azure - 无法使用 Azure Bicep 创建资源组

Question

我想使用 Bicep 构建 Azure 登陆区架构的一些组件。我尝试构建的组件如下:

• Contoso 管理组
• 平台管理小组
• 管理团队
• 管理订阅
• 管理订阅中的资源组

当我运行假设分析时，出现以下错误:

InvalidTemplateDeployment - 模板部署失败并出现错误:“订阅 ID:'/providers/Microsoft.Subscription/aliases/93cce83f-cae0-402e-8d0d-f4e9b4c12ec2”不存在。请确保嵌套部署引用有效的“subscriptionId”属性。

我确信这与线路有关

范围:订阅(managementSubscription.id)

但我不知道如何指定这一点。我知道订阅尚不存在，但它正在脚本中创建，因此我希望 Bicep 能够理解这一点。

我真正想做的就是使用 Bicep 在订阅中创建一个资源组。 Azure 着陆区部分仅供引用。这不是 Azure Landing Zone 问题，我只是提供该信息，因为现有的文档和图表描述了我想要实现的目标。

main.bicep

targetScope = 'tenant'

@description('The display name for the management management group')
param managementManagementGroupDisplayName string
@description('A unique identifier for the organization management group')
param managementManagementGroupIdentifier string
@description('The display name for the management subscription')
param managementSubscriptionDisplayName string
@description('The display name for the organization management group')
param organizationManagementGroupDisplayName string
@description('A unique identifier for the organization management group')
param organizationManagementGroupIdentifier string
@description('The display name for the platform management group')
param platformManagementGroupDisplayName string
@description('A unique identifier for the platform management group')
param platformManagementGroupIdentifier string
@description('The unique identifier for the tenant root group')
param tenantRootGroupIdentifier string
@description('The Azure region in which the terraform support resource group will be provisioned.')
param terraformSupportResourceGroupLocation string
@description('The name of the resource group that will contain terraform support resources.')
param terraformSupportResourceGroupName string

// create organization management group directly under tenant root group
module organizationManagementGroup './modules/managementgroup.bicep' = {
  name: 'managementGroupDeploy-${organizationManagementGroupIdentifier}'
  params: {
    displayName: organizationManagementGroupDisplayName
    identifier: organizationManagementGroupIdentifier
    parentGroupIdentifier: tenantResourceId('Microsoft.Management/managementGroups', tenantRootGroupIdentifier)
  }
}

// create platform management group directly under organization group
module platformManagementGroup './modules/managementgroup.bicep' = {
  name: 'managementGroupDeploy-${platformManagementGroupIdentifier}'
  params: {
    displayName: platformManagementGroupDisplayName
    identifier: platformManagementGroupIdentifier
    parentGroupIdentifier: organizationManagementGroup.outputs.groupIdentifier
  }
}

// create management management group directly under platform group
module managementManagementGroup './modules/managementgroup.bicep' = {
  name: 'managementGroupDeploy-${managementManagementGroupIdentifier}'
  params: {
    displayName: managementManagementGroupDisplayName
    identifier: managementManagementGroupIdentifier
    parentGroupIdentifier: platformManagementGroup.outputs.groupIdentifier
  }
}

// create management subscription
resource managementSubscription 'Microsoft.Subscription/aliases@2021-10-01' = {
  name: '93cce83f-cae0-402e-8d0d-f4e9b4c12ec2'
  properties: {
    workload: 'Production '
    displayName: managementSubscriptionDisplayName
    billingScope: '/billingAccounts/{mybillingaccountid}/enrollmentAccounts/{myenrollmentaccountid}'
  }
}

// resource group for terraform remote state storage account
module terraformSupportResourceGroup './modules/resourcegroup.bicep' = {
  name: 'resourceGroupDeploy-${terraformSupportResourceGroupName}'
  scope:subscription(managementSubscription.id)
  params: {
    location: terraformSupportResourceGroupLocation
    name: terraformSupportResourceGroupName
  }
}

管理组.bicep

targetScope = 'tenant'

param displayName string
param identifier string
param parentGroupIdentifier string

resource managementGroup 'Microsoft.Management/managementGroups@2020-02-01' = {
  name: identifier
  scope: tenant()
  properties: {
    displayName: displayName
    details: {
      parent: {
        id: parentGroupIdentifier
      }
    }
  }
}

资源组.bicep

targetScope = 'subscription'

param location string
param name string

resource rg 'Microsoft.Resources/resourceGroups@2021-01-01' = {
  name: name
  location: location
}

Answer 1

您理解正确，订阅未创建，但部署顺序无法保证，当 Bicep 执行“假设”操作时，它会评估模板而不实际创建资源，这意味着它将 managementSubscription 视为它尚未创建。最好先以有状态的方式创建子进程。或者按照以下文档所示正确设置依赖项(外部或内部)。

您可以单独部署 terraformSupportResourceGroup:将 terraformSupportResourceGroup 的部署移至单独的 Bicep 模板。这将确保资源组部署不依赖于同一模板中的 managementSubscription 资源。

或者您对不同的组件使用不同的二头肌文件，即将组件拆分为不同的二头肌文件(一个用于管理组，一个用于订阅等)。当存在依赖性时，最好在二头肌场景中执行此操作。我总是将我的订阅脚本分开并首先运行。

<小时/>

有关依赖项，请参阅此处:https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/resource-dependencies (本文档讨论了如果要将依赖项部署在一个文件中如何设置依赖项)