main.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "languageVersion": "2.0",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.33.93.31351",
      "templateHash": "10342722837469174682"
    },
    "name": "App ManagedEnvironments",
    "description": "This module deploys an App Managed Environment (also known as a Container App Environment)."
  },
  "definitions": {
    "managedIdentitiesType": {
      "type": "object",
      "properties": {
        "systemAssigned": {
          "type": "bool",
          "nullable": true,
          "metadata": {
            "description": "Optional. Enables system assigned managed identity on the resource."
          }
        },
        "userAssignedResourceIds": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "nullable": true,
          "metadata": {
            "description": "Optional. The resource ID(s) to assign to the resource."
          }
        }
      },
      "nullable": true
    },
    "lockType": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "nullable": true,
          "metadata": {
            "description": "Optional. Specify the name of lock."
          }
        },
        "kind": {
          "type": "string",
          "allowedValues": [
            "CanNotDelete",
            "None",
            "ReadOnly"
          ],
          "nullable": true,
          "metadata": {
            "description": "Optional. Specify the type of lock."
          }
        }
      },
      "nullable": true
    },
    "roleAssignmentType": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "nullable": true,
            "metadata": {
              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
            }
          },
          "roleDefinitionIdOrName": {
            "type": "string",
            "metadata": {
              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
            }
          },
          "principalId": {
            "type": "string",
            "metadata": {
              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
            }
          },
          "principalType": {
            "type": "string",
            "allowedValues": [
              "Device",
              "ForeignGroup",
              "Group",
              "ServicePrincipal",
              "User"
            ],
            "nullable": true,
            "metadata": {
              "description": "Optional. The principal type of the assigned principal ID."
            }
          },
          "description": {
            "type": "string",
            "nullable": true,
            "metadata": {
              "description": "Optional. The description of the role assignment."
            }
          },
          "condition": {
            "type": "string",
            "nullable": true,
            "metadata": {
              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
            }
          },
          "conditionVersion": {
            "type": "string",
            "allowedValues": [
              "2.0"
            ],
            "nullable": true,
            "metadata": {
              "description": "Optional. Version of the condition."
            }
          },
          "delegatedManagedIdentityResourceId": {
            "type": "string",
            "nullable": true,
            "metadata": {
              "description": "Optional. The Resource Id of the delegated managed identity resource."
            }
          }
        }
      },
      "nullable": true
    },
    "certificateKeyVaultPropertiesType": {
      "type": "object",
      "properties": {
        "identityResourceId": {
          "type": "string",
          "metadata": {
            "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
          }
        },
        "keyVaultUrl": {
          "type": "string",
          "metadata": {
            "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
          }
        }
      },
      "nullable": true
    },
    "storageType": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "accessMode": {
            "type": "string",
            "allowedValues": [
              "ReadOnly",
              "ReadWrite"
            ],
            "metadata": {
              "description": "Required. Access mode for storage: \"ReadOnly\" or \"ReadWrite\"."
            }
          },
          "kind": {
            "type": "string",
            "allowedValues": [
              "NFS",
              "SMB"
            ],
            "metadata": {
              "description": "Required. Type of storage: \"SMB\" or \"NFS\"."
            }
          },
          "storageAccountName": {
            "type": "string",
            "metadata": {
              "description": "Required. Storage account name."
            }
          },
          "shareName": {
            "type": "string",
            "metadata": {
              "description": "Required. File share name."
            }
          }
        }
      },
      "nullable": true
    }
  },
  "parameters": {
    "name": {
      "type": "string",
      "metadata": {
        "description": "Required. Name of the Container Apps Managed Environment."
      }
    },
    "logAnalyticsWorkspaceResourceId": {
      "type": "string",
      "metadata": {
        "description": "Required. Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990)."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Optional. Location for all Resources."
      }
    },
    "tags": {
      "type": "object",
      "nullable": true,
      "metadata": {
        "description": "Optional. Tags of the resource."
      }
    },
    "managedIdentities": {
      "$ref": "#/definitions/managedIdentitiesType",
      "metadata": {
        "description": "Optional. The managed identity definition for this resource."
      }
    },
    "roleAssignments": {
      "$ref": "#/definitions/roleAssignmentType",
      "metadata": {
        "description": "Optional. Array of role assignments to create."
      }
    },
    "logsDestination": {
      "type": "string",
      "defaultValue": "log-analytics",
      "metadata": {
        "description": "Optional. Logs destination."
      }
    },
    "enableTelemetry": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Optional. Enable/Disable usage telemetry for module."
      }
    },
    "appInsightsConnectionString": {
      "type": "securestring",
      "defaultValue": "",
      "metadata": {
        "description": "Optional. Application Insights connection string."
      }
    },
    "daprAIConnectionString": {
      "type": "securestring",
      "defaultValue": "",
      "metadata": {
        "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
      }
    },
    "daprAIInstrumentationKey": {
      "type": "securestring",
      "defaultValue": "",
      "metadata": {
        "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
      }
    },
    "dockerBridgeCidr": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
      }
    },
    "infrastructureSubnetId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
      }
    },
    "internal": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
      }
    },
    "platformReservedCidr": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
      }
    },
    "platformReservedDnsIP": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
      }
    },
    "peerTrafficEncryption": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Optional. Whether or not to encrypt peer traffic."
      }
    },
    "zoneRedundant": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Optional. Whether or not this Managed Environment is zone-redundant."
      }
    },
    "certificatePassword": {
      "type": "securestring",
      "defaultValue": "",
      "metadata": {
        "description": "Optional. Password of the certificate used by the custom domain."
      }
    },
    "certificateValue": {
      "type": "securestring",
      "defaultValue": "",
      "metadata": {
        "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
      }
    },
    "certificateKeyVaultProperties": {
      "$ref": "#/definitions/certificateKeyVaultPropertiesType",
      "metadata": {
        "description": "Optional. A key vault reference to the certificate to use for the custom domain."
      }
    },
    "dnsSuffix": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Optional. DNS suffix for the environment domain."
      }
    },
    "lock": {
      "$ref": "#/definitions/lockType",
      "metadata": {
        "description": "Optional. The lock settings of the service."
      }
    },
    "openTelemetryConfiguration": {
      "type": "object",
      "defaultValue": {},
      "metadata": {
        "description": "Optional. Open Telemetry configuration."
      }
    },
    "workloadProfiles": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
      }
    },
    "infrastructureResourceGroupName": {
      "type": "string",
      "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
      "metadata": {
        "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
      }
    },
    "storages": {
      "$ref": "#/definitions/storageType",
      "metadata": {
        "description": "Optional. The list of storages to mount on the environment."
      }
    }
  },
  "variables": {
    "copy": [
      {
        "name": "formattedRoleAssignments",
        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
      }
    ],
    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
    "builtInRoleNames": {
      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
    }
  },
  "resources": {
    "managedEnvironment::storage": {
      "copy": {
        "name": "managedEnvironment::storage",
        "count": "[length(coalesce(parameters('storages'), createArray()))]"
      },
      "type": "Microsoft.App/managedEnvironments/storages",
      "apiVersion": "2024-02-02-preview",
      "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
      "properties": {
        "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
        "azureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'SMB'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'accountName', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, 'accountKey', listkeys(resourceId('Microsoft.Storage/storageAccounts', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName), '2023-01-01').keys[0].value, 'shareName', coalesce(parameters('storages'), createArray())[copyIndex()].shareName), null())]"
      },
      "dependsOn": [
        "managedEnvironment"
      ]
    },
    "avmTelemetry": {
      "condition": "[parameters('enableTelemetry')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2024-03-01",
      "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [],
          "outputs": {
            "telemetry": {
              "type": "String",
              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
            }
          }
        }
      }
    },
    "logAnalyticsWorkspace": {
      "condition": "[not(empty(parameters('logAnalyticsWorkspaceResourceId')))]",
      "existing": true,
      "type": "Microsoft.OperationalInsights/workspaces",
      "apiVersion": "2023-09-01",
      "subscriptionId": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2]]",
      "resourceGroup": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]]",
      "name": "[last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))]"
    },
    "managedEnvironment": {
      "type": "Microsoft.App/managedEnvironments",
      "apiVersion": "2024-02-02-preview",
      "name": "[parameters('name')]",
      "location": "[parameters('location')]",
      "tags": "[parameters('tags')]",
      "identity": "[variables('identity')]",
      "properties": {
        "appInsightsConfiguration": {
          "connectionString": "[parameters('appInsightsConnectionString')]"
        },
        "appLogsConfiguration": {
          "destination": "[parameters('logsDestination')]",
          "logAnalyticsConfiguration": {
            "customerId": "[reference('logAnalyticsWorkspace').customerId]",
            "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))), '2023-09-01').primarySharedKey]"
          }
        },
        "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
        "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
        "customDomainConfiguration": {
          "certificatePassword": "[parameters('certificatePassword')]",
          "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
          "dnsSuffix": "[parameters('dnsSuffix')]",
          "certificateKeyVaultProperties": "[if(not(empty(parameters('certificateKeyVaultProperties'))), createObject('identity', parameters('certificateKeyVaultProperties').identityResourceId, 'keyVaultUrl', parameters('certificateKeyVaultProperties').keyVaultUrl), null())]"
        },
        "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
        "peerTrafficConfiguration": {
          "encryption": {
            "enabled": "[parameters('peerTrafficEncryption')]"
          }
        },
        "vnetConfiguration": {
          "internal": "[parameters('internal')]",
          "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('infrastructureSubnetId'), null())]",
          "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('dockerBridgeCidr'), null())]",
          "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedCidr'), null())]",
          "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedDnsIP'), null())]"
        },
        "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
        "zoneRedundant": "[parameters('zoneRedundant')]",
        "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
      },
      "dependsOn": [
        "logAnalyticsWorkspace"
      ]
    },
    "managedEnvironment_roleAssignments": {
      "copy": {
        "name": "managedEnvironment_roleAssignments",
        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
      },
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
      "properties": {
        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
      },
      "dependsOn": [
        "managedEnvironment"
      ]
    },
    "managedEnvironment_lock": {
      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
      "type": "Microsoft.Authorization/locks",
      "apiVersion": "2020-05-01",
      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
      "properties": {
        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
      },
      "dependsOn": [
        "managedEnvironment"
      ]
    }
  },
  "outputs": {
    "resourceGroupName": {
      "type": "string",
      "metadata": {
        "description": "The name of the resource group the Managed Environment was deployed into."
      },
      "value": "[resourceGroup().name]"
    },
    "location": {
      "type": "string",
      "metadata": {
        "description": "The location the resource was deployed into."
      },
      "value": "[reference('managedEnvironment', '2024-02-02-preview', 'full').location]"
    },
    "name": {
      "type": "string",
      "metadata": {
        "description": "The name of the Managed Environment."
      },
      "value": "[parameters('name')]"
    },
    "resourceId": {
      "type": "string",
      "metadata": {
        "description": "The resource ID of the Managed Environment."
      },
      "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
    },
    "systemAssignedMIPrincipalId": {
      "type": "string",
      "nullable": true,
      "metadata": {
        "description": "The principal ID of the system assigned identity."
      },
      "value": "[tryGet(tryGet(reference('managedEnvironment', '2024-02-02-preview', 'full'), 'identity'), 'principalId')]"
    },
    "defaultDomain": {
      "type": "string",
      "metadata": {
        "description": "The Default domain of the Managed Environment."
      },
      "value": "[reference('managedEnvironment').defaultDomain]"
    },
    "staticIp": {
      "type": "string",
      "metadata": {
        "description": "The IP address of the Managed Environment."
      },
      "value": "[reference('managedEnvironment').staticIp]"
    },
    "domainVerificationId": {
      "type": "string",
      "metadata": {
        "description": "The domain verification id for custom domains."
      },
      "value": "[reference('managedEnvironment').customDomainConfiguration.customDomainVerificationId]"
    }
  }
}