Error when passing variable with special parameters to the ARM template

Question

I have a master template and a couple of linked templates. I want to pass parameter with special characters and have an error. Anyone know how to fix it? The problem is caused by 'servicebus_1_connectionString' parameter in last linked template definition. I provided the error and modified few letters in the secret so you have an overview but still not revealing my secrets.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
    "parameters": {
        "containerUri": {
            "type": "string"
        },
        "containerSasToken": {
            "type": "string"
        }
    },
  "variables": {},
    "resources": [
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2017-05-10",
            "name": "AzureServiceBusLinkedTemplate",
            "properties": {
                "mode": "Incremental",
                "templateLink": {
                    "uri": "[concat(parameters('containerUri'), 'Infrastructure/AzureServiceBus.json', parameters('containerSasToken'))]"
                }
            }
        },
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2017-05-10",
            "name": "AppFunctionsLinkedTemplate",
            "properties": {
                "mode": "Incremental",
                "templateLink": {
                    "uri": "[concat(parameters('containerUri'), 'Infrastructure/AppFunctions.json', parameters('containerSasToken'))]"
                }
            }
        },
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2017-05-10",
            "name": "LogicAppLinkedTemplate",
            "properties": {
                "mode": "Incremental",
                "templateLink": {
                    "uri": "[concat(parameters('containerUri'), 'LogicApp.json', parameters('containerSasToken'))]"
                },
                 "parameters": {
                "servicebus_1_connectionString": "[reference('AzureServiceBusLinkedTemplate').outputs.SBNamespaceDefaultConnectionString.value]"
            }
            },
            "dependsOn": [
                "AzureServiceBusLinkedTemplate"
            ]
        }
    ],
  "outputs": {
  }
}

2020-02-26T09:47:34.3751880Z ##[error]At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.
2020-02-26T09:47:34.3754763Z ##[error]Details:
2020-02-26T09:47:34.3758785Z ##[error]BadRequest: {
  "error": {
    "code": "InvalidRequestContent",
    "message": "The request content was invalid and could not be deserialized: 'Error converting value \"Endpoint=sb://myservicebusname.servicebus.windows.net/;SharedAccessKeyName=RootManageSharedAccessKey;SharedAccessKey=I/COoOJCWH/PFMab0dzpseIbfA3+0sQMUj33d71/Rg4=\" to type 'Microsoft.WindowsAzure.ResourceStack.Frontdoor.Data.Definitions.DeploymentParameterDefinition'. Path 'properties.parameters.servicebus_1_connectionString', line 1, position 462.'."
  }
}
2020-02-26T09:47:34.3786900Z ##[error]Task failed while creating or updating the template deployment.

Edit: I solved it by changing the way I pass parameter to the following:

       {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2017-05-10",
            "name": "LogicAppLinkedTemplate",
            "properties": {
                "mode": "Incremental",
                "templateLink": {
                    "uri": "[concat(parameters('containerUri'), 'LogicApp.json', parameters('containerSasToken'))]"
                },
                "parameters": {
                    "servicebus_1_connectionString": {
                        "value": "[reference('AzureServiceBusLinkedTemplate').outputs.SBNamespaceDefaultConnectionString.value]"
                    },
                    "logicAppName": {
                        "value": "DeployedFromVS"
                    }
                }
            },
            "dependsOn": [
                "AzureServiceBusLinkedTemplate"
            ]
        }

Answer 1

I solved it by changing the way I pass parameter to the following:

   {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2017-05-10",
            "name": "LogicAppLinkedTemplate",
            "properties": {
                "mode": "Incremental",
                "templateLink": {
                    "uri": "[concat(parameters('containerUri'), 'LogicApp.json', parameters('containerSasToken'))]"
                },
                "parameters": {
                    "servicebus_1_connectionString": {
                        "value": "[reference('AzureServiceBusLinkedTemplate').outputs.SBNamespaceDefaultConnectionString.value]"
                    },
                    "logicAppName": {
                        "value": "DeployedFromVS"
                    }
                }
            },
            "dependsOn": [
                "AzureServiceBusLinkedTemplate"
            ]
        }

Answer 2

several options:

1. which makes more sense, don't pass it, just use the value in the nested template
2. bonus: instead of retrieving the value of the deployment output - retrieve the value of the connection string in the nested template. makes a lot more sense and is more secure
3. base64 encode it and decode it in the nested template. there is a base64encode\decode function for that