Resource not found error in cross subscription resources in Bicep

[PoojaG1]

I am trying to create a private endpoint in one subscription (say xxxx) and my Vnet is in another subscription (say YYYYY). both are managed under a management group. So, i am deploying at management group level. But while creating the endpoint it is giving error that Resource is not found. Please suggest how to solve this issue.

Below is my code for main file:

targetScope = 'managementGroup'
param env string = 'xxxxx'
param appname string = 'abcd'
param tags object
param strgSKU string
param strgKind string
//variables
var envfullname = ((env == 'PrePrd') ? 'preprod' : ((env == 'Prd') ? 'prod' : ((env == 'SB') ? 'sb' : 'dev')))
var strgActName = toLower('${envfullname}${appname}sa1')
var saPrvtEndptName = '${envfullname}-${appname}-sa-pe1'
resource RG 'Microsoft.Resources/resourceGroups@2021-04-01'  existing = {
  scope:subscription('xxxxxxxxxxxxxxxxxxxxx')
  name: '${env}-${appname}-RG'
}
resource vnet 'Microsoft.Network/virtualNetworks@2021-08-01' existing = {
  scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG')
  name: 'Vnet1'
}
resource linkSubnet 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' existing = {
  scope: resourceGroup('yyyyyyyyyyyyyyy','Networking_RG')
  name: 'Vnet1/subnet1'
}
var location = RG.location
var vnetid = vnet.id
//Deploy Resources
/////////////// STORAGE ACCOUNT///////////////////////////////////
//call storage Account bicep module to deploy the storage account
module storageAct './modules/storageAccount.bicep' = {
  scope:RG
  name: strgActName
  params:{
    strgActName: strgActName
    location: location
    tags: tags
    sku: strgSKU
    kind: strgKind
  }
}
// Create a private endpoint and link to storage Account
module saPrivateEndPoint './modules/privateEndpoint.bicep' = {
  scope:RG
  name: saPrvtEndptName
  params: {
    prvtEndpointName: saPrvtEndptName
    prvtLinkServiceId: storageAct.outputs.saId
    tags: tags
    location: location
    subnetId: linkSubnet.id
    //ipaddress: privateDNSip
    fqdn: '${strgActName}.blob.core.cloudapi.net'
    groupId: 'blob'
  }
  dependsOn: [
    storageAct
  ]
}

And my privateendpoint module file looks like:

param prvtEndpointName string
param prvtLinkServiceId string
param tags object
param location string
param subnetId string
//param ipaddress string
param fqdn string
param groupId string
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2020-11-01' = {
  name: prvtEndpointName
  location: location
  tags: tags
  properties: {
    privateLinkServiceConnections: [
      {
        name: '${prvtEndpointName}_cef3fd7f-f1d3-4970-ae54-497245676050'
        properties: {
          privateLinkServiceId: prvtLinkServiceId
          groupIds: [
            groupId
          ]
          privateLinkServiceConnectionState: {
            status: 'Approved'
            description: 'Auto-Approved'
            actionsRequired: 'None'
          }
        }
      }
    ]
    manualPrivateLinkServiceConnections: []
    subnet: {
      id: subnetId
    }
    customDnsConfigs: [
      {
        fqdn: fqdn
        // ipAddresses: [
        //   ipaddress
        // ]
      }
    ]
  }
}

Command to execute the script is:

az deployment mg create --location 'USEast2' --name 'dev2'--management-group-id xt74yryuihfjdnv --template-file main.bicep --parameters main.parameters.json

[alex-frankel]

Can you provide the complete error? Which resource is not found?

[PoojaG1]

Resource /subscriptions/yyyyyyyyyyyyyy/resourceGroups/Networking_RG/providers/Microsoft.Network/virtualNetworks/Vnet1 not found

This is the error when creating privateendpoint in susbcription xxxxxxxx, scope RG

[alex-frankel]

Looks like that corresponds to this section of your code:

resource vnet 'Microsoft.Network/virtualNetworks@2021-08-01' existing = {
  scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG')
  name: 'Vnet1'
}

Is it your intention to use the existing keyword? Are you confident that the vnet vnet already exists? Can you share the resource ID of that vnet?

[PoojaG1]

Yes the Vnet exists. I cannot share the exact Vnet I’d due to security reasons but it is similar to what is mentioned in the error that says resource id not found. It seems the cross subscription deployment is not working as the scope on privateEndpoint is different than where Vnet exists. Both are in different subscriptions and that’s why I have mentioned the target scope as ‘managementGroup’ Thanks Pooja Garg

…

________________________________ From: Alex Frankel ***@***.***> Sent: Wednesday, May 25, 2022 10:18:12 PM To: Azure/bicep ***@***.***> Cc: Garg, Pooja ***@***.***>; Author ***@***.***> Subject: [External] Re: [Azure/bicep] Resource not found error in cross subscription resources in Bicep (Discussion #6947) This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments.

________________________________ Looks like that corresponds to this section of your code: resource vnet ***@***.***' existing = { scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG') name: 'Vnet1' } Is it your intention to use the existing syntax? Are you confident that the vnet vnet already exists? Can you share the resource ID of that vnet? — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_Azure_bicep_discussions_6947-23discussioncomment-2D2821758&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=xxQNl8VhpxWeJjMOAwnPRpHA0oHlnk__iqVxM9DnRRk&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AESDIGUDHUHACLUZA6XDUSLVLZKUZANCNFSM5W346FWA&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=Pej5sT0PNHoOUasvl2pe8G-9l3NeEMDXofDhM2m2eSY&e=>. You are receiving this because you authored the thread.Message ID: ***@***.***>

________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy.

______________________________________________________________________________________ www.accenture.com

[PoojaG1]

Also if it would not have found the Vnet, the error would have been in that resource but not while deploying privateEndpoint. There are other resources in the code that gets deployed successfully as they do not have cross subscription reference like Storage Account Thanks Pooja Garg

…

________________________________ From: Garg, Pooja ***@***.***> Sent: Thursday, May 26, 2022 10:53:10 AM To: Azure/bicep ***@***.***>; Azure/bicep ***@***.***> Cc: Author ***@***.***> Subject: Re: [External] Re: [Azure/bicep] Resource not found error in cross subscription resources in Bicep (Discussion #6947) Yes the Vnet exists. I cannot share the exact Vnet I’d due to security reasons but it is similar to what is mentioned in the error that says resource id not found. It seems the cross subscription deployment is not working as the scope on privateEndpoint is different than where Vnet exists. Both are in different subscriptions and that’s why I have mentioned the target scope as ‘managementGroup’ Thanks Pooja Garg

________________________________ From: Alex Frankel ***@***.***> Sent: Wednesday, May 25, 2022 10:18:12 PM To: Azure/bicep ***@***.***> Cc: Garg, Pooja ***@***.***>; Author ***@***.***> Subject: [External] Re: [Azure/bicep] Resource not found error in cross subscription resources in Bicep (Discussion #6947) This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments.

________________________________ Looks like that corresponds to this section of your code: resource vnet ***@***.***' existing = { scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG') name: 'Vnet1' } Is it your intention to use the existing syntax? Are you confident that the vnet vnet already exists? Can you share the resource ID of that vnet? — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_Azure_bicep_discussions_6947-23discussioncomment-2D2821758&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=xxQNl8VhpxWeJjMOAwnPRpHA0oHlnk__iqVxM9DnRRk&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AESDIGUDHUHACLUZA6XDUSLVLZKUZANCNFSM5W346FWA&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=Pej5sT0PNHoOUasvl2pe8G-9l3NeEMDXofDhM2m2eSY&e=>. You are receiving this because you authored the thread.Message ID: ***@***.***>

________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy.

______________________________________________________________________________________ www.accenture.com

[PoojaG1]

Hey, Just wanted to check if there is any feedback on this yet. Thanks Pooja From: Garg, Pooja ***@***.***> Sent: Thursday, May 26, 2022 10:55 AM To: Azure/bicep ***@***.***>; Azure/bicep ***@***.***> Cc: Author ***@***.***> Subject: Re: [External] Re: [Azure/bicep] Resource not found error in cross subscription resources in Bicep (Discussion #6947) Also if it would not have found the Vnet, the error would have been in that resource but not while deploying privateEndpoint. There are other resources in the code that gets deployed successfully as they do not have cross subscription reference like Storage Account Thanks Pooja Garg

…

________________________________ From: Garg, Pooja ***@***.******@***.***>> Sent: Thursday, May 26, 2022 10:53:10 AM To: Azure/bicep ***@***.******@***.***>>; Azure/bicep ***@***.******@***.***>> Cc: Author ***@***.******@***.***>> Subject: Re: [External] Re: [Azure/bicep] Resource not found error in cross subscription resources in Bicep (Discussion #6947) Yes the Vnet exists. I cannot share the exact Vnet I'd due to security reasons but it is similar to what is mentioned in the error that says resource id not found. It seems the cross subscription deployment is not working as the scope on privateEndpoint is different than where Vnet exists. Both are in different subscriptions and that's why I have mentioned the target scope as 'managementGroup' Thanks Pooja Garg

________________________________ From: Alex Frankel ***@***.******@***.***>> Sent: Wednesday, May 25, 2022 10:18:12 PM To: Azure/bicep ***@***.******@***.***>> Cc: Garg, Pooja ***@***.******@***.***>>; Author ***@***.******@***.***>> Subject: [External] Re: [Azure/bicep] Resource not found error in cross subscription resources in Bicep (Discussion #6947) This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments.

________________________________ Looks like that corresponds to this section of your code: resource vnet ***@***.***' existing = { scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG') name: 'Vnet1' } Is it your intention to use the existing syntax? Are you confident that the vnet vnet already exists? Can you share the resource ID of that vnet? - Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_Azure_bicep_discussions_6947-23discussioncomment-2D2821758&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=xxQNl8VhpxWeJjMOAwnPRpHA0oHlnk__iqVxM9DnRRk&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AESDIGUDHUHACLUZA6XDUSLVLZKUZANCNFSM5W346FWA&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=Pej5sT0PNHoOUasvl2pe8G-9l3NeEMDXofDhM2m2eSY&e=>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy.

______________________________________________________________________________________ www.accenture.com

[brwilkinson]

Hi @PoojaG1

not sure what cloudapi is? '${strgActName}.blob.core.cloudapi.net'

I am only familar with the following .blob.core.windows.net

Other than that ...

please try the following.

resource vnet 'Microsoft.Network/virtualNetworks@2021-08-01' existing = {
  scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG')
  name: 'Vnet1'
}
resource linkSubnet 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' existing = {
  scope: resourceGroup('yyyyyyyyyyyyyyy','Networking_RG')
  name: 'Vnet1/subnet1'

Update the above to the following

resource vnet 'Microsoft.Network/virtualNetworks@2021-08-01' existing = {
  scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG')
  name: 'Vnet1'
}
resource linkSubnet 'Microsoft.Network/virtualNetworks/subnets@2021-08-01' existing = {
  parent: vnet
  name: 'Vnet1'
}

then also add outputs from the first template

/* comment this out
module saPrivateEndPoint './modules/privateEndpoint.bicep' = {
  scope:RG
  name: saPrvtEndptName
  params: {
    prvtEndpointName: saPrvtEndptName
    prvtLinkServiceId: storageAct.outputs.saId
    tags: tags
    location: location
    subnetId: linkSubnet.id
    //ipaddress: privateDNSip
    fqdn: '${strgActName}.blob.core.cloudapi.net'
    groupId: 'blob'
  }
  dependsOn: [
    storageAct
  ]
}
*/

output rgid string = RG.id
output said string = storageAct.outputs.saId
output subnetid string = linkSubnet.id

Add more outputs if you cannot see the error with the above.

Please share your results.

[PoojaG1]

Hi, Looks like I need to deploy Priavte Endpoint under same subscription as Vnet. Will do and let you know for any issues. Reference link: What is a private endpoint? | Microsoft Docs<https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview#private-endpoint-properties> “The private endpoint must be deployed in the same region and subscription as the virtual network.” Thanks Pooja From: Alex Frankel ***@***.***> Sent: Wednesday, May 25, 2022 10:18 PM To: Azure/bicep ***@***.***> Cc: Garg, Pooja ***@***.***>; Author ***@***.***> Subject: [External] Re: [Azure/bicep] Resource not found error in cross subscription resources in Bicep (Discussion #6947) This message is from an EXTERNAL SENDER - be CAUTIOUS, particularly with links and attachments.

…

________________________________ Looks like that corresponds to this section of your code: resource vnet ***@***.***' existing = { scope: resourceGroup('yyyyyyyyyyyyyyyyy','Networking_RG') name: 'Vnet1' } Is it your intention to use the existing syntax? Are you confident that the vnet vnet already exists? Can you share the resource ID of that vnet? — Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_Azure_bicep_discussions_6947-23discussioncomment-2D2821758&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=xxQNl8VhpxWeJjMOAwnPRpHA0oHlnk__iqVxM9DnRRk&e=>, or unsubscribe<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AESDIGUDHUHACLUZA6XDUSLVLZKUZANCNFSM5W346FWA&d=DwMCaQ&c=eIGjsITfXP_y-DLLX0uEHXJvU8nOHrUK8IrwNKOtkVU&r=Zi9vMma3qcPVCJikjXl2ruj1WvaLBZ0IKPrrfXsrvSY&m=dchneqZv4jsoWMtGgxivcQ655TDhajVM3xSf5tY3fy7zYRIguX4j6G25rF-rZV_h&s=Pej5sT0PNHoOUasvl2pe8G-9l3NeEMDXofDhM2m2eSY&e=>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>>

________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. Your privacy is important to us. Accenture uses your personal data only in compliance with data protection laws. For further information on how Accenture processes your personal data, please see our privacy statement at https://www.accenture.com/us-en/privacy-policy.

______________________________________________________________________________________ www.accenture.com

[brwilkinson]

You can use private link across subscriptions. Depending on your permissions in the other subscription, depends if you need to have a separate process in the destination to approve it.

The NIC from the private endpoint needs to land in the Vnet that you want to connect from.

Anyway, sounds like you have a plan.

[brwilkinson]

Will mark as answered.