migrating ado modules to github

.github/workflows/main.bicep

@@ -0,0 +1,31 @@
+// =========== main.bicep ===========
+
+param buildId string
+param environment string
+param location string = resourceGroup().location
+
+module apim '../../apim.bicep' = {
+  name: 'unit-test-${buildId}-apim'
+  params: {
+    application: 'chenette'
+    environment: environment
+    location: location
+  }
+}
+
+// module vnet '../../vnet.bicep' = {
+//   name: 'unit-test-${buildId}-vnet'
+//   params: {
+//     environment: environment
+//     location: location
+//   }
+// }
+
+// module snet '../../snet.bicep' = {
+//   name: 'unit-test-${buildId}-snet'
+//   params: {
+//     vnetName: vnet.outputs.name
+//     environment: environment
+//     location: location
+//   }
+// }

.github/workflows/main.yml

@@ -1,21 +1,41 @@
-on: [push,   workflow_dispatch]
+on: [push, workflow_dispatch]
 name: Azure ARM
+
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
-  build-and-deploy:
+  deploy:
     environment: Azure
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
-        uses: actions/checkout@main
+      - uses: actions/checkout@v3
 
-      - name: Log into Azure
-        uses: azure/[email protected]
+      # https://github.com/marketplace/actions/azure-login#login-with-openid-connect-oidc-recommended
+      - name: Log in to Azure using OIDC
+        uses: azure/login@v1
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
-      - name: Deploy Bicep file
-        uses: azure/arm-deploy@main
+      - name: Deploy resources to Azure
+        uses: azure/arm-deploy@v1
         with:
+          resourceGroupName: rg-application-dev-001
+          template: .github/workflows/main.bicep
+          parameters: buildId=${{ github.run_attempt }} environment=dev
+
+
+      - name: Remove deployed resources
+        uses: azure/arm-deploy@v1
+        with:
+          scope: subscription
           deploymentName: ${{ github.run_number }}
-          resourceGroupName: ${{ secrets.RESOURCE_GROUP }}
+          region: southcentralus
           template: demo.bicep
+          deploymentMode: Complete
+          parameters: delete=true
+
+

.ps-rule/GitHub.Community.Rule.ps1

@@ -0,0 +1,11 @@
+# Example .ps-rule/GitHub.Community.Rule.ps1
+
+# Synopsis: Check for recommended community files
+Rule 'GitHub.Community' -Type 'PSRule.Data.RepositoryInfo' {
+    $Assert.FilePath($TargetObject, 'FullName', @('LICENSE'));
+    $Assert.FilePath($TargetObject, 'FullName', @('CODE_OF_CONDUCT.md'));
+    $Assert.FilePath($TargetObject, 'FullName', @('CONTRIBUTING.md'));
+    $Assert.FilePath($TargetObject, 'FullName', @('README.md'));
+    $Assert.FilePath($TargetObject, 'FullName', @('.github/CODEOWNERS'));
+    $Assert.FilePath($TargetObject, 'FullName', @('.github/PULL_REQUEST_TEMPLATE.md'));
+}

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Matthew Chenette
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,18 @@
+## Best Practices
+- [Bicep Parameters](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/best-practices#parameters)
+- [ARM Templates](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/best-practices)
+
+- It is recommended to give a descriptive and unique [deploymentName](https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/azure-resource-manager-template-deployment-v3?view=azure-pipelines#inputs) for both the modules used and for the Azure Pipelines task itself. This allows for quicker and easier debugging of potential errors.
+
+- https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/best-practices#parameters
+
+- The idea is to be able to delete the entire application in Azure and be able to redeploy it with one click of a button
+
+- One thing that IaC does not address is data.
+
+
+- The principal behind these templates:
+  - They can be deployed with only 1-2 parameters required from the consumer
+  - Further configuration/customization possible, but not necessary
+
+- The idea is also to have these templates have all minimum and recommended security settings enabled by default (i.e., https/tls 1.2, ...)

agw.bicep

@@ -0,0 +1,62 @@
+// =========== agw.bicep ===========
+
+// USER-PROVIDED PARAMETERS
+param application string
+param environment string
+param instance string = '1'
+param vnetName string
+param snetName string
+
+@allowed([443, 8080])
+param httpSettingPort int = 443
+param httpSettingProtocol string = 'Http'
+
+
+// PROPERTIES PARAMETERS
+param sku object = {
+  name: 'Standard_Small'
+  tier: 'Standard'
+  capacity: 2
+}
+param backendPools array = [
+  { name: 'appGatewayBackendPool', properties: { backendAddresses: [ { IpAddress: '10.0.0.4' }, { IpAddress: '10.0.0.5' } ] } }
+]
+param backendHttpSettings array = [
+  { name: 'appGatewayBackendHttpSettings', properties: { port: httpSettingPort, protocol: httpSettingProtocol, cookieBasedAffinity: 'Disabled' } }
+]
+param httpListeners array = [
+  { name: 'appGatewayHttpListener', properties: { frontendIPConfiguration: { id: resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', name, 'appGatewayFrontendIP') }, frontendPort: { id: resourceId('Microsoft.Network/applicationGateways/frontendPorts', name, 'appGatewayFrontendPort') }, protocol: 'Http' } }
+]
+param requestRoutingRules array = [
+  { name: 'rule1', properties: { ruleType: 'Basic', httpListener: { id: resourceId('Microsoft.Network/applicationGateways/httpListeners', name, 'appGatewayHttpListener') }, backendAddressPool: { id: resourceId('Microsoft.Network/applicationGateways/backendAddressPools', name, 'appGatewayBackendPool') }, backendHttpSettings: { id: resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', name, 'appGatewayBackendHttpSettings') } } }
+]
+param frontendPorts array = [
+  { name: 'appGatewayFrontendPort',  properties: { port: 80 } }
+]
+
+// BASE PARAMETERS
+param name string = 'agw-${application}-${environment}-${location}-${padLeft(instance, 3, '0')}'
+param location string = resourceGroup().location
+
+// DEPENDENCIES
+resource vnet 'Microsoft.Network/virtualNetworks@2022-11-01' existing = { name: vnetName }
+// resource snet 'Microsoft.Network/virtualNetworks/subnets@2022-11-01' existing = { name: snetName }
+var subnetRef = resourceId('Microsoft.Network/virtualNetworks/subnets', vnetName, snetName)
+
+
+// RESOURCE
+resource applicationGateway 'Microsoft.Network/applicationGateways@2022-11-01' = {
+  name: name
+  location: location
+  properties: {
+    sku: sku
+    gatewayIPConfigurations:       [ { name: 'appGatewayIpConfig',     properties: { subnet: { id: subnetRef } } } ]
+    frontendIPConfigurations:      [ { name: 'appGatewayFrontendIP',   properties: { subnet: { id: subnetRef } } } ]
+    frontendPorts:                 [for frontendPort in frontendPorts:             { name: frontendPort.name,       properties: frontendPort.properties }]
+    backendAddressPools:           [for backendPool in backendPools:               { name: backendPool.name,        properties: backendPool.properties }]
+    backendHttpSettingsCollection: [for backendHttpSetting in backendHttpSettings: { name: backendHttpSetting.name, properties: backendHttpSetting.properties }]
+    httpListeners:                 [for httpListener in httpListeners:             { name: httpListener.name,       properties: httpListener.properties }]
+    requestRoutingRules:           [for requestRoutingRule in requestRoutingRules: { name: requestRoutingRule.name, properties: requestRoutingRule.properties }]
+  }
+  dependsOn: [ vnet ]
+}

apim.bicep

@@ -0,0 +1,26 @@
+param application string
+param environment string
+param instance string = '1'
+
+// PROPERTIES PARAMETERS
+
+// BASE PARAMETERS
+param name string = 'apim-${application}-${environment}-${padLeft(instance, 3, '0')}'
+param location string = resourceGroup().location
+param sku object = {
+  name: 'Developer'
+  capacity: 1
+}
+param identity object = { type: 'None' }
+param properties object = {
+  publisherEmail: '[email protected]'
+  publisherName: 'chenette'
+}
+
+resource apim 'Microsoft.ApiManagement/service@2023-03-01-preview' = {
+  name: name
+  location: location
+  sku: sku
+  identity: identity
+  properties: properties
+}

app.bicep

@@ -0,0 +1,33 @@
+// =========== app.bicep ===========
+
+// USER-PROVIDED PARAMETERS
+param application string
+param environment string
+param instance string = '1'
+param aspId string
+
+// PROPERTIES PARAMETERS
+param httpsOnly bool = true
+param isLinux bool = true
+
+// BASE PARAMETERS
+param name string = 'app-${application}-${environment}-${location}-${padLeft(instance, 3, '0')}'
+param location string = resourceGroup().location
+param kind string = 'app,linux' // 'app,linux,container'
+param properties object = {
+  httpsOnly: httpsOnly
+  reserved: isLinux
+  serverFarmId: aspId
+  siteConfig: {
+    alwaysOn: true
+    linuxFxVersion: 'DOTNETCORE|7.0' // 'DOCKER|crchenetteprod001.azurecr.io/dotnetwebapp:latest'
+  }
+}
+
+// RESOURCE
+resource app 'Microsoft.Web/sites@2022-09-01' = {
+  name: name
+  location: location
+  kind: kind
+  properties: properties
+}

asp.bicep

@@ -0,0 +1,41 @@
+// =========== asp.bicep ===========
+
+// USER-PROVIDED PARAMETERS
+param application string
+param environment string
+param instance string = '1'
+
+// SKU PARAMETERS
+param skuCapacity int = 1
+param skuFamily string = 'B'
+param skuName string = 'B1'
+param skuSize string = 'B1'
+param skuTier string = 'Basic'
+
+// PROPERTIES PARAMETERS
+param isLinux bool = true
+
+// BASE PARAMETERS
+param name string = 'asp-${application}-${environment}-${location}-${padLeft(instance, 3, '0')}'
+param location string = resourceGroup().location
+param sku object = {
+  capacity: skuCapacity
+  family: skuFamily
+  name: skuName
+  size: skuSize
+  tier: skuTier
+}
+param properties object = {
+  reserved: isLinux
+}
+
+// RESOURCE
+resource asp 'Microsoft.Web/serverfarms@2022-09-01' = {
+  name: name
+  location: location
+  sku: sku
+  properties: properties
+}
+
+// OUTPUTS
+output resourceId string = asp.id

cr.bicep

@@ -0,0 +1,50 @@
+// =========== cr.bicep ===========
+
+param name string
+param location string
+param sku string
+
+resource cr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' = {
+  name: name
+  location: location
+  sku: {
+    name: sku
+  }
+  properties: {
+    adminUserEnabled: true
+  }
+}
+
+resource kv 'Microsoft.KeyVault/vaults@2023-02-01' = {
+  name: name
+  location: location
+  properties: {
+    enabledForTemplateDeployment: true
+    tenantId: tenant().tenantId
+    accessPolicies: []
+    sku: {
+      name: 'standard'
+      family: 'A'
+    }
+  }
+  resource crUsername 'secrets' = {
+    name: 'crUsername'
+    properties: {
+      value: cr.listCredentials().username
+    }
+  }
+  resource crPassword1 'secrets' = {
+    name: 'crPassword1'
+    properties: {
+      value: cr.listCredentials().passwords[0].value
+    }
+  }
+  resource crPassword2 'secrets' = {
+    name: 'crPassword2'
+    properties: {
+      value: cr.listCredentials().passwords[1].value
+    }
+  }
+}
+
+// output resource resource = cr