Bicep创建Virtual Network Gateway遇BCP079错误：资源自引用求助

问题根源 #

你遇到的BCP079错误是因为在定义virtualNetworkGateways资源时，直接引用了自身的id（比如${p2s_vpn_name_resource.id}/ipConfigurations/default），而Bicep不允许资源在未创建完成时引用自身标识符。此外代码还存在子网重复定义的问题，会导致部署冲突。

具体修正步骤 #

1. 移除资源内部的自引用字段 #

Azure资源的子资源（比如网关的ipConfigurations、vpnClientRootCertificates）不需要手动指定id，平台会自动生成并关联到父资源。需要删除以下自引用的id字段：

• ipConfigurations数组中对象的id属性
• vpnClientRootCertificates数组中对象的id属性

2. 正确构造BGP配置中的ipconfigurationId #

对于bgpSettings.bgpPeeringAddresses里的ipconfigurationId，通过resourceId函数提前构造，不需要依赖网关自身的id：

ipconfigurationId: resourceId(rg, 'Microsoft.Network/virtualNetworkGateways/ipConfigurations', p2s_vpn_name, 'default')

3. 清理重复的子网定义 #

代码同时在virtual_network_name_resource里定义了子网，又单独创建了virtual_network_name_GatewaySubnet和virtual_network_name_p2s_subnet，这会导致子网重复创建错误。选择一种方式定义子网即可：要么在虚拟网络资源内嵌套定义子网，要么单独创建子网资源，不要同时操作。

修正后的完整代码 #

param location string = resourceGroup().location
param rg string = resourceGroup().name
param virtual_network_name string = 'my_virtual_network'
param gwSubnetName string = 'myGatewaySubnet'
param public_ip_gateway string = 'my_public_ip'
param p2s_vpn_name string = 'myPoint_toSite'
param p2s_subnet_name string = 'p2s_subnet'

resource public_ip_gateway_resource 'Microsoft.Network/publicIPAddresses@2022-01-01' = {
  name: public_ip_gateway
  location: location
  sku: {
    name: 'Basic'
    tier: 'Regional'
  }
  properties: {
    ipAddress: '40.161.130.50'
    publicIPAddressVersion: 'IPv4'
    publicIPAllocationMethod: 'Dynamic'
    idleTimeoutInMinutes: 4
    ipTags: []
  }
}

// 单独创建子网，不在虚拟网络内嵌套定义
resource virtual_network_name_resource 'Microsoft.Network/virtualNetworks@2022-01-01' = {
  name: virtual_network_name
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.2.0.0/16'
      ]
    }
    virtualNetworkPeerings: []
    enableDdosProtection: false
  }
}

resource virtual_network_name_GatewaySubnet 'Microsoft.Network/virtualNetworks/subnets@2022-01-01' = {
  name: '${virtual_network_name}/GatewaySubnet'
  properties: {
    addressPrefix: '10.2.255.0/25'
    delegations: []
    privateEndpointNetworkPolicies: 'Disabled'
    privateLinkServiceNetworkPolicies: 'Enabled'
  }
  dependsOn: [
    virtual_network_name_resource
  ]
}

resource virtual_network_name_p2s_subnet 'Microsoft.Network/virtualNetworks/subnets@2022-01-01' = {
  name: '${virtual_network_name}/p2s_subnet'
  properties: {
    addressPrefix: '10.2.1.0/24'
    serviceEndpoints: []
    delegations: []
    privateEndpointNetworkPolicies: 'Disabled'
    privateLinkServiceNetworkPolicies: 'Enabled'
  }
  dependsOn: [
    virtual_network_name_resource
  ]
}

resource p2s_vpn_name_resource 'Microsoft.Network/virtualNetworkGateways@2022-01-01' = {
  name: p2s_vpn_name
  location: location
  properties: {
    enablePrivateIpAddress: false
    ipConfigurations: [
      {
        name: 'default'
        // 移除自引用的id字段
        properties: {
          privateIPAllocationMethod: 'Dynamic'
          publicIPAddress: {
            id: public_ip_gateway_resource.id
          }
          subnet: {
            id: virtual_network_name_GatewaySubnet.id
          }
        }
      }
    ]
    natRules: []
    enableBgpRouteTranslationForNat: false
    disableIPSecReplayProtection: false
    sku: {
      name: 'VpnGw1'
      tier: 'VpnGw1'
    }
    gatewayType: 'Vpn'
    vpnType: 'RouteBased'
    enableBgp: false
    activeActive: false
    vpnClientConfiguration: {
      vpnClientAddressPool: {
        addressPrefixes: [
          '119.x.x.0/24'
        ]
      }
      vpnClientProtocols: [
        'OpenVPN'
      ]
      vpnAuthenticationTypes: [
        'Certificate'
      ]
      vpnClientRootCertificates: [
        {
          name: 'Rahman'
          // 移除自引用的id字段
          properties: {
            publicCertData: 'xxxxxxxxxxx=='
          }
        }
      ]
      vpnClientRevokedCertificates: []
      radiusServers: []
      vpnClientIpsecPolicies: []
    }
    bgpSettings: {
      asn: 65515
      bgpPeeringAddress: '10.2.255.126'
      peerWeight: 0
      bgpPeeringAddresses: [
        {
          // 使用resourceId构造ipconfigurationId，避免自引用
          ipconfigurationId: resourceId(rg, 'Microsoft.Network/virtualNetworkGateways/ipConfigurations', p2s_vpn_name, 'default')
          customBgpIpAddresses: []
        }
      ]
    }
    customRoutes: {
      addressPrefixes: []
    }
    vpnGatewayGeneration: 'Generation1'
  }
  dependsOn: [
    virtual_network_name_GatewaySubnet
    public_ip_gateway_resource
  ]
}

额外说明 #

• Bicep会自动处理资源之间的依赖关系，大部分场景下不需要手动添加dependsOn，但如果有明确的依赖顺序需求可以保留。
• 如果你更倾向于在虚拟网络资源内嵌套定义子网，只需要删除单独的子网资源，把子网配置移到virtual_network_name_resource的subnets数组中即可，这样更符合Bicep的简洁风格。

内容的提问来源于stack exchange，提问作者learner