Assign existing vnet in bicep file

[derekgrus]

I have a bicep file that creates a virtual machine. I would like to attach an existing subnet already in Azure. Would it be added in this section?

resource vn 'Microsoft.Network/virtualNetworks@2021-02-01' = { name: virtualNetworkName location: location properties: { addressSpace: { addressPrefixes: [ addressPrefix ] } subnets: [ { name: subnetName properties: { addressPrefix: subnetPrefix networkSecurityGroup: { id: securityGroup.id } } } ] } }

[ElYusubov]

Hi @derekgrus,

// Try to declare an existing VNet, like in the following sample:
// And then declare you NIC with an existing VNet and a subnet.
 
 resource virtualNetwork 'Microsoft.Network/virtualNetworks@2022-05-01' existing = {
  name: virtualNetworkName
}

resource nic 'Microsoft.Network/networkInterfaces@2022-05-01' = {
  name: nicName
  location: location
  properties: {
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          privateIPAllocationMethod: 'Dynamic'
          publicIPAddress: {
            id: publicIp.id
          }
          subnet: {
            id: resourceId('Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, subnetName)
          }
        }
      }
    ]
  }
  dependsOn: [
    virtualNetwork
  ]
}

// Next, create your VM with a network profile like in the following sample:

resource vm 'Microsoft.Compute/virtualMachines@2022-03-01' = {
  name: vmName
  location: location
  properties: {
    hardwareProfile: {
      vmSize: vmSize
    }
    osProfile: {
      computerName: vmName
      adminUsername: adminUsername
      adminPassword: adminPassword
    }
    storageProfile: {
      imageReference: {
        publisher: 'MicrosoftWindowsServer'
        offer: 'WindowsServer'
        sku: OSVersion
        version: 'latest'
      }
      osDisk: {
        createOption: 'FromImage'
        managedDisk: {
          storageAccountType: 'StandardSSD_LRS'
        }
      }
      dataDisks: [
        {
          diskSizeGB: 1023
          lun: 0
          createOption: 'Empty'
        }
      ]
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nic.id
        }
      ]
    }
    diagnosticsProfile: {
      bootDiagnostics: {
        enabled: true
        storageUri: storageAccount.properties.primaryEndpoints.blob
      }
    }
    securityProfile: ((securityType == 'TrustedLaunch') ? securityProfileJson : json('null'))
  }
}

Hope this samples will guide you to a correct solution.
Cheers!

[derekgrus]

Thank you @ElYusubov! It was a big help.

[ElYusubov]

Awesome!
Glad that it helped you, @derekgrus !

[cbg-branabhat]

Hi,

I am in the exactly same situation. Tried to workout.
It says, the subnet referenced by NIC was not found.

In my case, the vnet is in different subnet and i used the scope: resourceGroup (resourceGroup)

Please advise if you have any experience using this way.

[uky2019]

It should work normally, I usually reference and existing subnet directly, then reference the .id of it in the NIC I am creating for the VM, and it worked every time. Can you paste the code and I will try to help you

BTW what exactly do you mean VNET is in the other subnet, you mean subnet is in a different vnet? it should not make a difference with the deploy.

[cbg-branabhat]

Thanks Uky2019,

Apology ! I meant to say Virtual network in Another Resource Group (RG). The RG I am creating a VM is in different RG , but both RG are in the same subscription and same region.

Yep, I also want to reference to existing subnet.

Here is my Code

@description('Username for the Virtual Machine.')
param adminUsername string

@description('Password for the Virtual Machine.')
@minlength(12)
@secure()
param adminPassword string

@description('The Windows version for the VM. This will pick a fully patched image of this given Windows version.')
@Allowed([
'2016-datacenter-gensecond'
'2016-datacenter-server-core-g2'
'2016-datacenter-server-core-smalldisk-g2'
'2016-datacenter-smalldisk-g2'
'2016-datacenter-with-containers-g2'
'2016-datacenter-zhcn-g2'
'2019-datacenter-core-g2'
'2019-datacenter-core-smalldisk-g2'
'2019-datacenter-core-with-containers-g2'
'2019-datacenter-core-with-containers-smalldisk-g2'
'2019-datacenter-gensecond'
'2019-datacenter-smalldisk-g2'
'2019-datacenter-with-containers-g2'
'2019-datacenter-with-containers-smalldisk-g2'
'2019-datacenter-zhcn-g2'
'2022-datacenter-azure-edition'
'2022-datacenter-azure-edition-core'
'2022-datacenter-azure-edition-core-smalldisk'
'2022-datacenter-azure-edition-smalldisk'
'2022-datacenter-core-g2'
'2022-datacenter-core-smalldisk-g2'
'2022-datacenter-g2'
'2022-datacenter-smalldisk-g2'
])
param OSVersion string = '2022-datacenter-azure-edition'

@description('Size of the virtual machine.')
param vmSize string = 'Standard_D2s_v5'

@description('Location for all resources.')
param location string = resourceGroup().location

@description('Name of the virtual machine.')
param vmName string = 'simple-vm'

@description('Security Type of the Virtual Machine.')
@Allowed([
'Standard'
'TrustedLaunch'
])
param securityType string = 'TrustedLaunch'

var storageAccountName = 'bootdiags${uniqueString(resourceGroup().id)}'
var nicName = 'myVMNic'
var addressPrefix = '192.168.1.0/24'
var subnetName = 'subnet1'
var subnetPrefix = '192.168.1.0/26'
var virtualNetworkName = 'vnet1'
var networkSecurityGroupName = 'default-NSG'
var securityProfileJson = {
uefiSettings: {
secureBootEnabled: true
vTpmEnabled: true
}
securityType: securityType
}
var extensionName = 'GuestAttestation'
var extensionPublisher = 'Microsoft.Azure.Security.WindowsAttestation'
var extensionVersion = '1.0'
var maaTenantName = 'GuestAttestation'
var maaEndpoint = substring('emptyString', 0, 0)

resource storageAccount 'Microsoft.Storage/storageAccounts@2022-05-01' = {
name: storageAccountName
location: location
sku: {
name: 'Standard_LRS'
}
kind: 'Storage'
}

resource networkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2022-05-01' = {
name: networkSecurityGroupName
location: location
properties: {
securityRules: [
{
name: 'default-allow-3389'
properties: {
priority: 1000
access: 'Allow'
direction: 'Inbound'
destinationPortRange: '3389'
protocol: 'Tcp'
sourcePortRange: ''
sourceAddressPrefix: ''
destinationAddressPrefix: '*'
}
}
]
}
}

//I am using the existing virtualNetwork here

resource virtualNetwork 'Microsoft.Network/virtualNetworks@2022-05-01' existing = {
name: virtualNetworkName
scope: resourceGroup('rg-vnet')
//'rg-vnet' is the resource group where the virtual network is built

}

resource networksubnet 'Microsoft.Network/virtualNetworks/subnets@2023-04-01' existing = {
name: subnetName
scope: resourceGroup('rg-vnet')
}

resource nic 'Microsoft.Network/networkInterfaces@2022-05-01' = {
name: nicName
location: location
properties: {
ipConfigurations: [
{
name: 'ipconfig1'
properties: {
privateIPAllocationMethod: 'Dynamic'
subnet: {
id: resourceId('Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, subnetName)
}
}
}
]
}
dependsOn: [

virtualNetwork
networksubnet

]
}

resource vm 'Microsoft.Compute/virtualMachines@2022-03-01' = {
name: vmName
location: location
properties: {
hardwareProfile: {
vmSize: vmSize
}
osProfile: {
computerName: vmName
adminUsername: adminUsername
adminPassword: adminPassword
}
storageProfile: {
imageReference: {
publisher: 'MicrosoftWindowsServer'
offer: 'WindowsServer'
sku: OSVersion
version: 'latest'
}
osDisk: {
createOption: 'FromImage'
managedDisk: {
storageAccountType: 'StandardSSD_LRS'
}
}
dataDisks: [
{
diskSizeGB: 512
lun: 0
createOption: 'Empty'
}
]
}
networkProfile: {
networkInterfaces: [
{
id: nic.id
}
]
}
diagnosticsProfile: {
bootDiagnostics: {
enabled: true
storageUri: storageAccount.properties.primaryEndpoints.blob
}
}
securityProfile: ((securityType == 'TrustedLaunch') ? securityProfileJson : null)
}
}

resource vmExtension 'Microsoft.Compute/virtualMachines/extensions@2022-03-01' = if ((securityType == 'TrustedLaunch') && ((securityProfileJson.uefiSettings.secureBootEnabled == true) && (securityProfileJson.uefiSettings.vTpmEnabled == true))) {
parent: vm
name: extensionName
location: location
properties: {
publisher: extensionPublisher
type: extensionName
typeHandlerVersion: extensionVersion
autoUpgradeMinorVersion: true
enableAutomaticUpgrade: true
settings: {
AttestationConfig: {
MaaSettings: {
maaEndpoint: maaEndpoint
maaTenantName: maaTenantName
}
}
}
}
}

Error I am getting:

{"code":"InvalidResourceReference","message":"Resource /subscriptions/xxxxx-xxxx-xxxx/resourceGroups/rg-vnet/providers/Microsoft.Network/virtualNetworks/vnet1/subnets/subnet1 referenced by resource /subscriptions/xxxxx-xxxx-xxxx/resourceGroups/rg-test/providers/Microsoft.Network/networkInterfaces/myVMNic was not found.

Please make sure that the referenced resource exists, and that both resources are in the same region.","details":[]}
But both are in the same region, 'australiaeast'

Thank you so much for looking at it.

[uky2019]

Hi, my guess would be you are referencing the subnet wrong, try this, i commented directly below in your code:

look at the error, something is not adding up it should be /vnet1/subnet1 or vnet1/subnet not two times like it is in your error:

{"code":"InvalidResourceReference","message":"Resource /subscriptions/xxxxx-xxxx-xxxx/resourceGroups/rg-vnet/providers/Microsoft.Network/virtualNetworks/vnet1/subnets/subnet1

I commented out the not needed VNET part,

//I am using the existing virtualNetwork here 
//You do not actually need to reference vnet, you can only just reference a subnet like below:

/*
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2022-05-01' existing = {
name: virtualNetworkName
scope: resourceGroup('rg-vnet') 
//'rg-vnet' is the resource group where the virtual network is built
}
*/

resource networksubnet 'Microsoft.Network/virtualNetworks/subnets@2023-04-01' existing = {
name: virtualNetworkName/subnetName //example: 'vnet1/subnet1'
scope: resourceGroup('rg-vnet') //this is ok
}

resource nic 'Microsoft.Network/networkInterfaces@2022-05-01' = {
name: nicName
location: location
properties: {
ipConfigurations: [
{
name: 'ipconfig1'
properties: {
privateIPAllocationMethod: 'Dynamic'
subnet: {
id: networksubnet.id //this should work - no need to state both vnet and subnet
}
}
}
]
}
dependsOn: [ //you should also probably remove this, you are referencing and existing vnet, so they already exisist, and if they do not deployment will fail either way

virtualNetwork
networksubnet
]
}

Try it out.

[cbg-branabhat]

Thank you so much for this.

Used this way,

resource networksubnet 'Microsoft.Network/virtualNetworks/subnets@2023-04-01' existing = {
name: subnetName
scope: resourceGroup(virtualNetworkResourceGroup)
}

resource nic 'Microsoft.Network/networkInterfaces@2022-05-01' = {
name: nicName
location: location
properties: {
ipConfigurations: [
{
name: 'ipconfig1'
properties: {
privateIPAllocationMethod: 'Dynamic'
subnet: {
id: resourceId(virtualNetworkResourceGroup, 'Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, subnetName)
}
}
}
]
}

Finding another issue,

Script creates Vm, public IP, NSG etc..works as expected but does not attach public ip and NSG to NIC.

Any suggestion please.

BR,
Binod

[uky2019]

Well, you have to reference public IP in your NIC resource creation and you are not doing that, are you attaching NSG to Subnet or NIC?

[cbg-branabhat]

Thank you. Good point.
NSG , possibly to NIC ?

How it look like if I want to attach to subnet ?

Appreciate your reply.

[uky2019]

You reference the NSG in creation of your subnet:

resource YOUR_VNET 'Microsoft.Network/virtualNetworks@2020-06-01' = {
  name: 'VNET01'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        your_addressPrefix
      ]
    }
    enableVmProtection: false
    enableDdosProtection: false
    subnets: [
      {
        name: 'Subnet01'
        properties: {
          addressPrefix: your_subnetprefix
          networkSecurityGroup: {
            id: your_referenced_nsg.id // you are either creating new NSG or referencing existing one
         }
        }
      }

Or associate / connect it with NIC

resource testnsg 'Microsoft.Network/networkSecurityGroups@2023-05-01' existing = {
  name: 'YOUR-NSG'
}

resource YOUR_NIC 'Microsoft.Network/networkInterfaces@2021-02-01' = [for ip in staticIps: {
  name: 'YOUR-NIC'
  location: location
  properties: {
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          privateIPAllocationMethod: 'Static'
          privateIPAddress: privateipaddress
     networkSecurityGroup: testnsg.id //creating new or referencing existing
   }
 }]

I highly recommend that you start using VScode with bicep extension installed for linter and autocomplete etc, it will be so much easier for you.
And also if you are having troubles with understanding how things go together click for resource through GUI in Azure portal, export *.JSON template, decompile it to bicep with "bicep decompile" and inspect the file to see how things fall together.

[cbg-branabhat]

Thank you so much, will try this.