Skip to content

Commit fce1964

Browse files
brittneekbrittneek
authored
Merge pull request #144 from microsoft/feature-avm-bk
Feature avm bk
2 parents 70f2ea7 + efd9aba commit fce1964

4 files changed

Lines changed: 125 additions & 15 deletions

File tree

‎infra/main.bicep‎

Lines changed: 27 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ var container_app_deployment container_app_deployment_info_type = {
9393
var abbrs = loadJsonContent('./abbreviations.json')
9494

9595
// ========== Managed Identity ========== //
96-
module avmManagedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.4.1' = {
96+
module avmManagedIdentity './modules/managed-identity.bicep' = {
9797
name: format(deployment_param.resource_name_format_string, abbrs.security.managedIdentity)
9898
params: {
9999
name: '${abbrs.security.managedIdentity}${deployment_param.solution_prefix}'
@@ -128,24 +128,36 @@ module bicepOwnerRoleAssignment 'modules/role_assignment.bicep' = {
128128
// }
129129

130130
// ========== Key Vault Module ========== //
131-
module avmKeyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
131+
module avmKeyVault './modules/key-vault.bicep' = {
132132
name: format(deployment_param.resource_name_format_string, abbrs.security.keyVault)
133133
params: {
134-
name: '${abbrs.security.keyVault}${deployment_param.solution_prefix}'
135-
location: deployment_param.resource_group_location
136-
tags: {
137-
app: deployment_param.solution_prefix
134+
name: format(deployment_param.resource_name_format_string, abbrs.security.keyVault)
135+
keyVaultParams: {
136+
name: '${abbrs.security.keyVault}${deployment_param.solution_prefix}'
138137
location: deployment_param.resource_group_location
139-
}
140-
roleAssignments: [
141-
{
142-
principalId: avmManagedIdentity.outputs.principalId
143-
roleDefinitionIdOrName: 'Key Vault Administrator'
138+
tags: {
139+
app: deployment_param.solution_prefix
140+
location: deployment_param.resource_group_location
144141
}
145-
]
146-
enablePurgeProtection: false
147-
enableSoftDelete: true
148-
enableRbacAuthorization: true
142+
roleAssignments: [
143+
{
144+
principalId: avmManagedIdentity.outputs.principalId
145+
roleDefinitionIdOrName: 'Key Vault Administrator'
146+
}
147+
]
148+
enablePurgeProtection: false
149+
enableSoftDelete: true
150+
publicNetworkAccess: 'Enabled'
151+
keyvaultsku: 'standard'
152+
// Add missing AVM parameters for parity with classic resource
153+
enableRbacAuthorization: true
154+
createMode: 'default'
155+
enableTelemetry: false
156+
// networkAcls, privateEndpoints, diagnosticSettings, keys, secrets, lock can be added if needed
157+
enableVaultForDiskEncryption: true
158+
enableVaultForTemplateDeployment: true
159+
softDeleteRetentionInDays: 7
160+
}
149161
}
150162
scope: resourceGroup(resourceGroup().name)
151163
}

‎infra/modules/key-vault.bicep‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
metadata name = 'Key Vault Module'
2+
// ========== Key Vault Module ========== //
3+
// param name string
4+
// param location string
5+
// param tags object
6+
// param roleAssignments array = []
7+
// param enablePurgeProtection bool = false
8+
// param enableSoftDelete bool = true
9+
// param enableVaultForDiskEncryption bool = true
10+
// param enableVaultForTemplateDeployment bool = true
11+
// param publicNetworkAccess string = 'Enabled'
12+
// param vaultsku string = 'standard'
13+
// param softDeleteRetentionInDays int = 7
14+
// param enableRbacAuthorization bool = true
15+
// param createMode string = 'default'
16+
// param enableTelemetry bool = true
17+
18+
import {
19+
key_vault_param_type
20+
} from './types.bicep'
21+
22+
param keyVaultParams key_vault_param_type
23+
param name string
24+
25+
module avmKeyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
26+
name: name
27+
params: {
28+
name: keyVaultParams.name
29+
location: keyVaultParams.location
30+
tags: keyVaultParams.tags
31+
roleAssignments: keyVaultParams.roleAssignments
32+
enablePurgeProtection: keyVaultParams.enablePurgeProtection
33+
enableSoftDelete: keyVaultParams.enableSoftDelete
34+
enableVaultForDiskEncryption: keyVaultParams.enableVaultForDiskEncryption
35+
enableVaultForTemplateDeployment: keyVaultParams.enableVaultForTemplateDeployment
36+
publicNetworkAccess: keyVaultParams.publicNetworkAccess
37+
sku: keyVaultParams.keyvaultsku
38+
softDeleteRetentionInDays: keyVaultParams.softDeleteRetentionInDays
39+
enableRbacAuthorization: keyVaultParams.enableRbacAuthorization
40+
createMode: keyVaultParams.createMode
41+
enableTelemetry: keyVaultParams.enableTelemetry
42+
}
43+
}
44+
45+
output resourceId string = avmKeyVault.outputs.resourceId
46+
output vaultUri string = avmKeyVault.outputs.uri

‎infra/modules/managed-identity.bicep‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
// ========== Managed Identity ========== //
2+
param name string
3+
param location string
4+
param tags object
5+
6+
module avmManagedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.4.1' = {
7+
name: name
8+
params: {
9+
name: name
10+
location: location
11+
tags: tags
12+
}
13+
}
14+
15+
output resourceId string = avmManagedIdentity.outputs.resourceId
16+
output principalId string = avmManagedIdentity.outputs.principalId

‎infra/modules/types.bicep‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,39 @@ type container_app_deployment_info_type = {
6464

6565
@export()
6666
func make_solution_prefix(unique_id string) string => 'cps-${padLeft(take(unique_id, 12), 12, '0')}'
67+
68+
type keyvault_sku_type = 'standard' | 'premium'
69+
70+
type keyvault_public_network_access_type = 'Disabled' | 'Enabled'
71+
72+
@export()
73+
type key_vault_param_type = {
74+
@description('Name of the Key Vault')
75+
name: string
76+
@description('Location of the Key Vault')
77+
location: string
78+
@description('Tags for the Key Vault')
79+
tags: object
80+
@description('Role assignments for the Key Vault')
81+
roleAssignments: array
82+
@description('Enable purge protection for the Key Vault')
83+
enablePurgeProtection: bool
84+
@description('Enable soft delete for the Key Vault')
85+
enableSoftDelete: bool
86+
@description('Enable vault for disk encryption')
87+
enableVaultForDiskEncryption: bool
88+
@description('Enable vault for template deployment')
89+
enableVaultForTemplateDeployment: bool
90+
@description('Public network access setting for the Key Vault')
91+
publicNetworkAccess: keyvault_public_network_access_type
92+
@description('SKU of the Key Vault')
93+
keyvaultsku: keyvault_sku_type
94+
@description('Soft delete retention period in days')
95+
softDeleteRetentionInDays: int
96+
@description('Enable RBAC authorization for the Key Vault')
97+
enableRbacAuthorization: bool
98+
@description('Create mode for the Key Vault')
99+
createMode: string
100+
@description('Enable telemetry for the Key Vault')
101+
enableTelemetry: bool
102+
}

0 commit comments

Comments
 (0)