-
Notifications
You must be signed in to change notification settings - Fork 454
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Modules] Updated App Configuration Module to use the latest APIs and…
… added support for CMK (#4105) * [Modules] Updated App Configuration Module API Version and added CMK * Updated Tests * Updated * Updated module
- Loading branch information
1 parent
9f9e380
commit 07ba69c
Showing
12 changed files
with
451 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
modules/app-configuration/configuration-store/.test/encr/dependencies.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| @description('Required. The name of the managed identity to create.') | ||
| param managedIdentityName string | ||
|
|
||
| @description('Required. The name of the Key Vault to create.') | ||
| param keyVaultName string | ||
|
|
||
| @description('Optional. The location to deploy resources to.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { | ||
| name: managedIdentityName | ||
| location: location | ||
| } | ||
|
|
||
| resource keyVault 'Microsoft.KeyVault/vaults@2023-02-01' = { | ||
| name: keyVaultName | ||
| location: location | ||
| properties: { | ||
| sku: { | ||
| family: 'A' | ||
| name: 'standard' | ||
| } | ||
| tenantId: tenant().tenantId | ||
| enablePurgeProtection: true | ||
| softDeleteRetentionInDays: 90 | ||
| enabledForTemplateDeployment: true | ||
| enabledForDiskEncryption: true | ||
| enabledForDeployment: true | ||
| enableRbacAuthorization: true | ||
| accessPolicies: [] | ||
| } | ||
|
|
||
| resource key 'keys@2023-02-01' = { | ||
| name: 'keyEncryptionKey' | ||
| properties: { | ||
| kty: 'RSA' | ||
| } | ||
| } | ||
| } | ||
|
|
||
| resource keyPermissions 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| name: guid('msi-${keyVault::key.id}-${location}-${managedIdentity.id}-Key-Reader-RoleAssignment') | ||
| scope: keyVault::key | ||
| properties: { | ||
| principalId: managedIdentity.properties.principalId | ||
| roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424') // Key Vault Crypto User | ||
| principalType: 'ServicePrincipal' | ||
| } | ||
| } | ||
|
|
||
| @description('The principal ID of the created managed identity.') | ||
| output managedIdentityPrincipalId string = managedIdentity.properties.principalId | ||
|
|
||
| @description('The resource ID of the created Managed Identity.') | ||
| output managedIdentityResourceId string = managedIdentity.id | ||
|
|
||
| @description('The resource ID of the created Key Vault.') | ||
| output keyVaultResourceId string = keyVault.id | ||
|
|
||
| @description('The name of the created encryption key.') | ||
| output keyName string = keyVault::key.name |
98 changes: 98 additions & 0 deletions
98
modules/app-configuration/configuration-store/.test/encr/main.test.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| targetScope = 'subscription' | ||
|
|
||
| // ========== // | ||
| // Parameters // | ||
| // ========== // | ||
|
|
||
| @description('Optional. The name of the resource group to deploy for testing purposes.') | ||
| @maxLength(90) | ||
| param resourceGroupName string = 'dep-${namePrefix}-appconfiguration.configurationstores-${serviceShort}-rg' | ||
|
|
||
| @description('Optional. The location to deploy resources to.') | ||
| param location string = deployment().location | ||
|
|
||
| @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') | ||
| param serviceShort string = 'accencr' | ||
|
|
||
| @description('Optional. Enable telemetry via a Globally Unique Identifier (GUID).') | ||
| param enableDefaultTelemetry bool = true | ||
|
|
||
| @description('Generated. Used as a basis for unique resource names.') | ||
| param baseTime string = utcNow('u') | ||
|
|
||
| @description('Optional. A token to inject into the name of each resource.') | ||
| param namePrefix string = '[[namePrefix]]' | ||
|
|
||
| // ============ // | ||
| // Dependencies // | ||
| // ============ // | ||
|
|
||
| // General resources | ||
| // ================= | ||
| resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { | ||
| name: resourceGroupName | ||
| location: location | ||
| } | ||
|
|
||
| module nestedDependencies 'dependencies.bicep' = { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, location)}-nestedDependencies' | ||
| params: { | ||
| // Adding base time to make the name unique as purge protection must be enabled (but may not be longer than 24 characters total) | ||
| keyVaultName: 'dep-${namePrefix}-kv-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}' | ||
| managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}' | ||
| } | ||
| } | ||
|
|
||
| // ============== // | ||
| // Test Execution // | ||
| // ============== // | ||
|
|
||
| module testDeployment '../../main.bicep' = { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, location)}-test-${serviceShort}' | ||
| params: { | ||
| enableDefaultTelemetry: enableDefaultTelemetry | ||
| name: '${namePrefix}${serviceShort}001' | ||
| createMode: 'Default' | ||
| disableLocalAuth: false | ||
| enablePurgeProtection: false | ||
| keyValues: [ | ||
| { | ||
| contentType: 'contentType' | ||
| name: 'keyName' | ||
| roleAssignments: [ | ||
| { | ||
| roleDefinitionIdOrName: 'Reader' | ||
| principalIds: [ | ||
| nestedDependencies.outputs.managedIdentityPrincipalId | ||
| ] | ||
| principalType: 'ServicePrincipal' | ||
| } | ||
| ] | ||
| value: 'valueName' | ||
| } | ||
| ] | ||
| roleAssignments: [ | ||
| { | ||
| roleDefinitionIdOrName: 'Reader' | ||
| principalIds: [ | ||
| nestedDependencies.outputs.managedIdentityPrincipalId | ||
| ] | ||
| principalType: 'ServicePrincipal' | ||
| } | ||
| ] | ||
| softDeleteRetentionInDays: 1 | ||
| userAssignedIdentities: { | ||
| '${nestedDependencies.outputs.managedIdentityResourceId}': {} | ||
| } | ||
| tags: { | ||
| 'hidden-title': 'This is visible in the resource name' | ||
| Environment: 'Non-Prod' | ||
| Role: 'DeploymentValidation' | ||
| } | ||
| cMKKeyVaultResourceId: nestedDependencies.outputs.keyVaultResourceId | ||
| cMKKeyName: nestedDependencies.outputs.keyName | ||
| cMKUserAssignedIdentityResourceId: nestedDependencies.outputs.managedIdentityResourceId | ||
| } | ||
| } |
Oops, something went wrong.