跨资源组配置Azure VM备份的BICEP代码求助

以下是适配跨资源组场景的完整BICEP代码，已整合VM创建与跨资源组Recovery Services Vault备份配置：

@description('虚拟机管理员用户名')
param adminUsername string

@description('虚拟机管理员密码')
@minLength(12)
@secure()
param adminPassword string

@description('VNET所在的资源组名称')
param vnetRgName string = 'resroucegroup1'

@description('Recovery Services Vault所在的资源组名称')
param rsvRgName string = 'backup-resource-group'

@description('Recovery Services Vault名称')
param rsvName string = 'my-recovery-vault'

@description('虚拟机Windows系统版本，将选用对应版本的最新补丁镜像')
@allowed([
  '2016-datacenter-gensecond'
  '2016-datacenter-server-core-g2'
  '2016-datacenter-server-core-smalldisk-g2'
  '2016-datacenter-smalldisk-g2'
  '2016-datacenter-with-containers-g2'
  '2016-datacenter-zhcn-g2'
  '2019-datacenter-core-g2'
  '2019-datacenter-core-smalldisk-g2'
  '2019-datacenter-core-with-containers-g2'
  '2019-datacenter-core-with-containers-smalldisk-g2'
  '2019-datacenter-gensecond'
  '2019-datacenter-smalldisk-g2'
  '2019-datacenter-with-containers-g2'
  '2019-datacenter-with-containers-smalldisk-g2'
  '2019-datacenter-zhcn-g2'
  '2022-datacenter-azure-edition'
  '2022-datacenter-azure-edition-core'
  '2022-datacenter-azure-edition-core-smalldisk'
  '2022-datacenter-azure-edition-smalldisk'
  '2022-datacenter-core-g2'
  '2022-datacenter-core-smalldisk-g2'
  '2022-datacenter-g2'
  '2022-datacenter-smalldisk-g2'
])
param OSVersion string = '2022-datacenter-azure-edition'

@description('虚拟机实例大小')
param vmSize string = 'Standard_D2s_v5'

@description('所有资源部署区域')
param location string = 'australiaeast'

@description('虚拟机名称')
param vmName string = 'simple-vm'

@description('虚拟机安全类型')
@allowed([
  'Standard'
  'TrustedLaunch'
])
param securityType string = 'TrustedLaunch'

var storageAccountName = 'bootdiagsabcdeg'
var nicName = 'myVMNic2'
var subnetName = 'Subnet'
var virtualNetworkName = 'MyVNET'
var securityProfileJson = {
  uefiSettings: {
    secureBootEnabled: true
    vTpmEnabled: true
  }
  securityType: securityType
}
var extensionName = 'GuestAttestation'
var extensionPublisher = 'Microsoft.Azure.Security.WindowsAttestation'
var extensionVersion = '1.0'
var maaTenantName = 'GuestAttestation'
var maaEndpoint = substring('emptyString', 0, 0)

// 引用跨资源组的VNET
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2022-09-01' existing = {
  name: virtualNetworkName
  scope: resourceGroup(vnetRgName)
}

// 引用跨资源组VNET下的子网
resource subnet 'Microsoft.Network/virtualNetworks/subnets@2022-07-01' existing = {
  name: subnetName
  parent: virtualNetwork
}

// 启动诊断存储账户
resource storageAccount 'Microsoft.Storage/storageAccounts@2022-05-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'Storage'
}

// 网络接口
resource nic 'Microsoft.Network/networkInterfaces@2022-05-01' = {
  name: nicName
  location: location
  properties: {
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          privateIPAllocationMethod: 'Dynamic'
          subnet: {
            id: subnet.id // 用existing资源引用替代硬编码ID
          }
        }
      }
    ]
  }
}

// 虚拟机
resource vm 'Microsoft.Compute/virtualMachines@2022-03-01' = {
  name: vmName
  location: location
  properties: {
    hardwareProfile: {
      vmSize: vmSize
    }
    osProfile: {
      computerName: vmName
      adminUsername: adminUsername
      adminPassword: adminPassword
    }
    storageProfile: {
      imageReference: {
        publisher: 'MicrosoftWindowsServer'
        offer: 'WindowsServer'
        sku: OSVersion
        version: 'latest'
      }
      osDisk: {
        createOption: 'FromImage'
        managedDisk: {
          storageAccountType: 'StandardSSD_LRS'
        }
      }
      dataDisks: [
        {
          diskSizeGB: 128
          lun: 0
          createOption: 'Empty'
        }
      ]
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nic.id
        }
      ]
    }
    diagnosticsProfile: {
      bootDiagnostics: {
        enabled: true
        storageUri: storageAccount.properties.primaryEndpoints.blob
      }
    }
    securityProfile: (securityType == 'TrustedLaunch') ? securityProfileJson : json('null')
  }
}

// TrustedLaunch验证扩展
resource vmExtension 'Microsoft.Compute/virtualMachines/extensions@2022-03-01' = if ((securityType == 'TrustedLaunch') && (securityProfileJson.uefiSettings.secureBootEnabled && securityProfileJson.uefiSettings.vTpmEnabled)) {
  parent: vm
  name: extensionName
  location: location
  properties: {
    publisher: extensionPublisher
    type: extensionName
    typeHandlerVersion: extensionVersion
    autoUpgradeMinorVersion: true
    settings: {
      AttestationConfig: {
        MaaSettings: {
          maaEndpoint: maaEndpoint
          maaTenantName: maaTenantName
        }
      }
    }
  }
}

// 引用跨资源组的Recovery Services Vault
resource recoveryVault 'Microsoft.RecoveryServices/vaults@2023-02-01' existing = {
  name: rsvName
  scope: resourceGroup(rsvRgName)
}

// 配置VM备份保护
resource vmBackup 'Microsoft.RecoveryServices/vaults/backupProtectionContainers/protectedItems@2023-01-01' = {
  parent: recoveryVault
  name: 'iaasvmcontainer;iaasvmcontainerv2;${resourceGroup().name};${vm.name}/${vm.name}'
  properties: {
    sourceResourceId: vm.id
    policyId: '${recoveryVault.id}/backupPolicies/DefaultPolicy' // 使用RSV默认备份策略，可替换为自定义策略ID
  }
}

核心修改点说明 #

1. 跨资源组资源引用：
   • 通过scope: resourceGroup(资源组名称)实现对VNET和Recovery Services Vault的跨组引用，避免硬编码资源ID，提升代码灵活性。
2. 备份保护配置：
   • 添加Microsoft.RecoveryServices/vaults/backupProtectionContainers/protectedItems资源，将VM与目标RSV关联，指定备份策略（示例用默认策略，可替换为自定义策略的完整ID）。
3. 规范子网引用：
   • 替换原代码硬编码的subnetID为subnet.id，利用BICEP的existing资源引用自动生成正确ID，减少维护成本。

内容的提问来源于stack exchange，提问作者treeof