使用ARM模板配置Azure更新管理时遇模板验证错误求助

错误原因分析 #

你遇到的InvalidTemplate错误，核心问题在于：模板里的两个子资源（schedules和softwareUpdateConfigurations）都在dependsOn中引用了Microsoft.Automation/automationAccounts/UpdateTesting，但这个自动化账户是你提前创建好的、不属于当前模板的资源。ARM模板在验证阶段会检查所有dependsOn中列出的资源是否在模板内有定义，因此触发了这个报错。

解决方案：移除不必要的dependsOn声明 #

既然目标自动化账户已经存在，你不需要在模板中声明这个依赖（ARM会自动识别子资源对应的父资源是否存在）。只需要删除两个资源块里的dependsOn属性即可。

修改后的模板文件 #

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "automationAccounts_UpdateTesting_name": {
      "type": "String"
    }
  },
  "variables": {},
  "resources": [
    {
      "type": "Microsoft.Automation/automationAccounts/schedules",
      "apiVersion": "2015-10-31",
      "name": "[concat(parameters('automationAccounts_UpdateTesting_name'), '/testfromarm')]",
      "properties": {
        "startTime": "2020-03-10T10:57:00+01:00",
        "expiryTime": "2020-03-10T10:57:00+01:00",
        "frequency": "OneTime",
        "timeZone": "Europe/Warsaw"
      }
    },
    {
      "type": "Microsoft.Automation/automationAccounts/softwareUpdateConfigurations",
      "apiVersion": "2017-05-15-preview",
      "name": "[concat(parameters('automationAccounts_UpdateTesting_name'), '/testfromarm')]",
      "properties": {
        "updateConfiguration": {
          "operatingSystem": "Windows",
          "windows": {
            "includedUpdateClassifications": "Critical, Security, UpdateRollup, Updates",
            "rebootSetting": "IfRequired"
          },
          "targets": {
            "azureQueries": [
              {
                "scope": [ "/subscriptions/xxx" ],
                "tagSettings": {
                  "tags": {
                    "PatchGroup": [ "group01" ]
                  },
                  "filterOperator": "All"
                },
                "locations": []
              },
              {
                "scope": [ "/subscriptions/xxx" ],
                "tagSettings": {
                  "tags": {
                    "PatchGroup": [ "group02" ]
                  },
                  "filterOperator": "All"
                },
                "locations": []
              }
            ]
          },
          "duration": "PT2H"
        },
        "tasks": {},
        "scheduleInfo": {
          "scheduleName": "testfromarm"
        }
      }
    }
  ],
  "outputs": {}
}

额外注意事项 #

• 记得替换模板中/subscriptions/xxx为你的实际订阅ID
• 确认目标虚拟机的PatchGroup标签（group01和group02）已经正确配置
• 运行部署脚本前，先通过Connect-AzureRmAccount和Select-AzureRmSubscription确保登录到正确的Azure租户和订阅
• 我已经帮你补全了softwareUpdateConfigurations里的scheduleInfo，关联了前面创建的testfromarm计划，否则补丁任务无法触发

内容的提问来源于stack exchange，提问作者tester81