Subscription Placement Module Assistance

[oZakari]

Hello,

We are attempting to create a subscription placement module, but we've encountered the known limitation with the nested for resource loops in Bicep resource modules (as shown in the code below). The goal is to map multiple subscription IDs to their respective management group IDs in a way that allows a single management group ID to have multiple associated subscription IDs.

Given the syntax restrictions of the Microsoft.Management/managementGroups/subscriptions resource provider and lack of ability to do nested for resource loops , is there another approach to achieve this one-to-many mapping without using nested for loops? Or is the only viable option to declare a new object for each management group and subscription ID pairing individually, instead of allowing multiple subscription IDs under a single management group ID?

Here’s the current code:

targetScope = 'tenant'

@description('Type definition for management group child containing management group ID and subscription IDs.')
type typMgChild = {
  @description('The ID of the management group.')
  managementGroupId: string
  @description('The list of subscription IDs.')
  subscriptionIds: string[]
}[]

@description('Parameter for subscription placement containing management group and subscription IDs.')
param parSubscriptionPlacement typMgChild = [
  {
    managementGroupId: 'ALZ'
    subscriptionIds: ['SUBID1', 'SUBID2']
  }
  {
    managementGroupId: 'ALZ-LandingZones'
    subscriptionIds: ['SUBID3']
  }
]

resource customsubscriptionPlacement 'Microsoft.Management/managementGroups/subscriptions@2023-04-01' = [for placement in parSubscriptionPlacement: {
  scope: tenant()
  name: [for subscription in placement.subscriptionIds: {'${placement.managementGroupId}/${subscription}']
  }
]

[sebassem]

I gave it a try and I could do it using a helper module for subscription placement

Helper module

targetScope = 'tenant'

param managementGroupId string
param subscriptionIds array

resource customsubscriptionPlacement 'Microsoft.Management/managementGroups/subscriptions@2023-04-01' = [for (subscription,i) in subscriptionIds: {
  name: '${managementGroupId}/${subscription}'
}]

Module code

targetScope = 'tenant'

@description('Type definition for management group child containing management group ID and subscription IDs.')
type typMgChild = {
  @description('The ID of the management group.')
  managementGroupId: string
  @description('The list of subscription IDs.')
  subscriptionIds: string[]
}[]

param parSubscriptionPlacement typMgChild = [
  {
    managementGroupId: 'Group1'
    subscriptionIds: ['SUBID1', 'SUBID2']
  }
  {
    managementGroupId: 'Group2'
    subscriptionIds: ['SUBID3']
  }
]

module customsubscriptionPlacement 'module.bicep' = [for (subscriptionPlacement, index) in parSubscriptionPlacement: {
  name: 'subPlacement${index}'
  params: {
    managementGroupId: subscriptionPlacement.managementGroupId
    subscriptionIds: subscriptionPlacement.subscriptionIds
  }
}]

[johnlokerse]

I would go the same way as @sebassem. If you don't want another module/layer then you could go with this:

resource customsubscriptionPlacement 'Microsoft.Management/managementGroups/subscriptions@2023-04-01' = [for (placement, index) in parSubscriptionPlacement: {
  scope: tenant()
  name: '${placement.managementGroupId}/${placement.subscriptionIds[index]}'
  }
]

Essentially the same as @sebassem's example, but without the module

[oZakari]

Awesome, thank you both for your help!!!