Loop over created resources

[abunnyuk]

Here's a summary of what I'm hoping to achieve:

1. Deploy multiple copies of an App Service
2. Configure diagnostic settings for each deployed App Service

Here is the code I'm successfully using to :

1. Deploy a single App Service in an existing App Service Plan
2. Configuring diagnostic settings that send logs tn existing Log Analytics Workspace

param location string = resourceGroup().location

// reference existing resources
resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = {
  name: 'log-testing-dev'
}

resource serverFarm 'Microsoft.Web/serverfarms@2021-02-01' existing = {
  name: 'plan-testing-dev'
}

// deploy resources
resource appServiceApp 'Microsoft.Web/sites@2021-02-01' = {
  name: 'app-testing${count}-dev'
  kind: 'linux'
  location: location
  properties: {
    httpsOnly: true
    reserved: true
    serverFarmId: serverFarm.id
    siteConfig: {
      appSettings: [
        {
          name: 'WEBSITE_HTTPLOGGING_RETENTION_DAYS'
          value: '30'
        }
      ]
      httpLoggingEnabled: true
    }
  }
}

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  scope: appServiceApp
  name: 'default'
  properties: {
    workspaceId: logWorkspace.id
    logs: [
      {
        categoryGroup: 'audit'
        enabled: true
      }
    ]
  }
}

I then add a loop based on a count integer to deploy n copies of the same App Service resource:

param location string = resourceGroup().location
param appServiceCount int = 2

// reference existing resources
resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = {
  name: 'log-testing-dev'
}

resource serverFarm 'Microsoft.Web/serverfarms@2021-02-01' existing = {
  name: 'plan-testing-dev'
}

// deploy resources
resource appServiceApp 'Microsoft.Web/sites@2021-02-01' = [for count in range(1, appServiceCount): {
  name: 'app-testing${count}-dev'
  kind: 'linux'
  location: location
  properties: {
    httpsOnly: true
    reserved: true
    serverFarmId: serverFarm.id
    siteConfig: {
      appSettings: [
        {
          name: 'WEBSITE_HTTPLOGGING_RETENTION_DAYS'
          value: '30'
        }
      ]
      httpLoggingEnabled: true
    }
  }
}]

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  scope: appServiceApp
  name: 'default'
  properties: {
    workspaceId: logWorkspace.id
    logs: [
      {
        categoryGroup: 'audit'
        enabled: true
      }
    ]
  }
}

This then returns the following errors in vscode:

The property "scope" expected a value of type "resource | tenant" but the provided value is of type "Microsoft.Web/sites@2021-02-01[]".bicep(BCP036)
Directly referencing a resource or module collection is not currently supported. Apply an array indexer to the expression.bicep(BCP144)

I understand that the problem is due to the appServiceAppDiags resource needing to know the array index of each appServiceApp resource deployed, but I've yet to find a way to loop through those resources.

A workaround of sorts is to loop appServiceAppDiags through the same count parameter but starting at zero, thus looping through the appServiceApp array elements, but I'd need to also tell it to stop at index 1 (which would be the 2nd deployed App Service) so I'm hoping there's a better way of doing it:

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for count in range(0, appServiceCount): {
  scope: appServiceApp[count]
  name: 'default'
  properties: {
    workspaceId: logWorkspace.id
    logs: [
      {
        categoryGroup: 'audit'
        enabled: true
      }
    ]
  }
}]

Any and all help would be very gratefully received,

[brwilkinson]

While it is possible to just pass in X number of resources, it's not very practical to do that.

• what if you deploy 3 the first time, then you only want to redeploy the third one by itself later on?
• what if you need to map to different logs or serverfarms?

Another way to think about this is as follows

• let me know if this seems reasonable for you, or else we can dive deeper into your original scenario with the range()

A few features here:

• The if() statement for optionally deploying a resource such as logging

There is even another way to approach this which would be as follows:

• Define and deploy a single WebSite in a Module, then call that module multiples of times from a parent bicep template.
  • perhaps you can look into that option next.
    • The benefit of that is that you can have individual setting parameter validation, instead of passing in an object array.

Here is a sample for now:

param location string = resourceGroup().location
param WebSites array = [
  {
    name: 'prod'
    farm: 'prod'
    installDiags: true
  }
  {
    name: 'dev'
    farm: 'dev'
    installDiags: false
  }
]

// reference existing resources
resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = [for (ws, index) in WebSites: {
  name: 'log-testing-${ws.name}'
}]

resource serverFarm 'Microsoft.Web/serverfarms@2021-02-01' existing = [for (ws, index) in WebSites: {
  name: 'plan-testing-${ws.farm}'
}]

// deploy resources
resource appServiceApp 'Microsoft.Web/sites@2021-02-01' = [for (ws, index) in WebSites: {
  name: 'app-testing-${ws.name}'
  kind: 'linux'
  location: location
  properties: {
    httpsOnly: true
    reserved: true
    serverFarmId: serverFarm[index].id
    siteConfig: {
      appSettings: [
        {
          name: 'WEBSITE_HTTPLOGGING_RETENTION_DAYS'
          value: '30'
        }
      ]
      httpLoggingEnabled: true
    }
  }
}]

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for (ws, index) in WebSites: if (ws.installDiags) {
  scope: appServiceApp[index]
  name: 'default'
  properties: {
    workspaceId: logWorkspace[index].id
    logs: [
      {
        categoryGroup: 'audit'
        enabled: true
      }
    ]
  }
}]

[abunnyuk]

This is what I'm trying achieve:

1. Deploy n resources (App Services in this case but could be any resource)
2. For each resource deployed, then configure diagnostic settings (Insights extension resource)

It doesn't look like I can do this is in a single template and loop through the appServiceApp array as ARM has no knowledge of them when the Bicep is translated.

I think moving the App Service and Insight resources into a module would resolve the issue, which I'll focus on.

[brwilkinson]

Okay, lets take a look at your example, based on the error that you provided.

this produced and error

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  scope: appServiceApp

The property "scope" expected a value of type "resource | tenant" but the provided value is of type "Microsoft.Web/sites@2021-02-01[]".bicep(BCP036)

Then you stated... that the following resolved the issue.

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for count in range(0, appServiceCount): {
  scope: appServiceApp[count]

So are you clear on why the error occurred and why the index resolved it?

[brwilkinson]

The diagnostics settings here are an Extension resource type, so they have to be scoped to a single/individual resource.

https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/extension-resource-types

[abunnyuk]

Which is exactly what I'm trying to do.

The problem I'm finding is that I can't loop the extension resource against the appServiceApp resource array, so something like the following:

resource appServiceApp 'Microsoft.Web/sites@2021-02-01' = [for count in range(1, appServiceCount): {
  name: 'app-testing${count}-dev'
  kind: 'linux'
  location: location
  properties: {
    httpsOnly: true
    reserved: true
    serverFarmId: serverFarm.id
    siteConfig: {
      appSettings: [
        {
          name: 'WEBSITE_HTTPLOGGING_RETENTION_DAYS'
          value: '30'
        }
      ]
      httpLoggingEnabled: true
    }
  }
}]

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for index in range(0, length(appServiceApp)): {
  scope: appServiceApp[index]
  name: 'default'
  properties: {
    workspaceId: logWorkspace.id
    logs: [
      {
        categoryGroup: 'audit'
        enabled: true
      }
    ]
  }
}

I can sort of get around it by instead looping the extension resource against the count parameter (scope: appServiceApp[count]) which does work but it's messy.

Thank you for your help.

[brwilkinson]

yes exactly you cannot reference the resource itself, you should loop over whatever list that you originally used to generate the resource in the first place.

just use the exact same loop control that you used in the Website and it will be reliable and will work fine, At the end of the day you are achieving the same thing. It's just a different way of looking at it.

if you take a look at this file: https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/AppServiceContainer.bicep

you can see I looped over the same thing every time (a total of 6 times):

[for (ws, index) in WebSiteInfo: if (WSInfo[index].match) {

[abunnyuk]

I went back over what I needed to do and it was actually much simpler to move the resources into a module (which was the plan anyway) and then loop through the appServiceCount parameter starting from 0, using is the appServiceApp index.

The module then outputs the URL which is collated in an array that I'll use later to populate Application Gateway pools. This array could be used for anything, like deploying other resources/modules based on ouputs or simply the number of resources deployed.

// File: main.bicep

param appServiceCount int = 2
param diagsEnabled bool = true
param location string = resourceGroup().location

// reference existing resources
resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = {
  name: 'log-testing-dev'
}

resource serverFarm 'Microsoft.Web/serverfarms@2021-02-01' existing = {
  name: 'plan-testing-dev'
}

// deploy module n times
module appServiceModule 'appService.bicep' = [for count in range(1, appServiceCount): {
  name: 'appServiceDeploy${count}'
  params: {
    appServiceName: 'app-testing${count}-dev'
    appServiceFarmId: serverFarm.id
    appServiceKind: appServiceParams.kind
    diagsEnabled: diagsEnabled
    logWorkspaceId: logWorkspace.id
  }
}]

// create array of appServiceModule outputs for n module deployments
output appServiceApps array = [for index in (range(0, appServiceCount)): {
  'appServiceUrl': appServiceModule[index].outputs.appServiceUrl
}]

// create outputs from main.bicep
output logWorkspaceId string = logWorkspace.id
output namespaceId string = hubNamespace.id
output serverFarmId string = serverFarm.id

Here's the module:

// File: appService.bicep

param appServiceName string
param appServiceFarmId string
param appServiceKind string = 'linux'
param diagsEnabled bool = false
param location string = resourceGroup().location
param logWorkspaceId string = ''

resource appServiceApp 'Microsoft.Web/sites@2021-02-01' = {
  name: appServiceName
  kind: appServiceKind
  identity: {
    type: 'SystemAssigned'
  }
  location: location
  properties: {
    httpsOnly: true
    reserved: true
    serverFarmId: appServiceFarmId
    siteConfig: {
      appSettings: [
        {
          name: 'WEBSITE_HTTPLOGGING_RETENTION_DAYS'
          value: '30'
        }
      ]
      ftpsState: 'Disabled'
      httpLoggingEnabled: true
    }
  }
}

resource appServiceAppDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = if (diagsEnabled) {
  scope: appServiceApp
  name: 'default'
  properties: {
    workspaceId: logWorkspaceId
    logs: [
      {
        categoryGroup: 'audit'
        enabled: true
      }
    ]
  }
}

output appServiceUrl string = appServiceApp.properties.hostNames[0]

Outputs:

{
    "outputs": {
        "appServiceApps": {
            "type": "Array",
            "value": [
                {
                    "appServiceUrl": "app-testing1-dev.azurewebsites.net"
                },
                {
                    "appServiceUrl": "app-testing2-dev.azurewebsites.net"
                }
            ]
        },
        "logWorkspaceId": {
            "type": "String",
            "value": "/subscriptions/*******-****-****-****-************/resourceGroups/rg-log-dev/providers/Microsoft.OperationalInsights/workspaces/log-log-dev"
        },
        "serverFarmId": {
            "type": "String",
            "value": "/subscriptions/*******-****-****-****-************/resourceGroups/rg-app-dev/providers/Microsoft.Web/serverfarms/plan-testing-dev"
        }
    }
}

[brwilkinson]

Nice, that will give you a good amount of flexibility, function & simplicity. 👍

[axelbodin]

An older post, I know, but just came across this and wanted to share my example. I deploy a bunch of Private DNS Zones and then private dns zone links. Items in arrays in bicep seem to always be in the same order so I iterate this way:

var privateDnsZonesList = [
  'privatelink.monitor.azure.com'
  'privatelink.oms.opinsights.azure.com'
  'privatelink.ods.opinsights.azure.com'
  'privatelink.agentsvc.azure-automation.net'
  'privatelink.blob.core.windows.net'
  'privatelink.vault.azure.net'
  'privatelink.azurewebsites.net'
  'privatelink.scm.azurewebsites.net'
]

@batchSize(1)
resource privateDnsZones 'Microsoft.Network/privateDnsZones@2020-06-01' = [
  for zone in privateDnsZonesList: {
    name: zone
    location: resourceGroup().location
  }
]

resource privateDnaZonesVirtualNetworkLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = [
  for i in range(0, length(privateDnsZonesList)): {
    name: guid('${vnet.name}-${privateDnsZones[i].name}-vnl')
    parent: privateDnsZones[i]
    location: 'global'
    properties: {
      registrationEnabled: false
      virtualNetwork: {
        id: vnet.id
      }
    }
  }
]

I hope this helps someone.

The ability to iterate through a list of deployment objects would be nice anyway.
EDIT. Fixed an error. Forgot that deployments in a loop will run in parallel by default. Result of that is that the Microsoft.Network/privateDnsZones objects in privateDnsZones won't always be in the same order. This will break consecutive deployments.

[abunnyuk]

I've recently moved to using Azure Verified Modules for increased consistency and often enjoy looking at how Microsoft developers have approached similar problems.

https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/private-endpoint