Skip to content

microsoft/CSANestedTemplates

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

20 Commits

Templates

Templates

 
 

dsc

dsc

 
 

CODE_OF_CONDUCT.md

CODE_OF_CONDUCT.md

 
 

LICENSE

LICENSE

 
 

README.md

README.md

 
 

SECURITY.md

SECURITY.md

 
 

Repository files navigation

Nested Teamplates

The Nested Templates are built to be generic in nature with the ability to pass in the values needed to build your specific architecture. Below you will find details on how to utilize each of the nested templates in this folder:

Table of Contents

Network Templates

VNet Template

This template will deploy a Virtual Network in Azure. It accepts a dynamic list of Subnets with their IP Ranges.

Typical Nested Template used before

NA

Typical Nested Template used after

NSG-Empty-ExistingSubnet
NSG-ExistingSubnet

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
vNETName Name of the Virtual Network pocVNET
addressRange Address Range the the entire subnet 10.0.0.0/16
subnets Array of subnets with their IP Range. The subnet range should be seperated from the IP Range with the | deliminator ["subnetA|10.0.1.0/24","subnetB|10.0.2.0/24","subnetC|10.0.3.0/24"]

Output

"vnetId": The resource id of the VNet created

Sample Deployment

{
  "name": "deployVNET",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployVNETTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "vNETName": {
        "value": "pocVNET"
      },
      "addressRange": {
        "value": "10.0.0.0/16"
      },
      "subnets": {
        "value": [
            "subnetA\|10.0.1.0/24",
            "subnetB\|10.0.2.0/24",
            "subnetC\|10.0.3.0/24"
        ]
      }
    }
  }
}

NSG-EMPTY-ExistingSubnet Template

This template will deploy an empty NSG and attach it to an exising Subnet

Typical Nested Template used before

VNet

Typical Nested Template used after

WindowsVirtualMachine
LinuxVirtualMachine
APIM
AppGW
AzureRedisCache
PrivateAKSMICluster
PrivateEndpoint

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
virtualNetworkName Name of the existing Virtual Network pocVNET
subnetName Name of the subnet in the existing VNet to attach the NSG to subnetA
addressPrefix The IP range of the subnet attaching the NSG to 10.0.1.0/24
nsgName Name of the NSG subnetA-NSG
privateEndpointNetworkPolicies Boolean on if private endpoint network policies are enabled false

Output

na

Sample Deployment

  {
    "name": "deployAKSNSG",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "getAKSAddressPrefix"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('deployNSGEmptySETemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "virtualNetworkName": {
          "value": "[variables('vnetName')]"
        },
        "subnetName": {
          "value": "AKS-SN"
        },
        "addressPrefix": {
          "value": "[reference('getAKSAddressPrefix').outputs.addressPrefix.value]"
        },
        "nsgName": {
          "value": "AKS-NSG"
        },
        "privateEndpointNetworkPolicies": {
          "value": false
        }
    }
  }

NSG-EMPTY-ExistingSubnet with Service EndpointTemplate

This template will deploy an empty NSG and attach it to an exising Subnet

Typical Nested Template used before

VNet

Typical Nested Template used after

WindowsVirtualMachine
LinuxVirtualMachine
APIM
AppGW
AzureRedisCache
PrivateAKSMICluster
PrivateEndpoint

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
virtualNetworkName Name of the existing Virtual Network pocVNET
subnetName Name of the subnet in the existing VNet to attach the NSG to subnetA
addressPrefix The IP range of the subnet attaching the NSG to 10.0.1.0/24
nsgName Name of the NSG subnetA-NSG
privateEndpointNetworkPolicies Boolean on if private endpoint network policies are enabled false
serviceEndpoints Array of the service endpoints to enable ["Microsoft.Sql"]

Output

na

Sample Deployment

  {
    "name": "deployAKSNSG",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "getAKSAddressPrefix"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('deployNSGEmptySETemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "virtualNetworkName": {
          "value": "[variables('vnetName')]"
        },
        "subnetName": {
          "value": "AKS-SN"
        },
        "addressPrefix": {
          "value": "[reference('getAKSAddressPrefix').outputs.addressPrefix.value]"
        },
        "nsgName": {
          "value": "AKS-NSG"
        },
        "privateEndpointNetworkPolicies": {
          "value": false
        },
        "serviceEndpoints": {
          "value": [
            "Microsoft.Sql"
          ]
        }
    }
  }

NSG-ExistingSubnet Template

This template will deploy an NSG and attach it to an exising Subnet. You pass in the NSG rules for the NSG using an array.

Typical Nested Template used before

VNet

Typical Nested Template used after

WindowsVirtualMachine
LinuxVirtualMachine
APIM
AppGW
AzureRedisCache
PrivateAKSMICluster
PrivateEndpoint

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
virtualNetworkName Name of the existing Virtual Network pocVNET
subnetName Name of the subnet in the existing VNet to attach the NSG to subnetA
addressPrefix The IP range of the subnet attaching the NSG to 10.0.1.0/24
nsgName Name of the NSG subnetA-NSG
securityRules Array of security rules with a | deleminator RuleName|Description|Protocol|Source Port Range|Destination Port Range|Source Address Prefix|Destination Address Prefix|Access|Priority|Direction
privateEndpointNetworkPolicies Boolean on if private endpoint network policies are enabled false

Output

na

Sample Deployment

{
  "name": "deployAKSNSG",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployVNET"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployNSGTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "virtualNetworkName": {
        "value": "pocVNET"
      },
      "subnetName": {
        "value": "subnetB"
      },
      "addressPrefix": {
        "value": "[reference(resourceId(resourceGroup().name, 'Microsoft.Network/virtualNetworks/subnets', 'pocVNEt', 'subnetB'), '2018-03-01').addressPrefix]"
      },
      "nsgName": {
        "value": "subnetB-NSG"
      },
      "securityRules": {
        "value": [
          "deny-all|Deny-All-Traffic|Tcp|*|*|*|*|Deny|500|Inbound",
          "allow-443|Allow-SSL|Tcp|*|443|*|*|Allow|100|Inbound",
          "allow-8080|Allow-SSL|Tcp|*|8080|*|*|Allow|110|Inbound",
          "allow-HealthProbe|Allow-AppGWHealth|Tcp|*|65200-65535|*|*|Allow|120|Inbound"
        ]
      },
      "privateEndpointNetworkPolicies": {
        "value": false
      }
    }
  }
}

NSG-ExistingSubnet with Service Endpoints Template

This template will deploy an NSG and attach it to an exising Subnet. You pass in the NSG rules for the NSG using an array.

Typical Nested Template used before

VNet

Typical Nested Template used after

WindowsVirtualMachine
LinuxVirtualMachine
APIM
AppGW
AzureRedisCache
PrivateAKSMICluster
PrivateEndpoint

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
virtualNetworkName Name of the existing Virtual Network pocVNET
subnetName Name of the subnet in the existing VNet to attach the NSG to subnetA
addressPrefix The IP range of the subnet attaching the NSG to 10.0.1.0/24
nsgName Name of the NSG subnetA-NSG
securityRules Array of security rules with a | deleminator RuleName|Description|Protocol|Source Port Range|Destination Port Range|Source Address Prefix|Destination Address Prefix|Access|Priority|Direction
privateEndpointNetworkPolicies Boolean on if private endpoint network policies are enabled false
serviceEndpoints Array of the service endpoints to enable ["Microsoft.Sql"]

Output

na

Sample Deployment

{
  "name": "deployAKSNSG",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployVNET"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployNSGTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "virtualNetworkName": {
        "value": "pocVNET"
      },
      "subnetName": {
        "value": "subnetB"
      },
      "addressPrefix": {
        "value": "[reference(resourceId(resourceGroup().name, 'Microsoft.Network/virtualNetworks/subnets', 'pocVNEt', 'subnetB'), '2018-03-01').addressPrefix]"
      },
      "nsgName": {
        "value": "subnetB-NSG"
      },
      "securityRules": {
        "value": [
          "deny-all|Deny-All-Traffic|Tcp|*|*|*|*|Deny|500|Inbound",
          "allow-443|Allow-SSL|Tcp|*|443|*|*|Allow|100|Inbound",
          "allow-8080|Allow-SSL|Tcp|*|8080|*|*|Allow|110|Inbound",
          "allow-HealthProbe|Allow-AppGWHealth|Tcp|*|65200-65535|*|*|Allow|120|Inbound"
        ]
      },
      "privateEndpointNetworkPolicies": {
        "value": false
      },
      "serviceEndpoints": {
          "value": [
            "Microsoft.Sql"
          ]
      }
    }
  }
}

Public IP Address Template

This template will deploy standard sku Public IP Address

Typical Nested Template used before

NA

Typical Nested Template used after

WindowsVirtualMachine
LinuxVirtualMachine
AppGW

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
publicIpAddressName Name of the public IP poc-pip
sku SKU for the Public IP. Either basic or standard Standard
allocationMethod Static or Dynamic allocation of IP Static

Output

"publicIPID": The resource id of the public ip created

Sample Deployment

{
  "name": "deployPublicIP1",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployPublicIPTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "publicIpAddressName": {
        "value": "pocpip"
      },
      "sku": {
          "value": "Standard"
      },
      "allocationMethod": {
          "value": "Static"
      }
    }
  }
}

Get Network Interface IP Template

This template will return the first IP address assigned to a Azure Network Interface. This can be used to get an IP so you can add it to a Private DNS Zone

Typical Neted Template used before

PrivateEndpoint
WindowsVirtualMachine
LinuxVirtualMachine

Typical Nested Template used after

PrivateDNSARecord

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
nicID ResourceId for the network interface [reference('deploySqlServerPE').outputs.nicID.value]

Output

"nicIP": IP Address of the NIC

Sample Deployment

{
  "name": "getSqlServerNICIP",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deploySqlServerPE"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('getNICIPUrL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "nicID": {
        "value": "[reference('deploySqlServerPE').outputs.nicID.value]"
      }
    }
  }
}

Private Endpoint

This template will create a Private Endpoint for any PaaS Service that has this functionality

Typical Neted Template used before

Any PaaS Service that can utilize a Private Endpoint

Typical Nested Template used after

PrivateDNSZone

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
peName Private Endpoint resource name poc-sql-ep
resourceID ResourceId for the network interface [reference('deploySqlDb').outputs.sqlServerId.value]
vnetID ResourceId for the Virtual Network the Private Endpoint wil sit on [reference('deployVNET').outputs.vnetId.value]
subnetName Name of the subnet to palce the private endpoint on PrivateEP-SN
groupID The ID(s) of the group(s) obtained from the remote resource that this private endpoint should connect to. - string SqlServer

Output

"nicID": Resource ID of the virtual nic created by the Private Endpoint

Sample Deployment

{
  "name": "deploySqlServerPE",
  "comments":"",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deploySqlDb",
    "deployVNET"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployPrivateEndpointURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "peName": {
        "value": "[concat(parameters('sqlServerName'),'_pe')]"
      },
      "resourceID": {
        "value": "[reference('deploySqlDb').outputs.sqlServerId.value]"
      },
      "vnetID": {
        "value": "[reference('deployVNET').outputs.vnetId.value]"
      },
      "subnetName": {
        "value": "PrivateEP-SN"
      },
      "groupID": {
        "value": "SqlServer"
      }
    }
  }
}

Private DNS Zone

This template will create a Private DNS Zone and attach it to a VNet. This is often used to resolve Private Endpoints within Azure.

Typical Neted Template used before

PrivateEndpoint

Typical Nested Template used after

PrivateDNSARecord

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
zoneName The DNS zone name privatelink.database.windows.net
vnetID ResourceId for the Virtual Network Private DNS Zone will attach to [reference('deployVNET').outputs.vnetId.value]

Output

na

Sample Deployment

{
  "name": "deploySqlDbDNSZone",
  "comments":"",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "getSqlServerNICIP"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployDNSZoneTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "zone_name": {
        "value": "privatelink.database.windows.net"
      },
      "vnet_id": {
        "value": "[reference('deployVNET').outputs.vnetID.value]"
      }
    }
  }
}

Private DNS A Record

This template will create an A Record in an Azure Private DNS Zone

Typical Neted Template used before

PrivateDNSZone GetNicIP

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
zoneName The DNS zone name privatelink.database.windows.net
recordName Name of the record to be created [parameters('sqlServerName')]
recordValue IP Address to be associated with the A record [reference('getSqlServerNICIP').outputs.nicIP.value]

Output

na

Sample Deployment

{
  "name": "createSqlDbARecord",
  "comments":"",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "getSqlServerNICIP"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployDNSARecordTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "zoneName": {
        "value": "privatelink.database.windows.net"
      },
      "recordName": {
        "value": "[parameters('sqlServerName')]"
      },
      "recordValue": {
        "value": "[reference('getSqlServerNICIP').outputs.nicIP.value]"
      }
    }
  }
}

This template will retrieve the address prefix for a subnet.

Typical Neted Template used before

NSG-Empty-ExistingSubnet
NSG-Empty-ExistingSubnetSE
NSG-ExistingSubnet
NSG-ExistingSubnetSE

Typical Nested Template used after

VNet

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
vnetName Name of the virtual network poc-vnet
subnetName Name of the subnet within the virtual network poc-subnet

Output

na

Sample Deployment

  {
    "name": "getAKSAddressPrefix",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deployAppGWNSG"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('getSubnetAddressPrefixTemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "vnetName": {
          "value": "[variables('vnetName')]"
        },
        "subnetName": {
          "value": "AKS-SN"
        }
      }
    }
  }

Storage Templates

Storage Account

This template will create a storage account.

Typical Neted Template used before

NA

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
saName The name of the storage account pocsa
skuName Name of the record to be created. Allowed values: Standard_LRS,Standard_GRS,Standard_RAGRS,Standard_ZRS,Premium_LRS,Premium_ZRS,Standard_GZRS,Standard_RAGZRS Standard_LRS
skuTier Standard or Premium Standard

Output

saId: Resource ID of the storage account saConnectionString: Connection string for the storage account

Sample Deployment

{
  "name": "createSqlDbARecord",
  "comments":"",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "getSqlServerNICIP"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployDNSARecordTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "zoneName": {
        "value": "privatelink.database.windows.net"
      },
      "recordName": {
        "value": "[parameters('sqlServerName')]"
      },
      "recordValue": {
        "value": "[reference('getSqlServerNICIP').outputs.nicIP.value]"
      }
    }
  }
}

Managed Identity Template

User Assigned Managed Identity Template

This template will create a User Assigned Managed Identity.

Typical Nested Template used before

NA

Typical Nested Template used after

AppGWHTTPSListenerKV
WindowsVirtualMachine
LinuxVirtualMachine

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
identityName Name of the identity to be created pocGW-Identity

Output

"principalId": The principal ID of the Managed Identity that was created
"resourceId": The resource id of the Managed Identity that was created

Sample Deployment

{
  "name": "createManagedIdentity",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "resourceGroup": "[parameters('resourceGroup')]",
  "dependsOn": [
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('createManagedIdentityTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "identityName": {
          "value": "[concat(parameters('applicationGatewayName'),'-identity')]"
      }
    }
  }
}

Monitoring Template

Application Insights Template

This template will create an Application Insights.

Typical Nested Template used before

NA

Typical Nested Template used after

APIM

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
name Application Insights instance name poc-appinsights

Output

"appInsightsID": The resource id of the Application Insights instance that was created

Sample Deployment

{
  "name": "deployAppInsights",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployAppInsightsTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "name": {
        "value": "[parameters('appInsightsName')]"
      }
    }
  }
}

Log Analytics Workspace Template

This template will create a Log Analytics Workspace.

Typical Nested Template used before

NA

Typical Nested Template used after

VMInsights
DiagnosticSettings

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
workspaceName Log Analytics workspace name poc-laworkspace

Output

"workspaceId": The resource id of the Log Analytics Workspace that was created
"workspaceKey": The primary key for the workspace "customerId": The customer id for the workspace

Sample Deployment

{
  "name": "deployLAWorkspace",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployLogAnalyticsURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "workspaceName": {
        "value": "[parameters('workspaceName')]"
      }
    }
  }
}

Enabled VM Insights on an Existing VM Template

This template will enable VM Insights (Azure Monitor for VMs) to an existing VM

Typical Neted Template used before

Log_Analytics_Workspace
WindowsVirtualMachine
LinuxVirtualMachine

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
vmResourceId ResourceId for the VM to be monitored [reference('deployJumpBox').outputs.vmID.value]
osType Linux or Windows Windows
workspaceResourceId Resource ID of the log analytics workspace to use [reference('deployLAWorkspace').outputs.workspaceId.value]

Output

NA

Sample Deployment

{
  "name": "addJumpBoxInsights",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployJumpBox"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('addVMInsightsURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "VmResourceId": {
        "value": "[reference('deployJumpBox').outputs.vmID.value]"
      },
      "osType": {
        "value": "Windows"
      },
      "WorkspaceResourceId": {
        "value": "[reference('deployLAWorkspace').outputs.workspaceId.value]"
      }
    }
  }
}

Enabled APIM Diagnostic Template

This template will enable all diagnostic settings on a APIM resource to be sent to Log Aanalytic

Typical Neted Template used before

Log_Analytics_Workspace
APIM

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
workspaceId ResourceId for thelog analytics workspace to use [reference('deployLAWorkspace').outputs.workspaceId.value]
logs Array of logs to collect from diagnostic settings ["GatewayLogs"]
metrics Arra of metrics to collect from diagnostic settings ["Capacity"]
apimName Name of the APIM resource poc-apim

Output

NA

Sample Deployment

NA

Enabled AppGW Diagnostic Template

This template will enable all diagnostic settings on a APIM resource to be sent to Log Aanalytic

Typical Neted Template used before

Log_Analytics_Workspace
AppGWHTTPListener
AppGWHTTPSListener

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
workspaceId ResourceId for thelog analytics workspace to use [reference('deployLAWorkspace').outputs.workspaceId.value]
logs Array of logs to collect from diagnostic settings ["ApplicationGatewayAccessLog","ApplicationGatewayPerformanceLog","ApplicationGatewayFirewallLog"]
metrics Arra of metrics to collect from diagnostic settings ["AllMetrics"]
appgwName Name of the APIM resource poc-apim

Output

NA

Sample Deployment

  {
    "name": "deployAppGWDiagnostics",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deployAppGW",
      "deployLogAnalytics"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('deployAppGWDiagnosticsTemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "workspaceId": {
            "value": "[reference('deployLogAnalytics').outputs.workspaceId.value]"
        },
        "logs": {
            "value": [
              "ApplicationGatewayAccessLog",
              "ApplicationGatewayPerformanceLog",
              "ApplicationGatewayFirewallLog"
            ]
        },
        "metrics": {
            "value": [
              "AllMetrics"
            ]
        },
        "appgwName": {
          "value": "[variables('applicationGatewayName')]"
        }
      }
    }  
  }

Enabled Azure SQL DB Diagnostic Template

This template will enable diagnostic settings on a Bastion resource to be sent to Log Aanalytic

Typical Neted Template used before

Log_Analytics_Workspace
AzureBastion

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
workspaceId ResourceId for thelog analytics workspace to use [reference('deployLAWorkspace').outputs.workspaceId.value]
logs Array of logs to collect from diagnostic settings ["BastionAuditLogs"]
bastionName Name of the Bastion resource poc-bastion

Output

NA

Sample Deployment

  {
    "name": "deployAzureBastionDiagnostics",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deployAzureBastion",
      "deployLogAnalytics"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('deployAzureBastionDiagnosticsTemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "workspaceId": {
            "value": "[reference('deployLogAnalytics').outputs.workspaceId.value]"
        },
        "logs": {
            "value": [
              "BastionAuditLogs"
            ]
        },
        "bastionName": {
          "value": "[variables('bastionHostName')]"
        }
      }
    }  
  }

Enabled AppGW Diagnostic Template

This template will enable diagnostic settings on an Azure SQL DB resource to be sent to Log Aanalytic

Typical Neted Template used before

NA

Typical Nested Template used after

Log_Analytics_Workspace
SQLDB

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
workspaceId ResourceId for thelog analytics workspace to use [reference('deployLAWorkspace').outputs.workspaceId.value]
logs Array of logs to collect from diagnostic settings ["AutomaticTuning","Errors","Timeouts","Deadlocks"]
metrics Array of metrics to collect from diagnostic settings ["Basic","InstanceAndAppAdvanced","WorkloadManagement"]
sqldbName Name of the Azure SQL DB resource poc-database

Output

NA

Sample Deployment

  {
    "name": "deploySQLDBDiagnostics",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deploySqlDb",
      "deployLogAnalytics"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('deploySQLDBDiagnosticsTemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "workspaceId": {
            "value": "[reference('deployLogAnalytics').outputs.workspaceId.value]"
        },
        "logs": {
            "value": [
              "AutomaticTuning",
              "QueryStoreRuntimeStatistics",
              "QueryStoreWaitStatistics",
              "Errors",
              "DatabaseWaitStatistics",
              "Timeouts",
              "Blocks",
              "Deadlocks"
            ]
        },
        "metrics": {
            "value": [
              "Basic",
              "InstanceAndAppAdvanced",
              "WorkloadManagement"
            ]
        },
        "sqldbName": {
          "value": "[concat(variables('sqlServerName'),'/',variables('sqlDatabaseName'))]"
        }
      }
    }  
  }

Security Template

Key Vault Template

This template will deploy an Azure Key Vault

Typical Nested Template used before

NA

Typical Nested Template used after

KeyVaultAccessPolicy
KeyVaultSecrets

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
vaultName Key Vault name poc-keyvault

Output

"vaultId": The resource id of the Key Vault that was created

Sample Deployment

{
  "name": "deployKeyVault",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployLAWorkspace"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployKeyVaultURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "vaultName": {
        "value": "[parameters('vaultName')]"
      },
      "workspaceID": {
        "value": "[reference('deployLAWorkspace').outputs.workspaceId.value]"
      }
    }
  }
}

Key Vault Secret Template

This template will add a secret to an Azure Key Vault

Typical Nested Template used before

KeyVault

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
vaultName Key Vault name poc-keyvault
secretName Secret name to add to Key Vault supersecret
contentType Type of data being added to secret text/plain
value Value of the secret being added supersecretvalue

Output

NA

Sample Deployment

{
  "name": "addKeyVaultSecret",
  "type": "Microsoft.Resources/deployments",
  "resourceGroup": "[parameters('keyVaultResourceGroup')]",
  "apiVersion": "2017-05-10",
  "dependsOn": [
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('addKeyVaultSecretTemplate')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "keyVaultName": {
          "value": "[parameters('keyVaultName')]"
      },
      "secretName": {
        "value": "[parameters('keyVaultSecretName')]"
      },
      "contentType": {
          "value": "[parameters('keyVaultContentType')]"
      },
      "value": {
          "value": "[parameters('keyVaultSecretValue')]"
      }
    }
  }
}

Key Vault Access Policy Template

This template will create an acces policy to secrets in an existing Key Vault. It is currently limited to grating rights to secrets.

RBAC Role Assignment

This template will assign a RBAC Role to a principal id

Typical Neted Template used before

NA

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
roleAssignmentName Name of the role assignment AKS Custom Admin
roleDefinitionId Role ID that you are assigning "4d97b98b-1d4f-4787-a291-c67834d212e7"
principalId Principal ID that will be assigned the role "[reference('deployAKSCluster').outputs.aksPrincipalId.value"
scope Scope of the role assignment "[concat(subscription().id,'/resourceGroups/',parameters('resourceGroup'))]"

Output

na

Sample Deployment

  {
    "name": "grantAKSMINetworkRole",
    "comments":"",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deployAKSCluster"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('grantRBACTemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "roleAssignmentName": {
          "value": "[parameters('aksNetworkGuid')]"
        },
        "roleDefinitionId": {
          "value": "4d97b98b-1d4f-4787-a291-c67834d212e7"
        },
        "principalId": {
          "value": "[reference('deployAKSCluster').outputs.aksPrincipalId.value]"
        },
        "scope": {
          "value": "[concat(subscription().id,'/resourceGroups/',parameters('resourceGroup'))]"
        }
      }
    }
  }

<a name=IaaSTemplates">IaaS Templates

Ubuntu Virtual Machine

This template will create a Ubuntu Virtual Machine.

Typical Neted Template used before

VNet

Typical Nested Template used after

EnableVMInsights

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
subnetName Subnet name where the nic will be placed shared-SN
virtualNetworkId VNet ID where the nic will be placed [reference('deployVNet').outputs.vnetID.value]
virtualMachineName Name of the Virtual Machine pocVM
ubuntuOSVersion Allowd values: 18.04-LTS, 16.04-LTS, 14.04.4-LTS 18.04-LTS
adminUsername Administrator username LinuxAdmin
adminPassword Administrator password ABCabc1234
zone Availability zone to place the VM 1

Output

"vmID": Resource id of the virtual machine created
"nicID": Resource id of the nic created

Sample Deployment

{
  "name": "deployUbuntuBox",
  "comments":"NOTE: OS and Datadisks cannot be tagged when provisioned within VM.  Would need to provision DISK with tags first, then reference",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployVNET"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployUbuntuServerTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "subnetID": {
        "value": "[reference('deployVNET').outputs.sharedSubnetID.value]"
      },
      "virtualMachineName": {
        "value": "[parameters('ubuntuName')]"
      },
      "virtualMachineSize": {
        "value": "[parameters('ubuntuSize')]"
      },
      "adminUsername": {
        "value": "[parameters('adminUserName')]"
      },
      "adminPassword": {
        "value": "[parameters('adminPassword')]"
      },
      "ubuntuOSVersion": {
        "value": "18.04-LTS"
      },
      "zone": {
        "value": "1"
      }
    }
  }
}

Windows Virtual Machine

This template will create a Windows Virtual Machine.

Typical Neted Template used before

VNet

Typical Nested Template used after

EnableVMInsights

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
subnetID Subnet ID where the nic will be placed [concat(reference('deployVNET').outputs.vnetId.value,'/subnets/Shared-SN')]
virtualMachineName Name of the Virtual Machine pocVM
virtualMachineSize Azure VM Size for the VM Standard_DS1_v2
adminUsername Administrator username WindowsAdmin
adminPassword Administrator password ABCabc1234
sku Sku for the virtual machine being deployed 2019-Datacenter

Output

"vmID": Resource id of the virtual machine created
"nicID": Resource id of the nic created

Sample Deployment

  {
    "name": "deployJumpBox",
    "comments":"NOTE: OS and Datadisks cannot be tagged when provisioned within VM.  Would need to provision DISK with tags first, then reference",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deployVNET"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('deployWindowsServerTemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "subnetID": {
          "value": "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/Shared-SN')]"
        },
        "virtualMachineName": {
          "value": "[variables('jumpName')]"
        },
        "virtualMachineSize": {
          "value": "[variables('jumpSize')]"
        },
        "adminUsername": {
          "value": "[parameters('adminUserName')]"
        },
        "adminPassword": {
          "value": "[parameters('adminPassword')]"
        },
        "sku": {
          "value": "[variables('jumpSKU')]"
        }
      }
    }
  }

Azure Bastion Template

This template will deploy an Azure Bastion to an existing VNET

Typical Neted Template used before

Vnet
PublicIPAddress

Typical Nested Template used after

WindowsVirtualMachine
LinuxVirtualMachine

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
bastionHostName Name for the bastion host poc-bastionhost
subnetId SubnetID of the subnet dedicated to Azure Bastion [concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AzureBastionSubnet')]
publicIpId Resource ID of the public ip for the bastion host [reference('deployPublicIPBastion').outputs.publicIPID.value]

Output

NA

Sample Deployment

{
  "name": "deployPublicIPBastion",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "resourceGroup": "[parameters('resourceGroup')]",
  "dependsOn": [],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployPublicIPTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "publicIpAddressName": {
        "value": "[concat(parameters('bastionHostName'),'pip1')]"
      },
      "sku": {
          "value": "Standard"
      },
      "allocationMethod": {
          "value": "Static"
      }
    }
  }
},
{
  "name": "deployAzureBastion",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployVNET"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployAzureBastionTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "bastionHostName": {
          "value": "[parameters('bastionHostName')]"
      },
      "subnetId": {
          "value": "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AzureBastionSubnet')]"
      },
      "publicIpId": {
          "value": "[reference('deployPublicIPBastion').outputs.publicIPID.value]"
      }
    }
  }
}

Load Balancer Templates

AppGW with HTTP Listener Template

This template will deploy an Application Gateway with a HTTP Listeners and Basic routing rules. Note this does not deploy path based routing or a private IP listener

Typical Nested Template used before

PublicIPAddress

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
applicationGatewayName Name of the Application Gateway pocAppGW
tier Standard, WAF, Standard_v2, WAF_v2 WAF_v2
skuSize Name of an application gateway SKU. - Standard_Small, Standard_Medium, Standard_Large, WAF_Medium, WAF_Large, Standard_v2, WAF_v2 WAF_v2
minCapacity Min number of AppGW Capacity 2
maxCapacity Min number of AppGW Capacity 4
zones The Availability Zones the AppGW can be scaled to ["1","2","3"]
subnetID Resource ID of the subnet the AppGW will sit on "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AppGW-SN')]"
publicIpAddressesId Public IP for the Frontend. Format: name|publicIP Resource ID [
"[concat('PIP1|',reference('deployPublicIP1').outputs.publicIPID.value )]"
]
frontendPorts Ports that the AppGW will listen on. Format: name|port HTTP80|80
backendAddresses The backend pools for the AppGW. Format: name|backend IP or URL [
"Example1|example.com",
"Example2|example2.com"
]
backendHttpSettings The HTTP Setting for the backend pool. Format: name|port|protocol|cookieBasedAffinity|RequestTimeout|path [
"Example-App-HTTPSetting|80|Http|Disabled|30|/
]
httpListeners The HTTP Listener Settings for the frontend ip: Format: name|fronte ip config name|frontend port name [
"Example1-App-Listener/
requestRoutingRules Routing rules for the AppGW. Format: name|httpListener name|backend pool name|backend http setting name [
"Example1-App-RoutingRule|Example1-App-Listener|Example1-BEPool|Example-App-HTTPSetting",
"Example2-App-RoutingRule|Example2-App-Listener|Example2-BEPool|Example-App-HTTPSetting"
]

Output

na

Sample Deployment

{
  "name": "deployAppGW",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployVNET",
    "deployPublicIP1"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployAppGWHTTPListenerTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "applicationGatewayName": {
          "value": "[parameters('applicationGatewayName')]"
      },
      "tier": {
          "value": "[parameters('appgwtier')]"
      },
      "skuSize": {
          "value": "[parameters('appgwskuSize')]"
      },
      "minCapacity": {
          "value": "[parameters('appgwMinCapacity')]",
      },
      "maxCapacity": {
          "value": "[parameters('appgwMaxCapacity')]",
      },
      "zones": {
          "value": "[parameters('appgwzones')]"
      },
      "subnetID": {
          "value": "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AppGW-SN')]"
      },
      "publicIpAddressesIds": {
          "value": [
            "[concat('PIP1|',reference('deployPublicIP1').outputs.publicIPID.value )]"
          ]
      },
      "frontendPorts": {
          "value": [
            "HTTP-80|80",
            "HTTP-8080|8080"
          ]
      },
      "backendAddresses": {
          "value": [
            "Example1-BEPool|bing.com",
            "Example2-BEPool|microsoft.com"
          ]
      },
      "backendHttpSettings": {
          "value": [
            "Example-App-HTTPSetting|80|Http|Disabled|30|/"
          ]
      },
      "httpListeners": {
          "value": [
            "Example1-App-Listener|PIP1|HTTP-80",
            "Example2-App-Listener|PIP1|HTTP-8080"
          ]
      },
      "requestRoutingRules": {
          "value": [
            "Example1-App-RoutingRule|Example1-App-Listener|Example1-BEPool|Example-App-HTTPSetting",
            "Example2-App-RoutingRule|Example2-App-Listener|Example2-BEPool|Example-App-HTTPSetting"
          ]
      }
    }
  }
}

AppGW with HTTPS Listener Template and Key Vault Integration

This template will deploy an Application Gateway with a HTTPS Listeners and Basic routing rules. This will pull the template from an existing key vault with the certificate uploaded. The template make the following assumptions:

  1. There will be a different certificate for each HTTP Listener
  2. There will be only a single certificate for each HTTP Listener
  3. The order of the certificate parameter will match the order you want them applied ot the HTTP Listeners

Typical Nested Template used before

PublicIPAddress
ManagedIdentity

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
applicationGatewayName Name of the Application Gateway pocAppGW
tier Standard, WAF, Standard_v2, WAF_v2 WAF_v2
skuSize Name of an application gateway SKU. - Standard_Small, Standard_Medium, Standard_Large, WAF_Medium, WAF_Large, Standard_v2, WAF_v2 WAF_v2
minCapacity Min number of AppGW Capacity 2
maxCapacity Min number of AppGW Capacity 4
zones The Availability Zones the AppGW can be scaled to ["1","2","3"]
subnetID Resource ID of the subnet the AppGW will sit on "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AppGW-SN')]"
keyVaultName The name of the Key Vault that contains the SSL certificates pocKeyVault
identityID The user Assigned Managed Identity resource ID that will be attahed to the GW and used to pull the certificates poc-identity
certificates Reference to the certificates in the Key Vault. Format: Cert Name in AppGW|Path in KeyVault [
"ARMCert|ARM/df47f485ecb1455d98eae9a950af6f47",
"ARM2Cert|ARM2/b5e5e9c31a034bffa8387ef38754333f"
]
publicIpAddressesId Public IP for the Frontend. Format: name|publicIP Resource ID [
"[concat('PIP1|',reference('deployPublicIP1').outputs.publicIPID.value )]"
]
frontendPorts Ports that the AppGW will listen on. Format: name|port HTTP80|80
backendAddresses The backend pools for the AppGW. Format: name|backend IP or URL [
"Example1|example.com",
"Example2|example2.com"
]
backendHttpSettings The HTTP Setting for the backend pool. Format: name|port|protocol|cookieBasedAffinity|RequestTimeout|path [
"Example-App-HTTPSetting|80|Http|Disabled|30|/
]
httpListeners The HTTP Listener Settings for the frontend ip: Format: name|fronte ip config name|frontend port name [
"Example1-App-Listener/
requestRoutingRules Routing rules for the AppGW. Format: name|httpListener name|backend pool name|backend http setting name [
"Example1-App-RoutingRule|Example1-App-Listener|Example1-BEPool|Example-App-HTTPSetting",
"Example2-App-RoutingRule|Example2-App-Listener|Example2-BEPool|Example-App-HTTPSetting"
]

Output

na

Sample Deployment

{
  "name": "deployAppGW",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "resourceGroup": "[parameters('resourceGroup')]",
  "dependsOn": [
    "deployVNET",
    "deployPublicIP1"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployAppGWHTTPSListenerKVTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "applicationGatewayName": {
          "value": "[parameters('applicationGatewayName')]"
      },
      "tier": {
          "value": "[parameters('appgwtier')]"
      },
      "skuSize": {
          "value": "[parameters('appgwskuSize')]"
      },
      "minCapacity": {
          "value": "[parameters('appgwMinCapacity')]",
      },
      "maxCapacity": {
          "value": "[parameters('appgwMaxCapacity')]",
      },
      "zones": {
          "value": "[parameters('appgwzones')]"
      },
      "subnetID": {
          "value": "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AppGW-SN')]"
      },
      "publicIpAddressesIds": {
          "value": [
            "[concat('PIP1|',reference('deployPublicIP1').outputs.publicIPID.value )]"
          ]
      },
      "keyVaultName": {
        "value": "[parameters('keyVaultName')]"
      },
      "identityID": {
          "value": "[reference('createManagedIdentity').outputs.resourceId.value]"
      },
      "certificates": {
          "value": "[parameters('certificates')]"
      },
      "frontendPorts": {
          "value": [
            "HTTPS-443|443",
            "HTTPS-8080|8080"
          ]
      },
      "backendAddresses": {
          "value": [
            "Example1-BEPool|bing.com",
            "Example2-BEPool|microsoft.com"
          ]
      },
      "backendHttpSettings": {
          "value": [
            "Example-App-HTTPSetting|80|Http|Disabled|30|/"
          ]
      },
      "httpListeners": {
          "value": [
            "Example1-App-Listener|PIP1|HTTPS-443",
            "Example2-App-Listener|PIP1|HTTPS-8080"
          ]
      },
      "requestRoutingRules": {
          "value": [
            "Example1-App-RoutingRule|Example1-App-Listener|Example1-BEPool|Example-App-HTTPSetting",
            "Example2-App-RoutingRule|Example2-App-Listener|Example2-BEPool|Example-App-HTTPSetting"
          ]
      }
    }
  }
}

Typical Nested Template used before

KeyVault
UserAssignedManagedIdentity

Typical Nested Template used after

AppGWHTTPSListenerKV

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
keyVaultName Name of the Key Vault to add the access polity poc-keyvault
secrets This is an array of the rights given to access secrets [ "get", "list", "set" ]
objectId This object id you want the rights granted to "[reference('createManagedIdentity').outputs.principalId.value]"

Output

NA

Sample Deployment

{
  "name": "deployKeyVaultAccess",
  "type": "Microsoft.Resources/deployments",
  "resourceGroup": "[parameters('keyVaultResourceGroup')]",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "createManagedIdentity"
  ],
  "properties": {
      "mode": "Incremental",
      "templateLink": {
      "uri": "[variables('deployKeyVaultAccessTemplate')]",
      "contentVersion": "1.0.0.0"
      },
      "parameters": {
          "keyVaultName": {
              "value": "[parameters('keyVaultName')]"
          },
          "secrets": {
              "value": [
                  "Get",
                  "List",
                  "Set",
                  "Delete",
                  "Recover",
                  "Backup",
                  "Restore"
              ]
          },
          "objectId": {
              "value": "[reference('createManagedIdentity').outputs.principalId.value]"
          }
      }
  }
}

<a name"ContainerTemplates">Container Templates

Private AKS Cluster

This template will AKS cluster with Linux nodes.

Typical Neted Template used before

VNet

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
aksResourceName The name of the Managed Cluster resource. pocAKSCluster
nodeResourceGroup The name of AKS node resource group. pocNodeRG
vnetName Name of the vnet the AKS Nodes will live pocVnet
subnetName Nameof the subnet the AKS Nodes will live AKS-SN
dnsPrefix Optional DNS prefix to use with hosted Kubernetes API server FQDN.
vmSize Size of the nodes to be deployed Standard_DS2_v2
osDiskSizeGB Size of the OS disk. Allowed values between 0-1023 1023
kubernetesVersion The version of Kubernetes. 1.7.7
networkPlugin Network plugin used for building Kubernetes network. Allowed values: azure or kubenet azure
numNodes Number of nodes to run in the cluster 3
enableRBAC Boolean flag to turn on and off of RBAC. true
enablePrivateCluster Enable private network access to the Kubernetes cluster. true
enableHttpApplicationRouting Boolean flag to turn on and off http application routing. false
networkPolicy Network policy used for building Kubernetes network. calico
vnetSubnetID Resource ID of the subnet where the nodes will exists [reference('deployVNET').outputs.aksSubnetID.value]
serviceCidr A CIDR notation IP range from which to assign service cluster IPs. 10.0.0.0/24
dnsServiceIP Containers DNS server IP address. 10.0.0.10
dockerBridgeCidr A CIDR notation IP for Docker bridge. 172.17.0.1/24

Output

"controlPlaneFQDN": The FQDN for the AKS Control Plane
"aksID": The resource id for the AKS Cluster

Sample Deployment

{
  "name": "deployPrivateAKSCluster",
  "comments":"apiVersion is flagged, but haven't changed as not sure if this is needed for some features.",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2019-10-01",
  "dependsOn": [
    "deployVNET"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployAzureAKSTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "aksResourceName": {
        "value": "[parameters('aksResourceName')]"
      },
      "nodeResourceGroup":{
        "value": "[parameters('nodeResourceGroup')]"
      },
      "vnetName" : {
        "value": "[parameters('vnetName')]"
      },
      "subnetName" : {
        "value": "AKS-SN"
      },  
      "dnsPrefix": {
          "value": "[parameters('dnsPrefix')]"
      },
      "kubernetesVersion": {
          "value": "[parameters('kubernetesVersion')]"
      },
      "networkPlugin": {
          "value": "[parameters('networkPlugin')]"
      },
      "enableRBAC": {
          "value": "[parameters('enableRBAC')]"
      },
      "vmssNodePool": {
          "value": "[parameters('vmssNodePool')]"
      },
      "enablePrivateCluster": {
          "value": "[parameters('enablePrivateCluster')]"
      },
      "enableHttpApplicationRouting": {
          "value": "[parameters('enableHttpApplicationRouting')]"
      },
      "networkPolicy": {
          "value": "[parameters('networkPolicy')]"
      },
      "vnetSubnetID": {
          "value": "[reference('deployVNET').outputs.aksSubnetID.value]"
      },
      "serviceCidr": {
          "value": "[parameters('serviceCidr')]"
      },
      "dnsServiceIP": {
          "value": "[parameters('dnsServiceIP')]"
      },
      "dockerBridgeCidr": {
          "value": "[parameters('dockerBridgeCidr')]"
      }
    }
  }
}

Azure Container Registry Template

This template will deploy an Azure Container Registry

Typical Nested Template used before

NA

Typical Nested Template used after

PrivateEndpoint
PrivateDNSZone
PrivateDNSARecord
PrivateAKSMICluster

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
acrName Azure Container Registry name poc-acr

Output

"acrId": The resource id of the Azure Container Registry created

Sample Deployment

{
  "name": "deployACR",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployACRURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "acrName": {
        "value": "[parameters('acrName')]"
      }
    }
  }
}

Web Management

APIM Template

This template will deploy an Azure API Management Instance

Typical Nested Template used before

NA

Typical Nested Template used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
apimName Name for the APIM instance poc-apim
sku Allowed Values: Basic, Consumption, Developer, Standard, Premium Standard
capacity Capacity of the SKU (number of deployed units of the SKU). 2
apimEmail Publisher email example@microsoft.com
subnetID Resource ID of the subnet that APIM will sit on [concat(reference('deployVNET').outputs.vnetId.value,'/subnets/APIM-SN')]
publisherName Publisher Name Microsoft
virtualNetworkType Allowed Values: Internal, External Internal
disableGateway Boolean allowing you to diable gateway false

Output

"APIMIP": The resource id of the APIM Instance created

Sample Deployment

{
  "name": "deployAPIM",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployVNET",
    "deployAppInsights",
    "deployLAWorkspace"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployAPIMTemplateURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "apimname": {
        "value": "[parameters('apimName')]"
      },
      "sku": {
        "value": "[parameters('apimsku')]"
      },
      "capacity": {
        "value": "[parameters('apimcapacity')]"
      },
      "apimEmail": {
        "value": "[parameters('apimEmail')]"
      },
      "subnetID": {
        "value": "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/APIM-SN')]"
      },
      "publisherName": {
        "value": "[parameters('apimPublisherName')]"
      },
      "virtualNetworkType": {
        "value": "[parameters('apimVirtualNetworkType')]"
      },
      "disableGateway": {
        "value": "[parameters('apimDisableGateway')]"
      }
    }
  }
}

Azure Redis Cache VNet Integrated Template

This template will deploy a premium version of Azure Redis Cache injected on a VNet

Typical Nested Templates used before

Vnet

Typical Nested Templates used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
cahceName Name for the Azure Redis Cache poc-azurecache
capacity The size of the Redis cache to deploy 2
subnetId Resource ID of the subnet it will reside on [concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AzureBastionSubnet')]
saConnectionString Storage Account Connection String [reference('deployStorage').outputs.saConnectionString.value]
ipAddress IP Address to be assigned to cache 10.10.10.10
backupEnabled Boolean either enabling or disabling backup true
backupFrequency How often to run a backup 90
maxSnapshots Maximum number of snaphots allowed 10

Output

NA

Sample Deployment

{
  "name": "deployAzureCacheVault",
  "type": "Microsoft.Resources/deployments",
  "apiVersion": "2017-05-10",
  "dependsOn": [
    "deployLAWorkspace",
    "deployVNET"
  ],
  "properties": {
    "mode": "Incremental",
    "templateLink": {
      "uri": "[variables('deployAzureCacheBusURL')]",
      "contentVersion": "1.0.0.0"
    },
    "parameters": {
      "cacheName": {
        "value": "[parameters('cacheName')]"
      },
      "subnetId": {
        "value": "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/privateep-SN')]"
      },
      "saConnectionString": {
        "value": "[reference('deployPrivateStorage').outputs.saConnectionString.value]"
      },
      "ipAddress": {
        "value": "192.168.1.180"
      },
      "bakcupEnabled": {
        "value": true
      },
      "backupFrequency": {
        "value": 90
      },
      "maxSnaphots": {
        "value": 10
      }
    }
  }
}

Data Templates

Azure SQL Database

This template will deploy an Azure SQL Database

Typical Nested Templates used before

NA

Typical Nested Templates used after

PrivateEndpoint

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
administratorLogin Admin Login for the SQL Server sqladmin
administratorLoginPassword Admin password for the SQL Server SecretPassword01
serverName SQL Server Name to host the Azure SQL DB pocSQLServer
publicNetworkAccess Boolean value on if public network access is allowed to the SQL Server false
useVAManagedIdentity Boolean value on weather to create a System Managed Identity true
allowAzureIps Boolean value on if Azure IPs are allowed through firewall true
collation The collation of the database. SQL_Latin1_General_CP1_CI_AS
databaseName Name of the Azure DB to be created pocDB
tier The tier or edition of the particular SKU, e.g. Basic, Premium. GeneralPurpose
skuName The name of the SKU, typically, a letter + Number code, e.g. P3. GP_S_Gen5_24
maxSizeBytes The max size of the database expressed in bytes. 1024
sampleName The name of the sample schema to apply when creating this database. - AdventureWorksLT, WideWorldImportersStd, WideWorldImportersFull WideWorldImportersFull
zoneRedundant Whether or not this database is zone redundant, which means the replicas of this database will be spread across multiple availability zones true
licenseType The license type to apply for this database. - LicenseIncluded or BasePrice LicenseIncluded
readScaleOut f enabled, connections that have application intent set to readonly in their connection string may be routed to a readonly secondary replica. This property is only settable for Premium and Business Critical databases. - Enabled or Disabled Disabled
numberOfReplicas The number of readonly secondary replicas associated with the database to which readonly application intent connections may be routed. This property is only settable for Hyperscale edition databases. 0
minCapacity Minimal capacity that database will always have allocated, if not paused 2
autoPauseDelay Time in minutes after which database is automatically paused. A value of -1 means that automatic pause is disabled -1

Output

sqlServerId: Resource ID of the SQL Server created

Sample Deployment

  {
    "name": "deploySqlDb",
    "comments":"",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "[parameters('resourceGroup')]"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('deployAzureSqlDbURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "collation": {
          "value": "SQL_Latin1_General_CP1_CI_AS"
        },
        "databaseName": {
            "value": "[variables('sqlDatabaseName')]"
        },
        "tier": {
            "value": "GeneralPurpose"
        },
        "skuName": {
            "value": "GP_S_Gen5_24"
        },
        "maxSizeBytes": {
            "value": 1099511627776
        },
        "sampleName": {
            "value": ""
        },
        "serverName": {
            "value": "[variables('sqlServerName')]"
        },
        "zoneRedundant": {
            "value": false
        },
        "licenseType": {
            "value": ""
        },
        "readScaleOut": {
            "value": "Disabled"
        },
        "numberOfReplicas": {
            "value": 0
        },
        "minCapacity": {
            "value": "3"
        },
        "autoPauseDelay": {
            "value": "180"
        },
        "useVAManagedIdentity": {
            "value": true
        },
        "administratorLogin": {
          "value": "[parameters('adminUsername')]"
        },
        "administratorLoginPassword": {
            "value": "[parameters('adminPassword')]"
        },
        "publicNetworkAccess": {
          "value": "Disabled"
        }
      }
    }
  }

Azure SQL Database Allow VNet

This template will allow an Azure Virtual Network access to an Azure SQL DB.

Typical Nested Templates used before

NA

Typical Nested Templates used after

SQLDB

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
serverName SQL Server name poc-sqlserver
subnetID Subnet ID that will be allowed to access the database [concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AKS-SN')]

Output

sqlServerId: Resource ID of the SQL Server created

Sample Deployment

  {
    "name": "allowAKSVNet",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deploySqlDb"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('allowSQLVNetTemplateURL')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "serverName": {
            "value": "[variables('sqlServerName')]"
        },
        "subnetID": {
            "value": "[concat(reference('deployVNET').outputs.vnetId.value,'/subnets/AKS-SN')]"
        }
      }
    }  
  }

Configuration Scripts

DSC AKS-SQL Configuration

This template is an example of deploying a DSC script to a virtual machine. This script configures AKS with a SQL backend.

Typical Nested Templates used before

WindowsVirtualMachine

Typical Nested Templates used after

NA

Utilizing Template

This template requires you to pass in the following parameters:

Parameter Description Example
vmName VM name were the dsc script will run poc-jump
configModuleURL URL for the dsc script [variables('jumpConfigModuleURL')]
configFunction Function in the script to be executed [variables('jumpConfigFunction')]
lbIP IP address to use in the load balancer in AKS 10.10.10.10
acrName Name of the Azure Container registry to store the docker images poc-acr
aksName Name of the AKS resource in Azure poc-aks
gwName Name of the AppGW resource to use as a front end. poc-appgw
rgName Resource group that contains your resources pocrg
saName Name of a storage account to utilize. poc-sa
aiKey Application Insights Instrumentation Key. [reference('deployAppInsights').outputs.aiKey.value]
sqlName SQL Server name. poc-sql
dbName Database name that is on the sql server. exampledb
sqlAdmin Acccount that has SQL admin rights pocAdmin
sqlPwd Password for the SQL admin account SecurePassword123
saKey Storage Account Key for the storage account saName [reference('deploySAAccount').outputs.saKey.value]

Output

NA

Sample Deployment

  {
    "name": "configJumpBox",
    "comments":"",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2018-05-01",
    "resourceGroup": "[parameters('resourceGroup')]",
    "dependsOn": [
      "deployJumpBox",
      "grantMIRole",
      "deployAKSCluster"
    ],
    "properties": {
      "mode": "Incremental",
      "templateLink": {
        "uri": "[variables('addDSCExtension')]",
        "contentVersion": "1.0.0.0"
      },
      "parameters": {
        "vmName": {
          "value": "[variables('jumpName')]"
        },
        "configModuleURL": {
          "value": "[variables('jumpConfigModuleURL')]"
        },
        "configFunction": {
          "value": "[variables('jumpConfigFunction')]"
        },
        "lbIP": {
          "value": "[variables('lbIP')]"
        },
        "acrName": {
          "value": "[variables('acrName')]"
        },
        "aksName": {
          "value": "[variables('AksresourceName')]"
        },
        "gwName": {
          "value": "[variables('applicationGatewayName')]"
        },
        "rgName": {
          "value": "[parameters('resourceGroup')]"
        },
        "saName": {
            "value": "[variables('saName')]"
        },
        "aiKey": {
            "value": "[reference('deployAppInsights').outputs.aiKey.value]"
        },
        "sqlName": {
            "value": "[variables('sqlServerName')]"
        },
        "dbName": {
            "value": "[variables('sqlDatabaseName')]"
        },
        "sqlAdmin": {
            "value": "[parameters('adminUserName')]"
        },
        "sqlPwd": {
            "value": "[parameters('adminPassword')]"
        },
        "saKey": {
          "value": "[reference('deploySAAccount').outputs.saKey.value]"
        }
      }
    }
  }

About

No description, website, or topics provided.

Resources

Readme

License

MIT license

Code of conduct

Code of conduct

Security policy

Security policy
Activity
Custom properties

Stars

2 stars

Watchers

5 watching

Forks

4 forks
Report repository

Releases

No releases published

Packages

No packages published

Languages