Skip to content

Commit dcfa3d8

Browse files
csharpfritzcsharpfritz
committed
feat: add Azure infrastructure modules and parameters for web application deployment
1 parent b1858a9 commit dcfa3d8

8 files changed

Lines changed: 402 additions & 0 deletions

File tree

‎AppHost/infra/web/web.tmpl.bicepparam‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
using './web.module.bicep'
2+
3+
param azure_storage_outputs_tableendpoint = '{{ .Env.AZURE_STORAGE_TABLEENDPOINT }}'
4+
param certificateName = '{{ parameter "certificateName" }}'
5+
param domainApex = '{{ parameter "domainApex" }}'
6+
param domainWww = '{{ parameter "domainWww" }}'
7+
param outputs_azure_container_apps_environment_default_domain = '{{ .Env.AZURE_CONTAINER_APPS_ENVIRONMENT_DEFAULT_DOMAIN }}'
8+
param outputs_azure_container_apps_environment_id = '{{ .Env.AZURE_CONTAINER_APPS_ENVIRONMENT_ID }}'
9+
param outputs_azure_container_registry_endpoint = '{{ .Env.AZURE_CONTAINER_REGISTRY_ENDPOINT }}'
10+
param outputs_azure_container_registry_managed_identity_id = '{{ .Env.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID }}'
11+
param web_containerimage = '{{ .Image }}'
12+
param web_containerport = '{{ targetPortOrDefault 8080 }}'
13+
param web_identity_outputs_clientid = '{{ .Env.WEB_IDENTITY_CLIENTID }}'
14+
param web_identity_outputs_id = '{{ .Env.WEB_IDENTITY_ID }}'
15+
param wwwCertificateName = '{{ parameter "wwwCertificateName" }}'

‎infra/azure-storage/azure-storage.module.bicep‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
@description('The location for the resource(s) to be deployed.')
2+
param location string = resourceGroup().location
3+
4+
resource azure_storage 'Microsoft.Storage/storageAccounts@2024-01-01' = {
5+
name: take('azurestorage${uniqueString(resourceGroup().id)}', 24)
6+
kind: 'StorageV2'
7+
location: location
8+
sku: {
9+
name: 'Standard_GRS'
10+
}
11+
properties: {
12+
accessTier: 'Hot'
13+
allowSharedKeyAccess: false
14+
minimumTlsVersion: 'TLS1_2'
15+
networkAcls: {
16+
defaultAction: 'Allow'
17+
}
18+
}
19+
tags: {
20+
'aspire-resource-name': 'azure-storage'
21+
}
22+
}
23+
24+
resource blobs 'Microsoft.Storage/storageAccounts/blobServices@2024-01-01' = {
25+
name: 'default'
26+
parent: azure_storage
27+
}
28+
29+
output blobEndpoint string = azure_storage.properties.primaryEndpoints.blob
30+
31+
output queueEndpoint string = azure_storage.properties.primaryEndpoints.queue
32+
33+
output tableEndpoint string = azure_storage.properties.primaryEndpoints.table
34+
35+
output name string = azure_storage.name

‎infra/main.bicep‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
targetScope = 'subscription'
2+
3+
@minLength(1)
4+
@maxLength(64)
5+
@description('Name of the environment that can be used as part of naming resource convention, the name of the resource group for your application will use this name, prefixed with rg-')
6+
param environmentName string
7+
8+
@minLength(1)
9+
@description('The location used for all deployed resources')
10+
param location string
11+
12+
@description('Id of the user or app to assign application roles')
13+
param principalId string = ''
14+
15+
param certificateName string
16+
param domainApex string
17+
param domainWww string
18+
param wwwCertificateName string
19+
20+
var tags = {
21+
'azd-env-name': environmentName
22+
}
23+
24+
resource rg 'Microsoft.Resources/resourceGroups@2022-09-01' = {
25+
name: 'rg-${environmentName}'
26+
location: location
27+
tags: tags
28+
}
29+
module resources 'resources.bicep' = {
30+
scope: rg
31+
name: 'resources'
32+
params: {
33+
location: location
34+
tags: tags
35+
principalId: principalId
36+
}
37+
}
38+
39+
module azure_storage 'azure-storage/azure-storage.module.bicep' = {
40+
name: 'azure-storage'
41+
scope: rg
42+
params: {
43+
location: location
44+
}
45+
}
46+
module web_identity 'web-identity/web-identity.module.bicep' = {
47+
name: 'web-identity'
48+
scope: rg
49+
params: {
50+
location: location
51+
}
52+
}
53+
module web_roles_azure_storage 'web-roles-azure-storage/web-roles-azure-storage.module.bicep' = {
54+
name: 'web-roles-azure-storage'
55+
scope: rg
56+
params: {
57+
azure_storage_outputs_name: azure_storage.outputs.name
58+
location: location
59+
principalId: web_identity.outputs.principalId
60+
}
61+
}
62+
63+
output MANAGED_IDENTITY_CLIENT_ID string = resources.outputs.MANAGED_IDENTITY_CLIENT_ID
64+
output MANAGED_IDENTITY_NAME string = resources.outputs.MANAGED_IDENTITY_NAME
65+
output AZURE_LOG_ANALYTICS_WORKSPACE_NAME string = resources.outputs.AZURE_LOG_ANALYTICS_WORKSPACE_NAME
66+
output AZURE_CONTAINER_REGISTRY_ENDPOINT string = resources.outputs.AZURE_CONTAINER_REGISTRY_ENDPOINT
67+
output AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID string = resources.outputs.AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID
68+
output AZURE_CONTAINER_REGISTRY_NAME string = resources.outputs.AZURE_CONTAINER_REGISTRY_NAME
69+
output AZURE_CONTAINER_APPS_ENVIRONMENT_NAME string = resources.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_NAME
70+
output AZURE_CONTAINER_APPS_ENVIRONMENT_ID string = resources.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_ID
71+
output AZURE_CONTAINER_APPS_ENVIRONMENT_DEFAULT_DOMAIN string = resources.outputs.AZURE_CONTAINER_APPS_ENVIRONMENT_DEFAULT_DOMAIN
72+
output AZURE_STORAGE_TABLEENDPOINT string = azure_storage.outputs.tableEndpoint
73+
output WEB_IDENTITY_CLIENTID string = web_identity.outputs.clientId
74+
output WEB_IDENTITY_ID string = web_identity.outputs.id

‎infra/main.parameters.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"principalId": {
6+
"value": "${AZURE_PRINCIPAL_ID}"
7+
},
8+
"certificateName": {
9+
"value": "${AZURE_CERTIFICATE_NAME}"
10+
},
11+
"domainApex": {
12+
"value": "${AZURE_DOMAIN_APEX}"
13+
},
14+
"domainWww": {
15+
"value": "${AZURE_DOMAIN_WWW}"
16+
},
17+
"wwwCertificateName": {
18+
"value": "${AZURE_WWW_CERTIFICATE_NAME}"
19+
},
20+
"environmentName": {
21+
"value": "${AZURE_ENV_NAME}"
22+
},
23+
"location": {
24+
"value": "${AZURE_LOCATION}"
25+
}
26+
}
27+
}
28+

‎infra/resources.bicep‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
@description('The location used for all deployed resources')
2+
param location string = resourceGroup().location
3+
@description('Id of the user or app to assign application roles')
4+
param principalId string = ''
5+
6+
7+
@description('Tags that will be applied to all resources')
8+
param tags object = {}
9+
10+
var resourceToken = uniqueString(resourceGroup().id)
11+
12+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
13+
name: 'mi-${resourceToken}'
14+
location: location
15+
tags: tags
16+
}
17+
18+
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
19+
name: replace('acr-${resourceToken}', '-', '')
20+
location: location
21+
sku: {
22+
name: 'Basic'
23+
}
24+
tags: tags
25+
}
26+
27+
resource caeMiRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
28+
name: guid(containerRegistry.id, managedIdentity.id, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d'))
29+
scope: containerRegistry
30+
properties: {
31+
principalId: managedIdentity.properties.principalId
32+
principalType: 'ServicePrincipal'
33+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')
34+
}
35+
}
36+
37+
resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
38+
name: 'law-${resourceToken}'
39+
location: location
40+
properties: {
41+
sku: {
42+
name: 'PerGB2018'
43+
}
44+
}
45+
tags: tags
46+
}
47+
48+
resource containerAppEnvironment 'Microsoft.App/managedEnvironments@2024-02-02-preview' = {
49+
name: 'cae-${resourceToken}'
50+
location: location
51+
properties: {
52+
workloadProfiles: [{
53+
workloadProfileType: 'Consumption'
54+
name: 'consumption'
55+
}]
56+
appLogsConfiguration: {
57+
destination: 'log-analytics'
58+
logAnalyticsConfiguration: {
59+
customerId: logAnalyticsWorkspace.properties.customerId
60+
sharedKey: logAnalyticsWorkspace.listKeys().primarySharedKey
61+
}
62+
}
63+
}
64+
tags: tags
65+
66+
resource aspireDashboard 'dotNetComponents' = {
67+
name: 'aspire-dashboard'
68+
properties: {
69+
componentType: 'AspireDashboard'
70+
}
71+
}
72+
73+
}
74+
75+
output MANAGED_IDENTITY_CLIENT_ID string = managedIdentity.properties.clientId
76+
output MANAGED_IDENTITY_NAME string = managedIdentity.name
77+
output MANAGED_IDENTITY_PRINCIPAL_ID string = managedIdentity.properties.principalId
78+
output AZURE_LOG_ANALYTICS_WORKSPACE_NAME string = logAnalyticsWorkspace.name
79+
output AZURE_LOG_ANALYTICS_WORKSPACE_ID string = logAnalyticsWorkspace.id
80+
output AZURE_CONTAINER_REGISTRY_ENDPOINT string = containerRegistry.properties.loginServer
81+
output AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID string = managedIdentity.id
82+
output AZURE_CONTAINER_REGISTRY_NAME string = containerRegistry.name
83+
output AZURE_CONTAINER_APPS_ENVIRONMENT_NAME string = containerAppEnvironment.name
84+
output AZURE_CONTAINER_APPS_ENVIRONMENT_ID string = containerAppEnvironment.id
85+
output AZURE_CONTAINER_APPS_ENVIRONMENT_DEFAULT_DOMAIN string = containerAppEnvironment.properties.defaultDomain

‎infra/web-identity/web-identity.module.bicep‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
@description('The location for the resource(s) to be deployed.')
2+
param location string = resourceGroup().location
3+
4+
resource web_identity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
5+
name: take('web_identity-${uniqueString(resourceGroup().id)}', 128)
6+
location: location
7+
}
8+
9+
output id string = web_identity.id
10+
11+
output clientId string = web_identity.properties.clientId
12+
13+
output principalId string = web_identity.properties.principalId
14+
15+
output principalName string = web_identity.name

‎infra/web-roles-azure-storage/web-roles-azure-storage.module.bicep‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
@description('The location for the resource(s) to be deployed.')
2+
param location string = resourceGroup().location
3+
4+
param azure_storage_outputs_name string
5+
6+
param principalId string
7+
8+
resource azure_storage 'Microsoft.Storage/storageAccounts@2024-01-01' existing = {
9+
name: azure_storage_outputs_name
10+
}
11+
12+
resource azure_storage_StorageBlobDataContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
13+
name: guid(azure_storage.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'))
14+
properties: {
15+
principalId: principalId
16+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
17+
principalType: 'ServicePrincipal'
18+
}
19+
scope: azure_storage
20+
}
21+
22+
resource azure_storage_StorageTableDataContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
23+
name: guid(azure_storage.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3'))
24+
properties: {
25+
principalId: principalId
26+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')
27+
principalType: 'ServicePrincipal'
28+
}
29+
scope: azure_storage
30+
}
31+
32+
resource azure_storage_StorageQueueDataContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
33+
name: guid(azure_storage.id, principalId, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88'))
34+
properties: {
35+
principalId: principalId
36+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')
37+
principalType: 'ServicePrincipal'
38+
}
39+
scope: azure_storage
40+
}

0 commit comments

Comments
 (0)