How Scope a Resource to Another Resource Deployed Via a Module

[lpmulligan]

I'm having a problem getting around the issue of trying to associate a data collection rule to a VM resource that is deployed from the AVM VM template.

My target scope is set to targetScope = 'subscription' for the bicep file.

I deploy the VM just fine.

@description('VM for Application workloads.')
module AppVM 'br/public:avm/res/compute/virtual-machine:0.2.1' = {
  scope: resourceGroup(ResourceGroup.name)
  name: 'appVMDeployment-${uniqueString(deployment().name, resourceLocation)}'
...
}

But when trying to associate a data collection rule scoped to the VM I keep meeting with resistance. BTW, the data collection rule resides in another resource group deployed outside of this deployment with the VM.

resource dcrAssociation 'Microsoft.Insights/dataCollectionRuleAssociations@2022-06-01' = {
  name: 'vm-${customerName}-dcr-${env}-${azureRegionCode}'
  scope: AppVM <---THIS IS THE PROBLEM
  properties: {
    description: 'Association of data collection rule. Deleting this association will break the data collection for this virtual machine.'
    dataCollectionRuleId: windowsDataCollectionRule.id
  }
}

VS Code says:

Scope "module" is not valid for this resource type. Permitted scopes: "resource", "tenant", "managementGroup", "subscription", "resourceGroup".bicep(BCP135)
module AppVM 'br/public:avm/res/compute/virtual-machine:0.2.1'
VM for Application workloads.
This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs.

So my question is how can I associate the data collection rule with my VM? The only information I've seen -> https://learn.microsoft.com/en-us/azure/templates/microsoft.insights/datacollectionruleassociations?pivots=deployment-language-bicep has the target scope for the association as the target VM which I don't see how to reference in my current situation. Are there alternatives?

[GABRIELNGBTUC]

You are trying to scope your resource to a module, not a resource (your VM).

Create a new module to apply the data collection rule with your VM name as a parameter. Then inside your new module, use an existing statement to retrieve the previously created VM and apply the data collection rule using that reference.

Pseudo code:

main.bicep

module appVm = { ...}

module vmDataCollectionRule = {
scope: resourceGroup(ResourceGroup.name)
params: {
  vmName: appVm.outputs.vmName
}
}

new module

param vmName string

resource vm '...'  existing = {
name: vmName
}

resource dcrAssociation ... = {
scope: vm
}

[lpmulligan]

Thank you so much for this clear explanation and code. This worked. I don't exactly grasp why I can't scope the Association rule to the module, but that's a battle for another day.

[GABRIELNGBTUC]

Modules are an abstraction of deployments in ARM. You cannot scope the rule to a module because it would be more or less the equivalent to scoping it to a resource of type "Microsoft.Resources/deployments@2023-07-01".