Azure Bicep - 引用无法在开始时计算的变量

Question

我需要:

• 创建数据工厂
• 创建存储帐户
• 创建函数应用
• 将数据工厂的角色分配添加到存储帐户
• 将函数应用的角色分配添加到存储帐户

数据工厂是在与“主”二头肌不同的模块中创建的。这是为了防止“主”模板太大而难以使用 - 这是二头肌相对于 ARM 模板的主要优点之一。创建函数应用程序也是如此。

对于我的角色分配:

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-08-01-preview' = {
  name: guid(storageAccount.id, contributorRoleId, adfDeploy.outputs.dfId)

VSCode 然后出现以下“问题”:

This expression is being used in an assignment to the "name" propertyof the "Microsoft.Authorization/roleAssignments" type, which requiresa value that can be calculated at the start of the deployment.Properties of adfDeploy which can be calculated at the start include"name".

我无法从字符串(订阅/rg/资源等)组成 storageAccount Id，因为订阅 ID 也是在运行时确定的，因为调用同一个主二头肌来部署到多个订阅。

有没有什么方法可以实现所需的功能，而不将数据工厂和函数应用程序的创建拉回“主”二头肌？

Answer 1

您可以创建一个用于存储角色分配的通用模块:

// storage-account-role-assignment.bicep
param storageAccountName string
param principalId string
param roleId string

// Get a reference to the storage account
resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' existing = {
  name: storageAccountName
}

// Grant permissions to the storage account
resource storageAccountAppRoleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' =  {
  name: guid(storageAccount.id, roleId, principalId)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleId)
    principalId: principalId
  }
}

然后从您创建数据工厂或函数应用程序的位置调用此模块:

// function-app.bicep
...
resource functionApp 'Microsoft.Web/sites@2021-03-01' = {
  name: functionAppName
  kind: 'functionapp'
  identity: {
    type: 'SystemAssigned'
  }
  ...
}

// Create role assignment
module roleAssignment 'storage-account-role-assignment.bicep' = {
  name: 'function-storage-account-role-assignment'
  scope: resourceGroup()
  params:{
    storageAccountName: storageAccountName
    roleId: '<role-id>'
    principalId: functionApp.identity.principalId
  }
}

// data-factory.bicep
...
resource dataFactory 'Microsoft.DataFactory/factories@2018-06-01' = {
  name: name
  identity: {
    type: 'SystemAssigned'
  }
  ...
}

// Create role assignment
module roleAssignment 'storage-account-role-assignment.bicep' = {
  name: 'data-facory-storage-account-role-assignment'
  scope: resourceGroup()
  params:{
    storageAccountName: storageAccountName
    roleId: '<role-id>'
    principalId: dataFactory.identity.principalId
  }
}