Bicep模块引用托管标识时资源组为<null>的问题求助

我使用New-AzDeployment部署订阅级Bicep模板，流程为：创建资源组→在资源组内创建托管标识→为该标识分配Key Vault Secret Users角色（角色ID：4633458b-17de-408a-b874-0445c86b69e6）。资源组和托管标识部署正常，但角色分配时报错：

The Resource 'Microsoft.ManagedIdentity/userAssignedIdentities/test_idenity' under resource group '<null>' was not found.

相关Bicep代码 #

主模板 main.bicep #

targetScope = 'subscription'

var location = 'westeurope'
var resourceGroupName = 'test_resourcegroup'

module resourcegroup 'resourcegroup/resourcegroup.bicep' = {
  name: 'resource_group_deployment'
  params: {
    resourceGroupName: resourceGroupName
    location: location
  }
}

module managedidentity 'serviceprincipal/managedidentity.bicep' = {
  scope: resourceGroup(resourceGroupName)
  name: 'managed_identity_deployment'
  params: {
    location: location
  }
  dependsOn: [
    resourcegroup
  ]
}

module serviceprincipal 'serviceprincipal/roleassignment.bicep' = {
  name: 'role_assignment'
  params: {
    principalId: (reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'test_idenity'), '2023-01-31', 'Full')).properties.principalId
    roleDefinitionResourceId: '4633458b-17de-408a-b874-0445c86b69e6'
  }
  dependsOn: [
    resourcegroup
    managedidentity
  ]
}

依赖模块 #

resourcegroup/resourcegroup.bicep

targetScope = 'subscription'

param resourceGroupName string
param location string = deployment().location

resource resourcegroup 'Microsoft.Resources/resourceGroups@2022-09-01' = {
  name: resourceGroupName
  location: location
}

serviceprincipal/managedidentity.bicep

param location string

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
  name: 'test_idenity'
  location: location
}

serviceprincipal/roleassignment.bicep

targetScope = 'subscription'
param roleDefinitionResourceId string
param principalId string

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(subscription().id, principalId, roleDefinitionResourceId)  
  properties: {
    principalId: principalId
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionResourceId)
    principalType: 'ServicePrincipal'
  }
}

错误原因 #

在订阅级模板中直接使用reference(resourceId(...))获取资源组内的托管标识时，默认上下文为订阅级别，不会自动关联目标资源组，导致系统无法定位到托管标识（资源组字段显示为<null>）。

解决方案 #

核心思路是从托管标识模块直接输出principalId，而非在主模板中手动引用资源，通过模块输出传递参数，避免上下文匹配问题：

1. 修改托管标识模块，添加输出 #

更新serviceprincipal/managedidentity.bicep，新增principalId输出：

param location string

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
  name: 'test_idenity'
  location: location
}

output principalId string = managedIdentity.properties.principalId

2. 主模板引用模块输出的principalId #

修改main.bicep中serviceprincipal模块的参数，直接使用托管标识模块的输出值：

module serviceprincipal 'serviceprincipal/roleassignment.bicep' = {
  name: 'role_assignment'
  params: {
    principalId: managedidentity.outputs.principalId
    roleDefinitionResourceId: '4633458b-17de-408a-b874-0445c86b69e6'
  }
  dependsOn: [
    resourcegroup
    managedidentity
  ]
}

验证 #

修改后重新执行New-AzDeployment，资源组、托管标识创建完成后，角色分配会自动获取正确的principalId，不会再出现资源组为<null>的错误。

内容的提问来源于stack exchange，提问作者TheBrickAdmin