Azure ARM template enabling Linux Diagnostic Extension with automatically generated SAS token - azure

Question

I'm trying to deploy arm template with New VM and setting up Linux Diagnostic Extension/LAD without the creation of new Storage account but using an existing one. I found this article https://samcogan.com/generate-sas-tokens-in-arm-teamplates/ to use "listAccountSas" and I've set in "ProtectedSettings":
"storageAccountSasToken":
"[listAccountSas(parameters('existingStorageName'), '2018-07-01',
variables('accountSasProperties')).accountSasToken]"
"resources": [
{vm creation bla bla},
{
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "[providers('Microsoft.Compute','virtualMachines/extensions').apiVersions[0]]",
"location": "[parameters('vmLocation')]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"name": "[concat(parameters('vmName'), '/LinuxDiagnostic')]",
"properties": {
"publisher": "Microsoft.Azure.Diagnostics",
"type": "LinuxDiagnostic",
"autoUpgradeMinorVersion": true,
"typeHandlerVersion": "3.0",
"protectedSettings": {
"storageAccountName": "[parameters('existingStorageName')]",
"storageAccountSasToken": "[listAccountSas(parameters('existingStorageName'), '2018-07-01', variables('accountSasProperties')).accountSasToken]",
"storageAccountEndPoint": "https://core.windows.net/",
"sinksConfig": {
"sink": [
{
"name": "WADMetricJsonBlob",
"type": "JsonBlob"
}
]
}
},
"settings": {
"StorageAccount": "[parameters('existingStorageName')]",
"ladCfg": {
"diagnosticMonitorConfiguration": {
"eventVolume": "Medium",
"metrics": {
"metricAggregation": [
{
"scheduledTransferPeriod": "PT1H"
},
{
"scheduledTransferPeriod": "PT1M"
}
],
"resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]"
},
"performanceCounters": {
"sinks": "WADMetricJsonBlob",
"performanceCounterConfiguration": [
{
"annotation": [
{
"displayName": "Memory percentage",
"locale": "en-us"
}
],
"class": "memory",
"counter": "percentusedmemory",
"counterSpecifier": "/builtin/memory/percentusedmemory",
"type": "builtin",
"unit": "Percent"
}
]
},
"syslogEvents": {}
},
"sampleRateInSeconds": 15
}
}
}
},
When I try to deploy the template I get an error during validation:
"InvalidTemplate","message":"Deployment template validation failed:
'The template reference 'myExistingStorageAccount' is not valid: could
not find template resource or resource copy with this name. Please see
https://aka.ms/arm-template-expressions/#reference for usage
details.'."}
According to MS:
The reference function and list* functions don't create an implicit
dependency when the resource is referred to by its resource ID. To
create an implicit dependency, pass the name of the resource that is
deployed in the same template.
However, I tried with a nested template where to "create" the SAS token and in outputs to set sasToken.Id where later on to call, in my Main template, Diagnostic Extension with sastoken.Id:
{
"apiVersion": "2017-08-01",
"name": "SasTokenNestedTemplate",
"type": "Microsoft.Resources/deployments",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"mode" : "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"apiVersion" : "2018-03-01",
"type": "Microsoft.Resources/deployments",
"name": "NestedSasTokenCreation",
"properties": {
"sasToken": "[listAccountSas(parameters('existingStorageName'), '2018-07-01', variables('accountSasProperties')).accountSasToken]"
}
}
],
"outputs": {
"sasToken": {
"type": "string",
"value": "[resourceId('Microsoft.Resources/deployments', parameters('sasToken'))]"
}
}
}
}
},
{
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "[providers('Microsoft.Compute','virtualMachines/extensions').apiVersions[0]]",
"location": "[parameters('vmLocation')]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"name": "[concat(parameters('vmName'), '/LinuxDiagnostic')]",
"properties": {
"publisher": "Microsoft.Azure.Diagnostics",
"type": "LinuxDiagnostic",
"autoUpgradeMinorVersion": true,
"typeHandlerVersion": "3.0",
"protectedSettings": {
"storageAccountName": "[parameters('existingStorageName')]",
"storageAccountSasToken": { "value": "[reference('SasTokenNestedTemplate', '2017-08-01').outputs.sasToken.value]" },
"storageAccountEndPoint": "https://core.windows.net/",
"sinksConfig": {
"sink": [
{
"name": "WADMetricJsonBlob",
"type": "JsonBlob"
}
]
}
But still getting the same error as above.
Thanks in advance for your help!

Answer 1

you need to give it resource id of the storage account, because its not the part of the template, it cant figure it out on it own.
listAccountSas(resourceId('Microsoft.Storage/storageAccounts', parameters('existingStorageName')), '2018-07-01', variables('accountSasProperties')).accountSasToken