fix: Disable Zone Redundant for all locations

[NirajC-Microsoft]

This pull request makes several updates to the infra/main.bicep file to enhance security and simplify configurations. The changes primarily involve disabling public access and zone redundancy for various resources.

Security Enhancements:

Updated allowBlobPublicAccess to always be false, regardless of the virtualNetworkEnabled setting, ensuring no public access to storage blobs.

Configuration Simplifications:

Added isZoneRedundant: false to explicitly disable zone redundancy for Cosmos DB accounts.
Updated zoneRedundant to always be false, simplifying the configuration for container app environments.## Purpose

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull Request Overview

This PR disables public blob access and zone redundancy across storage, Cosmos DB, and container app environments to improve security and simplify configuration.

• Force allowBlobPublicAccess to false on the storage account
• Explicitly set isZoneRedundant: false for Cosmos DB
• Always use zoneRedundant: false for container app environments

Reviewed Changes

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

File	Description
infra/main.bicep	Disabled blob public access unconditionally
infra/main.bicep	Added explicit isZoneRedundant: false to Cosmos DB accounts
infra/main.bicep	Hardcoded zoneRedundant: false for container app environments

Comments suppressed due to low confidence (3)

infra/main.bicep:1039

• [nitpick] Add a brief comment or update project documentation to explain why zone redundancy is being explicitly disabled for Cosmos DB accounts, so future maintainers understand the security or cost rationale.

isZoneRedundant: false

infra/main.bicep:864

• The publicNetworkAccess property still allows network-level access when virtualNetworkEnabled is false, but blob-level access is always blocked. This mismatch can cause confusion or unintended failures; consider aligning both settings (e.g., disable public network access as well or make the blob access toggle follow the same condition).

allowBlobPublicAccess: false

infra/main.bicep:1077

• [nitpick] Since this setting no longer depends on virtualNetworkEnabled, consider parameterizing zoneRedundant or removing the now-unused virtualNetworkEnabled toggle to keep configuration flexible and avoid dead code.

zoneRedundant: false