Adding sample to test pipeline

[ouldsid]

PR Checklist

Check these items before submitting a PR...

Contribution Guide

Best Practice Guide

• - Please check this box once you've submitted the PR if you've read through the Contribution Guide and best practices checklist.

Changelog

[ouldsid]

/validate

[github-actions]

🤖 Quickstart Sample Summary

Sample Summary

• This sample demonstrates how to use a deployment stack to create and manage two Azure Storage Accounts with different replication types.

• It also deploys a virtual network with two subnets to test network integration with the storage accounts.

• The sample includes a prerequisite deployment stack as part of the setup.

• To deploy, first deploy the prerequisite template in the prereqs folder, then deploy the main template.

• The sample is authored in Bicep and uses parameterized resource names based on the resource group to ensure uniqueness.

Resources Deployed

• Microsoft.Storage/storageAccounts (defined in main.bicep): Two Storage Accounts deployed:

  • One with SKU Standard_LRS (Locally Redundant Storage)
  • One with SKU Standard_GRS (Geo-Redundant Storage)

• Microsoft.Network/virtualNetworks (defined in main.bicep): A virtual network with address prefix 10.0.0.0/16 containing two subnets:

  • Subnet-1 with address prefix 10.0.0.0/24
  • Subnet-2 with address prefix 10.0.1.0/24

• The prerequisite template file prereqs/prereq.main.bicep exists but content could not be fully verified due to a folder error.

Security Findings

• 13 security findings detected, including:

  • High severity issues from Template Analyzer and Checkov about Storage Account networking and encryption:
    • Default network access rule for Storage Accounts is not set to Deny (allowing connections from any network).
    • TLS version settings accept older TLS versions by default; recommending enforcing TLS 1.2 or above.
    • Storage Accounts may allow anonymous public blob access; recommend setting allowBlobPublicAccess to false.
  • Low severity Checkov findings related to naming conventions and replication usage of Storage Accounts.

• Most findings originate from main.bicep at lines 6 and 14 where the Storage Accounts are defined.

• No direct hardcoded secrets or public endpoints beyond the storage accounts' default network openness were noted.

Key Parameters

• resourceGroupLocation: Location for the resources; defaults to the resource group's location.
• storageAccountName: Name of the first Storage Account, generated uniquely per resource group.
• storageAccountName2: Name of the second Storage Account, also uniquely generated.
• vnetName: Name of the Virtual Network, uniquely generated per resource group.

Notes for Reviewers

• The sample emphasizes deployment stacks but does not currently configure Storage Account security best practices such as network rules or TLS enforcement.
• The prereqs folder includes a prerequisite Bicep template whose loading had an error, so its resources are not fully detailed.
• The sample README is minimal and marked as a test sample.
• Reviewers should verify the prereqs template resources and consider enhancing security configuration in the Storage Accounts.

Files Touched

• README.md (sample description)
• main.bicep (main deployment of storage accounts and VNet)
• metadata.json (sample metadata)
• prereqs/README.md (prerequisite README)
• prereqs/prereq.main.bicep (prerequisite deployment template)
• prereqs/prereq.azuredeploy.parameters.json (parameters for prereq deployment)

---

Generated by the quickstart summarizer agent (v2 — agentic + MSDO security) · triggered by /validate

[ouldsid]

/validate

[ouldsid]

/validate