Cannot create a child resource for a parent with an explicit resource group scope

[fschmied]

Bicep version
Bicep VS Code extension 0.4.1124

Describe the bug
I want to declare a child resource using the parent syntax, where the parent resource has a specific resource group as its scope. (I'm forced to use the parent syntax because I want to use a loop.)

• If I specify no scope on the child resource, I get this error: Cannot deploy a resource with ancestor under a different scope. Resource "azureSqlServers" has the "scope" property set.bicep(BCP165)
• If I do specify the same scope on the child as for the parent, I get this error: The "scope" property is unsupported for a resource with a parent resource. This resource has "azureSqlServer" declared as its parent.bicep(BCP164)

To Reproduce
Simple repro, with the loop removed:

resource azureSqlServer 'Microsoft.Sql/servers@2021-05-01-preview' existing = {
  name: 'some-sql'
  scope: resourceGroup('some-rg')
}

resource vnetRules 'Microsoft.Sql/servers/virtualNetworkRules@2021-05-01-preview' = {
  name: 'some-rule'
  // scope: resourceGroup('some-rg')
  parent: azureSqlServer
}

Additional context
This is probably related to #2990, but it's not about tenant-scoped resources.
Should this have been considered as a valid scenario in #4394?

[alex-frankel]

Except for a few exceptions, the scope for a resource will always be the scope of the current bicep file. If you need to change the scope of where a resource is deployed, you need to declare a module which deploys to a different scope like so:

module deploySql 'deploySql.bicep' = {
  scope: resourceGroup('some-rg')
  ...
} 

Then in the deploySql.bicep file you will declare the resources you want to deploy without the scope property.

[fschmied]

Thanks for the answer, using modules is a good workaround. However, don't you think that:

• the child resource should automatically "inherit" the scope of the parent resource and/or
• the child resource should be allowed to specify the same scope as on the parent resource?

At the very least, maybe the error messages could be improved. BCP165 seems to suggest to change the Bicep code so that BCP165 is issued and the other way around.

[alex-frankel]

I agree the error message is misleading here -- the root cause is BCP164. The child resource does automatically inherit the parent resource scope. The issue is trying the set the scope property on the parent resource, which is not allowed (with very few exceptions).

@anthony-c-martin / @shenglol / @majastrz -- is there a way that we could have thrown BCP164 instead of BCP165 in this scenario?

[anthony-c-martin]

I had a go at rewording the errors - see the diff here. Do these seem any clearer?

[tasdflkjweio]

The issue is trying the set the scope property on the parent resource, which is not allowed (with very few exceptions).

@alex-frankel Wondering why it's disallowed like this

[alex-frankel]

It is just not technically possible today. It would be nice to enable this at some point.