-
Notifications
You must be signed in to change notification settings - Fork 16.1k
/
azuredeploy.json
154 lines (154 loc) · 5.55 KB
/
azuredeploy.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.5.6.12127",
"templateHash": "16023511331197397029"
}
},
"parameters": {
"location": {
"type": "string",
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "The location into which the resources should be deployed."
}
},
"tenantId": {
"type": "string",
"defaultValue": "[subscription().tenantId]",
"metadata": {
"description": "The Tenant Id that should be used throughout the deployment."
}
},
"userAssignedIdentityName": {
"type": "string",
"metadata": {
"description": "The name of the existing User Assigned Identity."
}
},
"userAssignedIdentityResourceGroupName": {
"type": "string",
"metadata": {
"description": "The name of the resource group for the User Assigned Identity."
}
},
"keyVaultName": {
"type": "string",
"defaultValue": "[format('vault-{0}', uniqueString(resourceGroup().id))]",
"metadata": {
"description": "The name of the Key Vault."
}
},
"keyVaultKeyName": {
"type": "string",
"defaultValue": "cmkey",
"metadata": {
"description": "Name of the key in the Key Vault"
}
},
"keyExpiration": {
"type": "int",
"defaultValue": "[dateTimeToEpoch(dateTimeAdd(utcNow(), 'P1Y'))]",
"metadata": {
"description": "Expiration time of the key"
}
},
"storageAccountName": {
"type": "string",
"defaultValue": "[format('storage{0}', uniqueString(resourceGroup().id))]",
"metadata": {
"description": "The name of the Storage Account"
}
}
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2021-10-01",
"name": "[parameters('keyVaultName')]",
"location": "[parameters('location')]",
"properties": {
"sku": {
"name": "standard",
"family": "A"
},
"enableSoftDelete": true,
"enablePurgeProtection": true,
"enabledForDiskEncryption": true,
"tenantId": "[parameters('tenantId')]",
"accessPolicies": [
{
"tenantId": "[parameters('tenantId')]",
"permissions": {
"keys": [
"unwrapKey",
"wrapKey",
"get"
]
},
"objectId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('userAssignedIdentityResourceGroupName')), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName')), '2018-11-30').principalId]"
}
]
}
},
{
"type": "Microsoft.KeyVault/vaults/keys",
"apiVersion": "2021-10-01",
"name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('keyVaultKeyName'))]",
"properties": {
"attributes": {
"enabled": true,
"exp": "[parameters('keyExpiration')]"
},
"keySize": 4096,
"kty": "RSA"
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
]
},
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2021-04-01",
"name": "[parameters('storageAccountName')]",
"location": "[parameters('location')]",
"sku": {
"name": "Standard_LRS"
},
"kind": "StorageV2",
"identity": {
"type": "UserAssigned",
"userAssignedIdentities": {
"[format('{0}', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('userAssignedIdentityResourceGroupName')), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName')))]": {}
}
},
"properties": {
"accessTier": "Hot",
"supportsHttpsTrafficOnly": true,
"minimumTlsVersion": "TLS1_2",
"encryption": {
"identity": {
"userAssignedIdentity": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('userAssignedIdentityResourceGroupName')), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]"
},
"services": {
"blob": {
"enabled": true
}
},
"keySource": "Microsoft.Keyvault",
"keyvaultproperties": {
"keyname": "[parameters('keyVaultKeyName')]",
"keyvaulturi": "[if(endsWith(reference(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))).vaultUri, '/'), substring(reference(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))).vaultUri, 0, sub(length(reference(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))).vaultUri), 1)), reference(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))).vaultUri)]"
}
}
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
"[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('keyVaultKeyName'))]"
]
}
]
}