Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[AVM] Updated Readme's to support AVM transition - Part (1) #4072

Merged
merged 9 commits into from
Oct 13, 2023
Merged

[AVM] Updated Readme's to support AVM transition - Part (1) #4072

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
6c6b838
Updated Readmes- batch 1
ahmadabdalla Oct 12, 2023
d53a130
updated apim
ahmadabdalla Oct 12, 2023
9c730b2
updated authz and restored postgre
ahmadabdalla Oct 12, 2023
8727a67
updates
ahmadabdalla Oct 12, 2023
c192d66
Compute
ahmadabdalla Oct 12, 2023
216d7e6
Merge remote-tracking branch 'origin/main' into users/ahmad/readmeAVM
ahmadabdalla Oct 13, 2023
5304887
Update modules/authorization/policy-set-definition/README.md
ahmadabdalla Oct 13, 2023
5f4610d
Merge branch 'users/ahmad/readmeAVM' of https://github.com/Azure/Reso…
ahmadabdalla Oct 13, 2023
2935448
Updated based on feedback
ahmadabdalla Oct 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions modules/authorization/policy-exemption/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -553,10 +553,6 @@ module policyExemption './authorization/policy-exemption/main.bicep' = {

## Notes

### Module Pre-requisites

Policy Exemptions have a dependency on Policy Assignments being applied before creating an exemption.

### Module Usage Guidance

In general, most of the resources under the `Microsoft.Authorization` namespace allows deploying resources at multiple scopes (management groups, subscriptions, resource groups). The `main.bicep` root module is simply an orchestrator module that targets sub-modules for different scopes as seen in the parameter usage section. All sub-modules for this namespace have folders that represent the target scope. For example, if the orchestrator module in the [root](main.bicep) needs to target 'subscription' level scopes. It will look at the relative path ['/subscription/main.bicep'](./subscription/main.bicep) and use this sub-module for the actual deployment, while still passing the same parameters from the root module.
Expand Down
5 changes: 0 additions & 5 deletions modules/authorization/policy-set-definition/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ This module deploys a Policy Set Definition (Initiative) at a Management Group o
- [Cross-referenced modules](#Cross-referenced-modules)
- [Deployment examples](#Deployment-examples)
- [Notes](#Notes)
- [Module Pre-requisites](#Module-Pre-requisites)

## Resource types

Expand Down Expand Up @@ -491,10 +490,6 @@ module policySetDefinition './authorization/policy-set-definition/main.bicep' =

## Notes

## Module Pre-requisites

- Policy Set Definitions (Initiatives) have a dependency on Policy Definitions being applied before creating an initiative.

### Module Usage Guidance

In general, most of the resources under the `Microsoft.Authorization` namespace allows deploying resources at multiple scopes (management groups, subscriptions, resource groups). The `main.bicep` root module is simply an orchestrator module that targets sub-modules for different scopes as seen in the parameter usage section. All sub-modules for this namespace have folders that represent the target scope. For example, if the orchestrator module in the [root](main.bicep) needs to target 'subscription' level scopes. It will look at the relative path ['/subscription/main.bicep'](./subscription/main.bicep) and use this sub-module for the actual deployment, while still passing the same parameters from the root module.
Expand Down
59 changes: 0 additions & 59 deletions modules/automation/automation-account/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ This module deploys an Azure Automation Account.
- [Outputs](#Outputs)
- [Cross-referenced modules](#Cross-referenced-modules)
- [Deployment examples](#Deployment-examples)
- [Notes](#Notes)

## Resource Types

Expand Down Expand Up @@ -891,61 +890,3 @@ module automationAccount './automation/automation-account/main.bicep' = {

</details>
<p>


## Notes

### Parameter Usage: `encryption`

Prerequisites:

- User Assigned Identity for Encryption needs `Get`, `List`, `Wrap` and `Unwrap` permissions on the key.
- User Assigned Identity have to be one of the defined identities in userAssignedIdentities parameter block.
- To use Azure Automation with customer managed keys, both `Soft Delete` and `Do Not Purge` features must be turned on to allow for recovery of keys in case of accidental deletion.

<details>

<summary>Parameter JSON format</summary>

```json
"encryptionKeySource" : {
"value" : "Microsoft.KeyVault"
},
"encryptionUserAssignedIdentity": {
"value": "/subscriptions/[[subscriptionId]]/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-[[namePrefix]]-az-msi-x-001" // this identity needs to be one of the identities defined in userAssignedIdentities section
},
"keyName" : {
"value" : "keyEncryptionKey"
},
"keyvaultUri" : {
"value" : "https://[[keyValutName]].vault.azure.net/"
},
"keyVersion" : {
"value" : "aa11b22c1234567890c3608c657cd5a2"
},
"userAssignedIdentities": {
"value": {
"/subscriptions/[[subscriptionId]]/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-[[namePrefix]]-az-msi-x-001": {}, // same value as 'encryptionUserAssignedIdentity' parameter
}
}
```

</details>

<details>

<summary>Bicep format</summary>

```bicep
encryptionKeySource: 'Microsoft.KeyVault'
encryptionUserAssignedIdentity: '/subscriptions/[[subscriptionId]]/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-[[namePrefix]]-az-msi-x-001' // this identity needs to be one of the identities defined in userAssignedIdentities section
keyName : 'keyEncryptionKey'
keyvaultUri: 'https://[[keyValutName]].vault.azure.net/'
keyVersion: 'aa11b22c1234567890c3608c657cd5a2'
userAssignedIdentities: {
'/subscriptions/[[subscriptionId]]/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-[[namePrefix]]-az-msi-x-001': {} // same value as 'encryptionUserAssignedIdentity' parameter
}
```

</details>
<p>
230 changes: 60 additions & 170 deletions modules/cognitive-services/account/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,65 @@ userAssignedIdentities: {
</details>
<p>

### Parameter Usage: `roleAssignments`
AlexanderSehr marked this conversation as resolved.
Show resolved Hide resolved

Create a role assignment for the given resource. If you want to assign a service principal / managed identity that is created in the same deployment, make sure to also specify the `'principalType'` parameter and set it to `'ServicePrincipal'`. This will ensure the role assignment waits for the principal's propagation in Azure.

<details>

<summary>Parameter JSON format</summary>

```json
"roleAssignments": {
"value": [
{
"roleDefinitionIdOrName": "Reader",
"description": "Reader Role Assignment",
"principalIds": [
"12345678-1234-1234-1234-123456789012", // object 1
"78945612-1234-1234-1234-123456789012" // object 2
]
},
{
"roleDefinitionIdOrName": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",
"principalIds": [
"12345678-1234-1234-1234-123456789012" // object 1
],
"principalType": "ServicePrincipal"
}
]
}
```

</details>

<details>

<summary>Bicep format</summary>

```bicep
roleAssignments: [
{
roleDefinitionIdOrName: 'Reader'
description: 'Reader Role Assignment'
principalIds: [
'12345678-1234-1234-1234-123456789012' // object 1
'78945612-1234-1234-1234-123456789012' // object 2
]
}
{
roleDefinitionIdOrName: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'
principalIds: [
'12345678-1234-1234-1234-123456789012' // object 1
]
principalType: 'ServicePrincipal'
}
]
```

</details>
<p>

## Outputs

| Output Name | Type | Description |
Expand Down Expand Up @@ -706,175 +765,6 @@ module account './cognitive-services/account/main.bicep' = {

## Notes

### Considerations
### Module Usage Guidance

- Not all combinations of parameters `kind` and `SKU` are valid and they may vary in different Azure Regions. Please use PowerShell cmdlet `Get-AzCognitiveServicesAccountSku` or another methods to determine valid values in your region.
- Not all kinds of Cognitive Services support virtual networks. Please visit the link below to determine supported services.

### Parameter Usage: `encryption`

<details>

<summary>Parameter JSON format</summary>

```json
// With customer-managed key
"encryption": {
"value": {
"keySource": "Microsoft.KeyVault",
"keyVaultProperties": {
"identityClientId": "12345678-1234-1234-1234-123456789012", // ID must be updated for new identity
"keyVaultUri": "https://adp-[[namePrefix]]-az-kv-nopr-002.vault.azure.net/",
"keyName": "keyEncryptionKey",
"keyversion": "1111111111111111111111111111111" // Version must be updated for new keys
}
}
}
// With service-managed key
"encryption": {
"value": {
"keySource": "Microsoft.CognitiveServices"
}
}
```

</details>

<details>

<summary>Bicep format</summary>

```bicep
// With customer managed key
encryption: {
keySource: 'Microsoft.KeyVault'
keyVaultProperties: {
identityClientId: '12345678-1234-1234-1234-123456789012' // ID must be updated for new identity
keyVaultUri: 'https://adp-[[namePrefix]]-az-kv-nopr-002.vault.azure.net/'
keyName: 'keyEncryptionKey'
keyversion: '1111111111111111111111111111111' // Version must be updated for new keys
}
}
// With service-managed key
encryption: {
keySource: 'Microsoft.CognitiveServices'
}
```

</details>
<p>
### Parameter Usage: `roleAssignments`

Create a role assignment for the given resource. If you want to assign a service principal / managed identity that is created in the same deployment, make sure to also specify the `'principalType'` parameter and set it to `'ServicePrincipal'`. This will ensure the role assignment waits for the principal's propagation in Azure.

<details>

<summary>Parameter JSON format</summary>

```json
"roleAssignments": {
"value": [
{
"roleDefinitionIdOrName": "Reader",
"description": "Reader Role Assignment",
"principalIds": [
"12345678-1234-1234-1234-123456789012", // object 1
"78945612-1234-1234-1234-123456789012" // object 2
]
},
{
"roleDefinitionIdOrName": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",
"principalIds": [
"12345678-1234-1234-1234-123456789012" // object 1
],
"principalType": "ServicePrincipal"
}
]
}
```

</details>

<details>

<summary>Bicep format</summary>

```bicep
roleAssignments: [
{
roleDefinitionIdOrName: 'Reader'
description: 'Reader Role Assignment'
principalIds: [
'12345678-1234-1234-1234-123456789012' // object 1
'78945612-1234-1234-1234-123456789012' // object 2
]
}
{
roleDefinitionIdOrName: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'
principalIds: [
'12345678-1234-1234-1234-123456789012' // object 1
]
principalType: 'ServicePrincipal'
}
]
```

</details>
<p>

### Parameter Usage: `networkAcls`

<details>

<summary>Parameter JSON format</summary>

```json
"networkAcls": {
"value": {
"defaultAction": "Deny",
"virtualNetworkRules": [
{
"id": "/subscriptions/<subscription-ID>/resourceGroups/resourceGroup/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>",
"ignoreMissingVnetServiceEndpoint": false
}
],
"ipRules": [
{
"value": "1.1.1.1"
},
{
"value": "<IP address or CIDR>"
}
]
}
}
```

</details>

<details>

<summary>Bicep format</summary>

```bicep
networkAcls: {
defaultAction: 'Deny'
virtualNetworkRules: [
{
id: '/subscriptions/<subscription-ID>/resourceGroups/resourceGroup/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>'
ignoreMissingVnetServiceEndpoint: false
}
]
ipRules: [
{
value: '1.1.1.1'
}
{
value: '<IP address or CIDR>'
}
]
}
```

</details>
<p>
Loading