如何通过ARM-template将跨资源组现有hybrid connection关联至Azure Web App

Absolutely, this is totally doable—even with ARM template deployments in Complete mode. I’ve tackled this exact scenario before, so let me break down the key steps and gotchas to watch out for.

Core Concepts to Remember #

First, a quick reminder: Complete mode deletes any resources in the target resource group that aren’t defined in your template. But since your Hybrid Connection lives in a separate resource group, it won’t be touched—you just need to reference it correctly in your Web App’s configuration.

Step-by-Step Implementation #

1. Reference the Cross-Resource-Group Hybrid Connection #

Use the resourceId() function to point to the Hybrid Connection in its original resource group. This function lets you specify the external resource group name, so ARM knows where to look outside the deployment’s target group.

The syntax looks like this:

resourceId('existing-relay-resource-group-name', 'Microsoft.Relay/namespaces/hybridConnections', 'relay-namespace-name', 'hybrid-connection-name')

2. Add the Hybrid Connection to Your Web App’s Site Config #

In your Web App resource definition, include the hybridConnections array under siteConfig. Even though the Hybrid Connection already exists, you need to provide the hostname and port (the target endpoint the connection points to) along with the referenced ID.

3. Example Template Snippet #

Here’s a stripped-down template that demonstrates this setup:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "webAppName": { "type": "string" },
    "appServicePlanName": { "type": "string" },
    "relayResourceGroup": { "type": "string" },
    "relayNamespace": { "type": "string" },
    "hybridConnectionName": { "type": "string" },
    "hcTargetHost": { "type": "string" },
    "hcTargetPort": { "type": "int" }
  },
  "resources": [
    {
      "type": "Microsoft.Web/serverfarms",
      "apiVersion": "2022-09-01",
      "name": "[parameters('appServicePlanName')]",
      "location": "[resourceGroup().location]",
      "sku": { "name": "S1", "tier": "Standard" }
    },
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2022-09-01",
      "name": "[parameters('webAppName')]",
      "location": "[resourceGroup().location]",
      "dependsOn": ["[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]"],
      "properties": {
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('appServicePlanName'))]",
        "siteConfig": {
          "hybridConnections": [
            {
              "id": "[resourceId(parameters('relayResourceGroup'), 'Microsoft.Relay/namespaces/hybridConnections', parameters('relayNamespace'), parameters('hybridConnectionName'))]",
              "hostname": "[parameters('hcTargetHost')]",
              "port": "[parameters('hcTargetPort')]"
            }
          ]
        }
      }
    }
  ]
}

Critical Notes #

• Permissions: Make sure the account running the deployment has:
  • Contributor access to the Web App’s resource group (to create/update the Web App)
  • At least Reader access to the Relay’s resource group (to resolve the Hybrid Connection’s ID)
• Complete Mode Safety: Double-check that your template includes all existing resources in the Web App’s resource group that you want to keep. Any resource not defined in the template will be deleted when deploying in Complete mode.
• Hybrid Connection Keys: You don’t need to include access keys in the template—once the association is created, the Web App will automatically retrieve the necessary keys (assuming permissions are set correctly).

Testing Tip #

Before running the deployment in Complete mode, test it first in Incremental mode to verify the Hybrid Connection associates correctly. This helps you catch any configuration issues without risking accidental resource deletion.

内容的提问来源于stack exchange，提问作者martenolofsson