如何用单个Bicep模板部署带托管SSL证书的Azure App Service

我希望创建一个带有自定义主机名绑定和托管SSL证书的Azure App Service。在单个Bicep模板中，证书资源需在主机名绑定创建完成后才能部署，但创建主机名绑定又需要证书指纹；同时同一模板中无法重复定义主机名绑定资源来更新其配置。现有模板代码如下：

// hostname bindings must be deployed one by one to prevent Conflict (HTTP 429) errors.
@batchSize(1)
resource customHostnameWithoutSsl 'Microsoft.web/sites/hostnameBindings@2019-08-01' = [for fqdn in customHostnames: {
  name: '${webAppService.name}/${fqdn}'
  properties: {
    siteName: webAppService.name
    hostNameType: 'Verified'
    sslState: 'Disabled'
  }
}]

// Managed certificates can only be created once the hostname is added to the web app.
resource certificates 'Microsoft.Web/certificates@2022-03-01' = [for (fqdn, i) in customHostnames: {
  name: '${fqdn}-${webAppName}'
  location: location
  properties: {
    serverFarmId: appServicePlanResourceId
    canonicalName: fqdn
  }
  dependsOn: [ ]
}]

// sslState and thumbprint can only be set once the managed certificate is created
@batchSize(1)
resource customHostname 'Microsoft.web/sites/hostnameBindings@2019-08-01' = [for (fqdn, i) in customHostnames: {
  name: '${webAppService.name}/${fqdn}'
  properties: {
    siteName: webAppService.name
    hostNameType: 'Verified'
    sslState: 'SniEnabled'
    thumbprint: certificates[i].properties.thumbprint
  }
}]

请问是否存在其他方式，可通过单个部署模板完成带自定义主机名托管SSL证书的Azure App Service部署？

可以通过在单个模板内构建链式依赖+资源更新逻辑实现，无需拆分部署。核心是先创建禁用SSL的主机名绑定，待托管证书生成后，直接更新同一绑定的SSL配置，而非重复定义资源。具体实现如下：

修改后的Bicep代码 #

@batchSize(1)
resource customHostnameBindings 'Microsoft.Web/sites/hostnameBindings@2022-03-01' = [for fqdn in customHostnames: {
  name: '${webAppService.name}/${fqdn}'
  properties: {
    siteName: webAppService.name
    hostNameType: 'Verified'
    sslState: 'Disabled'
  }
}]

resource managedCertificates 'Microsoft.Web/certificates@2022-03-01' = [for (fqdn, index) in customHostnames: {
  name: '${fqdn}-${webAppName}'
  location: location
  properties: {
    serverFarmId: appServicePlanResourceId
    canonicalName: fqdn
  }
  // 依赖对应主机名绑定创建完成
  dependsOn: [
    customHostnameBindings[index]
  ]
}]

// 引用已创建的主机名绑定资源，更新SSL配置
@batchSize(1)
resource updateHostnameSsl 'Microsoft.Web/sites/hostnameBindings@2022-03-01' = [for (fqdn, index) in customHostnames: {
  name: customHostnameBindings[index].name
  properties: {
    siteName: webAppService.name
    hostNameType: 'Verified'
    sslState: 'SniEnabled'
    thumbprint: managedCertificates[index].properties.thumbprint
  }
  // 依赖对应托管证书生成完成
  dependsOn: [
    managedCertificates[index]
  ]
}]

关键逻辑说明 #

• 用@batchSize(1)避免批量部署时的429冲突错误，保证主机名绑定逐个创建
• 证书资源明确依赖对应主机名绑定，确保主机名已添加到App Service后再生成托管证书
• 通过引用已创建的主机名绑定资源名称，实现对同一资源的配置更新，而非重复定义新资源
• 使用较新的API版本（2022-03-01）确保支持完整的托管证书和主机名绑定更新特性

这种方式让Bicep自动处理三个阶段的部署顺序：创建无SSL绑定 → 生成证书 → 更新绑定启用SSL，全程在单个模板内完成。

内容的提问来源于stack exchange，提问作者Stan Janssen