Access Storage Account Key from a resource outside the ARM template

Question

I'm using several ARM templates in our project, each of them meant for a different component, and there's also a Common ARM template that includes all resources that most of the elements need to work, as SqlServer, Storage Accounts, Redis cache(only one of this resources for all the elements)

The thing is, as Storage account is in a separate ARM template(Common infrastructure ARM template), I'm not able to access the Storage account keys from the component template. I need this to properly set the value of the connection string for the component to use it. If I include the storage account resource in the component template, I can access it via:

[concat('DefaultEndpointsProtocol=https;AccountName=', 
variables('YFO.StorageAccount.Name'), ';AccountKey=', 
listKeys(resourceId('Microsoft.Storage/storageAccounts', 
variables('YFO.StorageAccount.Name')), providers('Microsoft.Storage', 
'storageAccounts').apiVersions[0]).keys[0].value)]

But when I remove it from the component template, as it should be, then I get the following error:

New-AzureRmResourceGroupDeployment :

Error: Code=InvalidTemplate; Message=Deployment template validation failed: 'The template reference '**********' is not valid: could not find template resource or resource copy with this name. Please see https://aka.ms/arm-template-expressions/#reference for usage details.'

It seems listKeys won't do the work if the resource is outside the template you are trying to deploy

For the AppInsights component, I was able to do this with:

[reference(concat('Microsoft.Insights/components/', 
variables('AppInsightsName'))).InstrumentationKey]

even if the AppInsights resource is located out of the component ARM template, but I cannot do it with Storage account as the object returned for Storage Account in reference function is as following:

"networkAcls": {
    "bypass": "AzureServices",
    "virtualNetworkRules": [],
    "ipRules": [],
    "defaultAction": "Allow"
    },
    "supportsHttpsTrafficOnly": false,
    "encryption": {
                   "services": {
                    "file": {
                             "enabled": true,
                             "lastEnabledTime": "2018-08-18T06:05:57.3069884Z"
                                },
                    "blob": {
                              "enabled": true,
                              "lastEnabledTime": "2018-08-18T06:05:57.3069884Z"
                                }
                              },
                    "keySource": "Microsoft.Storage"
                            },
                    "provisioningState": "Succeeded",
                    "creationTime": "2018-08-18T06:05:56.8228127Z",
                    "primaryEndpoints": {
                              "blob": "https://yfomormonttest.blob.core.windows.net/",
                              "queue": "https://yfomormonttest.queue.core.windows.net/",
                              "table": "https://yfomormonttest.table.core.windows.net/",
                              "file": "https://yfomormonttest.file.core.windows.net/"
                            },
              "primaryLocation": "westeurope",
               "statusOfPrimary": "available",
              "secondaryLocation": "northeurope",
              "statusOfSecondary": "available"
                          }

Any clue?

Thanks and regards.

Aleks Aleks · Accepted Answer · 2018-11-02T12:14:17

The problem was in providers('Microsoft.Storage', 'storageAccounts').apiVersions[0] to get the API version that listkeys needs as a parameter. Setting directly the parameter as 2018-07-01 did work

Access Storage Account Key from a resource outside the ARM template

Thanks and regards.

1 Answers