Added rbac + lock; removed arm

Azure · Oct 6, 2021 · 32446c1 · 32446c1
1 parent 2df8eff
commit 32446c1
Show file tree

Hide file tree

Showing 5 changed files with 274 additions and 142 deletions.
diff --git a/arm/Microsoft.Network/privateEndpoints/.bicep/nested_rbac.bicep b/arm/Microsoft.Network/privateEndpoints/.bicep/nested_rbac.bicep
@@ -0,0 +1,11 @@
+param roleAssignmentObj object
+param builtInRoleNames object
+param resourceName string
+
+resource roleAssigment 'Microsoft.Network/privateEndpoints/providers/roleAssignments@2020-04-01-preview' = [for principalId in roleAssignmentObj.principalIds: {
+  name: '${resourceName}/Microsoft.Authorization/${guid(resourceName, principalId, roleAssignmentObj.roleDefinitionIdOrName)}'
+  properties: {
+    roleDefinitionId: (contains(builtInRoleNames, roleAssignmentObj.roleDefinitionIdOrName) ? builtInRoleNames[roleAssignmentObj.roleDefinitionIdOrName] : roleAssignmentObj.roleDefinitionIdOrName)
+    principalId: principalId
+  }
+}]
diff --git a/arm/Microsoft.Network/privateEndpoints/deploy.bicep b/arm/Microsoft.Network/privateEndpoints/deploy.bicep
@@ -16,12 +16,36 @@ param privateDNSId string = ''
 @description('Optional. Location for all Resources.')
 param location string = resourceGroup().location
 
+@description('Optional. Switch to lock Traffic Manager from deletion.')
+param lockForDeletion bool = false
+
+@description('Optional. Array of role assignment objects that contain the \'roleDefinitionIdOrName\' and \'principalId\' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'')
+param roleAssignments array = []
+
 @description('Optional. Tags to be applied on all resources/resource groups in this deployment.')
 param tags object = {}
 
 @description('Optional. Customer Usage Attribution id (GUID). This GUID must be previously registered')
 param cuaId string = ''
 
+var builtInRoleNames = {
+  'Owner': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','8e3af657-a8ff-443c-a75c-2fe8c4bcb635')
+  'Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','b24988ac-6180-42a0-ab88-20f7382dd24c')
+  'Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','acdd72a7-3385-48ef-bd42-f606fba81ae7')
+  'Avere Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','4f8fab4f-1852-4a58-a46a-8eaf358af14a')
+  'Log Analytics Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','92aaf0da-9dab-42b6-94a3-d43ce8d16293')
+  'Log Analytics Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','73c42c96-874c-492b-b04d-ab87d138a893')
+  'Managed Application Contributor Role': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','641177b8-a67a-45b9-a033-47bc880bb21e')
+  'Managed Application Operator Role': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','c7393b34-138c-406f-901b-d8cf2b17e6ae')
+  'Managed Applications Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','b9331d33-8a36-4f8c-b097-4f54124fdb44')
+  'Monitoring Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','749f88d5-cbae-40b8-bcfc-e573ddc772fa')
+  'Monitoring Metrics Publisher': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','3913510d-42f4-4e42-8a64-420c390055eb')
+  'Monitoring Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','43d0d8ad-25c7-4714-9337-8ba259a9fe05')
+  'Network Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','4d97b98b-1d4f-4787-a291-c67834d212e7')
+  'Resource Policy Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','36243c78-bf99-498c-9df9-86d9f8d28608')
+  'User Access Administrator': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')
+}
+
 module pid_cuaId './.bicep/nested_pid.bicep' = if (!empty(cuaId)) {
   name: 'pid-${cuaId}'
   params: {}
@@ -63,6 +87,22 @@ resource privateEndpoint 'Microsoft.Network/privateEndpoints@2021-02-01' = {
   }
 }
 
+resource privateEndpoint_lock 'Microsoft.Authorization/locks@2016-09-01' = if (lockForDeletion) {
+  name: '${privateEndpoint.name}-doNotDelete'
+  properties: {
+    level: 'CanNotDelete'
+  }
+  scope: privateEndpoint
+}
+
+module privateEndpoint_rbac './.bicep/nested_rbac.bicep' = [for (roleAssignment, index) in roleAssignments: {
+  name: 'rbac-${deployment().name}${index}'
+  params: {
+    roleAssignmentObj: roleAssignment
+    builtInRoleNames: builtInRoleNames
+    resourceName: privateEndpoint.name
+  }
+}]
 
 output privateEndpointResourceGroup string = resourceGroup().name
 output privateEndpointResourceId string = privateEndpoint.id

diff --git a/arm/Microsoft.Network/privateEndpoints/deploy.json b/arm/Microsoft.Network/privateEndpoints/deploy.json
diff --git a/arm/Microsoft.Network/privateEndpoints/readme.md b/arm/Microsoft.Network/privateEndpoints/readme.md
Resource Type	Api Version
`Microsoft.Resources/deployments`	2020-10-01
`Microsoft.Network/privateEndpoints`	2021-02-01
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups`	2021-02-01
Parameter Name	Type	Description	DefaultValue	Possible values
`privateEndpointName`	string	Required. Name of the private endpoint resource to create
`targetSubnetId`	string	Required. Resource Id of the subnet where the endpoint needs to be connected
`serviceResourceId`	string	Required. Resource Id of the resource that needs to be connected to the network
`groupId`	array	Required. Subtype(s) of the connection to be created. The allowed values depend on the type serviceResourceId refers to. Currently only array of a single element are supported.		See here for possible values (subresources column). For Azure DataFactory: portal, dataFactory
`privateDNSId`	string	Optional. Resource id of the private DNS zone
`location`	string	Optional. Location for all Resources	resourceGroup().location
`tags`	object	Optional. Tags of the resource
`cuaId`	string	Optional. Customer Usage Attribution id (GUID). This GUID must be previously registered
Output Name	Type	Description
`privateEndpointResourceGroup`	string	The name of the Resource Group the resources was deployed to
`privateEndpointResourceId`	string	The Resource id of the resource deployed.
`privateEndpointName`	string	The Name of the deployed private endpoint.