Added tags module

.azuredevops/modulePipelines/ms.resources.tags.yml

@@ -0,0 +1,53 @@
+name: 'Resources - Tags'
+
+parameters:
+  - name: removeDeployment
+    displayName: Remove deployed module
+    type: boolean
+    default: true
+  - name: prerelease
+    displayName: Publish prerelease module
+    type: boolean
+    default: false
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - main
+  paths:
+    include:
+      - '/.azuredevops/modulePipelines/ms.resources.tags.yml'
+      - '/.azuredevops/pipelineTemplates/module.*.yml'
+      - '/arm/Microsoft.Resources/tags/*'
+    exclude:
+      - '/**/*.md'
+
+variables:
+  - template: '/.azuredevops/pipelineVariables/global.variables.yml'
+  - group: 'PLATFORM_VARIABLES'
+  - name: modulePath
+    value: '/arm/Microsoft.Resources/tags'
+
+stages:
+  - stage: Validation
+    displayName: Pester tests
+    jobs:
+      - template: /.azuredevops/pipelineTemplates/jobs.validateModulePester.yml
+
+  - stage: Deployment
+    displayName: Deployment tests
+    jobs:
+      - template: /.azuredevops/pipelineTemplates/jobs.validateModuleDeployment.yml
+        parameters:
+          removeDeployment: '${{ parameters.removeDeployment }}'
+          deploymentBlocks:
+            - path: $(modulePath)/.parameters/min.parameters.json
+            - path: $(modulePath)/.parameters/rg.parameters.json
+            - path: $(modulePath)/.parameters/sub.parameters.json
+
+  - stage: Publishing
+    displayName: Publish module
+    condition: and(succeeded(), or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq('${{ parameters.prerelease }}', 'true')))
+    jobs:
+      - template: /.azuredevops/pipelineTemplates/jobs.publishModule.yml

.github/workflows/ms.resources.tags.yml

@@ -0,0 +1,136 @@
+name: 'Resources: Tags'
+
+on:
+  workflow_dispatch:
+    inputs:
+      removeDeployment:
+        type: boolean
+        description: 'Remove deployed module'
+        required: false
+        default: 'true'
+      prerelease:
+        type: boolean
+        description: 'Publish prerelease module'
+        required: false
+        default: 'false'
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/actions/templates/**'
+      - '.github/workflows/ms.resources.tags.yml'
+      - 'arm/Microsoft.Resources/tags/**'
+      - '!*/**/readme.md'
+      - 'utilities/pipelines/**'
+      - '!utilities/pipelines/dependencies/**'
+
+env:
+  modulePath: 'arm/Microsoft.Resources/tags'
+  workflowPath: '.github/workflows/ms.resources.tags.yml'
+  AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
+  ARM_SUBSCRIPTION_ID: '${{ secrets.ARM_SUBSCRIPTION_ID }}'
+  ARM_MGMTGROUP_ID: '${{ secrets.ARM_MGMTGROUP_ID }}'
+  ARM_TENANT_ID: '${{ secrets.ARM_TENANT_ID }}'
+  DEPLOYMENT_SP_ID: '${{ secrets.DEPLOYMENT_SP_ID }}'
+
+jobs:
+  ############################
+  #   SET INPUT PARAMETERS   #
+  ############################
+  job_set_workflow_param:
+    runs-on: ubuntu-20.04
+    name: 'Set input parameters to output variables'
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: 'Set input parameters'
+        id: get-workflow-param
+        uses: ./.github/actions/templates/getWorkflowInput
+        with:
+          workflowPath: '${{ env.workflowPath}}'
+    outputs:
+      removeDeployment: ${{ steps.get-workflow-param.outputs.removeDeployment }}
+
+  ####################
+  #   Pester Tests   #
+  ####################
+  job_module_pester_validation:
+    runs-on: ubuntu-20.04
+    name: 'Pester tests'
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: 'Run tests'
+        uses: ./.github/actions/templates/validateModulePester
+        with:
+          modulePath: '${{ env.modulePath }}'
+
+  ####################
+  # Deployment tests #
+  ####################
+  job_module_deploy_validation:
+    runs-on: ubuntu-20.04
+    name: 'Deployment tests'
+    needs:
+      - job_set_workflow_param
+      - job_module_pester_validation
+    strategy:
+      fail-fast: false
+      matrix:
+        parameterFilePaths:
+          ['min.parameters.json', 'rg.parameters.json', 'sub.parameters.json']
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Set environment variables
+        uses: deep-mm/set-variables@v1.0
+        with:
+          variableFileName: 'global.variables'
+      - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
+        uses: ./.github/actions/templates/validateModuleDeployment
+        with:
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
+          parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
+          location: '${{ env.defaultLocation }}'
+          resourceGroupName: '${{ env.resourceGroupName }}'
+          subscriptionId: '${{ secrets.ARM_SUBSCRIPTION_ID }}'
+          managementGroupId: '${{ secrets.ARM_MGMTGROUP_ID }}'
+          removeDeployment: '${{ needs.job_set_workflow_param.outputs.removeDeployment }}'
+
+  ###############
+  #   PUBLISH   #
+  ###############
+  job_publish_module:
+    name: 'Publish module'
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || github.event.inputs.prerelease == 'true'
+    runs-on: ubuntu-20.04
+    needs:
+      - job_set_workflow_param
+      - job_module_deploy_validation
+    steps:
+      - name: 'Checkout'
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Set environment variables
+        uses: deep-mm/set-variables@v1.0
+        with:
+          variableFileName: 'global.variables'
+      - name: 'Publish module'
+        uses: ./.github/actions/templates/publishModule
+        with:
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
+          templateSpecsRGName: '${{ env.templateSpecsRGName }}'
+          templateSpecsRGLocation: '${{ env.templateSpecsRGLocation }}'
+          templateSpecsDescription: '${{ env.templateSpecsDescription }}'
+          templateSpecsDoPublish: '${{ env.templateSpecsDoPublish }}'
+          bicepRegistryName: '${{ env.bicepRegistryName }}'
+          bicepRegistryRGName: '${{ env.bicepRegistryRGName }}'
+          bicepRegistryRgLocation: '${{ env.bicepRegistryRgLocation }}'
+          bicepRegistryDoPublish: '${{ env.bicepRegistryDoPublish }}'

arm/Microsoft.Resources/tags/.parameters/min.parameters.json

@@ -0,0 +1,5 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {}
+}

arm/Microsoft.Resources/tags/.parameters/rg.parameters.json

@@ -0,0 +1,18 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "onlyUpdate": {
+            "value": false
+        },
+        "tags": {
+            "value": {
+                "Test": "Yes",
+                "TestToo": "No"
+            }
+        },
+        "resourceGroupName": {
+            "value": "validation-rg"
+        }
+    }
+}

arm/Microsoft.Resources/tags/.parameters/sub.parameters.json

@@ -0,0 +1,15 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "onlyUpdate": {
+            "value": true
+        },
+        "tags": {
+            "value": {
+                "Test": "Yes",
+                "TestToo": "No"
+            }
+        }
+    }
+}

arm/Microsoft.Resources/tags/deploy.bicep

@@ -0,0 +1,36 @@
+targetScope = 'subscription'
+
+@description('Optional. Tags for the resource group. If not provided, removes existing tags')
+param tags object = {}
+
+@description('Optional. Instead of overwriting the existing tags, combine them with the new tags')
+param onlyUpdate bool = false
+
+@description('Optional. Name of the Resource Group to assign the tags to. If no Resource Group name is provided, and Subscription ID is provided, the module deploys at subscription level, therefore assigns the provided tags to the subscription.')
+param resourceGroupName string = ''
+
+@description('Optional. Subscription ID of the subscription to assign the tags to. If no Resource Group name is provided, the module deploys at subscription level, therefore assigns the provided tags to the subscription.')
+param subscriptionId string = subscription().id
+
+module tags_sub 'subscriptions/deploy.bicep' = if (!empty(subscriptionId) && empty(resourceGroupName)) {
+  name: '${deployment().name}-Tags-Sub'
+  params: {
+    onlyUpdate: onlyUpdate
+    tags: tags
+  }
+}
+
+module tags_rg 'resourceGroups/deploy.bicep' = if (!empty(resourceGroupName) && !empty(subscriptionId)) {
+  name: '${deployment().name}-Tags-RG'
+  scope: resourceGroup(resourceGroupName)
+  params: {
+    onlyUpdate: onlyUpdate
+    tags: tags
+  }
+}
+
+@description('The name of the tags resource')
+output name string = (!empty(resourceGroupName) && !empty(subscriptionId)) ? tags_rg.outputs.name : tags_sub.outputs.name
+
+@description('The applied tags')
+output tags object = (!empty(resourceGroupName) && !empty(subscriptionId)) ? tags_rg.outputs.tags : tags_sub.outputs.tags

arm/Microsoft.Resources/tags/readme.md

@@ -0,0 +1,46 @@
+# Resources Tags `[Microsoft.Resources/tags]`
+
+This module deploys Resources Tags on a subscription or resource group scope.
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Resources/tags` | 2019-10-01 |
+
+## Parameters
+
+| Parameter Name | Type | Default Value | Possible Values | Description |
+| :-- | :-- | :-- | :-- | :-- |
+| `onlyUpdate` | bool |  |  | Optional. Instead of overwriting the existing tags, combine them with the new tags |
+| `resourceGroupName` | string |  |  | Optional. Name of the Resource Group to assign the tags to. If no Resource Group name is provided, and Subscription ID is provided, the module deploys at subscription level, therefore assigns the provided tags to the subscription. |
+| `subscriptionId` | string | `[subscription().id]` |  | Optional. Subscription ID of the subscription to assign the tags to. If no Resource Group name is provided, the module deploys at subscription level, therefore assigns the provided tags to the subscription. |
+| `tags` | object | `{object}` |  | Optional. Tags for the resource group. If not provided, removes existing tags |
+
+### Parameter Usage: `tags`
+
+Tag names and tag values can be provided as needed. A tag can be left without a value.
+
+```json
+"tags": {
+    "value": {
+        "Environment": "Non-Prod",
+        "Contact": "test.user@testcompany.com",
+        "PurchaseOrder": "1234",
+        "CostCenter": "7890",
+        "ServiceName": "DeploymentValidation",
+        "Role": "DeploymentValidation"
+    }
+}
+```
+
+## Outputs
+
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `name` | string | The name of the tags resource |
+| `tags` | object | The applied tags |
+
+## Template references
+
+- [Tags](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Resources/2019-10-01/tags)

arm/Microsoft.Resources/tags/resourceGroups/.bicep/readTags.bicep

@@ -0,0 +1,9 @@
+@description('Optional. The name of the tags resource.')
+param name string = 'default'
+
+resource tags 'Microsoft.Resources/tags@2019-10-01' existing = {
+  name: name
+}
+
+@description('Tags currently applied to the subscription level')
+output existingTags object = contains(tags.properties, 'tags') ? tags.properties.tags : {}

arm/Microsoft.Resources/tags/resourceGroups/deploy.bicep

@@ -0,0 +1,33 @@
+@description('Optional. Tags for the resource group. If not provided, removes existing tags')
+param tags object = {}
+
+@description('Optional. The name of the tags resource.')
+param name string = 'default'
+
+@description('Optional. Instead of overwriting the existing tags, combine them with the new tags')
+param onlyUpdate bool = false
+
+module readTags '.bicep/readTags.bicep' = if (onlyUpdate) {
+  name: '${deployment().name}-ReadTags'
+}
+
+var newTags = (onlyUpdate) ? union(readTags.outputs.existingTags, tags) : tags
+
+resource tag 'Microsoft.Resources/tags@2019-10-01' = {
+  name: name
+  properties: {
+    tags: newTags
+  }
+}
+
+@description('The name of the tags resource')
+output name string = tag.name
+
+@description('The resourceId of the resource group the tags were applied to')
+output resourceId string = resourceGroup().id
+
+@description('The name of the resource group the tags were applied to')
+output resourceGroupName string = resourceGroup().name
+
+@description('The applied tags')
+output tags object = newTags