Skip to content

Commit 53f02d3

Browse files
brittneekbrittneek
committed
keyvault and managed identity
1 parent f0086a5 commit 53f02d3

4 files changed

Lines changed: 126 additions & 15 deletions

File tree

‎infra/main.bicep‎

Lines changed: 28 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ var container_app_deployment container_app_deployment_info_type = {
8585
var abbrs = loadJsonContent('./abbreviations.json')
8686

8787
// ========== Managed Identity ========== //
88-
module avmManagedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.4.1' = {
88+
module avmManagedIdentity './modules/managed-identity.bicep' = {
8989
name: format(deployment_param.resource_name_format_string, abbrs.security.managedIdentity)
9090
params: {
9191
name: '${abbrs.security.managedIdentity}${deployment_param.solution_prefix}'
@@ -120,23 +120,36 @@ module bicepOwnerRoleAssignment 'modules/role_assignment.bicep' = {
120120
// }
121121

122122
// ========== Key Vault Module ========== //
123-
module avmKeyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
124-
name: format(deployment_param.resource_name_format_string, abbrs.security.keyVault)
123+
module avmKeyVault './modules/key-vault.bicep' = {
124+
//name: format(deployment_param.resource_name_format_string, abbrs.security.keyVault)
125125
params: {
126-
name: '${abbrs.security.keyVault}${deployment_param.solution_prefix}'
127-
location: deployment_param.resource_group_location
128-
tags: {
129-
app: deployment_param.solution_prefix
126+
name: format(deployment_param.resource_name_format_string, abbrs.security.keyVault)
127+
keyVaultParams: {
128+
name: '${abbrs.security.keyVault}${deployment_param.solution_prefix}'
130129
location: deployment_param.resource_group_location
131-
}
132-
roleAssignments: [
133-
{
134-
principalId: avmManagedIdentity.outputs.principalId
135-
roleDefinitionIdOrName: 'Key Vault Administrator'
130+
tags: {
131+
app: deployment_param.solution_prefix
132+
location: deployment_param.resource_group_location
136133
}
137-
]
138-
enablePurgeProtection: false
139-
enableSoftDelete: true
134+
roleAssignments: [
135+
{
136+
principalId: avmManagedIdentity.outputs.principalId
137+
roleDefinitionIdOrName: 'Key Vault Administrator'
138+
}
139+
]
140+
enablePurgeProtection: false
141+
enableSoftDelete: true
142+
publicNetworkAccess: 'Enabled'
143+
keyvaultsku: 'standard'
144+
// Add missing AVM parameters for parity with classic resource
145+
enableRbacAuthorization: true
146+
createMode: 'default'
147+
enableTelemetry: false
148+
// networkAcls, privateEndpoints, diagnosticSettings, keys, secrets, lock can be added if needed
149+
enableVaultForDiskEncryption: true
150+
enableVaultForTemplateDeployment: true
151+
softDeleteRetentionInDays: 7
152+
}
140153
}
141154
scope: resourceGroup(resourceGroup().name)
142155
}

‎infra/modules/key-vault.bicep‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
// ========== Key Vault Module ========== //
2+
// param name string
3+
// param location string
4+
// param tags object
5+
// param roleAssignments array = []
6+
// param enablePurgeProtection bool = false
7+
// param enableSoftDelete bool = true
8+
// param enableVaultForDiskEncryption bool = true
9+
// param enableVaultForTemplateDeployment bool = true
10+
// param publicNetworkAccess string = 'Enabled'
11+
// param vaultsku string = 'standard'
12+
// param softDeleteRetentionInDays int = 7
13+
// param enableRbacAuthorization bool = true
14+
// param createMode string = 'default'
15+
// param enableTelemetry bool = true
16+
17+
import {
18+
key_vault_param_type
19+
} from './types.bicep'
20+
21+
param keyVaultParams key_vault_param_type
22+
param name string
23+
24+
module avmKeyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
25+
name: name
26+
params: {
27+
name: keyVaultParams.name
28+
location: keyVaultParams.location
29+
tags: keyVaultParams.tags
30+
roleAssignments: keyVaultParams.roleAssignments
31+
enablePurgeProtection: keyVaultParams.enablePurgeProtection
32+
enableSoftDelete: keyVaultParams.enableSoftDelete
33+
enableVaultForDiskEncryption : keyVaultParams.enableVaultForDiskEncryption
34+
enableVaultForTemplateDeployment: keyVaultParams.enableVaultForTemplateDeployment
35+
publicNetworkAccess: keyVaultParams.publicNetworkAccess
36+
sku: keyVaultParams.keyvaultsku
37+
softDeleteRetentionInDays: keyVaultParams.softDeleteRetentionInDays
38+
enableRbacAuthorization: keyVaultParams.enableRbacAuthorization
39+
createMode: keyVaultParams.createMode
40+
enableTelemetry: keyVaultParams.enableTelemetry
41+
42+
}
43+
}
44+
45+
output resourceId string = avmKeyVault.outputs.resourceId
46+
output vaultUri string = avmKeyVault.outputs.uri

‎infra/modules/managed-identity.bicep‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
// ========== Managed Identity ========== //
2+
param name string
3+
param location string
4+
param tags object
5+
6+
module avmManagedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.4.1' = {
7+
name: name
8+
params: {
9+
name: name
10+
location: location
11+
tags: tags
12+
}
13+
}
14+
15+
output resourceId string = avmManagedIdentity.outputs.resourceId
16+
output principalId string = avmManagedIdentity.outputs.principalId

‎infra/modules/types.bicep‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,39 @@ type container_app_deployment_info_type = {
6464

6565
@export()
6666
func make_solution_prefix(unique_id string) string => 'cps-${padLeft(take(unique_id, 12), 12, '0')}'
67+
68+
type keyvault_sku_type = 'standard' | 'premium'
69+
70+
type keyvault_public_network_access_type = 'Disabled' | 'Enabled'
71+
72+
@export()
73+
type key_vault_param_type = {
74+
@description('Name of the Key Vault')
75+
name: string
76+
@description('Location of the Key Vault')
77+
location: string
78+
@description('Tags for the Key Vault')
79+
tags: object
80+
@description('Role assignments for the Key Vault')
81+
roleAssignments: array
82+
@description('Enable purge protection for the Key Vault')
83+
enablePurgeProtection: bool
84+
@description('Enable soft delete for the Key Vault')
85+
enableSoftDelete: bool
86+
@description('Enable vault for disk encryption')
87+
enableVaultForDiskEncryption: bool
88+
@description('Enable vault for template deployment')
89+
enableVaultForTemplateDeployment: bool
90+
@description('Public network access setting for the Key Vault')
91+
publicNetworkAccess: keyvault_public_network_access_type
92+
@description('SKU of the Key Vault')
93+
keyvaultsku: keyvault_sku_type
94+
@description('Soft delete retention period in days')
95+
softDeleteRetentionInDays: int
96+
@description('Enable RBAC authorization for the Key Vault')
97+
enableRbacAuthorization: bool
98+
@description('Create mode for the Key Vault')
99+
createMode: string
100+
@description('Enable telemetry for the Key Vault')
101+
enableTelemetry: bool
102+
}

0 commit comments

Comments
 (0)