Skip to content

Commit 5ed010b

Browse files
seesharprunseesharprun
authored
Merge branch 'MicrosoftDocs:main' into patch-3
2 parents 59fd7d4 + 4176ecf commit 5ed010b

23 files changed

+881
-175
lines changed

‎articles/azure-resource-manager/bicep/deployment-script-vnet-private-endpoint.md

Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
---
2+
title: Run Bicep deployment script privately over a private endpoint
3+
description: Learn how to run Bicep deployment script privately over a private endpoint.
4+
ms.custom: devx-track-bicep
5+
ms.topic: how-to
6+
ms.date: 06/04/2024
7+
---
8+
9+
# Run Bicep deployment script privately over a private endpoint
10+
11+
With the [`Microsoft.Resources/deploymentScripts`](/azure/templates/microsoft.resources/deploymentscripts?pivots=deployment-language-bicep) resource API version `2023-08-01`, you can run deployment scripts privately within an Azure Container Instance (ACI).
12+
13+
## Configure the environment
14+
15+
In this setup, the ACI created by deployment script runs within a virtual network and obtains a private IP address. It then establishes a connection to a new or pre-existing storage account via a private endpoint. The `containerSettings/subnetIds` property specifies the ACI that must be deployed in a subnet of the virtual network.
16+
17+
:::image type="content" source="./media/deployment-script-vnet-private-endpoint/bicep-deployment-script-vnet-private-endpoint-diagram.jpg" alt-text="Screenshot of high-level architecture showing how the infrastructure is connected to run deployment scripts privately.":::
18+
19+
To run deployment scripts privately you need the following infrastructure as seen in the architecture diagram:
20+
21+
- Create a virtual network with two subnets:
22+
- A subnet for the private endpoint.
23+
- A subnet for the ACI, this subnet needs a `Microsoft.ContainerInstance/containerGroups` delegation.
24+
- Create a storage account without public network access.
25+
- Create a private endpoint within the virtual network configured with the `file` sub-resource on the storage account.
26+
- Create a private DNS zone `privatelink.file.core.windows.net` and register the private endpoint IP address as an A record. Link the private DNS zone to the created virtual network.
27+
- Create a user-assigned managed identity with `Storage File Data Privileged Contributor` permissions on the storage account and specify it in the `identity` property in the deployment script resource. To assign the identity, see [Identity](/azure/azure-resource-manager/bicep/deployment-script-develop#identity).
28+
- The ACI resource is created automatically by the deployment script resource.
29+
30+
The following Bicep file configures the infrastructure required for running a deployment script privately:
31+
32+
```bicep
33+
@maxLength(10) // Required maximum length, because the storage account has a maximum of 26 characters
34+
param namePrefix string
35+
param location string = resourceGroup().location
36+
param userAssignedIdentityName string = '${namePrefix}Identity'
37+
param storageAccountName string = '${namePrefix}stg${uniqueString(resourceGroup().id)}'
38+
param vnetName string = '${namePrefix}Vnet'
39+
param deploymentScriptName string = '${namePrefix}ds'
40+
41+
var roleNameStorageFileDataPrivilegedContributor = '69566ab7-960f-475b-8e7c-b3118f30c6bd'
42+
var vnetAddressPrefix = '192.168.4.0/23'
43+
var subnetEndpointAddressPrefix = '192.168.4.0/24'
44+
var subnetACIAddressPrefix = '192.168.5.0/24'
45+
46+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
47+
name: userAssignedIdentityName
48+
location: location
49+
}
50+
51+
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-04-01' = {
52+
name: storageAccountName
53+
kind: 'StorageV2'
54+
location: location
55+
sku: {
56+
name: 'Standard_LRS'
57+
}
58+
properties: {
59+
publicNetworkAccess: 'Disabled'
60+
networkAcls: {
61+
defaultAction: 'Deny'
62+
bypass: 'AzureServices'
63+
}
64+
}
65+
}
66+
67+
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-11-01' = {
68+
name: storageAccount.name
69+
location: location
70+
properties: {
71+
privateLinkServiceConnections: [
72+
{
73+
name: storageAccount.name
74+
properties: {
75+
privateLinkServiceId: storageAccount.id
76+
groupIds: [
77+
'file'
78+
]
79+
}
80+
}
81+
]
82+
customNetworkInterfaceName: '${storageAccount.name}-nic'
83+
subnet: {
84+
id: virtualNetwork::privateEndpointSubnet.id
85+
}
86+
}
87+
}
88+
89+
resource storageFileDataPrivilegedContributorReference 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
90+
name: roleNameStorageFileDataPrivilegedContributor
91+
scope: tenant()
92+
}
93+
94+
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
95+
name: guid(storageFileDataPrivilegedContributorReference.id, managedIdentity.id, storageAccount.id)
96+
scope: storageAccount
97+
properties: {
98+
principalId: managedIdentity.properties.principalId
99+
roleDefinitionId: storageFileDataPrivilegedContributorReference.id
100+
principalType: 'ServicePrincipal'
101+
}
102+
}
103+
104+
resource privateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
105+
name: 'privatelink.file.core.windows.net'
106+
location: 'global'
107+
108+
resource virtualNetworkLink 'virtualNetworkLinks' = {
109+
name: uniqueString(virtualNetwork.name)
110+
location: 'global'
111+
properties: {
112+
registrationEnabled: false
113+
virtualNetwork: {
114+
id: virtualNetwork.id
115+
}
116+
}
117+
}
118+
119+
resource resRecord 'A' = {
120+
name: storageAccount.name
121+
properties: {
122+
ttl: 10
123+
aRecords: [
124+
{
125+
ipv4Address: first(first(privateEndpoint.properties.customDnsConfigs)!.ipAddresses)
126+
}
127+
]
128+
}
129+
}
130+
}
131+
132+
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-11-01' = {
133+
name: vnetName
134+
location: location
135+
properties:{
136+
addressSpace: {
137+
addressPrefixes: [
138+
vnetAddressPrefix
139+
]
140+
}
141+
}
142+
143+
resource privateEndpointSubnet 'subnets' = {
144+
name: 'PrivateEndpointSubnet'
145+
properties: {
146+
addressPrefixes: [
147+
subnetEndpointAddressPrefix
148+
]
149+
}
150+
}
151+
152+
resource containerInstanceSubnet 'subnets' = {
153+
name: 'ContainerInstanceSubnet'
154+
properties: {
155+
addressPrefix: subnetACIAddressPrefix
156+
delegations: [
157+
{
158+
name: 'containerDelegation'
159+
properties: {
160+
serviceName: 'Microsoft.ContainerInstance/containerGroups'
161+
}
162+
}
163+
]
164+
}
165+
}
166+
}
167+
168+
resource privateDeploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
169+
name: deploymentScriptName
170+
dependsOn: [
171+
privateEndpoint
172+
privateDnsZone::virtualNetworkLink
173+
]
174+
location: location
175+
kind: 'AzurePowerShell'
176+
identity: {
177+
type: 'UserAssigned'
178+
userAssignedIdentities: {
179+
'${managedIdentity.id}' : {}
180+
}
181+
}
182+
properties: {
183+
storageAccountSettings: {
184+
storageAccountName: storageAccount.name
185+
}
186+
containerSettings: {
187+
subnetIds: [
188+
{
189+
id: virtualNetwork::containerInstanceSubnet.id
190+
}
191+
]
192+
}
193+
azPowerShellVersion: '9.0'
194+
retentionInterval: 'P1D'
195+
scriptContent: 'Write-Host "Hello World!"'
196+
}
197+
}
198+
```
199+
200+
The ACI downloads container images from the Microsoft Container Registry. If you use a firewall, allowlist the URL [mcr.microsoft.com](https://mcr.microsoft.com) to download the image. Failure to download the container image results in the ACI entering a `waiting` state, eventually leading to a timeout error.
201+
202+
## Next steps
203+
204+
In this article, you learned how to run deployment scripts over a private endpoint. To learn more:
205+
206+
> [!div class="nextstepaction"]
207+
> [Use deployment scripts in Bicep](./deployment-script-bicep.md)

‎articles/azure-resource-manager/bicep/media/deployment-script-vnet-private-endpoint/bicep-deployment-script-vnet-private-endpoint-diagram.jpg

158 KB
Loading

‎articles/azure-resource-manager/bicep/toc.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,9 @@
400400
- name: Access private virtual networks
401401
displayName: deployment script
402402
href: deployment-script-vnet.md
403+
- name: Use over private Endpoint
404+
displayName: deployment script
405+
href: deployment-script-vnet-private-endpoint.md
403406
- name: Create script development environments
404407
displayName: deployment script
405408
href: deployment-script-bicep-configure-dev.md

‎articles/communication-services/quickstarts/voice-video-calling/get-started-with-closed-captions.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
title: Quickstart - Add closed captions to your app
33
titleSuffix: An Azure Communication Services quickstart
44
description: In this quickstart, you'll learn how to add closed captions to your existing calling app using Azure Communication Services.
5-
author: RinaRish
6-
ms.author: ektrishi
7-
ms.date: 02/02/2022
5+
author: Kunaal
6+
ms.author: kpunjabi
7+
ms.date: 04/15/2024
88
ms.topic: quickstart
99
ms.service: azure-communication-services
1010
ms.subservice: calling
11-
zone_pivot_groups: acs-plat-web-ios-android
11+
zone_pivot_groups: acs-plat-web-ios-android-windows
1212
ms.custom: mode-api, devx-track-js
1313
---
1414

@@ -21,6 +21,10 @@ ms.custom: mode-api, devx-track-js
2121
[!INCLUDE [Closed Captions for Web](./includes/closed-captions/closed-captions-javascript.md)]
2222
::: zone-end
2323

24+
::: zone pivot="platform-windows"
25+
[!INCLUDE [Video Calling with Windows](./includes/closed-captions/closed-captions-windows.md)]
26+
::: zone-end
27+
2428
::: zone pivot="platform-android"
2529
[!INCLUDE [Closed Captions for Android](./includes/closed-captions/closed-captions-android.md)]
2630
::: zone-end

0 commit comments

Comments
 (0)