How do I reference a linked ARM template that is stored in a VSTS or Azure DevOps Git Repo?

Question

An ARM template allows you to reference another "linked" ARM template using the "templateLink" property. I would like to do this using a raw git uri in Azure DevOps (VSTS). I can do this with github as shown below:

"resources": [ 
  { 
      "apiVersion": "2017-05-10", 
      "name": "linkedTemplate", 
      "type": "Microsoft.Resources/deployments", 
      "properties": { 
        "mode": "incremental", 
        "templateLink": {
          "uri": "https://raw.githubusercontent.com/lw/BaseARMTemplates/master/ARM.json"",
          "contentVersion": "1.0.0.0"
        }, 
      } 
  }
] 

Answer 1

Best practice is to use storage account with sas token to retrieve the template. that would allow you to reference your template securely (https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-powershell-sas-token).

you can use any secure storage if you can pass auth in the url (only get requests). or you can create an azure function that would proxy your requests to private storage and retrieve templates (a hack, obviously).

Answer 2

You can create a pipeline which first pushes arm-templates to private storage account and then create a step to create SAS-token and then pass the SAS-token to the ARM-template. That's the MS recommended best practise, but it feels like a hack and I didn't like it too much so I ended up creating separate release pipeline tasks and templates instead of using nested templates. If you need to pass values from template to another you can use ARM-template outputs to achieve that.