Passing url as parameter in ARM template from CLI - azure

I am trying to deploy azure resources using Linked ARM template, for which i places the parameters file and template file on blob storage. Link for parameter file and blob storage i need to pass as parameter while executing the azure command from CLI. Below is my sample masterazuredeploy.json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {
"templateBaseUrl": "[parameters('templateBaseUrl')]",
"parameterBaseUrl": "[parameters('parameterBaseUrl')]",
"keyVaultDeployTemplateUrl": "[uri(variables('templateBaseUrl'), 'keyvaultdeploy.json')]"
},
"resources": [
{
"apiVersion": "[variables('apiVersionResourceDeployment')]",
"name": "keyVaultDeployment",
"type": "Microsoft.Resources/deployments",
"properties": {
"mode": "Incremental",
"templateLink": {
"uri": "[variables('keyVaultDeployTemplateUrl')]"
},
"parametersLink": {
"uri": "[variables('keyVaultparameterFileUrl')]"
}
}
}
]
}
To execute this i am giving following CLI command:
az group deployment create --resource-group abc-devops-test --template-file .\masterazuredeploy.json --parameters templateBaseUrl="https://test.blob.core
.windows.net/azurestackautomationtest/resourcetemplates/" parameterBaseUrl="https://test.blob.core.windows.net/azurestackautomationtest/parameters/dev/" --verbose
While executing i am getting following error:
unrecognized template parameter 'templateBaseUrl'. Allowed parameters:
command ran in 1.918 seconds.
I tried parameter values without inverted quotes, with single quotes. Still not working. Where exactly i am missing.
Also tried the another approach, placed both parameters in global.parameters.json as below,
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"templateBaseUrl": {
"value": "https://test.blob.core.windows.net/azurestackautomation/resourcetemplates/"
},
"parameterBaseUrl": {
"value": "https://test.blob.core.windows.net/azurestackautomation/parameters/dev/"
}
}
}
and uploaded this file to blob storage, and given path of blob storage as parameter
az group deployment create --resource-group abc-devops-test --template-file .\masterazuredeploy.json --parameters https://test.blob.core.windows.net/azur
estackautomationtest/parameters/dev/global.parameters.json --verbose
But getting below error:
400 Client Error: Bad Request for url: https://management.azure.com/subscriptions/XXXX-xx-x-x-x--x-x/resourcegroups/abc-devops-test/providers/Microsoft.Resources/deployments/masterazuredeploy?api-version=2018-05-01
command ran in 5.646 seconds.

As I see in your template, you miss setting the parameters, what you did is to input the parameter values to the parameters in the template, no matter the both CLI command you have provided. But you did not set parameters so that no parameters you can use. I suggest you change the template into below:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"templateBaseUrl": {
"type": "string"
},
"parameterBaseUrl": {
"type": "string"
}
},
"variables": {
"keyVaultDeployTemplateUrl": "[uri(parameters('templateBaseUrl'), 'keyvaultdeploy.json')]"
},
"resources": [
{
"apiVersion": "[variables('apiVersionResourceDeployment')]", #1
"name": "keyVaultDeployment",
"type": "Microsoft.Resources/deployments",
"properties": {
"mode": "Incremental",
"templateLink": {
"uri": "[variables('keyVaultDeployTemplateUrl')]"
},
"parametersLink": {
"uri": "[variables('keyVaultparameterFileUrl')]" #2
}
}
}
]
}
And you also miss setting the variables apiVersionResourceDeployment and keyVaultparameterFileUrl. You can use both parameter and variable as you like.

Related

Reading Azure Key Vault secret into ARM template via parameter file

I've set up the problem in the these two files. The template is simply POSTing the parameter with a fake url to check the value.
read_secret_params.json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"ftpPrivateKey": {
"reference": {
"keyVault": {
"id": "/subscriptions/dummyid/resourceGroups/dummyrg/providers/Microsoft.KeyVault/vaults/myvault"
},
"secretName": "mysecret"
}
}
}
}
read_secret_template.json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"ftpPrivateKey": {
"type": "securestring"
}
},
"resources": [
{
"type": "Microsoft.Logic/workflows",
"apiVersion": "2019-05-01",
"name": "read-secret",
"location": "East US",
"properties": {
"definition": {
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
"contentVersion": "1.0.0.0",
"triggers": {
"Recurrence": {
"recurrence": {
"frequency": "Week",
"interval": 1
},
"type": "Recurrence"
}
},
"actions": {
"HTTP": {
"inputs": {
"body": "[parameters('ftpPrivateKey')]",
"method": "POST",
"uri": "https://dummysite.com"
},
"runAfter": {},
"type": "Http"
}
},
"outputs": {}
},
"parameters": {}
}
}
]
}
The first issue is, when I try to deploy via the portal, no value comes thru for the parameter so it can't create it due to the validation error "Validation failed. Required information is missing or not valid.". Is this because it's not able to read the secret, permissions thing? NOTE: the key vault is also created by myself so I am the owner.
I can get around the validation error and successfully deploy by adding a default value as follows:-
"parameters": {
"ftpPrivateKey": {
"type": "securestring",
"defaultValue": "privateKeyDefault"
}
},
But when I run the logic app, it's using the default value in the POST command so it seems like it's not pulling the secret out of the key vault.
So in summary I have 2 questions:-
Has this test proved that the logic app is not reading the secret OR might it have successfully read the secret but is for some reason displaying the default value in the POST command?
If it is not reading the secret, can anyone suggest a cause + fix?
If I deploy using the Azure CLI then it works i.e. gets the secret from Azure Key Vault. If deployed in the portal then it always uses the default value.

Updating key vault secret via Arm template release from devops CI/CD fails

I have managed to release secrets to my Azure key vault via CI/CD from DevOps using my arm templates. The initial release went fine and added my new non existing secrets to my key vault resource. Though men trying to update the value of the secret in my ARM template and then pushing it to my GIT-repo to in turn release it as to update my secret in azure it fails giving me:
At least one resource deployment operation failed. Please list deployment operations for
details. Please see https://aka.ms/DeployOperations for usage details.
Details:
BadRequest:
Check out the troubleshooting guide to see if your issue is addressed:
https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-resource-group-deployment?view=azure-devops#troubleshooting
Task failed while creating or updating the template deployment.
My template looks like this:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"keyVault": {
"value": "test-kv-devopstest01-d"
},
"TestCedential_1": {
"value": "TestCedentialSecretValue1"
},
"TestCedentialName_1": {
"value": "TestCedentialSecretName1_SecondVersion"
}
}
}
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"keyVault": {
"type": "string"
},
"TestCedential_1": {
"type": "secureString"
},
"TestCedentialName_1": {
"type": "string"
}
},
"variables": {
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults/secrets",
"name": "[concat(parameters('keyVault'), '/', parameters('TestCedentialName_1'))]",
"apiVersion": "2015-06-01",
"properties": {
"contentType": "text/plain",
"value": "[parameters('TestCedential_1')]"
}
}
],
"outputs": {}
}
I've also tried granting permissions for the pipelines in access control in the key vault resource in azure.
Am i missing something maybe?
I tested the same code in my environment and it resulted in same error :
The issue is with the below :
"TestCedentialName_1": {
"value": "TestCedentialSecretName1_SecondVersion"
}
In Key vault secret '_' (underscore) is not allowed in name. The allowed values are alphanumeric characters and dashes.
Changing underscore to dash fixes the issue :
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"keyVault": {
"type": "string",
"defaultValue" :"test-kv-ansuman-d"
},
"TestCedential_1": {
"type": "secureString",
"defaultValue":"TestCedentialSecretValue1"
},
"TestCedentialName_1": {
"type": "string",
"defaultValue": "TestCedentialSecretName1-SecondVersion"
}
},
"variables": {
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults/secrets",
"name": "[concat(parameters('keyVault'), '/', parameters('TestCedentialName_1'))]",
"apiVersion": "2015-06-01",
"properties": {
"contentType": "text/plain",
"value": "[parameters('TestCedential_1')]"
}
}
],
"outputs": {}
}
Output:

Can output of an ARM template be used in another template as a reference which is not called as nested?

I'm trying to use different templates for creating a NSG and then for a spoke. I don't want to use nested template, instead I want the out of NSG template as resource ID and give reference to spoke template as a parameter. Can this be achieved or is it just the case for nested template also the parameters in the spoke template where NSG resource ID is needed is in a array as I have used copy function.
"outputs": {"resourceID": {
"type": "string",
"value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"}}
This output is to be used here
"subnetsConfiguration": {
"value": [
{
"name": "app-subnet",
"addressPrefix": "10.112.0.0/20",
"networkSecurityGroupName": "set the resource ID as a reference here",
To get an output value from a linked template, retrieve the property value with syntax like: [reference('deploymentName').outputs.propertyName.value]
First, the linked template- helloworld.json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [],
"outputs": {
"greetingMessage": {
"value": "Hello World",
"type" : "string"
}
}
}
The main template deploys the linked template and gets the returned value -
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2020-06-01",
"name": "linkedTemplate",
"properties": {
"mode": "incremental",
"templateLink": {
"uri": "[uri(deployment().properties.templateLink.uri, 'helloworld.json')]",
"contentVersion": "1.0.0.0"
}
}
}
],
"outputs": {
"messageFromLinkedTemplate": {
"type": "string",
"value": "[reference('linkedTemplate').outputs.greetingMessage.value]"
}
}
}
Please refer this documentation for more details.

Specify multiple parameters file for an ARM

I have a solution consisting of different services I need to deploy in my Azure account:
global_params.json:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"globalParam1": {
"value": "v1"
},
"globalParam2": {
"value": "v2"
}
}
}
myservice_params.json:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"svcParam1": {
"value": "v1"
},
"svcParam2": {
"value": "v2"
},
"svcParam3": {
"value": "v3"
}
}
}
In my ARM template azuredeploy.json I need to get both groups of parameters:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"globalParam1": {...}
},
"globalParam2": {...}
},
"svcParam1": {...}
},
"svcParam2": {...}
},
"svcParam3": {...}
}
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2020-08-01",
"name": "[parameters('storageAccountName')]",
"location": "[parameters('globalParam1')]",
"sku": {
"name": "[parameters('svcParam1')]",
"tier": "[parameters('svcParam2')]"
},
"kind": "[parameters('svcParam3')]",
"properties": {
"accessTier": "[parameters('globalParam2')]"
}
}
]
}
How do I use the Azure CLI to make sure I pass parameters merged from both parameters file? I know one parameter file can be passed as follow (see doc):
az deployment group create ... --template-file ./azuredeploy.json --parameters #myservice_params.json
But how to specify two parameters files and get them merged?
The CLI (nor Azure itself) support this - you would have to do the merge yourself prior to calling into Azure.
You could use defaultValues on the parameters in the template to come close to replicating.
Although article is few months old, I tested it by adding second parameters file using #.
So command will be:
az deployment group create -g resourceGroup --template-file template.json --parameters #parameters1.json #parameters2.json

How to access the contentVersion in output session of ARM Templates?

I am building an Web Application and deploy it into Azure using ARM Templates. I am creating and deploying them without any problem. I am trying to access contentVersion in output session. But, I am receiving an message
Unable to evaluate template outputs
I tried it in following ways:
"outputs": {
"Contentoutput": {
"type": "string",
"value": "[reference('contentVersion')]" //First case
"value": "[reference('contentVersion').value]" //Second case
"value": "['contentVersion']" //Third case
"value": "[contains('contentVersion','contentVersion')]" //Fourth case
}
}
How to access the contentVersion in output session?
A better way of outputting the content version would be to use the deployment function (see documentation).
Your workaround solution would then translate to:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [],
"outputs": {
"contentVersion": {
"type": "string",
"value": "[deployment().properties.template.contentVersion]"
}
}
}
I also can't find a way to get it in the outputs. According to the azure official document, we could know that contentVersion could the value you supplied.
contentVersion: Version of the template (such as 1.0.0.0). You can provide any value for this element. When deploying resources using the template, this value can be used to make sure that the right template is being used.
So my workaround is that you could define it as a parameter then you could get it from outputs. The following is the demo code. You also could give your idea to Azure team
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"contentVersion": {
"type": "string",
"defaultValue": "1.0.0.0",
"metadata": {
"description": "contentVersion"
}
}
},
"variables": {
},
"resources": [
],
"outputs": {
"contentVersion": {
"type": "string",
"value": "[parameters('contentVersion')]"
}
}
}

Resources