跨资源组ARM模板角色分配报错：找不到ResourceGroupB中的KeyVault

问题根源 #

你在ResourceGroupA层级部署ARM模板时，ARM默认会以当前资源组作为上下文查找资源，即便你在scope中指定了ResourceGroupB的KeyVault路径，系统仍会尝试在ResourceGroupA中定位该KeyVault，导致资源未找到的错误。

解决方案 #

方案1：切换为订阅层级部署 #

将模板部署到订阅层级，而非ResourceGroupA层级，这样ARM不会局限于单个资源组的上下文。使用Azure CLI的部署命令示例：

az deployment sub create --location eastus --template-file ./your-template.json --parameters managedIdentityName=mymanagedidentityname

方案2：在RG级部署中显式指定KeyVault的完整资源ID #

如果必须在ResourceGroupA层级部署，修改模板，用resourceId函数显式指定KeyVault所属的资源组，确保ARM能正确定位目标资源：

修改后的完整模板：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "managedIdentityName": {
      "type": "string",
      "defaultValue": "mymanagedidentityname"
    }
  },
  "variables": {
    "kvResourceGroupName": "ResourceGroupB",
    "kvName": "myKv",
    "userAssignedIdentityApiVersion": "2018-11-30",
    "kvSecretsUserRoleId": "b86a8fe4-44ce-4948-aee5-eccb2c155cd7",
    "kvResourceId": "[resourceId(variables('kvResourceGroupName'), 'Microsoft.KeyVault/vaults', variables('kvName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(subscription().id, variables('kvResourceId'), parameters('managedIdentityName'), variables('kvSecretsUserRoleId'))]",
      "scope": "[variables('kvResourceId')]",
      "properties": {
        "roleDefinitionId": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', variables('kvSecretsUserRoleId'))]",
        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('managedIdentityName')), variables('userAssignedIdentityApiVersion')).principalId]"
      }
    }
  ]
}

额外注意事项 #

• 执行部署的账号需要同时具备：
  • ResourceGroupA的Microsoft.Resources/deployments/write权限
  • ResourceGroupB中KeyVault的Microsoft.Authorization/roleAssignments/write权限

内容的提问来源于stack exchange，提问作者narcs