-
Notifications
You must be signed in to change notification settings - Fork 459
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[PSRule] Fix Keyvault issues (#3989)
* uniquestring with utc datetime * json rollback and psrule ver update * 1.29.0 * upd * upd * utcnow * undo * newGUID * test * upd * upd * upd * upd * upd * removed 'all' permission from secret * upd * upd * upd * upd * upd --------- Co-authored-by: Fabio Masciotra <fabmas@microsoft.com>
- Loading branch information
Showing
11 changed files
with
455 additions
and
105 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
modules/key-vault/vault/.test/accesspolicies/dependencies.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| @description('Optional. The location to deploy to.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| @description('Required. The name of the Virtual Network to create.') | ||
| param virtualNetworkName string | ||
|
|
||
| @description('Required. The name of the Managed Identity to create.') | ||
| param managedIdentityName string | ||
|
|
||
| var addressPrefix = '10.0.0.0/16' | ||
|
|
||
| resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = { | ||
| name: virtualNetworkName | ||
| location: location | ||
| properties: { | ||
| addressSpace: { | ||
| addressPrefixes: [ | ||
| addressPrefix | ||
| ] | ||
| } | ||
| subnets: [ | ||
| { | ||
| name: 'defaultSubnet' | ||
| properties: { | ||
| addressPrefix: cidrSubnet(addressPrefix, 16, 0) | ||
| serviceEndpoints: [ | ||
| { | ||
| service: 'Microsoft.KeyVault' | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { | ||
| name: managedIdentityName | ||
| location: location | ||
| } | ||
|
|
||
| @description('The resource ID of the created Virtual Network Subnet.') | ||
| output subnetResourceId string = virtualNetwork.properties.subnets[0].id | ||
|
|
||
| @description('The principal ID of the created Managed Identity.') | ||
| output managedIdentityPrincipalId string = managedIdentity.properties.principalId |
124 changes: 124 additions & 0 deletions
124
modules/key-vault/vault/.test/accesspolicies/main.test.bicep
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,124 @@ | ||
| targetScope = 'subscription' | ||
|
|
||
| // ========== // | ||
| // Parameters // | ||
| // ========== // | ||
|
|
||
| @description('Optional. The name of the resource group to deploy for testing purposes.') | ||
| @maxLength(90) | ||
| param resourceGroupName string = 'ms.keyvault.vaults-${serviceShort}-rg' | ||
|
|
||
| @description('Optional. The location to deploy resources to.') | ||
| param location string = deployment().location | ||
|
|
||
| @description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') | ||
| param serviceShort string = 'kvvap' | ||
|
|
||
| @description('Optional. Enable telemetry via a Globally Unique Identifier (GUID).') | ||
| param enableDefaultTelemetry bool = true | ||
|
|
||
| @description('Optional. A token to inject into the name of each resource.') | ||
| param namePrefix string = '[[namePrefix]]' | ||
|
|
||
| // ============ // | ||
| // Dependencies // | ||
| // ============ // | ||
|
|
||
| // General resources | ||
| // ================= | ||
| resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { | ||
| name: resourceGroupName | ||
| location: location | ||
| } | ||
|
|
||
| module nestedDependencies 'dependencies.bicep' = { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, location)}-nestedDependencies' | ||
| params: { | ||
| managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}' | ||
| virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}' | ||
| } | ||
| } | ||
|
|
||
| // Diagnostics | ||
| // =========== | ||
| module diagnosticDependencies '../../../../.shared/.templates/diagnostic.dependencies.bicep' = { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, location)}-diagnosticDependencies' | ||
| params: { | ||
| storageAccountName: 'dep${namePrefix}diasa${serviceShort}03' | ||
| logAnalyticsWorkspaceName: 'dep-${namePrefix}-law-${serviceShort}' | ||
| eventHubNamespaceEventHubName: 'dep-${namePrefix}-evh-${serviceShort}01' | ||
| eventHubNamespaceName: 'dep-${namePrefix}-evhns-${serviceShort}01' | ||
| location: location | ||
| } | ||
| } | ||
|
|
||
| // ============== // | ||
| // Test Execution // | ||
| // ============== // | ||
|
|
||
| module testDeployment '../../main.bicep' = { | ||
| scope: resourceGroup | ||
| name: '${uniqueString(deployment().name, location)}-test-${serviceShort}' | ||
| params: { | ||
| enableDefaultTelemetry: enableDefaultTelemetry | ||
| name: '${namePrefix}${serviceShort}002' | ||
| diagnosticStorageAccountId: diagnosticDependencies.outputs.storageAccountResourceId | ||
| diagnosticWorkspaceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId | ||
| diagnosticEventHubAuthorizationRuleId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId | ||
| diagnosticEventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName | ||
| enablePurgeProtection: false | ||
| accessPolicies: [ | ||
| { | ||
| objectId: nestedDependencies.outputs.managedIdentityPrincipalId | ||
| permissions: { | ||
| keys: [ | ||
| 'get' | ||
| 'list' | ||
| 'update' | ||
| ] | ||
| secrets: [ | ||
| 'get' | ||
| 'list' | ||
| ] | ||
| } | ||
| tenantId: tenant().tenantId | ||
| } | ||
| { | ||
| objectId: nestedDependencies.outputs.managedIdentityPrincipalId | ||
| permissions: { | ||
| certificates: [ | ||
| 'backup' | ||
| 'create' | ||
| 'delete' | ||
| ] | ||
| secrets: [ | ||
| 'get' | ||
| 'list' | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| networkAcls: { | ||
| bypass: 'AzureServices' | ||
| defaultAction: 'Deny' | ||
| ipRules: [ | ||
| { | ||
| value: '40.74.28.0/23' | ||
| } | ||
| ] | ||
| virtualNetworkRules: [ | ||
| { | ||
| id: nestedDependencies.outputs.subnetResourceId | ||
| ignoreMissingVnetServiceEndpoint: false | ||
| } | ||
| ] | ||
| } | ||
| tags: { | ||
| 'hidden-title': 'This is visible in the resource name' | ||
| Environment: 'Non-Prod' | ||
| Role: 'DeploymentValidation' | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.