Skip to content

Commit a50f07d

Browse files
tae0ytae0y
authored
[DevOps] Table Storage용 bicep 파일 만들기 #283 (#292)
1 parent 1f7d418 commit a50f07d

File tree

2 files changed

+159
-0
lines changed

2 files changed

+159
-0
lines changed

‎infra/aspire.bicep

+41
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,15 @@ param enabledForDeployment bool = true
1717
param enabledForTemplateDeployment bool = true
1818
param enableRbacAuthorization bool = true
1919

20+
//TODO: 배포 시점에 사용자 princpalId, apiapp principalId를 받는 방법 조사
21+
//param creatorAdminPrincipalId string = ''
22+
//param apiAppUserPrincipalId string = ''
23+
24+
// parameters for storage account
25+
param storageAccountName string = ''
26+
// tableNames passed as a comma separated string from command line
27+
param tableNames string = 'events'
28+
2029
var abbrs = loadJsonContent('./abbreviations.json')
2130

2231
// Tags that should be applied to all resources.
@@ -39,6 +48,9 @@ var resourceToken = uniqueString(resourceGroup().id)
3948
#disable-next-line no-unused-vars
4049
// var apiServiceName = 'python-api'
4150

51+
// tables for storage account seperated by comma
52+
var tables = split(tableNames, ',')
53+
4254
// Add resources to be provisioned below.
4355

4456
// Provision Key Vault
@@ -54,6 +66,35 @@ module keyVault './core/security/keyvault.bicep' = {
5466
}
5567
}
5668

69+
// Provision Storage Account
70+
module storageAccount './core/storage/storage-account.bicep' = {
71+
name: 'storageAccount'
72+
params: {
73+
name: !empty(storageAccountName) ? storageAccountName : '${abbrs.storageStorageAccounts}${resourceToken}'
74+
location: location
75+
tags: tags
76+
tables: tables
77+
keyVaultName: keyVault.outputs.name
78+
}
79+
}
80+
81+
// TODO: Key vault Secret 권한부여, 생성한 사람에게 관리자 권한을, 그 외에는 secret user 권한을 부여
82+
//resource keyVaultSecretRoleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
83+
// name: guid(resourceGroup().id, resolvedKeyVaultName, 'secret-role-assignment')
84+
// properties: {
85+
// principalId: creatorAdminPrincipalId
86+
// roleDefinitionId: '00482A5A-887F-4FB3-B363-3B7FE8E74483' // administrator role
87+
// }
88+
//}
89+
//
90+
//resource keyVaultSecretApiAppRoleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
91+
// name: guid(resourceGroup().id, resolvedKeyVaultName, 'secret-apiapp-role-assignment')
92+
// properties: {
93+
// principalId: apiAppUserPrincipalId
94+
// roleDefinitionId: '4633458B-17DE-408A-B874-0445C86B69E6' // secret user role
95+
// }
96+
//}
97+
5798
// Add outputs from the deployment here, if needed.
5899
//
59100
// This allows the outputs to be referenced by other bicep deployments in the deployment pipeline,

‎infra/core/storage/storage-account.bicep

+118
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
metadata description = 'Creates an Azure storage account.'
2+
param name string
3+
param location string = resourceGroup().location
4+
param tags object = {}
5+
6+
@allowed([
7+
'Cool'
8+
'Hot'
9+
'Premium' ])
10+
param accessTier string = 'Hot'
11+
param allowBlobPublicAccess bool = true
12+
param allowCrossTenantReplication bool = true
13+
param allowSharedKeyAccess bool = true
14+
param containers array = []
15+
param corsRules array = []
16+
param defaultToOAuthAuthentication bool = false
17+
param deleteRetentionPolicy object = {}
18+
@allowed([ 'AzureDnsZone', 'Standard' ])
19+
param dnsEndpointType string = 'Standard'
20+
param files array = []
21+
param kind string = 'StorageV2'
22+
param minimumTlsVersion string = 'TLS1_2'
23+
param queues array = []
24+
param shareDeleteRetentionPolicy object = {}
25+
param supportsHttpsTrafficOnly bool = true
26+
param tables array = []
27+
param networkAcls object = {
28+
bypass: 'AzureServices'
29+
defaultAction: 'Allow'
30+
}
31+
@allowed([ 'Enabled', 'Disabled' ])
32+
param publicNetworkAccess string = 'Enabled'
33+
param sku object = { name: 'Standard_LRS' }
34+
param keyVaultName string = ''
35+
36+
resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
37+
name: name
38+
location: location
39+
tags: tags
40+
kind: kind
41+
sku: sku
42+
properties: {
43+
accessTier: accessTier
44+
allowBlobPublicAccess: allowBlobPublicAccess
45+
allowCrossTenantReplication: allowCrossTenantReplication
46+
allowSharedKeyAccess: allowSharedKeyAccess
47+
defaultToOAuthAuthentication: defaultToOAuthAuthentication
48+
dnsEndpointType: dnsEndpointType
49+
minimumTlsVersion: minimumTlsVersion
50+
networkAcls: networkAcls
51+
publicNetworkAccess: publicNetworkAccess
52+
supportsHttpsTrafficOnly: supportsHttpsTrafficOnly
53+
}
54+
55+
resource blobServices 'blobServices' = if (!empty(containers)) {
56+
name: 'default'
57+
properties: {
58+
cors: {
59+
corsRules: corsRules
60+
}
61+
deleteRetentionPolicy: deleteRetentionPolicy
62+
}
63+
resource container 'containers' = [for container in containers: {
64+
name: container.name
65+
properties: {
66+
// todo: Warning use-safe-access: Use the safe access (.?) operator instead of checking object contents with the 'contains' function. [https://aka.ms/bicep/linter/use-safe-access]
67+
publicAccess: contains(container, 'publicAccess') ? container.publicAccess : 'None'
68+
}
69+
}]
70+
}
71+
72+
resource fileServices 'fileServices' = if (!empty(files)) {
73+
name: 'default'
74+
properties: {
75+
cors: {
76+
corsRules: corsRules
77+
}
78+
shareDeleteRetentionPolicy: shareDeleteRetentionPolicy
79+
}
80+
}
81+
82+
resource queueServices 'queueServices' = if (!empty(queues)) {
83+
name: 'default'
84+
properties: {
85+
86+
}
87+
resource queue 'queues' = [for queue in queues: {
88+
name: queue.name
89+
properties: {
90+
metadata: {}
91+
}
92+
}]
93+
}
94+
95+
resource tableServices 'tableServices' = if (!empty(tables)) {
96+
name: 'default'
97+
properties: {}
98+
// create tables pre-defined in aspire.bicep
99+
resource table 'tables' = [for table in tables: {
100+
name: table
101+
properties: {}
102+
}]
103+
}
104+
}
105+
106+
// Save Storage Account Connection String in Key Vault Secret
107+
module keyVaultSecrets '../../core/security/keyvault-secret.bicep' = {
108+
name: 'keyVaultSecrets'
109+
params: {
110+
name: 'storage-connection-string'
111+
secretValue:'DefaultEndpointsProtocol=https;EndpointSuffix=${environment().suffixes.storage};AccountName=${storage.name};AccountKey=${storage.listKeys().keys[0].value};BlobEndpoint=${storage.properties.primaryEndpoints.blob};FileEndpoint=${storage.properties.primaryEndpoints.file};QueueEndpoint=${storage.properties.primaryEndpoints.queue};TableEndpoint=${storage.properties.primaryEndpoints.table}'
112+
keyVaultName:keyVaultName
113+
}
114+
}
115+
116+
output id string = storage.id
117+
output name string = storage.name
118+
output primaryEndpoints object = storage.properties.primaryEndpoints

0 commit comments

Comments
 (0)