跨订阅VNet对等连接ARM模板部署报错求助

问题背景 #

我正在创建ARM模板，用于新建包含子网的VNet，并与另一订阅中的现有VNet建立虚拟网络对等连接。单订阅场景下模板可正常运行，但跨订阅版本部署时出现资源找不到的错误。

跨订阅ARM模板代码 #

{  
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",  
  "contentVersion": "1.0.0.0",  
  "parameters": {    
    "vnet1Name": {      
      "type": "string",      
      "defaultValue": "VNet1",      
      "metadata": {        
        "description": "新建VNet名称"      
      }    
    },    
    "vnet1AddressPrefix": {      
      "type": "string",      
      "defaultValue": "10.0.0.0/16",      
      "metadata": {        
        "description": "新建VNet地址前缀"      
      }    
    },    
    "subnet1Name": {      
      "type": "string",      
      "defaultValue": "Subnet1",      
      "metadata": {        
        "description": "子网名称"      
      }    
    },    
    "subnet1Prefix": {      
      "type": "string",      
      "defaultValue": "10.0.0.0/24",      
      "metadata": {        
        "description": "子网地址前缀"      
      }    
    },    
    "vnet2Name": {      
      "type": "string",      
      "defaultValue": "Hub_network",      
      "metadata": {        
        "description": "现有Hub VNet名称"      
      }    
    },    
    "vnet2ResourceGroup": {      
      "type": "string",      
      "metadata": {        
        "description": "现有Hub VNet所在资源组名称"      
      }    
    },    
    "subscription1ID": {      
      "type": "string",      
      "metadata": {        
        "description": "新建VNet所属订阅ID"      
      }    
    },    
    "subscription2ID": {      
      "type": "string",      
      "metadata": {        
        "description": "现有Hub VNet所属订阅ID"      
      }    
    },    
    "location": {      
      "type": "string",      
      "defaultValue": "[resourceGroup().location]",      
      "metadata": {        
        "description": "新建VNet的区域"      
      }    
    }  
  },  
  "resources": [    
    {      
      "type": "Microsoft.Network/virtualNetworks",      
      "apiVersion": "2021-08-01",      
      "name": "[parameters('vnet1Name')]",      
      "location": "[parameters('location')]",      
      "properties": {        
        "addressSpace": {          
          "addressPrefixes": [            
            "[parameters('vnet1AddressPrefix')]"          
          ]        
        },        
        "subnets": [          
          {            
            "name": "[parameters('subnet1Name')]",            
            "properties": {              
              "addressPrefix": "[parameters('subnet1Prefix')]"            
            }          
          }        
        ]      
      }    
    },    
    {      
      "apiVersion": "2020-06-01",      
      "name": "createPeeringAtoB",      
      "type": "Microsoft.Resources/deployments",      
      "location": "[parameters('location')]",      
      "subscriptionId": "[parameters('subscription1ID')]",      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",              
              "apiVersion": "2020-05-01",              
              "name": "[concat(parameters('vnet1Name'), '/to-', parameters('vnet2Name'))]",              
              "properties": {                
                "peeringState": "Connected",                
                "remoteVirtualNetwork": {                  
                  "id": "[concat('/subscriptions/',parameters('subscription2ID'),'/resourceGroups/',parameters('vnet2ResourceGroup'),'/providers/Microsoft.Network/virtualNetworks/', parameters('vnet2Name'))]"                
                },                
                "allowVirtualNetworkAccess": true,                
                "allowForwardedTraffic": true,                
                "allowGatewayTransit": false,                
                "useRemoteGateways": false              
              }            
            }          
          ]        
        }      
      }    
    },    
    {      
      "apiVersion": "2020-06-01",      
      "name": "createPeeringBtoA",      
      "type": "Microsoft.Resources/deployments",      
      "location": "[parameters('location')]",      
      "subscriptionId": "[parameters('subscription2ID')]",      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",              
              "apiVersion": "2020-05-01",              
              "name": "[concat(parameters('vnet2Name'), '/to-', parameters('vnet1Name'))]",              
              "properties": {                
                "peeringState": "Connected",                
                "remoteVirtualNetwork": {                  
                  "id": "[concat('/subscriptions/',parameters('subscription1ID'),'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Network/virtualNetworks/', parameters('vnet1Name'))]"                
                },                
                "allowVirtualNetworkAccess": true,                
                "allowForwardedTraffic": true,                
                "allowGatewayTransit": false,                
                "useRemoteGateways": false              
              }            
            }          
          ]        
        }      
      }    
    }  
  ]
}

报错信息 #

{"code":"DeploymentFailed","message":"至少有一个资源部署操作失败。请列出部署操作以获取详细信息。","details":[{"code":"NotFound","message":"{\r\n  \"error\": {\r\n    \"code\": \"ResourceNotFound\",\r\n    \"message\": \"未找到资源组'<null>'下的资源'Microsoft.Network/virtualNetworks/VNet1'。\"\r\n  }\r\n}"}]}

错误原因及修复方案 #

错误原因 #

1. 跨订阅嵌套部署未指定资源组：原模板中createPeeringAtoB和createPeeringBtoA仅指定订阅ID，未明确资源组，导致ARM无法定位VNet所在资源组，出现<null>资源组错误。
2. 资源组引用错误：createPeeringBtoA中使用resourceGroup().name获取VNet1的资源组，但该函数在subscription2的嵌套部署中返回的是subscription2下的资源组，而非VNet1所在的subscription1资源组，导致VNet1的ID拼接错误。
3. 对等连接状态设置错误：手动将peeringState设为Connected不符合跨订阅对等连接逻辑，该状态由Azure自动同步，无需手动指定。

修复后的模板 #

{  
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",  
  "contentVersion": "1.0.0.0",  
  "parameters": {    
    "vnet1Name": {      
      "type": "string",      
      "defaultValue": "VNet1",      
      "metadata": {        
        "description": "新建VNet名称"      
      }    
    },    
    "vnet1AddressPrefix": {      
      "type": "string",      
      "defaultValue": "10.0.0.0/16",      
      "metadata": {        
        "description": "新建VNet地址前缀"      
      }    
    },    
    "subnet1Name": {      
      "type": "string",      
      "defaultValue": "Subnet1",      
      "metadata": {        
        "description": "子网名称"      
      }    
    },    
    "subnet1Prefix": {      
      "type": "string",      
      "defaultValue": "10.0.0.0/24",      
      "metadata": {        
        "description": "子网地址前缀"      
      }    
    },    
    "vnet2Name": {      
      "type": "string",      
      "defaultValue": "Hub_network",      
      "metadata": {        
        "description": "现有Hub VNet名称"      
      }    
    },    
    "vnet2ResourceGroup": {      
      "type": "string",      
      "metadata": {        
        "description": "现有Hub VNet所在资源组名称"      
      }    
    },    
    "vnet1ResourceGroup": {      
      "type": "string",      
      "metadata": {        
        "description": "新建VNet所在资源组名称"      
      }    
    },    
    "subscription1ID": {      
      "type": "string",      
      "metadata": {        
        "description": "新建VNet所属订阅ID"      
      }    
    },    
    "subscription2ID": {      
      "type": "string",      
      "metadata": {        
        "description": "现有Hub VNet所属订阅ID"      
      }    
    },    
    "location": {      
      "type": "string",      
      "defaultValue": "[resourceGroup().location]",      
      "metadata": {        
        "description": "新建VNet的区域"      
      }    
    }  
  },  
  "resources": [    
    {      
      "type": "Microsoft.Network/virtualNetworks",      
      "apiVersion": "2021-08-01",      
      "name": "[parameters('vnet1Name')]",      
      "location": "[parameters('location')]",      
      "properties": {        
        "addressSpace": {          
          "addressPrefixes": [            
            "[parameters('vnet1AddressPrefix')]"          
          ]        
        },        
        "subnets": [          
          {            
            "name": "[parameters('subnet1Name')]",            
            "properties": {              
              "addressPrefix": "[parameters('subnet1Prefix')]"            
            }          
          }        
        ]      
      }    
    },    
    {      
      "apiVersion": "2020-06-01",      
      "name": "createPeeringAtoB",      
      "type": "Microsoft.Resources/deployments",      
      "location": "[parameters('location')]",      
      "subscriptionId": "[parameters('subscription1ID')]",      
      "resourceGroup": "[parameters('vnet1ResourceGroup')]",      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",              
              "apiVersion": "2020-05-01",              
              "name": "[concat(parameters('vnet1Name'), '/to-', parameters('vnet2Name'))]",              
              "properties": {                
                "remoteVirtualNetwork": {                  
                  "id": "[concat('/subscriptions/',parameters('subscription2ID'),'/resourceGroups/',parameters('vnet2ResourceGroup'),'/providers/Microsoft.Network/virtualNetworks/', parameters('vnet2Name'))]"                
                },                
                "allowVirtualNetworkAccess": true,                
                "allowForwardedTraffic": true,                
                "allowGatewayTransit": false,                
                "useRemoteGateways": false              
              }            
            }          
          ]        
        }      
      }    
    },    
    {      
      "apiVersion": "2020-06-01",      
      "name": "createPeeringBtoA",      
      "type": "Microsoft.Resources/deployments",      
      "location": "[parameters('location')]",      
      "subscriptionId": "[parameters('subscription2ID')]",      
      "resourceGroup": "[parameters('vnet2ResourceGroup')]",      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",              
              "apiVersion": "2020-05-01",              
              "name": "[concat(parameters('vnet2Name'), '/to-', parameters('vnet1Name'))]",              
              "properties": {                
                "remoteVirtualNetwork": {                  
                  "id": "[concat('/subscriptions/',parameters('subscription1ID'),'/resourceGroups/',parameters('vnet1ResourceGroup'),'/providers/Microsoft.Network/virtualNetworks/', parameters('vnet1Name'))]"                
                },                
                "allowVirtualNetworkAccess": true,                
                "allowForwardedTraffic": true,                
                "allowGatewayTransit": false,                
                "useRemoteGateways": false              
              }            
            }          
          ]        
        }      
      }    
    }  
  ]
}

关键修复点说明 #

1. 新增资源组参数：添加vnet1ResourceGroup参数，明确传递新建VNet所在的资源组名称。
2. 嵌套部署指定资源组：在两个跨订阅嵌套部署中新增resourceGroup属性，分别绑定VNet1和VNet2的资源组，确保ARM能准确定位目标资源。
3. 修正VNet ID引用：在createPeeringBtoA中用parameters('vnet1ResourceGroup')替代resourceGroup().name，正确拼接VNet1的完整资源ID。
4. 移除手动状态设置：删除peeringState属性，由Azure自动处理跨订阅对等连接的状态同步。

内容的提问来源于stack exchange，提问作者Michał Olczyk