Related
I am trying to create a deployment template that creates a resource group and a VM with the necessary resources within it. The resources in their own deploymentTemplate deploy just fine. But in the subscriptionDeploymentTemplate I get the following error (in validation):
{
"code": "InvalidTemplate",
"message": "Deployment template validation failed: 'The resource 'Microsoft.Network/networkInterfaces/Assessment-NetInterfacescrobp34x4564' is not defined in the template. Please see https://aka.ms/arm-template for usage details.'."
}
After a lot of googling I have not found a solution that works in my case. I would appreciate any help.
The template:
"$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"rgName": {
"type": "string"
}
},
"variables": {
"rgLocation": "westeurope",
"vm_id": "[concat('AssessmentVM', uniquestring(deployment().name))]",
"location": "westeurope",
"vnet_id": "[concat('Assessment-Vnet', uniquestring(deployment().name))]",
"nic_id": "[concat('Assessment-NetInterface', uniquestring(deployment().name))]",
"publicIP_id": "[concat('AssessmentVM-ip', uniquestring(deployment().name))]",
"nsg_id": "[concat('AssessmentVM-nsg', uniquestring(deployment().name))]",
"vmImage_id": "/subscriptions/x/resourceGroups/AssessmentCase_Snapshot/providers/Microsoft.Compute/galleries/AssessmentVM_Images/images/AssessmentVM/versions/0.0.1"
},
"resources": [
{
"type": "Microsoft.Resources/resourceGroups",
"apiVersion": "2021-04-01",
"name": "[parameters('rgName')]",
"location": "[variables('rgLocation')]",
"properties": {}
},
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2021-04-01",
"name": "assessmentDeployment",
"resourceGroup": "[parameters('rgName')]",
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups/', parameters('rgName'))]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"variables": {},
"resources": [
{
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2020-05-01",
"name": "[variables('nsg_id')]",
"location": "[variables('location')]",
"properties": {
"securityRules": [
{
"name": "RDP",
"properties": {
"protocol": "TCP",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 300,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
]
}
},
{
"type": "Microsoft.Network/publicIPAddresses",
"apiVersion": "2020-05-01",
"name": "[variables('publicIP_id')]",
"location": "[variables('location')]",
"sku": {
"name": "Basic"
},
"properties": {
"publicIPAddressVersion": "IPv4",
"publicIPAllocationMethod": "Dynamic",
"idleTimeoutInMinutes": 4,
"ipTags": []
}
},
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2020-05-01",
"name": "[variables('vnet_id')]",
"location": "[variables('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.1.4.0/24"
]
},
"subnets": [
{
"name": "default",
"properties": {
"addressPrefix": "10.1.4.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
],
"virtualNetworkPeerings": [],
"enableDdosProtection": false
}
},
{
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2019-07-01",
"name": "[variables('vm_id')]",
"location": "[variables('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/networkInterfaces', variables('nic_id'))]"
],
"properties": {
"hardwareProfile": {
"vmSize": "Standard_D4s_v3"
},
"storageProfile": {
"imageReference": {
"id": "[variables('vmImage_id')]"
},
"osDisk": {
"createOption": "FromImage"
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nic_id'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": false
}
},
"licenseType": "Windows_Client"
}
},
{
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"apiVersion": "2020-05-01",
"name": "[concat(variables('nsg_id'), '/RDP')]",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsg_id'))]"
],
"properties": {
"protocol": "TCP",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 300,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2020-05-01",
"name": "[concat(variables('vnet_id'), '/default')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', variables('vnet_id'))]"
],
"properties": {
"addressPrefix": "10.1.4.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"type": "Microsoft.Network/networkInterfaces",
"apiVersion": "2020-05-01",
"name": "[variables('nic_id')]",
"location": "[variables('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIP_id'))]",
"[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnet_id'), 'default')]",
"[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsg_id'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAddress": "10.1.4.4",
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIP_id'))]"
},
"subnet": {
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnet_id'), 'default')]"
},
"primary": true,
"privateIPAddressVersion": "IPv4"
}
}
],
"dnsSettings": {
"dnsServers": []
},
"enableAcceleratedNetworking": false,
"enableIPForwarding": false,
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsg_id'))]"
}
}
}
]
}
}
}
],
"outputs": {}
}
The problem was the resourceId function which was in the wrong scope and therefore need to be additionally supplied with the subscription id and resource group name to return the correct ids. This template is now working as expected
{
"$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"rg_name": {
"type": "string"
},
"location": {
"type": "string",
"defaultValue": "westeurope"
}
},
"variables": {
"vm_id": "[concat('AssessmentVM', uniquestring(deployment().name))]",
"vnet_id": "[concat('Assessment-Vnet', uniquestring(deployment().name))]",
"nic_id": "[concat('Assessment-NetInterface', uniquestring(deployment().name))]",
"publicIP_id": "[concat('AssessmentVM-ip', uniquestring(deployment().name))]",
"nsg_id": "[concat('AssessmentVM-nsg', uniquestring(deployment().name))]",
"subscription_id": "x",
"vmImage_id": "/subscriptions/x/resourceGroups/AssessmentCase_Snapshot/providers/Microsoft.Compute/galleries/AssessmentVM_Images/images/AssessmentVM/versions/0.0.1"
},
"resources": [
{
"type": "Microsoft.Resources/resourceGroups",
"apiVersion": "2021-04-01",
"name": "[parameters('rg_name')]",
"location": "[parameters('location')]",
"properties": {}
},
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2021-04-01",
"name": "assessment_vm_deployment",
"resourceGroup": "[parameters('rg_name')]",
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups/', parameters('rg_name'))]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2020-05-01",
"name": "[variables('nsg_id')]",
"location": "[parameters('location')]",
"properties": {
"securityRules": [
{
"name": "RDP",
"properties": {
"protocol": "TCP",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 300,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
]
}
},
{
"type": "Microsoft.Network/publicIPAddresses",
"apiVersion": "2020-05-01",
"name": "[variables('publicIP_id')]",
"location": "[parameters('location')]",
"sku": {
"name": "Basic"
},
"properties": {
"publicIPAddressVersion": "IPv4",
"publicIPAllocationMethod": "Dynamic",
"idleTimeoutInMinutes": 4,
"ipTags": []
}
},
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2020-05-01",
"name": "[variables('vnet_id')]",
"location": "[parameters('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.1.4.0/24"
]
},
"subnets": [
{
"name": "default",
"properties": {
"addressPrefix": "10.1.4.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
],
"virtualNetworkPeerings": [],
"enableDdosProtection": false
}
},
{
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2019-07-01",
"name": "[variables('vm_id')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/networkInterfaces', variables('nic_id'))]"
],
"properties": {
"hardwareProfile": {
"vmSize": "Standard_D4s_v3"
},
"storageProfile": {
"imageReference": {
"id": "[variables('vmImage_id')]"
},
"osDisk": {
"createOption": "FromImage"
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/networkInterfaces', variables('nic_id'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": false
}
},
"licenseType": "Windows_Client"
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2020-05-01",
"name": "[concat(variables('vnet_id'), '/default')]",
"dependsOn": [
"[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/virtualNetworks', variables('vnet_id'))]"
],
"properties": {
"addressPrefix": "10.1.4.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"type": "Microsoft.Network/networkInterfaces",
"apiVersion": "2020-05-01",
"name": "[variables('nic_id')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/publicIPAddresses', variables('publicIP_id'))]",
"[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/virtualNetworks/subnets', variables('vnet_id'), 'default')]",
"[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/networkSecurityGroups', variables('nsg_id'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAddress": "10.1.4.4",
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/publicIPAddresses', variables('publicIP_id'))]"
},
"subnet": {
"id": "[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/virtualNetworks/subnets', variables('vnet_id'), 'default')]"
},
"primary": true,
"privateIPAddressVersion": "IPv4"
}
}
],
"dnsSettings": {
"dnsServers": []
},
"enableAcceleratedNetworking": false,
"enableIPForwarding": false,
"networkSecurityGroup": {
"id": "[resourceId(variables('subscription_id'), parameters('rg_name'), 'Microsoft.Network/networkSecurityGroups', variables('nsg_id'))]"
}
}
}
]
}
}
}
],
"outputs": {}
}
Please find the below template which I have modified -
There were few resources which were same but you were creating them 2 times, so modified that.
use of dependsOn - This error usually comes from having a dependency on a resource and we are not using dependsOn correctly, so modified the order of the resources that you were creating.
{
"$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"rgName": {
"type": "string"
}
},
"variables": {
"rgLocation": "westeurope",
"vm_id": "[concat('AssessmentVM', uniquestring(deployment().name))]",
"location": "westeurope",
"vnet_id": "[concat('Assessment-Vnet', uniquestring(deployment().name))]",
"nic_id": "[concat('Assessment-NetInterface', uniquestring(deployment().name))]",
"publicIP_id": "[concat('AssessmentVM-ip', uniquestring(deployment().name))]",
"nsg_id": "[concat('AssessmentVM-nsg', uniquestring(deployment().name))]",
"vmImage_id": "/subscriptions/x/resourceGroups/AssessmentCase_Snapshot/providers/Microsoft.Compute/galleries/AssessmentVM_Images/images/AssessmentVM/versions/0.0.1"
},
"resources": [
{
"type": "Microsoft.Resources/resourceGroups",
"apiVersion": "2021-04-01",
"name": "[parameters('rgName')]",
"location": "[variables('rgLocation')]",
"properties": {}
},
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2021-04-01",
"name": "assessmentDeployment",
"resourceGroup": "[parameters('rgName')]",
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups/', parameters('rgName'))]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"variables": {},
"resources": [
{
"apiVersion": "2020-05-01",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[variables('publicIP_id')]",
"location": "[parameters('location')]",
"properties": {
"publicIPAddressVersion": "IPv4",
"publicIPAllocationMethod": "Dynamic",
"idleTimeoutInMinutes": 4,
"ipTags": []
}
},
{
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2020-05-01",
"name": "[variables('nsg_id')]",
"location": "[variables('location')]",
"properties": {
"securityRules": [
{
"name": "RDP",
"properties": {
"protocol": "TCP",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 300,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
]
}
},
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2020-05-01",
"name": "[variables('vnet_id')]",
"location": "[variables('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.1.4.0/24"
]
},
"subnets": [
{
"name": "default",
"properties": {
"addressPrefix": "10.1.4.0/24",
"delegations": [],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
],
"virtualNetworkPeerings": [],
"enableDdosProtection": false
}
},
{
"type": "Microsoft.Network/networkInterfaces",
"apiVersion": "2020-05-01",
"name": "[variables('nic_id')]",
"location": "[variables('location')]",
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAddress": "10.1.4.4",
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIP_id'))]"
},
"subnet": {
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnet_id'), 'default')]"
},
"primary": true,
"privateIPAddressVersion": "IPv4"
}
}
],
"dnsSettings": {
"dnsServers": []
},
"enableAcceleratedNetworking": false,
"enableIPForwarding": false,
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsg_id'))]"
}
},
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIP_id'))]",
"[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnet_id'), 'default')]",
"[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsg_id'))]"
]
},
{
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2019-07-01",
"name": "[variables('vm_id')]",
"location": "[variables('location')]",
"properties": {
"hardwareProfile": {
"vmSize": "Standard_D4s_v3"
},
"storageProfile": {
"imageReference": {
"id": "[variables('vmImage_id')]"
},
"osDisk": {
"createOption": "FromImage"
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces', variables('nic_id'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": false
}
},
"licenseType": "Windows_Client"
},
"dependsOn": [
"[resourceId('Microsoft.Network/networkInterfaces', variables('nic_id'))]"
]
}
]
}
}
}
],
"outputs": {}
}
I want to create an ARM template for encrypted CosmosDB by customer managed key
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
...
},
"functions": [],
"variables": {
...
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2020-04-01-preview",
"name": "[variables('keyVaultName')]",
"location": "westeurope",
"properties": {
"sku": {
"family": "A",
"name": "Standard"
},
"tenantId": "[parameters('tenantId')]",
"dependsOn": [
"[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName'))]"
],
"accessPolicies": [
{
"tenantId": "[parameters('tenantId')]",
"objectId": "[reference(resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName')), '2021-03-01-preview', 'full').identity.principalId]",
"permissions": {
"keys": [
"get",
"wrapKey",
"unwrapKey"
]
}
}
],
"enabledForDeployment": false,
"enabledForDiskEncryption": false,
"enabledForTemplateDeployment": false,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 90,
"enableRbacAuthorization": false,
"vaultUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/')]",
"provisioningState": "Succeeded",
"enablePurgeProtection": true
}
},
{
"type": "Microsoft.KeyVault/vaults/keys",
"apiVersion": "2020-04-01-preview",
"name": "[concat(variables('keyVaultName'), '/', variables('keyVaultName'), '-cosmos-db')]",
"location": "westeurope",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]"
],
"properties": {
"crv": "P-256",
"kty": "EC",
"key_size": 4096,
"keyOps": [
"wrapKey",
"unwrapKey"
],
"attributes": {
"enabled": true
}
}
},
{
"type": "Microsoft.DocumentDB/databaseAccounts",
"name": "[variables('dbAccountName')]",
"apiVersion": "2021-01-15",
"location": "[parameters('location')]",
"kind": "MongoDB",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]",
"locations": "[variables('locations')]",
"databaseAccountOfferType": "Standard",
"apiProperties": {
"serverVersion": "[parameters('serverVersion')]"
},
"keyVaultKeyUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/keys/', variables('keyVaultName'), '-cosmos-db')]"
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults/keys', variables('keyVaultName'), concat(variables('keyVaultName'), '-cosmos-db'))]"
]
}
],
"outputs": {
...
}
}
I was trying approach with nested template but getting such error after deployment: "DatabaseAccount name '****' already exists"
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
...
},
"functions": [],
"variables": {
...
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2020-04-01-preview",
"name": "[variables('keyVaultName')]",
"location": "westeurope",
"properties": {
"sku": {
"family": "A",
"name": "Standard"
},
"tenantId": "[parameters('tenantId')]",
"dependsOn": [
"[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName'))]",
"[resourceId('Microsoft.Web/sites', variables('appName'))]"
],
"accessPolicies": [
{
"tenantId": "[parameters('tenantId')]",
"objectId": "[reference(resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName')), '2021-03-01-preview', 'full').identity.principalId]",
// "objectId": "d8749310-a50e-457e-97cb-c6e8ea601eb9",
"permissions": {
"keys": [
"get",
"wrapKey",
"unwrapKey"
]
}
}
],
"enabledForDeployment": false,
"enabledForDiskEncryption": false,
"enabledForTemplateDeployment": false,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 90,
"enableRbacAuthorization": false,
"vaultUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/')]",
"provisioningState": "Succeeded",
"enablePurgeProtection": true
}
},
{
"type": "Microsoft.KeyVault/vaults/keys",
"apiVersion": "2020-04-01-preview",
"name": "[concat(variables('keyVaultName'), '/', variables('keyVaultName'), '-cosmos-db')]",
"location": "westeurope",
// "dependsOn": [
// "[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]"
// ],
"properties": {
"crv": "P-256",
"kty": "EC",
"key_size": 4096,
"keyOps": [
"wrapKey",
"unwrapKey"
],
"attributes": {
"enabled": true
}
}
},
{
"type": "Microsoft.DocumentDB/databaseAccounts",
"name": "[variables('dbAccountName')]",
"apiVersion": "2021-01-15",
"location": "[parameters('location')]",
"kind": "MongoDB",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]",
"locations": "[variables('locations')]",
"databaseAccountOfferType": "Standard",
"apiProperties": {
"serverVersion": "[parameters('serverVersion')]"
}
// "keyVaultKeyUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/keys/', variables('keyVaultName'), '-cosmos-db')]"
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults/keys', variables('keyVaultName'), concat(variables('keyVaultName'), '-cosmos-db'))]"
]
},
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2020-10-01",
"name": "databaseUpdate",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults/keys', variables('keyVaultName'), concat(variables('keyVaultName'), '-cosmos-db'))]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.DocumentDB/databaseAccounts",
"name": "[variables('dbAccountName')]",
"apiVersion": "2021-01-15",
"location": "[parameters('location')]",
"kind": "MongoDB",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]",
"locations": "[variables('locations')]",
"databaseAccountOfferType": "Standard",
"apiProperties": {
"serverVersion": "[parameters('serverVersion')]"
},
"keyVaultKeyUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/keys/', variables('keyVaultName'), '-cosmos-db')]"
}
},
{
"type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
"name": "[concat(variables('dbAccountName'), '/', variables('dbName'))]",
"apiVersion": "2021-01-15",
"dependsOn": [
"[resourceId('Microsoft.DocumentDB/databaseAccounts/', variables('dbAccountName'))]"
],
"properties": {
"resource": {
"id": "[variables('dbName')]"
},
"options": {
"throughput": "[parameters('throughput')]"
}
}
}
]
}
}
}
],
"outputs": {
...
}
}
I was also trying to create key vault resource and key vault access policy separately. But getting exception
{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"BadRequest","message":"Access policies operation not permitted. Allowed operations are "add", "replace", and "remove"."}]}
I am trying to set diagnostic settings for my Azure sql database via ARM template, However the diagnostic part (nested under database resource) is failing because the type 'providers/diagnosticsetting' is invalid.
Error:
New-AzResourceGroupDeployment : 4:56:26 AM - Resource providers/diagnosticSettings 'monitor' failed with message '{
"error": {
"code": "InvalidResourceNamespace",
"message": "The resource namespace 'providers' is invalid."
}
}'
ARM Template snippet:
"resources": [
{
"type": "Microsoft.Sql/servers",
"apiVersion": "2020-02-02-preview",
"name": "[parameters('serverName')]",
"location": "[parameters('location')]",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"administratorLogin": "[parameters('administratorLogin')]",
"administratorLoginPassword": "[parameters('administratorLoginPassword')]",
"version": "12.0"
},
"resources": [
{
"type": "databases",
"apiVersion": "2020-02-02-preview",
"name": "[parameters('sqlDBName')]",
"location": "[parameters('location')]",
"sku": {
"name": "Standard",
"tier": "Standard"
},
"properties": {
"collation": "SQL_Latin1_General_CP1_CI_AS"
},
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', concat(parameters('serverName')))]"
],
"resources": [
{
"type": "transparentDataEncryption",
"apiVersion": "2017-03-01-preview",
"name": "current",
"dependsOn": [
"[parameters('sqlDBName')]"
],
"properties": {
"status": "Enabled"
}
},
{
"type": "providers/diagnosticSettings",
"apiVersion": "2017-05-01-preview",
"name": "monitor",
"dependsOn": [
"[parameters('sqlDBName')]"
],
"properties": {
"workspaceId": "[parameters('logAnalyticsWorkspaceIdForGlobalDiagnosticSetting')]",
"logs": [
],
"metrics": [
]
}
},
{
"type": "vulnerabilityAssessments",
"apiVersion": "2020-02-02-preview",
"name": "default",
"dependsOn": [
"[parameters('sqlDBName')]"
],
"properties": {
"storageContainerPath": "[parameters('storageContainerPathForVulnerabilityAssesment')]",
"storageAccountAccessKey": "[parameters('storageAccountAccessKeyForVulnerabilityAssesment')]",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"emails": []
}
}
}
]
}
]
},
{
"type": "Microsoft.Sql/servers/firewallRules",
"apiVersion": "2020-02-02-preview",
"name": "[concat(parameters('serverName'), '/AllowAzureIPs')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
],
"properties": {
"endIpAddress": "0.0.0.0",
"startIpAddress": "0.0.0.0"
}
},
{
"type": "Microsoft.Sql/servers/administrators",
"apiVersion": "2020-08-01-preview",
"name": "[concat(parameters('serverName'), '/ActiveDirectory')]",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
],
"properties": {
"administratorType": "ActiveDirectory",
"login": "[parameters('azureActiveDirectoryAdminLogin')]",
"sid": "[parameters('azureActiveDirectoryAdminSid')]",
"tenantId": "[parameters('azureActiveDirectoryAdminTenantId')]"
}
},
{
"type": "Microsoft.Sql/servers/securityAlertPolicies",
"apiVersion": "2020-08-01-preview",
"name": "[concat(parameters('serverName'), '/Default')]",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
],
"properties": {
"state": "Enabled",
"emailAccountAdmins": false
}
},
{
"type": "Microsoft.Sql/servers/auditingSettings",
"apiVersion": "2020-08-01-preview",
"name": "[concat(parameters('serverName'), '/Default')]",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
],
"properties": {
"isDevopsAuditEnabled": false,
"retentionDays": 0,
"auditActionsAndGroups": [
"SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
"FAILED_DATABASE_AUTHENTICATION_GROUP",
"BATCH_COMPLETED_GROUP"
],
"isStorageSecondaryKeyInUse": false,
"isAzureMonitorTargetEnabled": false,
"state": "Enabled",
"storageEndpoint": "[reference(resourceId(parameters('centralMonitoringResourceGroup'), 'Microsoft.Storage/storageAccounts', parameters('centralMonitoringStorageAccountName')), '2019-06-01').PrimaryEndpoints.Blob]",
"storageAccountAccessKey": "[parameters('centralMonitoringStorageAccountAccessKey')]",
"storageAccountSubscriptionId": "[parameters('centralMonitoringStorageAccountSubscriptionId')]"
}
},
{
"type": "Microsoft.Sql/servers/vulnerabilityAssessments",
"apiVersion": "2020-08-01-preview",
"name": "[concat(parameters('serverName'), '/Default')]",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', parameters('serverName'))]",
"[concat('Microsoft.Sql/servers/', parameters('serverName'), '/securityAlertPolicies/Default')]"
],
"properties": {
"storageContainerPath": "[parameters('storageContainerPathForVulnerabilityAssesment')]",
"storageAccountAccessKey": "[parameters('storageAccountAccessKeyForVulnerabilityAssesment')]",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"emails": []
}
}
},
{
"type": "Microsoft.Sql/servers/encryptionProtector",
"apiVersion": "2020-08-01-preview",
"name": "[concat(parameters('serverName'), '/current')]",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
],
"kind": "servicemanaged",
"properties": {
"serverKeyName": "ServiceManaged",
"serverKeyType": "ServiceManaged",
"autoRotationEnabled": false
}
},
{
"type": "Microsoft.Sql/servers/connectionPolicies",
"apiVersion": "2014-04-01",
"name": "[concat(parameters('serverName'), '/ConnectionPolicies')]",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
],
"properties": {
"connectionType": "[parameters('connectionType')]"
}
}
]
I created few resrources through Azure Portal in the following order.
Created a virtual network with two subnets and on one the subnet1 I enabled the Storage Service End point.
Created a storage account stgaccount1 and then on the firewall settings for the storage account, I added the subnet1.
Created a Service Endpoint Policy which allowed access only to stgaccount1 and associated this policy to subnet1.
This setup worked for me just fine and now I wanted to automate it and hence I generated the template for it, however just by looking at the template it seemed like there were circular dependencies in the template and when I tried deploying it failed as expected.
The dependency flow looked like this.
Service Endpoind policy is dependent on Storage Account.
Storage Account is dependent on subnet1 as the access is allowed only for this subnet.
Now since subnet is also associated with ServiceEndpoint policy, it is dependent on Service End Point Policy.
I am not sure who can I resolved this dependency chain or what is the right way for it.
Below is the template for reference.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymenttemplate.json#",
"contentversion": "1.0.0.0",
"parameters": {
"virtual_network_name": {
"defaultvalue": "vnet",
"type": "string"
},
"serviceEndPointPolicyName": {
"type": "string",
"defaultvalue": "storageEndPointPolicy"
}
},
"variables": {
"storageAccountName": "[tolower(concat(resourceGroup().name, 'storageaccount'))]",
"virtualNetworkName": "[concat(resourceGroup().name, parameters('virtual_network_name'))]"
},
"resources": [
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"apiVersion": "2019-11-01",
"name": "[parameters('serviceEndPointPolicyName')]",
"location": "eastus",
"dependsOn": [
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
],
"properties": {
"serviceEndpointPolicyDefinitions": [
{
"name": "[concat(parameters('serviceEndPointPolicyName'), '_Microsoft.Storage')]",
"properties": {
"service": "Microsoft.Storage",
"serviceResources": [
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
]
}
}
]
}
},
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2019-06-01",
"name": "[variables('storageAccountName')]",
"location": "eastus",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'subent1')]"
],
"sku": {
"name": "Standard_RAGRS",
"tier": "Standard"
},
"kind": "StorageV2",
"properties": {
"networkAcls": {
"bypass": "AzureServices",
"virtualNetworkRules": [
{
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'subent1')]",
"action": "Allow",
"state": "Succeeded"
}
],
"ipRules": [
],
"defaultAction": "Deny"
},
"supportsHttpsTrafficOnly": false,
"encryption": {
"services": {
"file": {
"keyType": "Account",
"enabled": true
},
"blob": {
"keyType": "Account",
"enabled": true
}
},
"keySource": "Microsoft.Storage"
},
"accessTier": "Hot"
}
},
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2019-11-01",
"name": "[variables('virtualNetworkName')]",
"location": "eastus",
"dependsOn": [
"[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/16"
]
},
"subnets": [
{
"name": "subnet2",
"properties": {
"addressPrefix": "10.0.1.0/24",
"delegations": [
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"name": "subent1",
"properties": {
"addressPrefix": "10.0.0.0/24",
"serviceEndpointPolicies": [
{
"id": "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
}
],
"serviceEndpoints": [
{
"service": "Microsoft.Storage",
"locations": [
"*"
]
}
],
"delegations": [
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
],
"virtualNetworkPeerings": [
],
"enableDdosProtection": false,
"enableVmProtection": false
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2019-11-01",
"name": "[concat(variables('virtualNetworkName'), '/subent1')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]",
"[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
],
"properties": {
"addressPrefix": "10.0.0.0/24",
"serviceEndpointPolicies": [
{
"id": "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
}
],
"serviceEndpoints": [
{
"service": "Microsoft.Storage",
"locations": [
"*"
]
}
],
"delegations": [
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2019-11-01",
"name": "[concat(variables('virtualNetworkName'), '/subnet2')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
],
"properties": {
"addressPrefix": "10.0.1.0/24",
"delegations": [
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
]
}
Export problems aside, follow the same steps in your template (sequence) that you followed in the portal. Below is my version of that... Essentially you'll deploy the vnet first without the policies and then add the policy later...
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymenttemplate.json#",
"contentversion": "1.0.0.0",
"parameters": {
"virtual_network_name": {
"defaultvalue": "vnet",
"type": "string"
},
"serviceEndPointPolicyName": {
"type": "string",
"defaultvalue": "storageEndPointPolicy"
}
},
"variables": {
"storageAccountName": "[uniqueString(resourceGroup().id)]",
"virtualNetworkName": "[parameters('virtual_network_name')]"
},
"resources": [
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2019-11-01",
"name": "[variables('virtualNetworkName')]",
"location": "eastus",
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/16"
]
},
"subnets": [
{
"name": "subnet2",
"properties": {
"addressPrefix": "10.0.1.0/24",
"delegations": [
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
},
{
"name": "subent1",
"properties": {
"addressPrefix": "10.0.0.0/24",
"serviceEndpoints": [
{
"service": "Microsoft.Storage",
"locations": [
"*"
]
}
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
],
"enableDdosProtection": false,
"enableVmProtection": false
}
},
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2019-06-01",
"name": "[variables('storageAccountName')]",
"location": "eastus",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]"
],
"sku": {
"name": "Standard_RAGRS",
"tier": "Standard"
},
"kind": "StorageV2",
"properties": {
"networkAcls": {
"bypass": "AzureServices",
"virtualNetworkRules": [
{
"id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), 'subent1')]",
"action": "Allow",
"state": "Succeeded"
}
],
"defaultAction": "Deny"
},
"supportsHttpsTrafficOnly": false,
"encryption": {
"services": {
"file": {
"keyType": "Account",
"enabled": true
},
"blob": {
"keyType": "Account",
"enabled": true
}
},
"keySource": "Microsoft.Storage"
},
"accessTier": "Hot"
}
},
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"apiVersion": "2019-11-01",
"name": "[parameters('serviceEndPointPolicyName')]",
"location": "eastus",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', variables('virtualNetworkName'))]",
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
],
"properties": {
"serviceEndpointPolicyDefinitions": [
{
"name": "[concat(parameters('serviceEndPointPolicyName'), '_Microsoft.Storage')]",
"properties": {
"service": "Microsoft.Storage",
"serviceResources": [
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
]
}
}
]
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2019-11-01",
"name": "[concat(variables('virtualNetworkName'), '/subent1')]",
"dependsOn": [
"[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
],
"properties": {
"addressPrefix": "10.0.0.0/24",
"serviceEndpointPolicies": [
{
"id": "[resourceId('Microsoft.Network/serviceEndpointPolicies', parameters('serviceEndPointPolicyName'))]"
}
],
"serviceEndpoints": [
{
"service": "Microsoft.Storage",
"locations": [
"*"
]
}
],
"privateEndpointNetworkPolicies": "Enabled",
"privateLinkServiceNetworkPolicies": "Enabled"
}
}
]
}
I am trying to automate website deployment using the Azure Resource Manager. Website creation and code deployment is working fine, but I am unable to attach the new site to an existing Web Hosting plan.
I am using the 2015-08-01 API and from different examples I think that this template should work (it does not...):
The deployment fails at "Microsoft.Web/sites/config" and the site is beeing assigned a new default free hosting plan.
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"siteName": {
"type": "string"
},
"subscriptionId": {
"type": "string"
},
"setting1": {
"type": "string"
},
"setting2": {
"type": "string"
}
},
"resources": [
{
"apiVersion": "2015-08-01",
"type": "Microsoft.Web/sites",
"name": "[parameters('siteName')]",
"location": "[resourceGroup().location]",
"properties": {
"serverFarmId ": "/subscriptions/xxxxxx/resourceGroups/xxxxxx/providers/Microsoft.Web/serverfarms/xxxxxx"
},
"resources": [
{
"apiVersion": "2015-08-01",
"name": "web",
"type": "config",
"dependsOn": [
"[resourceId('Microsoft.Web/Sites', parameters('siteName'))]"
],
"properties": {
"phpVersion": "off",
"netFrameworkVersion": "v4.6",
"use32BitWorkerProcess": false,
"webSocketsEnabled": true,
"alwaysOn": true,
"requestTracingEnabled": false,
"httpLoggingEnabled": false,
"logsDirectorySizeLimit": 40,
"detailedErrorLoggingEnabled": false,
"appSettings": [
{
"Name": "setting1",
"Value": "Value1"
},
{
"Name": "setting2",
"Value": "Value2"
}
]
}
},
{
"apiVersion": "2015-08-01",
"type": "extensions",
"name": "MSDeploy",
"dependsOn": [
"[resourceId('Microsoft.Web/sites', parameters('siteName'))]"
],
"properties": {
"packageUri": "xxxxxxxx",
"dbType": "None",
"connectionString": ""
}
}
]
}
],
"outputs": {
"siteUri": {
"type": "string",
"value": "[concat('http://',reference(resourceId('Microsoft.Web/sites', parameters('siteName'))).hostNames[0])]"
}
}
}
I ended up falling back to the 2014-06-01 API and with some adjustments to the script, was able to do what I wanted.
Providing the script for future references.
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"siteName": {
"type": "string"
},
"subscriptionId": {
"type": "string"
},
"hostingPlanName": {
"type": "string"
},
"setting1": {
"type": "string"
},
"setting2": {
"type": "string"
}
},
"resources": [
{
"apiVersion": "2014-06-01",
"type": "Microsoft.Web/sites",
"name": "[parameters('siteName')]",
"location": "[resourceGroup().location]",
"dependsOn": [
],
"properties": {
"name": "[parameters('siteName')]",
"serverFarm": "[parameters('hostingPlanName')]"
},
"resources": [
{
"apiVersion": "2014-06-01",
"name": "web",
"type": "config",
"dependsOn": [
"[resourceId('Microsoft.Web/Sites', parameters('siteName'))]",
"[concat('Microsoft.Web/Sites/', parameters('siteName'), '/Extensions/MSDeploy')]"
],
"properties": {
"phpVersion": "off",
"netFrameworkVersion": "v4.6",
"use32BitWorkerProcess": false,
"webSocketsEnabled": true,
"alwaysOn": true,
"requestTracingEnabled": false,
"httpLoggingEnabled": false,
"logsDirectorySizeLimit": 40,
"detailedErrorLoggingEnabled": false
}
},
{
"apiVersion": "2014-11-01",
"name": "appsettings",
"type": "config",
"dependsOn": [
"[resourceId('Microsoft.Web/Sites', parameters('siteName'))]",
"[concat('Microsoft.Web/Sites/', parameters('siteName'), '/Extensions/MSDeploy')]"
],
"properties": {
"Setting1": "[parameters('setting1')]",
"Setting2": "[parameters('setting2')]"
}
},
{
"apiVersion": "2015-08-01",
"type": "extensions",
"name": "MSDeploy",
"dependsOn": [
"[resourceId('Microsoft.Web/Sites', parameters('siteName'))]"
],
"properties": {
"packageUri": "https://xxxxx.zip",
"dbType": "None",
"connectionString": ""
}
}
]
}
]
}