More expansive examples that tie resources together

[gsuttie]

Would it be possible to create some better examples and link them from the docs pages?

I have been struggling with the following:-

1 - Create a key vault - ( that I can reference later)
2 - Create access policies / RBAC for users for the above key vault so they can access the key vault to get, set, and list secrets for example.
3 - Create a User Managed Identity and be able to then use this with other resources - some more examples on output parameters and how they work and which id to use (is it .id, /principleId etc)
4 - Add azure role assignments for the key vault to the managed identity above

Creating the resources is straightforward, tying them all together I'm finding it tricky having never really used ARM templates before.
Explanations would be good too.

An example of what I consider poor docs - https://docs.microsoft.com/en-us/azure/azure-resource-manager/bicep/outputs?tabs=azure-powershell. When using modules the output parameter example is pretty poor, a couple of examples would be much better.

[alex-frankel]

@johndowns - I wonder if this would be a good one to add to the list of "scenarios"?

[johndowns]

Potentially, although I think we already cover a lot of this in the secret scenarios page page. I agree with @gsuttie that we could do with more examples though.

For now, I'll push an update to the specific document that @gsuttie mentioned and elaborate on that example a bit.

I think we should also create a complete worked example along the lines of what @gsuttie suggested. @azMantas would you have any interest in publishing your example as a quickstart? We could link to it from the secret scenarios page once it's published.

[azMantas]

it will create a KeyVault and assign rbac roles for users. It will also create a managed identity and assign rbac role to kv.

KeyVault module

param projectName string
param environment string
param enabledForDeployment bool = true
param enabledForTemplateDeployment bool = true
param enabledForDiskEncryption bool = true
param enableRbacAuthorization bool = true
param enableSoftDelete bool = true
param enablePurgeProtection bool = true
param keyVaultRoles object = {}
param utc string = utcNow()
param location string = resourceGroup().location


var unique = take(uniqueString(resourceGroup().id), 5)
var keyVaultName = toLower('kv-${projectName}-${environment}-${unique}')


resource keyVault 'Microsoft.KeyVault/vaults@2019-09-01' = {
  name: keyVaultName
  location: location
  properties: {
    enabledForDeployment: enabledForDeployment
    enabledForTemplateDeployment: enabledForTemplateDeployment
    enabledForDiskEncryption: enabledForDiskEncryption
    tenantId: tenant().tenantId
    enableRbacAuthorization: enableRbacAuthorization
    enableSoftDelete: enableSoftDelete
    enablePurgeProtection: enablePurgeProtection
    sku: {
      name: 'standard'
      family: 'A'
    }
  }
}

module rbacKeyvault 'roleAssignments.bicep' = [for role in items(keyVaultRoles): {
  name: '${role.key}-${utc}'
  params: {
    principalID: role.value.principalId
    roledefinitionId: role.value.roleDefinitionId
    resourceNameToAssignRbac: keyVault.name
    principalType: 'User'
  }
}]

output kvName string = keyVault.name
output kvId string = keyVault.id

rbac assignment module:

param principalID array
param roledefinitionId string
param resourceNameToAssignRbac string
param principalType string = 'ServicePrincipal'

resource resource 'Microsoft.KeyVault/vaults@2021-06-01-preview' existing = {
  name: resourceNameToAssignRbac
}

resource rbac 'Microsoft.Authorization/roleAssignments@2020-08-01-preview' = [for principal in principalID: {
  name: guid(principal, roledefinitionId, resource.id)
  scope: resource
  properties:{
    roleDefinitionId: roledefinitionId
    principalId: principal
    principalType: principalType
  }
}]

User assigned managed identity module:

param projectName string
param environment string

var userAssignedIdentityName = 'id-${projectName}-${environment}'

resource userAssignedIdentities 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
  name: userAssignedIdentityName
  location: resourceGroup().location
}

output uamiId string = userAssignedIdentities.id
output uamiPrincipalId string = userAssignedIdentities.properties.principalId

Deployable file:

targetScope = 'subscription'

param projectName string
param environment string
param kvSettings object

resource targetKvRg 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  name: 'rg-targetKv'
  location: 'westeurope'
}

module kv 'KeyVault/keyVault.bicep' = {
  name: 'kv'
  scope: targetKvRg
  params: {
    environment: environment
    projectName: projectName
    keyVaultRoles: kvSettings.rbacKeyVault
  }
}

module id 'ManagedIdentity/userAssignedIdentities.bicep' = {
  scope: targetKvRg
  name: 'id'
  params: {
    environment: environment
    projectName: projectName
  }
}

module rbacKeyVaultAdmin 'KeyVault/roleAssignments.bicep' = {
  scope: targetKvRg
  name: 'rbac-kv-admin'
  params: {
    principalID: [
      id.outputs.uamiPrincipalId
    ]
    resourceNameToAssignRbac: kv.outputs.kvName 
    roledefinitionId: '/providers/Microsoft.Authorization/roleDefinitions/00482a5a-887f-4fb3-b363-3b7fe8e74483' //keyvauld admin
  }
}

parameters file:

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "projectName": {
            "value": "demo"
        },
        "environment": {
            "value": "dev"
        },
        "kvSettings": {
            "value": {
                "rbacKeyVault" : {
                    "kvAdministrator": {
                        "roleDefinitionId": "/providers/Microsoft.Authorization/roleDefinitions/00482a5a-887f-4fb3-b363-3b7fe8e74483",
                        "principalId": [
                            "d1508d82-8a2e-4854-b5ab-7c105f7e8b3e"
                        ]
                    },
                    "kvContributor": {
                        "roleDefinitionId": "/providers/Microsoft.Authorization/roleDefinitions/00482a5a-887f-4fb3-b363-3b7fe8e74483",
                        "principalId": [
                            "d1508d82-8a2e-4854-b5ab-7c105f7e8b3e"
                        ]
                    }
                }
            }
        }
    }
}

[gsuttie]

Thank you all for the above help - is there any examples you know about for creating a managed identity and then assigning azure role assignments to the MI - like I was wondering how to add the role Kevault Administrator to this manage identity for a certain keyvault.

Scenarios like this are hard to figure out for me at the moment.

[johndowns]

I've put together a quick example here.

This example is based on the guidance we published here. The example creates a key vault (using Azure RBAC for authorization) and a user-assigned managed identity, then grants the managed identity the Key Vault Administrator role over the vault.

[johndowns]

We do have some examples (in the quickstart templates repository) showing parts of this. I'll see if we can link to a few examples from the docs.

[brwilkinson]

Appears this discussion has the required responses.

@gsuttie are you okay if we mark this discussion as answered ?

[gsuttie]

Yeah thank you to all 👍

[johndowns]

We have also just made a series of updates to the RBAC scenarios doc to explain some of this more clearly too, and we've created a new quickstart that illustrates how to handle managed identity deletion given the way things work today.

[gsuttie]

Would there be anything to cover creating multiple vms and then adding a load balancer to the vms in Bicep - fighting against this for 2 days , cant figure out the loadBalancerBackendAddressPools section - still need more example of these kinds of scenarios if possible. The docs at the moment make this stuff hard to figure out.

[brwilkinson]

@gsuttie

When you have load balancers, you create as many backend pools on the Load balancer as you need, without any targets.

Then you add in the backend from the VM or VMSS NIC.

The NIC references the backend pool that it wants to join.

generic NIC module used by several resource types. e.g. VirtualMachine or VMSS

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.NIC-NIC.bicep