I am trying to conditionally pass through the fully qualified resource id of network security groups and route tables to subnets within a vnet. These are currently deployed using arm property iteration on a virtual network resource.
I have followed this article to get to this point. https://github.com/MicrosoftDocs/azure-docs/issues/29115
I am successfully able to attach route tables and nsgs to subnets based on populated property values. However, I am unable to construct a fully qualified resource id using variables and parameters to conditionally deploy objects.
I have tried using Azure ARM functions such as subscription() and resource(). However, whenever I concatenate my FQDN string using these functions I receive an error about malformed JSON. As per the article above, MSFT support are stating that this needs to be passed through fully qualified and I havent been able to come up with a way to do this and convert it through using the json() function. I tested passing through a short name of the resource Id and the ARM API also reports that I need to pass this through as a fully qualified name
I really dont want these hard coded in the top of my template as I dont know what the resource id is until these objects are created. Plus it is obviously also bad practice, defeating the purpose of a reusable template.
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"location": {
"type": "string",
"allowedValues": ["australiaeast", "australiasoutheast"],
"defaultValue": "australiasoutheast",
"metadata": {
"description": "Deployment location"
}
},
"routeTables": {
"type": "array",
"defaultValue": [
"TrustedSubnets",
"UntrustedSubnets"
],
"metadata": {
"description": "Array of interconnect route table names, (e.g. GatewaySubnet / Internal / Onprem)"
}
},
"subnets": {
"type": "array",
"defaultValue": [
{
"Name": "Management",
"Address": "10.118.124.0/24",
"Nsg": "/sub/1234/resourceGroups/azresgroup/providers/Microsoft.Network/networkSecurityGroups/ManagementSn-ase-nsg",
"routeTable": "/sub/1234/resourceGroups/azresgroup/providers/Microsoft.Network/routeTables/TrustedSubnets-ase-rt"
},
{
"Name": "Trusted",
"Address": "10.118.125.0/24",
"Nsg": "/sub/1234/resourceGroups/azresgroup/providers/Microsoft.Network/networkSecurityGroups/TrustedSn-ase-nsg",
"routeTable": "/sub/1234/resourceGroups/azresgroup/providers/Microsoft.Network/routeTables/TrustedSubnets-ase-rt"
},
{
"Name": "Untrusted",
"Address": "10.118.126.0/24",
"Nsg": "/sub/1234/resourceGroups/azresgroup/providers/Microsoft.Network/networkSecurityGroups/UntrustedSn-ase-nsg",
"routeTable": "/sub/1234/resourceGroups/azresgroup/providers/Microsoft.Network/routeTables/UntrustedSubnets-ase-rt"
},
{
"Name": "GatewaySubnet",
"Address": "10.118.127.0/24",
"Nsg": "",
"routeTable": ""
}
],
"metadata": {
"description": "Subnet properties to be deployed per region. Each entry must contain a Name, Address, Nsg and routeTable key. Route tables and NSG's must be fully qualified"
}
},
"vnetName": {
"type": "string",
"defaultValue": "hubvnet",
"metadata": {
"description": "Virtual network name"
}
},
"vnetAddressPrefix": {
"type": "string",
"defaultValue": "10.118.124.0/22",
"metadata": {
"description": "Address prefix"
}
}
},
"variables": {
"alertsDistributionList": "dl_azurevnetalerts@email.com.au",
"HubNetAgResourceId": "[resourceId('microsoft.insights/actionGroups', concat(parameters('vnetName'), '-ag'))]",
"vnetResourceId": "[resourceId('Microsoft.Network/virtualNetworks', concat(parameters('vnetName')))]"
},
"resources": [
{
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2019-04-01",
"name": "[if(contains(parameters('location'), 'australiasoutheast'), concat(parameters('subnets')[copyIndex()].Name, 'Sn', '-ase-nsg'), concat(parameters('subnets')[copyIndex()].Name, 'Sn', '-ae-nsg'))]",
"location": "[parameters('location')]",
"copy": {
"name": "NsgCopy",
"count": 3,
"mode": "Serial",
"batchSize": 1
},
"properties": {
"securityRules": []
},
"dependsOn": []
},
{
"apiVersion": "2019-04-01",
"name": "[if(contains(parameters('location'), 'australiasoutheast'), concat(parameters('routeTables')[copyIndex()], '-ase-rt'), concat(parameters('routeTables')[copyIndex()], '-ae-rt'))]",
"type": "Microsoft.Network/routeTables",
"location": "[resourceGroup().location]",
"copy": {
"name": "RtCopy",
"count": "[length(parameters('routeTables'))]"
},
"properties": {
"routes": [],
"disableBgpRoutePropagation": true
}
},
{
"type": "Microsoft.Network/virtualNetworks",
"name": "[parameters('vnetName')]",
"apiVersion": "2019-04-01",
"location": "[resourceGroup().location]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[parameters('vnetAddressPrefix')]"
]
},
"dhcpOptions": {
"dnsServers": []
},
"virtualNetworkPeerings": [],
"copy": [{
"name": "subnets",
"count": "[length(parameters('subnets'))]",
"input": {
"name": "[parameters('subnets')[copyIndex('subnets')].Name]",
"properties": {
"addressPrefix": "[parameters('subnets')[copyIndex('subnets')].Address]",
"networkSecurityGroup": "[if(not(empty(parameters('subnets')[copyIndex('subnets')].Nsg)), json(concat('{\"id\": \"', parameters('subnets')[copyIndex('subnets')].Nsg, '\"}')), json('null'))]",
"routeTable": "[if(not(empty(parameters('subnets')[copyIndex('subnets')].routeTable)), json(concat('{\"id\": \"', parameters('subnets')[copyIndex('subnets')].routeTable, '\"}')), json('null'))]"
}
}
}]
},
"dependsOn": [
"NsgCopy",
"RtCopy"
]
}
]
}
I would like to avoid hard coding resource ID;s in the properties of my parameter where I declare an array of subnets. I would like these to be generated using intelligent logic and then converted and passed through as raw json in the subnet loop at the bottom
I have obfuscated my sub Id at the top of the template. Please replace your values if you would like to test my template
Any help is greatly appreciated. :)
