Assign NSG to VNet subnet using Bicep template - azure

Question

I want to add an existing NSG to existing VNet subnet.
I tried doing it this way:
#description('Name of nsg')
param nsgName string
#description('Name of vnet')
param vnetName string
#description('Name of subnet')
param subnetName string
resource nsg 'Microsoft.Network/networkSecurityGroups#2022-01-01' existing = {
name: nsgName
}
resource subnet 'Microsoft.Network/virtualNetworks/subnets#2022-01-01' existing = {
name: '${vnetName}/${subnetName}'
}
resource nsgAttachment 'Microsoft.Network/virtualNetworks/subnets#2022-01-01' = {
name: '${vnetName}/${subnetName}'
properties: {
addressPrefix: subnet.properties.addressPrefix
networkSecurityGroup: {
id: nsg.id
}
}
}
Unfortunately, I can't pass the review/validation on Azure portal. It says that:
{"code":"InvalidTemplate","message":"Deployment template validation failed: 'Circular dependency detected on resource: '/subscriptions/xxxxxxxxx-02eaf5d20f25/resourceGroups/bicepRG/providers/Microsoft.Network/virtualNetworks/myVnetName/subnets/api'. Please see https://aka.ms/arm-template/#resources for usage details.'."}
How to assign a NSG to existing VNet subnet, or how to get rid of this Circular dependency error?

Answer 1

You will have to use a module to update the subnet:
// update-subnet.bicep
param vnetName string
param subnetName string
param properties object
resource subnet 'Microsoft.Network/virtualNetworks/subnets#2022-01-01' = {
name: '${vnetName}/${subnetName}'
properties: properties
}
From you main, you could invoke it like that:
// main.bicep
param nsgName string = 'thomastest-nsg2'
param vnetName string = 'thomastest-vnet'
param subnetName string = 'subnet1'
// Reference to nsg
resource nsg 'Microsoft.Network/networkSecurityGroups#2022-01-01' existing = {
name: nsgName
}
// Get existing subnet
resource subnet 'Microsoft.Network/virtualNetworks/subnets#2022-01-01' existing = {
name: '${vnetName}/${subnetName}'
}
// Update the subnet
module attachNsg 'update-subnet.bicep' = {
name: 'update-vnet-subnet-${vnetName}-${subnetName}'
params: {
vnetName: vnetName
subnetName: subnetName
// Update the nsg
properties: union(subnet.properties, {
networkSecurityGroup: {
id: nsg.id
}
})
}
}