+
+via JSON Parameter file
+
+```json
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ // Required parameters
+ "dnsForwardingRulesetOutboundEndpointResourceIds": {
+ "value": [
+ "
+
+### Example 2: _Using large parameter set_
+
+This instance deploys the module with most of its features enabled.
+
+
+via Bicep module
+
+```bicep
+module dnsForwardingRuleset 'br/public:avm-res-network-dnsforwardingruleset:1.0.0' = {
+ name: '${uniqueString(deployment().name, location)}-test-ndfrsmax'
+ params: {
+ // Required parameters
+ dnsForwardingRulesetOutboundEndpointResourceIds: [
+ '
+
+via JSON Parameter file
+
+```json
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ // Required parameters
+ "dnsForwardingRulesetOutboundEndpointResourceIds": {
+ "value": [
+ "
+
+### Example 3: _WAF-aligned_
+
+This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
+
+
+via Bicep module
+
+```bicep
+module dnsForwardingRuleset 'br/public:avm-res-network-dnsforwardingruleset:1.0.0' = {
+ name: '${uniqueString(deployment().name, location)}-test-ndfrswaf'
+ params: {
+ // Required parameters
+ dnsForwardingRulesetOutboundEndpointResourceIds: [
+ '
+
+via JSON Parameter file
+
+```json
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+ "contentVersion": "1.0.0.0",
+ "parameters": {
+ // Required parameters
+ "dnsForwardingRulesetOutboundEndpointResourceIds": {
+ "value": [
+ "
+ + +## Parameters + +**Required parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`dnsForwardingRulesetOutboundEndpointResourceIds`](#parameter-dnsforwardingrulesetoutboundendpointresourceids) | array | The reference to the DNS resolver outbound endpoints that are used to route DNS queries matching the forwarding rules in the ruleset to the target DNS servers. | +| [`name`](#parameter-name) | string | Name of the DNS Forwarding Ruleset. | + +**Optional parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable telemetry via a Globally Unique Identifier (GUID). | +| [`forwardingRules`](#parameter-forwardingrules) | array | Array of forwarding rules. | +| [`location`](#parameter-location) | string | Location for all resources. | +| [`lock`](#parameter-lock) | object | The lock settings of the service. | +| [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. | +| [`tags`](#parameter-tags) | object | Tags of the resource. | +| [`vNetLinks`](#parameter-vnetlinks) | array | Array of virtual network links. | + +### Parameter: `dnsForwardingRulesetOutboundEndpointResourceIds` + +The reference to the DNS resolver outbound endpoints that are used to route DNS queries matching the forwarding rules in the ruleset to the target DNS servers. +- Required: Yes +- Type: array + +### Parameter: `enableTelemetry` + +Enable telemetry via a Globally Unique Identifier (GUID). +- Required: No +- Type: bool +- Default: `True` + +### Parameter: `forwardingRules` + +Array of forwarding rules. +- Required: No +- Type: array + + +| Name | Required | Type | Description | +| :-- | :-- | :--| :-- | +| [`domainName`](#parameter-forwardingrulesdomainname) | Yes | string | Required. The domain name to forward. | +| [`forwardingRuleState`](#parameter-forwardingrulesforwardingrulestate) | No | string | Optional. The state of the forwarding rule. | +| [`metadata`](#parameter-forwardingrulesmetadata) | No | string | Optional. Metadata attached to the forwarding rule. | +| [`name`](#parameter-forwardingrulesname) | Yes | string | Required. The name of the forwarding rule. | +| [`targetDnsServers`](#parameter-forwardingrulestargetdnsservers) | Yes | array | Required. The target DNS servers to forward to. | + +### Parameter: `forwardingRules.domainName` + +Required. The domain name to forward. + +- Required: Yes +- Type: string + +### Parameter: `forwardingRules.forwardingRuleState` + +Optional. The state of the forwarding rule. + +- Required: No +- Type: string +- Allowed: `[Disabled, Enabled]` + +### Parameter: `forwardingRules.metadata` + +Optional. Metadata attached to the forwarding rule. + +- Required: No +- Type: string + +### Parameter: `forwardingRules.name` + +Required. The name of the forwarding rule. + +- Required: Yes +- Type: string + +### Parameter: `forwardingRules.targetDnsServers` + +Required. The target DNS servers to forward to. + +- Required: Yes +- Type: array + +### Parameter: `location` + +Location for all resources. +- Required: No +- Type: string +- Default: `[resourceGroup().location]` + +### Parameter: `lock` + +The lock settings of the service. +- Required: No +- Type: object + + +| Name | Required | Type | Description | +| :-- | :-- | :--| :-- | +| [`kind`](#parameter-lockkind) | No | string | Optional. Specify the type of lock. | +| [`name`](#parameter-lockname) | No | string | Optional. Specify the name of lock. | + +### Parameter: `lock.kind` + +Optional. Specify the type of lock. + +- Required: No +- Type: string +- Allowed: `[CanNotDelete, None, ReadOnly]` + +### Parameter: `lock.name` + +Optional. Specify the name of lock. + +- Required: No +- Type: string + +### Parameter: `name` + +Name of the DNS Forwarding Ruleset. +- Required: Yes +- Type: string + +### Parameter: `roleAssignments` + +Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. +- Required: No +- Type: array + + +| Name | Required | Type | Description | +| :-- | :-- | :--| :-- | +| [`condition`](#parameter-roleassignmentscondition) | No | string | Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container" | +| [`conditionVersion`](#parameter-roleassignmentsconditionversion) | No | string | Optional. Version of the condition. | +| [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | No | string | Optional. The Resource Id of the delegated managed identity resource. | +| [`description`](#parameter-roleassignmentsdescription) | No | string | Optional. The description of the role assignment. | +| [`principalId`](#parameter-roleassignmentsprincipalid) | Yes | string | Required. The principal ID of the principal (user/group/identity) to assign the role to. | +| [`principalType`](#parameter-roleassignmentsprincipaltype) | No | string | Optional. The principal type of the assigned principal ID. | +| [`roleDefinitionIdOrName`](#parameter-roleassignmentsroledefinitionidorname) | Yes | string | Required. The name of the role to assign. If it cannot be found you can specify the role definition ID instead. | + +### Parameter: `roleAssignments.condition` + +Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container" + +- Required: No +- Type: string + +### Parameter: `roleAssignments.conditionVersion` + +Optional. Version of the condition. + +- Required: No +- Type: string +- Allowed: `[2.0]` + +### Parameter: `roleAssignments.delegatedManagedIdentityResourceId` + +Optional. The Resource Id of the delegated managed identity resource. + +- Required: No +- Type: string + +### Parameter: `roleAssignments.description` + +Optional. The description of the role assignment. + +- Required: No +- Type: string + +### Parameter: `roleAssignments.principalId` + +Required. The principal ID of the principal (user/group/identity) to assign the role to. + +- Required: Yes +- Type: string + +### Parameter: `roleAssignments.principalType` + +Optional. The principal type of the assigned principal ID. + +- Required: No +- Type: string +- Allowed: `[Device, ForeignGroup, Group, ServicePrincipal, User]` + +### Parameter: `roleAssignments.roleDefinitionIdOrName` + +Required. The name of the role to assign. If it cannot be found you can specify the role definition ID instead. + +- Required: Yes +- Type: string + +### Parameter: `tags` + +Tags of the resource. +- Required: No +- Type: object + +### Parameter: `vNetLinks` + +Array of virtual network links. +- Required: No +- Type: array + + +## Outputs + +| Output | Type | Description | +| :-- | :-- | :-- | +| `location` | string | The location the resource was deployed into. | +| `name` | string | The name of the DNS Forwarding Ruleset. | +| `resourceGroupName` | string | The resource group the DNS Forwarding Ruleset was deployed into. | +| `resourceId` | string | The resource ID of the DNS Forwarding Ruleset. | + +## Cross-referenced modules + +_None_ diff --git a/avm/res/network/dns-forwarding-ruleset/forwarding-rule/README.md b/avm/res/network/dns-forwarding-ruleset/forwarding-rule/README.md new file mode 100644 index 0000000000..1c844c873e --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/forwarding-rule/README.md @@ -0,0 +1,88 @@ +# Dns Forwarding Rulesets Forwarding Rules `[Microsoft.Network/dnsForwardingRulesets/forwardingRules]` + +This template deploys Forwarding Rule in a Dns Forwarding Ruleset. + +## Navigation + +- [Resource Types](#Resource-Types) +- [Parameters](#Parameters) +- [Outputs](#Outputs) +- [Cross-referenced modules](#Cross-referenced-modules) + +## Resource Types + +| Resource Type | API Version | +| :-- | :-- | +| `Microsoft.Network/dnsForwardingRulesets/forwardingRules` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2022-07-01/dnsForwardingRulesets/forwardingRules) | + +## Parameters + +**Required parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`domainName`](#parameter-domainname) | string | The domain name for the forwarding rule. | +| [`name`](#parameter-name) | string | Name of the Forwarding Rule. | +| [`targetDnsServers`](#parameter-targetdnsservers) | array | DNS servers to forward the DNS query to. | + +**Conditional parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`dnsForwardingRulesetName`](#parameter-dnsforwardingrulesetname) | string | Name of the parent DNS Forwarding Ruleset. Required if the template is used in a standalone deployment. | + +**Optional parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`forwardingRuleState`](#parameter-forwardingrulestate) | string | The state of forwarding rule. | +| [`metadata`](#parameter-metadata) | object | Metadata attached to the forwarding rule. | + +### Parameter: `dnsForwardingRulesetName` + +Name of the parent DNS Forwarding Ruleset. Required if the template is used in a standalone deployment. +- Required: Yes +- Type: string + +### Parameter: `domainName` + +The domain name for the forwarding rule. +- Required: Yes +- Type: string + +### Parameter: `forwardingRuleState` + +The state of forwarding rule. +- Required: No +- Type: string + +### Parameter: `metadata` + +Metadata attached to the forwarding rule. +- Required: No +- Type: object + +### Parameter: `name` + +Name of the Forwarding Rule. +- Required: Yes +- Type: string + +### Parameter: `targetDnsServers` + +DNS servers to forward the DNS query to. +- Required: Yes +- Type: array + + +## Outputs + +| Output | Type | Description | +| :-- | :-- | :-- | +| `name` | string | The name of the Forwarding Rule. | +| `resourceGroupName` | string | The resource group the Forwarding Rule was deployed into. | +| `resourceId` | string | The resource ID of the Forwarding Rule. | + +## Cross-referenced modules + +_None_ diff --git a/avm/res/network/dns-forwarding-ruleset/forwarding-rule/main.bicep b/avm/res/network/dns-forwarding-ruleset/forwarding-rule/main.bicep new file mode 100644 index 0000000000..efe4aeac92 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/forwarding-rule/main.bicep @@ -0,0 +1,46 @@ +metadata name = 'Dns Forwarding Rulesets Forwarding Rules' +metadata description = 'This template deploys Forwarding Rule in a Dns Forwarding Ruleset.' +metadata owner = 'Azure/module-maintainers' + +@description('Required. Name of the Forwarding Rule.') +@minLength(1) +param name string + +@description('Conditional. Name of the parent DNS Forwarding Ruleset. Required if the template is used in a standalone deployment.') +param dnsForwardingRulesetName string + +@description('Required. The domain name for the forwarding rule.') +param domainName string + +@description('Optional. The state of forwarding rule.') +param forwardingRuleState string? + +@description('Optional. Metadata attached to the forwarding rule.') +param metadata object? + +@description('Required. DNS servers to forward the DNS query to.') +param targetDnsServers array + +resource dnsForwardingRuleset 'Microsoft.Network/dnsForwardingRulesets@2022-07-01' existing = { + name: dnsForwardingRulesetName +} + +resource forwardingRule 'Microsoft.Network/dnsForwardingRulesets/forwardingRules@2022-07-01' = { + name: name + parent: dnsForwardingRuleset + properties: { + domainName: domainName + forwardingRuleState: forwardingRuleState + metadata: metadata + targetDnsServers: targetDnsServers + } +} + +@description('The resource group the Forwarding Rule was deployed into.') +output resourceGroupName string = resourceGroup().name + +@description('The resource ID of the Forwarding Rule.') +output resourceId string = forwardingRule.id + +@description('The name of the Forwarding Rule.') +output name string = forwardingRule.name diff --git a/avm/res/network/dns-forwarding-ruleset/forwarding-rule/main.json b/avm/res/network/dns-forwarding-ruleset/forwarding-rule/main.json new file mode 100644 index 0000000000..bcd11592a5 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/forwarding-rule/main.json @@ -0,0 +1,101 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.22.6.54827", + "templateHash": "10548868595530009801" + }, + "name": "Dns Forwarding Rulesets Forwarding Rules", + "description": "This template deploys Forwarding Rule in a Dns Forwarding Ruleset.", + "owner": "Azure/module-maintainers" + }, + "parameters": { + "name": { + "type": "string", + "minLength": 1, + "metadata": { + "description": "Required. Name of the Forwarding Rule." + } + }, + "dnsForwardingRulesetName": { + "type": "string", + "metadata": { + "description": "Conditional. Name of the parent DNS Forwarding Ruleset. Required if the template is used in a standalone deployment." + } + }, + "domainName": { + "type": "string", + "metadata": { + "description": "Required. The domain name for the forwarding rule." + } + }, + "forwardingRuleState": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The state of forwarding rule." + } + }, + "metadata": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Metadata attached to the forwarding rule." + } + }, + "targetDnsServers": { + "type": "array", + "metadata": { + "description": "Required. DNS servers to forward the DNS query to." + } + } + }, + "resources": { + "dnsForwardingRuleset": { + "existing": true, + "type": "Microsoft.Network/dnsForwardingRulesets", + "apiVersion": "2022-07-01", + "name": "[parameters('dnsForwardingRulesetName')]" + }, + "forwardingRule": { + "type": "Microsoft.Network/dnsForwardingRulesets/forwardingRules", + "apiVersion": "2022-07-01", + "name": "[format('{0}/{1}', parameters('dnsForwardingRulesetName'), parameters('name'))]", + "properties": { + "domainName": "[parameters('domainName')]", + "forwardingRuleState": "[parameters('forwardingRuleState')]", + "metadata": "[parameters('metadata')]", + "targetDnsServers": "[parameters('targetDnsServers')]" + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the Forwarding Rule was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Forwarding Rule." + }, + "value": "[resourceId('Microsoft.Network/dnsForwardingRulesets/forwardingRules', parameters('dnsForwardingRulesetName'), parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the Forwarding Rule." + }, + "value": "[parameters('name')]" + } + } +} \ No newline at end of file diff --git a/avm/res/network/dns-forwarding-ruleset/main.bicep b/avm/res/network/dns-forwarding-ruleset/main.bicep new file mode 100644 index 0000000000..8d62d8fd35 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/main.bicep @@ -0,0 +1,186 @@ +metadata name = 'Dns Forwarding Rulesets' +metadata description = 'This template deploys an dns forwarding ruleset.' +metadata owner = 'Azure/module-maintainers' + +@description('Required. Name of the DNS Forwarding Ruleset.') +@minLength(1) +param name string + +@description('Optional. Location for all resources.') +param location string = resourceGroup().location + +@description('Optional. The lock settings of the service.') +param lock lockType + +@description('Optional. Array of role assignment objects that contain the \'roleDefinitionIdOrName\' and \'principalId\' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.') +param roleAssignments roleAssignmentType + +@description('Optional. Tags of the resource.') +param tags object? + +@description('Required. The reference to the DNS resolver outbound endpoints that are used to route DNS queries matching the forwarding rules in the ruleset to the target DNS servers.') +param dnsForwardingRulesetOutboundEndpointResourceIds array + +@description('Optional. Array of forwarding rules.') +param forwardingRules forwardingRuleType? + +@description('Optional. Array of virtual network links.') +param vNetLinks array? + +@description('Optional. Enable telemetry via a Globally Unique Identifier (GUID).') +param enableTelemetry bool = true + +var builtInRoleNames = { + Contributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c') + 'DNS Resolver Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d') + 'DNS Zone Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314') + 'Network Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7') + Owner: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635') + 'Private DNS Zone Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f') + Reader: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7') + 'Role Based Access Control Administrator (Preview)': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168') +} + +resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' = if (enableTelemetry) { + name: '46d3xbcp.res.network-dnsforwardingruleset.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}' + properties: { + mode: 'Incremental' + template: { + '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#' + contentVersion: '1.0.0.0' + resources: [] + outputs: { + telemetry: { + type: 'String' + value: 'For more information, see https://aka.ms/avm/TelemetryInfo' + } + } + } + } +} + +resource dnsForwardingRuleset 'Microsoft.Network/dnsForwardingRulesets@2022-07-01' = { + name: name + location: location + tags: tags + properties: { + dnsResolverOutboundEndpoints: [for dnsForwardingRulesetOutboundEndpointResourceId in dnsForwardingRulesetOutboundEndpointResourceIds: { + id: dnsForwardingRulesetOutboundEndpointResourceId + }] + } +} + +module dnsForwardingRuleset_forwardingRule 'forwarding-rule/main.bicep' = [for (forwardingRule, index) in (forwardingRules ?? []): { + name: '${uniqueString(deployment().name, location)}-forwardingRule-${index}' + params: { + dnsForwardingRulesetName: dnsForwardingRuleset.name + name: forwardingRule.?name + forwardingRuleState: forwardingRule.?forwardingRuleState ?? 'Enabled' + domainName: forwardingRule.?domainName + targetDnsServers: forwardingRule.?targetDnsServers + metadata: forwardingRule.?metadata + } +}] + +module dnsForwardingRuleset_virtualNetworkLinks 'virtual-network-link/main.bicep' = [for (vnetId, index) in (vNetLinks ?? []): { + name: '${uniqueString(deployment().name, location)}-virtualNetworkLink-${index}' + params: { + dnsForwardingRulesetName: dnsForwardingRuleset.name + virtualNetworkResourceId: !empty(vNetLinks) ? vnetId : null + } +}] + +resource dnsForwardingRuleset_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') { + name: lock.?name ?? 'lock-${name}' + properties: { + level: lock.?kind ?? '' + notes: lock.?kind == 'CanNotDelete' ? 'Cannot delete resource or child resources.' : 'Cannot delete or modify the resource or child resources.' + } + scope: dnsForwardingRuleset +} + +resource dnsForwardingRuleset_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for (roleAssignment, index) in (roleAssignments ?? []): { + name: guid(dnsForwardingRuleset.id, roleAssignment.principalId, roleAssignment.roleDefinitionIdOrName) + properties: { + roleDefinitionId: contains(builtInRoleNames, roleAssignment.roleDefinitionIdOrName) ? builtInRoleNames[roleAssignment.roleDefinitionIdOrName] : roleAssignment.roleDefinitionIdOrName + principalId: roleAssignment.principalId + description: roleAssignment.?description + principalType: roleAssignment.?principalType + condition: roleAssignment.?condition + conditionVersion: !empty(roleAssignment.?condition) ? (roleAssignment.?conditionVersion ?? '2.0') : null // Must only be set if condtion is set + delegatedManagedIdentityResourceId: roleAssignment.?delegatedManagedIdentityResourceId + } + scope: dnsForwardingRuleset +}] + +@description('The resource group the DNS Forwarding Ruleset was deployed into.') +output resourceGroupName string = resourceGroup().name + +@description('The resource ID of the DNS Forwarding Ruleset.') +output resourceId string = dnsForwardingRuleset.id + +@description('The name of the DNS Forwarding Ruleset.') +output name string = dnsForwardingRuleset.name + +@description('The location the resource was deployed into.') +output location string = dnsForwardingRuleset.location + +// ================ // +// Definitions // +// ================ // + +type roleAssignmentType = { + @description('Required. The name of the role to assign. If it cannot be found you can specify the role definition ID instead.') + roleDefinitionIdOrName: string + + @description('Required. The principal ID of the principal (user/group/identity) to assign the role to.') + principalId: string + + @description('Optional. The principal type of the assigned principal ID.') + principalType: ('ServicePrincipal' | 'Group' | 'User' | 'ForeignGroup' | 'Device' | null)? + + @description('Optional. The description of the role assignment.') + description: string? + + @description('Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container"') + condition: string? + + @description('Optional. Version of the condition.') + conditionVersion: '2.0'? + + @description('Optional. The Resource Id of the delegated managed identity resource.') + delegatedManagedIdentityResourceId: string? +}[]? + +type lockType = { + @description('Optional. Specify the name of lock.') + name: string? + + @description('Optional. Specify the type of lock.') + kind: ('CanNotDelete' | 'ReadOnly' | 'None')? +}? + +type forwardingRuleType = { + @description('Required. The name of the forwarding rule.') + name: string + + @description('Optional. The state of the forwarding rule.') + forwardingRuleState: ('Enabled' | 'Disabled')? + + @description('Required. The domain name to forward.') + domainName: string + + @description('Required. The target DNS servers to forward to.') + targetDnsServers: targetDnsServers + + @description('Optional. Metadata attached to the forwarding rule.') + metadata: string? +}[]? + +type targetDnsServers = { + @description('Required. The IP address of the target DNS server.') + ipAddress: string + + @description('Required. The port of the target DNS server.') + port: string +}[] diff --git a/avm/res/network/dns-forwarding-ruleset/main.json b/avm/res/network/dns-forwarding-ruleset/main.json new file mode 100644 index 0000000000..91c58067f3 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/main.json @@ -0,0 +1,604 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.22.6.54827", + "templateHash": "6432207702551473267" + }, + "name": "Dns Forwarding Rulesets", + "description": "This template deploys an dns forwarding ruleset.", + "owner": "Azure/module-maintainers" + }, + "definitions": { + "roleAssignmentType": { + "type": "array", + "items": { + "type": "object", + "properties": { + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The name of the role to assign. If it cannot be found you can specify the role definition ID instead." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"" + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + } + }, + "nullable": true + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "nullable": true + }, + "forwardingRuleType": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the forwarding rule." + } + }, + "forwardingRuleState": { + "type": "string", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. The state of the forwarding rule." + } + }, + "domainName": { + "type": "string", + "metadata": { + "description": "Required. The domain name to forward." + } + }, + "targetDnsServers": { + "$ref": "#/definitions/targetDnsServers", + "metadata": { + "description": "Required. The target DNS servers to forward to." + } + }, + "metadata": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Metadata attached to the forwarding rule." + } + } + } + }, + "nullable": true + }, + "targetDnsServers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "ipAddress": { + "type": "string", + "metadata": { + "description": "Required. The IP address of the target DNS server." + } + }, + "port": { + "type": "string", + "metadata": { + "description": "Required. The port of the target DNS server." + } + } + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "minLength": 1, + "metadata": { + "description": "Required. Name of the DNS Forwarding Ruleset." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "$ref": "#/definitions/roleAssignmentType", + "metadata": { + "description": "Optional. Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "dnsForwardingRulesetOutboundEndpointResourceIds": { + "type": "array", + "metadata": { + "description": "Required. The reference to the DNS resolver outbound endpoints that are used to route DNS queries matching the forwarding rules in the ruleset to the target DNS servers." + } + }, + "forwardingRules": { + "$ref": "#/definitions/forwardingRuleType", + "nullable": true, + "metadata": { + "description": "Optional. Array of forwarding rules." + } + }, + "vNetLinks": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Array of virtual network links." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable telemetry via a Globally Unique Identifier (GUID)." + } + } + }, + "variables": { + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2023-07-01", + "name": "[format('46d3xbcp.res.network-dnsforwardingruleset.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "dnsForwardingRuleset": { + "type": "Microsoft.Network/dnsForwardingRulesets", + "apiVersion": "2022-07-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "dnsResolverOutboundEndpoints", + "count": "[length(parameters('dnsForwardingRulesetOutboundEndpointResourceIds'))]", + "input": { + "id": "[parameters('dnsForwardingRulesetOutboundEndpointResourceIds')[copyIndex('dnsResolverOutboundEndpoints')]]" + } + } + ] + } + }, + "dnsForwardingRuleset_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/dnsForwardingRulesets/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + }, + "dnsForwardingRuleset_roleAssignments": { + "copy": { + "name": "dnsForwardingRuleset_roleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/dnsForwardingRulesets/{0}', parameters('name'))]", + "name": "[guid(resourceId('Microsoft.Network/dnsForwardingRulesets', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]", + "properties": { + "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]", + "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + }, + "dnsForwardingRuleset_forwardingRule": { + "copy": { + "name": "dnsForwardingRuleset_forwardingRule", + "count": "[length(coalesce(parameters('forwardingRules'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-forwardingRule-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "dnsForwardingRulesetName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('forwardingRules'), createArray())[copyIndex()], 'name')]" + }, + "forwardingRuleState": { + "value": "[coalesce(tryGet(coalesce(parameters('forwardingRules'), createArray())[copyIndex()], 'forwardingRuleState'), 'Enabled')]" + }, + "domainName": { + "value": "[tryGet(coalesce(parameters('forwardingRules'), createArray())[copyIndex()], 'domainName')]" + }, + "targetDnsServers": { + "value": "[tryGet(coalesce(parameters('forwardingRules'), createArray())[copyIndex()], 'targetDnsServers')]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('forwardingRules'), createArray())[copyIndex()], 'metadata')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.22.6.54827", + "templateHash": "10548868595530009801" + }, + "name": "Dns Forwarding Rulesets Forwarding Rules", + "description": "This template deploys Forwarding Rule in a Dns Forwarding Ruleset.", + "owner": "Azure/module-maintainers" + }, + "parameters": { + "name": { + "type": "string", + "minLength": 1, + "metadata": { + "description": "Required. Name of the Forwarding Rule." + } + }, + "dnsForwardingRulesetName": { + "type": "string", + "metadata": { + "description": "Conditional. Name of the parent DNS Forwarding Ruleset. Required if the template is used in a standalone deployment." + } + }, + "domainName": { + "type": "string", + "metadata": { + "description": "Required. The domain name for the forwarding rule." + } + }, + "forwardingRuleState": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The state of forwarding rule." + } + }, + "metadata": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Metadata attached to the forwarding rule." + } + }, + "targetDnsServers": { + "type": "array", + "metadata": { + "description": "Required. DNS servers to forward the DNS query to." + } + } + }, + "resources": { + "dnsForwardingRuleset": { + "existing": true, + "type": "Microsoft.Network/dnsForwardingRulesets", + "apiVersion": "2022-07-01", + "name": "[parameters('dnsForwardingRulesetName')]" + }, + "forwardingRule": { + "type": "Microsoft.Network/dnsForwardingRulesets/forwardingRules", + "apiVersion": "2022-07-01", + "name": "[format('{0}/{1}', parameters('dnsForwardingRulesetName'), parameters('name'))]", + "properties": { + "domainName": "[parameters('domainName')]", + "forwardingRuleState": "[parameters('forwardingRuleState')]", + "metadata": "[parameters('metadata')]", + "targetDnsServers": "[parameters('targetDnsServers')]" + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the Forwarding Rule was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Forwarding Rule." + }, + "value": "[resourceId('Microsoft.Network/dnsForwardingRulesets/forwardingRules', parameters('dnsForwardingRulesetName'), parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the Forwarding Rule." + }, + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + }, + "dnsForwardingRuleset_virtualNetworkLinks": { + "copy": { + "name": "dnsForwardingRuleset_virtualNetworkLinks", + "count": "[length(coalesce(parameters('vNetLinks'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-virtualNetworkLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "dnsForwardingRulesetName": { + "value": "[parameters('name')]" + }, + "virtualNetworkResourceId": "[if(not(empty(parameters('vNetLinks'))), createObject('value', coalesce(parameters('vNetLinks'), createArray())[copyIndex()]), createObject('value', null()))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.22.6.54827", + "templateHash": "16281449356047571788" + }, + "name": "Dns Forwarding Rulesets Virtual Network Links", + "description": "This template deploys Virtual Network Link in a Dns Forwarding Ruleset.", + "owner": "Azure/module-maintainers" + }, + "parameters": { + "dnsForwardingRulesetName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent DNS Fowarding Rule Set. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the virtual network link." + } + }, + "virtualNetworkResourceId": { + "type": "string", + "metadata": { + "description": "Required. Link to another virtual network resource ID." + } + }, + "metadata": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Metadata attached to the forwarding rule." + } + } + }, + "resources": { + "dnsForwardingRuleset": { + "existing": true, + "type": "Microsoft.Network/dnsForwardingRulesets", + "apiVersion": "2022-07-01", + "name": "[parameters('dnsForwardingRulesetName')]" + }, + "virtualNetworkLink": { + "type": "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks", + "apiVersion": "2022-07-01", + "name": "[format('{0}/{1}', parameters('dnsForwardingRulesetName'), coalesce(parameters('name'), format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))))]", + "properties": { + "virtualNetwork": { + "id": "[parameters('virtualNetworkResourceId')]" + }, + "metadata": "[parameters('metadata')]" + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed virtual network link." + }, + "value": "[coalesce(parameters('name'), format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed virtual network link." + }, + "value": "[resourceId('Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks', parameters('dnsForwardingRulesetName'), coalesce(parameters('name'), format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed virtual network link." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the DNS Forwarding Ruleset was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the DNS Forwarding Ruleset." + }, + "value": "[resourceId('Microsoft.Network/dnsForwardingRulesets', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the DNS Forwarding Ruleset." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('dnsForwardingRuleset', '2022-07-01', 'full').location]" + } + } +} \ No newline at end of file diff --git a/avm/res/network/dns-forwarding-ruleset/tests/e2e/defaults/dependencies.bicep b/avm/res/network/dns-forwarding-ruleset/tests/e2e/defaults/dependencies.bicep new file mode 100644 index 0000000000..41fbb37c7e --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/tests/e2e/defaults/dependencies.bicep @@ -0,0 +1,69 @@ +@description('Required. The name of the Virtual Network to create.') +param virtualNetworkName string + +@description('Required. The name of the DNS Resolver to create.') +param dnsResolverName string + +@description('Optional. The location to deploy resources to.') +param location string = resourceGroup().location + +var addressPrefix = '10.0.0.0/16' + +resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = { + name: virtualNetworkName + location: location + properties: { + addressSpace: { + addressPrefixes: [ + addressPrefix + ] + } + subnets: map(range(0, 2), i => { + name: 'subnet-${i}' + properties: { + addressPrefix: cidrSubnet(addressPrefix, 25, i) + delegations: [ + { + name: 'dnsdel' + properties: { + serviceName: 'Microsoft.Network/dnsResolvers' + } + } + ] + } + }) + } +} + +resource dnsResolver 'Microsoft.Network/dnsResolvers@2022-07-01' = { + name: dnsResolverName + location: location + properties: { + virtualNetwork: { + id: virtualNetwork.id + } + } +} + +resource outboundEndpoints 'Microsoft.Network/dnsResolvers/outboundEndpoints@2022-07-01' = { + name: 'pdnsout' + location: location + parent: dnsResolver + properties: { + subnet: { + id: virtualNetwork.properties.subnets[1].id + } + } +} + +@description('The resource ID of the created Virtual Network.') +output virtualNetworkResourceId string = virtualNetwork.id + +@description('The resource ID of the created inbound endpoint Virtual Network Subnet.') +output subnetResourceId_dnsIn string = virtualNetwork.properties.subnets[0].id + +@description('The resource ID of the created outbound endpoint Virtual Network Subnet.') +output subnetResourceId_dnsOut string = virtualNetwork.properties.subnets[1].id + +@description('The resource ID of the created DNS Resolver.') +output dnsResolverOutboundEndpointsResourceId string = outboundEndpoints.id diff --git a/avm/res/network/dns-forwarding-ruleset/tests/e2e/defaults/main.test.bicep b/avm/res/network/dns-forwarding-ruleset/tests/e2e/defaults/main.test.bicep new file mode 100644 index 0000000000..94afee5a39 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/tests/e2e/defaults/main.test.bicep @@ -0,0 +1,69 @@ +targetScope = 'subscription' + +metadata name = 'Using only defaults' +metadata description = ''' +This instance deploys the module with the minimum set of required parameters. +> **Note:** The test currently implements additional non-required parameters to cater for a test-specific limitation. +''' + +// ========== // +// Parameters // +// ========== // + +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'dep-${namePrefix}-network.dnsForwardingRuleset-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'ndfrsmin' + +@description('Optional. A token to inject into the name of each resource.') +param namePrefix string = '#_namePrefix_#' + +// ============ // +// Dependencies // +// ============ // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: location +} + +module nestedDependencies 'dependencies.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-nestedDependencies' + params: { + virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}' + dnsResolverName: 'dep-${namePrefix}-ndr-${serviceShort}' + location: location + } +} + +// ============== // +// Test Execution // +// ============== // + +@batchSize(1) +module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-test-${serviceShort}-${iteration}' + params: { + name: '${namePrefix}${serviceShort}001' + dnsForwardingRulesetOutboundEndpointResourceIds: [ + nestedDependencies.outputs.dnsResolverOutboundEndpointsResourceId + ] + location: location + + // Workaround for PSRule + forwardingRules: [] + lock: {} + roleAssignments: [] + tags: {} + vNetLinks: [] + } +}] diff --git a/avm/res/network/dns-forwarding-ruleset/tests/e2e/max/dependencies.bicep b/avm/res/network/dns-forwarding-ruleset/tests/e2e/max/dependencies.bicep new file mode 100644 index 0000000000..d1fb3445ee --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/tests/e2e/max/dependencies.bicep @@ -0,0 +1,81 @@ +@description('Required. The name of the Virtual Network to create.') +param virtualNetworkName string + +@description('Required. The name of the DNS Resolver to create.') +param dnsResolverName string + +@description('Optional. The location to deploy resources to.') +param location string = resourceGroup().location + +@description('Required. The name of the Managed Identity to create.') +param managedIdentityName string + +var addressPrefix = '10.0.0.0/16' + +resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = { + name: virtualNetworkName + location: location + properties: { + addressSpace: { + addressPrefixes: [ + addressPrefix + ] + } + subnets: map(range(0, 2), i => { + name: 'subnet-${i}' + properties: { + addressPrefix: cidrSubnet(addressPrefix, 25, i) + delegations: [ + { + name: 'dnsdel' + properties: { + serviceName: 'Microsoft.Network/dnsResolvers' + } + } + ] + } + }) + } +} + +resource dnsResolver 'Microsoft.Network/dnsResolvers@2022-07-01' = { + name: dnsResolverName + location: location + properties: { + virtualNetwork: { + id: virtualNetwork.id + } + + } +} + +resource outboundEndpoints 'Microsoft.Network/dnsResolvers/outboundEndpoints@2022-07-01' = { + name: 'pdnsout' + location: location + parent: dnsResolver + properties: { + subnet: { + id: virtualNetwork.properties.subnets[1].id + } + } +} + +resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { + name: managedIdentityName + location: location +} + +@description('The resource ID of the created Virtual Network.') +output virtualNetworkResourceId string = virtualNetwork.id + +@description('The resource ID of the created inbound endpoint Virtual Network Subnet.') +output subnetResourceId_dnsIn string = virtualNetwork.properties.subnets[0].id + +@description('The resource ID of the created outbound endpoint Virtual Network Subnet.') +output subnetResourceId_dnsOut string = virtualNetwork.properties.subnets[1].id + +@description('The resource ID of the created DNS Resolver.') +output dnsResolverOutboundEndpointsId string = outboundEndpoints.id + +@description('The principal ID of the created Managed Identity.') +output managedIdentityPrincipalId string = managedIdentity.properties.principalId diff --git a/avm/res/network/dns-forwarding-ruleset/tests/e2e/max/main.test.bicep b/avm/res/network/dns-forwarding-ruleset/tests/e2e/max/main.test.bicep new file mode 100644 index 0000000000..5883886ec0 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/tests/e2e/max/main.test.bicep @@ -0,0 +1,92 @@ +targetScope = 'subscription' + +metadata name = 'Using large parameter set' +metadata description = 'This instance deploys the module with most of its features enabled.' + +// ========== // +// Parameters // +// ========== // + +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'dep-${namePrefix}-network.dnsForwardingRuleset-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'ndfrsmax' + +@description('Optional. A token to inject into the name of each resource.') +param namePrefix string = '#_namePrefix_#' + +// ============ // +// Dependencies // +// ============ // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: location +} + +module nestedDependencies 'dependencies.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-nestedDependencies' + params: { + virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}' + dnsResolverName: 'dep-${namePrefix}-ndr-${serviceShort}' + location: location + managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}' + } +} + +// ============== // +// Test Execution // +// ============== // + +@batchSize(1) +module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-test-${serviceShort}-${iteration}' + params: { + name: '${namePrefix}${serviceShort}001' + location: location + dnsForwardingRulesetOutboundEndpointResourceIds: [ + nestedDependencies.outputs.dnsResolverOutboundEndpointsId + ] + vNetLinks: [ + nestedDependencies.outputs.virtualNetworkResourceId + ] + forwardingRules: [ + { + name: 'rule1' + forwardingRuleState: 'Enabled' + domainName: 'contoso.' + targetDnsServers: [ + { + ipAddress: '192.168.0.1' + port: '53' + } + ] + } + ] + roleAssignments: [ + { + roleDefinitionIdOrName: 'Reader' + principalId: nestedDependencies.outputs.managedIdentityPrincipalId + principalType: 'ServicePrincipal' + } + ] + lock: { + kind: 'CanNotDelete' + name: 'myCustomLockName' + } + tags: { + 'hidden-title': 'This is visible in the resource name' + Environment: 'Non-Prod' + Role: 'DeploymentValidation' + } + } +}] diff --git a/avm/res/network/dns-forwarding-ruleset/tests/e2e/waf-aligned/dependencies.bicep b/avm/res/network/dns-forwarding-ruleset/tests/e2e/waf-aligned/dependencies.bicep new file mode 100644 index 0000000000..d1fb3445ee --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/tests/e2e/waf-aligned/dependencies.bicep @@ -0,0 +1,81 @@ +@description('Required. The name of the Virtual Network to create.') +param virtualNetworkName string + +@description('Required. The name of the DNS Resolver to create.') +param dnsResolverName string + +@description('Optional. The location to deploy resources to.') +param location string = resourceGroup().location + +@description('Required. The name of the Managed Identity to create.') +param managedIdentityName string + +var addressPrefix = '10.0.0.0/16' + +resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = { + name: virtualNetworkName + location: location + properties: { + addressSpace: { + addressPrefixes: [ + addressPrefix + ] + } + subnets: map(range(0, 2), i => { + name: 'subnet-${i}' + properties: { + addressPrefix: cidrSubnet(addressPrefix, 25, i) + delegations: [ + { + name: 'dnsdel' + properties: { + serviceName: 'Microsoft.Network/dnsResolvers' + } + } + ] + } + }) + } +} + +resource dnsResolver 'Microsoft.Network/dnsResolvers@2022-07-01' = { + name: dnsResolverName + location: location + properties: { + virtualNetwork: { + id: virtualNetwork.id + } + + } +} + +resource outboundEndpoints 'Microsoft.Network/dnsResolvers/outboundEndpoints@2022-07-01' = { + name: 'pdnsout' + location: location + parent: dnsResolver + properties: { + subnet: { + id: virtualNetwork.properties.subnets[1].id + } + } +} + +resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { + name: managedIdentityName + location: location +} + +@description('The resource ID of the created Virtual Network.') +output virtualNetworkResourceId string = virtualNetwork.id + +@description('The resource ID of the created inbound endpoint Virtual Network Subnet.') +output subnetResourceId_dnsIn string = virtualNetwork.properties.subnets[0].id + +@description('The resource ID of the created outbound endpoint Virtual Network Subnet.') +output subnetResourceId_dnsOut string = virtualNetwork.properties.subnets[1].id + +@description('The resource ID of the created DNS Resolver.') +output dnsResolverOutboundEndpointsId string = outboundEndpoints.id + +@description('The principal ID of the created Managed Identity.') +output managedIdentityPrincipalId string = managedIdentity.properties.principalId diff --git a/avm/res/network/dns-forwarding-ruleset/tests/e2e/waf-aligned/main.test.bicep b/avm/res/network/dns-forwarding-ruleset/tests/e2e/waf-aligned/main.test.bicep new file mode 100644 index 0000000000..5c7a7af719 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/tests/e2e/waf-aligned/main.test.bicep @@ -0,0 +1,74 @@ +targetScope = 'subscription' + +metadata name = 'WAF-aligned' +metadata description = 'This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.' + +// ========== // +// Parameters // +// ========== // + +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'dep-${namePrefix}-network.dnsForwardingRuleset-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'ndfrswaf' + +@description('Optional. A token to inject into the name of each resource.') +param namePrefix string = '#_namePrefix_#' + +// ============ // +// Dependencies // +// ============ // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: location +} + +module nestedDependencies 'dependencies.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-nestedDependencies' + params: { + virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}' + dnsResolverName: 'dep-${namePrefix}-ndr-${serviceShort}' + location: location + managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}' + } +} + +// ============== // +// Test Execution // +// ============== // + +@batchSize(1) +module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-test-${serviceShort}-${iteration}' + params: { + name: '${namePrefix}${serviceShort}001' + location: location + dnsForwardingRulesetOutboundEndpointResourceIds: [ + nestedDependencies.outputs.dnsResolverOutboundEndpointsId + ] + lock: { + kind: 'CanNotDelete' + name: 'myCustomLockName' + } + tags: { + 'hidden-title': 'This is visible in the resource name' + Environment: 'Non-Prod' + Role: 'DeploymentValidation' + } + + // Workaround for PSRule + vNetLinks: [] + forwardingRules: [] + roleAssignments: [] + } +}] diff --git a/avm/res/network/dns-forwarding-ruleset/version.json b/avm/res/network/dns-forwarding-ruleset/version.json new file mode 100644 index 0000000000..8def869ede --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/version.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#", + "version": "0.1", + "pathFilters": [ + "./main.json" + ] +} diff --git a/avm/res/network/dns-forwarding-ruleset/virtual-network-link/README.md b/avm/res/network/dns-forwarding-ruleset/virtual-network-link/README.md new file mode 100644 index 0000000000..95a3f47ac8 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/virtual-network-link/README.md @@ -0,0 +1,74 @@ +# Dns Forwarding Rulesets Virtual Network Links `[Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks]` + +This template deploys Virtual Network Link in a Dns Forwarding Ruleset. + +## Navigation + +- [Resource Types](#Resource-Types) +- [Parameters](#Parameters) +- [Outputs](#Outputs) +- [Cross-referenced modules](#Cross-referenced-modules) + +## Resource Types + +| Resource Type | API Version | +| :-- | :-- | +| `Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks` | [2022-07-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2022-07-01/dnsForwardingRulesets/virtualNetworkLinks) | + +## Parameters + +**Required parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`virtualNetworkResourceId`](#parameter-virtualnetworkresourceid) | string | Link to another virtual network resource ID. | + +**Conditional parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`dnsForwardingRulesetName`](#parameter-dnsforwardingrulesetname) | string | The name of the parent DNS Fowarding Rule Set. Required if the template is used in a standalone deployment. | + +**Optional parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`metadata`](#parameter-metadata) | object | Metadata attached to the forwarding rule. | +| [`name`](#parameter-name) | string | The name of the virtual network link. | + +### Parameter: `dnsForwardingRulesetName` + +The name of the parent DNS Fowarding Rule Set. Required if the template is used in a standalone deployment. +- Required: Yes +- Type: string + +### Parameter: `metadata` + +Metadata attached to the forwarding rule. +- Required: No +- Type: object + +### Parameter: `name` + +The name of the virtual network link. +- Required: No +- Type: string + +### Parameter: `virtualNetworkResourceId` + +Link to another virtual network resource ID. +- Required: Yes +- Type: string + + +## Outputs + +| Output | Type | Description | +| :-- | :-- | :-- | +| `name` | string | The name of the deployed virtual network link. | +| `resourceGroupName` | string | The resource group of the deployed virtual network link. | +| `resourceId` | string | The resource ID of the deployed virtual network link. | + +## Cross-referenced modules + +_None_ diff --git a/avm/res/network/dns-forwarding-ruleset/virtual-network-link/main.bicep b/avm/res/network/dns-forwarding-ruleset/virtual-network-link/main.bicep new file mode 100644 index 0000000000..cab9c1df23 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/virtual-network-link/main.bicep @@ -0,0 +1,39 @@ +metadata name = 'Dns Forwarding Rulesets Virtual Network Links' +metadata description = 'This template deploys Virtual Network Link in a Dns Forwarding Ruleset.' +metadata owner = 'Azure/module-maintainers' + +@description('Conditional. The name of the parent DNS Fowarding Rule Set. Required if the template is used in a standalone deployment.') +param dnsForwardingRulesetName string + +@description('Optional. The name of the virtual network link.') +param name string? + +@description('Required. Link to another virtual network resource ID.') +param virtualNetworkResourceId string + +@description('Optional. Metadata attached to the forwarding rule.') +param metadata object? + +resource dnsForwardingRuleset 'Microsoft.Network/dnsForwardingRulesets@2022-07-01' existing = { + name: dnsForwardingRulesetName +} + +resource virtualNetworkLink 'Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks@2022-07-01' = { + name: name ?? '${last(split(virtualNetworkResourceId, '/'))}-vnetlink' + parent: dnsForwardingRuleset + properties: { + virtualNetwork: { + id: virtualNetworkResourceId + } + metadata: metadata + } +} + +@description('The name of the deployed virtual network link.') +output name string = virtualNetworkLink.name + +@description('The resource ID of the deployed virtual network link.') +output resourceId string = virtualNetworkLink.id + +@description('The resource group of the deployed virtual network link.') +output resourceGroupName string = resourceGroup().name diff --git a/avm/res/network/dns-forwarding-ruleset/virtual-network-link/main.json b/avm/res/network/dns-forwarding-ruleset/virtual-network-link/main.json new file mode 100644 index 0000000000..7d91357cc4 --- /dev/null +++ b/avm/res/network/dns-forwarding-ruleset/virtual-network-link/main.json @@ -0,0 +1,88 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.22.6.54827", + "templateHash": "16281449356047571788" + }, + "name": "Dns Forwarding Rulesets Virtual Network Links", + "description": "This template deploys Virtual Network Link in a Dns Forwarding Ruleset.", + "owner": "Azure/module-maintainers" + }, + "parameters": { + "dnsForwardingRulesetName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent DNS Fowarding Rule Set. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the virtual network link." + } + }, + "virtualNetworkResourceId": { + "type": "string", + "metadata": { + "description": "Required. Link to another virtual network resource ID." + } + }, + "metadata": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Metadata attached to the forwarding rule." + } + } + }, + "resources": { + "dnsForwardingRuleset": { + "existing": true, + "type": "Microsoft.Network/dnsForwardingRulesets", + "apiVersion": "2022-07-01", + "name": "[parameters('dnsForwardingRulesetName')]" + }, + "virtualNetworkLink": { + "type": "Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks", + "apiVersion": "2022-07-01", + "name": "[format('{0}/{1}', parameters('dnsForwardingRulesetName'), coalesce(parameters('name'), format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))))]", + "properties": { + "virtualNetwork": { + "id": "[parameters('virtualNetworkResourceId')]" + }, + "metadata": "[parameters('metadata')]" + }, + "dependsOn": [ + "dnsForwardingRuleset" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed virtual network link." + }, + "value": "[coalesce(parameters('name'), format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed virtual network link." + }, + "value": "[resourceId('Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks', parameters('dnsForwardingRulesetName'), coalesce(parameters('name'), format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed virtual network link." + }, + "value": "[resourceGroup().name]" + } + } +} \ No newline at end of file