update bicep to adhere to latest waf standards

Harsh-Microsoft · Harsh-Microsoft · commit c4d65cd1d35d · 2025-11-18T17:08:50.000+05:30
diff --git a/infra/main.bicep b/infra/main.bicep
diff --git a/infra/main.json b/infra/main.json
diff --git a/infra/modules/ai-foundry/ai-services.bicep b/infra/modules/ai-foundry/ai-services.bicep
@@ -260,7 +260,7 @@ var formattedRoleAssignments = [
   })
 ]
 
-resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = {
+resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = {
   name: name
   kind: kind
   identity: identity
@@ -355,7 +355,7 @@ resource cognitiveService_diagnosticSettings 'Microsoft.Insights/diagnosticSetti
   }
 ]
 
-module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.0' = [
+module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: take('${uniqueString(deployment().name, location)}-cognitiveService-PrivateEndpoint-${index}', 64)
     scope: resourceGroup(
diff --git a/infra/modules/ai-foundry/aifoundry.bicep b/infra/modules/ai-foundry/aifoundry.bicep
@@ -156,7 +156,7 @@ var identity = !empty(managedIdentities)
       userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
     }
   : null
-  
+
 #disable-next-line no-deployments-resources
 resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {
   name: '46d3xbcp.res.cognitiveservices-account.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
@@ -176,14 +176,14 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT
   }
 }
 
-resource cMKKeyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId)) {
+resource cMKKeyVault 'Microsoft.KeyVault/vaults@2025-05-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId)) {
   name: last(split(customerManagedKey.?keyVaultResourceId!, '/'))
   scope: resourceGroup(
     split(customerManagedKey.?keyVaultResourceId!, '/')[2],
     split(customerManagedKey.?keyVaultResourceId!, '/')[4]
   )
 
-  resource cMKKey 'keys@2023-07-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId) && !empty(customerManagedKey.?keyName)) {
+  resource cMKKey 'keys@2025-05-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId) && !empty(customerManagedKey.?keyName)) {
     name: customerManagedKey.?keyName!
   }
 }
@@ -208,7 +208,7 @@ var aiServicesPrivateDnsZoneResourceId = privateNetworking != null
   ? privateNetworking.?aiServicesPrivateDnsZoneResourceId ?? ''
   : ''
 
-resource cognitiveServiceNew 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = if(!useExistingService) {
+resource cognitiveServiceNew 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = if(!useExistingService) {
   name: name
   kind: kind
   identity: identity
diff --git a/infra/modules/ai-foundry/dependencies.bicep b/infra/modules/ai-foundry/dependencies.bicep
@@ -187,7 +187,7 @@ var formattedRoleAssignments = [
 
 var enableReferencedModulesTelemetry = false
 
-resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' existing = {
+resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' existing = {
   name: name
 }
 
@@ -251,7 +251,7 @@ resource cognitiveService_diagnosticSettings 'Microsoft.Insights/diagnosticSetti
   }
 ]
 
-module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.0' = [
+module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.1' = [
   for (privateEndpoint, index) in (privateEndpoints ?? []): {
     name: '${uniqueString(deployment().name, location)}-cognitiveService-PrivateEndpoint-${index}'
     scope: resourceGroup(
diff --git a/infra/modules/ai-foundry/keyVaultExport.bicep b/infra/modules/ai-foundry/keyVaultExport.bicep
@@ -13,11 +13,11 @@ param secretsToSet secretToSetType[]
 //   Resources   //
 // ============= //
 
-resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
+resource keyVault 'Microsoft.KeyVault/vaults@2025-05-01' existing = {
   name: keyVaultName
 }
 
-resource secrets 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = [
+resource secrets 'Microsoft.KeyVault/vaults/secrets@2025-05-01' = [
   for secret in secretsToSet: {
     name: secret.name
     parent: keyVault
diff --git a/infra/modules/ai-foundry/project.bicep b/infra/modules/ai-foundry/project.bicep
@@ -27,7 +27,7 @@ resource cogServiceReference 'Microsoft.CognitiveServices/accounts@2024-10-01' e
 }
 
 // Create new AI project only if not reusing existing one
-resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' = if(!useExistingProject) {
+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-07-01-preview' = if(!useExistingProject) {
   parent: cogServiceReference
   name: name
   tags: tags
diff --git a/infra/modules/cosmosDb.bicep b/infra/modules/cosmosDb.bicep
@@ -43,7 +43,7 @@ var batchContainerName = 'cmsabatch'
 var fileContainerName = 'cmsafile'
 var logContainerName = 'cmsalog'
 
-module cosmosAccount 'br/public:avm/res/document-db/database-account:0.15.0' = {
+module cosmosAccount 'br/public:avm/res/document-db/database-account:0.18.0' = {
   name: take('avm.res.document-db.database-account.${name}', 64)
   params: {
     name: name
@@ -58,7 +58,6 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.15.0' = {
       virtualNetworkRules: []
     }
     zoneRedundant: zoneRedundant
-    automaticFailover: !empty(secondaryLocation)
     failoverLocations: !empty(secondaryLocation)
       ? [
           {
@@ -132,7 +131,7 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.15.0' = {
         name: databaseName
       }
     ]
-    dataPlaneRoleAssignments: [
+    sqlRoleAssignments: [
       {
         principalId: dataAccessIdentityPrincipalId
         roleDefinitionId: sqlContributorRoleDefinition.id
diff --git a/infra/modules/keyVault.bicep b/infra/modules/keyVault.bicep
@@ -25,7 +25,7 @@ import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5
 @description('Optional. Array of role assignments to create.')
 param roleAssignments roleAssignmentType[]?
 
-import { secretType } from 'br/public:avm/res/key-vault/vault:0.12.1'
+import { secretType } from 'br/public:avm/res/key-vault/vault:0.13.3'
 @description('Optional. Array of secrets to create in the Key Vault.')
 param secrets secretType[]?
 
@@ -36,7 +36,7 @@ var privateDnsZoneResourceId = privateNetworking != null
   ? privateNetworking.?privateDnsZoneResourceId ?? ''
   : ''
 
-module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
+module keyvault 'br/public:avm/res/key-vault/vault:0.13.3' = {
   name: take('avm.res.key-vault.vault.${name}', 64)
   params: {
     name: name
diff --git a/infra/modules/storageAccount.bicep b/infra/modules/storageAccount.bicep
@@ -43,7 +43,7 @@ var filePrivateDnsZoneResourceId = privateNetworking != null
   ? privateNetworking.?filePrivateDnsZoneResourceId ?? ''
   : ''
 
-module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
+module storageAccount 'br/public:avm/res/storage/storage-account:0.28.0' = {
   name: take('avm.res.storage.storage-account.${name}', 64)
   #disable-next-line no-unnecessary-dependson
   params: {
@@ -108,6 +108,10 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
     roleAssignments: roleAssignments
     blobServices: {
       containers: containers ?? []
+      deleteRetentionPolicyEnabled: true
+      deleteRetentionPolicyDays: 7
+      containerDeleteRetentionPolicyEnabled: true
+      containerDeleteRetentionPolicyDays: 7
     }
     enableTelemetry: enableTelemetry
   }
diff --git a/infra/modules/virtualNetwork.bicep b/infra/modules/virtualNetwork.bicep
@@ -1,10 +1,10 @@
 /****************************************************************************************************************************/
 // Networking - NSGs, VNET and Subnets. Each subnet has its own NSG
 /****************************************************************************************************************************/
-@description('Name of the virtual network.')
+@description('Required. Name of the virtual network.')
 param name string
 
-@description('Azure region to deploy resources.')
+@description('Optional. Azure region to deploy resources.')
 param location string = resourceGroup().location
 
 @description('Required. An Array of 1 or more IP Address Prefixes for the Virtual Network.')
@@ -175,7 +175,6 @@ param resourceSuffix string
 //     Standard_D2s_v3 (2 vCPU, 8 GiB RAM, Premium SSD) //  next most common
 //     Standard_D2s_v4 (2 vCPU, 8 GiB RAM, Premium SSD)  // Newest, so fewer regions available
 
-
 // Subnet Classless Inter-Domain Routing (CIDR)  Sizing Reference Table (Best Practices)
 // | CIDR      | # of Addresses | # of /24s | Notes                                 |
 // |-----------|---------------|-----------|----------------------------------------|
@@ -205,12 +204,12 @@ param resourceSuffix string
 // - Document subnet usage and purpose in code comments.
 // - For AVM modules, ensure only one delegation per subnet and leave delegations empty if not required.
 
-// 1. Create NSGs for subnets 
+// 1. Create NSGs for subnets
 // using AVM Network Security Group module
 // https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/network-security-group
 
 @batchSize(1)
-module nsgs 'br/public:avm/res/network/network-security-group:0.5.1' = [
+module nsgs 'br/public:avm/res/network/network-security-group:0.5.2' = [
   for (subnet, i) in subnets: if (!empty(subnet.?networkSecurityGroup)) {
     name: take('avm.res.network.network-security-group.${subnet.?networkSecurityGroup.name}.${resourceSuffix}', 64)
     params: {
@@ -227,7 +226,7 @@ module nsgs 'br/public:avm/res/network/network-security-group:0.5.1' = [
 // using AVM Virtual Network module
 // https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/virtual-network
 
-module virtualNetwork 'br/public:avm/res/network/virtual-network:0.7.0' = {
+module virtualNetwork 'br/public:avm/res/network/virtual-network:0.7.1' = {
   name: take('avm.res.network.virtual-network.${name}', 64)
   params: {
     name: name
@@ -280,15 +279,22 @@ output subnets subnetOutputType[] = [
 ]
 
 // Dynamic outputs for individual subnets for backward compatibility
+@description('The resource ID of the Web Subnet.')
 output webSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'web')
   ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'web')]
   : ''
+
+@description('The resource ID of the Private Endpoints Subnet.')
 output pepsSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'peps')
   ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'peps')]
   : ''
+
+@description('The resource ID of the Azure Bastion Subnet.')
 output bastionSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'AzureBastionSubnet')
   ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'AzureBastionSubnet')]
   : ''
+
+@description('The resource ID of the Jumpbox Subnet.')
 output jumpboxSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'jumpbox')
   ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'jumpbox')]
   : ''

Original file line number	Diff line number	Diff line change
`@@ -260,7 +260,7 @@ var formattedRoleAssignments = [`
`260`	`260`	`})`
`261`	`261`	`]`
`262`	`262`
`263`		`-resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = {`
	`263`	`+resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = {`
`264`	`264`	`name: name`
`265`	`265`	`kind: kind`
`266`	`266`	`identity: identity`
`@@ -355,7 +355,7 @@ resource cognitiveService_diagnosticSettings 'Microsoft.Insights/diagnosticSetti`
`355`	`355`	`}`
`356`	`356`	`]`
`357`	`357`
`358`		`-module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.0' = [`
	`358`	`+module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.1' = [`
`359`	`359`	`for (privateEndpoint, index) in (privateEndpoints ?? []): {`
`360`	`360`	`name: take('${uniqueString(deployment().name, location)}-cognitiveService-PrivateEndpoint-${index}', 64)`
`361`	`361`	`scope: resourceGroup(`
Original file line number	Diff line number	Diff line change
`@@ -156,7 +156,7 @@ var identity = !empty(managedIdentities)`
`156`	`156`	`userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null`
`157`	`157`	`}`
`158`	`158`	`: null`
`159`		`-`
	`159`	`+`
`160`	`160`	`#disable-next-line no-deployments-resources`
`161`	`161`	`resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {`
`162`	`162`	`name: '46d3xbcp.res.cognitiveservices-account.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'`
`@@ -176,14 +176,14 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT`
`176`	`176`	`}`
`177`	`177`	`}`
`178`	`178`
`179`		`-resource cMKKeyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId)) {`
	`179`	`+resource cMKKeyVault 'Microsoft.KeyVault/vaults@2025-05-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId)) {`
`180`	`180`	`name: last(split(customerManagedKey.?keyVaultResourceId!, '/'))`
`181`	`181`	`scope: resourceGroup(`
`182`	`182`	`split(customerManagedKey.?keyVaultResourceId!, '/')[2],`
`183`	`183`	`split(customerManagedKey.?keyVaultResourceId!, '/')[4]`
`184`	`184`	`)`
`185`	`185`
`186`		`- resource cMKKey 'keys@2023-07-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId) && !empty(customerManagedKey.?keyName)) {`
	`186`	`+ resource cMKKey 'keys@2025-05-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId) && !empty(customerManagedKey.?keyName)) {`
`187`	`187`	`name: customerManagedKey.?keyName!`
`188`	`188`	`}`
`189`	`189`	`}`
`@@ -208,7 +208,7 @@ var aiServicesPrivateDnsZoneResourceId = privateNetworking != null`
`208`	`208`	`? privateNetworking.?aiServicesPrivateDnsZoneResourceId ?? ''`
`209`	`209`	`: ''`
`210`	`210`
`211`		`-resource cognitiveServiceNew 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = if(!useExistingService) {`
	`211`	`+resource cognitiveServiceNew 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = if(!useExistingService) {`
`212`	`212`	`name: name`
`213`	`213`	`kind: kind`
`214`	`214`	`identity: identity`
Original file line number	Diff line number	Diff line change
`@@ -187,7 +187,7 @@ var formattedRoleAssignments = [`
`187`	`187`
`188`	`188`	`var enableReferencedModulesTelemetry = false`
`189`	`189`
`190`		`-resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' existing = {`
	`190`	`+resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' existing = {`
`191`	`191`	`name: name`
`192`	`192`	`}`
`193`	`193`
`@@ -251,7 +251,7 @@ resource cognitiveService_diagnosticSettings 'Microsoft.Insights/diagnosticSetti`
`251`	`251`	`}`
`252`	`252`	`]`
`253`	`253`
`254`		`-module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.0' = [`
	`254`	`+module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.1' = [`
`255`	`255`	`for (privateEndpoint, index) in (privateEndpoints ?? []): {`
`256`	`256`	`name: '${uniqueString(deployment().name, location)}-cognitiveService-PrivateEndpoint-${index}'`
`257`	`257`	`scope: resourceGroup(`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ resource cogServiceReference 'Microsoft.CognitiveServices/accounts@2024-10-01' e`
`27`	`27`	`}`
`28`	`28`
`29`	`29`	`// Create new AI project only if not reusing existing one`
`30`		`-resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-04-01-preview' = if(!useExistingProject) {`
	`30`	`+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-07-01-preview' = if(!useExistingProject) {`
`31`	`31`	`parent: cogServiceReference`
`32`	`32`	`name: name`
`33`	`33`	`tags: tags`
Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,7 @@ var batchContainerName = 'cmsabatch'`
`43`	`43`	`var fileContainerName = 'cmsafile'`
`44`	`44`	`var logContainerName = 'cmsalog'`
`45`	`45`
`46`		`-module cosmosAccount 'br/public:avm/res/document-db/database-account:0.15.0' = {`
	`46`	`+module cosmosAccount 'br/public:avm/res/document-db/database-account:0.18.0' = {`
`47`	`47`	`name: take('avm.res.document-db.database-account.${name}', 64)`
`48`	`48`	`params: {`
`49`	`49`	`name: name`
`@@ -58,7 +58,6 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.15.0' = {`
`58`	`58`	`virtualNetworkRules: []`
`59`	`59`	`}`
`60`	`60`	`zoneRedundant: zoneRedundant`
`61`		`- automaticFailover: !empty(secondaryLocation)`
`62`	`61`	`failoverLocations: !empty(secondaryLocation)`
`63`	`62`	`? [`
`64`	`63`	`{`
`@@ -132,7 +131,7 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.15.0' = {`
`132`	`131`	`name: databaseName`
`133`	`132`	`}`
`134`	`133`	`]`
`135`		`- dataPlaneRoleAssignments: [`
	`134`	`+ sqlRoleAssignments: [`
`136`	`135`	`{`
`137`	`136`	`principalId: dataAccessIdentityPrincipalId`
`138`	`137`	`roleDefinitionId: sqlContributorRoleDefinition.id`