Add placeholder for CORS

Resolves #27

Author: simonkurtz-MSFT

shared/apim-policies/all-apis.xml

@@ -0,0 +1,29 @@
+<!--
+    This is the global All APIs policy.
+    If you want to apply CORS policies to all APIs, uncomment the CORS policy block below and make the necessary adjustments to the allowed origins.
+-->
+<policies>
+    <inbound>
+        <!--
+        <cors allow-credentials="true" terminate-unmatched-request="false">
+            <allowed-origins>
+                <origin>[ADD YOUR ORIGINS]</origin>
+            </allowed-origins>
+            <allowed-methods preflight-result-max-age="300">
+                <method>*</method>
+            </allowed-methods>
+            <allowed-headers>
+                <header>*</header>
+            </allowed-headers>
+            <expose-headers>
+                <header>*</header>
+            </expose-headers>
+        </cors>
+        -->
+    </inbound>
+    <backend>
+        <forward-request />
+    </backend>
+    <outbound />
+    <on-error />
+</policies>

shared/bicep/modules/apim/v1/apim.bicep

@@ -67,9 +67,21 @@ param apimManagedIdentityType string = 'SystemAssigned'
 param apimUserAssignedManagedIdentityId string = ''
 
 
+@description('Content of the global All APIs policy XML. If provided, sets the global policy.')
+param globalPolicyXml string = loadTextContent('../../../../apim-policies/all-apis.xml')
+
 // ------------------------------
 //    RESOURCES
 // ------------------------------
+// https://learn.microsoft.com/azure/templates/microsoft.apimanagement/service/policies
+resource apimGlobalPolicy 'Microsoft.ApiManagement/service/policies@2024-06-01-preview' = if (!empty(globalPolicyXml)) {
+  name: 'policy'
+  parent: apimService
+  properties: {
+    format: 'xml'
+    value: globalPolicyXml
+  }
+}
 
 // https://learn.microsoft.com/azure/templates/microsoft.apimanagement/service
 resource apimService 'Microsoft.ApiManagement/service@2024-06-01-preview' = {