Address feedback from Copilot

Author: pamelafox

infra/core/host/container-registry.bicep

@@ -16,9 +16,6 @@ param sku object = {
 }
 param zoneRedundancy string = 'Disabled'
 
-@description('The log analytics workspace id used for logging & monitoring')
-param workspaceId string = ''
-
 // 2022-02-01-preview needed for anonymousPullEnabled
 resource containerRegistry 'Microsoft.ContainerRegistry/registries@2022-02-01-preview' = {
   name: name
@@ -36,34 +33,6 @@ resource containerRegistry 'Microsoft.ContainerRegistry/registries@2022-02-01-pr
   }
 }
 
-// TODO: Update diagnostics to be its own module
-// Blocking issue: https://github.com/Azure/bicep/issues/622
-// Unable to pass in a `resource` scope or unable to use string interpolation in resource types
-resource diagnostics 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = if (!empty(workspaceId)) {
-  name: 'registry-diagnostics'
-  scope: containerRegistry
-  properties: {
-    workspaceId: workspaceId
-    logs: [
-      {
-        category: 'ContainerRegistryRepositoryEvents'
-        enabled: true
-      }
-      {
-        category: 'ContainerRegistryLoginEvents'
-        enabled: true
-      }
-    ]
-    metrics: [
-      {
-        category: 'AllMetrics'
-        enabled: true
-        timeGrain: 'PT1M'
-      }
-    ]
-  }
-}
-
 output loginServer string = containerRegistry.properties.loginServer
 output name string = containerRegistry.name
 output resourceId string = containerRegistry.id

infra/network-isolation.bicep

@@ -17,6 +17,13 @@ param useVpnGateway bool = false
 param vpnGatewayName string = '${vnetName}-vpn-gateway'
 param dnsResolverName string = '${vnetName}-dns-resolver'
 
+// Subnet name constants
+var backendSubnetName = 'backend-subnet'
+var gatewaySubnetName = 'GatewaySubnet' // Required name for Gateway subnet
+var dnsResolverSubnetName = 'dns-resolver-subnet'
+var appServiceSubnetName = 'app-service-subnet'
+var containerAppsSubnetName = 'container-apps-subnet'
+
 module containerAppsNSG 'br/public:avm/res/network/network-security-group:0.5.1' = if (deploymentTarget == 'containerapps') {
   name: 'container-apps-nsg'
   params: {
@@ -41,7 +48,7 @@ module containerAppsNSG 'br/public:avm/res/network/network-security-group:0.5.1'
   }
 }
 
-module privateEndpointsNSG 'br/public:avm/res/network/network-security-group:0.5.1' = if (deploymentTarget == 'containerapps') {
+module privateEndpointsNSG 'br/public:avm/res/network/network-security-group:0.5.1' = {
   name: 'private-endpoints-nsg'
   params: {
     name: '${vnetName}-private-endpoints-nsg'
@@ -155,26 +162,26 @@ module vnet 'br/public:avm/res/network/virtual-network:0.6.1' = {
     subnets: union(
       [
         {
-          name: 'backend-subnet'
+          name: backendSubnetName
           addressPrefix: '10.0.8.0/24'
           privateEndpointNetworkPolicies: 'Enabled'
           privateLinkServiceNetworkPolicies: 'Enabled'
           networkSecurityGroupResourceId: privateEndpointsNSG.outputs.resourceId
         }
         {
-          name: 'GatewaySubnet' // Required name for Gateway subnet
+          name: gatewaySubnetName // Required name for Gateway subnet
           addressPrefix: '10.0.255.0/27' // Using a /27 subnet size which is minimal required size for gateway subnet
         }
         {
-          name: 'dns-resolver-subnet' // Dedicated subnet for Azure Private DNS Resolver
+          name: dnsResolverSubnetName // Dedicated subnet for Azure Private DNS Resolver
           addressPrefix: '10.0.11.0/28'
           delegation: 'Microsoft.Network/dnsResolvers'
         }
       ],
       deploymentTarget == 'appservice'
         ? [
             {
-              name: 'app-service-subnet'
+              name: appServiceSubnetName
               addressPrefix: '10.0.9.0/24'
               privateEndpointNetworkPolicies: 'Enabled'
               privateLinkServiceNetworkPolicies: 'Enabled'
@@ -183,16 +190,21 @@ module vnet 'br/public:avm/res/network/virtual-network:0.6.1' = {
           ]
         : [
             {
-              name: 'container-apps-subnet'
+              name: containerAppsSubnetName
               addressPrefix: '10.0.0.0/21'
-              networkSecurityGroupResourceId: containerAppsNSG.outputs.resourceId
               delegation: 'Microsoft.App/environments'
+              networkSecurityGroupResourceId: containerAppsNSG!.outputs.resourceId
             }
           ]
     )
   }
 }
 
+// Helper variables to find subnet resource IDs by name instead of hardcoded indices
+var dnsResolverSubnetIndex = indexOf(vnet.outputs.subnetNames, dnsResolverSubnetName)
+var backendSubnetIndex = indexOf(vnet.outputs.subnetNames, backendSubnetName)
+var appSubnetIndex = deploymentTarget == 'appservice' ? indexOf(vnet.outputs.subnetNames, appServiceSubnetName) : indexOf(vnet.outputs.subnetNames, containerAppsSubnetName)
+
 module virtualNetworkGateway 'br/public:avm/res/network/virtual-network-gateway:0.8.0' = if (useVpnGateway) {
   name: 'virtual-network-gateway'
   params: {
@@ -230,15 +242,15 @@ module dnsResolver 'br/public:avm/res/network/dns-resolver:0.5.4' = if (useVpnGa
     inboundEndpoints: [
       {
         name: 'inboundEndpoint'
-        subnetResourceId: useVpnGateway ? vnet.outputs.subnetResourceIds[2] : ''
+        subnetResourceId: useVpnGateway ? vnet.outputs.subnetResourceIds[dnsResolverSubnetIndex] : ''
       }
     ]
   }
 }
 
-output backendSubnetId string = vnet.outputs.subnetResourceIds[0]
-output privateDnsResolverSubnetId string = useVpnGateway ? vnet.outputs.subnetResourceIds[2] : ''
-output appSubnetId string = vnet.outputs.subnetResourceIds[3]
+output backendSubnetId string = vnet.outputs.subnetResourceIds[backendSubnetIndex]
+output privateDnsResolverSubnetId string = useVpnGateway ? vnet.outputs.subnetResourceIds[dnsResolverSubnetIndex] : ''
+output appSubnetId string = vnet.outputs.subnetResourceIds[appSubnetIndex]
 output vnetName string = vnet.outputs.name
 output vnetId string = vnet.outputs.resourceId
-output virtualNetworkGatewayName string = useVpnGateway ? virtualNetworkGateway.outputs.name : ''
+output virtualNetworkGatewayName string = useVpnGateway ? virtualNetworkGateway!.outputs.name : ''

infra/private-endpoints.bicep

@@ -82,7 +82,8 @@ module monitorDnsZones './core/networking/private-dns-zones.bicep' = [for monito
 }]
 // Get blob DNS zone index for monitor private link
 var blobEndpointInfo = filter(flatten(privateEndpointInfo), info => info.groupId == 'blob')
-var dnsZoneBlobIndex = empty(blobEndpointInfo) ? 0 : blobEndpointInfo[0].dnsZoneIndex
+// Assert that blob endpoints exist (required for this application)
+var dnsZoneBlobIndex = blobEndpointInfo[0].dnsZoneIndex
 
 // Azure Monitor Private Link Scope
 // https://learn.microsoft.com/azure/azure-monitor/logs/private-link-security