diff --git a/arm/Microsoft.Network/privateEndpoints/.bicep/nested_rbac.bicep b/arm/Microsoft.Network/privateEndpoints/.bicep/nested_rbac.bicep new file mode 100644 index 0000000000..9a0c576382 --- /dev/null +++ b/arm/Microsoft.Network/privateEndpoints/.bicep/nested_rbac.bicep @@ -0,0 +1,11 @@ +param roleAssignmentObj object +param builtInRoleNames object +param resourceName string + +resource roleAssigment 'Microsoft.Network/privateEndpoints/providers/roleAssignments@2020-04-01-preview' = [for principalId in roleAssignmentObj.principalIds: { + name: '${resourceName}/Microsoft.Authorization/${guid(resourceName, principalId, roleAssignmentObj.roleDefinitionIdOrName)}' + properties: { + roleDefinitionId: (contains(builtInRoleNames, roleAssignmentObj.roleDefinitionIdOrName) ? builtInRoleNames[roleAssignmentObj.roleDefinitionIdOrName] : roleAssignmentObj.roleDefinitionIdOrName) + principalId: principalId + } +}] diff --git a/arm/Microsoft.Network/privateEndpoints/deploy.bicep b/arm/Microsoft.Network/privateEndpoints/deploy.bicep index 2c42e32d0c..ce56bed620 100644 --- a/arm/Microsoft.Network/privateEndpoints/deploy.bicep +++ b/arm/Microsoft.Network/privateEndpoints/deploy.bicep @@ -16,12 +16,36 @@ param privateDNSId string = '' @description('Optional. Location for all Resources.') param location string = resourceGroup().location +@description('Optional. Switch to lock Traffic Manager from deletion.') +param lockForDeletion bool = false + +@description('Optional. Array of role assignment objects that contain the \'roleDefinitionIdOrName\' and \'principalId\' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'') +param roleAssignments array = [] + @description('Optional. Tags to be applied on all resources/resource groups in this deployment.') param tags object = {} @description('Optional. Customer Usage Attribution id (GUID). This GUID must be previously registered') param cuaId string = '' +var builtInRoleNames = { + 'Owner': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','8e3af657-a8ff-443c-a75c-2fe8c4bcb635') + 'Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','b24988ac-6180-42a0-ab88-20f7382dd24c') + 'Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','acdd72a7-3385-48ef-bd42-f606fba81ae7') + 'Avere Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','4f8fab4f-1852-4a58-a46a-8eaf358af14a') + 'Log Analytics Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','92aaf0da-9dab-42b6-94a3-d43ce8d16293') + 'Log Analytics Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','73c42c96-874c-492b-b04d-ab87d138a893') + 'Managed Application Contributor Role': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','641177b8-a67a-45b9-a033-47bc880bb21e') + 'Managed Application Operator Role': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','c7393b34-138c-406f-901b-d8cf2b17e6ae') + 'Managed Applications Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','b9331d33-8a36-4f8c-b097-4f54124fdb44') + 'Monitoring Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','749f88d5-cbae-40b8-bcfc-e573ddc772fa') + 'Monitoring Metrics Publisher': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','3913510d-42f4-4e42-8a64-420c390055eb') + 'Monitoring Reader': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','43d0d8ad-25c7-4714-9337-8ba259a9fe05') + 'Network Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','4d97b98b-1d4f-4787-a291-c67834d212e7') + 'Resource Policy Contributor': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','36243c78-bf99-498c-9df9-86d9f8d28608') + 'User Access Administrator': subscriptionResourceId('Microsoft.Authorization/roleDefinitions','18d7d88d-d35e-4fb5-a5c3-7773c20a72d9') +} + module pid_cuaId './.bicep/nested_pid.bicep' = if (!empty(cuaId)) { name: 'pid-${cuaId}' params: {} @@ -63,6 +87,22 @@ resource privateEndpoint 'Microsoft.Network/privateEndpoints@2021-02-01' = { } } +resource privateEndpoint_lock 'Microsoft.Authorization/locks@2016-09-01' = if (lockForDeletion) { + name: '${privateEndpoint.name}-doNotDelete' + properties: { + level: 'CanNotDelete' + } + scope: privateEndpoint +} + +module privateEndpoint_rbac './.bicep/nested_rbac.bicep' = [for (roleAssignment, index) in roleAssignments: { + name: 'rbac-${deployment().name}${index}' + params: { + roleAssignmentObj: roleAssignment + builtInRoleNames: builtInRoleNames + resourceName: privateEndpoint.name + } +}] output privateEndpointResourceGroup string = resourceGroup().name output privateEndpointResourceId string = privateEndpoint.id diff --git a/arm/Microsoft.Network/privateEndpoints/deploy.json b/arm/Microsoft.Network/privateEndpoints/deploy.json deleted file mode 100644 index 7ca1742556..0000000000 --- a/arm/Microsoft.Network/privateEndpoints/deploy.json +++ /dev/null @@ -1,142 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "privateEndpointName": { - "type": "string", - "metadata": { - "description": "Required. Name of the private endpoint resource to create." - } - }, - "targetSubnetId": { - "type": "string", - "metadata": { - "description": "Required. Resource Id of the subnet where the endpoint needs to be created." - } - }, - "serviceResourceId": { - "type": "string", - "metadata": { - "description": "Required. Resource Id of the resource that needs to be connected to the network." - } - }, - "groupId": { - "type": "array", - "metadata": { - "description": "Required. Subtype(s) of the connection to be created. The allowed values depend on the type serviceResourceId refers to." - } - }, - "privateDNSId": { - "type": "string", - "defaultValue":"", - "metadata": { - "description": "Optional. Resource id of the private DNS zone." - } - }, - "location": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Optional. Location for all Resources." - } - }, - "tags": { - "type": "object", - "defaultValue": {}, - "metadata": { - "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." - } - }, - "cuaId": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "Optional. Customer Usage Attribution id (GUID). This GUID must be previously registered" - } - } - }, - "variables": {}, - "resources": [ - { - "type": "Microsoft.Resources/deployments", - "apiVersion": "2020-10-01", - "name": "[concat('pid-', parameters('cuaId'))]", - "condition": "[not(empty(parameters('cuaId')))]", - "properties": { - "mode": "Incremental", - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "resources": [ - ] - } - } - }, - { - "type": "Microsoft.Network/privateEndpoints", - "apiVersion": "2021-02-01", - "name": "[parameters('privateEndpointName')]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "privateLinkServiceConnections": [ - { - "name": "[parameters('privateEndpointName')]", - "properties": { - "privateLinkServiceId": "[parameters('serviceResourceId')]", - "groupIds": "[parameters('groupId')]" - } - } - ], - "manualPrivateLinkServiceConnections": [], - "subnet": { - "id": "[parameters('targetSubnetId')]" - }, - "customDnsConfigs": [] - } - }, - { - "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", - "apiVersion": "2021-02-01", - "condition": "[not(empty(parameters('privateDNSId')))]", - "name": "[concat(parameters('privateEndpointName'),'/default')]", - "dependsOn": [ - "[resourceId('Microsoft.Network/privateEndpoints', parameters('privateEndpointName'))]" - ], - "properties": { - "privateDnsZoneConfigs": [ - { - "name": "[parameters('privateEndpointName')]", - "properties": { - "privateDnsZoneId": "[parameters('privateDNSId')]" - } - } - ] - } - } - ], - "functions": [], - "outputs": { - "privateEndpointResourceGroup": { - "type": "string", - "value": "[resourceGroup().name]", - "metadata": { - "description": "The name of the Resource Group the resources was deployed to." - } - }, - "privateEndpointResourceId": { - "type": "string", - "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('privateEndpointName'))]", - "metadata": { - "description": "The Resource Id of the private Endpoint." - } - }, - "privateEndpointName": { - "type": "string", - "value": "[parameters('privateEndpointName')]", - "metadata": { - "description": "The Name of the deployed private endpoint." - } - } - } -} \ No newline at end of file diff --git a/arm/Microsoft.Network/privateEndpoints/readme.md b/arm/Microsoft.Network/privateEndpoints/readme.md index 4e00655c1b..33aac51a41 100644 Binary files a/arm/Microsoft.Network/privateEndpoints/readme.md and b/arm/Microsoft.Network/privateEndpoints/readme.md differ diff --git a/testResults.xml b/testResults.xml new file mode 100644 index 0000000000..be7d872106 --- /dev/null +++ b/testResults.xml @@ -0,0 +1,223 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file