如何向ARM模板的resourceid函数传递动态参数

1. 调整参数结构 #

修改roleAssignment数组的定义，将resourceName字段改为数组类型，每个元素对应嵌套资源的一层名称：

• 对于顶层资源（如Microsoft.EventHub/namespaces），resourceName为单元素数组：["my-namespace"]
• 对于二级嵌套资源（如Microsoft.EventHub/namespaces/eventhubs），resourceName为双元素数组：["my-namespace", "my-eventhub"]
• 更深层级的资源以此类推，数组长度与资源类型的嵌套层级数一致。

2. 动态构建Scope的资源ID #

放弃使用resourceId函数，直接按照Azure资源ID的固定格式拼接字符串，适配所有嵌套场景：

"scope": "[concat(
  '/subscriptions/', subscription().subscriptionId,
  '/resourceGroups/', parameters('roleAssignment')[copyIndex()].resourceGroup,
  '/providers/', parameters('roleAssignment')[copyIndex()].resourceType,
  '/', join(parameters('roleAssignment')[copyIndex()].resourceName, '/')
)]"

完整模板片段示例 #

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "roleAssignment": {
      "type": "array",
      "metadata": {
        "description": "输入目标资源的权限分配详情"
      },
      "defaultValue": []
    }
  },
  "resources": [
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2020-04-01-preview",
      "name": "[guid(parameters('roleAssignment')[copyIndex()].principalId, parameters('roleAssignment')[copyIndex()].roleDefinitionId, parameters('roleAssignment')[copyIndex()].resourceGroup)]",
      "scope": "[concat(
        '/subscriptions/', subscription().subscriptionId,
        '/resourceGroups/', parameters('roleAssignment')[copyIndex()].resourceGroup,
        '/providers/', parameters('roleAssignment')[copyIndex()].resourceType,
        '/', join(parameters('roleAssignment')[copyIndex()].resourceName, '/')
      )]",
      "properties": {
        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', parameters('roleAssignment')[copyIndex()].roleDefinitionId)]",
        "principalId": "[parameters('roleAssignment')[copyIndex()].principalId]"
      }
    }
  ],
  "copy": {
    "name": "roleAssignmentCopy",
    "count": "[length(parameters('roleAssignment'))]"
  }
}

参数示例 #

{
  "roleAssignment": [
    {
      "resourceGroup": "my-rg",
      "resourceType": "Microsoft.EventHub/namespaces",
      "resourceName": ["my-eventhub-ns"],
      "roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c", // 参与者角色ID
      "principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    },
    {
      "resourceGroup": "my-rg",
      "resourceType": "Microsoft.EventHub/namespaces/eventhubs",
      "resourceName": ["my-eventhub-ns", "my-eventhub"],
      "roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
      "principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    }
  ]
}

方法优势 #

• 完全适配任意层级的嵌套资源，无需针对不同资源类型编写多个条件判断
• 避免resourceId函数参数格式带来的限制，逻辑更清晰
• 直接遵循Azure资源ID的官方格式，稳定性更高

内容的提问来源于stack exchange，提问作者Octonaut