跨资源组为Azure应用服务托管标识分配Service Bus Sender角色失败

问题背景 #

需要通过Bicep模块为应用服务的托管标识分配Azure Service Bus Sender角色，但Service Bus实例与应用服务不在同一资源组。尝试将模块作用域设置到Service Bus所在资源组后，依然报错找不到目标资源。

原模块代码 #

param principalId string
param roleDefinitionID string
param serviceBusName string

resource serviceBus 'Microsoft.ServiceBus/namespaces@2022-10-01-preview' existing = {
  name: serviceBusName
}

resource azureServiceBusDataRoleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
  scope: subscription()
  name: roleDefinitionID
}

resource AzureServiceBusRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(subscription().id, principalId, roleDefinitionID)
  scope: serviceBus
  properties: {
    principalId: principalId
    roleDefinitionId: azureServiceBusDataRoleDefinition.id 
    principalType: 'ServicePrincipal' 
  }
}

模块调用代码 #

module azureServiceBusSenderPremissions './azureServiceBus-roleassignment.bicep' = if (useAzureServiceBus){
  name: '${deployment().name}-bbb-${appServiceName}'
  scope: resourceGroup(serviceBusResourceGroup)
  params:{
    principalId: appServicesResource.identity.principalId
    roleDefinitionID: '69a216fc-b8fb-44d8-bc22-1f3c2cd27a39'
    serviceBusName: serviceBusName
  }
}

报错信息 #

The Resource 'Microsoft.ServiceBus/namespaces/providers' under resource group 'appservice-resourceGroup' was not found.

修复方案 #

修改后的Bicep模块 #

param principalId string
param roleDefinitionID string
param serviceBusName string
param serviceBusResourceGroup string // 新增参数：指定Service Bus所在资源组

resource serviceBus 'Microsoft.ServiceBus/namespaces@2022-10-01-preview' existing = {
  name: serviceBusName
  scope: resourceGroup(serviceBusResourceGroup) // 明确指定Service Bus的资源组作用域
}

resource azureServiceBusDataRoleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
  scope: subscription()
  name: roleDefinitionID
}

resource AzureServiceBusRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(serviceBus.id, principalId, roleDefinitionID) // 基于Service Bus实例ID生成唯一标识，避免跨资源冲突
  scope: serviceBus
  properties: {
    principalId: principalId
    roleDefinitionId: azureServiceBusDataRoleDefinition.id 
    principalType: 'ServicePrincipal' 
  }
}

修改后的模块调用 #

module azureServiceBusSenderPremissions './azureServiceBus-roleassignment.bicep' = if (useAzureServiceBus){
  name: '${deployment().name}-bbb-${appServiceName}'
  params:{
    principalId: appServicesResource.identity.principalId
    roleDefinitionID: '69a216fc-b8fb-44d8-bc22-1f3c2cd27a39'
    serviceBusName: serviceBusName
    serviceBusResourceGroup: serviceBusResourceGroup // 传递Service Bus所在资源组参数
  }
}

修复说明 #

1. 新增资源组参数：通过serviceBusResourceGroup参数明确指定Service Bus所在资源组，无需依赖模块部署作用域
2. 指定资源查找范围：在existing Service Bus资源中配置scope: resourceGroup(serviceBusResourceGroup)，确保精准定位目标资源
3. 优化角色分配命名：改用serviceBus.id生成角色分配名称的GUID，避免跨资源场景下的命名冲突

内容的提问来源于stack exchange，提问作者Don Chambers