Invalid ARM template due to child resources having "/" in their name

Dilyan Borisov 0

I get the Resource Group deployment template from the portal (copy/paste) or from the CLI:

az group export --name {source_resource_group_name} --include-comments --include-parameter-default-value --output json

Later, I cannot create resources using this template neither from the portal, nor from the CLI:

az deployment group validate --resource-group {target_resource_group_name} --template-file {arm_file_path} --parameters ...

az deployment group create --name {deployment_name} --resource-group {target_resource_group_name} --template-file {arm_file_path} --parameters ...

I get this error:

{
    "code": "Resource has invalid name",
    "message": "Resource has invalid name Microsoft.Audio. Characters /, \\, ?, #, [, ],  , ., @, %, &, *, (, ), +, =, ;, :, ,, <, > are not allowed."
}

...because some resources related to the OpenAI or KeyVault have names like:

    {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "apiVersion": "2024-04-01-preview",
      "name": "[concat(parameters('vaults_kv_my_random_keyvault_name'), '/my-random-secret')]",
      "location": "swedencentral",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', parameters('vaults_kv_my_random_keyvault_name'))]"
      ],
      "properties": {
        "attributes": {
          "enabled": true
        }
      }
    }

All the resources (including the child ones) within the exported template are at root level (not nested).

Obviously the "/" in the name is needed for validation against the type. Replacing the "/" with the encoded/escaped value "%2F" or the expression uriComponent('/') doesn't help. Removing the "/" it says:

{
    "code": "InvalidTemplate",
    "message": "Deployment template validation failed: 'The template resource 'my-random-keyvault' for type 'Microsoft.CognitiveServices/accounts/defenderForAISettings' at line '1411' and column '74' has incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name. Please see https://aka.ms/arm-syntax-resources for usage details."
}

The docs also very clearly state that the "/" is valid and indeed required:

So WTF I need to do to resolve this ???

santoshkc 11,710 Reputation points Microsoft Vendor

2024-12-18T08:50:08.49+00:00
Hi @Dilyan Borisov,

Thank you for reaching out to Microsoft Q&A forum!

The error occurs because Azure ARM templates don’t allow slashes (/) in resource names for certain types. In your case, resources like Microsoft.KeyVault/vaults/secrets include a slash, which is valid for resource identification but not allowed in Azure’s naming rules for ARM templates.

To resolve this:

Ensure proper nesting: Child resources must be correctly referenced and named according to Azure’s resource structure.

Avoid invalid characters: The slash (/) is needed but cannot be used in the resource name segments as per Azure's validation rules.

Check segment lengths: The error suggests a mismatch in the segment count between resource types and names. Ensure the parent and child resource structures are correct.

For more details, refer to the Azure documentation on child resource names.

I hope this helps. Thank you.
Dilyan Borisov 0 Reputation points

2024-12-18T13:33:01.6133333+00:00
Docs are very clear that the "/" is valid. However, I already handled the root level child resources nesting to their parent, with a script.

But now another error occurs for some of these resources - these with "." in their names which are not accepted without it... total non-sense:

names like Microsoft.Default, Microsoft.DefaultV2 and Microsoft.Audio;

their type is: Microsoft.CognitiveServices/accounts/raiPolicies.
santoshkc 11,710 Reputation points Microsoft Vendor

2024-12-19T10:44:56.09+00:00

Hi @Dilyan Borisov,

The issue with . in resource names for Microsoft.CognitiveServices/accounts/raiPolicies likely stems from Azure's validation inconsistencies, as some resource types may not fully support . despite its use in documentation. To resolve this, verify if . is explicitly supported for these resource types and consider replacing it with valid characters like - or _ if it’s not mandatory. Additionally, ensure all resources are properly nested under their parent and test escaping the . using uriComponent('.'). If the issue persists, I recommend you to raise a support request through the Azure portal.

Share via

Invalid ARM template due to child resources having "/" in their name

Your answer