azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "OrgName": {
      "type": "string",
      "minLength": 2,
      "metadata": {
        "description": "Name of the Company or Organization used for the Certificate Subject"
      }
    },
    "license": {
      "type": "string",
      "defaultValue": "trial",
      "metadata": {
        "description": "License Key for SCEPman"
      }
    },
    "keyVaultName": {
      "type": "string",
      "minLength": 3,
      "maxLength": 24,
      "metadata": {
        "description": "Specifies the name of the Azure Key Vault. The name of a Key Vault must be globally unique and contain only DNS-compatible characters (letters, numbers, and hyphens)."
      },
      "defaultValue": "kv-scepman-UNIQUENAME"
    },
    "caKeyType": {
      "type": "string",
      "allowedValues": [ "RSA", "RSA-HSM" ],
      "metadata": {
        "description": "When generating the SCEPman CA certificate, which kind of key pair shall be created? RSA is a software-protected RSA key; RSA-HSM is HSM-protected."
      },
      "defaultValue": "RSA-HSM"
    },
    "storageAccountName": {
      "type": "string",
      "minLength": 3,
      "maxLength": 24,
      "metadata": {
        "description": "Choose a globally unique name for your storage account. Storage account names must be between 3 and 24 characters in length and may contain numbers and lowercase letters only."
      },
      "defaultValue": "stscepmanuniquename"
    },
    "appServicePlanName": {
      "type": "string",
      "maxLength": 40,
      "defaultValue": "asp-scepman-UNIQUENAME"
    },
    "existingAppServicePlanID": {
      "type": "string",
      "defaultValue": "none",
      "metadata": {
        "description": "Provide the Resource ID of an existing App Service Plan (the long string displayed in the properties tab). Keep default value 'none' if you want to create a new one."
      }
    },
    "primaryAppServiceName": {
      "type": "string",
      "maxLength": 60,
      "metadata": {
        "description": "The SCEPman App Service and part of the default FQDN. Therefore, it must be globally unique and contain only DNS-compatible characters."
      },
      "defaultValue": "app-scepman-UNIQUENAME"
    },
    "logAnalyticsWorkspaceName": {
      "type": "string",
      "minLength": 4,
      "maxLength": 63,
      "metadata": {
        "description": "The Log Analytics Workspace with log data. Alphanumerics and hyphens are allowed."
      },
      "defaultValue": "log-scepman-UNIQUENAME"
    },
    "certificateMasterAppServiceName": {
      "type": "string",
      "maxLength": 60,
      "metadata": {
        "description": "The App Service for the component SCEPman Certificate Master. As it is part of the default FQDN, it must be globally unique and contain only DNS-compatible characters."
      },
      "defaultValue": "app-scepman-UNIQUENAME-cm"
    },
    "deployPrivateNetwork": {
      "type": "bool",
      "metadata": {
        "description": "Choose 'true' to deploy SCEPman with a Virtual Network. In this case, you must also provide names for the parameters virtualNetworkName, privateEndpointForTableStorage, and privateEndpointForKeyVaultName."
      },
      "defaultValue": true
    },
    "virtualNetworkName": {
      "type": "string",
      "maxLength": 80,
      "metadata": {
        "description": "The name of the Virtual Network. This is only applicable if deployPrivateNetwork is chosen."
      },
      "defaultValue": "vnet-scepman-UNIQUENAME"
    },
    "privateEndpointForKeyVaultName": {
      "type": "string",
      "minLength": 4,
      "maxLength": 64,
      "metadata": {
        "description": "Name of the Private Endpoint for the Key Vault. This is only applicable if deployPrivateNetwork is chosen."
      },
      "defaultValue": "pep-kv-scepman-UNIQUENAME"
    },
    "privateEndpointForTableStorage": {
      "type": "string",
      "minLength": 4,
      "maxLength": 64,
      "metadata": {
        "description": "Name of the Private Endpoint for the Azure Table Storage Service. This is only applicable if deployPrivateNetwork is chosen."
      },
      "defaultValue": "pep-sts-scepman-UNIQUENAME"
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources. For a manual deployment, we recommend the default value."
      }
    },
    "resourceTags": {
      "type": "object",
      "defaultValue": {},
      "metadata": {
        "description": "Tags to be assigned to all created resources. Use JSON syntax, e.g. if you want to add tags env with value dev and project with value scepman, then write { \"env\":\"dev\", \"project\":\"scepman\"}."
      }
    }
  },
  "variables": {
    "artifactsRepositoryUrl": "https://raw.githubusercontent.com/scepman/install/master/",
    "ArtifactsLocationSCEPman": "[uri(variables('artifactsRepositoryUrl'),'dist/Artifacts.zip')]",
    "ArtifactsLocationCertMaster":  "[uri(variables('artifactsRepositoryUrl'),'dist-certmaster/CertMaster-Artifacts.zip')]",
    "templateRepositoryUrl": "https://raw.githubusercontent.com/scepman/install/master/",
    "vnetTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/vnet.json')]",
    "vnet2AppServicesTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/vnet-to-appservices.json')]",
    "appSvcTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/appSvcDouble.json')]",
    "logAnalyticsTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/loganalytics.json')]",
    "vaultTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/vault.json')]",
    "appConfigTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/appConfig-scepman.json')]",
    "appConfigCertMasterTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/appConfig-certmaster.json')]",
    "stgAccountTemplateUri": "[uri(variables('templateRepositoryUrl'), 'nestedtemplates/stgAccount.json')]",
    "appServiceNames": [
        "[parameters('primaryAppServiceName')]",
        "[parameters('certificateMasterAppServiceName')]"
      ]
  },
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "pid-a262352f-52a9-4ed9-a9ba-6a2b2478d19b-partnercenter",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": []
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "VirtualNetwork",
      "condition": "[parameters('deployPrivateNetwork')]",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('vnetTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "[concat('AppService-', copyIndex(), '-ConnectionToVirtualNetwork')]",
      "condition": "[parameters('deployPrivateNetwork')]",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('vnet2AppServicesTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "appServiceName": {
            "value": "[variables('appServiceNames')[copyIndex()]]"
          }
        }
      },
      "dependsOn": [
        "VirtualNetwork", "SCEPmanAppServices"//,
       // "SCEPmanVault", "SCEPmanStorageAccount" // The connection does not actually depend on these two resources,
                                                // but concurrent modifications to the same VNET can lead to deployment errors.
                                                // This makes sure, only one operation at a time is performed on the VNET.
      ],
      "copy": {
        "name": "appServiceConnectionToVirtualNetwork",
        "count": 2,
        "mode": "serial",
        "batchSize": 1
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "SCEPmanAppServices",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('appSvcTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "AppServicePlanName": {
            "value": "[parameters('AppServicePlanName')]"
          },
          "existingAppServicePlanID": {
            "value": "[parameters('existingAppServicePlanID')]"
          },
          "appServiceName": {
            "value": "[parameters('primaryAppServiceName')]"
          },
          "appServiceName2": {
            "value": "[parameters('certificateMasterAppServiceName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "AzureMonitor",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('logAnalyticsTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "logAnalyticsAccountName": {
            "value": "[parameters('logAnalyticsWorkspaceName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "SCEPmanVault",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('vaultTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "keyVaultName": {
            "value": "[parameters('keyVaultName')]"
          },
          "permittedPrincipalId": {
            "value": "[reference('SCEPmanAppServices').outputs.scepmanPrincipalID.value]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          },
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "privateEndpointName": {
            "value": "[if(parameters('deployPrivateNetwork'), parameters('privateEndpointForKeyVaultName'), 'None')]"
          }
        }
      },
      "dependsOn": [
        "VirtualNetwork",
        "AppService-0-ConnectionToVirtualNetwork", "AppService-1-ConnectionToVirtualNetwork",
          // This is only to ensure that no concurrent modifications are made to the VNET. If no VNET is added, 
          // the dependency is not required, but an if() statement in dependsOn is against Best Practice, so we'll accept the performance hit instead.
        "SCEPmanStorageAccount" 
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "DeploymentSCEPmanConfig",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('appConfigTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "StorageAccountTableUrl": {
            "value": "[reference('SCEPmanStorageAccount').outputs.storageAccountTableUrl.value]"
          },
          "appServiceName": {
            "value": "[parameters('primaryAppServiceName')]"
          },
          "scepManBaseURL": {
            "value": "[reference('SCEPmanAppServices').outputs.scepmanURL.value]"
          },
          "keyVaultURL": {
            "value": "[reference('SCEPmanVault').outputs.keyVaultURL.value]"
          },
          "caKeyType": {
            "value": "[parameters('caKeyType')]"
          },
          "logAnalyticsWorkspaceId": {
            "value": "[reference('AzureMonitor').outputs.workspaceId.value]"
          },
          "logAnalyticsWorkspaceName": {
            "value": "[parameters('logAnalyticsWorkspaceName')]"
          },
          "OrgName": {
            "value": "[parameters('OrgName')]"
          },
          "WebsiteArtifactsUri": {
            "value": "[variables('ArtifactsLocationSCEPman')]"
          },
          "license": {
            "value": "[parameters('license')]"
          },
          "location": {
            "value": "[parameters('location')]"
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "DeploymentCertMasterConfig",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('appConfigCertMasterTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "appServiceName": {
            "value": "[parameters('certificateMasterAppServiceName')]"
          },
          "scepmanUrl": {
            "value": "[reference('SCEPmanAppServices').outputs.scepmanURL.value]"
          },
          "StorageAccountTableUrl": {
            "value": "[reference('SCEPmanStorageAccount').outputs.storageAccountTableUrl.value]"
          },
          "logAnalyticsWorkspaceId": {
            "value": "[reference('AzureMonitor').outputs.workspaceId.value]"
          },
          "logAnalyticsWorkspaceName": {
            "value": "[parameters('logAnalyticsWorkspaceName')]"
          },
          "WebsiteArtifactsUri": {
            "value": "[variables('ArtifactsLocationCertMaster')]"
          },
          "location": {
            "value": "[parameters('location')]"
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "SCEPmanStorageAccount",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('stgAccountTemplateUri')]",
          "contentVersion": "1.0.0.0"
        },
        "parameters": {
          "StorageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          },
          "tableContributorPrincipals": {
            "value": [
              "[reference('SCEPmanAppServices').outputs.scepmanPrincipalID.value]",
              "[reference('SCEPmanAppServices').outputs.certmasterPrincipalID.value]"
            ]
          },
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "privateEndpointName": {
            "value": "[if(parameters('deployPrivateNetwork'), parameters('privateEndpointForTableStorage'), 'None')]"
          }
        }
      },
      "dependsOn": [
        "VirtualNetwork",
        "AppService-0-ConnectionToVirtualNetwork", "AppService-1-ConnectionToVirtualNetwork"
      ]
    }
  ]
}