@intentius/chant-lexicon-azure 0.124.34 → 0.124.35

package/src/api/read-client.ts

@@ -19,6 +19,7 @@
  * token acquisition lands here.
  */
 
+import { armResourcePath } from "../arm-type";
 import { type AzHttp } from "../op/activities/az-apply";
 
 /** Default ARM host, matching the applier's. */
@@ -78,7 +79,7 @@ export function armResourceReadUrl(
 ): string {
   const base = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
   const subscription = options.subscriptionId ?? DEFAULT_SUBSCRIPTION;
-  return `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+  return `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/providers/${armResourcePath(type, name)}?api-version=${apiVersion}`;
 }
 
 /**

package/src/arm-type.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from "vitest";
+import { armResourcePath, armType } from "./arm-type";
+import { azureSerializer } from "./serializer";
+import { armResourceReadUrl } from "./api/read-client";
+import { armResourceUrl, evalArmString, type ArmEvalCtx } from "./op/activities/az-apply";
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+import { AttrRef } from "@intentius/chant";
+
+describe("ARM child types (#4230)", () => {
+  test("armType joins child types with /", () => {
+    expect(armType("Microsoft.Network/virtualNetworks_subnets")).toBe("Microsoft.Network/virtualNetworks/subnets");
+    expect(armType("Microsoft.Storage/storageAccounts_blobServices_containers")).toBe("Microsoft.Storage/storageAccounts/blobServices/containers");
+    expect(armType("Microsoft.Storage/storageAccounts")).toBe("Microsoft.Storage/storageAccounts");
+    expect(armType("Microsoft.Network/virtualNetworks/subnets")).toBe("Microsoft.Network/virtualNetworks/subnets");
+  });
+
+  test("armResourcePath interleaves type and name segments", () => {
+    expect(armResourcePath("Microsoft.Network/virtualNetworks_subnets", "vnet/apps")).toBe("Microsoft.Network/virtualNetworks/vnet/subnets/apps");
+    expect(armResourcePath("Microsoft.Storage/storageAccounts", "st1")).toBe("Microsoft.Storage/storageAccounts/st1");
+  });
+
+  test("a Subnet serializes type, resourceId and dependsOn with /", () => {
+    const entity = (entityType: string, props: Record<string, unknown>): Declarable =>
+      ({ [DECLARABLE_MARKER]: true, lexicon: "azure", entityType, kind: "resource", props }) as unknown as Declarable;
+    const subnet = entity("Microsoft.Network/virtualNetworks_subnets", { name: "vnet/apps", addressPrefix: "10.0.1.0/24" });
+    const subnetId = new AttrRef(subnet, "id");
+    subnetId._setLogicalName("apps");
+    const nic = entity("Microsoft.Network/networkInterfaces", { name: "nic1", subnetId });
+    const entities = new Map<string, Declarable>([["apps", subnet], ["nic", nic]]);
+    const template = JSON.parse(azureSerializer.serialize(entities) as string);
+    const [s, n] = template.resources;
+    expect(s.type).toBe("Microsoft.Network/virtualNetworks/subnets");
+    expect(JSON.stringify(template)).not.toContain("virtualNetworks_subnets");
+    expect(n.properties.subnetId).toBe("[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]");
+    expect(n.dependsOn).toContain("[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]");
+  });
+
+  test("apply and read address a child resource by its ARM path", async () => {
+    const ctx = { base: "http://x", subscriptionId: "sub-1", resourceGroup: "rg", location: "eastus", deployed: new Map() } as unknown as ArmEvalCtx;
+    const want = "http://x/subscriptions/sub-1/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/apps?api-version=2024-01-01";
+    expect(await armResourceUrl({ type: "Microsoft.Network/virtualNetworks/subnets", apiVersion: "2024-01-01", name: "vnet/apps" }, ctx)).toBe(want);
+    expect(armResourceReadUrl({ endpoint: "http://x", subscriptionId: "sub-1", resourceGroup: "rg" }, "Microsoft.Network/virtualNetworks_subnets", "vnet/apps", "2024-01-01")).toBe(want);
+    expect(await evalArmString("[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]", ctx)).toBe(
+      "/subscriptions/sub-1/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/apps",
+    );
+  });
+});

package/src/arm-type.ts

@@ -0,0 +1,31 @@
+/**
+ * ARM resource types as ARM spells them (#4230).
+ *
+ * The lexicon's entity types come from the ARM schema ids, which join a child
+ * type to its parent with `_` (`Microsoft.Network/virtualNetworks_subnets`).
+ * ARM itself joins them with `/` (`Microsoft.Network/virtualNetworks/subnets`),
+ * in a template's `type`, in `resourceId()` and in the resource URL. Resource
+ * type segments never contain `_`, so every `_` after the namespace is a
+ * child separator.
+ */
+
+/** `Microsoft.Network/virtualNetworks_subnets` → `Microsoft.Network/virtualNetworks/subnets`. Idempotent. */
+export function armType(entityType: string): string {
+  const slash = entityType.indexOf("/");
+  if (slash < 0) return entityType;
+  return entityType.slice(0, slash + 1) + entityType.slice(slash + 1).replace(/_/g, "/");
+}
+
+/**
+ * The provider-relative path of one resource: each type segment followed by
+ * its name segment, as ARM's `resourceId()` builds it.
+ * `('Microsoft.Network/virtualNetworks/subnets', 'vnet/apps')` →
+ * `Microsoft.Network/virtualNetworks/vnet/subnets/apps`. A name with fewer
+ * segments than the type has kinds is joined as given.
+ */
+export function armResourcePath(type: string, name: string): string {
+  const [namespace, ...kinds] = armType(type).split("/");
+  const names = name.split("/");
+  if (kinds.length <= 1 || names.length !== kinds.length) return `${armType(type)}/${name}`;
+  return [namespace, ...kinds.flatMap((kind, i) => [kind, names[i]])].join("/");
+}

package/src/deep-observe.test.ts

@@ -18,7 +18,7 @@ const stubArmFetch = (response: { status: number; text: string }): void => {
 };
 
 const { azurePlugin } = await import("./plugin");
-const { observeResourcesDeepAzure, azureDeepNormalizationHooks } = await import("./deep-observe");
+const { observeResourcesDeepAzure, azureDeepNormalizationHooks, userAssignedIdentityKey } = await import("./deep-observe");
 const { deepDiffForLexicon } = await import("@intentius/chant/lifecycle/deep-observe");
 const { normalizeDeepObservation, normalizeDeepProperties, UNRESOLVED } = await import("@intentius/chant/deep-observation");
 
@@ -599,3 +599,58 @@ describe("end to end: declared + mutated live + baseline (#1086)", () => {
     ).toBe(true);
   });
 });
+
+describe("user-assigned identities (#4231)", () => {
+  const identityId = (name: string) =>
+    `/subscriptions/sub/resourceGroups/Prod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${name}`;
+  const declared = entities({
+    web: {
+      entityType: "Microsoft.App/containerApps",
+      props: {
+        name: "web",
+        location: "eastus",
+        identity: {
+          type: "UserAssigned",
+          userAssignedIdentities: { "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'appId')]": {} },
+        },
+      },
+    },
+  });
+  const liveWith = (name: string) =>
+    stubArmFetch(ok({
+      id: "/subscriptions/sub/resourceGroups/prod/providers/Microsoft.App/containerApps/web",
+      name: "web",
+      location: "eastus",
+      identity: {
+        type: "UserAssigned",
+        principalId: "p0",
+        tenantId: "t0",
+        userAssignedIdentities: { [identityId(name)]: { principalId: "p1", clientId: "c1" } },
+      },
+      properties: { provisioningState: "Succeeded" },
+    }));
+
+  test("both spellings of an identity's key are one key", () => {
+    expect(userAssignedIdentityKey("[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'appId')]")).toBe(
+      "microsoft.managedidentity/userassignedidentities/appid",
+    );
+    expect(userAssignedIdentityKey(identityId("appId"))).toBe("microsoft.managedidentity/userassignedidentities/appid");
+    expect(userAssignedIdentityKey("plain")).toBe("plain");
+  });
+
+  test("an applied identity is not drift", async () => {
+    liveWith("appId");
+    const result = await deepDiffForLexicon(azurePlugin, { environment: "prod", buildOutput: "", entities: declared });
+    expect(result.drifted).toEqual([]);
+    expect(result.unclaimed).toEqual([]);
+    expect(result.unchanged).toEqual(["web"]);
+  });
+
+  test("a different identity attached live is drift", async () => {
+    liveWith("otherId");
+    const result = await deepDiffForLexicon(azurePlugin, { environment: "prod", buildOutput: "", entities: declared });
+    expect(result.drifted.map((d) => d.changes.map((c) => `${c.kind} ${c.path}`))).toEqual([
+      ["absent identity.userAssignedIdentities.microsoft.managedidentity/userassignedidentities/appid"],
+    ]);
+  });
+});

package/src/deep-observe.ts

@@ -240,6 +240,45 @@ function lastSegment(pattern: string): string {
   return dot === -1 ? withoutIndex : withoutIndex.slice(dot + 1);
 }
 
+/**
+ * The canonical key for one entry of `identity.userAssignedIdentities`
+ * (#4231): `<type>/<name>` lowercased, from either spelling. Source keys the
+ * map by `[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities',
+ * 'appId')]`; ARM answers with the evaluated id, `/subscriptions/.../providers/
+ * Microsoft.ManagedIdentity/userAssignedIdentities/appId`, in whatever case it
+ * stored. A key in neither form is left as it is.
+ */
+export function userAssignedIdentityKey(key: string): string {
+  const expr = /^\[\s*resourceId\(\s*'([^']+)'\s*,\s*'([^']+)'\s*\)\s*\]$/.exec(key);
+  if (expr) return `${expr[1]}/${expr[2]}`.toLowerCase();
+  const at = key.toLowerCase().lastIndexOf("/providers/");
+  if (at !== -1 && key.startsWith("/subscriptions/")) return key.slice(at + "/providers/".length).toLowerCase();
+  return key;
+}
+
+/**
+ * Rekey `identity.userAssignedIdentities` by {@link userAssignedIdentityKey},
+ * on a copy, and drop the `principalId` and `clientId` ARM fills in on each
+ * entry. Nobody declares them, and pruning them later would leave the live
+ * entry empty and gone, where source declares `{}`.
+ */
+function rekeyUserAssignedIdentities(tree: Record<string, unknown>): Record<string, unknown> {
+  const identity = tree.identity;
+  if (!identity || typeof identity !== "object" || Array.isArray(identity)) return tree;
+  const assigned = (identity as Record<string, unknown>).userAssignedIdentities;
+  if (!assigned || typeof assigned !== "object" || Array.isArray(assigned)) return tree;
+  const rekeyed: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(assigned)) {
+    let entry = v;
+    if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+      const { principalId: _p, clientId: _c, ...rest } = entry as Record<string, unknown>;
+      entry = rest;
+    }
+    rekeyed[userAssignedIdentityKey(k)] = entry;
+  }
+  return { ...tree, identity: { ...(identity as Record<string, unknown>), userAssignedIdentities: rekeyed } };
+}
+
 /**
  * The azure lexicon's noise rules. Three classes, same as AWS: server-
  * populated fields (by name, unconditional), controller-injected boilerplate
@@ -250,6 +289,8 @@ function lastSegment(pattern: string): string {
  * since it is a plain object; only the *default empty map* needs a rule here).
  */
 export const azureDeepNormalizationHooks: DeepNormalizationHooks = {
+  prepare: (tree) => rekeyUserAssignedIdentities(tree),
+
   prune(node: DeepNode): boolean {
     const name = lastSegment(node.pattern);
     if (AZURE_READ_ONLY_NAMES.has(name) || AZURE_UNCONDITIONAL_PRUNE_NAMES.has(name)) return true;

package/src/graph-edges.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect } from "vitest";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { azureGraphEdges } from "./graph-edges";
+import { azureSerializer } from "./serializer";
+import { ListKeys, Reference, ResourceId } from "./intrinsics";
+
+function makeEntity(entityType: string, props: Record<string, unknown> = {}): any {
+  return { [DECLARABLE_MARKER]: true, lexicon: "azure", entityType, kind: "resource", props };
+}
+
+/** behold's three-cloud Azure member, cut down to the two references in #4232. */
+function threeCloud(): Map<string, any> {
+  const entities = new Map<string, any>();
+  entities.set("logs", makeEntity("Microsoft.OperationalInsights/workspaces", { name: "logs", location: "eastus" }));
+  entities.set("appIdentity", makeEntity("Microsoft.ManagedIdentity/userAssignedIdentities", { name: "app-id", location: "eastus" }));
+  entities.set("env", makeEntity("Microsoft.App/managedEnvironments", {
+    name: "env",
+    location: "eastus",
+    appLogsConfiguration: {
+      destination: "log-analytics",
+      logAnalyticsConfiguration: {
+        customerId: "[reference(resourceId('Microsoft.OperationalInsights/workspaces', 'logs')).customerId]",
+        sharedKey: ListKeys(ResourceId("Microsoft.OperationalInsights/workspaces", "logs"), "2022-10-01"),
+      },
+    },
+  }));
+  entities.set("app", makeEntity("Microsoft.App/containerApps", {
+    name: "web",
+    location: "eastus",
+    identity: {
+      type: "UserAssigned",
+      userAssignedIdentities: {
+        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'app-id')]": {},
+      },
+    },
+    managedEnvironmentId: Reference("env"),
+  }));
+  return entities;
+}
+
+describe("azureGraphEdges (#4232)", () => {
+  it("draws env -> logs from reference(resourceId(...)) and listKeys(...)", () => {
+    const refs = azureGraphEdges(threeCloud())!.references;
+    expect(refs).toContainEqual({ from: "env", to: "logs", kind: "ref", viaAttr: "appLogsConfiguration" });
+    expect(refs.filter((r) => r.from === "env" && r.to === "logs")).toHaveLength(1);
+  });
+
+  it("draws app -> identity from a resourceId(...) object key, by the identity's ARM name", () => {
+    const refs = azureGraphEdges(threeCloud())!.references;
+    expect(refs).toContainEqual({ from: "app", to: "appIdentity", kind: "ref", viaAttr: "identity" });
+    expect(refs).toContainEqual({ from: "app", to: "env", kind: "ref", viaAttr: "managedEnvironmentId" });
+  });
+
+  it("agrees with the dependsOn the serializer writes", () => {
+    const entities = threeCloud();
+    const template = JSON.parse(azureSerializer.serialize(entities) as string);
+    const keyOfName = new Map<string, string>([["logs", "logs"], ["app-id", "appIdentity"], ["env", "env"], ["web", "app"]]);
+    const fromTemplate = new Set<string>();
+    for (const r of template.resources) {
+      for (const dep of r.dependsOn ?? []) {
+        const name = /'([^']+)'\)\]$/.exec(dep)![1];
+        fromTemplate.add(`${keyOfName.get(r.name)}->${keyOfName.get(name)}`);
+      }
+    }
+    const fromGraph = new Set(azureGraphEdges(entities)!.references.map((r) => `${r.from}->${r.to}`));
+    expect(fromGraph).toEqual(fromTemplate);
+    expect(fromGraph).toEqual(new Set(["env->logs", "app->appIdentity", "app->env"]));
+  });
+
+  it("matches a child resource by name whichever way its type is spelled, and links it to its parent", () => {
+    const entities = new Map<string, any>();
+    entities.set("vnet", makeEntity("Microsoft.Network/virtualNetworks", { name: "vnet", location: "eastus" }));
+    entities.set("apps", makeEntity("Microsoft.Network/virtualNetworks_subnets", { name: "vnet/apps" }));
+    entities.set("nic", makeEntity("Microsoft.Network/networkInterfaces", {
+      name: "nic",
+      location: "eastus",
+      ipConfigurations: [{ name: "ip", properties: { subnet: { id: "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]" } } }],
+    }));
+    const refs = azureGraphEdges(entities)!.references;
+    expect(refs).toContainEqual({ from: "nic", to: "apps", kind: "ref", viaAttr: "ipConfigurations" });
+    expect(refs).toContainEqual({ from: "apps", to: "vnet", kind: "ref", viaAttr: "name" });
+  });
+
+  it("leaves out a name nothing declares, and returns nothing without azure resources", () => {
+    const entities = new Map<string, any>();
+    entities.set("app", makeEntity("Microsoft.Web/sites", {
+      name: "site",
+      location: "eastus",
+      serverFarmId: "[resourceId('Microsoft.Web/serverfarms', 'existing-plan')]",
+    }));
+    expect(azureGraphEdges(entities)).toBeUndefined();
+    expect(azureGraphEdges(new Map())).toBeUndefined();
+  });
+});

package/src/graph-edges.ts

@@ -0,0 +1,72 @@
+/**
+ * References written as ARM expressions, as graph edges (#4232).
+ *
+ * `chant graph` draws an edge for every `AttrRef` it finds in props, but an
+ * Azure reference is often an expression instead: `reference(resourceId(...))
+ * .customerId` and `listKeys(...)` for a value the resource has no attribute
+ * for, or a `resourceId(...)` used as an object key, which is how
+ * `identity.userAssignedIdentities` names an identity. The serializer already
+ * reads these to write `dependsOn` (./serializer.ts), with
+ * `findArmResourceRefs` (./lint/post-synth/arm-refs.ts). This module runs the
+ * same extraction over each prop as the template writes it and reports each
+ * reference to a declared resource through the plugin's `graphEdges` hook.
+ *
+ * A reference matches by resource name, never by type, as the serializer's
+ * inference does. A name nothing in the project declares is left out: it is
+ * an existing resource the template reads, not a dangling reference.
+ */
+
+import type { Declarable } from "@intentius/chant/declarable";
+import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import type { LexiconGraphEdges, LexiconGraphReference } from "@intentius/chant/graph-ir";
+import { findArmResourceRefs } from "./lint/post-synth/arm-refs";
+import { armResourceName, toArmValue } from "./serializer";
+
+function isAzureResource(entity: Declarable): boolean {
+  return entity.lexicon === "azure" && isResourceDeclarable(entity) && !isPropertyDeclarable(entity);
+}
+
+export function azureGraphEdges(entities: ReadonlyMap<string, Declarable>): LexiconGraphEdges | undefined {
+  const entityNames = new Map<Declarable, string>();
+  for (const [key, entity] of entities) entityNames.set(entity, key);
+
+  // Template name -> entity key, for the resources whose name is a literal.
+  const byArmName = new Map<string, string>();
+  for (const [key, entity] of entities) {
+    if (!isAzureResource(entity)) continue;
+    const name = armResourceName(entity, key, entityNames);
+    if (typeof name === "string") byArmName.set(name, key);
+  }
+  if (byArmName.size === 0) return undefined;
+
+  const references: LexiconGraphReference[] = [];
+  const seen = new Set<string>();
+  const add = (from: string, to: string | undefined, viaAttr: string): void => {
+    if (!to || to === from) return;
+    const id = `${from}\0${to}\0${viaAttr}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    references.push({ from, to, kind: "ref", viaAttr });
+  };
+
+  for (const [key, entity] of entities) {
+    if (!isAzureResource(entity)) continue;
+    const props = (entity as { props?: unknown }).props;
+    if (props && typeof props === "object") {
+      for (const [attr, value] of Object.entries(props as Record<string, unknown>)) {
+        if (value === undefined) continue;
+        for (const ref of findArmResourceRefs(toArmValue(value, entityNames))) {
+          add(key, byArmName.get(ref), attr);
+        }
+      }
+    }
+    // A child resource named "vnet/subnet" depends on "vnet", as the
+    // serializer infers for dependsOn.
+    const name = armResourceName(entity, key, entityNames);
+    if (typeof name === "string" && name.includes("/")) {
+      add(key, byArmName.get(name.split("/")[0]), "name");
+    }
+  }
+
+  return references.length > 0 ? { references } : undefined;
+}

package/src/lint/post-synth/arm-refs.ts

@@ -56,6 +56,8 @@ export function parseArmTemplate(output: string | { primary: string }): ArmTempl
  * - [reference('myStorage')]
  * - [reference('myStorage').primaryEndpoints.blob]
  *
+ * Object keys are read as well as values.
+ *
  * Returns the set of resource names found in these references.
  */
 export function findArmResourceRefs(value: unknown): Set<string> {
@@ -121,7 +123,10 @@ function walkArmValue(value: unknown, refs: Set<string>): void {
 
   if (typeof value === "object") {
     const obj = value as Record<string, unknown>;
-    for (const val of Object.values(obj)) {
+    for (const [key, val] of Object.entries(obj)) {
+      // A key can be an expression too: a user-assigned identity is named by
+      // its resource ID as the key of identity.userAssignedIdentities.
+      walkArmValue(key, refs);
       walkArmValue(val, refs);
     }
   }

package/src/op/activities/az-apply.test.ts

@@ -149,6 +149,38 @@ describe("armResourceUrl / armResourceBody (#707)", () => {
       tags: { "managed-by": "chant" },
     });
   });
+
+  test("body keeps identity, zones, plan, extendedLocation and managedBy, keys evaluated (#4231)", async () => {
+    const app: ArmResource = {
+      type: "Microsoft.App/containerApps",
+      apiVersion: "2024-03-01",
+      name: "web",
+      location: "[resourceGroup().location]",
+      identity: {
+        type: "UserAssigned",
+        userAssignedIdentities: { "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'appId')]": {} },
+      },
+      zones: ["1"],
+      plan: { name: "p1", publisher: "pub", product: "prod" },
+      extendedLocation: { type: "EdgeZone", name: "edge1" },
+      managedBy: "[resourceId('Microsoft.Web/sites', 'owner')]",
+      properties: {},
+    };
+    expect(await armResourceBody(app, ctx())).toEqual({
+      location: "eastus",
+      properties: {},
+      identity: {
+        type: "UserAssigned",
+        userAssignedIdentities: {
+          "/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/appId": {},
+        },
+      },
+      zones: ["1"],
+      plan: { name: "p1", publisher: "pub", product: "prod" },
+      extendedLocation: { type: "EdgeZone", name: "edge1" },
+      managedBy: "/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Web/sites/owner",
+    });
+  });
 });
 
 describe("azApply flow (#707)", () => {

package/src/op/activities/az-apply.ts

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { armResourcePath } from "../../arm-type";
 import { createHash } from "node:crypto";
 import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 import { AZURE_TAG_OWNERSHIP_KEYS } from "../../ownership";
@@ -25,6 +26,11 @@ export interface ArmResource {
   sku?: unknown;
   kind?: unknown;
   tags?: Record<string, string>;
+  identity?: unknown;
+  zones?: unknown;
+  plan?: unknown;
+  extendedLocation?: unknown;
+  managedBy?: unknown;
   dependsOn?: unknown;
 }
 
@@ -71,13 +77,17 @@ export async function evalArmString(s: string, ctx: ArmEvalCtx): Promise<unknown
   return new ArmExpr(s.slice(1, -1), ctx).parse();
 }
 
-/** Recursively evaluate every string in a value against the ARM context. */
+/**
+ * Recursively evaluate every string in a value against the ARM context,
+ * object keys included: ARM evaluates a property name too, and
+ * `identity.userAssignedIdentities` is keyed by `[resourceId(...)]` (#4231).
+ */
 export async function evalArm(value: unknown, ctx: ArmEvalCtx): Promise<unknown> {
   if (typeof value === "string") return evalArmString(value, ctx);
   if (Array.isArray(value)) return Promise.all(value.map((v) => evalArm(v, ctx)));
   if (value && typeof value === "object") {
     const out: Record<string, unknown> = {};
-    for (const [k, v] of Object.entries(value)) out[k] = await evalArm(v, ctx);
+    for (const [k, v] of Object.entries(value)) out[String(await evalArmString(k, ctx))] = await evalArm(v, ctx);
     return out;
   }
   return value;
@@ -151,7 +161,7 @@ class ArmExpr {
         return { subscriptionId: this.ctx.subscriptionId, id: `/subscriptions/${this.ctx.subscriptionId}` };
       case "resourceId":
         // resourceId('Microsoft.X/y', 'name'[, 'child']) → the resource-id path.
-        return `/subscriptions/${this.ctx.subscriptionId}/resourceGroups/${this.ctx.resourceGroup}/providers/${args.map(String).join("/")}`;
+        return `/subscriptions/${this.ctx.subscriptionId}/resourceGroups/${this.ctx.resourceGroup}/providers/${armResourcePath(String(args[0]), args.slice(1).map(String).join("/"))}`;
       case "reference": {
         // reference('name') → the runtime `properties` of an already-applied resource.
         const dep = this.ctx.deployed.get(String(args[0]));
@@ -260,17 +270,23 @@ export function orderArmResources(resources: ArmResource[]): ArmResource[] {
 /** The ARM resource-ID PUT URL for a resource (name expression evaluated). */
 export async function armResourceUrl(resource: ArmResource, ctx: ArmEvalCtx): Promise<string> {
   const name = await evalArmString(resource.name, ctx);
-  return `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${resource.type}/${name}?api-version=${resource.apiVersion}`;
+  return `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(resource.type, String(name))}?api-version=${resource.apiVersion}`;
 }
 
-/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. */
+/**
+ * The top-level ARM resource fields a PUT takes beside `location` (#4231). A
+ * field missing here is dropped from the body, which is how a declared
+ * `identity` came back absent.
+ */
+const ARM_BODY_FIELDS = ["properties", "sku", "kind", "tags", "identity", "zones", "plan", "extendedLocation", "managedBy"] as const;
+
+/** The ARM resource PUT body: `location` and {@link ARM_BODY_FIELDS}, expressions evaluated. */
 export async function armResourceBody(resource: ArmResource, ctx: ArmEvalCtx): Promise<Record<string, unknown>> {
   const body: Record<string, unknown> = {};
   if (resource.location) body.location = await evalArmString(resource.location, ctx);
-  if (resource.properties !== undefined) body.properties = await evalArm(resource.properties, ctx);
-  if (resource.sku !== undefined) body.sku = await evalArm(resource.sku, ctx);
-  if (resource.kind !== undefined) body.kind = await evalArm(resource.kind, ctx);
-  if (resource.tags !== undefined) body.tags = await evalArm(resource.tags, ctx);
+  for (const field of ARM_BODY_FIELDS) {
+    if (resource[field] !== undefined) body[field] = await evalArm(resource[field], ctx);
+  }
   return body;
 }
 
@@ -454,7 +470,7 @@ export async function deleteArmResource(
   http: AzHttp = defaultHttp,
   signal?: AbortSignal,
 ): Promise<{ type: string; name: string; deleted: boolean }> {
-  const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+  const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(type, name)}?api-version=${apiVersion}`;
   const res = await http("DELETE", url, undefined, signal);
   if (res.status === 404) return { type, name, deleted: false };
   if (res.status >= 300) throw new Error(`${type} ${name} delete failed (${res.status}): ${res.text}`);

package/src/plugin.ts

@@ -15,6 +15,7 @@ import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { moduleSourceDir } from "@intentius/chant/module-source";
 import { azureSerializer } from "./serializer";
+import { azureGraphEdges } from "./graph-edges";
 import { hardcodedLocationRule } from "./lint/rules/hardcoded-location";
 import { storageHttpsRule } from "./lint/rules/storage-https";
 import { nsgWildcardRule } from "./lint/rules/nsg-wildcard";
@@ -37,6 +38,8 @@ export const azurePlugin: LexiconPlugin = {
   emulator: FLOCI_AZ_EMULATOR,
   auditCatalog: () => azureAuditCatalog,
   serializer: azureSerializer,
+  // References written as ARM expressions (resourceId, reference, listKeys) as graph edges (#4232).
+  graphEdges: (entities) => azureGraphEdges(entities),
 
   lintRules(): LintRule[] {
     return [hardcodedLocationRule, storageHttpsRule, nsgWildcardRule];

package/src/serializer.ts

@@ -10,6 +10,7 @@
  * - parameters, outputs sections
  */
 
+import { armType } from "./arm-type";
 import type { Declarable, CoreParameter } from "@intentius/chant/declarable";
 import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
@@ -194,7 +195,7 @@ function entityNamed(entityNames: Map<Declarable, string>, name: string): Declar
 function armResourceId(entityNames: Map<Declarable, string>, name: string): string {
   const entity = entityNamed(entityNames, name);
   const { args } = armNameArgs(entity, name);
-  return entity ? `resourceId('${entity.entityType}', ${args})` : `resourceId(${args})`;
+  return entity ? `resourceId('${armType(entity.entityType)}', ${args})` : `resourceId(${args})`;
 }
 
 /**
@@ -259,10 +260,24 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return proto === Object.prototype || proto === null;
 }
 
-function toArmValue(value: unknown, entityNames: Map<Declarable, string>): unknown {
+/** A prop value as the template writes it: references become bracket expressions. */
+export function toArmValue(value: unknown, entityNames: Map<Declarable, string>): unknown {
   return walkValue(value, entityNames, armVisitor(entityNames));
 }
 
+/**
+ * The name a resource takes in the template: its `name` prop, or the entity
+ * key when it sets none. `findArmResourceRefs` reports references by this
+ * name, so the dependsOn inference below and the graph edges
+ * (./graph-edges.ts) both resolve a reference through it.
+ */
+export function armResourceName(entity: Declarable, key: string, entityNames: Map<Declarable, string>): unknown {
+  const props = isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null
+    ? entity.props as Record<string, unknown>
+    : undefined;
+  return props?.name !== undefined ? toArmValue(props.name, entityNames) : key;
+}
+
 /**
  * Serialize entities into an ARM template object.
  */
@@ -291,7 +306,7 @@ function serializeToTemplate(
     } else if (isChildProject(entity)) {
       emittedTypes.push("Microsoft.Resources/deployments");
     } else if (!isPropertyDeclarable(entity)) {
-      emittedTypes.push(entity.entityType);
+      emittedTypes.push(armType(entity.entityType));
     }
   }
   const templateScope = pinnedScope ?? resolveTemplateScope(emittedTypes);
@@ -369,9 +384,9 @@ function serializeToTemplate(
       const apiVersion = (typeof attrs0?.apiVersion === "string") ? attrs0.apiVersion : getApiVersion(resourceType);
 
       const resource: ArmResource = {
-        type: resourceType,
+        type: armType(resourceType),
         apiVersion,
-        name: name,
+        name: armResourceName(entity, name, entityNames) as string,
       };
 
       // Extract all props
@@ -386,7 +401,7 @@ function serializeToTemplate(
             // Hoist to resource level
             (resource as unknown as Record<string, unknown>)[key] = toArmValue(value, entityNames);
           } else if (key === "name") {
-            resource.name = toArmValue(value, entityNames) as string;
+            // Set above by armResourceName.
           } else if (key === "properties" && isPlainObject(value)) {
             // The generated types take ARM's own `properties` object, so
             // merge it, not nest it (#4183).