-
Notifications
You must be signed in to change notification settings - Fork 376
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
7e8e250
commit dddfee2
Showing
15 changed files
with
1,248 additions
and
834 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
Large diffs are not rendered by default.
Oops, something went wrong.
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,33 +1,19 @@ | ||
| provider microsoftGraph | ||
|
|
||
| @description('Required. The location to deploy resources to.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| @description('Required. The name of the Azure AD group to create.') | ||
| param entraIdGroupName string | ||
|
|
||
| @description('Required. The name of the managed identity to create.') | ||
| param managedIdentityName string | ||
|
|
||
| var entraIdGroupmailNickname = replace(entraIdGroupName, ' ', '') | ||
|
|
||
| resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = { | ||
| name: managedIdentityName | ||
| location: location | ||
| } | ||
|
|
||
| resource entraIdGroup 'Microsoft.Graph/[email protected]' = { | ||
| displayName: entraIdGroupName | ||
| mailEnabled: false | ||
| mailNickname: entraIdGroupmailNickname | ||
| securityEnabled: true | ||
| uniqueName: entraIdGroupName | ||
| } | ||
|
|
||
| @description('The resource ID of the created Managed Identity.') | ||
| output managedIdentityResourceId string = managedIdentity.id | ||
|
|
||
| @description('The principal ID of the created Managed Identity.') | ||
| output managedIdentityPrincipalId string = managedIdentity.properties.principalId | ||
|
|
||
| output entraIdGroupDisplayName string = entraIdGroup.displayName | ||
| @description('The client ID of the created Managed Identity.') | ||
| output managedIdentityClientId string = managedIdentity.properties.clientId |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
68 changes: 68 additions & 0 deletions
68
avm/res/kusto/cluster/tests/e2e/system-assigned-cmk-encryption/dependencies.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| @description('Required. The name of the Key Vault to create.') | ||
| param keyVaultName string | ||
|
|
||
| @description('Required. The name of the Kusto Cluster to create.') | ||
| param kustoClusterName string | ||
|
|
||
| @description('Optional. The location to deploy resources to.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| resource kustoCluster 'Microsoft.Kusto/clusters@2023-08-15' = { | ||
| name: kustoClusterName | ||
| location: location | ||
| sku: { | ||
| name: 'Standard_E2ads_v5' | ||
| tier: 'Standard' | ||
| } | ||
| identity: { | ||
| type: 'SystemAssigned' | ||
| } | ||
| } | ||
|
|
||
| resource keyVault 'Microsoft.KeyVault/vaults@2023-02-01' = { | ||
| name: keyVaultName | ||
| location: location | ||
| properties: { | ||
| sku: { | ||
| family: 'A' | ||
| name: 'standard' | ||
| } | ||
| tenantId: tenant().tenantId | ||
| enablePurgeProtection: true // Required for encryption to work | ||
| softDeleteRetentionInDays: 7 | ||
| enabledForTemplateDeployment: true | ||
| enabledForDiskEncryption: true | ||
| enabledForDeployment: true | ||
| enableRbacAuthorization: true | ||
| accessPolicies: [] | ||
| } | ||
|
|
||
| resource key 'keys@2023-02-01' = { | ||
| name: 'keyEncryptionKey' | ||
| properties: { | ||
| kty: 'RSA' | ||
| } | ||
| } | ||
| } | ||
|
|
||
| resource keyPermissions 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| name: guid('msi-${keyVault::key.id}-${location}-${kustoCluster.id}-Key-Reader-RoleAssignment') | ||
| scope: keyVault::key | ||
| properties: { | ||
| principalId: kustoCluster.identity.principalId | ||
| roleDefinitionId: subscriptionResourceId( | ||
| 'Microsoft.Authorization/roleDefinitions', | ||
| '12338af0-0e69-4776-bea7-57ae8d297424' | ||
| ) // Key Vault Crypto User | ||
| principalType: 'ServicePrincipal' | ||
| } | ||
| } | ||
|
|
||
| @description('The name of the created Kusto Cluster.') | ||
| output kustoClusterName string = kustoCluster.name | ||
|
|
||
| @description('The resource ID of the created Key Vault.') | ||
| output keyVaultResourceId string = keyVault.id | ||
|
|
||
| @description('The name of the created encryption key.') | ||
| output keyName string = keyVault::key.name |
66 changes: 66 additions & 0 deletions
66
avm/res/kusto/cluster/tests/e2e/system-assigned-cmk-encryption/main.test.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| targetScope = 'subscription' | ||
|
|
||
| metadata name = 'Using Customer-Managed-Keys with System-Assigned identity' | ||
| metadata description = 'This instance deploys the module using Customer-Managed-Keys using a System-Assigned Identity. This required the service to be deployed twice, once as a pre-requisite to create the System-Assigned Identity, and once to use it for accessing the Customer-Managed-Key secret.' | ||
|
|
||
| // ========== // | ||
| // Parameters // | ||
| // ========== // | ||
|
|
||
| @description('Optional. The name of the resource group to deploy for testing purposes.') | ||
| @maxLength(90) | ||
| param resourceGroupName string = 'dep-${namePrefix}-kusto.clusters-${serviceShort}-rg' | ||
|
|
||
| @description('Optional. The location to deploy resources to.') | ||
| param resourceLocation string = deployment().location | ||
|
|
||
| @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') | ||
| param serviceShort string = 'kcsencr' | ||
|
|
||
| @description('Optional. A token to inject into the name of each resource.') | ||
| param namePrefix string = '#_namePrefix_#' | ||
|
|
||
| @description('Generated. Used as a basis for unique resource names.') | ||
| param baseTime string = utcNow('u') | ||
|
|
||
| // ============ // | ||
| // Dependencies // | ||
| // ============ // | ||
|
|
||
| // General resources | ||
| // ================= | ||
| resource resourceGroup 'Microsoft.Resources/resourceGroups@2024-03-01' = { | ||
| name: resourceGroupName | ||
| location: resourceLocation | ||
| } | ||
|
|
||
| module nestedDependencies 'dependencies.bicep' = { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies' | ||
| params: { | ||
| // Adding base time to make the name unique as purge protection must be enabled (but may not be longer than 24 characters total) | ||
| keyVaultName: 'dep-${namePrefix}-kv-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}' | ||
| kustoClusterName: '${namePrefix}${serviceShort}001' | ||
| location: resourceLocation | ||
| } | ||
| } | ||
|
|
||
| // ============== // | ||
| // Test Execution // | ||
| // ============== // | ||
|
|
||
| @batchSize(1) | ||
| module testDeployment '../../../main.bicep' = [ | ||
| for iteration in ['init', 'idem']: { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}' | ||
| params: { | ||
| name: nestedDependencies.outputs.kustoClusterName | ||
| sku: 'Standard_E2ads_v5' | ||
| customerManagedKey: { | ||
| keyName: nestedDependencies.outputs.keyName | ||
| keyVaultResourceId: nestedDependencies.outputs.keyVaultResourceId | ||
| } | ||
| } | ||
| } | ||
| ] |
64 changes: 64 additions & 0 deletions
64
avm/res/kusto/cluster/tests/e2e/user-assigned-cmk-encryption/dependencies.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| @description('Required. The name of the Key Vault to create.') | ||
| param keyVaultName string | ||
|
|
||
| @description('Required. The name of the Managed Identity to create.') | ||
| param managedIdentityName string | ||
|
|
||
| @description('Optional. The location to deploy resources to.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { | ||
| name: managedIdentityName | ||
| location: location | ||
| } | ||
|
|
||
| resource keyVault 'Microsoft.KeyVault/vaults@2023-02-01' = { | ||
| name: keyVaultName | ||
| location: location | ||
| properties: { | ||
| sku: { | ||
| family: 'A' | ||
| name: 'standard' | ||
| } | ||
| tenantId: tenant().tenantId | ||
| enablePurgeProtection: true // Required for encryption to work | ||
| softDeleteRetentionInDays: 7 | ||
| enabledForTemplateDeployment: true | ||
| enabledForDiskEncryption: true | ||
| enabledForDeployment: true | ||
| enableRbacAuthorization: true | ||
| accessPolicies: [] | ||
| } | ||
|
|
||
| resource key 'keys@2023-02-01' = { | ||
| name: 'keyEncryptionKey' | ||
| properties: { | ||
| kty: 'RSA' | ||
| } | ||
| } | ||
| } | ||
|
|
||
| resource keyPermissions 'Microsoft.Authorization/roleAssignments@2022-04-01' = { | ||
| name: guid('msi-${keyVault::key.id}-${location}-${managedIdentity.id}-Key-Reader-RoleAssignment') | ||
| scope: keyVault::key | ||
| properties: { | ||
| principalId: managedIdentity.properties.principalId | ||
| roleDefinitionId: subscriptionResourceId( | ||
| 'Microsoft.Authorization/roleDefinitions', | ||
| '12338af0-0e69-4776-bea7-57ae8d297424' | ||
| ) // Key Vault Crypto User | ||
| principalType: 'ServicePrincipal' | ||
| } | ||
| } | ||
|
|
||
| @description('The resource ID of the created Managed Identity.') | ||
| output managedIdentityResourceId string = managedIdentity.id | ||
|
|
||
| @description('The client ID of the created Managed Identity.') | ||
| output managedIdentityClientId string = managedIdentity.properties.clientId | ||
|
|
||
| @description('The resource ID of the created Key Vault.') | ||
| output keyVaultResourceId string = keyVault.id | ||
|
|
||
| @description('The name of the created encryption key.') | ||
| output keyName string = keyVault::key.name |
72 changes: 72 additions & 0 deletions
72
avm/res/kusto/cluster/tests/e2e/user-assigned-cmk-encryption/main.test.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| targetScope = 'subscription' | ||
|
|
||
| metadata name = 'Using Customer-Managed-Keys with User-Assigned identity' | ||
| metadata description = 'This instance deploys the module using Customer-Managed-Keys using a User-Assigned Identity to access the Customer-Managed-Key secret.' | ||
|
|
||
| // ========== // | ||
| // Parameters // | ||
| // ========== // | ||
|
|
||
| @description('Optional. The name of the resource group to deploy for testing purposes.') | ||
| @maxLength(90) | ||
| param resourceGroupName string = 'dep-${namePrefix}-kusto.clusters-${serviceShort}-rg' | ||
|
|
||
| @description('Optional. The location to deploy resources to.') | ||
| param resourceLocation string = deployment().location | ||
|
|
||
| @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') | ||
| param serviceShort string = 'kcuencr' | ||
|
|
||
| @description('Optional. A token to inject into the name of each resource.') | ||
| param namePrefix string = '#_namePrefix_#' | ||
|
|
||
| @description('Generated. Used as a basis for unique resource names.') | ||
| param baseTime string = utcNow('u') | ||
|
|
||
| // ============ // | ||
| // Dependencies // | ||
| // ============ // | ||
|
|
||
| // General resources | ||
| // ================= | ||
| resource resourceGroup 'Microsoft.Resources/resourceGroups@2024-03-01' = { | ||
| name: resourceGroupName | ||
| location: resourceLocation | ||
| } | ||
|
|
||
| module nestedDependencies 'dependencies.bicep' = { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies' | ||
| params: { | ||
| // Adding base time to make the name unique as purge protection must be enabled (but may not be longer than 24 characters total) | ||
| keyVaultName: 'dep-${namePrefix}-kv-${serviceShort}-${substring(uniqueString(baseTime), 0, 3)}' | ||
| managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}' | ||
| location: resourceLocation | ||
| } | ||
| } | ||
|
|
||
| // ============== // | ||
| // Test Execution // | ||
| // ============== // | ||
|
|
||
| @batchSize(1) | ||
| module testDeployment '../../../main.bicep' = [ | ||
| for iteration in ['init', 'idem']: { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}' | ||
| params: { | ||
| name: '${namePrefix}${serviceShort}0001' | ||
| sku: 'Standard_E2ads_v5' | ||
| customerManagedKey: { | ||
| keyName: nestedDependencies.outputs.keyName | ||
| keyVaultResourceId: nestedDependencies.outputs.keyVaultResourceId | ||
| userAssignedIdentityResourceId: nestedDependencies.outputs.managedIdentityResourceId | ||
| } | ||
| managedIdentities: { | ||
| userAssignedResourceIds: [ | ||
| nestedDependencies.outputs.managedIdentityResourceId | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.