feat(bicep): add tags parameter to various Bicep modules for resource tagging

Author: pauldotyu

infra/bicep/README.md

@@ -0,0 +1,22 @@
+# Azure Bicep Infrastructure
+
+This directory contains Bicep templates for deploying Azure infrastructure and is scanned for compliance using PSRule.
+
+## PSRule for Azure
+
+PSRule is a tool for validating Azure resources against best practices and compliance rules. It can be used to ensure that your Bicep templates adhere to organizational standards.
+
+To manually run PSRule against the Bicep templates in this directory, you can use the following command:
+
+```powershell
+$modules = @('PSRule.Rules.Azure')
+Install-Module -Name $modules -Scope CurrentUser -Force -ErrorAction Stop;
+Assert-PSRule -InputPath './infra/bicep/*.test.bicep' -Module $modules -Format File -ErrorAction Stop;
+```
+
+Some rules have been suppressed due to known issues or specific requirements. You can find the list of suppressed rules in the [ps-rule.yaml](./ps-rule.yaml) file.
+
+## Resources
+
+- [PSRule for Azure](https://azure.github.io/PSRule.Rules.Azure/)
+- [PSRules for Azure Rule Reference](https://azure.github.io/PSRule.Rules.Azure/en/rules/)

infra/bicep/cosmosdb.bicep

@@ -4,6 +4,7 @@ param accountKind string
 param identityPrincipalId string
 param currentIpAddress string
 param servicePrincipalId string
+param tags object
 
 // https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/document-db/database-account
 module databaseAccount 'br/public:avm/res/document-db/database-account:0.11.3' = {
@@ -92,6 +93,7 @@ module databaseAccount 'br/public:avm/res/document-db/database-account:0.11.3' =
         principalType: 'ServicePrincipal'
       }
     ]
+    tags: tags
   }
 }
 

infra/bicep/kubernetes.bicep

@@ -8,6 +8,7 @@ param metricsWorkspaceResourceId string
 param currentUserObjectId string
 param currentIpAddress string
 param configureMonitorSettings bool = false
+param tags object
 
 // https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/container-service/managed-cluster
 module managedCluster 'br/public:avm/res/container-service/managed-cluster:0.8.3' = {
@@ -30,6 +31,7 @@ module managedCluster 'br/public:avm/res/container-service/managed-cluster:0.8.3
     enableOidcIssuerProfile: true
     enableWorkloadIdentity: true
     enableKeyvaultSecretsProvider: true
+    enableSecretRotation: true
     enableAzureMonitorProfileMetrics: configureMonitorSettings
     enableContainerInsights: configureMonitorSettings
     disablePrometheusMetricsScraping: !configureMonitorSettings
@@ -42,16 +44,49 @@ module managedCluster 'br/public:avm/res/container-service/managed-cluster:0.8.3
       systemAssigned: true
     }
     publicNetworkAccess: 'Enabled'
-    // authorizedIPRanges: [
-    //   currentIpAddress
-    // ]
+    authorizedIPRanges: [
+      currentIpAddress
+    ]
     roleAssignments: [
       {
         principalId: currentUserObjectId
         roleDefinitionIdOrName: 'Azure Kubernetes Service RBAC Cluster Admin'
         principalType: 'User'
       }
     ]
+    maintenanceConfigurations: [
+      {
+        maintenanceWindow: {
+          durationHours: 4
+          schedule: {
+            weekly: {
+              dayOfWeek: 'Sunday'
+              intervalWeeks: 1
+            }
+          }
+          startDate: '2025-06-11'
+          startTime: '00:00'
+          utcOffset: '+00:00'
+        }
+        name: 'aksManagedAutoUpgradeSchedule'
+      }
+      {
+        maintenanceWindow: {
+          durationHours: 4
+          schedule: {
+            weekly: {
+              dayOfWeek: 'Sunday'
+              intervalWeeks: 1
+            }
+          }
+          startDate: '2025-06-11'
+          startTime: '00:00'
+          utcOffset: '+00:00'
+        }
+        name: 'aksManagedNodeOSUpgradeSchedule'
+      }
+    ]
+    tags: tags
   }
 }
 
@@ -77,6 +112,7 @@ module registry 'br/public:avm/res/container-registry/registry:0.9.1' = if (depl
         principalType: 'ServicePrincipal'
       }
     ]
+    tags: tags
   }
 }
 
@@ -95,6 +131,7 @@ resource dataCollectionEndpoint 'Microsoft.Insights/dataCollectionEndpoints@2022
   properties: {
     description: 'Data Collection Endpoint for Prometheus'
   }
+  tags: tags
 }
 
 resource dataCollectionRuleAssociationEndpoint 'Microsoft.Insights/dataCollectionRuleAssociations@2022-06-01' = if (configureMonitorSettings) {
@@ -148,6 +185,7 @@ resource dataCollectionRuleMSCI 'Microsoft.Insights/dataCollectionRules@2022-06-
       }
     ]
   }
+  tags: tags
 }
 
 resource dataCollectionRuleAssociationMSCI 'Microsoft.Insights/dataCollectionRuleAssociations@2022-06-01' = if (configureMonitorSettings) {
@@ -193,6 +231,7 @@ resource dataCollectionRuleMSProm 'Microsoft.Insights/dataCollectionRules@2022-0
       }
     ]
   }
+  tags: tags
 }
 
 resource dataCollectionRuleAssociationMSProm 'Microsoft.Insights/dataCollectionRuleAssociations@2022-06-01' = if (configureMonitorSettings) {
@@ -306,6 +345,7 @@ resource prometheusK8sRuleGroups 'Microsoft.AlertsManagement/prometheusRuleGroup
       }
     ]
   }
+  tags: tags
 }
 
 resource prometheusNodeRuleGroups 'Microsoft.AlertsManagement/prometheusRuleGroups@2023-03-01' = if (configureMonitorSettings) {
@@ -367,6 +407,7 @@ resource prometheusNodeRuleGroups 'Microsoft.AlertsManagement/prometheusRuleGrou
       }
     ]
   }
+  tags: tags
 }
 
 output id string = managedCluster.outputs.resourceId

infra/bicep/main.bicep

@@ -67,13 +67,19 @@ param currentIpAddress string
 @description('value of source registry to use for image imports')
 param sourceRegistry string = 'ghcr.io/azure-samples'
 
+@description('value of tags to apply to resources')
+param tags object = {
+  environment: 'development'
+}
+
 // generate a unique string based on the resource group id
 // this is used to ensure that each resource name is unique
 var name = '${appEnvironment}${take(uniqueString(subscription().id, appEnvironment), 4)}'
 
 resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' = {
   name: 'rg-${name}'
   location: location
+  tags: tags
 }
 
 module observability 'observability.bicep' = if (deployObservabilityTools) {
@@ -82,6 +88,7 @@ module observability 'observability.bicep' = if (deployObservabilityTools) {
   params: {
     nameSuffix: name
     currentUserObjectId: currentUserObjectId
+    tags: tags
   }
 }
 
@@ -98,6 +105,7 @@ module aks 'kubernetes.bicep' = {
     currentUserObjectId: currentUserObjectId
     currentIpAddress: currentIpAddress
     configureMonitorSettings: deployObservabilityTools
+    tags: tags
   }
 }
 
@@ -113,6 +121,7 @@ module workloadidentity 'workloadidentity.bicep' = if (deployAzureCosmosDB || de
         partialSubject: 'system:serviceaccount:${k8sNamespace}'
       }
     ]
+    tags: tags
   }
 }
 
@@ -124,6 +133,7 @@ module servicebus 'servicebus.bicep' = if (deployAzureServiceBus) {
     currentUserObjectId: currentUserObjectId
     currentIpAddress: currentIpAddress
     servicePrincipalId: workloadidentity.outputs.principalId
+    tags: tags
   }
 }
 
@@ -136,6 +146,7 @@ module cosmosdb 'cosmosdb.bicep' = if (deployAzureCosmosDB) {
     identityPrincipalId: workloadidentity.outputs.principalId
     currentIpAddress: currentIpAddress
     servicePrincipalId: workloadidentity.outputs.principalId
+    tags: tags
   }
 }
 
@@ -160,6 +171,7 @@ module openai 'openai.bicep' = if (deployAzureOpenAI) {
     currentIpAddress: currentIpAddress
     servicePrincipalId: workloadidentity.outputs.principalId
     modelDeployments: modelDeployments
+    tags: tags
   }
 }
 
@@ -196,5 +208,5 @@ output AZURE_DATABASE_API string = cosmosDBAccountKind == 'MongoDB' ? 'mongodb'
 output AZURE_REGISTRY_NAME string = deployAzureContainerRegistry ? aks.outputs.registryName : ''
 output AZURE_REGISTRY_URI string = deployAzureContainerRegistry
   ? aks.outputs.registryLoginServer
-  : sourceRegistry
+  : sourceRegistry 
 output AZURE_TENANT_ID string = tenant().tenantId

infra/bicep/main.test.bicep

@@ -1,10 +1,11 @@
 // This file is for doing static analysis and contains sensible defaults 
-// for PSRule to minimise false-positives and provide the best results. 
+// for PSRule to minimize false-positives and provide the best results. 
 
 // This file is not intended to be used as a runtime configuration file. 
 
 targetScope = 'subscription'
 
+@description('value of deployment location for resources')
 param location string = 'swedencentral'
 
 module main 'main.bicep' = { 
@@ -14,5 +15,8 @@ module main 'main.bicep' = {
     location: location
     appEnvironment: 'test'
     currentIpAddress: '1.1.1.1'
+    tags: {
+      environment: 'development'
+    }
   }
 }

infra/bicep/observability.bicep

@@ -3,6 +3,7 @@ param nameSuffix string
 @description('The location of the resource.')
 param location string = resourceGroup().location
 param currentUserObjectId string
+param tags object
 
 resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
   name: 'logs-${nameSuffix}'
@@ -15,11 +16,13 @@ resource logWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
       name: 'PerGB2018'
     }
   }
+  tags: tags
 }
 
 resource metricsWorkspace 'Microsoft.Monitor/accounts@2023-04-03' = {
   name: 'metrics-${nameSuffix}'
   location: location
+  tags: tags
 }
 
 resource grafanaDashboard 'Microsoft.Dashboard/grafana@2023-09-01' = {
@@ -32,6 +35,7 @@ resource grafanaDashboard 'Microsoft.Dashboard/grafana@2023-09-01' = {
     type: 'SystemAssigned'
   }
   properties: {
+    grafanaMajorVersion: '11'
     grafanaIntegrations: {
       azureMonitorWorkspaceIntegrations: [
         {
@@ -40,6 +44,7 @@ resource grafanaDashboard 'Microsoft.Dashboard/grafana@2023-09-01' = {
       ]
     }
   }
+  tags: tags
 }
 
 resource grafanaAdminRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {

infra/bicep/openai.bicep

@@ -5,6 +5,7 @@ param currentUserObjectId string
 param currentIpAddress string
 param servicePrincipalId string
 param modelDeployments array = []
+param tags object
 
 // https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/cognitive-services/account
 module cognitiveServicesAccount 'br/public:avm/res/cognitive-services/account:0.10.1' = {
@@ -52,6 +53,7 @@ module cognitiveServicesAccount 'br/public:avm/res/cognitive-services/account:0.
         principalType: 'ServicePrincipal'
       }
     ]
+    tags: tags
   }
 }
 

infra/bicep/ps-rule.yaml

@@ -0,0 +1,15 @@
+configuration:
+  AZURE_BICEP_FILE_EXPANSION: true
+rule:
+  exclude:
+    # Ignore the following rules for all resources to keep cost down
+    - Azure.Log.Replication # log storage would be too expensive
+    - Azure.ACR.ContentTrust # requires ACR Premium SKU
+    - Azure.ACR.Firewall # requires ACR Premium SKU
+    - Azure.AKS.PoolScaleSet # run on a single node pool
+    - Azure.AKS.NodeMinPods # run on a single node pool
+    - Azure.AKS.AuditLogs # log storage would be too expensive
+    - Azure.AKS.PlatformLogs # log storage would be too expensive
+    - Azure.AKS.NetworkPolicy # using cilium instead which is recommended but not in the allowlist in this rule
+    - Azure.AKS.DefenderProfile # log storage would be too expensive
+    - Azure.Deployment.SecureParameter # uniqueKeyPolicyKeys needs to be secured here https://github.com/Azure/bicep-registry-modules/blob/main/avm/res/document-db/database-account/main.bicep

infra/bicep/servicebus.bicep

@@ -3,6 +3,7 @@ param nameSuffix string
 param currentUserObjectId string
 param currentIpAddress string
 param servicePrincipalId string
+param tags object
 
 // https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/service-bus/namespace
 module serviceBusNamespace 'br/public:avm/res/service-bus/namespace:0.13.2' = {
@@ -43,6 +44,7 @@ module serviceBusNamespace 'br/public:avm/res/service-bus/namespace:0.13.2' = {
         principalType: 'ServicePrincipal'
       }
     ]
+    tags: tags
   }
 }
 

infra/bicep/workloadidentity.bicep

@@ -1,6 +1,7 @@
 @minLength(3)
 param nameSuffix string
 param federatedCredentials federatedCredential[]
+param tags object
 
 type federatedCredential = {
   audiences: string[]
@@ -20,6 +21,7 @@ module userAssignedIdentity 'br/public:avm/res/managed-identity/user-assigned-id
         subject: '${fc.partialSubject}:mi-${nameSuffix}'
       }
     ]
+    tags: tags
   }
 }