Skip to content

Commit 5057df0

Browse files
Niall LangleyNJLangley
Niall Langley
authored and
NJLangley
committed
Added key vault to the ARM template
1 parent 1f1d843 commit 5057df0

File tree

1 file changed

+108
-19
lines changed
  • Azure-DevTestLab/Environments/sqlcollaborative_AzureDataPipelineTools

1 file changed

+108
-19
lines changed

‎Azure-DevTestLab/Environments/sqlcollaborative_AzureDataPipelineTools/azuredeploy.json

Lines changed: 108 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -22,28 +22,41 @@
2222
},
2323
"deploymentTimestamp": {
2424
"type": "string",
25-
"defaultValue": "[utcNow()]"
25+
"defaultValue": "[utcNow('O')]"
2626
},
2727
"devopsServicePrincipalId": {
2828
"type": "string"
2929
},
3030
"adlsStorageAccountContainerName": {
3131
"type": "string",
3232
"defaultValue": "test"
33+
},
34+
"adlsStorageAccountSasProperties": {
35+
"type": "object",
36+
"defaultValue": {
37+
"signedServices": "b",
38+
"signedPermission": "rl",
39+
"signedExpiry": "[dateTimeAdd(parameters('deploymentTimestamp'), 'P7D')]",
40+
"signedResourceTypes": "c"
41+
}
3342
}
3443
},
3544
"variables": {
3645
"storageAccountApiVersion": "2021-04-01",
3746
"adlsStorageAccountName": "[concat('adls', substring(uniqueString(parameters('branch')), 0, 4), 'xxxx', substring(parameters('commit'), 0, min(length(parameters('commit')), 7)))]",
3847
"adlsStorageAccountResourceId": "[resourceId('Microsoft.Storage/storageAccounts', variables('adlsStorageAccountName'))]",
39-
//"adlsStorageAccountContainerName": "test",
48+
49+
"keyVaultApiVersion": "2021-04-01-preview",
50+
"keyVaultName": "[concat('kv', substring(uniqueString(parameters('branch')), 0, 4), 'xxxx', substring(parameters('commit'), 0, min(length(parameters('commit')), 7)))]",
4051

4152
"functionsAppApiVersion": "2015-08-01",
4253
"functionsAppBlobStorageAccountName": "[concat('funcblob', substring(uniqueString(parameters('branch')), 0, 4), 'xxxx', substring(parameters('commit'), 0, min(length(parameters('commit')), 7)))]",
4354
"functionsAppName": "[concat('func', substring(uniqueString(parameters('branch')), 0, 4), 'xxxx', substring(parameters('commit'), 0, min(length(parameters('commit')), 7)))]",
4455

4556
"authorizationApiVersion": "2018-09-01-preview",
4657

58+
59+
4760
"owner": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
4861
"contributor": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
4962
"reader": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
@@ -70,27 +83,25 @@
7083
}
7184
},
7285

73-
// 'Storage Blob Data Reader' scoped to the storage account
74-
{
75-
"type": "Microsoft.Storage/storageAccounts/providers/roleAssignments",
76-
"name": "[concat(variables('adlsStorageAccountName'),'/Microsoft.Authorization/',guid(resourceGroup().id, 'devopsServicePrincipal_adlsStorageAccount_storageBlobDataReader'))]",
77-
"apiVersion": "[variables('authorizationApiVersion')]",
78-
"properties": {
79-
"roleDefinitionId": "[variables('storageBlobDatareader')]",
80-
"principalId": "[parameters('devopsServicePrincipalId')]"
81-
},
82-
"dependsOn": [
83-
"[concat('Microsoft.Storage/storageAccounts/', variables('adlsStorageAccountName'))]"
84-
]
85-
},
86+
// // 'Storage Blob Data Reader' scoped to the storage account
87+
// {
88+
// "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments",
89+
// "name": "[concat(variables('adlsStorageAccountName'),'/Microsoft.Authorization/',guid(resourceGroup().id, 'devopsServicePrincipal_adlsStorageAccount_storageBlobDataReader'))]",
90+
// "apiVersion": "[variables('authorizationApiVersion')]",
91+
// "properties": {
92+
// "roleDefinitionId": "[variables('storageBlobDatareader')]",
93+
// "principalId": "[parameters('devopsServicePrincipalId')]"
94+
// },
95+
// "dependsOn": [
96+
// "[concat('Microsoft.Storage/storageAccounts/', variables('adlsStorageAccountName'))]"
97+
// ]
98+
// },
8699

87100
// 'Storage Blob Data Contributor' scoped to the storage account container
88101
{
89102
"type": "Microsoft.Storage/storageAccounts/blobServices/containers/providers/roleAssignments",
90-
//"name": "[concat(variables('adlsStorageAccountName'), '/default/', parameters('adlsStorageAccountContainerName'), '/Microsoft.Authorization/', guid(resourceGroup().id, 'devopsServicePrincipal_adlsStorageAccountContainer', parameters('adlsStorageAccountContainerName'), 'test_storageBlobDataContributor'))]",
91103
"name": "[concat(variables('adlsStorageAccountName'), '/default/', parameters('adlsStorageAccountContainerName'), '/Microsoft.Authorization/', guid(resourceGroup().id, parameters('devopsServicePrincipalId'), variables('adlsStorageAccountName'), parameters('adlsStorageAccountContainerName'), variables('storageBlobDataContributor')))]",
92104
"apiVersion": "[variables('authorizationApiVersion')]",
93-
//"scope": "[concat(resourceGroup().id, '/providers/Microsoft.Storage/storageAccounts/', variables('adlsStorageAccountName'), '/blobServices/containers/containers/', variables('adlsStorageAccountContainerName'))]",
94105
"properties": {
95106
"roleDefinitionId": "[variables('storageBlobDataContributor')]",
96107
"principalId": "[parameters('devopsServicePrincipalId')]"
@@ -166,8 +177,7 @@
166177
"Branch": "[parameters('branch')]",
167178
"Pull Request": "[parameters('pullRequest')]",
168179
"Create Date Time": "[parameters('deploymentTimestamp')]",
169-
"Git Project Resource Code": "ADLS",
170-
"RG": "[resourceGroup().name]"
180+
"Git Project Resource Code": "ADLS"
171181
},
172182
"resources": [
173183
// Add a container to the storage account
@@ -178,6 +188,14 @@
178188
"properties": {
179189
"publicAccess": "None"
180190
},
191+
"tags": {
192+
"Git Project": "[parameters('gitProject')]",
193+
"Commit": "[parameters('commit')]",
194+
"Branch": "[parameters('branch')]",
195+
"Pull Request": "[parameters('pullRequest')]",
196+
"Create Date Time": "[parameters('deploymentTimestamp')]",
197+
"Git Project Resource Code": "ADLSTestContainer"
198+
},
181199
"dependsOn": [
182200
"[variables('adlsStorageAccountName')]"
183201
]
@@ -186,6 +204,77 @@
186204
},
187205

188206

207+
208+
/********************************************************************************************************************************************
209+
**** Key Vault
210+
********************************************************************************************************************************************/
211+
{
212+
"type": "Microsoft.KeyVault/vaults",
213+
"apiVersion": "[variables('keyVaultApiVersion')]",
214+
"name": "[variables('keyVaultName')]",
215+
"location": "[resourceGroup().location]",
216+
"tags": {
217+
"Git Project": "[parameters('gitProject')]",
218+
"Commit": "[parameters('commit')]",
219+
"Branch": "[parameters('branch')]",
220+
"Pull Request": "[parameters('pullRequest')]",
221+
"Create Date Time": "[parameters('deploymentTimestamp')]",
222+
"Git Project Resource Code": "KeyVault",
223+
"Tenant Id": "[subscription().tenantId]"
224+
},
225+
"dependsOn": [
226+
"[variables('adlsStorageAccountName')]",
227+
"[concat('Microsoft.Storage/storageAccounts/', variables('adlsStorageAccountName'))]",
228+
"[resourceId('Microsoft.Web/sites', variables('functionsAppName'))]"
229+
],
230+
"properties": {
231+
"enabledForDeployment": true,
232+
"enabledForTemplateDeployment": true,
233+
"enabledForDiskEncryption": true,
234+
"tenantId": "[subscription().tenantId]",
235+
"accessPolicies": [
236+
{
237+
"tenantId": "[subscription().tenantId]",
238+
"objectId": "[parameters('devopsServicePrincipalId')]",
239+
"permissions": {
240+
"secrets": [
241+
"list",
242+
"get"
243+
]
244+
}
245+
},
246+
{
247+
"tenantId": "[subscription().tenantId]",
248+
"objectId": "[reference(resourceId('Microsoft.Web/sites', variables('functionsAppName')), variables('functionsAppApiVersion'), 'full').identity.principalId]",
249+
"permissions": {
250+
"secrets": [
251+
"list",
252+
"get"
253+
]
254+
}
255+
}
256+
],
257+
"sku": {
258+
"name": "standard",
259+
"family": "A"
260+
}
261+
},
262+
"resources": [
263+
{
264+
"type": "secrets",
265+
"apiVersion": "[variables('keyVaultApiVersion')]",
266+
"name": "StorageSaSToken",
267+
"dependsOn": [
268+
"[concat('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]"
269+
],
270+
"properties": {
271+
"value": "[listAccountSas(variables('adlsStorageAccountName'), variables('storageAccountApiVersion'), parameters('adlsStorageAccountSasProperties')).accountSasToken]"
272+
}
273+
}
274+
]
275+
},
276+
277+
189278
/********************************************************************************************************************************************
190279
**** Functions Apps
191280
********************************************************************************************************************************************/

0 commit comments

Comments
 (0)