Hashtable into Get-AzResource -Tag $QueryTag returns results as if it's OR instead of AND

[nofate301]

Description

So I have a hashtable of tags and values that I know are on a virtual machine in the environment.

$QueryTags = @{"Technical:AlwaysPatch" = "yes"; "Technical:PatchingOwner" = "NamedPerson";"Technical:PatchingSchedule" = "Default"; "Technical:Environment" = "NONPROD"}

When I do Get-AzResource -Tag $QueryTags I get a response with all the resources in the subscription.

The problem is there's only one virtual machine in the subscription that has this combination of tags. Nothing in the documentation indicates that the -Tag parameter is an OR or AND function. I thought it would be an AND function like the query section from New-AzAutomationUpdateManagementAzureQuery.

Is there something I'm missing?

Script or Debug output

No response

Environment data

Name                           Value                                                                                                                                                                                                     
----                           -----                                                                                                                                                                                                     
PSVersion                      5.1.19041.1682                                                                                                                                                                                            
PSEdition                      Desktop                                                                                                                                                                                                   
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}                                                                                                                                                                                   
BuildVersion                   10.0.19041.1682                                                                                                                                                                                           
CLRVersion                     4.0.30319.42000                                                                                                                                                                                           
WSManStackVersion              3.0                                                                                                                                                                                                       
PSRemotingProtocolVersion      2.3                                                                                                                                                                                                       
SerializationVersion           1.1.0.1

Module versions

PS C:\WINDOWS\system32> Get-Module Az*

ModuleType Version    Name                                ExportedCommands                                                                                                                                                               
---------- -------    ----                                ----------------                                                                                                                                                               
Script     2.9.1      Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}                                                                                                       
Script     6.1.0      Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment...}

Error output

No response

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @josephkwchan, @jennyhunter-msft.

Issue Details

---

Description

So I have a hashtable of tags and values that I know are on a virtual machine in the environment.

$QueryTags = @{"Technical:AlwaysPatch" = "yes"; "Technical:PatchingOwner" = "NamedPerson";"Technical:PatchingSchedule" = "Default"; "Technical:Environment" = "NONPROD"}

When I do Get-AzResource -Tag $QueryTags I get a response with all the resources in the subscription.

The problem is there's only one virtual machine in the subscription that has this combination of tags. Nothing in the documentation indicates that the -Tag parameter is an OR or AND function. I thought it would be an AND function like the query section from New-AzAutomationUpdateManagementAzureQuery.

Is there something I'm missing?

Script or Debug output

No response

Environment data

Name                           Value                                                                                                                                                                                                     
----                           -----                                                                                                                                                                                                     
PSVersion                      5.1.19041.1682                                                                                                                                                                                            
PSEdition                      Desktop                                                                                                                                                                                                   
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}                                                                                                                                                                                   
BuildVersion                   10.0.19041.1682                                                                                                                                                                                           
CLRVersion                     4.0.30319.42000                                                                                                                                                                                           
WSManStackVersion              3.0                                                                                                                                                                                                       
PSRemotingProtocolVersion      2.3                                                                                                                                                                                                       
SerializationVersion           1.1.0.1

Module versions

PS C:\WINDOWS\system32> Get-Module Az*

ModuleType Version    Name                                ExportedCommands                                                                                                                                                               
---------- -------    ----                                ----------------                                                                                                                                                               
Script     2.9.1      Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}                                                                                                       
Script     6.1.0      Az.Resources                        {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment...}

Error output

No response

Author:	nofate301
Assignees:	-
Labels:	Service Attention, question, ARM - Core, customer-reported
Milestone:	-

[dingmeng-xue]

@nofate301 , your observation is correct. It is using ANY()/OR to filter results according to tags list from user. Modules implemented by different teams. Each team has different understanding. It's not easy to ask owner team to update it because there is no official standard and change will introduce breaking change to all users. Please let us know if you have further concern.

azure-powershell/src/Resources/ResourceManager/Implementation/Resource/GetAzureResourceCmdlet.cs

Lines 187 to 207 in c463245

	if (!string.IsNullOrEmpty(this.TagName) && !string.IsNullOrEmpty(this.TagValue))
	{
	result = result.Where(r => r.Tags != null &&
	r.Tags.Keys != null &&
	r.Tags.Keys.Where(k => string.Equals(k, this.TagName, StringComparison.OrdinalIgnoreCase))
	.Any(k => string.Equals(r.Tags[k], this.TagValue, StringComparison.OrdinalIgnoreCase)));
	}
	else if (!string.IsNullOrEmpty(this.TagName))
	{
	result = result.Where(r => r.Tags != null &&
	r.Tags.Keys != null &&
	r.Tags.Keys.Where(k => string.Equals(k, this.TagName, StringComparison.OrdinalIgnoreCase))
	.Any());
	}
	else if (!string.IsNullOrEmpty(this.TagValue))
	{
	result = result.Where(r => r.Tags != null &&
	r.Tags.Values != null &&
	r.Tags.Values.Where(v => string.Equals(v, this.TagValue, StringComparison.OrdinalIgnoreCase))
	.Any());
	}

[nofate301]

Thanks for the response @dingmeng-xue. It would be nice if there was an option for each so you could do both and not be stuck beholden to the whims of the team. It's especially frustrating because I had it working in an older version of the Az.Resources module. I'm hoping I can write something that can emulate this in the meantime.

[ArmaanMcleod]

Thanks for the response @dingmeng-xue. It would be nice if there was an option for each so you could do both and not be stuck beholden to the whims of the team. It's especially frustrating because I had it working in an older version of the Az.Resources module. I'm hoping I can write something that can emulate this in the meantime.

@nofate301 I think it would be good to include such an option. Maybe something like -FilterOperator, which can default to the current filtering behaviour, but allow a user to do -FilterOperator Any or -FilterOperator All. Often I'm wanting to do an All match, but I think flexibility here is better.

[ArmaanMcleod]

I've currently introduced this to Get-AzResourceGroup in this PR #20574. I guess if that gets merged and the filter operator option is adopted across more cmdlets then we can probably fix it with Get-AzResource as well.

I think it's a really straightforward way to solve the tagging inconsistency problem across all the cmdlets and will allow customers to filter resources with tags easier. The azure governance and cloud adoption guidelines also make use of tags alot, so we can make it easier with powershell as well. Some scenarios require filtering across all given tags, such as environment, cost centre, business unit etc. so including an All option is very beneficial.