Trying to use looped outputs of a module in another module/loop

[samtjordan23]

Hey team,

I am trying to create a storage account, with private endpoints (for blob, table, web, queue and file), and then create the relevant DNS entries for them.
I can create the storage account, and associate the private endpoints correctly, however I then need to get the IP output from the private endpoint loop, and pump that into my Private-DNS loop.

The reason I have to modulate these is the privateendpoints and privatedns live in different resource groups/subscriptions.
I am happy to move the loop to be on the module, or in the module file itself, or to merge the two loops into one module file as I will always need private DNS when I roll out PE on my storage accounts.

//main.bicep
module privateEndpoint '../Module-PrivateEndpoint-Storagev2.bicep' = {
  name: '${storageAccountName}-PrivateEndpoints'
  scope: resourceGroup(privateendpointRG)
  params: {
    storageAccountId: StorageAccount.id
    storageAccountName: StorageAccount.name
    subnetName: subnet.name
    virtualNetworkName: virtualNetwork.name
    tags: tags
  }
}
// unsure if this line is needed
var storageInfo = privateEndpoint.outputs.storageInfo

module aRecord '../Module-PrivateDNS-A.bicep' = [for i in storageInfo:{
  name: '${storageAccountName}-aRecord-${i}'
  scope: resourceGroup(dnsRG)
  params: {
    endpointName: storageAccountName
    dnsZoneName: 'privatelink.${i.groupid}.${az.environment().suffixes.storage}'
    privateEndpointIpAddress: i.dnsip
  }
}]

// This is now the module file - ../Module-PrivateEndpoint-Storagev2.bicep
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = [for storagetype in storagetypes:{
  name: '${storageAccountName}-${storagetype}-privateEndpoint'
  location: location
  tags: tags
  properties: {
    subnet: {
      id: subnet.id
    }
    privateLinkServiceConnections: [
      {
        name: '${storageAccountName}-${storagetype}-privateendpoint'
        properties: {
          privateLinkServiceId: storageAccountId
          groupIds: ['${storagetype}']
        }
      }
      
    ]
  }
}]
output storageInfo array = [for (storagetype, i) in storagetypes: {
  dnsip: privateEndpoint[i].properties.customDnsConfigs[0].ipAddresses[0]
  groupid: i
}]

// This is now the module file - ../Module-PrivateDNS-A.bicep
resource privateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = {
  name: dnsZoneName
}
resource aRecord 'Microsoft.Network/privateDnsZones/A@2020-06-01' = {
  name: endpointName
  parent: privateDnsZone
  properties: {
    ttl: 3600
    aRecords: [
      {
        ipv4Address: privateEndpointIpAddress
      }
    ]
  }
}

[GABRIELNGBTUC]

You need to do the loop:

module aRecord '../Module-PrivateDNS-A.bicep' = [for i in storageInfo:{
  name: '${storageAccountName}-aRecord-${i}'
  scope: resourceGroup(dnsRG)
  params: {
    endpointName: storageAccountName
    dnsZoneName: 'privatelink.${i.groupid}.${az.environment().suffixes.storage}'
    privateEndpointIpAddress: i.dnsip
  }
}]

Inside a module that is referenced in the main.bicep as explained by the error This expression is being used in the for-expression, which requires a value that can be calculated at the start of the deployment. You are referencing a variable which cannot be calculated at the start (\"storageInfo\" -> \"privateEndpoint\"). Properties of privateEndpoint which can be calculated at the start include \"name\"."]

Or if you already know the value of storageTypes in your main.bicep, change the loop to:

param storageTypes array
...
module aRecord './Module-PrivateEndpoint-Storagev2.bicep' = [for i in range(0, length(storageTypes)):{
  name: '${storageAccountName}-aRecord-${i}'
  scope: resourceGroup(dnsRG)
  params: {
    endpointName: storageAccountName
    dnsZoneName: 'privatelink.${storageInfo[i].groupid}.${az.environment().suffixes.storage}'
    privateEndpointIpAddress: storageInfo[i].dnsip
  }
}]

[samtjordan23]

So my issue is that I don't know the dnsip from storageinfo until I have run the privateendpoint module.
So what I am wanting is to run the PE module, and then use the outputs from that in the privatedns module.

I know the storage types as these are the defaults - ['blob', 'web', 'storage', 'queue', 'table'], See the output from the private endpoint module here:

// This is now the module file - ../Module-PrivateEndpoint-Storagev2.bicep
output storageInfo array = [for (storagetype, i) in storagetypes: {
  dnsip: privateEndpoint[i].properties.customDnsConfigs[0].ipAddresses[0]
  groupid: i
}]

[samtjordan23]

So I was able to get this working. I was overthinking this, and just needed to pass the array into the module, and let the module handle the information from there. Most of the changes happened in the DNS module at the bottom.

1. I had to pass the outputs into the module as an array
2. I had to define it at the top of the module as an array (like you would any variable set)
3. I then had to use my groupid variable to loop through the array for the existing azuredns zone names
4. I then had to get the existing dns zones in my environment using the dnsZones variable
5. I was then able to iterate through my privateendpoint results, and create the appropriate DNS record with the appropriate IP address

Here is my main.bicep:

module privateEndpoint '../Module-PrivateEndpoint-Storagev2.bicep' = {
  name: '${storageAccountName}-PrivateEndpoints'
  scope: resourceGroup(privateendpointRG)
  params: {
    storageAccountId: StorageAccount.id
    storageAccountName: StorageAccount.name
    subnetName: subnet.name
    virtualNetworkName: virtualNetwork.name
    tags: tags
  }
}

module aRecords '../Module-PrivateDNS-A.bicep' = {
  name: 'aRecordsModule'
  scope: resourceGroup(DNS_SubscriptionID, DNS_RG)
  params: {
    storageInfo: privateEndpoint.outputs.storageInfo
    storageAccountName: StorageAccount.name
  }
}

Module-PrivateEndpoint-Storagev2.bicep:

param storageAccountName string
param virtualNetworkName string
param subnetName string
param storageAccountId string
param location string = 'Australia East'
param tags object
param storagetypes array = ['blob', 'web', 'file', 'queue', 'table' ]

// Virtual Network and Subnet
resource vnet 'Microsoft.Network/virtualNetworks@2023-04-01' existing = {
  name: virtualNetworkName
}

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2023-04-01' existing = {
  parent: vnet
  name: subnetName
}

// Private Endpoint
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = [for storagetype in storagetypes:{
  name: '${storageAccountName}-${storagetype}-privateEndpoint'
  location: location
  tags: tags
  properties: {
    subnet: {
      id: subnet.id
    }
    privateLinkServiceConnections: [
      {
        name: '${storageAccountName}-${storagetype}-privateendpoint'
        properties: {
          privateLinkServiceId: storageAccountId
          groupIds: ['${storagetype}']
        }
      }
      
    ]
  }
}]
output storageInfo array = [for (storagetype, i) in storagetypes: {
  dnsip: privateEndpoint[i].properties.customDnsConfigs[0].ipAddresses[0]
  groupid: storagetype
}]

Module-PrivateDNS-A.bicep

param storageInfo array
param storageAccountName string


var dnsZones = [for (info, i) in storageInfo: 'privatelink.${info.groupid}.core.windows.net']

resource dnsZonesResource 'Microsoft.Network/privateDnsZones@2020-06-01' existing = [for zone in dnsZones: {
  name: zone
}]

resource aRecords 'Microsoft.Network/privateDnsZones/A@2020-06-01' = [for (info, i) in storageInfo: {
  name: storageAccountName
  parent: dnsZonesResource[i]  // Reference the correct DNS zone resource
  properties: {
    ttl: 3600
    aRecords: [
      {
        ipv4Address: info.dnsip
      }
    ]
  }
}]

I hope this is able to help someone with bicep storage accounts, with private endpoint and the azure dns records to go with them.