Can't use reference function properly in ARM template

Question

I have a main template. Within that: I have a linked template creating application insights. and another linked template call to create a webapp.

Within the webapp linked template call, I want to pass the AIKey, as a parameter, but this is problematic. If i do:

"value": "[reference(resourceId('Microsoft.Insights/components', variables('appInsightsName')),'2014-04-01').InstrumentationKey]"

This fails the first time because the reference value gets evaluated immediately, and the appinsights doesn't exist yet. This happens even if i use a depends-on on for the appinsights linked template resource call within the webapp.

So i thought maybe I can use a reference within a reference to prevent it from being evaluated too early, but this doesn't work - it seems you can't have a reference within a reference.

"value": "[reference(reference('AppInsights').outputs.resourceID.value,'2014-04-01').InstrumentationKey]"

I do not want to put the AI Key in the output of the linked template, since it would be putting it in plaintext. Is there a way to achieve what I'm trying to do?

Here are some code snippets, it's a single template but the template is very large so I didn't include everything:

Call AI nested template:

{
  "name": "AppInsights",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2016-09-01",
  "dependsOn": [],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('AppInsightsTemplatePath')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "tagValues": {
        "value": "[parameters('tagValues')]"
      },
      "workspaceId": {
        "value": "[parameters('workspaceId')]"
      },
      "appInsightsName": {
        "value": "[variables('appInsightsName')]"
      }
    }
  }
 },

Call WebAPP Template:

{
  "name": "WebApp",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2016-09-01",
  "dependsOn": [
    "AppInsights",
    "AppServicePlan"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('WebAppTemplatePath')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "siteConfig": {
        "value": {
          "netFrameworkVersion": "v4.7",
          "phpVersion": "",
          "pythonVersion": "",
          "javaVersion": "",
          "nodeVersion": "",
          "linuxFxVersion": "",
          "use32BitWorkerProcess": "False",
          "webSocketsEnabled": "False",
          "alwaysOn": "True",
          "managedPipelineMode": "Integrated",
          "remoteDebuggingEnabled": "False",
          "appSettings": [
            {
              "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
              "value": "[reference(resourceId('Microsoft.Insights/components', variables('appInsightsName')),'2014-04-01').InstrumentationKey]"
            }
          ],
          "connectionStrings": [],
          "defaultDocuments": [],
          "handlerMappings": [],
          "virtualApplications": [
            {
              "virtualPath": "/",
              "physicalPath": "site\\wwwroot",
              "preloadEnabled": "True",
              "virtualDirectories": ""
            }
          ],
          "minTlsVersion": "1.2"
        }
      }
    }
  }
},

Here's the error: "code": "ResourceNotFound", "message": "The Resource 'Microsoft.Insights/components/MyAppInsightsName' under resource group 'MyResourceGroup' was not found."

Answer 1

Instead of passing the key into the webapp template, pass in the resourceId of the AI resource and put the reference() call in the web app template. Don't output the resourceId, just pass in the string like you have in the first code snippet.

"value": "[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]

Aside, if you could share your template (or enough of it for a repro) that would be helpful... I thought we fixed this behavior, but sounds like we didn't, so would be good to see if we missed a case.

Answer 2

ok, i think I understand what you are saying, this is what you template looks like:

parent:
  - child1:
      - application insights
  - child2:
      - webapp

so you dont really have a lot of good options here. first of all: this setup makes very little sense. creating nested deployments just for the sake of creating nested deployments only leads to creating stack overflow questions ;) you can convert this to a flat template and it will work just fine or you can rearrange them like this:

parent: - child1: - application insights - child2: - webapp

you can also try and update the config as a standalone resource inside child2:

{
    "name": "appsettings",
    "type": "config",
    "apiVersion": "2015-08-01",
    "properties": {
        "APPINSIGHTS_INSTRUMENTATIONKEY": "[reference(resourceId('Microsoft.Insights/components', variables('appInsightsName')),'2014-04-01').InstrumentationKey]"
    }
}

another option is output it in the child1 and reference in child2, that will work. you can delete the deployment as part of your script (if you dont want to delete child1, you can create a proxy deployment that only does that), so there would be no trace of the AI key in Azure another option is somewhat hacky:

parent: - child1: - child1.1 (former child1): - application insights - child2: << this dependsOn child1 - child2.1 (former child2) : << this references AI key - webapp