Skip to content

Commit abc1d99

Browse files
BernieWhiteBernieWhite
authored
Update repo structure to focus on Bicep #45 (#47)
1 parent d9edfda commit abc1d99

19 files changed

Lines changed: 707 additions & 838 deletions

File tree

‎.vscode/settings.json‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,5 +11,13 @@
1111
"[powershell]": {
1212
"editor.formatOnSave": false,
1313
"editor.tabSize": 4
14-
}
14+
},
15+
"cSpell.words": [
16+
"bicepparam",
17+
"contoso",
18+
"eastus"
19+
],
20+
"cSpell.enableFiletypes": [
21+
"bicep"
22+
]
1523
}

‎README.md‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ To learn more about PSRule for Azure, see <https://aka.ms/ps-rule-azure>.
1313

1414
This repository includes:
1515

16-
- **Azure Templates** &mdash; Starter Azure Resource Manager (ARM) templates and parameter files.
17-
- Use the files in the `template/` folder if you are using ARM templates to deploy resources.
18-
- **Azure Bicep** &mdash; Starter Azure Bicep deployments and test files.
19-
- Use the files in the `bicep/` folder if you are using Bicep deployments and modules to deploy resources.
16+
- **Azure Bicep deployment** &mdash; Starter Azure Bicep deployments.
17+
- Use the files in the `deployments/` folder if you are using Bicep to deploy resources.
18+
- **Azure Bicep modules** &mdash; Starter Azure Bicep modules.
19+
- Use the files in the `modules/` folder if you are using Bicep to create reusable modules with tests.
2020
- **GitHub Actions** &mdash; Starter workflow for checking Azure Infrastructure as Code (IaC).
2121
- Use the files in the `.github/workflows/` to check your Azure IaC with GitHub Actions.
2222
- The `ms-analyze.yaml` file can be ignore or removed as this will not execute outside this repository.
@@ -28,14 +28,21 @@ This repository includes:
2828
- PSRule options are configures within `ps-rule.yaml`.
2929
- Options include suppressing rules, configuring input/ output, and any rules modules.
3030

31+
> **ARM templates**
32+
> PSRule for Azure supports ARM templates in addition to Bicep code.
33+
> However going forward this repository will focus on Bicep deployments and modules.
34+
> Existing ARM templates samples are no longer maintained and have been archived.
35+
> To access these samples jump to the [archive/with-arm-templates][3] branch.
36+
37+
[3]: https://github.com/Azure/PSRule.Rules.Azure-quickstart/tree/archive/with-arm-templates
38+
3139
## What to expect?
3240

3341
This repository shows valid uses of PSRule for Azure, both pass and failure cases.
3442
Inspect the following files for instructions to test PSRule for Azure rules by creating a failure.
3543

36-
- [bicep/deployments/contoso/landing-zones/subscription-1/rg-app-001/dev.bicepparam](bicep/deployments/contoso/landing-zones/subscription-1/rg-app-001/dev.bicepparam)
37-
- [bicep/deployments/contoso/landing-zones/subscription-1/rg-app-002/deploy.bicep](bicep/deployments/contoso/landing-zones/subscription-1/rg-app-002/deploy.bicep)
38-
- [template/deployments/contoso/landing-zones/subscription-1/rg-app-001/sttemplateapp001.parameters.json](template/deployments/contoso/landing-zones/subscription-1/rg-app-001/sttemplateapp001.parameters.json)
44+
- [deployments/contoso/landing-zones/subscription-1/rg-app-001/dev.bicepparam](deployments/contoso/landing-zones/subscription-1/rg-app-001/dev.bicepparam)
45+
- [deployments/contoso/landing-zones/subscription-1/rg-app-002/deploy.bicep](deployments/contoso/landing-zones/subscription-1/rg-app-002/deploy.bicep)
3946

4047
## Support
4148

@@ -61,7 +68,6 @@ or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any addi
6168
## Maintainers
6269

6370
- [Bernie White](https://github.com/BernieWhite)
64-
- [Sam Bell](https://github.com/ms-sambell)
6571

6672
## License
6773

‎bicep/modules/storage/v1/main.bicep‎

Lines changed: 0 additions & 89 deletions
This file was deleted.

bicep/deployments/contoso/landing-zones/subscription-1/rg-app-001/dev.bicepparam renamed to deployments/contoso/landing-zones/subscription-1/rg-app-001/dev.bicepparam

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,16 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
4+
// Note:
5+
// This Azure Bicep parameter file demonstrates using parameters.
6+
17
using 'main.bicep'
28

9+
// The env tag must be test, dev, or prod.
10+
// Try setting this to 'demo' to fail the custom organization Org.Azure.Tags rule.
11+
// See .ps-rule/Org.Rule.yaml for details.
312
param environment = 'dev'
13+
414
param name = 'kv-example-001'
515

616
// Key Vault should only accept explicitly allowed traffic through the firewall.

bicep/deployments/contoso/landing-zones/subscription-1/rg-app-001/main.bicep renamed to deployments/contoso/landing-zones/subscription-1/rg-app-001/main.bicep

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
4+
// Note:
5+
// This Azure Bicep code demonstrates using resources directly.
6+
// Also see parameter file for configurable options.
7+
18
targetScope = 'resourceGroup'
29

310
param name string
@@ -20,9 +27,12 @@ resource vault 'Microsoft.KeyVault/vaults@2023-02-01' = {
2027
name: 'standard'
2128
}
2229
tenantId: tenant().tenantId
30+
31+
// Try setting any of these to false to flag an issue.
2332
enableSoftDelete: true
2433
enablePurgeProtection: true
2534
enableRbacAuthorization: true
35+
2636
networkAcls: {
2737
defaultAction: defaultAction
2838
}

bicep/deployments/contoso/landing-zones/subscription-1/rg-app-002/deploy.bicep renamed to deployments/contoso/landing-zones/subscription-1/rg-app-002/deploy.bicep

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Licensed under the MIT License.
33

44
// Note:
5-
// This Azure Bicep code demonistrates a deployment of one or more modules.
5+
// This Azure Bicep code demonstrates a deployment of one or more modules.
66
// This file has multiple template errors to show validation.
77

88
@description('Configures the location to deploy the Azure resources.')
@@ -42,7 +42,8 @@ module keyvault '../../../../../modules/keyvault/v1/main.bicep' = {
4242
workspaceId: '/subscriptions/<subscription_id>/resourceGroups/rg-test/providers/Microsoft.OperationalInsights/workspaces/latest001'
4343

4444
// An env tag must be test, dev, or prod.
45-
// Try setting this to 'demo' to fail the Org.Azure.Tags rule.
45+
// Try setting this to 'demo' to fail the custom organization Org.Azure.Tags rule.
46+
// See .ps-rule/Org.Rule.yaml for details.
4647
tags: {
4748
env: 'dev'
4849
}

‎deployments/contoso/landing-zones/subscription-1/rg-app-003/deploy.bicep‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
4+
// Note:
5+
// This Azure Bicep code demonstrates using an AVM module.
6+
7+
module vault 'br/public:avm/res/key-vault/vault:0.3.5' = {
8+
// The name of the deployment.
9+
name: '${uniqueString(deployment().name)}-test-kvvwaf'
10+
params: {
11+
12+
// The name of the key vault.
13+
name: 'kvvwaf002'
14+
15+
// Try setting any of these to false to flag an issue.
16+
enablePurgeProtection: true
17+
enableRbacAuthorization: true
18+
19+
networkAcls: {
20+
bypass: 'AzureServices'
21+
22+
// Try setting the firewall to 'Allow' traffic by default to flag an issue.
23+
defaultAction: 'Deny'
24+
}
25+
26+
diagnosticSettings: [
27+
{
28+
workspaceResourceId: '<workspaceResourceId>'
29+
}
30+
]
31+
32+
softDeleteRetentionInDays: 7
33+
34+
// An env tag must be test, dev, or prod.
35+
// Try setting this to 'demo' to fail the custom organization Org.Azure.Tags rule.
36+
// See .ps-rule/Org.Rule.yaml for details.
37+
tags: {
38+
env: 'dev'
39+
}
40+
}
41+
}

bicep/modules/keyvault/v1/.tests/main.tests.bicep renamed to modules/keyvault/v1/.tests/main.tests.bicep

File renamed without changes.

bicep/modules/keyvault/v1/main.bicep renamed to modules/keyvault/v1/main.bicep

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
// Licensed under the MIT License.
33

44
targetScope = 'resourceGroup'
5-
65
metadata name = 'Key Vault'
76
metadata description = 'Create or update an Azure Key Vault.'
7+
metadata version = '1.0.0'
88

99
@sys.description('The name of the Key Vault.')
1010
param name string

‎modules/storage/v1/.bicep/pe.bicep‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Create or update a Private Endpoint for the Storage Account.
2+
3+
// ----------
4+
// PARAMETERS
5+
// ----------
6+
7+
@description('The name of the Private Endpoint.')
8+
param name string
9+
10+
@metadata({
11+
strongType: 'location'
12+
example: 'eastus'
13+
})
14+
@description('The Azure region to deploy to.')
15+
param location string
16+
17+
@description('The unique resource identifer for the resource to expose through the Private Endpoint.')
18+
param resourceId string
19+
20+
@allowed([
21+
'blob'
22+
'file'
23+
'table'
24+
'queue'
25+
])
26+
@description('The sub-resources to register the Private Endpoint for.')
27+
param groupId string
28+
29+
@metadata({
30+
strongType: 'Microsoft.Network/virtualNetworks/subnets'
31+
})
32+
@description('The unique resource identifer for the subnet to join the private endpoint to.')
33+
param subnetId string
34+
35+
@metadata({
36+
strongType: 'Microsoft.Network/privateDnsZones'
37+
})
38+
@description('The private DNS zone to register the private endpoint within.')
39+
param privateDnsZoneId string = ''
40+
41+
@description('Tags to apply to the resource.')
42+
param tags object
43+
44+
// ---------
45+
// VARIABLES
46+
// ---------
47+
48+
// ---------
49+
// RESOURCES
50+
// ---------
51+
52+
@description('Create or update a Private Endpoint for a resource.')
53+
resource endpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = {
54+
location: location
55+
name: name
56+
properties: {
57+
subnet: {
58+
id: subnetId
59+
}
60+
privateLinkServiceConnections: [
61+
{
62+
name: name
63+
properties: {
64+
privateLinkServiceId: resourceId
65+
groupIds: [
66+
groupId
67+
]
68+
}
69+
}
70+
]
71+
}
72+
tags: tags
73+
}
74+
75+
@description('Configures DNS for the Private Endpoint.')
76+
resource endpointGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2023-04-01' = if (!empty(privateDnsZoneId)) {
77+
parent: endpoint
78+
name: 'default'
79+
properties: {
80+
privateDnsZoneConfigs: [
81+
{
82+
name: replace(last(split(privateDnsZoneId, '/')), '.', '-')
83+
properties: {
84+
privateDnsZoneId: privateDnsZoneId
85+
}
86+
}
87+
]
88+
}
89+
}
90+
91+
// -------
92+
// OUTPUTS
93+
// -------
94+
95+
@description('A unique identifier for the Private Endpoint.')
96+
output id string = endpoint.id
97+
98+
@description('The name of the associated Private DNS Zone.')
99+
output privateDnsZone string = last(split(privateDnsZoneId, '/'))
100+
101+
@description('The name of the Resource Group where the Private Endpoint is deployed.')
102+
output resourceGroupName string = resourceGroup().name
103+
104+
@description('The guid for the subscription where the Private Endpoint is deployed.')
105+
output subscriptionId string = subscription().subscriptionId

0 commit comments

Comments
 (0)