main.bicep

// original file - https://github.com/Azure/bicep/blob/main/docs/examples/101/function-app-create/main.bicep
param location string = resourceGroup().location
param watchlistStorageAccountName string = ''
param watchlistStorageAccountFileShareName string = ''
param watchlistStorageAccountFileShareAccessKey string = ''
param watchlistStorageAccountIncomingContainerOrDirectoryName string = 'incoming'
param watchlistStorageAccountCompletedContainerOrDirectoryName string = 'imported'
param watchlistStorageSubscriptionId string = ''
param watchlistWorkspaceId string = ''
param workspaceSharedKey string = ''

param appNameSuffix string = uniqueString(resourceGroup().id)

var functionAppName = 'functionapp-${appNameSuffix}'
var vaultName = 'vault-${appNameSuffix}'
var appServiceName = 'appservice-${appNameSuffix}'

var blobAppSettings = [
{
  name: 'WATCHLIST_STORAGE_INCOMING_CONTAINER_NAME'
  value: watchlistStorageAccountIncomingContainerOrDirectoryName
}
{
  name: 'WATCHLIST_STORAGE_COMPLETED_CONTAINER_NAME'
  value: watchlistStorageAccountCompletedContainerOrDirectoryName
}
]

var fileAppSettings = [
  {
    name: 'WATCHLIST_STORAGE_ACCOUNT_FILE_SHARE_NAME'
    value: watchlistStorageAccountFileShareName
  }
  {
    name: 'WATCHLIST_STORAGE_INCOMING_DIRECTORY_NAME'
    value: watchlistStorageAccountIncomingContainerOrDirectoryName
  }
  {
    name: 'WATCHLIST_STORAGE_COMPLETED_DIRECTORY_NAME'
    value: watchlistStorageAccountCompletedContainerOrDirectoryName
  }
  {
    name: 'WATCHLIST_STORAGE_ACCOUNT_FILE_SHARE_ACCESS_KEY'
    value: '@Microsoft.KeyVault(SecretUri=https://${vaultName}.vault.azure.net/secrets/WATCHLIST-STORAGE-ACCOUNT-FILE-SHARE-ACCESS-KEY)'
  }
  ]

// remove dashes for storage account name
var storageAccountName = format('sta{0}', replace(appNameSuffix, '-', ''))

// Storage Account
resource storageAccount 'Microsoft.Storage/storageAccounts@2019-06-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
    accessTier: 'Hot'
  }
}

// Blob Services for Storage Account
resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2019-06-01' = {
  parent: storageAccount

  name: 'default'
  properties: {
    cors: {
      corsRules: []
    }
    deleteRetentionPolicy: {
      enabled: true
      days: 7
    }
  }
}

// App Service
resource appService 'Microsoft.Web/serverfarms@2021-01-15' = {
  name: appServiceName
  location: location
  kind: 'functionapp'
  sku: {
    name: 'EP1'
  }
  properties: {
    reserved: false
  }
}

// Function App
resource functionApp 'Microsoft.Web/sites@2020-06-01' = {
  name: functionAppName
  location: location
  kind: 'functionapp'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    enabled: true
    hostNameSslStates: [
      {
        name: '${functionAppName}.azurewebsites.net'
        sslState: 'Disabled'
        hostType: 'Standard'
      }
      {
        name: '${functionAppName}.scm.azurewebsites.net'
        sslState: 'Disabled'
        hostType: 'Standard'
      }
    ]
    serverFarmId: appService.id
    reserved: false
    isXenon: false
    hyperV: false
    siteConfig: {
      appSettings: union([
        {
          name: 'AzureWebJobsStorage'
          value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${storageAccount.listKeys().keys[0].value}'
        }
        {
          name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING'
          value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${storageAccount.listKeys().keys[0].value}'
        }
        {
          name: 'FUNCTIONS_WORKER_RUNTIME'
          value: 'powershell'
        }
        {
          name: 'FUNCTIONS_EXTENSION_VERSION'
          value: '~3'
        }
        {
          name: 'WATCHLIST_STORAGE_ACCOUNT_NAME'
          value: watchlistStorageAccountName
        } 
        {
          name: 'WATCHLIST_STORAGE_SUBSCRIPTION_ID'
          value: watchlistStorageSubscriptionId
        }
        {
          name: 'WATCHLIST_WORKSPACE_ID'
          value: watchlistWorkspaceId
        }
        {
          name: 'WATCHLIST_WORKSPACE_SHARED_KEY'
          value: '@Microsoft.KeyVault(SecretUri=https://${vaultName}.vault.azure.net/secrets/WATCHLIST-WORKSPACE-SHARED-KEY)'
        }
        {
          name: 'AzureWebJobs.ImportWatchlistsDaily.Disabled'
          value: 'true'
        }
        {
          name: 'FUNCTIONS_WORKER_PROCESS_COUNT'
          value: '1'
        }
        {
          name: 'PSWorkerInProcConcurrencyUpperBound'
          value: '5'
        }
      ], empty(watchlistStorageAccountFileShareName) ?  blobAppSettings : fileAppSettings)
    }
    scmSiteAlsoStopped: false
    clientAffinityEnabled: false
    clientCertEnabled: false
    hostNamesDisabled: false
    dailyMemoryTimeQuota: 0
    httpsOnly: true
    redundancyMode: 'None'
  }
}

// Function App Config
resource functionAppConfig 'Microsoft.Web/sites/config@2021-01-15' = {
  parent: functionApp

  name: 'web'
  properties: {
    numberOfWorkers: -1
    defaultDocuments: [
      'Default.htm'
      'Default.html'
      'Default.asp'
      'index.htm'
      'index.html'
      'iisstart.htm'
      'default.aspx'
      'index.php'
      'hostingstart.html'
    ]
    netFrameworkVersion: 'v4.0'
    phpVersion: '5.6'
    powerShellVersion: '~7'
    requestTracingEnabled: false
    remoteDebuggingEnabled: false
    httpLoggingEnabled: false
    logsDirectorySizeLimit: 35
    detailedErrorLoggingEnabled: false
    publishingUsername: '$${functionAppName}'
    scmType: 'None'
    use32BitWorkerProcess: true
    webSocketsEnabled: false
    alwaysOn: false
    managedPipelineMode: 'Integrated'
    virtualApplications: [
      {
        virtualPath: '/'
        physicalPath: 'site\\wwwroot'
        preloadEnabled: true
      }
    ]
    loadBalancing: 'LeastRequests'
    experiments: {
      rampUpRules: []
    }
    autoHealEnabled: false
    cors: {
      allowedOrigins: [
        'https://functions.azure.com'
        'https://functions-staging.azure.com'
        'https://functions-next.azure.com'
      ]
      supportCredentials: false
    }
    localMySqlEnabled: false
    ipSecurityRestrictions: [
      {
        ipAddress: 'Any'
        action: 'Allow'
        priority: 1
        name: 'Allow all'
        description: 'Allow all access'
      }
    ]
    scmIpSecurityRestrictions: [
      {
        ipAddress: 'Any'
        action: 'Allow'
        priority: 1
        name: 'Allow all'
        description: 'Allow all access'
      }
    ]
    scmIpSecurityRestrictionsUseMain: false
    http20Enabled: true
    minTlsVersion: '1.2'
    ftpsState: 'AllAllowed'
    preWarmedInstanceCount: 0
  }
}

// Function App Binding
resource functionAppBinding 'Microsoft.Web/sites/hostNameBindings@2020-06-01' = {
  parent: functionApp

  name: '${functionApp.name}.azurewebsites.net'
  properties: {
    siteName: functionApp.name
    hostNameType: 'Verified'
  }
}

resource keyvault 'Microsoft.KeyVault/vaults@2019-09-01' = {
  name: vaultName
  location: location
  properties: {
    tenantId: subscription().tenantId
    sku: {
      family: 'A'
      name: 'standard'
    }
    accessPolicies: [
      {
        tenantId: subscription().tenantId
        objectId: reference(functionApp.id, '2020-06-01', 'Full').identity.principalId // replace with your objectId
        permissions: {
          keys: [ ]
          secrets: [
            'get'
            'list'
          ]
          certificates: [ ]
        }
      }
    ]
    enabledForDeployment: false
    enabledForDiskEncryption: false
    enabledForTemplateDeployment: false
    softDeleteRetentionInDays: 90
    enableRbacAuthorization: false
    networkAcls: {
      ipRules: []
      virtualNetworkRules: []
    }
  }
}

// create secret
resource secret 'Microsoft.KeyVault/vaults/secrets@2018-02-14' = {
  name: '${keyvault.name}/WATCHLIST-WORKSPACE-SHARED-KEY'
  properties: {
    value: workspaceSharedKey
  }
}

resource secret1 'Microsoft.KeyVault/vaults/secrets@2018-02-14' = if (!empty(watchlistStorageAccountFileShareAccessKey)) {
  name: '${keyvault.name}/WATCHLIST-STORAGE-ACCOUNT-FILE-SHARE-ACCESS-KEY'
  properties: {
    value: watchlistStorageAccountFileShareAccessKey
  }
}


output functionAppName string = functionAppName
output functionPrincipalId string = reference(functionApp.id, '2020-06-01', 'Full').identity.principalId