Skip to content

Commit a153d38

Browse files
wviriyawviriya
authored
Merge pull request #85 from wviriya/refresh-functions-v4
Fix Key Vault dependency issue, split create and update Key Vault int…
2 parents 9c136fb + f4a3308 commit a153d38

File tree

3 files changed

+98
-66
lines changed

3 files changed

+98
-66
lines changed

‎bicep/main.bicep

Lines changed: 60 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ param sqlAdminLogin string
1818
@secure()
1919
param sqlAdminPassword string
2020

21+
@description('Service principal Id used for deployment.')
22+
param objectId string
23+
2124
@description('The resource tags that will be applied to the deployed resources.')
2225
param resourceTags object = {
2326
ProjectType: 'Azure Serverless Microservices'
@@ -36,24 +39,27 @@ var apimName = '${applicationName}Apim'
3639
var sqlServerName = '${applicationName}-db'
3740
var staticWebAppName = '${applicationName}Web'
3841
var storageAccountName = take(toLower(replace('${applicationName}func', '-', '')), 24)
39-
var functionsApps = [
40-
'Trips'
41-
'Drivers'
42-
'Passengers'
43-
'TripArchiver'
44-
'Orchestrators'
45-
]
4642
var functionRuntime = 'dotnet'
4743
var functionVersion = '~4'
4844

45+
module keyVault 'modules/keyvault.bicep' = {
46+
name: keyVaultName
47+
params: {
48+
keyVaultName: keyVaultName
49+
objectId: objectId
50+
resourceTags: resourceTags
51+
location: location
52+
}
53+
}
54+
4955
module cosmos 'modules/cosmosdb.bicep' = {
5056
name: cosmosdbName
5157
params: {
5258
accountName: cosmosdbName
5359
location: location
5460
databaseName: applicationName
5561
resourceTags: resourceTags
56-
keyVaultName: keyVaultName
62+
keyVaultName: keyVault.name
5763
}
5864
}
5965

@@ -66,7 +72,7 @@ module sqlDb 'modules/sqldb.bicep' = {
6672
administratorPassword: sqlAdminPassword
6773
location: location
6874
resourceTags: resourceTags
69-
keyVaultName: keyVaultName
75+
keyVaultName: keyVault.name
7076
}
7177
}
7278

@@ -76,7 +82,7 @@ module eventGrid 'modules/eventgrid.bicep' = {
7682
eventGridTopicName: eventGridName
7783
location: location
7884
resourceTags: resourceTags
79-
keyVaultName: keyVaultName
85+
keyVaultName: keyVault.name
8086
}
8187
}
8288

@@ -86,7 +92,7 @@ module signalR 'modules/signalr.bicep' = {
8692
signalRName: signalRName
8793
location: location
8894
resourceTags: resourceTags
89-
keyVaultName: keyVaultName
95+
keyVaultName: keyVault.name
9096
}
9197
}
9298

@@ -187,11 +193,11 @@ resource tripFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
187193
}
188194
{
189195
name: 'DocDbApiKey'
190-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
196+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
191197
}
192198
{
193199
name: 'DocDbEndpointUri'
194-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbEndpoint)'
200+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbEndpoint)'
195201
}
196202
{
197203
name: 'DocDbRideShareDatabaseName'
@@ -227,27 +233,27 @@ resource tripFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
227233
}
228234
{
229235
name: 'AuthorityUrl'
230-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/AuthorityUrl)'
236+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/AuthorityUrl)'
231237
}
232238
{
233239
name: 'ApiApplicationId'
234-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/ApiApplicationId)'
240+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/ApiApplicationId)'
235241
}
236242
{
237243
name: 'ApiScopeName'
238-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/ApiScopeName)'
244+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/ApiScopeName)'
239245
}
240246
{
241247
name: 'EnableAuth'
242248
value: 'true'
243249
}
244250
{
245251
name: 'SqlConnectionString'
246-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/SqlConnectionString)'
252+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/SqlConnectionString)'
247253
}
248254
{
249255
name: 'AzureSignalRConnectionString'
250-
value:'@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/AzureSignalRConnectionString)'
256+
value:'@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/AzureSignalRConnectionString)'
251257
}
252258
]
253259
cors: {
@@ -297,11 +303,11 @@ resource driverFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
297303
}
298304
{
299305
name: 'DocDbApiKey'
300-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
306+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
301307
}
302308
{
303309
name: 'DocDbEndpointUri'
304-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbEndpoint)'
310+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbEndpoint)'
305311
}
306312
{
307313
name: 'DocDbRideShareDatabaseName'
@@ -321,15 +327,15 @@ resource driverFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
321327
}
322328
{
323329
name: 'AuthorityUrl'
324-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/AuthorityUrl)'
330+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/AuthorityUrl)'
325331
}
326332
{
327333
name: 'ApiApplicationId'
328-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/ApiApplicationId)'
334+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/ApiApplicationId)'
329335
}
330336
{
331337
name: 'ApiScopeName'
332-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/ApiScopeName)'
338+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/ApiScopeName)'
333339
}
334340
{
335341
name: 'EnableAuth'
@@ -383,11 +389,11 @@ resource passengerFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
383389
}
384390
{
385391
name: 'DocDbApiKey'
386-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
392+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
387393
}
388394
{
389395
name: 'DocDbEndpointUri'
390-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbEndpoint)'
396+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbEndpoint)'
391397
}
392398
{
393399
name: 'DocDbRideShareDatabaseName'
@@ -407,31 +413,31 @@ resource passengerFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
407413
}
408414
{
409415
name: 'AuthorityUrl'
410-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/AuthorityUrl)'
416+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/AuthorityUrl)'
411417
}
412418
{
413419
name: 'ApiApplicationId'
414-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/ApiApplicationId)'
420+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/ApiApplicationId)'
415421
}
416422
{
417423
name: 'ApiScopeName'
418-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/ApiScopeName)'
424+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/ApiScopeName)'
419425
}
420426
{
421427
name: 'EnableAuth'
422428
value: 'true'
423429
}
424430
{
425431
name: 'GraphTenantId'
426-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/GraphTenantId)'
432+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/GraphTenantId)'
427433
}
428434
{
429435
name: 'GraphClientId'
430-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/GraphClientId)'
436+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/GraphClientId)'
431437
}
432438
{
433439
name: 'GraphClientSecret'
434-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/GraphClientSecret)'
440+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/GraphClientSecret)'
435441
}
436442
]
437443
cors: {
@@ -441,6 +447,9 @@ resource passengerFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
441447
}
442448
}
443449
}
450+
identity: {
451+
type: 'SystemAssigned'
452+
}
444453
}
445454

446455
resource orchestratorsFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
@@ -477,11 +486,11 @@ resource orchestratorsFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
477486
}
478487
{
479488
name: 'DocDbApiKey'
480-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
489+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbPrimaryKey)'
481490
}
482491
{
483492
name: 'DocDbEndpointUri'
484-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbEndpoint)'
493+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbEndpoint)'
485494
}
486495
{
487496
name: 'DocDbRideShareDatabaseName'
@@ -541,7 +550,7 @@ resource orchestratorsFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
541550
}
542551
{
543552
name: 'TripExternalizationsEventGridTopicApiKey'
544-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/TripExternalizationsEventGridTopicApiKey)'
553+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/TripExternalizationsEventGridTopicApiKey)'
545554
}
546555
]
547556
cors: {
@@ -551,6 +560,9 @@ resource orchestratorsFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
551560
}
552561
}
553562
}
563+
identity: {
564+
type: 'SystemAssigned'
565+
}
554566
}
555567

556568
resource tripArchiverFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
@@ -566,7 +578,7 @@ resource tripArchiverFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
566578
}
567579
{
568580
name: 'DocDbConnectionString'
569-
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVaultName}.vault.azure.net/secrets/CosmosDbConnectionString)'
581+
value: '@Microsoft.KeyVault(SecretUri=https:://${keyVault.name}.vault.azure.net/secrets/CosmosDbConnectionString)'
570582
}
571583
]
572584
cors: {
@@ -576,23 +588,23 @@ resource tripArchiverFunctionApp 'Microsoft.Web/sites@2021-03-01' = {
576588
}
577589
}
578590
}
591+
identity: {
592+
type: 'SystemAssigned'
593+
}
579594
}
580595

581-
module keyVault 'modules/keyvault.bicep' = {
582-
name: keyVaultName
596+
module keyVaultPolicies 'modules/keyvaultPolicies.bicep' = {
597+
name: '${keyVaultName}polices'
583598
params: {
584599
keyVaultName: keyVaultName
585-
functionAppPrefix: applicationName
586-
functionApps: functionsApps
587-
resourceTags: resourceTags
588-
location: location
600+
functionAppPrincipalIds: [
601+
tripFunctionApp.identity.principalId
602+
driverFunctionApp.identity.principalId
603+
passengerFunctionApp.identity.principalId
604+
tripArchiverFunctionApp.identity.principalId
605+
orchestratorsFunctionApp.identity.principalId
606+
]
589607
}
590-
dependsOn: [
591-
tripFunctionApp
592-
driverFunctionApp
593-
passengerFunctionApp
594-
tripArchiverFunctionApp
595-
orchestratorsFunctionApp
596-
]
597608
}
598609

610+
output principalId string = orchestratorsFunctionApp.identity.principalId

‎bicep/modules/keyvault.bicep

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,15 @@
11
@description('The name of the Key Vault resource that will be deployed.')
22
param keyVaultName string
33

4-
@description('The prefix for the function apps.')
5-
param functionAppPrefix string
6-
7-
@description('The list of function apps that will have access to this Key Vault.')
8-
param functionApps array
4+
@description('Service principal Id used for deployment.')
5+
param objectId string
96

107
@description('The resource tags that will be applied to this Key Vault.')
118
param resourceTags object
129

1310
@description('The location that this Key Vault will be deployed to.')
1411
param location string
1512

16-
resource functions 'Microsoft.Web/sites@2021-01-15' existing = [for functionApp in functionApps :{
17-
name: '${functionAppPrefix}${functionApp}'
18-
}]
19-
2013
resource keyVault 'Microsoft.KeyVault/vaults@2021-06-01-preview' = {
2114
name: keyVaultName
2215
location: location
@@ -25,19 +18,21 @@ resource keyVault 'Microsoft.KeyVault/vaults@2021-06-01-preview' = {
2518
name: 'standard'
2619
family: 'A'
2720
}
21+
accessPolicies: [
22+
{
23+
tenantId: subscription().tenantId
24+
objectId: objectId
25+
permissions: {
26+
secrets: [
27+
'all'
28+
]
29+
}
30+
}
31+
]
2832
enableSoftDelete: true
2933
softDeleteRetentionInDays: 7
3034
enabledForTemplateDeployment: true
3135
tenantId: subscription().tenantId
32-
accessPolicies: [for i in range(0, length(functionApps)) : {
33-
tenantId: functions[i].identity.tenantId
34-
objectId: functions[i].identity.principalId
35-
permissions: {
36-
secrets: [
37-
'get'
38-
]
39-
}
40-
}]
4136
}
4237
tags: resourceTags
4338
}

‎bicep/modules/keyvaultPolicies.bicep

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
@description('The name of the Key Vault resource that will be deployed.')
2+
param keyVaultName string
3+
4+
@description('The list of function app principal Id that will have access to this Key Vault.')
5+
param functionAppPrincipalIds array
6+
7+
resource keyVault 'Microsoft.KeyVault/vaults@2021-11-01-preview' existing = {
8+
name: keyVaultName
9+
}
10+
11+
resource policies 'Microsoft.KeyVault/vaults/accessPolicies@2021-06-01-preview' = {
12+
name: 'add'
13+
parent: keyVault
14+
properties: {
15+
accessPolicies: [for i in range(0, length(functionAppPrincipalIds)) : {
16+
tenantId: subscription().tenantId
17+
objectId: functionAppPrincipalIds[i]
18+
permissions: {
19+
secrets: [
20+
'get'
21+
]
22+
}
23+
}]
24+
}
25+
}

0 commit comments

Comments
 (0)