localstack-azure-client: .bicepparam files that use readEnvironmentVariable() can't be deployed

Aberta
  • Algo errado?
#111 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
64/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
azure, typescript
Domínio
cloud, security

Direção de pesquisa

Start with child-env.ts to see how the Azure CLI environment allow-list is built, then read docs/AZURE.md and the tool description. Document that variables are not forwarded and .bicepparam files using readEnvironmentVariable() need inline --parameters, or explore a setting for explicitly forwarded variables while blocking Azure credential prefixes. Done means the limitation and supported behavior are clear, with any forwarding option preserving the stated credential restrictions.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

What happens

The Azure tool builds az's environment from an allow-list (child-env.ts). That's the right call for keeping az away from real Azure, but it also means a .bicepparam file that reads a value with readEnvironmentVariable() can't be deployed through the tool:

deployment group validate --resource-group local-rg --template-file bicep/main.bicep --parameters bicep/main.bicepparam

❌ Command Failed (exit 1)
ERROR: …/bicep/main.bicepparam(11,47) : Error BCP427: Environment variable "BACKEND_SECRET" does not exist and there's no default value set.

The api-management-function-app sample in localstack-azure-samples does this: its deploy.sh exports BACKEND_SECRET before calling az. Through the MCP tool there is no way to set it, so an agent has to drop the .bicepparam file and pass --template-file main.bicep --parameters backendSecret=…. That puts the secret in the agent's transcript.

Expected

At least, docs/AZURE.md and the tool description should say that the environment isn't forwarded and that .bicepparam files using readEnvironmentVariable() need inline --parameters instead.

A possible option is a setting that names extra variables to forward to az, while still refusing AZURE_*, ARM_* and MSI_*. That would also keep secrets out of tool-call arguments.

Context

  • MCP server 0.7.0 via npx
  • LocalStack Azure emulator 2026.11.0.dev501
  • Bicep 0.48.1
  • Azure CLI 2.70.0
Linguagem predominante
TypeScript
Estrelas
29
Forks
14
Merge médio
3d 16h
PRs com merge (30d)
18

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de localstack/localstack-mcp-server

Todas as issues de localstack/localstack-mcp-server

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.