无法在同一个arm模板中创建资源组和资源

Question

我想创建一个

resource group

，然后在同一资源组中创建

NSG

。

ARM模板-

{
  "$schema": "http://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
 "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "deployment-rg",
      "location": "easatus",
      "subscriptionId": "[parameters('subscriptionId')]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [
            {
              "type": "Microsoft.Resources/resourceGroups",
              "apiVersion": "2021-04-01",
              "name": "demo-test",
              "location": "eastus",
              "properties": {}
            }
          ],
          "outputs": {}
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "deployment-nsg",
      "comments": "test vnet",
      "resourceGroup": "demo-test",
      "dependsOn": [
        "['deployment-rg']"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [
            {
              "apiVersion": "2020-05-01",
              "type": "Microsoft.Network/networkSecurityGroups",
              "name": "nsg",
              "location": "eastus",
              "properties": {
                "securityRules": [
                  {
                    "name": "AllowAll",
                    "properties": {
                      "priority": 100,
                      "protocol": "*",
                      "sourcePortRange": "*",
                      "destinationPortRange": "4489",
                      "sourceAddressPrefix": "Gateway",
                      "destinationAddressPrefix": "*",
                      "access": "Allow",
                      "direction": "Inbound",
                      "sourcePortRanges": [],
                      "destinationPortRanges": [],
                      "sourceAddressPrefixes": [],
                      "destinationAddressPrefixes": [],
                      "description": "more info."
                    }
                  }                  
                ]
              },
              "tags": {
                "resourceType": "Demo NSG",
                "clusterName": "Apps Demo"
              }
            }
          ]
        }
      }
    }
  ]
}

我在 NSG 中也使用了depends，但仍然出现以下错误 -

错误：代码=ResourceGroupNotFound；消息=资源组 找不到“演示测试”。

知道这里出了什么问题吗？

Answer 1

无法从资源组 ARM 模板部署资源组（架构 https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#）。您必须使用订阅范围的 ARM 模板（架构“https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#”）。

这是更新的 ARM 模板，您应该使用

az deployment sub create

Azure CLI 命令进行部署：

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "resources": [
        {
            "type": "Microsoft.Resources/resourceGroups",
            "apiVersion": "2021-04-01",
            "name": "demo-test",
            "location": "uksouth",
            "properties": {}
        },
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2021-04-01",
            "name": "deployment-nsg",
            "comments": "test vnet",
            "resourceGroup": "demo-test",
            "dependsOn": [
                "[resourceId('Microsoft.Resources/resourceGroups/', 'demo-test')]"
            ],
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "resources": [
                        {
                            "apiVersion": "2020-05-01",
                            "type": "Microsoft.Network/networkSecurityGroups",
                            "name": "nsg",
                            "location": "uksouth",
                            "properties": {
                                "securityRules": [
                                    {
                                        "name": "AllowAll",
                                        "properties": {
                                            "priority": 100,
                                            "protocol": "*",
                                            "sourcePortRange": "*",
                                            "destinationPortRange": "4489",
                                            "sourceAddressPrefix": "10.0.3.0/27", // Replace this with the CIDR range of your GatewaySubnet
                                            "destinationAddressPrefix": "*",
                                            "access": "Allow",
                                            "direction": "Inbound",
                                            "sourcePortRanges": [],
                                            "destinationPortRanges": [],
                                            "sourceAddressPrefixes": [],
                                            "destinationAddressPrefixes": [],
                                            "description": "more info."
                                        }
                                    }
                                ]
                            },
                            "tags": {
                                "resourceType": "Demo NSG",
                                "clusterName": "Apps Demo"
                            }
                        }
                    ]
                }
            }
        }
    ],
    "outputs": {}
}

请注意，您的 NSG (

sourceAddressPrefix

) 上的

Gateway

对我来说是错误的。我将其替换为虚构的 CIDR 范围 (

10.0.3.0/27

)，但您需要将其替换为网关子网的 CIDR 范围。