嵌套ARM模板资源关联问题：NSG与VNet绑定失败排查

看起来你遇到的问题是resourceId函数的用法不正确，导致无法正确关联NSG和VNet的子网。咱们一步步来修正：

错误原因分析 #

你在嵌套部署里使用resourceId时犯了两个小错误：

• 在嵌套部署（资源组范围）中，resourceId不需要指定订阅ID和资源组名称——因为当前部署已经限定了资源组上下文，多余的参数会导致函数解析失败。
• 资源类型后面多了个斜杠（比如Microsoft.Network/networkSecurityGroups/），这会被ARM引擎识别为无效的资源类型格式。

修正后的完整模板 #

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "name": {
            "type": "string"
        }
    },
    "variables": {
        "uniqueID": "[uniqueString(subscription().subscriptionId)]",
        "resourceGroupName": "[concat(parameters('name'), '-RG-', variables('uniqueID'))]",
        "nestedDeploymentName": "[concat(parameters('name'), '-NDEPL-', variables('uniqueID'))]",
        "subnetName": "[concat(parameters('name'),'-SUBNET-', variables('uniqueID'))]",
        "virtualNetworkName": "[concat(parameters('name'),'-VNET-', variables('uniqueID'))]",
        "networkSecurityGroupName": "[concat(parameters('name'),'-NSG-', variables('uniqueID'))]"
    },
    "resources": [
        {
            "type": "Microsoft.Resources/resourceGroups",
            "name": "[variables('resourceGroupName')]",
            "apiVersion": "2019-10-01",
            "location": "westeurope",
            "tags": {
                // TODO add some tags for easier monitoring
            }
        },
        {
            "type": "Microsoft.Resources/deployments",
            "name": "[variables('nestedDeploymentName')]",
            "apiVersion": "2019-10-01",
            "resourceGroup": "[variables('resourceGroupName')]",
            "dependsOn": [
                "[resourceId('Microsoft.Resources/resourceGroups',variables('resourceGroupName'))]"
            ],
            "properties": {
                "expressionEvaluationOptions": {
                    "scope": "outer"
                },
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "resources": [
                        {
                            "type": "Microsoft.Network/networkSecurityGroups",
                            "apiVersion": "2020-05-01",
                            "name": "[variables('networkSecurityGroupName')]",
                            "location": "westeurope",
                            "properties": {
                                "securityRules": [
                                    {
                                        "name": "SSH",
                                        "properties": {
                                            "protocol": "TCP",
                                            "sourcePortRange": "*",
                                            "destinationPortRange": "22",
                                            "sourceAddressPrefix": "*",
                                            "destinationAddressPrefix": "*",
                                            "access": "Allow",
                                            "priority": 300,
                                            "direction": "Inbound"
                                        }
                                    }
                                ]
                            }
                        },
                        {
                            "type": "Microsoft.Network/virtualNetworks",
                            "apiVersion": "2020-05-01",
                            "name": "[variables('virtualNetworkName')]",
                            "location": "westeurope",
                            "dependsOn": [
                                // 修正：嵌套部署内直接使用资源类型和名称，无需订阅/资源组参数
                                "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
                            ],
                            "properties": {
                                "addressSpace": {
                                    "addressPrefixes": ["10.1.1.0/24"]
                                },
                                "subnets": [
                                    {
                                        "name": "[variables('subnetName')]",
                                        "properties": {
                                            "addressPrefix": "10.1.1.0/24",
                                            "networkSecurityGroup": {
                                                // 修正：去掉资源类型后的多余斜杠，使用正确的resourceId格式
                                                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
                                            }
                                        }
                                    }
                                ]
                            }
                        }
                    ]
                }
            }
        }
    ]
}

关键修正点 #

• VNet的dependsOn：删除了订阅ID和资源组名称参数，直接使用resourceId('资源类型', '资源名称')的格式，因为嵌套部署已经在目标资源组上下文里了。
• 子网的NSG ID：去掉了Microsoft.Network/networkSecurityGroups后面的斜杠，确保资源类型格式正确。
• 这样修改后，ARM引擎就能正确解析NSG的资源ID，并且保证VNet在NSG创建完成后再部署，避免关联时的依赖问题。

内容的提问来源于stack exchange，提问作者Moglum