Referencing UserManagedIdentity from other resource group

[nikodemrafalski]

Hi Farmer Community,

I'm struggling with getting inter resource group references right. My goal is to reference identity created in other deployment from keyvault (and also webapp) deployments

Some of the Farmer's Computational Expressions expose the unmanaged variant, policies don't Is it possible without changes to farmer?

This is how I tried to approach it.

let webAppsIdentity = ResourceId.create(ManagedIdentity.userAssignedIdentities, ResourceName IAM.WebAppsIdentity, group=ResourceGroups.IAM)
let webAppsIdentityPrincipalId = ArmExpression.create($"guid(reference({webAppsIdentity.ArmExpression.Value}).principalId)")

let kv = keyVault{
    name "kv"
    add_access_policies [
        accessPolicy {
            object_id webAppsIdentityPrincipalId
            secret_permissions [ KeyVault.Secret.Get ]
        }
    ]
}

Unfortunately during the deployment to live Azure Subscription I'm getting the error stating that the UserManagedIdentity is not a part of the deployment.

Thanks!

[ninjarobot]

ARM resources are designed such that if you send multiple requests to create a resource that is already created, they will leave the existing resource in place so there is no real harm in declaring the same resource in multiple deployments. Since they are different resource groups, you could do this with nested deployments so the identity is in the same deployment. For instance, you'll have a top level deployment that creates the user assigned identity. Then a nested deployment targeting the resource group with the key vault and access policy that references that user assigned identity like you have here.

Here is an example for creating nested deployments targeting different resource groups and running them in one deployment which should make those references work properly.

[martinbryant]

Hi @nikodemrafalski - can we look to close this issue following the suggestion that has been given?

[nikodemrafalski]

Thank you