Блог

Приведенный ниже шаблон ARM предназначен для создания следующих ресурсов:

 resource group
    - user managed identity
       - subscription level Contributor role assignment
  

В настоящее время развертывание завершается с ошибкой, "error": { "code": "ResourceGroupNotFound", "message": "Resource group 'rg-myproject-deploy' could not be found." } по-видимому, потому, что на этапе назначения роли, похоже, не соблюдаются dependsOn инструкции, которые должны обеспечить выполнение того, что это должно произойти только после создания группы ресурсов. Есть ли способ развернуть все эти ресурсы в одном шаблоне ARM?

 {
  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "projectName": {
      "type": "string",
      "defaultValue": "myproject",
      "maxLength": 11,
      "metadata": {
        "description": "The name of the project"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "westus2",
      "metadata": {
        "description": "The region were to deploy assets"
      }
    }
  },
  "variables": {
    "resourceGroupName": "[concat('rg-', parameters('projectName'), '-deploy')]",
    "managedIdentityName": "[concat('msi-', parameters('projectName'), '-deploy')]",
    "bootstrapRoleAssignmentId": "[guid(subscription().id, 'contributor')]",
    "contributorRoleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
    "managedIdentityId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', variables('resourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', variables('managedIdentityName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2019-10-01",
      "name": "[variables('resourceGroupName')]",
      "location": "[parameters('location')]",
      "properties": {}
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2019-10-01",
      "name": "deployment-assets-except-role-assignment",
      "resourceGroup": "[variables('resourceGroupName')]",
      "dependsOn": [
        "[resourceId('Microsoft.Resources/resourceGroups/', variables('resourceGroupName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {},
          "variables": {},
          "resources": [
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "name": "[variables('managedIdentityName')]",
              "apiVersion": "2018-11-30",
              "location": "[parameters('location')]"
            }
          ],
          "outputs": {}
        }
      }
    }
    ,
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2017-09-01",
      "name": "[variables('bootstrapRoleAssignmentId')]",
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/resourceGroups', variables('resourceGroupName'))]",
        "deployment-assets-except-role-assignment"
      ],
      "properties": {
        "roleDefinitionId": "[variables('contributorRoleDefinitionId')]",
        "principalId": "[reference(variables('managedIdentityId'), '2018-11-30').principalId]",
        "principalType": "ServicePrincipal",
        "scope": "[subscription().id]"
      }
    }
  ],
  "outputs": {}
}
  

Я думаю, вы столкнулись с этим:

https://bmoore-msft.blog/2020/07/26/resource-not-found-dependson-is-not-working/

Исправление оказалось немного сложнее, чем я думал, но подводя итог:

1. для вложенного развертывания, обеспечивающего MI, должна быть установлена оценка внутренней области
2. выведите principalId из этого развертывания и используйте его в своей ссылке (т. Е. не ссылайтесь напрямую)

Из-за # 1 я переместил некоторые вещи (параметры / переменные)

 {
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
      "projectName": {
        "type": "string",
        "defaultValue": "myproject",
        "maxLength": 11,
        "metadata": {
          "description": "The name of the project"
        }
      },
      "location": {
        "type": "string",
        "defaultValue": "westus2",
        "metadata": {
          "description": "The region were to deploy assets"
        }
      }
    },
    "variables": {
      "identityDeploymentName": "deployment-assets-except-role-assignment",
      "resourceGroupName": "[concat('rg-', parameters('projectName'), '-deploy')]",
      "managedIdentityName": "[concat('msi-', parameters('projectName'), '-deploy')]",
      "managedIdentityId": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', variables('resourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', variables('managedIdentityName'))]",
      "bootstrapRoleAssignmentId": "[guid(subscription().id, variables('contributorRoleDefinitionId'),variables('managedIdentityId'))]",
      "contributorRoleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
    },
    "resources": [
      {
        "type": "Microsoft.Resources/resourceGroups",
        "apiVersion": "2019-10-01",
        "name": "[variables('resourceGroupName')]",
        "location": "[parameters('location')]",
        "properties": {}
      },
      {
        "type": "Microsoft.Resources/deployments",
        "apiVersion": "2019-10-01",
        "name": "[variables('identityDeploymentName')]",
        "resourceGroup": "[variables('resourceGroupName')]",
        "dependsOn": [
          "[resourceId('Microsoft.Resources/resourceGroups', variables('resourceGroupName'))]"
        ],
        "properties": {
          "mode": "Incremental",
          "expressionEvaluationOptions":{
              "scope": "inner"
          },
          "parameters": {
              "location": {
                  "value": "[parameters('location')]" 
              },
              "managedIdentityName": {
                  "value": "[variables('managedIdentityName')]" 
              }
          },
          "template": {
            "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "parameters": {
                "location": {
                    "type": "string"
                },
                "managedIdentityName": {
                    "type": "string"
                }
            },
            "variables": {},
            "resources": [
              {
                "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
                "name": "[parameters('managedIdentityName')]",
                "apiVersion": "2018-11-30",
                "location": "[parameters('location')]"
              }
            ],
            "outputs": {
                "principalId": {
                    "type": "string",
                    "value": "[reference(parameters('managedIdentityName')).principalId]"
                }
            }
          }
        }
      }
      ,
      {
        "type": "Microsoft.Authorization/roleAssignments",
        "apiVersion": "2020-04-01-preview",
        "name": "[variables('bootstrapRoleAssignmentId')]",
        "dependsOn": [
          "[subscriptionResourceId('Microsoft.Resources/resourceGroups', variables('resourceGroupName'))]",
          "[variables('identityDeploymentName')]"
        ],
        "properties": {
          "roleDefinitionId": "[variables('contributorRoleDefinitionId')]",
          "principalId": "[reference(variables('identityDeploymentName')).outputs.principalId.value]",
          "principalType": "ServicePrincipal",
          "scope": "[subscription().id]"
        }
      }
    ]
  }