Azure ARM template resourceId problem with nested deployments on subscription level

Question

I'm working on an ARM template to

A. deploy a resource group B. deploy an ASE env.

To do both, as I understand I need to run a deployment on scope subscription level New-AzDeployment -Name TestingASE -TemplateFile $HOME/azuredeploy.json -TemplateParameterFile $HOME/parameters.json -Location 'West Europe'

My template is pretty long already - so here are the most important parts (I think).

{
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.1",
    "parameters": {
....

"resources": [
        // Resource Group
        {
            "type": "Microsoft.Resources/resourceGroups",
            "apiVersion": "2018-05-01",
            "location": "[parameters('Location')]",
            "name": "[parameters('rgName')]",
            "properties": {}
        },
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2019-05-01",
            "name": "storageDeployment",
            "resourceGroup": "[parameters('rgName')]",
            "dependsOn": [
                "[resourceId('Microsoft.Resources/resourceGroups/', parameters('rgName'))]"
            ],
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "parameters": {},
                    "variables": {},
                    "resources": [
....

{
                            "apiVersion": "2019-04-01",
                            "name": "[parameters('asevnetname')]",
                            "type": "Microsoft.Network/virtualNetworks",
                            "location": "[parameters('Location')]",
                            "properties": {
                                "addressSpace": {
                                    "addressPrefixes": [
                                        "[parameters('addressPrefix')]"
                                    ]
                                },
                                "subnets": [
                                    {
                                        "name": "[parameters('subnetName')]",
...

{
                            "apiVersion": "2019-02-01",
                            "type": "Microsoft.Web/hostingEnvironments",
                            "name": "[parameters('aseName')]",
                            "kind": "ASEV2",
                            "location": "[parameters('Location')]",
                            "properties": {
                                "name": "[parameters('aseName')]",
                                "location": "[parameters('Location')]",
                                "InternalLoadBalancingMode": "[parameters('ilbMode')]",
                                "virtualNetwork": {
                                    "Id": "[resourceId(subscription().id, resourceGroup().Id, 'Microsoft.Network/virtualNetworks/subnets',parameters('asevnetname'),parameters('subnetName'))]"
                                }
....

This give me an output "The template function 'RESOURCEGROUP' is not expected at thislocation" As far as I understand I'm following the guidelines https://learn.microsoft.com/en-gb/azure/azure-resource-manager/templates/template-functions-resource#resourcegroup

The resourceGroup() function can't be used in a template that is deployed at the subscription level. It can only be used in templates that are deployed to a resource group. You can use the resourceGroup() function in a linked or nested template (with inner scope) that targets a resource group, even when the parent template is deployed to the subscription. In that scenario, the linked or nested template is deployed at the resource group level.

Thanks for helping with this.

Answer 1

Your deployment schema is subscriptionDeploymentTemplate and the New-AzDeployment cmdlet creates a deployment at the subscription scope. As per the docs you can't use that function when deploying at the subscription scope. You'll also encounter problems with the resourceId() function that wraps around it. The subscriptionResourceId() function should solve your problem.

"virtualNetwork": {
    "Id": "[subscriptionResourceId('Microsoft.Network/virtualNetworks/subnets',parameters('asevnetname'),parameters('subnetName'))]"
}

The resource id will be returned in the subscription format as described here, if that isn't an acceptable format for the virtualNetwork.Id property of the Microsoft.Web/hostingEnvironments resource you're trying to deploy you might need to construct the resource id using the concat() function instead.

Answer 2

The error happened at the resourceId format, it should be

resourceId([subscriptionId], [resourceGroupName], resourceType, resourceName1, [resourceName2], ...)

To get the resource ID for a resource in the same subscription but a different resource group, provide the resource group name.

"[resourceId('otherResourceGroup', 'Microsoft.Storage/storageAccounts', 'examplestorage')]"

So, in this case, the virtualNetwork ID in the properties of Microsoft.Web/hostingEnvironments should be

"virtualNetwork": {
 "Id": "[resourceId(parameters('rgName'), 'Microsoft.Network/virtualNetworks/subnets',parameters('asevnetname'),parameters('subnetName'))]"
}

or

"Id": "[resourceId(resourceGroup().name, 'Microsoft.Network/virtualNetworks/subnets',parameters('asevnetname'),parameters('subnetName'))]"

For more information, you could get more references to deploy an ASE within a subnet from this template.