Skip to content

Commit 301891f

Browse files
oZakarioZakari
authored
fix: Resolve a variety of bugs and update api version of private dns zone links resource (Azure#896)
* Added tags to AMA resources * Update API version of private dns virtual link * Add additional logic to default to at least 2 zones for pip in case not specified * Add additional role assignments * Add additional management group scopes for ama policies * Add secondary location references * Adding pattern to skip checking for any email
1 parent c282211 commit 301891f

File tree

6 files changed

+86
-14
lines changed

6 files changed

+86
-14
lines changed

‎.github/actions-config/mlc_config.json

+4-1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
{
77
"pattern": "^(https:\\/\\/)?([www.]?)+(microsoft.com\\/)+[\\w\\-\\._~:/?#[\\]@!\\$&'\\(\\)\\*\\+,;=.]+$"
88
}
9+
{
10+
"pattern": "^mailto:"
11+
}
912
],
1013
"httpHeaders": [
1114
{
@@ -27,4 +30,4 @@
2730
203,
2831
206
2932
]
30-
}
33+
}

‎infra-as-code/bicep/modules/hubNetworking/hubNetworking-multiRegion.bicep

+32-8
Original file line numberDiff line numberDiff line change
@@ -1265,8 +1265,14 @@ module modGatewayPublicIp '../publicIp/publicIp.bicep' = [
12651265
params: {
12661266
parLocation: parLocation
12671267
parAvailabilityZones: toLower(gateway.gatewayType) == 'expressroute'
1268-
? parAzErGatewayAvailabilityZones
1269-
: toLower(gateway.gatewayType) == 'vpn' ? parAzVpnGatewayAvailabilityZones : []
1268+
? (contains(toLower(gateway.sku), 'az') && empty(parAzErGatewayAvailabilityZones)
1269+
? ['1', '2']
1270+
: parAzErGatewayAvailabilityZones)
1271+
: (toLower(gateway.gatewayType) == 'vpn'
1272+
? (contains(toLower(gateway.sku), 'az') && empty(parAzVpnGatewayAvailabilityZones)
1273+
? ['1', '2']
1274+
: parAzVpnGatewayAvailabilityZones)
1275+
: [])
12701276
parPublicIpName: '${parPublicIpPrefix}${gateway.name}${parPublicIpSuffix}'
12711277
parPublicIpProperties: {
12721278
publicIpAddressVersion: 'IPv4'
@@ -1291,8 +1297,14 @@ module modGatewayPublicIpActiveActive '../publicIp/publicIp.bicep' = [
12911297
params: {
12921298
parLocation: parLocation
12931299
parAvailabilityZones: toLower(gateway.gatewayType) == 'expressroute'
1294-
? parAzErGatewayAvailabilityZones
1295-
: toLower(gateway.gatewayType) == 'vpn' ? parAzVpnGatewayAvailabilityZones : []
1300+
? (contains(toLower(gateway.sku), 'az') && empty(parAzErGatewayAvailabilityZones)
1301+
? ['1', '2']
1302+
: parAzErGatewayAvailabilityZones)
1303+
: (toLower(gateway.gatewayType) == 'vpn'
1304+
? (contains(toLower(gateway.sku), 'az') && empty(parAzVpnGatewayAvailabilityZones)
1305+
? ['1', '2']
1306+
: parAzVpnGatewayAvailabilityZones)
1307+
: [])
12961308
parPublicIpName: '${parPublicIpPrefix}${gateway.name}${parPublicIpSuffix}-aa'
12971309
parPublicIpProperties: {
12981310
publicIpAddressVersion: 'IPv4'
@@ -1316,8 +1328,14 @@ module modGatewayPublicIpSecondaryLocation '../publicIp/publicIp.bicep' = [
13161328
params: {
13171329
parLocation: parSecondaryLocation
13181330
parAvailabilityZones: toLower(gateway.gatewayType) == 'expressroute'
1319-
? parAzErGatewayAvailabilityZonesSecondaryLocation
1320-
: toLower(gateway.gatewayType) == 'vpn' ? parAzVpnGatewayAvailabilityZonesSecondaryLocation : []
1331+
? (contains(toLower(gateway.sku), 'az') && empty(parAzErGatewayAvailabilityZonesSecondaryLocation)
1332+
? ['1', '2']
1333+
: parAzErGatewayAvailabilityZones)
1334+
: (toLower(gateway.gatewayType) == 'vpn'
1335+
? (contains(toLower(gateway.sku), 'az') && empty(parAzVpnGatewayAvailabilityZonesSecondaryLocation)
1336+
? ['1', '2']
1337+
: parAzVpnGatewayAvailabilityZonesSecondaryLocation)
1338+
: [])
13211339
parPublicIpName: '${parPublicIpPrefixSecondaryLocation}${gateway.name}${parPublicIpSuffix}'
13221340
parPublicIpProperties: {
13231341
publicIpAddressVersion: 'IPv4'
@@ -1342,8 +1360,14 @@ module modGatewayPublicIpActiveActiveSecondaryLocation '../publicIp/publicIp.bic
13421360
params: {
13431361
parLocation: parLocation
13441362
parAvailabilityZones: toLower(gateway.gatewayType) == 'expressroute'
1345-
? parAzErGatewayAvailabilityZones
1346-
: toLower(gateway.gatewayType) == 'vpn' ? parAzVpnGatewayAvailabilityZones : []
1363+
? (contains(toLower(gateway.sku), 'az') && empty(parAzErGatewayAvailabilityZonesSecondaryLocation)
1364+
? ['1', '2']
1365+
: parAzErGatewayAvailabilityZones)
1366+
: (toLower(gateway.gatewayType) == 'vpn'
1367+
? (contains(toLower(gateway.sku), 'az') && empty(parAzVpnGatewayAvailabilityZonesSecondaryLocation)
1368+
? ['1', '2']
1369+
: parAzVpnGatewayAvailabilityZonesSecondaryLocation)
1370+
: [])
13471371
parPublicIpName: '${parPublicIpPrefix}${gateway.name}${parPublicIpSuffix}-aa'
13481372
parPublicIpProperties: {
13491373
publicIpAddressVersion: 'IPv4'

‎infra-as-code/bicep/modules/hubNetworking/hubNetworking.bicep

+16-4
Original file line numberDiff line numberDiff line change
@@ -696,8 +696,14 @@ module modGatewayPublicIp '../publicIp/publicIp.bicep' = [
696696
params: {
697697
parLocation: parLocation
698698
parAvailabilityZones: toLower(gateway.gatewayType) == 'expressroute'
699-
? parAzErGatewayAvailabilityZones
700-
: toLower(gateway.gatewayType) == 'vpn' ? parAzVpnGatewayAvailabilityZones : []
699+
? (contains(toLower(gateway.sku), 'az') && empty(parAzErGatewayAvailabilityZones)
700+
? ['1', '2']
701+
: parAzErGatewayAvailabilityZones)
702+
: (toLower(gateway.gatewayType) == 'vpn'
703+
? (contains(toLower(gateway.sku), 'az') && empty(parAzVpnGatewayAvailabilityZones)
704+
? ['1', '2']
705+
: parAzVpnGatewayAvailabilityZones)
706+
: [])
701707
parPublicIpName: '${parPublicIpPrefix}${gateway.name}${parPublicIpSuffix}'
702708
parPublicIpProperties: {
703709
publicIpAddressVersion: 'IPv4'
@@ -722,8 +728,14 @@ module modGatewayPublicIpActiveActive '../publicIp/publicIp.bicep' = [
722728
params: {
723729
parLocation: parLocation
724730
parAvailabilityZones: toLower(gateway.gatewayType) == 'expressroute'
725-
? parAzErGatewayAvailabilityZones
726-
: toLower(gateway.gatewayType) == 'vpn' ? parAzVpnGatewayAvailabilityZones : []
731+
? (contains(toLower(gateway.sku), 'az') && empty(parAzErGatewayAvailabilityZones)
732+
? ['1', '2']
733+
: parAzErGatewayAvailabilityZones)
734+
: (toLower(gateway.gatewayType) == 'vpn'
735+
? (contains(toLower(gateway.sku), 'az') && empty(parAzVpnGatewayAvailabilityZones)
736+
? ['1', '2']
737+
: parAzVpnGatewayAvailabilityZones)
738+
: [])
727739
parPublicIpName: '${parPublicIpPrefix}${gateway.name}${parPublicIpSuffix}-aa'
728740
parPublicIpProperties: {
729741
publicIpAddressVersion: 'IPv4'

‎infra-as-code/bicep/modules/logging/logging.bicep

+4
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ var varCuaid = 'f8087c67-cc41-46b2-994d-66e4b661860d'
187187
resource resUserAssignedManagedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
188188
name: parUserAssignedManagedIdentityName
189189
location: parUserAssignedManagedIdentityLocation
190+
tags: parTags
190191
}
191192

192193
resource resAutomationAccount 'Microsoft.Automation/automationAccounts@2023-11-01' = {
@@ -243,6 +244,7 @@ resource resLogAnalyticsWorkspaceLock 'Microsoft.Authorization/locks@2020-05-01'
243244
resource resDataCollectionRuleVMInsights 'Microsoft.Insights/dataCollectionRules@2021-04-01' = {
244245
name: parDataCollectionRuleVMInsightsName
245246
location: parLogAnalyticsWorkspaceLocation
247+
tags: parTags
246248
properties: {
247249
description: 'Data collection rule for VM Insights'
248250
dataSources: {
@@ -311,6 +313,7 @@ resource resDataCollectionRuleVMInsightsLock 'Microsoft.Authorization/locks@2020
311313
resource resDataCollectionRuleChangeTracking 'Microsoft.Insights/dataCollectionRules@2021-04-01' = {
312314
name: parDataCollectionRuleChangeTrackingName
313315
location: parLogAnalyticsWorkspaceLocation
316+
tags: parTags
314317
properties: {
315318
description: 'Data collection rule for CT.'
316319
dataSources: {
@@ -582,6 +585,7 @@ resource resDataCollectionRuleChangeTrackingLock 'Microsoft.Authorization/locks@
582585
resource resDataCollectionRuleMDFCSQL'Microsoft.Insights/dataCollectionRules@2021-04-01' = {
583586
name: parDataCollectionRuleMDFCSQLName
584587
location: parLogAnalyticsWorkspaceLocation
588+
tags: parTags
585589
properties: {
586590
description: 'Data collection rule for Defender for SQL.'
587591
dataSources: {

‎infra-as-code/bicep/modules/policy/assignments/alzDefaults/alzDefaultPolicyAssignments.bicep

+29
Original file line numberDiff line numberDiff line change
@@ -941,6 +941,9 @@ module modPolicyAssignmentPlatformDeployVmArcChangeTrack '../../../policy/assign
941941
varRbacRoleDefinitionIds.monitoringContributor
942942
varRbacRoleDefinitionIds.reader
943943
]
944+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
945+
string(varManagementGroupIds.landingZones)
946+
]
944947
parTelemetryOptOut: parTelemetryOptOut
945948
}
946949
}
@@ -972,6 +975,9 @@ module modPolicyAssignmentPlatformDeployVmChangeTrack '../../../policy/assignmen
972975
varRbacRoleDefinitionIds.managedIdentityOperator
973976
varRbacRoleDefinitionIds.reader
974977
]
978+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
979+
string(varManagementGroupIds.landingZones)
980+
]
975981
parTelemetryOptOut: parTelemetryOptOut
976982
}
977983
}
@@ -1003,6 +1009,9 @@ module modPolicyAssignmentPlatformDeployVmssChangeTrack '../../../policy/assignm
10031009
varRbacRoleDefinitionIds.managedIdentityOperator
10041010
varRbacRoleDefinitionIds.reader
10051011
]
1012+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1013+
string(varManagementGroupIds.landingZones)
1014+
]
10061015
parTelemetryOptOut: parTelemetryOptOut
10071016
}
10081017
}
@@ -1030,6 +1039,8 @@ module modPolicyAssignmentPlatformDeployVmArcMonitor '../../../policy/assignment
10301039
varRbacRoleDefinitionIds.reader
10311040
varRbacRoleDefinitionIds.connectedMachineResourceAdministrator
10321041
]
1042+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1043+
string(varManagementGroupIds.landingZones) ]
10331044
parTelemetryOptOut: parTelemetryOptOut
10341045
}
10351046
}
@@ -1061,6 +1072,9 @@ module modPolicyAssignmentPlatformDeployVmMonitor '../../../policy/assignments/p
10611072
varRbacRoleDefinitionIds.managedIdentityOperator
10621073
varRbacRoleDefinitionIds.reader
10631074
]
1075+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1076+
string(varManagementGroupIds.landingZones)
1077+
]
10641078
parTelemetryOptOut: parTelemetryOptOut
10651079
}
10661080
}
@@ -1095,6 +1109,9 @@ module modPolicyAssignmentPlatformDeployMdfcDefSqlAma '../../../policy/assignmen
10951109
varRbacRoleDefinitionIds.managedIdentityOperator
10961110
varRbacRoleDefinitionIds.reader
10971111
]
1112+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1113+
string(varManagementGroupIds.landingZones)
1114+
]
10981115
parTelemetryOptOut: parTelemetryOptOut
10991116
}
11001117
}
@@ -1146,6 +1163,9 @@ module modPolicyAssignmentPlatformDeployVmssMonitor '../../../policy/assignments
11461163
varRbacRoleDefinitionIds.managedIdentityOperator
11471164
varRbacRoleDefinitionIds.reader
11481165
]
1166+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1167+
string(varManagementGroupIds.landingZones)
1168+
]
11491169
parTelemetryOptOut: parTelemetryOptOut
11501170
}
11511171
}
@@ -1751,6 +1771,9 @@ module modPolicyAssignmentLzsDeployVmMonitor '../../../policy/assignments/policy
17511771
varRbacRoleDefinitionIds.managedIdentityOperator
17521772
varRbacRoleDefinitionIds.reader
17531773
]
1774+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1775+
string(varManagementGroupIds.platform)
1776+
]
17541777
parTelemetryOptOut: parTelemetryOptOut
17551778
}
17561779
}
@@ -1782,6 +1805,9 @@ module modPolicyAssignmentLzsDeployVmssMonitor '../../../policy/assignments/poli
17821805
varRbacRoleDefinitionIds.managedIdentityOperator
17831806
varRbacRoleDefinitionIds.reader
17841807
]
1808+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1809+
string(varManagementGroupIds.platform)
1810+
]
17851811
parTelemetryOptOut: parTelemetryOptOut
17861812
}
17871813
}
@@ -1813,6 +1839,9 @@ module modPolicyAssignmentLzsmDeployMdfcDefSqlAma '../../../policy/assignments/p
18131839
varRbacRoleDefinitionIds.managedIdentityOperator
18141840
varRbacRoleDefinitionIds.reader
18151841
]
1842+
parPolicyAssignmentIdentityRoleAssignmentsAdditionalMgs: [
1843+
string(varManagementGroupIds.platform)
1844+
]
18161845
parTelemetryOptOut: parTelemetryOptOut
18171846
}
18181847
}

‎infra-as-code/bicep/modules/privateDnsZoneLinks/privateDnsZoneLinks.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ param parResourceLockConfig lockType = {
3030

3131
var varSpokeVirtualNetworkName = split(parSpokeVirtualNetworkResourceId, '/')[8]
3232

33-
resource resPrivateDnsZoneLinkToSpoke 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = if (!empty(parPrivateDnsZoneResourceId)) {
33+
resource resPrivateDnsZoneLinkToSpoke 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = if (!empty(parPrivateDnsZoneResourceId)) {
3434
location: 'global'
3535
name: '${split(parPrivateDnsZoneResourceId, '/')[8]}/dnslink-to-${varSpokeVirtualNetworkName}'
3636
properties: {

0 commit comments

Comments
 (0)