Existing resources behavior

[Antse]

hello,

Based on the following feature (existing resources) : https://github.com/Azure/bicep/blob/main/docs/tutorial/05-loops-conditions-existing.md#existing-keyword

I have a simple question: What is happening if the resource is not existing, because, in my case, the resource is created, which is very helpful, is it the standard behavior ?

[anthony-c-martin]

As long as you ensure the new resource is created before your use of the existing reference in your deployment flow, the existing reference should function exactly the same. For example:

main.bicep

resource storageAcc 'Microsoft.Storage/storageAccounts@2021-02-01' = {
  name: 'mystorageacc'
  kind: 'StorageV2'
  location: 'West US'
  sku: {
    name: 'Standard_LRS'
  }
}

module applyLock './lock.bicep' = {
  name: 'applyLock'
  params: {
    // by referencing the storageAcc here, we ensure the module is deployed AFTER the storage account
    accountName: storageAcc.name
  }
}

lock.bicep

param accountName string

// This module is deployed AFTER the storage account, so we can safely obtain a reference to the account here
resource storageAcc 'Microsoft.Storage/storageAccounts@2021-02-01' existing = {
  name: accountName
}

resource lockResource 'Microsoft.Authorization/locks@2016-09-01' = {
  name: 'DontDelete'
  scope: storageAcc
  properties: {
    level: 'CanNotDelete'
  }
}

Does that help, or am I misunderstanding the question?

[Antse]

interesting, because i have a different behavior, i maybe doing something in a wrong way.

Maybe NetworkWatcherRG is automatically created by a prior deployment

here is my example : (it is a part of the deployment, it also deploy an application gateway, storage accounts; log analytics)

main.bicep

// set the target scope for this file
targetScope = 'subscription'

// deploy a resource group to the subscription scope
resource RgFlowlogz 'Microsoft.Resources/resourceGroups@2020-10-01' existing = {
  name: 'NetworkWatcherRG'
}

module flowLogz './modules/nested_deployFlowLogs.bicep' = {
  name: FlowLogName
  scope: resourceGroup(RgFlowlogz.name)
  params:{
    existingNSG: instance.outputs.existingNSG
    storageAccountResourceId: instance.outputs.storageAccountResourceId
    location: instanceConf.location
    FlowLogName: FlowLogName
    NetworkWatcherName: networkWatcherName
  }
}

/modules/nested_deployFlowLogs.bicep

param location string
param NetworkWatcherName string
param FlowLogName string
param existingNSG string
param storageAccountResourceId string

resource networkWatcher 'Microsoft.Network/networkWatchers@2020-11-01' = {
  name: NetworkWatcherName
  location: location
}

resource NetworkWatcherName_FlowLogName 'Microsoft.Network/networkWatchers/FlowLogs@2019-11-01' = {
  parent: networkWatcher
  name: FlowLogName
  location: location
  properties: {
    targetResourceId: existingNSG
    storageId: storageAccountResourceId
    enabled: true
    retentionPolicy: {
      days: 365
      enabled: true
    }
    format: {
      type: 'JSON'
      version: 2
    }
  }
}

[alex-frankel]

Maybe NetworkWatcherRG is automatically created by a prior deployment

I think this is what is happening: https://docs.microsoft.com/en-us/answers/questions/27211/what-is-the-networkwatcherrg.html

[brwilkinson]

@Antse How did you go with this one?

Let us know if you found the root cause, perhaps what Alex mentioned above? Happy to dive deeper if you are still seeing issues here.

[brwilkinson]

Going to mark @alex-frankel as the answer here, since no response to confirm.

Since that link is now dead, here is the updated link and info.

https://docs.microsoft.com/en-us/azure/network-watcher/frequently-asked-questions#what-is-the-networkwatcherrg-