GrillPhil

param name string
param location string
param tags object

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: name
  location: location
  properties: {
    enabledForTemplateDeployment: true
    enableRbacAuthorization: true

GrillPhil

param name string
param location string
param tags object
@allowed([
  'Free'
  'Standard'
])
param sku string = 'Free'
param appSettings object = {}

GrillPhil

GrillPhil

# Create App Registration that allows only sign-ins from my own organization and has the issuing of id tokens enabled
$swaApp = az ad app create --display-name "$($projectName)-$($env)-app" --sign-in-audience "AzureADMyOrg" --enable-id-token-issuance true | ConvertFrom-Json 
$swaClientId = $swaApp.appId

# Create a new secret for the app registration
$swaCredential = az ad app credential reset --id $swaApp.id | ConvertFrom-Json 
$swaClientSecret = $swaCredential.password

# Create a new SP attached to the app registration
$swaSP = az ad sp create --id $swaApp.appId | ConvertFrom-Json 

GrillPhil

$serviceConnection = New-Object -TypeName psobject
$serviceConnection | Add-Member NoteProperty -Name SubscriptionId -Value $subscriptionId
$serviceConnection | Add-Member NoteProperty -Name SubscriptionName -Value $subscriptionName
$serviceConnection | Add-Member NoteProperty -Name ServicePrincipalId -Value $azureDevOpsSPObjectId
$serviceConnection | Add-Member NoteProperty -Name ServicePrincipalKey -Value $azureDevOpsSPKey
$serviceConnection | Add-Member NoteProperty -Name TenantId -Value $tenantId
$serviceConnection | Add-Member NoteProperty -Name ServiceConnectionName -Value "$($projectName)-$($env)"

$serviceConnection | ConvertTo-Json

GrillPhil

$sp = az ad sp create-for-rbac --name "$($projectName)-$($env)" --scopes "/subscriptions/$($subscriptionId)/resourceGroups/$($resourceGroupName)" --role Contributor | ConvertFrom-Json 
$azureDevOpsSPObjectId = $sp.appId
$azureDevOpsSPKey = $sp.password

$sp = az ad sp show --id $azureDevOpsSPObjectId --query '{displayName: displayName, principalId: id}' | ConvertFrom-Json
$azureDevOpsSPClientId = $sp.principalId

az role assignment create --assignee $($azureDevOpsSPClientId) --role 'User Access Administrator' --scope /subscriptions/$($subscriptionId)/resourceGroups/$($resourceGroupName)

GrillPhil

az login -t $tenantId
az account set --subscription $subscriptionId
az group create --location $location --name $resourceGroupName

GrillPhil

$tenantId = "{YOUR_TENANT_ID}"
$subscriptionId = "{YOUR_SUBSCRIPTION_ID}"
$subscriptionName = "{YOUR_SUBSCRIPTION_NAME}"
$location = "WestEurope"
$projectName = "securengdemo"
$env = "dev"
$resourceGroupName = "rg-$($projectName)-$($env)"

GrillPhil

module apiEndpoint 'services/frontdoor-endpoint.bicep' = {
  name: 'deploy-fd-${envName}-api-ep'
  params: {
    frontDoorName: frontDoor.outputs.name
    name: 'ep-${envName}-api'
  }
}

module apiDomain 'services/frontdoor-custom-domain.bicep' = {
  name: 'deploy-fd-${envName}-api-domain'

GrillPhil

module docEndpoint 'services/frontdoor-endpoint.bicep' = {
  name: 'deploy-fd-${envName}-doc-ep'
  params: {
    frontDoorName: frontDoor.outputs.name
    name: 'ep-${envName}-doc'
  }
}

module docDomain 'services/frontdoor-custom-domain.bicep' = {
  name: 'deploy-fd-${envName}-doc-domain'