Skip to content

chore: Update Bicep modules and resource versions across the infrastructure #415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Roopan-Microsoft merged 3 commits into from
Apr 21, 2026
Merged

chore: Update Bicep modules and resource versions across the infrastructure #415

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
549917d
Update Bicep modules and resource versions across the infrastructure
Pavan-Microsoft Apr 20, 2026
d8d1bbd
Refactor Bicep modules for improved configuration and output handling
Pavan-Microsoft Apr 20, 2026
734757b
Remove aiModelDeployments parameter from main.parameters.json and mai…
Pavan-Microsoft Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 33 additions & 39 deletions infra/main.bicep
View file
Open in desktop

Large diffs are not rendered by default.

3,724 changes: 2,333 additions & 1,391 deletions infra/main.json
View file
Open in desktop

Large diffs are not rendered by default.

34 changes: 16 additions & 18 deletions infra/main_custom.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,15 +167,15 @@ var resourceGroupTagsValue = union(
)

// ========== Resource Group Tag ========== //
resource resourceGroupTags 'Microsoft.Resources/tags@2021-04-01' = {
resource resourceGroupTags 'Microsoft.Resources/tags@2025-04-01' = {
name: 'default'
properties: {
tags: resourceGroupTagsValue
}
}

#disable-next-line no-deployments-resources
resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry) {
resource avmTelemetry 'Microsoft.Resources/deployments@2025-04-01' = if (enableTelemetry) {
name: take(
'46d3xbcp.ptn.sa-modernizeyourcode.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}',
64
Expand All @@ -196,7 +196,7 @@ resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableT
}
}

module appIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.4.2' = {
module appIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.5.0' = {
name: take('avm.res.managed-identity.user-assigned-identity.${solutionSuffix}', 64)
params: {
name: 'id-${solutionSuffix}'
Expand All @@ -212,13 +212,13 @@ var existingLawSubscription = useExistingLogAnalytics ? split(existingLogAnalyti
var existingLawResourceGroup = useExistingLogAnalytics ? split(existingLogAnalyticsWorkspaceId, '/')[4] : ''
var existingLawName = useExistingLogAnalytics ? split(existingLogAnalyticsWorkspaceId, '/')[8] : ''

resource existingLogAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2020-08-01' existing = if (useExistingLogAnalytics) {
resource existingLogAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2025-07-01' existing = if (useExistingLogAnalytics) {
name: existingLawName
scope: resourceGroup(existingLawSubscription, existingLawResourceGroup)
}

// Deploy new Log Analytics workspace only if required and not using existing
module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.12.0' = if ((enableMonitoring || enablePrivateNetworking) && !useExistingLogAnalytics) {
module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.15.0' = if ((enableMonitoring || enablePrivateNetworking) && !useExistingLogAnalytics) {
name: take('avm.res.operational-insights.workspace.${solutionSuffix}', 64)
params: {
name: 'log-${solutionSuffix}'
Expand Down Expand Up @@ -282,7 +282,7 @@ var LogAnalyticsPrimarySharedKey string = useExistingLogAnalytics? existingLogAn
var LogAnalyticsWorkspaceId = useExistingLogAnalytics? existingLogAnalyticsWorkspace.properties.customerId : logAnalyticsWorkspace!.outputs.logAnalyticsWorkspaceId
var logAnalyticsWorkspaceName = useExistingLogAnalytics ? existingLawName : logAnalyticsWorkspace!.outputs.name

module applicationInsights 'br/public:avm/res/insights/component:0.7.0' = if (enableMonitoring) {
module applicationInsights 'br/public:avm/res/insights/component:0.7.1' = if (enableMonitoring) {
name: take('avm.res.insights.component.${solutionSuffix}', 64)
params: {
name: 'appi-${solutionSuffix}'
Expand Down Expand Up @@ -341,7 +341,7 @@ var dnsZoneIndex = {
// - Excludes AI-related zones when using with an existing Foundry project
// ===================================================
@batchSize(5)
module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.8.0' = [
module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.8.1' = [
for (zone, i) in privateDnsZones: if (enablePrivateNetworking) {
name: take('avm.res.network.private-dns-zone.${split(zone, '.')[1]}.${solutionSuffix}', 64)
params: {
Expand All @@ -360,7 +360,7 @@ module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.8.0' = [

// Azure Bastion Host
var bastionHostName = 'bas-${solutionSuffix}'
module bastionHost 'br/public:avm/res/network/bastion-host:0.8.0' = if (enablePrivateNetworking) {
module bastionHost 'br/public:avm/res/network/bastion-host:0.8.2' = if (enablePrivateNetworking) {
name: take('avm.res.network.bastion-host.${bastionHostName}', 64)
params: {
Comment thread
Pavan-Microsoft marked this conversation as resolved.
name: bastionHostName
Expand Down Expand Up @@ -390,7 +390,7 @@ module bastionHost 'br/public:avm/res/network/bastion-host:0.8.0' = if (enablePr

// ========== Jumpbox Virtual machine ========== //
var maintenanceConfigurationResourceName = 'mc-${solutionSuffix}'
module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-configuration:0.3.2' = if (enablePrivateNetworking) {
module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-configuration:0.4.0' = if (enablePrivateNetworking) {
name: take('avm.res.compute.virtual-machine.${maintenanceConfigurationResourceName}', 64)
params: {
name: maintenanceConfigurationResourceName
Expand Down Expand Up @@ -430,7 +430,7 @@ var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
var dataCollectionRulesLocation = useExistingLogAnalytics
? existingLogAnalyticsWorkspace!.location
: logAnalyticsWorkspace!.outputs.location
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.8.0' = if (enablePrivateNetworking && enableMonitoring) {
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
params: {
name: dataCollectionRulesResourceName
Expand Down Expand Up @@ -556,7 +556,7 @@ module proximityPlacementGroup 'br/public:avm/res/compute/proximity-placement-gr


var virtualMachineResourceName = take('vm-jumpbox-${solutionSuffix}', 15)
module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.20.0' = if (enablePrivateNetworking) {
module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.22.0' = if (enablePrivateNetworking) {
name: take('avm.res.compute.virtual-machine.${virtualMachineResourceName}', 64)
params: {
name: virtualMachineResourceName
Expand Down Expand Up @@ -673,11 +673,9 @@ module aiServices 'modules/ai-foundry/aifoundry.bicep' = {
privateNetworking: null // Private endpoint is handled by the standalone aiFoundryPrivateEndpoint module
existingFoundryProjectResourceId: existingFoundryProjectResourceId
disableLocalAuth: true //Should be set to true for WAF aligned configuration
customSubDomainName: 'aif-${solutionSuffix}'
apiProperties: {
//staticsEnabled: false
}
allowProjectManagement: true
managedIdentities: {
systemAssigned: true
}
Expand Down Expand Up @@ -712,7 +710,7 @@ module aiServices 'modules/ai-foundry/aifoundry.bicep' = {
var aiFoundryAiServicesResourceName = 'aif-${solutionSuffix}'
var useExistingAiFoundryAiProject = !empty(existingFoundryProjectResourceId)

module aiFoundryPrivateEndpoint 'br/public:avm/res/network/private-endpoint:0.8.1' = if (enablePrivateNetworking && !useExistingAiFoundryAiProject) {
module aiFoundryPrivateEndpoint 'br/public:avm/res/network/private-endpoint:0.12.0' = if (enablePrivateNetworking && !useExistingAiFoundryAiProject) {
name: take('pep-${aiFoundryAiServicesResourceName}-deployment', 64)
params: {
name: 'pep-${aiFoundryAiServicesResourceName}'
Expand Down Expand Up @@ -788,7 +786,7 @@ module storageAccount 'modules/storageAccount.bicep' = {
}

// Azure Container Registry for azd container deployments
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-11-01' = {
name: take('acrreg${solutionSuffix}', 50)
location: location
sku: {
Expand Down Expand Up @@ -863,7 +861,7 @@ module cosmosDb 'modules/cosmosDb.bicep' = {

var containerAppsEnvironmentName = 'cae-${solutionSuffix}'

module containerAppsEnvironment 'br/public:avm/res/app/managed-environment:0.11.3' = {
module containerAppsEnvironment 'br/public:avm/res/app/managed-environment:0.13.1' = {
name: take('avm.res.app.managed-environment.${solutionSuffix}', 64)
#disable-next-line no-unnecessary-dependson
dependsOn: [applicationInsights, logAnalyticsWorkspace, virtualNetwork] // required due to optional flags that could change dependency
Expand Down Expand Up @@ -903,7 +901,7 @@ module containerAppsEnvironment 'br/public:avm/res/app/managed-environment:0.11.
}
}

module containerAppBackend 'br/public:avm/res/app/container-app:0.19.0' = {
module containerAppBackend 'br/public:avm/res/app/container-app:0.22.0' = {
name: take('avm.res.app.container-app.backend.${solutionSuffix}', 64)
#disable-next-line no-unnecessary-dependson
dependsOn: [applicationInsights] // required due to optional flags that could change dependency
Expand Down Expand Up @@ -1088,7 +1086,7 @@ module containerAppBackend 'br/public:avm/res/app/container-app:0.19.0' = {
}
}

module containerAppFrontend 'br/public:avm/res/app/container-app:0.19.0' = {
module containerAppFrontend 'br/public:avm/res/app/container-app:0.22.0' = {
name: take('avm.res.app.container-app.frontend.${solutionSuffix}', 64)
params: {
name: take('ca-frontend-${solutionSuffix}', 32)
Expand Down
16 changes: 8 additions & 8 deletions infra/modules/ai-foundry/ai-services.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
// This module is here solely to provide network injection for Cognitive Services.
// The AVM Module 'br/public:avm/res/cognitive-services/account:0.11.0' does not support that feature as of version 0.11.0
// The AVM Module 'br/public:avm/res/cognitive-services/account:0.14.2' does not support that feature as of version 0.11.0
Comment thread
Pavan-Microsoft marked this conversation as resolved.
Outdated
metadata name = 'Cognitive Services'
metadata description = 'This module deploys a Cognitive Service.'

Expand Down Expand Up @@ -60,7 +60,7 @@ param sku string = 'S0'
@description('Optional. Location for all Resources.')
param location string = resourceGroup().location

import { diagnosticSettingFullType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
import { diagnosticSettingFullType } from 'br/public:avm/utl/types/avm-common-types:0.7.0'
@description('Optional. The diagnostic settings of the service.')
param diagnosticSettings diagnosticSettingFullType[]?

Expand All @@ -80,11 +80,11 @@ param networkAcls object?
@description('Optional. The network injection subnet resource Id for the Cognitive Services account. This allows to use the AI Services account with a virtual network.')
param networkInjectionSubnetResourceId string?

import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.7.0'
@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
param privateEndpoints privateEndpointSingleServiceType[]?

import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.7.0'
@description('Optional. Array of role assignments to create.')
param roleAssignments roleAssignmentType[]?

Expand Down Expand Up @@ -116,7 +116,7 @@ param restrictOutboundNetworkAccess bool = true
@description('Optional. The storage accounts for this resource.')
param userOwnedStorage array?

import { managedIdentityAllType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
import { managedIdentityAllType } from 'br/public:avm/utl/types/avm-common-types:0.7.0'
@description('Optional. The managed identity definition for this resource.')
param managedIdentities managedIdentityAllType?

Expand Down Expand Up @@ -260,7 +260,7 @@ var formattedRoleAssignments = [
})
]

resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-07-01-preview' = {
resource cognitiveService 'Microsoft.CognitiveServices/accounts@2026-03-01' = {
name: name
kind: kind
identity: identity
Expand Down Expand Up @@ -306,7 +306,7 @@ resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-07-01-previ
}

@batchSize(1)
resource cognitiveService_deployments 'Microsoft.CognitiveServices/accounts/deployments@2024-10-01' = [
resource cognitiveService_deployments 'Microsoft.CognitiveServices/accounts/deployments@2026-03-01' = [
for (deployment, index) in (deployments ?? []): {
parent: cognitiveService
name: deployment.?name ?? '${name}-deployments'
Expand Down Expand Up @@ -355,7 +355,7 @@ resource cognitiveService_diagnosticSettings 'Microsoft.Insights/diagnosticSetti
}
]

module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.1' = [
module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.12.0' = [
for (privateEndpoint, index) in (privateEndpoints ?? []): {
name: take('${uniqueString(deployment().name, location)}-cognitiveService-PrivateEndpoint-${index}', 64)
scope: resourceGroup(
Expand Down
Loading
Loading