如何编写并部署嵌套ARM模板？跨资源组部署Azure资源咨询

你的核心需求是通过嵌套ARM模板在两个资源组分别部署存储账户和对应私有端点，原模板存在几个关键问题（必填属性缺失、跨资源组引用错误、拼写问题等），以下是修正后的完整实现方案：

关键修正点 #

• 补充所有资源的必填属性（如存储账户的name、sku、kind、location，私有端点的子网、连接配置等）
• 跨资源组引用资源时，使用带订阅/资源组参数的resourceId函数生成完整资源ID
• 用参数/变量提升模板复用性，避免硬编码
• 修正拼写错误（storageAcountsName → storageAccountName）
• 第二个嵌套部署需明确指定目标资源组resourceGroupB

修正后的完整ARM模板 #

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "subscriptionId": {
            "type": "string",
            "defaultValue": "0000-000000-0000000",
            "metadata": {
                "description": "目标订阅ID"
            }
        },
        "resourceGroupA": {
            "type": "string",
            "defaultValue": "resourceGroupA",
            "metadata": {
                "description": "存储账户所在资源组"
            }
        },
        "resourceGroupB": {
            "type": "string",
            "defaultValue": "resourceGroupB",
            "metadata": {
                "description": "私有端点所在资源组"
            }
        },
        "location": {
            "type": "string",
            "defaultValue": "[resourceGroup().location]",
            "metadata": {
                "description": "资源部署位置"
            }
        },
        "storageAccountName": {
            "type": "string",
            "defaultValue": "staccountdemo001",
            "metadata": {
                "description": "存储账户名称（需全局唯一）"
            }
        },
        "vnetName": {
            "type": "string",
            "defaultValue": "vnet-demo",
            "metadata": {
                "description": "私有端点所在虚拟网络名称"
            }
        },
        "subnetName": {
            "type": "string",
            "defaultValue": "subnet-pe",
            "metadata": {
                "description": "私有端点所在子网名称"
            }
        }
    },
    "variables": {},
    "resources": [
        // 部署存储账户到ResourceGroupA
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2021-04-01",
            "name": "deploymentResourceGroupA",
            "subscriptionId": "[parameters('subscriptionId')]",
            "resourceGroup": "[parameters('resourceGroupA')]",
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {
                        "storageAccountName": { "type": "string" },
                        "location": { "type": "string" }
                    },
                    "resources": [
                        {
                            "type": "Microsoft.Storage/storageAccounts",
                            "apiVersion": "2023-01-01",
                            "name": "[parameters('storageAccountName')]",
                            "location": "[parameters('location')]",
                            "sku": {
                                "name": "Standard_LRS"
                            },
                            "kind": "StorageV2",
                            "properties": {
                                "supportsHttpsTrafficOnly": true
                            }
                        }
                        // 注：存储账户默认会自动创建blobServices/default、fileServices/default等，无需显式定义，除非需要自定义配置
                    ]
                },
                "parameters": {
                    "storageAccountName": { "value": "[parameters('storageAccountName')]" },
                    "location": { "value": "[parameters('location')]" }
                }
            }
        },
        // 部署私有端点到ResourceGroupB，依赖ResourceGroupA的存储账户
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2021-04-01",
            "name": "deploymentResourceGroupB",
            "subscriptionId": "[parameters('subscriptionId')]",
            "resourceGroup": "[parameters('resourceGroupB')]",
            "dependsOn": [
                "[resourceId('Microsoft.Resources/deployments', 'deploymentResourceGroupA')]"
            ],
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {
                        "storageAccountResourceId": { "type": "string" },
                        "location": { "type": "string" },
                        "vnetName": { "type": "string" },
                        "subnetName": { "type": "string" },
                        "peName": { "type": "string" }
                    },
                    "resources": [
                        {
                            "type": "Microsoft.Network/privateEndpoints",
                            "apiVersion": "2023-04-01",
                            "name": "[parameters('peName')]",
                            "location": "[parameters('location')]",
                            "properties": {
                                "subnet": {
                                    "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('vnetName'), parameters('subnetName'))]"
                                },
                                "privateLinkServiceConnections": [
                                    {
                                        "name": "pe-connection-storage",
                                        "properties": {
                                            "privateLinkServiceId": "[parameters('storageAccountResourceId')]",
                                            "groupIds": ["blob"] // 根据实际需求指定存储服务类型，如blob、file等
                                        }
                                    }
                                ]
                            }
                        }
                    ]
                },
                "parameters": {
                    "storageAccountResourceId": {
                        "value": "[resourceId(parameters('subscriptionId'), parameters('resourceGroupA'), 'Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
                    },
                    "location": { "value": "[parameters('location')]" },
                    "vnetName": { "value": "[parameters('vnetName')]" },
                    "subnetName": { "value": "[parameters('subnetName')]" },
                    "peName": { "value": "[concat('pe-', parameters('storageAccountName'))]" }
                }
            }
        }
    ]
}

额外说明 #

1. 存储账户服务默认创建：存储账户的blobServices、fileServices等默认会生成default实例，无需在模板中显式定义，除非你需要修改默认配置（如更改软删除规则）。
2. 私有端点子网要求：部署私有端点的子网必须禁用privateEndpointNetworkPolicies，可在模板中添加子网资源或提前配置。
3. 部署方式：此模板需在根级别部署（即订阅范围或管理组范围），才能跨资源组部署资源。

内容的提问来源于stack exchange，提问作者user19504539