Bicep嵌套循环语法问题：多AD组多RBAC角色分配至存储账户

问题背景 #

需要为存储账户批量分配多个AD组到多个RBAC角色，计划遍历adGroup数组与roleId数组实现操作，但编写的Bicep代码存在语法错误，以下是调用模块及模块内的代码：

调用模块原代码 #

param adGroup array

module addGroups 'platform/modules/roles/aad group/deploy.bicep' = {
  name: 'datalake-rbac'
  params: {
    storageAccountName: storageAccountName
    adGroup: adGroup
    roleId: ['ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
             'b24988ac-6180-42a0-ab88-20f7382dd24c' // Contributor
  ]
  }
  dependsOn: [
    storageAccountModule

  ]
}

模块内原代码 #

param storageAccountName string
param addGroup array
param roleId array
param principalType string = 'Group'

// Reference to the storage account
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

// Flatten the loop into a single array using a combined `for` loop
resource roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for groupId in addGroup: for rId in roleId: {
  name: guid(subscription().subscriptionId, resourceGroup().name, storageAccountName, groupId, rId)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', rId)
    principalId: groupId
    principalType: principalType
  }
}]

错误排查与修复方案 #

1. 参数名不匹配 #

调用模块时传递的参数是adGroup，但模块内定义的参数是addGroup，拼写错误导致参数无法正确传递。需将模块内的参数名改为adGroup，与调用端保持一致。

2. 数组括号未闭合 #

调用模块中的roleId数组末尾缺少闭合的]，属于语法错误，需补全括号。

3. 不支持嵌套for循环定义资源 #

Bicep不允许直接使用嵌套的for循环来定义资源数组，需通过flatten函数将二维的组-角色组合转换为一维数组，再进行循环。

修复后的完整代码 #

修复后的调用模块代码 #

param adGroup array

module addGroups 'platform/modules/roles/aad group/deploy.bicep' = {
  name: 'datalake-rbac'
  params: {
    storageAccountName: storageAccountName
    adGroup: adGroup
    roleId: [
      'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
      'b24988ac-6180-42a0-ab88-20f7382dd24c' // Contributor
    ]
  }
  dependsOn: [
    storageAccountModule
  ]
}

修复后的模块内代码 #

param storageAccountName string
param adGroup array
param roleId array
param principalType string = 'Group'

// 引用存储账户
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

// 构造包含所有AD组与角色组合的一维数组
var roleAssignmentsArray = flatten([for groupId in adGroup: [for rId in roleId: {
  groupId: groupId
  roleId: rId
}]])

// 批量创建角色分配
resource roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for assignment in roleAssignmentsArray: {
  name: guid(subscription().subscriptionId, resourceGroup().name, storageAccountName, assignment.groupId, assignment.roleId)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', assignment.roleId)
    principalId: assignment.groupId
    principalType: principalType
  }
}]

内容的提问来源于stack exchange，提问作者play_something_good