-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #5 from Hekku2/feat/key-vault
Add Key Vault and User Assigned Managed Identity support
- Loading branch information
Showing
6 changed files
with
236 additions
and
52 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| @minLength(5) | ||
| param baseName string | ||
|
|
||
| @description('Location for all resources.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| @description('Names of the container to create in the storage account.') | ||
| param imageContainerName string | ||
|
|
||
| @description('Identities of which are assigned with Blob Data Reader to the containers.') | ||
| param imageReaderIdentities string[] | ||
|
|
||
| resource identities 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-preview' existing = [ | ||
| for identityName in imageReaderIdentities: { | ||
| name: identityName | ||
| scope: resourceGroup() | ||
| } | ||
| ] | ||
|
|
||
| resource imageStorage 'Microsoft.Storage/storageAccounts@2022-05-01' = { | ||
| name: substring(replace('stimages${baseName}', '-', ''), 0, 24) | ||
| location: location | ||
| kind: 'StorageV2' | ||
| sku: { | ||
| name: 'Standard_LRS' | ||
| } | ||
| tags: { | ||
| displayName: 'Storage for function app' | ||
| } | ||
| properties: { | ||
| allowBlobPublicAccess: false | ||
| minimumTlsVersion: 'TLS1_2' | ||
| supportsHttpsTrafficOnly: true | ||
| isHnsEnabled: true | ||
| } | ||
| } | ||
|
|
||
| resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2023-01-01' = { | ||
| parent: imageStorage | ||
| name: 'default' | ||
| } | ||
|
|
||
| resource container 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = { | ||
| parent: blobServices | ||
| name: imageContainerName | ||
| } | ||
|
|
||
| var storageBlobDataReaderRoleDefinitionId = subscriptionResourceId( | ||
| 'Microsoft.Authorization/roleDefinitions', | ||
| '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1' | ||
| ) | ||
|
|
||
| resource imageRearderAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [ | ||
| for (identityName, i) in imageReaderIdentities: { | ||
| scope: container | ||
| name: guid(identities[i].id, storageBlobDataReaderRoleDefinitionId, container.id) | ||
| properties: { | ||
| principalId: identities[i].properties.principalId | ||
| principalType: 'ServicePrincipal' | ||
| roleDefinitionId: storageBlobDataReaderRoleDefinitionId | ||
| } | ||
| } | ||
| ] | ||
|
|
||
| output blobContainerUri string = '${imageStorage.properties.primaryEndpoints.blob}${imageContainerName}' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| import { SecretKeyValue } from 'types.bicep' | ||
|
|
||
| @description('Base of the name for all resources.') | ||
| param baseName string | ||
|
|
||
| @description('Location for all resources.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| @description('Secrets to store in the key vault.') | ||
| param secrets SecretKeyValue[] | ||
|
|
||
| @description('Secret users to grant access to the key vault.') | ||
| param secretUserRoleIdentities string[] | ||
|
|
||
| var secretUserRoleDefinitionId = subscriptionResourceId( | ||
| 'Microsoft.Authorization/roleDefinitions', | ||
| '4633458b-17de-408a-b874-0445c86b69e6' | ||
| ) | ||
|
|
||
| resource identities 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-preview' existing = [ | ||
| for identityName in secretUserRoleIdentities: { | ||
| name: identityName | ||
| scope: resourceGroup() | ||
| } | ||
| ] | ||
|
|
||
| var keyVaultName = replace('kv${baseName}', '-', '') | ||
| resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = { | ||
| name: keyVaultName | ||
| location: location | ||
| properties: { | ||
| enableRbacAuthorization: true | ||
| enabledForDeployment: false | ||
| enabledForDiskEncryption: false | ||
| enabledForTemplateDeployment: false | ||
| tenantId: tenant().tenantId | ||
| enableSoftDelete: false | ||
| accessPolicies: [] | ||
| sku: { | ||
| name: 'standard' | ||
| family: 'A' | ||
| } | ||
| networkAcls: { | ||
| defaultAction: 'Allow' | ||
| bypass: 'AzureServices' | ||
| } | ||
| } | ||
| } | ||
|
|
||
| resource keyVaultSecrets 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = [ | ||
| for secret in secrets: { | ||
| parent: keyVault | ||
| name: secret.key | ||
| properties: { | ||
| value: secret.value | ||
| } | ||
| } | ||
| ] | ||
|
|
||
| resource secretUserRoleAssingment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [ | ||
| for (identityName, i) in secretUserRoleIdentities: { | ||
| scope: keyVault | ||
| name: guid(identities[i].id, secretUserRoleDefinitionId, keyVault.id) | ||
| properties: { | ||
| principalId: identities[i].properties.principalId | ||
| principalType: 'ServicePrincipal' | ||
| roleDefinitionId: secretUserRoleDefinitionId | ||
| } | ||
| } | ||
| ] | ||
|
|
||
| output keyVaultName string = keyVaultName |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.