azure二头肌模块-现有资源的条件-如何?

我正在尝试使用模块部署不同类型的机密。其思想是拥有“通用”机密和“存储相关”机密,其中机密值不是直接传递的,而是从存储的属性中检索的。我设计了以下 Secret.bicep :

param keyVaultName string
param secretName string

@secure()
param secretValue string

@allowed([
  'general'
  'storage_conn_string'
])
param secretType string = 'general'

@description('For secretType = storage_*, this is how we will be passing storage name')
param storageAccountName string = 'dummyvalue123'


resource kv 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
  name: keyVaultName
}

resource secret'Microsoft.KeyVault/vaults/secrets@2023-02-01' = if (secretType == 'general') {
  parent: kv
  name: secretName
  properties: {
    value: secretValue
  }
}

// for secrets related to storage we will need to have storage resource:
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = if (startsWith(secretType, 'storage_')) {
  name: storageAccountName
}

// storage connection string
resource secret_conn_string 'Microsoft.KeyVault/vaults/secrets@2023-02-01' = if (secretType == 'storage_conn_string') {
  parent: kv
  name: secretName
  properties: {
    value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccountName};EndpointSuffix=${environment().suffixes.storage};AccountKey=${storageAccount.listKeys().keys[0].value}'
  }
}

现在 main.bicep 我有以下内容:

@secure()
param secretValueAPIkey string

...

module secretStorageDataConnectionString 'modules/KeyVault/Secret.bicep' = {
  // this needs to be a module and not a resource because we need 
  // to pass a connection string to storage, and storage is declared here as a module
  // so we cannot use the listKeys() method
  name: 'secretStorageDataConnectionString'
  params: {
    keyVaultName: kv.outputs.keyVaultName
    secretType : 'storage_conn_string'
    storageAccountName: storageAccount4data.outputs.dtls.name
    secretName: 'secretStorageDataConnectionString'
    secretValue: 'some-dummy-secret-value' //passing dummy value, we will retrieve it in via the module
  }
}

module secretAPIkey 'modules/KeyVault/Secret.bicep' = {
  name: 'secretAPIkey'
  params: {
    keyVaultName: kv.outputs.keyVaultName
    secretType: 'general'
    secretName: 'secretAPIkey'
    secretValue: secretValueAPIkey
  }
}

(请注意,我跳过了一些部分,例如密钥库模块或存储模块。它们部署起来没有问题。)

编辑:

存储帐户创建为 单元 :

module storageAccount4data 'modules/Storage/StorageAccount.bicep' = {
  name: storageAccount4dataName
  params: {
    location: location
    storageAccountName: storageAccount4dataName
  }
}

StorageAccount.bicep:

param storageAccountName string

...

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: storageAccountSkuName
  }
  kind: 'StorageV2'
}

output dtls object = {
  id: storageAccount.id
  name: storageAccount.name
  apiVersion: storageAccount.apiVersion
}

编辑结束

现在,在部署时 secretStorageDataConnectionString 模块的创建没有任何问题,但是 secreAPIkey 模块返回错误:

\"target\": \"/subscriptions/<...>/providers/Microsoft.Resources/deployments/secretAPIkey\"
\"message\": \"The Resource 'Microsoft.Storage/storageAccounts/dummyvalue123' under resource group <resource-group> was not found. ..."

由于某种原因,尽管存在if条件,但仍试图创建存储资源。。。?

我还使用以下方法进行了测试:

//secret.bicep
param storageAccountName string = ''

...

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = if (!empty(storageAccountName)) {
  name: storageAccountName
}

但这个似乎也没有正确评估。。。