add nested accessor

Author: tfitzmac

articles/azure-resource-manager/bicep/bicep-functions-resource.md

@@ -4,7 +4,7 @@ description: Describes the functions to use in a Bicep file to retrieve values a
 author: mumian
 ms.author: jgao
 ms.topic: conceptual
-ms.date: 12/28/2021
+ms.date: 03/02/2022
 ---
 
 # Resource functions for Bicep
@@ -145,7 +145,7 @@ param subscriptionId string
 param kvResourceGroup string
 param kvName string
 
-resource kv 'Microsoft.KeyVault/vaults@2019-09-01' existing = {
+resource keyVault 'Microsoft.KeyVault/vaults@2019-09-01' existing = {
   name: kvName
   scope: resourceGroup(subscriptionId, kvResourceGroup )
 }
@@ -155,7 +155,7 @@ module sql './sql.bicep' = {
   params: {
     sqlServerName: sqlServerName
     adminLogin: adminLogin
-    adminPassword: kv.getSecret('vmAdminPassword')
+    adminPassword: keyVault.getSecret('vmAdminPassword')
   }
 }
 ```
@@ -171,7 +171,7 @@ You can call a list function for any resource type with an operation that starts
 
 The syntax for this function varies by the name of the list operation. The returned values also vary by operation. Bicep doesn't currently support completions and validation for `list*` functions.
 
-With **Bicep version 0.4.412 or later**, you call the list function by using the [accessor operator](operators-access.md#function-accessor). For example, `stg.listKeys()`.
+With **Bicep version 0.4.412 or later**, you call the list function by using the [accessor operator](operators-access.md#function-accessor). For example, `storageAccount.listKeys()`.
 
 A [namespace qualifier](bicep-functions.md#namespaces-for-functions) isn't needed because the function is used with a resource type.
 
@@ -218,7 +218,7 @@ Other `list` functions have different return formats. To see the format of a fun
 The following example deploys a storage account and then calls `listKeys` on that storage account. The key is used when setting a value for [deployment scripts](../templates/deployment-script-template.md).
 
 ```bicep
-resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' = {
+resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
   name: 'dscript${uniqueString(resourceGroup().id)}'
   location: location
   kind: 'StorageV2'
@@ -234,8 +234,8 @@ resource dScript 'Microsoft.Resources/deploymentScripts@2019-10-01-preview' = {
   properties: {
     azCliVersion: '2.0.80'
     storageAccountSettings: {
-      storageAccountName: stg.name
-      storageAccountKey: stg.listKeys().keys[0].value
+      storageAccountName: storageAccount.name
+      storageAccountKey: storageAccount.listKeys().keys[0].value
     }
     ...
   }
@@ -254,7 +254,7 @@ param accountSasProperties object {
   }
 }
 ...
-sasToken: stg.listAccountSas('2021-04-01', accountSasProperties).accountSasToken
+sasToken: storageAccount.listAccountSas('2021-04-01', accountSasProperties).accountSasToken
 ```
 
 ### Implementations
@@ -493,12 +493,12 @@ Namespace: [az](bicep-functions.md#namespaces-for-functions).
 
 The reference function is available in Bicep files, but typically you don't need it. Instead, use the symbolic name for the resource.
 
-The following example deploys a storage account. It uses the symbolic name `stg` for the storage account to return a property.
+The following example deploys a storage account. It uses the symbolic name `storageAccount` for the storage account to return a property.
 
 ```bicep
 param storageAccountName string
 
-resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' = {
+resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
   name: storageAccountName
   location: 'eastus'
   kind: 'Storage'
@@ -507,25 +507,29 @@ resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' = {
   }
 }
 
-output storageEndpoint object = stg.properties.primaryEndpoints
+output storageEndpoint object = storageAccount.properties.primaryEndpoints
 ```
 
 To get a property from an existing resource that isn't deployed in the template, use the `existing` keyword:
 
 ```bicep
 param storageAccountName string
 
-resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' existing = {
+resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' existing = {
   name: storageAccountName
 }
 
 // use later in template as often as needed
-output blobAddress string = stg.properties.primaryEndpoints.blob
+output blobAddress string = storageAccount.properties.primaryEndpoints.blob
 ```
 
-If you attempt to reference a resource that doesn't exist, you get the `NotFound` error and your deployment fails.
+To reference a resource that is nested inside a parent resource, use the [nested accessor](operators-access.md#nested-resource-accessor) (`::`). You only use this syntax when you're accessing the nested resource from outside of the parent resource.
+
+```bicep
+vNet1::subnet1.properties.addressPrefix
+```
 
-For more information, see [Reference resources](./compare-template-syntax.md#reference-resources) and the [JSON template reference function](../templates/template-functions-resource.md#reference).
+If you attempt to reference a resource that doesn't exist, you get the `NotFound` error and your deployment fails.
 
 ## resourceId
 
@@ -544,7 +548,7 @@ For example:
 ```bicep
 param storageAccountName string
 
-resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' = {
+resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
   name: storageAccountName
   location: 'eastus'
   kind: 'Storage'
@@ -553,19 +557,19 @@ resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' = {
   }
 }
 
-output storageID string = stg.id
+output storageID string = storageAccount.id
 ```
 
 To get the resource ID for a resource that isn't deployed in the Bicep file, use the existing keyword.
 
 ```bicep
 param storageAccountName string
 
-resource stg 'Microsoft.Storage/storageAccounts@2019-06-01' existing = {
+resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' existing = {
     name: storageAccountName
 }
 
-output storageID string = stg.id
+output storageID string = storageAccount.id
 ```
 
 For more information, see the [JSON template resourceId function](../templates/template-functions-resource.md#resourceid)
@@ -618,7 +622,7 @@ var roleDefinitionId = {
   }
 }
 
-resource myRoleAssignment 'Microsoft.Authorization/roleAssignments@2018-09-01-preview' = {
+resource roleAssignment 'Microsoft.Authorization/roleAssignments@2018-09-01-preview' = {
   name: guid(resourceGroup().id, principalId, roleDefinitionId[builtInRoleType].id)
   properties: {
     roleDefinitionId: roleDefinitionId[builtInRoleType].id
@@ -652,7 +656,7 @@ param policyDefinitionID string = '0a914e76-4921-4c19-b460-a2d36003525a'
 @description('Specifies the name of the policy assignment, can be used defined or an idempotent name as the defaultValue provides.')
 param policyAssignmentName string = guid(policyDefinitionID, resourceGroup().name)
 
-resource myPolicyAssignment 'Microsoft.Authorization/policyAssignments@2019-09-01' = {
+resource policyAssignment 'Microsoft.Authorization/policyAssignments@2019-09-01' = {
   name: policyAssignmentName
   properties: {
     scope: subscriptionResourceId('Microsoft.Resources/resourceGroups', resourceGroup().name)