azure/resourcemodules

This repository includes a CI platform for and collection of mature and curated Bicep modules. The platform supports both ARM and Bicep and can be leveraged using GitHub actions as well as Azure DevOps pipelines.

⚠️ Upcoming breaking changes ⚠️

Following the recent release of 0.11.0, the upcoming period will focus on implementing the remaining changes required to align CARML's modules to the specifications of Azure Verified Modules (currently in development). This will enable us to move & publish the modules of the CARML library to the official Public Bicep Registry. You can read more about CARML's future in AVM here.

You can find details on the status of the migration in this issue.

Please note that these changes will affect many interfaces (e.g., the diagnostic settings). We intend to keep this period as short as possible, but are limited by our own available capacity. As we want to avoid one 'big bang' migration, we will incrementally align & move modules, and keep a copy in this repository until the move is concluded. For modules that were already published, we will redirect the proposed changes to the AVM folder of the new repository. In its final state, this AVM folder will contain all modules you can currently find in the modules folder of this repository.

Possible changes include (but are not limited to):

• An update of the extension resource interfaces (i.e., diagnostic settings, RBAC, etc.)
• An update of the README.md that comes with each module (including an update of the utility itself) to allow for a more detailed parameter description
• An update to individual folder names
• The addition of several user defined types (requiring Bicep version 0.21.1)

Modules that are already migrated to AVM will contain a file MOVED-TO-AVM.md to indicate that further contributions to the module should be done in the Public Bicep Registry's repository. Therefore, further contributions to those modules will not be integrated in the CARML repository.

Once the move concluded, the library & CI environment is planned to be maintained. However, several changes to the CARML CI environment will become necessary to ensure a low entry barrier when onboarding both (for example, as per the AVM specs we will need to be less restrictive in our tests).

Common Azure Resource Modules Library

Description

This repository includes a library of mature and curated Bicep modules as well as a Continuous Integration (CI) environment leveraged for modules' validation and versioned publishing.

The CI environment supports both ARM and Bicep and can be leveraged using GitHub actions as well as Azure DevOps pipelines.

Get started

• For introduction guidance visit the Wiki
• For guidance on which version of the code to leverage, see Disclaimer
• For information on contributing, see Contribution
• File an issue via GitHub Issues
• For reference documentation, visit Enterprise-Scale
• For an outline of the module features, visit Module overview

Note: To ensure the modules and environment work as expected, please ensure you are using the latest version of the used tools such as PowerShell and Bicep. Especially in case of the later, note, that you need to manually update the Bicep CLI. For further information, see our troubleshooting guide.

Available Resource Modules

Provider namespace	Resource Type	Name	Deploy
Microsoft.AAD	domainServices	Azure Active Directory Domain Services
Microsoft.AnalysisServices	servers	Analysis Services Servers
Microsoft.ApiManagement	service	API Management Services
Microsoft.App	containerApps	Container Apps
	jobs	Container App Jobs
	managedEnvironments	App ManagedEnvironments
Microsoft.AppConfiguration	configurationStores	App Configuration Stores
Microsoft.Authorization	locks	Authorization Locks (All scopes)
	policyAssignments	Policy Assignments (All scopes)
	policyDefinitions	Policy Definitions (All scopes)
	policyExemptions	Policy Exemptions (All scopes)
	policySetDefinitions	Policy Set Definitions (Initiatives) (All scopes)
	roleAssignments	Role Assignments (All scopes)
	roleDefinitions	Role Definitions (All scopes)
Microsoft.Automation	automationAccounts	Automation Accounts
Microsoft.Batch	batchAccounts	Batch Accounts
Microsoft.Cache	redis	Redis Cache
	redisEnterprise	Redis Cache Enterprise
Microsoft.Cdn	profiles	CDN Profiles
Microsoft.CognitiveServices	accounts	Cognitive Services
Microsoft.Compute	availabilitySets	Availability Sets
	disks	Compute Disks
	diskEncryptionSets	Disk Encryption Sets
	galleries	Azure Compute Galleries
	images	Images
	proximityPlacementGroups	Proximity Placement Groups
	sshPublicKeys	Public SSH Keys
	virtualMachines	Virtual Machines
	virtualMachineScaleSets	Virtual Machine Scale Sets
Microsoft.Consumption	budgets	Consumption Budgets
Microsoft.ContainerInstance	containerGroups	Container Instances Container Groups
Microsoft.ContainerRegistry	registries	Azure Container Registries (ACR)
Microsoft.ContainerService	managedClusters	Azure Kubernetes Service (AKS) Managed Clusters
Microsoft.DataFactory	factories	Data Factories
Microsoft.DataProtection	backupVaults	Data Protection Backup Vaults
Microsoft.Databricks	accessConnectors	Azure Databricks Access Connectors
	workspaces	Azure Databricks Workspaces
Microsoft.DBforMySQL	flexibleServers	DBforMySQL Flexible Servers
Microsoft.DBforPostgreSQL	flexibleServers	DBforPostgreSQL Flexible Servers
Microsoft.DesktopVirtualization	applicationGroups	Azure Virtual Desktop (AVD) Application Groups
	hostPools	Azure Virtual Desktop (AVD) Host Pools
	scalingPlans	Azure Virtual Desktop (AVD) Scaling Plans
	workspaces	Azure Virtual Desktop (AVD) Workspaces
Microsoft.DevTestLab	labs	DevTest Labs
Microsoft.DigitalTwins	digitalTwinsInstances	Digital Twins Instances
Microsoft.DocumentDB	databaseAccounts	DocumentDB Database Accounts
Microsoft.EventGrid	domains	Event Grid Domains
	systemTopics	Event Grid System Topics
	topics	Event Grid Topics
Microsoft.EventHub	namespaces	Event Hub Namespaces
Microsoft.HealthBot	healthBots	Azure Health Bots
Microsoft.HealthcareApis	workspaces	Healthcare API Workspaces
microsoft.insights	actionGroups	Action Groups
	activityLogAlerts	Activity Log Alerts
	components	Application Insights
	dataCollectionEndpoints	Data Collection Endpoints
	dataCollectionRules	Data Collection Rules
	diagnosticSettings	Diagnostic Settings (Activity Logs) for Azure Subscriptions
	metricAlerts	Metric Alerts
	privateLinkScopes	Azure Monitor Private Link Scopes
	scheduledQueryRules	Scheduled Query Rules
	webtests	Web Tests
Microsoft.KeyVault	vaults	Key Vaults
Microsoft.KubernetesConfiguration	extensions	Kubernetes Configuration Extensions
	fluxConfigurations	Kubernetes Configuration Flux Configurations
Microsoft.Logic	workflows	Logic Apps (Workflows)
Microsoft.MachineLearningServices	workspaces	Machine Learning Services Workspaces
Microsoft.Maintenance	maintenanceConfigurations	Maintenance Configurations
Microsoft.ManagedIdentity	userAssignedIdentities	User Assigned Identities
Microsoft.ManagedServices	registrationDefinitions	Registration Definitions
Microsoft.Management	managementGroups	Management Groups
Microsoft.NetApp	netAppAccounts	Azure NetApp Files
Microsoft.Network	applicationGateways	Network Application Gateways
	ApplicationGatewayWebApplicationFirewallPolicies	Application Gateway Web Application Firewall (WAF) Policies
	applicationSecurityGroups	Application Security Groups (ASG)
	azureFirewalls	Azure Firewalls
	bastionHosts	Bastion Hosts
	connections	Virtual Network Gateway Connections
	ddosProtectionPlans	DDoS Protection Plans
	dnsForwardingRulesets	Dns Forwarding Rulesets
	dnsResolvers	DNS Resolvers
	dnsZones	Public DNS Zones
	expressRouteCircuits	ExpressRoute Circuits
	expressRouteGateways	Express Route Gateways
	firewallPolicies	Firewall Policies
	frontDoors	Azure Front Doors
	FrontDoorWebApplicationFirewallPolicies	Front Door Web Application Firewall (WAF) Policies
	ipGroups	IP Groups
	loadBalancers	Load Balancers
	localNetworkGateways	Local Network Gateways
	natGateways	NAT Gateways
	networkInterfaces	Network Interface
	networkManagers	Network Managers
	networkSecurityGroups	Network Security Groups
	networkWatchers	Network Watchers
	privateDnsZones	Private DNS Zones
	privateEndpoints	Private Endpoints
	privateLinkServices	Private Link Services
	publicIPAddresses	Public IP Addresses
	publicIPPrefixes	Public IP Prefixes
	routeTables	Route Tables
	serviceEndpointPolicies	Service Endpoint Policies
	trafficmanagerprofiles	Traffic Manager Profiles
	virtualHubs	Virtual Hubs
	virtualNetworks	Virtual Networks
	virtualNetworkGateways	Virtual Network Gateways
	virtualWans	Virtual WANs
	vpnGateways	VPN Gateways
	vpnSites	VPN Sites
Microsoft.OperationalInsights	workspaces	Log Analytics Workspaces
Microsoft.OperationsManagement	solutions	Operations Management Solutions
Microsoft.PolicyInsights	remediations	Policy Insights Remediations
Microsoft.PowerBIDedicated	capacities	Power BI Dedicated Capacities
Microsoft.Purview	accounts	Purview Accounts
Microsoft.RecoveryServices	vaults	Recovery Services Vaults
Microsoft.Relay	namespaces	Relay Namespaces
Microsoft.ResourceGraph	queries	Resource Graph Queries
Microsoft.Resources	deploymentScripts	Deployment Scripts
	resourceGroups	Resource Groups
	tags	Resources Tags
Microsoft.Search	searchServices	Search Services
Microsoft.Security	azuresecuritycenter	Azure Security Center (Defender for Cloud)
Microsoft.ServiceBus	namespaces	Service Bus Namespaces
Microsoft.ServiceFabric	clusters	Service Fabric Clusters
Microsoft.SignalRService	signalR	SignalR Service SignalR
	webPubSub	SignalR Web PubSub Services
Microsoft.Sql	managedInstances	SQL Managed Instances
	servers	Azure SQL Servers
Microsoft.Storage	storageAccounts	Storage Accounts
Microsoft.Synapse	privateLinkHubs	Azure Synapse Analytics
	workspaces	Synapse Workspaces
Microsoft.VirtualMachineImages	imageTemplates	Virtual Machine Image Templates
Microsoft.Web	connections	API Connections
	hostingEnvironments	App Service Environments
	serverfarms	App Service Plans
	sites	Web/Function Apps
	staticSites	Static Web Apps

Platform

Name	Status
Update API Specs file
Assign Pull Request to Author
Test - ConvertTo-ARMTemplate.ps1
Clean up deployment history
Library PSRule pre-flight validation
Broken Links Check
Linter (audit)
Manage issues for failing pipelines
Update ReadMe Module Tables
Update Static Test Documentation
Sync Docs/Wiki

Disclaimer

Please note that CARML is constantly evolving and introducing new features. The main branch of this repository changes frequently and thus, it always contains the latest available version of the code. Some of the updates may introduce breaking changes as well.

• Default path: To avoid disruptions, use distinct versions available through releases.
• Early adopter path: If the risk of breaking changes is understood and accepted, you can use the code in the main branch directly. However, the CARML team recommends against automatically pulling code from main. It is always recommended to review changes before you pull them into your own repository.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

For specific guidelines on how to contribute to this repository please refer to the Contribution guide Wiki section.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

Learn More

• PowerShell Documentation
• Microsoft Azure Documentation
• GitHubDocs
• Azure Resource Manager
• Bicep

Telemetry

Modules provided in this library have telemetry enabled by default. To learn more about this feature, please refer to the Telemetry article in the wiki.

resourcemodules's Issues

Remaining Modules

Description

• Microsoft.ContainerRegistry/registries @Msanzdelrio
• Microsoft.DataFactory/factories @segraef
• Microsoft.EventHub/namespaces/eventhubs @SomilGanguly
• Microsoft.ServiceFabric @SomilGanguly
• Microsoft.Compute/virtualMachines @eriqua
• Microsoft.DocumentDB (CosmosDB) @Msanzdelrio

General: Add 'primary resource' to module ReadMe title

To improve readability and avoid confusion we should add the 'primary resource' (e.g. Microsoft.KeyVault/vaults) to the title of the module's readme.

Underneath we have the 'ResourceTypes' table that just lists all resources in the template. That may cause confusion as to what resource we aim at with the template. Hence the intended 'highlighting'

Cleanup RBAC roles per module

Right now, most modules have 'all' available RBAC roles as a variable in the template even though only a subset can be applied to the given service.
Where possible we should update these modules and reduce the roles to the once that are actually available.

This will in most instances also drastically reduce the template's size.

Document Dependency Services & High Cost Services

Description

Document Dependency Services & High Cost Services as pre-stage for module deployments and unit tests.

Merge AppService & WebApp modules under `Microsoft.Web/sites`

Both modules have almost the same content with one major difference:

• The AppService module deploys a serverfarm (appServicePlan) directly and references its ID in the subsequent site deployment
• The WebApp module deploys no serverfarm but only requires you to provide its ID in the site deployment

Ideally we merge both together and provide an experience where the ID can be provided as an optional parameter. If provided it is used, if it is not provided, but a name for an AppServicePlan is, an AppServicePlan is deployed and its ID used

Module Pipeline Implementation ADO

Set up the intial set of pipelines required to run the platform on AzureDevOps

• Create V1 of unit-testing pipelines for Azure DevOps
• Create V1 of test-deployment pipelines for Azure Devops
• Create V1 of publish pipelines for Azure Devops
• Create V1 of removal pipelines for AzureDevOps

Create module overview table

Create a table that provides a flat overview of the modules available in this repository.

Modules: Set our custom CuaID as a default value for our templates

For most if not all modules we have support for the CuaID to track consumption & usage of templates.

We could use that concept, generate a custom GuaID and set it as a default value.

Repository structure

Description

For a solid library base concrete file and folder structures must be defined.

• Modules

  • Folder structure
    • Modules/
      ┣ ModuleName/
      ┣ deploy.bicep
      ┣ deploy.json
      ┣ parameters.json
      ┗ readme.md
  • Basic elements (templates, parameters, pipelines, workflows, ...)
  • Readme (deploy to Azure button, readme structure, ...)
  • Naming convention (deploy.json/deploy.bicep/...)

• Repository

  • Folder structure (Resource provider based)
    • Modules/
      ┣ Microsoft.Compute/
      ┃ ┣ VirtualMachines/
      ┃ ┃ ┣ deploy.bicep
      ┃ ┃ ┣ deploy.json
      ┃ ┃ ┣ parameters.json
      ┃ ┃ ┗ readme.md
      ┃ ┗ VirtualMachineScaleSets/
      ┃ ┣ deploy.bicep
      ┃ ┣ deploy.json
      ┃ ┣ linux.parameters.json
      ┃ ┣ readme.md
      ┃ ┗ windows.parameters.json
      ┣ Microsoft.Storage/
      ┃ ┗ StorageAccounts/
      ┃ ┣ deploy.bicep
      ┃ ┣ deploy.json
      ┃ ┣ parameters.json
      ┃ ┗ readme.md

Kind property in Deployment Script modules is hardcoded

Description

Kind property in Deployment Script modules is hardcoded as it can't be parameterized because of PG bug

Steps to reproduce

1. NA
2. NA

Screenshots

Prioritized Modules

Description

Add/Develop additional compliant Modules for Azure resources/services

Prioritized resources:

• App Services
• Storage Account
• SQL Server and Databases
• CosmosDb
• Event Hub
• Event Grid
• AKS
• Virtual Machines (Linux, Windows)
• Virtual Machine Scale Sets (Linux, Windows)
• Service Fabric

References

• Azure/Enterprise-Scale#708
• https://github.com/Azure/Enterprise-Scale/tree/main/workloads
• Work in Progress library at [Azure/Modules]
• #168

Update module test script based on changed lock parameter

Description

arm\.global\global.module.tests.ps1 is still referencing lockForDeletion. This would need to be fixed with the replaced lock parameter which takes its place.

Module: NetworkWatcher merge NSGFlowLogs

The NSG Flow Logs Module resources are of type Microsoft.Network/networkWatchers/flowLogs and should be merged into the network watcher module.

They are also implemented in the NSG module itself which however seems to be fine to reduce the number of deployments in case somebody wants to do both.

However, it does not make sense to have the NetworkWatcher module + NSGFlowLogsModule + NSG Module (wirh NSG Flow Logs)

Documentation, Wiki and FAQ

Description

A common set of FAQs and Wiki needs to be set up.
General documentation is required for

• What is a Module?
• Module Dependencies?
• What is a Module used for?
• How to deploy a Module (with PS, CLI, AzOps, TF, ...)?
• What is a Workload?
• How have Modules to do with Azure Landing Zones?
• How does this fit into CAF?
• What collaboration platform is recommended (GitHub/ADO)?
• What is IaC?
• Azure Resource Manager Reference?
• What are GitHub Actions and Workflows?
• Are Azure Pipelines supported?
• How to contribute a Module?
• How to structure a Module (ARM Template) according to an ARM Template syntax?
• How to structure a Module (Bicep Module) according to an ARM Template syntax?
• What are Constructs?

Other

• naming in general for parameters in modules to remain consistent naming structure within templates and files (input parameter as well as output parameters, camelcasing)

References

https://docs.microsoft.com/en-us/azure/azure-resource-manager/bicep/file
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/syntax
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/plan/workloads#what-is-a-workload
https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/extension-resource-types
https://docs.microsoft.com/en-us/devops/deliver/what-is-infrastructure-as-code
https://docs.microsoft.com/en-us/dotnet/architecture/cloud-native/infrastructure-as-code
https://docs.microsoft.com/en-us/azure/architecture/framework/devops/automation-infrastructure

Resolve ambiguous modules

The following modules need another look:

• AzureSecurityCenter: Ambiguous provider
• appService: overlapping provider with appServicePlan
• appServicePlan: overlapping provider with appService
• webApp: overlapping provider with siteFunctions
• sitesFunction: overlapping provider with webApp
• OpenSystemsNVA: Ambiguous provider

Module: VPN Gateway - vNet is always assumed to be in the same RG

Create/Generate `Deploy to Azure` Button

Example

Code

[![Deploy to Azure](/docs/media/deploytoazure.svg?sanitize=true)](<https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FModules%2Fmain%2Farm%2FMicrosoft.AnalysisServices%2Fservers%2Fdeploy.json>)

[![Deploy To Azure US Gov](/docs/media/deploytoazuregov.svg?sanitize=true)](<https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FModules%2Fmain%2Farm%2FMicrosoft.AnalysisServices%2Fservers%2Fdeploy.json>)

[![Visualize](/docs/media/visualizebutton.svg?sanitize=true)](<http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FModules%2Fmain%2Farm%2FMicrosoft.AnalysisServices%2Fservers%2Fdeploy.json>)

References

https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-azure-button
https://devblogs.microsoft.com/cse/2017/01/17/the-deploy-to-azure-button/
https://medium.com/@codeprincess/get-your-own-azure-button-now-8d79b1811061

Add PE to SQLServer bicep template

Releases, Tags and GitHub Packages

Description

Do we have requirements to use

• Releases
• Tags
• GitHub Packages

to further enable development of components without affecting already existing reference to older versions.
Especially if people are going to and want to reference raw content URLs without having an impact if the repository gets updated with never versions of improved code.

Pipeline: Add logic to replace GUID placeholders (e.g. subId) with secrets

We're currently exposing subscription IDs in the repository to enable testing.

To hide them going forward we should implement a logic that replaces placeholders in parameter files during test & deployment (e.g. ) with the correponding secret stored in GitHub

Auto-Generate Module Table

Now that we have the module table & script available it might be worth thinking about auto-generating / updating the list.

While the implementation should be relatively straight forward as the main script is already available, working around the branching policies may be the trickier part.

Test Deployment of Bicep Modules in Azure US Gov and Azure China

Description

Test Deployment of Bicep Modules in Azure US Gov and Azure China.

Acceptance Criteria

Manual deployment validation via Test-AzResourceGroupDeployment and New-AzResourceGroupDeployment is required and must be successful.
Optionally you can make use of the already existing Module Test Pipelines (https://github.com/Azure/ResourceModules/.github/workflows). You just have to set your ARM credentials to test in your environment.

ResourceModules/.github/workflows/ms.apimanagement.service.authorizationservers.yml

Line 22 in 17e2e29

AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}

Modules to validate

Module	Azure US Gov	Azure China	Assignee
ReferenceModule	✔️	✔️	@segraef
Activity Log Alert
ActivityLog
Analysis Services
API Connection
Api Management Service Apis
Api Management Service Authorization Servers
Api Management Service Backends
Api Management Service Cache
Api Management Service Named Values
Api Management Service Products
Api Management Subscriptions
Api Management
App Service Environment
Application Insights
ApplicationGateway
ApplicationSecurityGroups
AppServicePlan
AutoManage
AutomationAccounts
AvailabilitySet
AVD Application Groups
AVD Applications
AVD HostPools
AVD Workspaces
Azure Databricks
Azure Health Bot
Azure Monitor Private Link Scope
AzureBastion
AzureFirewall
AzureKubernetesService
AzureNetAppFiles
AzureSecurityCenter
AzureSQLDatabase
AzureSQLServer
Batch Accounts
Budgets
CognitiveServices
ContainerInstances
ContainerRegistry
DataFactory
DDoS Protection Plans
Deployment Scripts
DiskEncryptionSet
Event Grid
EventHub Namespaces
EventHubs
ExpressRoute Circuit
Image Templates
Image
IP Groups
KeyVault
LoadBalancer
Local Network Gateway
LogAnalytics
LogicApp
Machine Learning Services
Management groups
Metric Alert
NAT Gateway
Network Watcher
NetworkSecurityGroups
NSG Flow Logs
PolicyAssignment
PolicyDefinition
PolicyExemption
policySetDefinition
PrivateDnsZones
PrivateEndpoints
ProximityPlacementGroup
Public IP Addresses
Public IP Prefixes
RecoveryServicesVaults
registrationDefinitions
Resource Group
Role Assignments
Role Definitions
RouteTables
Scheduled Query Rules
ServiceBusNamespaces
ServiceBusQueues
Shared Image Definition
Shared Image Gallery
Software Update Configuration
SQL Managed Instances Database
SQL Managed Instances
StorageAccounts
TrafficManager
User Assigned Identities
Virtual Machine Scale Sets
Virtual Machines
Virtual Network
Virtual Wan
VirtualNetworkGateway
VirtualNetworkGatewayConnection
VirtualNetworkPeering
Web/Function App

References

• https://docs.microsoft.com/en-us/azure/azure-government/compare-azure-government-global-azure

Module: VPN Gateway - PIP defaults to zone 1, should default to noZone

Pipeline: Add automatic PR triggers (change on main)

Just the way we did it in IaCS we should trigger pipelines/workflows automatically on a change in main.

Rationale for existence of Azure/Modules

Description

In general the question is if it makes sense to develop Azure Modules and templates in this repository or if it's just better to use/develop these under Azure Quickstart Templates or ESLZ Workload Templates

Add Readme to composite action

Bicep: Refactor diagnostic settings implementation for resources supporting them and document for contribution guide

Enable the user to define the logs on a case-by-case basis with 'all' as the default
Ref https://github.com/Azure/ResourceModules/blob/main/arm/Microsoft.Insights/diagnosticSettings/deploy.bicep

Upgrade Issue Forms

Description

Create Issue Forms

https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository#creating-issue-forms

Super Linter: ARM (ARM-TTK) and JSON compliance

Description

Linting for ARM (ARM-TTK) and JSON is currently disabled since it throws errors due to non-compliance with some parts of the ARM templates.

Steps to reproduce

https://github.com/Azure/Modules/blob/fba751cac154a4d07dbe285077a20bb664b0298f/.github/workflows/linter.yml#L19-L20
Workflow run: https://github.com/Azure/Modules/actions/runs/1141463824

Screenshots

Move virtualNetworkPeerings

Description

virtualNetworkPeerings needs to be moved from /arm/Microsoft.Network/virtualNetwork/virtualNetworkPeerings to /arm/Microsoft.Network/virtualNetwork/virtualNetworkResources/virtualNetworkPeerings if I'm correct.

Develop constructs/variants

Description

Move all modules which support easy deployments of multiple instances into constructs and create variants/constructs.

virtualMachines
roleAssignments
virtualNetworkpeerings

Setup Branch and Security policy

Description

Setup Branch policy and Security Scanning.

MD files showing as binary in PRs

Description

When reviewing PRs containing some markdown files, some of the files show as binary.
An assumed cause is that the encoding of files are UTF16-LE. The files that can be reviewed in a PR (working as expected) are mostly UTF8.

Change the encoding of all MD files to UTF8 to see if they work as indented again in PRs.

Compute: Galleries Images

Error: [-] [galleries] parameters section should contain all parameters from the deploy.json file 62ms (60ms|2ms)

Pipeline failure due to allowed locations policy violation

Description

Allowed location policy deployed by the PolicyAssignment module prevents resources to be created in locations different than westus and westus2.

Steps to reproduce

1. Deploy any resource in westus as per default workflows

Screenshots

E.g. storage account

https://github.com/Azure/ResourceModules/runs/3707436376?check_suite_focus=true#step:4:124

Accounts CognitiveServices

Error: [-] [accounts] Output section should contain all outputs defined in the deploy.json file 104ms (101ms|3ms)

Construct: Management Group structure

Description

After converting the managementGroup module, it only deploys a single management group. To retain the functionality of being able to deploy an entire management group structure, a construct using this singular managementGroup module should be created.

Use same logic for deploying locks on modules

Description

There are two approaches to enable locks in modules. The module which is set up different is Microsoft.Insights/privateLinkScopes and Microsoft.Resources/resourceGroups . They have the different lock modes you can enable as a parameter lock while for the other modules, they just take a boolean for lockForDeletion, which only exposes the ability to deploy a CanNotDelete lock.

Align on one approach and make that the default for the modules which support locks.

Investigate an approach to maintaining the latest resources (modules) in alignment to the latest API Versions

Description

We need to have a method for reading the latest published API versions from Azure resources and find a smart way to creating GitHub issues where it makes sense so that we don't constantly populate issues that makes it hard to track or maintain.

Gov: Api Update required for activityLogAlerts

Error: [-] In [activityLogAlerts] used resource type [activityLogAlerts] should use on of the recent API version(s). Currently using [2020-10-01] 152ms (120ms|32ms)

Other Items

Description

• be conscious about naming and avoid creating too many repositories
• make use of GitHub packages
• make use of Tags/Releases
• Sanitization Check
• Migrate Global Module Unit Test workflows
• Deploy to Azure Button
• Auto-Readme creation workflow
• remain linkage between ES and Modules @SomilGanguly

References

https://github.com/equinor/AzModules/blob/bicepifi/docs/Module-Guidelines.md#module-outputsreturns

UX: Advanced Portal Deployments with createUiDefinition.json

References

UI Definition Sandbox: https://portal.azure.com/?feature.customPortal=false&#blade/Microsoft_Azure_CreateUIDef/SandboxBlade

createUiDefinition Overview

createUiDefinition UI elements reference

testing createUiDefinition

Use same logic for deploying diagnosticSettings on modules

Description

There are two approaches to enable logs in modules. The module which is set up different is Microsoft.Insights/diagnosticLogs. It has the different logs you can enable as a parameter logsToEnable while for the others, what logs to enable is "hardcoded" into vars.

Align on one approach and make that the default for the modules which support diagnosticSettings

Bicep: Create script that allows a customer to transform all bicep files to their ARM counterpart

Some customers may not want to use bicep e.g. because it is not on version 1.0 yet.

To enable those, we should provide a utility script that is capable of translation all bicep files to ARM

Move `builtInRoleNames` variable into rbac module

Description

Today the builtInRoleNames variable is in the deploy.bicep files for many of the resources. They should be moved into the module, as it is here they are used.

Remove comment in param files

Description

Clean up comments in param files. Make sure that the examples that the commented params are shown in the readme file rather than in the param file it self.

Easy to find Module list

Description

To ease the search for Modules, a Modules list needs to be developed in https://github.com/Azure/Modules/tree/main/arm to have an overview of all current Modules with direct links to their respective folders they're sitting in. It would be also nice to have an overview like this: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-services-resource-providers

Create/Fix and test Bicep templates

Description

Some ARM templates still have non-Bicep compliant decompilation errors which need to be fixed.

Steps to reproduce

bicep decompile .\deploy.json

Repository name

Description

Based on the decision in #10 we also have to consider the naming of this repository

• ResourceModules
• Modules
• Service Modules / ServiceModules
• Units

Add Public Bicep Registery to Publish Action/Pipeline

Add support for the 'public bicep registry' to the publish actions (GitHub) and pipeline (Azure DevOps) to enable the modules consumption by other bicep resources