Skip to content

Commit 3e1ae25

Browse files
DongbumleeDongbumlee
committed
update main.bicep
1 parent 5571b42 commit 3e1ae25

1 file changed

Lines changed: 102 additions & 48 deletions

File tree

‎infra/main.bicep‎

Lines changed: 102 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ module avmNetworkSecurityGroup_Containers 'br/public:avm/res/network/network-sec
126126
module avmNetworkSecurityGroup_Bastion 'br/public:avm/res/network/network-security-group:0.5.1' = if (deployment_param.enable_waf) {
127127
name: format(
128128
deployment_param.resource_name_format_string,
129-
'${deployment_param.naming_abbrs.networking.networkSecurityGroup}Bastion'
129+
'${deployment_param.naming_abbrs.networking.networkSecurityGroup}bastion'
130130
)
131131
params: {
132132
name: '${deployment_param.naming_abbrs.networking.networkSecurityGroup}${deployment_param.solution_prefix}-bastion'
@@ -225,14 +225,15 @@ module avmPrivateDnsZoneAiServices 'br/public:avm/res/network/private-dns-zone:0
225225
]
226226

227227
// Private DNS Zone for AI foundry Storage Blob
228-
var aiFoundryStoragePrivateDnsZones = {
228+
var storagePrivateDnsZones = {
229229
'privatelink.blob.${environment().suffixes.storage}': 'blob'
230+
'privatelink.queue.${environment().suffixes.storage}': 'queue'
230231
'privatelink.file.${environment().suffixes.storage}': 'file'
231232
}
232233

233-
module avmPrivateDnsZoneAiFoundryStorage 'br/public:avm/res/network/private-dns-zone:0.7.1' = [
234-
for zone in items(aiFoundryStoragePrivateDnsZones): if (deployment_param.enable_waf) {
235-
name: 'private-dns-zone-aifoundry-storage-${zone.value}'
234+
module avmPrivateDnsZoneStorage 'br/public:avm/res/network/private-dns-zone:0.7.1' = [
235+
for zone in items(storagePrivateDnsZones): if (deployment_param.enable_waf) {
236+
name: 'private-dns-zone-storage-${zone.value}'
236237
params: {
237238
name: zone.key
238239
tags: deployment_param.tags
@@ -274,23 +275,23 @@ module avmPrivateDnsZoneCosmosMongoDB 'br/public:avm/res/network/private-dns-zon
274275
}
275276
}
276277

277-
// Private DNS Zone for Application Storage Account
278-
var appStoragePrivateDnsZones = {
279-
'privatelink.blob.${environment().suffixes.storage}': 'blob'
280-
'privatelink.queue.${environment().suffixes.storage}': 'queue'
281-
}
282-
283-
module avmPrivateDnsZonesAppStorage 'br/public:avm/res/network/private-dns-zone:0.7.1' = [
284-
for (zone, i) in items(appStoragePrivateDnsZones): if (deployment_param.enable_waf) {
285-
name: 'private-dns-zone-app-storage-${zone.value}-${i}'
286-
params: {
287-
name: zone.key
288-
tags: deployment_param.tags
289-
enableTelemetry: deployment_param.enable_telemetry
290-
virtualNetworkLinks: [{ virtualNetworkResourceId: avmVirtualNetwork.outputs.resourceId }]
291-
}
292-
}
293-
]
278+
// // Private DNS Zone for Application Storage Account
279+
// var appStoragePrivateDnsZones = {
280+
// 'privatelink.blob.${environment().suffixes.storage}': 'blob'
281+
// 'privatelink.queue.${environment().suffixes.storage}': 'queue'
282+
// }
283+
284+
// module avmPrivateDnsZonesAppStorage 'br/public:avm/res/network/private-dns-zone:0.7.1' = [
285+
// for (zone, i) in items(appStoragePrivateDnsZones): if (deployment_param.enable_waf) {
286+
// name: 'private-dns-zone-app-storage-${zone.value}-${i}'
287+
// params: {
288+
// name: zone.key
289+
// tags: deployment_param.tags
290+
// enableTelemetry: deployment_param.enable_telemetry
291+
// virtualNetworkLinks: [{ virtualNetworkResourceId: avmVirtualNetwork.outputs.resourceId }]
292+
// }
293+
// }
294+
// ]
294295

295296
// Private DNS Zone for App Configuration
296297
var appConfigPrivateDnsZones = {
@@ -515,9 +516,30 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
515516
? [
516517
{
517518
name: 'storage-private-endpoint-blob'
519+
privateDnsZoneGroup: {
520+
privateDnsZoneGroupConfigs: [
521+
{
522+
name: 'storage-dns-zone-group-blob'
523+
privateDnsZoneResourceId: avmPrivateDnsZoneStorage[0].outputs.resourceId
524+
}
525+
]
526+
}
518527
subnetResourceId: avmVirtualNetwork.outputs.subnetResourceIds[0] // Use the backend subnet
519528
service: 'blob'
520529
}
530+
{
531+
name: 'storage-private-endpoint-queue'
532+
privateDnsZoneGroup: {
533+
privateDnsZoneGroupConfigs: [
534+
{
535+
name: 'storage-dns-zone-group-queue'
536+
privateDnsZoneResourceId: avmPrivateDnsZoneStorage[1].outputs.resourceId
537+
}
538+
]
539+
}
540+
subnetResourceId: avmVirtualNetwork.outputs.subnetResourceIds[0] // Use the backend subnet
541+
service: 'queue'
542+
}
521543
]
522544
: []
523545

@@ -775,21 +797,21 @@ module avmAiServices_storage_hub 'br/public:avm/res/storage/storage-account:0.20
775797
privateDnsZoneGroupConfigs: [
776798
{
777799
name: 'aistoragehub-dns-zone-blob'
778-
privateDnsZoneResourceId: avmPrivateDnsZonesAppStorage[0].outputs.resourceId
800+
privateDnsZoneResourceId: avmPrivateDnsZoneStorage[0].outputs.resourceId
779801
}
780802
]
781803
}
782804
subnetResourceId: avmVirtualNetwork.outputs.subnetResourceIds[0] // Use the backend subnet
783805
}
784806
{
785-
name: 'aistoragehub-private-endpoint-queue'
807+
name: 'aistoragehub-private-endpoint-file'
786808
privateEndpointResourceId: avmVirtualNetwork.outputs.resourceId
787-
service: 'queue'
809+
service: 'file'
788810
privateDnsZoneGroup: {
789811
privateDnsZoneGroupConfigs: [
790812
{
791-
name: 'aistoragehub-dns-zone-queue'
792-
privateDnsZoneResourceId: avmPrivateDnsZonesAppStorage[1].outputs.resourceId
813+
name: 'aistoragehub-dns-zone-file'
814+
privateDnsZoneResourceId: avmPrivateDnsZoneStorage[2].outputs.resourceId
793815
}
794816
]
795817
}
@@ -908,10 +930,10 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.11.1' = {
908930
publicNetworkAccess: 'Enabled'
909931

910932
// <========== WAF related parameters
911-
// infrastructureSubnetResourceId: (deployment_param.enable_waf)
912-
// ? avmVirtualNetwork.outputs.subnetResourceIds[1]
913-
// : null // Use the container app subnet
914-
zoneRedundant: (deployment_param.enable_waf) ? true : false
933+
zoneRedundant: (deployment_param.enable_waf) ? false : true
934+
infrastructureSubnetResourceId: (deployment_param.enable_waf)
935+
? avmVirtualNetwork.outputs.subnetResourceIds[1] // Use the container app subnet
936+
: null // Use the container app subnet
915937
}
916938
}
917939

@@ -1338,26 +1360,58 @@ module avmAppConfig 'br/public:avm/res/app-configuration/configuration-store:0.6
13381360
}
13391361
]
13401362

1363+
publicNetworkAccess: 'Enabled' // Always enabled for App Configuration
13411364
// WAF related parameters
1342-
publicNetworkAccess: (deployment_param.enable_waf) ? 'Disabled' : 'Enabled'
1343-
privateEndpoints: (deployment_param.enable_waf)
1344-
? [
1345-
{
1346-
name: 'appconfig-private-endpoint'
1347-
privateEndpointResourceId: avmVirtualNetwork.outputs.resourceId
1348-
privateDnsZoneGroup: {
1349-
privateDnsZoneGroupConfigs: [
1350-
{
1351-
name: 'appconfig-dns-zone-group'
1352-
privateDnsZoneResourceId: avmPrivateDnsZoneAppConfig.outputs.resourceId
1353-
}
1354-
]
1365+
// publicNetworkAccess: (deployment_param.enable_waf) ? 'Disabled' : 'Enabled'
1366+
// privateEndpoints: (deployment_param.enable_waf)
1367+
// ? [
1368+
// {
1369+
// name: 'appconfig-private-endpoint'
1370+
// privateEndpointResourceId: avmVirtualNetwork.outputs.resourceId
1371+
// privateDnsZoneGroup: {
1372+
// privateDnsZoneGroupConfigs: [
1373+
// {
1374+
// name: 'appconfig-dns-zone-group'
1375+
// privateDnsZoneResourceId: avmPrivateDnsZoneAppConfig.outputs.resourceId
1376+
// }
1377+
// ]
1378+
// }
1379+
// subnetResourceId: avmVirtualNetwork.outputs.subnetResourceIds[0] // Use the backend subnet
1380+
// }
1381+
// ]
1382+
// : []
1383+
}
1384+
}
1385+
1386+
module avmAppConfig_update 'br/public:avm/res/app-configuration/configuration-store:0.6.3' = if (deployment_param.enable_waf) {
1387+
name: format(
1388+
deployment_param.resource_name_format_string,
1389+
'${deployment_param.naming_abbrs.developerTools.appConfigurationStore}-update'
1390+
)
1391+
params: {
1392+
name: '${deployment_param.naming_abbrs.developerTools.appConfigurationStore}${deployment_param.solution_prefix}'
1393+
location: deployment_param.resource_group_location
1394+
1395+
publicNetworkAccess: 'Disabled'
1396+
privateEndpoints: [
1397+
{
1398+
name: 'appconfig-private-endpoint'
1399+
privateDnsZoneGroup: {
1400+
privateDnsZoneGroupConfigs: [
1401+
{
1402+
name: 'appconfig-dns-zone-group'
1403+
privateDnsZoneResourceId: avmPrivateDnsZoneAppConfig.outputs.resourceId
13551404
}
1356-
subnetResourceId: avmVirtualNetwork.outputs.subnetResourceIds[0] // Use the backend subnet
1357-
}
1358-
]
1359-
: []
1405+
]
1406+
}
1407+
subnetResourceId: avmVirtualNetwork.outputs.subnetResourceIds[0] // Use the backend subnet
1408+
}
1409+
]
13601410
}
1411+
1412+
dependsOn: [
1413+
avmAppConfig
1414+
]
13611415
}
13621416

13631417
module avmRoleAssignment_container_app 'br/public:avm/ptn/authorization/resource-role-assignment:0.1.2' = {

0 commit comments

Comments
 (0)