部署带私有端点的Key Vault时出现NIC名称不可修改错误

问题原因 #

Azure创建私有端点时，会自动生成格式为<私有端点名称>-nic的NIC资源。重新部署ARM模板时，如果没有显式指定现有NIC的名称，ARM会尝试将NIC名称重置为空值，触发NameOfExistingPrivateEndpointNicCannotBeChanged错误——Azure不允许修改已存在的私有端点NIC名称。

解决方案 #

在私有端点资源的properties中添加customNetworkInterfaceName属性，显式指定与现有NIC一致的名称（默认就是私有端点名称加-nic后缀）。

修改后的ARM模板片段 #

找到Microsoft.Network/privateEndpoints资源部分，添加customNetworkInterfaceName配置：

{
  "type": "Microsoft.Network/privateEndpoints",
  "apiVersion": "2024-01-01",
  "name": "[parameters('pvtEndpointConnKv')]",
  "location": "[parameters('location')]",
  "dependsOn": [
    "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
  ],
  "properties": {
    "customNetworkInterfaceName": "[concat(parameters('pvtEndpointConnKv'), '-nic')]", // 显式指定现有NIC名称
    "subnet": {
      "id": "[parameters('subnetId1')]"
    },
    "privateLinkServiceConnections": [
      {
        "name": "[parameters('privateLinkServiceConnectionName1')]",
        "properties": {
          "privateLinkServiceId": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
          "groupIds": ["vault"],
          "requestMessage": ""
        }
      }
    ]
  }
}

额外优化建议 #

利用模板中的deployPrivateEndpoint参数添加条件部署，避免重复创建已存在的私有端点：

{
  "type": "Microsoft.Network/privateEndpoints",
  "apiVersion": "2024-01-01",
  "name": "[parameters('pvtEndpointConnKv')]",
  "condition": "[parameters('deployPrivateEndpoint')]", // 仅当参数为true时部署
  "location": "[parameters('location')]",
  "dependsOn": [
    "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
  ],
  "properties": {
    "customNetworkInterfaceName": "[concat(parameters('pvtEndpointConnKv'), '-nic')]",
    "subnet": {
      "id": "[parameters('subnetId1')]"
    },
    "privateLinkServiceConnections": [
      {
        "name": "[parameters('privateLinkServiceConnectionName1')]",
        "properties": {
          "privateLinkServiceId": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
          "groupIds": ["vault"],
          "requestMessage": ""
        }
      }
    ]
  }
}

验证修改 #

重新部署模板时，ARM会识别到指定的NIC名称与现有资源一致，不会触发修改操作，即可正常完成部署。

内容的提问来源于stack exchange，提问作者Abhijeet