Skip to content

Commit b574891

Browse files
alrios-msalrios-ms
committed
Updated functions to use UAMI
1 parent 16bf7a8 commit b574891

File tree

56 files changed

+665
-28
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+665
-28
lines changed

‎Service/GroupMembershipManagement/Hosts/AzureMaintenance/Infrastructure/compute/functionApp.bicep‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ param servicePlanName string
2020
@description('app settings')
2121
param secretSettings object
2222

23+
@description('User assigned managed identities. Single or list of user assigned managed identities. Format: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}')
24+
param userManagedIdentities object = {}
25+
26+
var deployUserManagedIdentity = userManagedIdentities != null && userManagedIdentities != {}
27+
2328
resource functionApp 'Microsoft.Web/sites@2018-02-01' = {
2429
name: name
2530
location: location
@@ -35,7 +40,8 @@ resource functionApp 'Microsoft.Web/sites@2018-02-01' = {
3540
}
3641
}
3742
identity: {
38-
type: 'SystemAssigned'
43+
type: deployUserManagedIdentity ? 'SystemAssigned, UserAssigned' : 'SystemAssigned'
44+
userAssignedIdentities: deployUserManagedIdentity ? userManagedIdentities : null
3945
}
4046
}
4147

‎Service/GroupMembershipManagement/Hosts/AzureMaintenance/Infrastructure/compute/functionAppSlot.bicep‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ param servicePlanName string
2020
@description('app settings')
2121
param secretSettings object
2222

23+
@description('User assigned managed identities. Single or list of user assigned managed identities. Format: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}')
24+
param userManagedIdentities object = {}
25+
26+
var deployUserManagedIdentity = userManagedIdentities != null && userManagedIdentities != {}
27+
2328
resource functionAppSlot 'Microsoft.Web/sites/slots@2018-11-01' = {
2429
name: name
2530
kind: kind
@@ -36,7 +41,8 @@ resource functionAppSlot 'Microsoft.Web/sites/slots@2018-11-01' = {
3641
}
3742
}
3843
identity: {
39-
type: 'SystemAssigned'
44+
type: deployUserManagedIdentity ? 'SystemAssigned, UserAssigned' : 'SystemAssigned'
45+
userAssignedIdentities: deployUserManagedIdentity ? userManagedIdentities : null
4046
}
4147
}
4248

‎Service/GroupMembershipManagement/Hosts/AzureMaintenance/Infrastructure/compute/keyVaultReader.bicep‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// Do not use this to return secrets like passwords or API keys
2+
// This is only for returning plain values that are not sensitive
3+
@description('Plain value')
4+
@secure()
5+
param value string
6+
var plainValue = string(value)
7+
output value string = plainValue

‎Service/GroupMembershipManagement/Hosts/AzureMaintenance/Infrastructure/compute/template.bicep‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,26 @@ var productionSettings = {
167167
AzureFunctionsWebHost__hostid: 'AzureMaintenance'
168168
}
169169

170+
resource dataKeyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
171+
name: dataKeyVaultName
172+
scope: resourceGroup(dataKeyVaultResourceGroup)
173+
}
174+
175+
module userAssignedManagedIdentityNameReader 'keyVaultReader.bicep' = {
176+
name: 'userAssignedManagedIdentityNameReaderTemplate'
177+
params: {
178+
value: dataKeyVault.getSecret('graphUserAssignedManagedIdentityName')
179+
}
180+
dependsOn: [
181+
dataKeyVault
182+
]
183+
}
184+
185+
resource graphUAMI 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-preview' existing = {
186+
name: userAssignedManagedIdentityNameReader.outputs.value
187+
scope: resourceGroup(dataKeyVaultResourceGroup)
188+
}
189+
170190
module functionAppTemplate_AzureMaintenance 'functionApp.bicep' = {
171191
name: 'functionAppTemplate-AzureMaintenance'
172192
params: {
@@ -175,9 +195,13 @@ module functionAppTemplate_AzureMaintenance 'functionApp.bicep' = {
175195
location: location
176196
servicePlanName: servicePlanName
177197
secretSettings: commonSettings
198+
userManagedIdentities:{
199+
'${graphUAMI.id}' : {}
200+
}
178201
}
179202
dependsOn: [
180203
servicePlanTemplate
204+
graphUAMI
181205
]
182206
}
183207

@@ -189,6 +213,9 @@ module functionAppSlotTemplate_AzureMaintenance 'functionAppSlot.bicep' = {
189213
location: location
190214
servicePlanName: servicePlanName
191215
secretSettings: commonSettings
216+
userManagedIdentities:{
217+
'${graphUAMI.id}' : {}
218+
}
192219
}
193220
dependsOn: [
194221
functionAppTemplate_AzureMaintenance

‎Service/GroupMembershipManagement/Hosts/AzureUserReader/Infrastructure/compute/functionApp.bicep‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ param dataKeyVaultName string
2626
@description('Name of the resource group where the \'data\' key vault is located.')
2727
param dataKeyVaultResourceGroup string
2828

29+
@description('User assigned managed identities. Single or list of user assigned managed identities. Format: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}')
30+
param userManagedIdentities object = {}
31+
32+
var deployUserManagedIdentity = userManagedIdentities != null && userManagedIdentities != {}
33+
2934
resource functionApp 'Microsoft.Web/sites@2018-02-01' = {
3035
name: name
3136
location: location
@@ -41,7 +46,8 @@ resource functionApp 'Microsoft.Web/sites@2018-02-01' = {
4146
}
4247
}
4348
identity: {
44-
type: 'SystemAssigned'
49+
type: deployUserManagedIdentity ? 'SystemAssigned, UserAssigned' : 'SystemAssigned'
50+
userAssignedIdentities: deployUserManagedIdentity ? userManagedIdentities : null
4551
}
4652
}
4753

‎Service/GroupMembershipManagement/Hosts/AzureUserReader/Infrastructure/compute/functionAppSlot.bicep‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ param dataKeyVaultName string
2626
@description('Name of the resource group where the \'data\' key vault is located.')
2727
param dataKeyVaultResourceGroup string
2828

29+
@description('User assigned managed identities. Single or list of user assigned managed identities. Format: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}')
30+
param userManagedIdentities object = {}
31+
32+
var deployUserManagedIdentity = userManagedIdentities != null && userManagedIdentities != {}
33+
2934
resource functionAppSlot 'Microsoft.Web/sites/slots@2018-11-01' = {
3035
name: name
3136
kind: kind
@@ -42,7 +47,8 @@ resource functionAppSlot 'Microsoft.Web/sites/slots@2018-11-01' = {
4247
}
4348
}
4449
identity: {
45-
type: 'SystemAssigned'
50+
type: deployUserManagedIdentity ? 'SystemAssigned, UserAssigned' : 'SystemAssigned'
51+
userAssignedIdentities: deployUserManagedIdentity ? userManagedIdentities : null
4652
}
4753
}
4854

‎Service/GroupMembershipManagement/Hosts/AzureUserReader/Infrastructure/compute/keyVaultReader.bicep‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// Do not use this to return secrets like passwords or API keys
2+
// This is only for returning plain values that are not sensitive
3+
@description('Plain value')
4+
@secure()
5+
param value string
6+
var plainValue = string(value)
7+
output value string = plainValue

‎Service/GroupMembershipManagement/Hosts/AzureUserReader/Infrastructure/compute/template.bicep‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,26 @@ var productionSettings = {
146146
AzureFunctionsWebHost__hostid: 'AzureUserReader'
147147
}
148148

149+
resource dataKeyVault 'Microsoft.KeyVault/vaults@2023-07-01' existing = {
150+
name: dataKeyVaultName
151+
scope: resourceGroup(dataKeyVaultResourceGroup)
152+
}
153+
154+
module userAssignedManagedIdentityNameReader 'keyVaultReader.bicep' = {
155+
name: 'userAssignedManagedIdentityNameReaderTemplate'
156+
params: {
157+
value: dataKeyVault.getSecret('graphUserAssignedManagedIdentityName')
158+
}
159+
dependsOn: [
160+
dataKeyVault
161+
]
162+
}
163+
164+
resource graphUAMI 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-preview' existing = {
165+
name: userAssignedManagedIdentityNameReader.outputs.value
166+
scope: resourceGroup(dataKeyVaultResourceGroup)
167+
}
168+
149169
module functionAppTemplate_AzureUserReader 'functionApp.bicep' = {
150170
name: 'functionAppTemplate-AzureUserReader'
151171
params: {
@@ -156,9 +176,13 @@ module functionAppTemplate_AzureUserReader 'functionApp.bicep' = {
156176
dataKeyVaultName: dataKeyVaultName
157177
dataKeyVaultResourceGroup: dataKeyVaultResourceGroup
158178
secretSettings: commonSettings
179+
userManagedIdentities:{
180+
'${graphUAMI.id}' : {}
181+
}
159182
}
160183
dependsOn: [
161184
servicePlanTemplate
185+
graphUAMI
162186
]
163187
}
164188

@@ -172,6 +196,9 @@ module functionAppSlotTemplate_AzureUserReader 'functionAppSlot.bicep' = {
172196
dataKeyVaultName: dataKeyVaultName
173197
dataKeyVaultResourceGroup: dataKeyVaultResourceGroup
174198
secretSettings: commonSettings
199+
userManagedIdentities:{
200+
'${graphUAMI.id}' : {}
201+
}
175202
}
176203
dependsOn: [
177204
functionAppTemplate_AzureUserReader

‎Service/GroupMembershipManagement/Hosts/DestinationAttributesUpdater/Infrastructure/compute/functionApp.bicep‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ param servicePlanName string
2020
@description('app settings')
2121
param secretSettings object
2222

23+
@description('User assigned managed identities. Single or list of user assigned managed identities. Format: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}')
24+
param userManagedIdentities object = {}
25+
26+
var deployUserManagedIdentity = userManagedIdentities != null && userManagedIdentities != {}
27+
2328
resource functionApp 'Microsoft.Web/sites@2018-02-01' = {
2429
name: name
2530
location: location
@@ -35,7 +40,8 @@ resource functionApp 'Microsoft.Web/sites@2018-02-01' = {
3540
}
3641
}
3742
identity: {
38-
type: 'SystemAssigned'
43+
type: deployUserManagedIdentity ? 'SystemAssigned, UserAssigned' : 'SystemAssigned'
44+
userAssignedIdentities: deployUserManagedIdentity ? userManagedIdentities : null
3945
}
4046
}
4147

‎Service/GroupMembershipManagement/Hosts/DestinationAttributesUpdater/Infrastructure/compute/functionAppSlot.bicep‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ param servicePlanName string
2020
@description('app settings')
2121
param secretSettings object
2222

23+
@description('User assigned managed identities. Single or list of user assigned managed identities. Format: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}')
24+
param userManagedIdentities object = {}
25+
26+
var deployUserManagedIdentity = userManagedIdentities != null && userManagedIdentities != {}
27+
2328
resource functionAppSlot 'Microsoft.Web/sites/slots@2018-11-01' = {
2429
name: name
2530
kind: kind
@@ -36,7 +41,8 @@ resource functionAppSlot 'Microsoft.Web/sites/slots@2018-11-01' = {
3641
}
3742
}
3843
identity: {
39-
type: 'SystemAssigned'
44+
type: deployUserManagedIdentity ? 'SystemAssigned, UserAssigned' : 'SystemAssigned'
45+
userAssignedIdentities: deployUserManagedIdentity ? userManagedIdentities : null
4046
}
4147
}
4248

0 commit comments

Comments
 (0)