Create resource if another resource exists

[dkirrane]

What's the correct way to create the diagnostics resource if the logWorkspace resource exists?

resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2020-10-01' existing = {
  name: 'my-lg'
}

resource diagnostics 'Microsoft.Insights/diagnosticsettings@2017-05-01-preview' = if (logWorkspace) {
  name: 'my-dg'
}

[Antse]

key thing here is scope

you should find something helpful here : #2067 (reply in thread)

[dkirrane]

Hi @Antse maybe I misunderstand the purpose of the existing keyword. It looks like my-lg workspace must exist. It will fail with Code:ResourceNotFound if it does not exist.

Whereas, what I want is

if(logWorkspace exists) {
   // create diagnostics resource
} else {
   // skip - do not create diagnostics resource
}

[alex-frankel]

Can you clarify your scenario a bit for me?

Do you know (in advance of the deployment starting) if the log analytics workspace has been deployed or not? If it has not been deployed are you going to deploy it as part of this bicep deployment? If the LA workspace was deployed previously, why wasn't diagnostics added at the time of creation?

There is no concept of an "existence check" in bicep. The exists keyword is to get a symbolic reference to a known, previously deployed resource and one that you do not intend to update as part of this deployment.

What we will typically see is the "intent to deploy a resource" expressed as a parameter, and then a conditional check to deploy something based on that intent. For example:

param deployLa bool = true

resource la 'Microsoft.OperationalInsights/workspaces@2020-10-01' = if (deployLa) {
  name: 'foo'
  location: 'bar'
}

resource diag 'microsoft.insights/diagnosticSettings@2017-05-01-preview' = if (deployLa) {
  name: 'foo'
  properties: {
    workspaceId: la.id
  }
}

[dkirrane]

Ya I've solved my usecase by passing in LA workspace Id as param to bicep and doing.

param logWorkspaceId string = ''

resource diagnostics 'Microsoft.Insights/diagnosticsettings@2017-05-01-preview' = if (!empty(logWorkspaceId)) {
}

[centur]

This is interesting case. This behaviour implies that it's not bicep responsibility to do any checks before trying to deploy resorurces. This would work fine if you start a greenfield project with bicep, and there are great practices how to build solid IaaC when there is no legacy .
I have a very similar question as @dkirrane - how can we use bicep for already provisioned resources (aside of keywork existing) and either reconfigure or deploy new resource with a correct configuration - something like "desired state" configuration (which not supported on all scope levels) or SQL's upsert\merge behaviour when some resources would be already there and just need to be reconfigured but if they are not there - will be created with a provided set of parameters. Is it possible to define in Bicep and it's supported in ARM ?

[brwilkinson]

The best way is to export (ALL of) your resources out, so that you own ALL of the configurations (Configuration Items (CI's) e.g. each setting) in your environment.

That way you can redeploy them out again, iteratively (as needed via Continuous Integration or manually or scheduled). In this case you would not be using the 'existing' resource reference, you would actually be redeploying them, however if they exist with the same settings, they (resource manager) will validate the settings and continue. You just have to make sure the resource names match, when you redeploy them, exactly like Desired State Configuration (DSC), Bicep/ARM is the same, otherwise it will deploy the new resource with the new name, otherwise it 'skips set' if you compare it to DSC language.

This enables you to control things like TLS or other security settings in your environment on those resources and lowers the chances from having configuration drift in your environments from any manual changes.

If you break your deployments phases/categories out into Modules, then have your standard settings in your Modules, along with the ability to pass in parameters for those settings that may be optional or may change, this will scale very well. E.g. a Storage Module.

This is also an excellent way to pass compliance and security audits... which generally happen either continuously or manually one or more times a year. It also makes you agile for security vulnerabilities that may show up, because to can easily update your baseline settings and redeploy out your infrastructure.

Currently there are limited skillsets in this 'Declarative style deployment' process, which is why Policy driven deployments are so popular right now, since most teams don't actually have control of environments and individual CI's, so they rely on Policy, however if you do have a solid deployment process and have a flexible and well-crafted set of templates, you would be winning in the space of declarative deployments. Also I am not saying Policy is bad, it can control 'allowed' settings in the first place and is another way of setting guardrails, beyond Role Based Access Control (RBAC), however there is a cross over in capabilities in some regards. Policy can be somewhat of a large hammer, where flexible templates can provide more precision and specific application configuration, which is more difficult via policy.

[centur]

Thank you @brwilkinson for such detailed and specific recommendations

[brwilkinson]

Here is an example: "Manually created storage account"

New-AzStorageAccount -Name acu1brwbott5sadev01 -ResourceGroupName ACU1-BRW-AOA-RG-T5 -SkuName Standard_LRS -Location centralus -Kind StorageV2

StorageAccountName  ResourceGroupName  PrimaryLocation SkuName      Kind      AccessTier CreationTime          ProvisioningState EnableHttpsTrafficOnly LargeFileShares
------------------  -----------------  --------------- -------      ----      ---------- ------------          ----------------- ---------------------- ---------------
acu1brwbott5sadev01 ACU1-BRW-AOA-RG-T5 centralus       Standard_LRS StorageV2 Hot        10/21/2021 4:03:04 AM Succeeded         True

here it is in the portal, freshly deployed...

I can also view the template in the portal "export template"

If I copy the storage account template, then save it to a json file, I can convert it to bicep

bicep decompile .\storageexport.json --outfile storageNew.bicep

I end up with the bicep file

resource acu1brwbott5sadev01 'Microsoft.Storage/storageAccounts@2021-06-01' = {
  name: 'acu1brwbott5sadev01'
  location: 'centralus'
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_0'
    allowBlobPublicAccess: true
    networkAcls: {
      bypass: 'AzureServices'
      virtualNetworkRules: []
      ipRules: []
      defaultAction: 'Allow'
    }
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
    accessTier: 'Hot'
  }
}

resource acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/blobServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  properties: {
    cors: {
      corsRules: []
    }
    deleteRetentionPolicy: {
      enabled: false
    }
  }
}

resource Microsoft_Storage_storageAccounts_fileServices_acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/fileServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  sku: {
    name: 'Standard_LRS'
    tier: 'Standard'
  }
  properties: {
    protocolSettings: {
      smb: {}
    }
    cors: {
      corsRules: []
    }
    shareDeleteRetentionPolicy: {
      enabled: true
      days: 7
    }
  }
}

resource Microsoft_Storage_storageAccounts_queueServices_acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/queueServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
  }
}

resource Microsoft_Storage_storageAccounts_tableServices_acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/tableServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
  }
}

Now the export is not perfect, however the linter helps me.. A few properties that are read only were exported, these are only warnings, however I will clean them up.

I end up with this

resource acu1brwbott5sadev01 'Microsoft.Storage/storageAccounts@2021-06-01' = {
  name: 'acu1brwbott5sadev01'
  location: 'centralus'
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_0'
    allowBlobPublicAccess: true
    networkAcls: {
      bypass: 'AzureServices'
      virtualNetworkRules: []
      ipRules: []
      defaultAction: 'Allow'
    }
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
    accessTier: 'Hot'
  }
}

resource acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/blobServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
    deleteRetentionPolicy: {
      enabled: false
    }
  }
}

resource Microsoft_Storage_storageAccounts_fileServices_acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/fileServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  properties: {
    protocolSettings: {
      smb: {}
    }
    cors: {
      corsRules: []
    }
    shareDeleteRetentionPolicy: {
      enabled: true
      days: 7
    }
  }
}

resource Microsoft_Storage_storageAccounts_queueServices_acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/queueServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
  }
}

resource Microsoft_Storage_storageAccounts_tableServices_acu1brwbott5sadev01_default 'Microsoft.Storage/storageAccounts/tableServices@2021-06-01' = {
  parent: acu1brwbott5sadev01
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
  }
}

So before I do anything else I will

1. try to build the file, right click and Build (json file, ARM template)
2. once it builds I will test deploy it.

okay the new json file looks good, I see some extra metadata in the json file, since it was build/compiled

now test deploy the new

New-AzResourceGroupDeployment -Name storageDeploy -ResourceGroupName ACU1-BRW-AOA-RG-T5 -TemplateFile .\storageNew.bicep -verbose
VERBOSE: Using Bicep v0.4.1008
VERBOSE: TRACE: Building semantic model for file:///D:/Repos/ADF/ADF/bicep/foo/storageNew.bicep
VERBOSE: Performing the operation "Creating Deployment" on target "ACU1-BRW-AOA-RG-T5".
VERBOSE: 9:22:33 PM - Template is valid.
VERBOSE: 9:22:35 PM - Create template deployment 'storageDeploy'
VERBOSE: 9:22:35 PM - Checking deployment status in 5 seconds
VERBOSE: 9:22:40 PM - Resource Microsoft.Storage/storageAccounts/tableServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:22:40 PM - Resource Microsoft.Storage/storageAccounts 'acu1brwbott5sadev01' provisioning status is succeeded
VERBOSE: 9:22:40 PM - Checking deployment status in 5 seconds
VERBOSE: 9:22:45 PM - Resource Microsoft.Storage/storageAccounts/queueServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:22:45 PM - Resource Microsoft.Storage/storageAccounts/blobServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
New-AzResourceGroupDeployment: 9:22:45 PM - The deployment 'storageDeploy' failed with error(s). Showing 1 out of 1 error(s).
Status Message: XML specified is not syntactically valid.
RequestId:04cb6ba5-f01a-0014-6f33-c6f8f8000000
Time:2021-10-21T04:22:37.6074358Z (Code:InvalidXmlDocument)
CorrelationId: 2381e918-102e-4ecd-8667-b29cb1bccc1f

DeploymentName          : storageDeploy
ResourceGroupName       : ACU1-BRW-AOA-RG-T5
ProvisioningState       : Failed
Timestamp               : 10/21/2021 4:22:42 AM
Mode                    : Incremental
TemplateLink            : 
Parameters              : 
Outputs                 : 
DeploymentDebugLogLevel :

Okay I have an error, needs more cleanup... go in and remove some values that are empty.

just cleanup this from the fileservices default properties

    protocolSettings: {
      smb: {}
    }

deploy again...

New-AzResourceGroupDeployment -Name storageDeploy -ResourceGroupName ACU1-BRW-AOA-RG-T5 -TemplateFile .\storageNew.bicep -verbose
VERBOSE: Using Bicep v0.4.1008
VERBOSE: TRACE: Building semantic model for file:///D:/Repos/ADF/ADF/bicep/foo/storageNew.bicep
VERBOSE: Performing the operation "Creating Deployment" on target "ACU1-BRW-AOA-RG-T5".
VERBOSE: 9:24:50 PM - Template is valid.
VERBOSE: 9:24:51 PM - Create template deployment 'storageDeploy'
VERBOSE: 9:24:51 PM - Checking deployment status in 5 seconds
VERBOSE: 9:24:56 PM - Resource Microsoft.Storage/storageAccounts/blobServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:24:56 PM - Resource Microsoft.Storage/storageAccounts/fileServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:24:56 PM - Resource Microsoft.Storage/storageAccounts/tableServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:24:56 PM - Resource Microsoft.Storage/storageAccounts 'acu1brwbott5sadev01' provisioning status is succeeded
VERBOSE: 9:24:56 PM - Checking deployment status in 5 seconds
VERBOSE: 9:25:02 PM - Resource Microsoft.Storage/storageAccounts/queueServices 'acu1brwbott5sadev01/default' provisioning status is succeeded

DeploymentName          : storageDeploy
ResourceGroupName       : ACU1-BRW-AOA-RG-T5
ProvisioningState       : Succeeded
Timestamp               : 10/21/2021 4:24:57 AM
Mode                    : Incremental
TemplateLink            : 
Parameters              : 
Outputs                 : 
DeploymentDebugLogLevel :

Okay all good, now make it scale

1. remove any hard coded values, put them as parameters.
2. make the resource names short and generic
3. add a few good default options and my allowed values

param storageName string = 'acu1brwbott5sadev01'
param location string = 'centralus'

@allowed([
  'Standard_LRS'
  'Premium_LRS'
])
param skuName string = 'Standard_LRS'

@allowed([
  'StorageV2'
  'BlobStorage'
])
param storageKind string = 'StorageV2'

@allowed([
  'TLS1_0'
  'TLS1_2'
])
param minTLS string = 'TLS1_0'

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-06-01' = {
  name: storageName
  location: location
  sku: {
    name: skuName
  }
  kind: storageKind
  properties: {
    minimumTlsVersion: minTLS
    allowBlobPublicAccess: true
    networkAcls: {
      bypass: 'AzureServices'
      virtualNetworkRules: []
      ipRules: []
      defaultAction: 'Allow'
    }
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
    accessTier: 'Hot'
  }
}

resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2021-06-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
    deleteRetentionPolicy: {
      enabled: false
    }
  }
}

resource fileService 'Microsoft.Storage/storageAccounts/fileServices@2021-06-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
    shareDeleteRetentionPolicy: {
      enabled: true
      days: 7
    }
  }
}

resource queueService 'Microsoft.Storage/storageAccounts/queueServices@2021-06-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
  }
}

resource tableService 'Microsoft.Storage/storageAccounts/tableServices@2021-06-01' = {
  parent: storageAccount
  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
  }
}

Then redeploy, exactly the same as before, this will be the 3rd deployment over the top of the same storage account.

New-AzResourceGroupDeployment -Name storageDeploy -ResourceGroupName ACU1-BRW-AOA-RG-T5 -TemplateFile .\storageNew.bicep -verbose
VERBOSE: Using Bicep v0.4.1008
VERBOSE: TRACE: Building semantic model for file:///D:/Repos/ADF/ADF/bicep/foo/storageNew.bicep
VERBOSE: Performing the operation "Creating Deployment" on target "ACU1-BRW-AOA-RG-T5".
VERBOSE: 9:33:47 PM - Template is valid.
VERBOSE: 9:33:49 PM - Create template deployment 'storageDeploy'
VERBOSE: 9:33:49 PM - Checking deployment status in 5 seconds
VERBOSE: 9:33:54 PM - Resource Microsoft.Storage/storageAccounts/blobServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:33:54 PM - Resource Microsoft.Storage/storageAccounts/fileServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:33:54 PM - Resource Microsoft.Storage/storageAccounts/tableServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:33:54 PM - Resource Microsoft.Storage/storageAccounts 'acu1brwbott5sadev01' provisioning status is succeeded
VERBOSE: 9:33:54 PM - Checking deployment status in 5 seconds
VERBOSE: 9:33:59 PM - Resource Microsoft.Storage/storageAccounts/queueServices 'acu1brwbott5sadev01/default' provisioning status is succeeded

DeploymentName          : storageDeploy
ResourceGroupName       : ACU1-BRW-AOA-RG-T5
ProvisioningState       : Succeeded
Timestamp               : 10/21/2021 4:33:54 AM
Mode                    : Incremental
TemplateLink            : 
Parameters              : 
                          Name             Type                       Value     
                          ===============  =========================  ==========
                          storageName      String                     acu1brwbott5sadev01
                          location         String                     centralus
                          skuName          String                     Standard_LRS
                          storageKind      String                     StorageV2
                          minTLS           String                     TLS1_0

Outputs                 : 
DeploymentDebugLogLevel :

Looking good . . . okay now the whole point, let me update my TLS version in my bicep file

@allowed([
  'TLS1_0'
  'TLS1_2'
])
param minTLS string = 'TLS1_2'

Deploy again 4th time.

New-AzResourceGroupDeployment -Name storageDeploy -ResourceGroupName ACU1-BRW-AOA-RG-T5 -TemplateFile .\storageNew.bicep -verbose

VERBOSE: Using Bicep v0.4.1008
VERBOSE: TRACE: Building semantic model for file:///D:/Repos/ADF/ADF/bicep/foo/storageNew.bicep
VERBOSE: Performing the operation "Creating Deployment" on target "ACU1-BRW-AOA-RG-T5".
VERBOSE: 9:35:22 PM - Template is valid.
VERBOSE: 9:35:24 PM - Create template deployment 'storageDeploy'
VERBOSE: 9:35:24 PM - Checking deployment status in 5 seconds
VERBOSE: 9:35:29 PM - Resource Microsoft.Storage/storageAccounts/queueServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:35:29 PM - Resource Microsoft.Storage/storageAccounts/fileServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:35:29 PM - Resource Microsoft.Storage/storageAccounts/tableServices 'acu1brwbott5sadev01/default' provisioning status is succeeded
VERBOSE: 9:35:29 PM - Resource Microsoft.Storage/storageAccounts 'acu1brwbott5sadev01' provisioning status is succeeded
VERBOSE: 9:35:29 PM - Checking deployment status in 5 seconds
VERBOSE: 9:35:34 PM - Resource Microsoft.Storage/storageAccounts/blobServices 'acu1brwbott5sadev01/default' provisioning status is succeeded

DeploymentName          : storageDeploy
ResourceGroupName       : ACU1-BRW-AOA-RG-T5
ProvisioningState       : Succeeded
Timestamp               : 10/21/2021 4:35:28 AM
Mode                    : Incremental
TemplateLink            : 
Parameters              : 
                          Name             Type                       Value
                          ===============  =========================  ==========
                          storageName      String                     acu1brwbott5sadev01
                          location         String                     centralus
                          skuName          String                     Standard_LRS
                          storageKind      String                     StorageV2
                          minTLS           String                     TLS1_2

Outputs                 : 
DeploymentDebugLogLevel : 

okay lets check the portal again.

If you iterate on this process, you can have a standard Storage Module.

E.g. https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/SA-Storage.bicep

You can select the settings that are important to you and keep them updated...

This is (an example) how I choose to define my storage account that I use with that template above.

• added some logging settings
• added ability to create shares and containers
• added private link

        "saInfo": [
          {
            "namesuffix": "dev01",
            "skuName": "Standard_LRS",
            "allNetworks": "Allow",
            "logging": {
              "r": 0,
              "w": 0,
              "d": 1
            },
            "blobVersioning": 1,
            "changeFeed": 1,
            "softDeletePolicy": {
              "enabled": 1,
              "days": 7
            },
            "fileShares": [
              {
                "name": "locust",
                "quota": 5120
              },
              {
                "name": "function",
                "quota": 5120
              }
            ],
            "containers": [
              {
                "name": "locust"
              }
            ]
          }
        ],

This is just an example that works with all resource types, I hope this answer/example is aligned with your actual question 😊or at least gives you some ideas.