ARM Template - Creating dependency between two nested templates - azure-resource-manager

Question

I have two nested deployments:
One for resource group A which deploys a managed identity.
Second for resource group B which deploys a Keyvault and sets an access policy to the ManagedIdentity in resource group A.
I would like to have the nested deployment of the resource group B to be dependent on the nested deployment of resource group A.
(My main template is deploying to resource group C)
I have tried:
"dependsOn": [
"[variables('resourceGroupADeploymentName')]"
],
But I keep failing on:
The Resource 'Microsoft.ManagedIdentity/userAssignedIdentities/managedIdentityA' under resource group 'A' was not found.
After a while I see the ManagedIdentityA created in resource group A - so it means the dependsOn did not work and the resourceGroupB deployment did not wait for ResourceGroupA deployment.
I also tried using dependsOn resourceId but it did not work. (and also adding the dependsOn to the actual KeyVault resource deployment within ResourceGroupB)
Any idea how can I have a resource from resource group B dependent on resource from resource group A?
This is my ARM Template for resourceGroupB:
{
"name": "resourceGroupBDeploymentName",
"type": "Microsoft.Resources/deployments",
"apiVersion": "[variables('resourceDeploymentApiVersion')]",
"resourceGroup": "[parameters('B')]",
"subscriptionId": "[parameters('S')]",
"dependsOn": [
"[variables('resourceGroupADeploymentName')]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.KeyVault/vaults/accessPolicies",
"name": "[concat(parameters('deploymentKvName'), '/add')]",
"apiVersion": "[variables('kvApiVersion')]",
"properties": {
"accessPolicies": [
{
"tenantId": "[parameters('S')]",
"objectId": "[reference(variables('ManagedIdentityResourceGroupA'), '2018-11-30').principalId]",
"permissions": {
"keys": [],
"secrets": [],
"certificates": [
"Get"
]
}
}
]
}
}
}
]
}
}
}
This is my ARM Template for resourceGroupA:
{
"name": "[variables('ManagedIdentityResourceGroupA')]",
"type": "Microsoft.Resources/deployments",
"apiVersion": "[variables('resourceDeploymentApiVersion')]",
"resourceGroup": "[parameters('A')]",
"subscriptionId": "[parameters('S')]",
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"name": "[variables('ManagedIdentityResourceGroupA')]",
"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
"apiVersion": "2018-11-30",
"tags": {},
"location": "[resourceGroup().location]"
}
]
}
}
},

Answer 1

I dont think there is a way around that yet. Dependencies only work in the same resource gruop. you can use deployment script resource to run a script that would check the status and that can act as a dependsOn