Azure App Service Bicep模块证书与主机名绑定条件部署问题

问题描述 #

开发用于Azure DevOps部署Azure App Service的Bicep模块时，遇到以下问题：

• 当通过customHostnameConfiguration参数传入证书配置时，App Service部署正常，能创建Key Vault证书引用并绑定到指定主机名。
• 当不传入customHostnameConfiguration参数时，App Service会被创建，但部署仍会尝试创建Microsoft.Web/certificates和Microsoft.Web/sites/hostNameBindings资源，因证书资源名称为空字符串或无效评估导致部署失败。

尝试过用if (!empty(customHostnameConfiguration))做条件部署，配合三元运算符处理属性，但未解决问题。

解决方案 #

通过以下步骤实现证书和主机名绑定的按需条件部署：

1. 调整参数默认值 #

将customHostnameConfiguration参数的默认值从空对象改为null，明确表示“未提供配置”的状态：

@description('Optional. The custom hostname and key vault object for custom hostname configuration. Get and List access policy will be generated for this app service system assigned managed identity')
param customHostnameConfiguration object = null

2. 优化资源条件判断 #

对证书和主机名绑定资源，使用更严谨的条件判断，确保只有当配置存在且有效时才部署：

• 证书资源：同时检查参数不为null且非空
• 主机名绑定资源：复用相同的条件判断，避免无效评估

3. 简化资源属性表达式 #

条件满足时直接访问配置属性，无需三元运算符兜底（条件已确保配置存在），避免生成空字符串等无效值。

修改后的App Service Bicep核心代码示例 #

//KeyVault Certificate
resource appServiceCertificate 'Microsoft.Web/certificates@2022-03-01' = if (customHostnameConfiguration != null && !empty(customHostnameConfiguration)) {
  name: customHostnameConfiguration.appServiceCertificateName
  location: location
  properties: { 
    keyVaultId: resourceId(customHostnameConfiguration.keyVaultResourceGroup, 'Microsoft.KeyVault/vaults', customHostnameConfiguration.keyVaultName)
    keyVaultSecretName: customHostnameConfiguration.keyVaultCertificateSecretName
    serverFarmId: appServicePlanId
  }
}

//Create the app service
resource app 'Microsoft.Web/sites@2021-03-01' = {
  name: name
  location: location
  kind: kind
  tags: tags
  identity: identity
  properties: {
    serverFarmId: appServicePlanId
    clientAffinityEnabled: clientAffinityEnabled
    httpsOnly: httpsOnly
    hostingEnvironmentProfile: !empty(appServiceEnvironmentId) ? {
      id: appServiceEnvironmentId
    } : null
    storageAccountRequired: storageAccountRequired
    keyVaultReferenceIdentity: !empty(keyVaultAccessIdentityResourceId) ? keyVaultAccessIdentityResourceId : null
    siteConfig: siteConfig
    clientCertEnabled: clientCertEnabled
    clientCertMode: clientCertMode
    containerSize: containerSize != -1 ? containerSize : null
    customDomainVerificationId: !empty(customDomainVerificationId) ? customDomainVerificationId : null
    dailyMemoryTimeQuota: dailyMemoryTimeQuota != -1 ? dailyMemoryTimeQuota : null
    enabled: enabled
    hostNamesDisabled: false
    hyperV: hyperV
    redundancyMode: redundancyMode
  }
}

resource hostNameBinding 'Microsoft.Web/sites/hostNameBindings@2021-03-01' = if (customHostnameConfiguration != null && !empty(customHostnameConfiguration)) {
    name: customHostnameConfiguration.customHostName
    parent: app
    properties: {
      siteName: app.name
      sslState: 'SniEnabled'
      thumbprint: appServiceCertificate.properties.thumbprint
    }
  }

验证效果 #

• 无证书配置场景：不传customHostnameConfiguration参数时，参数值为null，证书和主机名绑定资源不会被部署，App Service正常创建。
• 带证书配置场景：传入有效customHostnameConfiguration时，条件满足，证书和绑定资源正常部署，完成自定义域名的SSL绑定。

内容的提问来源于stack exchange，提问作者Phil Murray