使用Bicep为Databricks访问连接器分配角色时遇资源组未找到错误

我在通过Bicep同时部署Databricks工作区（含托管资源组及其中的访问连接器）和存储账户时，尝试将Databricks访问连接器分配为存储账户的Storage Blob Data Contributor角色，但部署时报错提示托管资源组不存在。

部署代码 #

main.bicep

module databricks 'platform/modules/databricks/deploy.bicep' = {
  name: 'DeployDatabricksWorkspace'
  params: {
    workspaceName: workspaceName
    pricingTier: pricingTier
    location: location
    disablePublicIp: disablePublicIp
    vnetID: vNetId
    environment: environment
  }
  dependsOn: [
    virtualNetwrok
  ]
}

module accessConnectorStorageRbac 'platform/modules/roles/accessConnector/deploy.bicep' = {
  name: 'AccessConnector-rbac'
  params: {
    storageAccountName: storageAccountName
    principalId: accessConnectorPrincipalId
    roleId: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
  }
  dependsOn: [
    storageAccountModule
    databricks
  ]
}

Databricks模块代码（platform/modules/databricks/deploy.bicep）

param disablePublicIp bool
param workspaceName string
param pricingTier string
param location string = resourceGroup().location
param vnetID string
param environment string

var managedResourceGroupName = 'rg-mgd-databricks-${workspaceName}-${uniqueString(workspaceName, resourceGroup().id)}'

resource workspace 'Microsoft.Databricks/workspaces@2024-05-01' = {
  name: workspaceName
  location: location
  sku: {
    name: pricingTier
  }
  properties: {
    managedResourceGroupId: managedResourceGroup.id
    parameters: {
      customVirtualNetworkId: {
        value: vnetID
      }
      customPublicSubnetName: {
        value: 'snet-ads-public-${environment}-weu-01'
      }
      customPrivateSubnetName: {
        value: 'snet-ads-private-${environment}-weu-01'
      }
      enableNoPublicIp: {
        value: disablePublicIp
      }
    }
  }
}

resource managedResourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' existing = {
  scope: subscription()
  name: managedResourceGroupName
}

resource accessConnector 'Microsoft.Databricks/accessConnectors@2024-05-01' existing = {
  name:'unity-catalog-access-connector'
  scope:resourceGroup(managedResourceGroupName)
  dependsOn: [
    managedResourceGroup
  ]
}

output accessConnectorPrincipalId string = accessConnector.identity.principalId

错误信息 #

Resource group 'rg-mgd-databricks-ads-mdp-comm-dev-weu-01-ntm7hk4xxjyda' could not be found

排查与解决方法 #

核心原因：托管资源组的existing声明时机错误

Databricks工作区部署时自动创建托管资源组，但你在模块中提前用existing引用该资源组——Bicep会在部署初期就尝试解析这个资源组，而此时托管资源组还未被创建，因此触发"未找到"错误。

修正方案1：修改Databricks模块代码

移除手动计算托管资源组名称的逻辑，改用Databricks工作区部署完成后输出的托管资源组ID来动态定位访问连接器：

param disablePublicIp bool
param workspaceName string
param pricingTier string
param location string = resourceGroup().location
param vnetID string
param environment string

resource workspace 'Microsoft.Databricks/workspaces@2024-05-01' = {
  name: workspaceName
  location: location
  sku: {
    name: pricingTier
  }
  properties: {
    parameters: {
      customVirtualNetworkId: {
        value: vnetID
      }
      customPublicSubnetName: {
        value: 'snet-ads-public-${environment}-weu-01'
      }
      customPrivateSubnetName: {
        value: 'snet-ads-private-${environment}-weu-01'
      }
      enableNoPublicIp: {
        value: disablePublicIp
      }
    }
  }
}

// 从工作区属性中提取已创建的托管资源组名称
var managedResourceGroupName = last(split(workspace.properties.managedResourceGroupId, '/'))

// 依赖工作区部署完成后，再引用托管资源组内的访问连接器
resource accessConnector 'Microsoft.Databricks/accessConnectors@2024-05-01' existing = {
  name: 'unity-catalog-access-connector'
  scope: resourceGroup(managedResourceGroupName)
  dependsOn: [workspace]
}

output accessConnectorPrincipalId string = accessConnector.identity.principalId

修正方案2：修复main.bicep的参数传递错误

你当前的main.bicep中直接使用accessConnectorPrincipalId作为参数，这会导致参数未定义的问题，需要改为引用Databricks模块的输出：

module accessConnectorStorageRbac 'platform/modules/roles/accessConnector/deploy.bicep' = {
  name: 'AccessConnector-rbac'
  params: {
    storageAccountName: storageAccountName
    principalId: databricks.outputs.accessConnectorPrincipalId // 引用模块输出的主体ID
    roleId: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
  }
  dependsOn: [
    storageAccountModule
    databricks
  ]
}

内容的提问来源于stack exchange，提问作者play_something_good