ARM模板同时创建Resource Group与NSG时出现ResourceGroupNotFound错误

问题描述 #

我希望在同一个ARM模板中先创建Resource Group，再在该资源组内创建NSG，使用的ARM模板如下：

{  
  "$schema": "http://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",  
  "contentVersion": "1.0.0.0", 
  "resources": [    
    {      
      "type": "Microsoft.Resources/deployments",      
      "apiVersion": "2021-04-01",      
      "name": "deployment-rg",      
      "location": "easatus",      
      "subscriptionId": "[parameters('subscriptionId')]",      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "type": "Microsoft.Resources/resourceGroups",              
              "apiVersion": "2021-04-01",              
              "name": "demo-test",              
              "location": "eastus",              
              "properties": {}            
            }          
          ],          
          "outputs": {}        
        }      
      }    
    },    
    {      
      "type": "Microsoft.Resources/deployments",      
      "apiVersion": "2021-04-01",      
      "name": "deployment-nsg",      
      "comments": "test vnet",      
      "resourceGroup": "demo-test",      
      "dependsOn": [        
        "['deployment-rg']"      
      ],      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "apiVersion": "2020-05-01",              
              "type": "Microsoft.Network/networkSecurityGroups",              
              "name": "nsg",              
              "location": "eastus",              
              "properties": {                
                "securityRules": [                  
                  {                    
                    "name": "AllowAll",                    
                    "properties": {                      
                      "priority": 100,                      
                      "protocol": "*",                      
                      "sourcePortRange": "*",                      
                      "destinationPortRange": "4489",                      
                      "sourceAddressPrefix": "Gateway",                      
                      "destinationAddressPrefix": "*",                      
                      "access": "Allow",                      
                      "direction": "Inbound",                      
                      "sourcePortRanges": [],                      
                      "destinationPortRanges": [],                      
                      "sourceAddressPrefixes": [],                      
                      "destinationAddressPrefixes": [],                      
                      "description": "more info."                    
                    }                  
                  }                
                ]              
              },              
              "tags": {                
                "resourceType": "Demo NSG",                
                "clusterName": "Apps Demo"              
              }            
            }          
          ]        
        }      
      }    
  }  
}

错误信息 #

Error: Code=ResourceGroupNotFound; Message=Resource group 'demo-test' could not be found.

问题原因 #

• dependsOn格式错误：dependsOn数组中的"['deployment-rg']"是错误写法，多了一层引号和方括号嵌套，导致Azure无法正确解析依赖关系，NSG部署流程未等待资源组创建完成就启动。
• 资源组部署的location拼写错误：第一个部署资源的location字段写成了"easatus"，正确值应为"eastus"，该错误会引发资源组部署的额外异常。

修复方案 #

1. 修正dependsOn格式：将dependsOn数组中的值改为"deployment-rg"（同层级部署资源可直接使用资源名称），或者使用完整资源ID表达式"[resourceId('Microsoft.Resources/deployments', 'deployment-rg')]"。
2. 修正location拼写：将第一个部署资源的"location": "easatus"修改为"location": "eastus"。

修复后的完整模板 #

{  
  "$schema": "http://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",  
  "contentVersion": "1.0.0.0", 
  "resources": [    
    {      
      "type": "Microsoft.Resources/deployments",      
      "apiVersion": "2021-04-01",      
      "name": "deployment-rg",      
      "location": "eastus",      
      "subscriptionId": "[parameters('subscriptionId')]",      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "type": "Microsoft.Resources/resourceGroups",              
              "apiVersion": "2021-04-01",              
              "name": "demo-test",              
              "location": "eastus",              
              "properties": {}            
            }          
          ],          
          "outputs": {}        
        }      
      }    
    },    
    {      
      "type": "Microsoft.Resources/deployments",      
      "apiVersion": "2021-04-01",      
      "name": "deployment-nsg",      
      "comments": "test vnet",      
      "resourceGroup": "demo-test",      
      "dependsOn": [        
        "deployment-rg"      
      ],      
      "properties": {        
        "mode": "Incremental",        
        "template": {          
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",          
          "contentVersion": "1.0.0.0",          
          "resources": [            
            {              
              "apiVersion": "2020-05-01",              
              "type": "Microsoft.Network/networkSecurityGroups",              
              "name": "nsg",              
              "location": "eastus",              
              "properties": {                
                "securityRules": [                  
                  {                    
                    "name": "AllowAll",                    
                    "properties": {                      
                      "priority": 100,                      
                      "protocol": "*",                      
                      "sourcePortRange": "*",                      
                      "destinationPortRange": "4489",                      
                      "sourceAddressPrefix": "Gateway",                      
                      "destinationAddressPrefix": "*",                      
                      "access": "Allow",                      
                      "direction": "Inbound",                      
                      "sourcePortRanges": [],                      
                      "destinationPortRanges": [],                      
                      "sourceAddressPrefixes": [],                      
                      "destinationAddressPrefixes": [],                      
                      "description": "more info."                    
                    }                  
                  }                
                ]              
              },              
              "tags": {                
                "resourceType": "Demo NSG",                
                "clusterName": "Apps Demo"              
              }            
            }          
          ]        
        }      
      }    
  }  
}

内容的提问来源于stack exchange，提问作者Neo