Microsoft.Authorization: Publish templates on different scopes

.azuredevops/modulePipelines/ms.authorization.policyassignments.yml

@@ -42,10 +42,18 @@ stages:
         parameters:
           removeDeployment: '${{ parameters.removeDeployment }}'
           deploymentBlocks:
-            - path: $(modulePath)/.parameters/min.parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policyAssignments_sub.bicep
-            - path: $(modulePath)/.parameters/parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policyAssignments_sub.bicep
+            - path: $(modulePath)/.parameters/mg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/mg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
 
   - stage: Publishing
     displayName: Publish module

.azuredevops/modulePipelines/ms.authorization.policydefinitions.yml

@@ -42,10 +42,14 @@ stages:
         parameters:
           removeDeployment: '${{ parameters.removeDeployment }}'
           deploymentBlocks:
-            - path: $(modulePath)/.parameters/min.parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policyDefinitions_sub.bicep
-            - path: $(modulePath)/.parameters/parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policyDefinitions_sub.bicep
+            - path: $(modulePath)/.parameters/mg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/mg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
 
   - stage: Publishing
     displayName: Publish module

.azuredevops/modulePipelines/ms.authorization.policyexemptions.yml

@@ -42,10 +42,18 @@ stages:
         parameters:
           removeDeployment: '${{ parameters.removeDeployment }}'
           deploymentBlocks:
-            - path: $(modulePath)/.parameters/min.parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policyExemptions_sub.bicep
-            - path: $(modulePath)/.parameters/parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policyExemptions_sub.bicep
+            - path: $(modulePath)/.parameters/mg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/mg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
 
   - stage: Publishing
     displayName: Publish module

.azuredevops/modulePipelines/ms.authorization.policysetdefinitions.yml

@@ -42,10 +42,14 @@ stages:
         parameters:
           removeDeployment: '${{ parameters.removeDeployment }}'
           deploymentBlocks:
-            - path: $(modulePath)/.parameters/min.parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policySetDefinition_sub.bicep
-            - path: $(modulePath)/.parameters/parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_policySetDefinition_sub.bicep
+            - path: $(modulePath)/.parameters/mg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/mg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
 
   - stage: Publishing
     displayName: Publish module

.azuredevops/modulePipelines/ms.authorization.roleassignments.yml

@@ -42,10 +42,18 @@ stages:
         parameters:
           removeDeployment: '${{ parameters.removeDeployment }}'
           deploymentBlocks:
-            - path: $(modulePath)/.parameters/min.parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_rbac_sub.bicep
-            - path: $(modulePath)/.parameters/parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_rbac_sub.bicep
+            - path: $(modulePath)/.parameters/mg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/mg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
 
   - stage: Publishing
     displayName: Publish module

.azuredevops/modulePipelines/ms.authorization.roledefinitions.yml

@@ -42,10 +42,18 @@ stages:
         parameters:
           removeDeployment: '${{ parameters.removeDeployment }}'
           deploymentBlocks:
-            - path: $(modulePath)/.parameters/min.parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_roleDefinitions_sub.bicep
-            - path: $(modulePath)/.parameters/parameters.json
-              templateFilePath: $(modulePath)/.bicep/nested_roleDefinitions_sub.bicep
+            - path: $(modulePath)/.parameters/mg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/mg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/sub.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.min.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
+            - path: $(modulePath)/.parameters/rg.parameters.json
+              templateFilePath: $(modulePath)/deploy.bicep
 
   - stage: Publishing
     displayName: Publish module

.azuredevops/pipelineTemplates/jobs.validateModuleDeployment.yml

@@ -216,7 +216,7 @@ jobs:
               pwsh: true
               inline: |
                 # Load used functions
-                . (Join-Path '$(moduleRepoRoot)' '$(pipelineFunctionsPath)' 'resourceValidation' 'Test-TemplateWithParameterFile.ps1')
+                . (Join-Path '$(moduleRepoRoot)' '$(pipelineFunctionsPath)' 'resourceDeployment' 'Test-TemplateWithParameterFile.ps1')
 
                 if(-not [String]::IsNullOrEmpty('${{ deploymentBlock.templateFilePath }}')) {
                   $templateFilePath = Join-Path '$(moduleRepoRoot)' '${{ deploymentBlock.templateFilePath }}'

.azuredevops/platformPipelines/platform.dependencies.yml

@@ -91,7 +91,7 @@ stages:
       - deploy_rg
     variables:
       resourceType: 'Microsoft.Authorization/policyAssignments'
-      templateFilePath: $(modulesPath)/$(resourceType)/.bicep/nested_policyAssignments_sub.bicep
+      templateFilePath: $(modulesPath)/$(resourceType)/subscription/deploy.bicep
     jobs:
       - template: /.azuredevops/pipelineTemplates/jobs.validateModuleDeployment.yml
         parameters:
@@ -803,7 +803,7 @@ stages:
       - deploy_msi
     variables:
       resourceType: 'Microsoft.Authorization/roleAssignments'
-      templateFilePath: $(modulesPath)/$(resourceType)/.bicep/nested_rbac_sub.bicep
+      templateFilePath: $(modulesPath)/$(resourceType)/subscription/deploy.bicep
       msiPrincipalId: $[ stageDependencies.deploy_msi.job_set_msi_id.outputs['print_msi_prinId.msiPrincipalId'] ]
     jobs:
       - template: /.azuredevops/pipelineTemplates/jobs.validateModuleDeployment.yml

.github/actions/templates/validateModuleDeployment/action.yml

@@ -138,7 +138,7 @@ runs:
         Write-Output "::group::Validate [${{ inputs.templateFilePath }}]"
 
         # Load used functions
-        . (Join-Path $env:GITHUB_WORKSPACE 'utilities' 'pipelines' 'resourceValidation' 'Test-TemplateWithParameterFile.ps1')
+        . (Join-Path $env:GITHUB_WORKSPACE 'utilities' 'pipelines' 'resourceDeployment' 'Test-TemplateWithParameterFile.ps1')
 
         # ----------- #
         # INVOKE TEST #

.github/workflows/ms.authorization.policyassignments.yml

@@ -81,7 +81,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        parameterFilePaths: ['parameters.json', 'min.parameters.json']
+        parameterFilePaths:
+          [
+            'mg.parameters.json',
+            'mg.min.parameters.json',
+            'sub.parameters.json',
+            'sub.min.parameters.json',
+            'rg.parameters.json',
+            'rg.min.parameters.json',
+          ]
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v2
@@ -98,7 +106,7 @@ jobs:
       - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: '${{ env.modulePath }}/.bicep/nested_policyAssignments_sub.bicep'
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
           parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.resourceGroupName }}'

.github/workflows/ms.authorization.policydefinitions.yml

@@ -81,7 +81,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        parameterFilePaths: ['parameters.json', 'min.parameters.json']
+        parameterFilePaths:
+          [
+            'mg.min.parameters.json',
+            'mg.parameters.json',
+            'sub.min.parameters.json',
+            'sub.parameters.json',
+          ]
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v2
@@ -98,7 +104,7 @@ jobs:
       - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: '${{ env.modulePath }}/.bicep/nested_policyDefinitions_sub.bicep'
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
           parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.resourceGroupName }}'

.github/workflows/ms.authorization.policyexemptions.yml

@@ -81,7 +81,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        parameterFilePaths: ['parameters.json', 'min.parameters.json']
+        parameterFilePaths:
+          [
+            'mg.parameters.json',
+            'mg.min.parameters.json',
+            'sub.parameters.json',
+            'sub.min.parameters.json',
+            'rg.parameters.json',
+            'rg.min.parameters.json',
+          ]
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v2
@@ -98,7 +106,7 @@ jobs:
       - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: '${{ env.modulePath }}/.bicep/nested_policyExemptions_sub.bicep'
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
           parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.resourceGroupName }}'

.github/workflows/ms.authorization.policysetdefinitions.yml

@@ -81,7 +81,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        parameterFilePaths: ['parameters.json', 'min.parameters.json']
+        parameterFilePaths:
+          [
+            'mg.min.parameters.json',
+            'mg.parameters.json',
+            'sub.min.parameters.json',
+            'sub.parameters.json',
+          ]
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v2
@@ -98,7 +104,7 @@ jobs:
       - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: '${{ env.modulePath }}/.bicep/nested_policySetDefinition_sub.bicep'
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
           parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.resourceGroupName }}'

.github/workflows/ms.authorization.roleassignments.yml

@@ -81,7 +81,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        parameterFilePaths: ['parameters.json', 'min.parameters.json']
+        parameterFilePaths:
+          [
+            'mg.parameters.json',
+            'mg.min.parameters.json',
+            'sub.parameters.json',
+            'sub.min.parameters.json',
+            'rg.parameters.json',
+            'rg.min.parameters.json',
+          ]
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v2
@@ -98,7 +106,7 @@ jobs:
       - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: '${{ env.modulePath }}/.bicep/nested_rbac_sub.bicep'
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
           parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.resourceGroupName }}'

.github/workflows/ms.authorization.roledefinitions.yml

@@ -81,7 +81,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        parameterFilePaths: ['parameters.json', 'min.parameters.json']
+        parameterFilePaths:
+          [
+            'mg.parameters.json',
+            'mg.min.parameters.json',
+            'sub.parameters.json',
+            'sub.min.parameters.json',
+            'rg.parameters.json',
+            'rg.min.parameters.json',
+          ]
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v2
@@ -98,7 +106,7 @@ jobs:
       - name: 'Using parameter file [${{ matrix.parameterFilePaths }}]'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: '${{ env.modulePath }}/.bicep/nested_roleDefinitions_sub.bicep'
+          templateFilePath: '${{ env.modulePath }}/deploy.bicep'
           parameterFilePath: '${{ env.modulePath }}/.parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.resourceGroupName }}'

.github/workflows/platform.dependencies.yml

@@ -137,7 +137,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        parameterFilePaths: ['parameters.json']
+        parameterFilePaths: ['mg.parameters.json', 'sub.parameters.json']
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v2
@@ -146,7 +146,7 @@ jobs:
       - name: 'Deploy module'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: 'arm/${{ env.namespace }}/.bicep/nested_policyAssignments_sub.bicep'
+          templateFilePath: 'arm/${{ env.namespace }}/deploy.bicep'
           parameterFilePath: '${{ env.dependencyPath }}/${{ env.namespace }}/parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.defaultResourceGroupName }}'
@@ -1135,7 +1135,7 @@ jobs:
       - name: 'Deploy module'
         uses: ./.github/actions/templates/validateModuleDeployment
         with:
-          templateFilePath: 'arm/${{ env.namespace }}/.bicep/nested_rbac_sub.bicep'
+          templateFilePath: 'arm/${{ env.namespace }}/subscription/deploy.bicep'
           parameterFilePath: '${{ env.dependencyPath }}/${{ env.namespace }}/parameters/${{ matrix.parameterFilePaths }}'
           location: '${{ env.defaultLocation }}'
           resourceGroupName: '${{ env.defaultResourceGroupName }}'

arm/Microsoft.Authorization/policyAssignments/.parameters/mg.min.parameters.json

@@ -0,0 +1,12 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "name": {
+            "value": "<<namePrefix>>-min-mg-polAss"
+        },
+        "policyDefinitionID": {
+            "value": "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d"
+        }
+    }
+}