如何在ARM模板中提前验证子网是否属于指定虚拟网络？

Great question! Unfortunately, ARM templates don’t have a direct equivalent to AWS Service Catalog’s Constraint Rules for native pre-deployment validation out of the box. But there are several effective workarounds to validate that a specified subnet belongs to its associated virtual network before launching a deployment, avoiding unnecessary failed deployments.

1. Azure Policy (Pre-Deployment Enforcement) #

Azure Policy is the closest alternative to AWS’s Constraint Rules for blocking invalid deployments before they start. You can create a custom policy that checks if the subnet’s parent virtual network matches the one provided in your deployment parameters.

Here’s a simplified example of a policy rule that validates the subnet-VNet relationship:

{
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Network/virtualNetworks/subnets"
      },
      {
        "not": {
          "field": "Microsoft.Network/virtualNetworks/subnets/virtualNetwork.id",
          "equals": "[parameters('virtualNetworkId')]"
        }
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}

This policy will deny any deployment where the subnet being used isn’t part of the specified VNet. You can scope this policy to your subscription, resource group, or specific resources to enforce the validation universally.

2. Pre-Deployment Scripts (Custom Validation Logic) #

For more flexible, custom validation, you can use pre-deployment scripts (PowerShell or Azure CLI) to check the subnet-VNet association before triggering the ARM deployment.

Example Azure CLI Script: #

# Get subnet details
subnet_details=$(az network vnet subnet show --name $subnetName --vnet-name $vnetName --resource-group $resourceGroup --query "virtualNetwork.id" -o tsv)

# Validate subnet belongs to the specified VNet
if [ "$subnet_details" != "/subscriptions/$subscriptionId/resourceGroups/$resourceGroup/providers/Microsoft.Network/virtualNetworks/$vnetName" ]; then
  echo "Error: Subnet $subnetName does not belong to VNet $vnetName"
  exit 1
fi

# Proceed with ARM deployment if validation passes
az deployment group create --resource-group $resourceGroup --template-file ./your-template.json --parameters @params.json

This script checks the subnet’s parent VNet ID against the expected value. If the validation fails, it exits with an error code, preventing the ARM deployment from starting.

3. ARM Template Inline Validation (Early Deployment Failure) #

While this isn’t strictly pre-deployment validation (it runs during deployment initialization), you can use ARM template functions to validate the subnet-VNet association early in the deployment process, minimizing resource waste.

Add this validation block to your template’s variables section:

"variables": {
  "subnetResource": "[reference(parameters('subnetId'), '2023-05-01')]",
  "vnetValidation": "[if(not(equals(variables('subnetResource').virtualNetwork.id, parameters('vnetId'))), fail('Subnet does not belong to the specified virtual network'), '')]"
}

The reference function fetches the subnet’s details, and we compare its parent VNet ID to the provided parameter. If they don’t match, the fail function immediately terminates the deployment with a clear error message.

Key Notes #

• Azure Policy is ideal for organizational-wide enforcement, ensuring all deployments adhere to the rule.
• Pre-deployment scripts offer maximum flexibility for custom logic (e.g., checking multiple subnets, cross-resource group validation).
• Inline template validation is quick to implement but only catches issues after deployment starts (though it fails early, so no resources are provisioned).

内容的提问来源于stack exchange，提问作者Paolo