diff --git a/modules/Microsoft.Web/staticSites/.test/min.parameters.json b/modules/Microsoft.Web/staticSites/.test/min.parameters.json index b5781f46f0..dd29975a58 100644 --- a/modules/Microsoft.Web/staticSites/.test/min.parameters.json +++ b/modules/Microsoft.Web/staticSites/.test/min.parameters.json @@ -1,9 +1,9 @@ { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-az-wss-min-001" - } + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "name": { + "value": "<>-az-wss-min-001" } + } } diff --git a/modules/Microsoft.Web/staticSites/.test/parameters.json b/modules/Microsoft.Web/staticSites/.test/parameters.json index 68d8697715..4728d3cd16 100644 --- a/modules/Microsoft.Web/staticSites/.test/parameters.json +++ b/modules/Microsoft.Web/staticSites/.test/parameters.json @@ -1,50 +1,74 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-az-wss-x-001" - }, - "lock": { - "value": "CanNotDelete" - }, - "sku": { - "value": "Standard" - }, - "stagingEnvironmentPolicy": { - "value": "Enabled" - }, - "allowConfigFileUpdates": { - "value": true - }, - "enterpriseGradeCdnStatus": { - "value": "Disabled" - }, - "systemAssignedIdentity": { - "value": true - }, - "userAssignedIdentities": { - "value": { - "/subscriptions/<>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<>-az-msi-x-001": {} - } - }, - "roleAssignments": { - "value": [ - { - "roleDefinitionIdOrName": "Reader", - "principalIds": [ - "<>" - ] - } - ] - }, - "privateEndpoints": { - "value": [ - { - "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<>-az-vnet-x-001/subnets/<>-az-subnet-x-005-privateEndpoints", - "service": "staticSites" - } - ] - } - } -} +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "name": { + "value": "<>-az-wss-x-001" + }, + "lock": { + "value": "CanNotDelete" + }, + "sku": { + "value": "Standard" + }, + "stagingEnvironmentPolicy": { + "value": "Enabled" + }, + "allowConfigFileUpdates": { + "value": true + }, + "enterpriseGradeCdnStatus": { + "value": "Disabled" + }, + "systemAssignedIdentity": { + "value": true + }, + "customDomains": { + "value": [ + "<>domain1.domain", + "<>domain2.domain.domain", + "<>domain3.domain.domain.domain" + ] + }, + "appSettings": { + "value": { + "foo": "bar", + "setting": 1 + } + }, + "functionAppSettings": { + "value": { + "foo": "bar", + "setting": 1 + } + }, + "userAssignedIdentities": { + "value": { + "/subscriptions/<>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<>-az-msi-x-001": {} + } + }, + "roleAssignments": { + "value": [ + { + "roleDefinitionIdOrName": "Reader", + "principalIds": [ + "<>" + ] + } + ] + }, + "privateEndpoints": { + "value": [ + { + "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<>-az-vnet-x-001/subnets/<>-az-subnet-x-005-privateEndpoints", + "service": "staticSites" + } + ] + }, + "linkedBackend": { + "value": { + "resourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Web/sites/<>-az-fa-x-001" + } + } + } +} diff --git a/modules/Microsoft.Web/staticSites/config/deploy.bicep b/modules/Microsoft.Web/staticSites/config/deploy.bicep new file mode 100644 index 0000000000..453d5922be --- /dev/null +++ b/modules/Microsoft.Web/staticSites/config/deploy.bicep @@ -0,0 +1,33 @@ +@allowed([ + 'appsettings' + 'functionappsettings' +]) +@description('Required. Type of settings to apply.') +param kind string + +@description('Required. App settings.') +param properties object + +@description('Conditional. The name of the parent Static Web App. Required if the template is used in a standalone deployment.') +param staticSiteName string + +resource staticSite 'Microsoft.Web/staticSites@2022-03-01' existing = { + name: staticSiteName +} + +resource config 'Microsoft.Web/staticSites/config@2022-03-01' = { + #disable-next-line BCP225 + name: kind + parent: staticSite + properties: properties +} + +@description('The name of the config.') +output name string = config.name + +@description('The resource ID of the config.') +output resourceId string = config.id + +@description('The name of the resource group the config was created in.') +output resourceGroupName string = resourceGroup().name + diff --git a/modules/Microsoft.Web/staticSites/config/readme.md b/modules/Microsoft.Web/staticSites/config/readme.md new file mode 100644 index 0000000000..9ec0d83799 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/config/readme.md @@ -0,0 +1,37 @@ +# Static Site Config `[Microsoft.Web/staticSites/config]` + +This module deploys a Static Site Config. + +## Navigation + +- [Resource Types](#Resource-Types) +- [Parameters](#Parameters) +- [Outputs](#Outputs) + +## Resource Types + +| Resource Type | API Version | +| :-- | :-- | +| `Microsoft.Web/staticSites/config` | [2022-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/staticSites/config) | + +## Parameters + +**Required parameters** +| Parameter Name | Type | Allowed Values | Description | +| :-- | :-- | :-- | :-- | +| `kind` | string | `[appsettings, functionappsettings]` | Type of settings to apply. | +| `properties` | object | | App settings. | + +**Conditional parameters** +| Parameter Name | Type | Description | +| :-- | :-- | :-- | +| `staticSiteName` | string | The name of the parent Static Web App. Required if the template is used in a standalone deployment. | + + +## Outputs + +| Output Name | Type | Description | +| :-- | :-- | :-- | +| `name` | string | The name of the config. | +| `resourceGroupName` | string | The name of the resource group the config was created in. | +| `resourceId` | string | The resource ID of the config. | diff --git a/modules/Microsoft.Web/staticSites/config/version.json b/modules/Microsoft.Web/staticSites/config/version.json new file mode 100644 index 0000000000..d52c7d0010 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/config/version.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json", + "version": "0.6" +} diff --git a/modules/Microsoft.Web/staticSites/customDomains/deploy.bicep b/modules/Microsoft.Web/staticSites/customDomains/deploy.bicep new file mode 100644 index 0000000000..bd6ad9d005 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/customDomains/deploy.bicep @@ -0,0 +1,29 @@ +@description('Conditional. The custom domain name. Required if the template is used in a standalone deployment.') +param name string + +@description('Conditional. The name of the parent Static Web App. Required if the template is used in a standalone deployment.') +param staticSiteName string + +@description('Optional. Validation method for adding a custom domain.') +param validationMethod string = 'cname-delegation' + +resource staticSite 'Microsoft.Web/staticSites@2022-03-01' existing = { + name: staticSiteName +} + +resource customDomain 'Microsoft.Web/staticSites/customDomains@2022-03-01' = { + name: name + parent: staticSite + properties: { + validationMethod: validationMethod + } +} + +@description('The name of the static site.') +output name string = customDomain.name + +@description('The resource ID of the static site.') +output resourceId string = customDomain.id + +@description('The resource group the static site was deployed into.') +output resourceGroupName string = resourceGroup().name diff --git a/modules/Microsoft.Web/staticSites/customDomains/readme.md b/modules/Microsoft.Web/staticSites/customDomains/readme.md new file mode 100644 index 0000000000..8c2307e642 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/customDomains/readme.md @@ -0,0 +1,37 @@ +# Static Site Custom Domain `[Microsoft.Web/staticSites/customDomains]` + +This module deploys a Custom Domain into a Static Site. + +## Navigation + +- [Resource Types](#Resource-Types) +- [Parameters](#Parameters) +- [Outputs](#Outputs) + +## Resource Types + +| Resource Type | API Version | +| :-- | :-- | +| `Microsoft.Web/staticSites/customDomains` | [2022-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/staticSites/customDomains) | + +## Parameters + +**Conditional parameters** +| Parameter Name | Type | Description | +| :-- | :-- | :-- | +| `name` | string | The custom domain name. Required if the template is used in a standalone deployment. | +| `staticSiteName` | string | The name of the parent Static Web App. Required if the template is used in a standalone deployment. | + +**Optional parameters** +| Parameter Name | Type | Default Value | Description | +| :-- | :-- | :-- | :-- | +| `validationMethod` | string | `'cname-delegation'` | Validation method for adding a custom domain. | + + +## Outputs + +| Output Name | Type | Description | +| :-- | :-- | :-- | +| `name` | string | The name of the static site. | +| `resourceGroupName` | string | The resource group the static site was deployed into. | +| `resourceId` | string | The resource ID of the static site. | diff --git a/modules/Microsoft.Web/staticSites/customDomains/version.json b/modules/Microsoft.Web/staticSites/customDomains/version.json new file mode 100644 index 0000000000..d52c7d0010 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/customDomains/version.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json", + "version": "0.6" +} diff --git a/modules/Microsoft.Web/staticSites/deploy.bicep b/modules/Microsoft.Web/staticSites/deploy.bicep index 7fff54a10e..116eb2de02 100644 --- a/modules/Microsoft.Web/staticSites/deploy.bicep +++ b/modules/Microsoft.Web/staticSites/deploy.bicep @@ -10,7 +10,7 @@ param name string @description('Optional. Type of static site to deploy.') param sku string = 'Free' -@description('Optional. If config file is locked for this static web app.') +@description('Optional. False if config file is locked for this static web app; otherwise, true.') param allowConfigFileUpdates bool = true @description('Optional. Location to deploy static site. The following locations are supported: CentralUS, EastUS2, EastAsia, WestEurope, WestUS2.') @@ -77,6 +77,18 @@ param enableDefaultTelemetry bool = true @description('Optional. Array of role assignment objects that contain the \'roleDefinitionIdOrName\' and \'principalId\' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.') param roleAssignments array = [] +@description('Optional. Object with "resourceId" and "location" of the a user defined function app.') +param linkedBackend object = {} + +@description('Optional. Static site app settings.') +param appSettings object = {} + +@description('Optional. Function app settings.') +param functionAppSettings object = {} + +@description('Optional. The custom domains associated with this static site. The deployment will fail as long as the validation records are not present.') +param customDomains array = [] + var enableReferencedModulesTelemetry = false var identityType = systemAssignedIdentity ? (!empty(userAssignedIdentities) ? 'SystemAssigned,UserAssigned' : 'SystemAssigned') : (!empty(userAssignedIdentities) ? 'UserAssigned' : 'None') @@ -120,6 +132,42 @@ resource staticSite 'Microsoft.Web/staticSites@2021-03-01' = { } } +module staticSite_linkedBackend 'linkedBackends/deploy.bicep' = if (!empty(linkedBackend)) { + name: '${uniqueString(deployment().name, location)}-StaticSite-UserDefinedFunction' + params: { + staticSiteName: staticSite.name + backendResourceId: linkedBackend.resourceId + region: contains(linkedBackend, 'location') ? linkedBackend.location : location + } +} + +module staticSite_appSettings 'config/deploy.bicep' = if (!empty(appSettings)) { + name: '${uniqueString(deployment().name, location)}-StaticSite-appSettings' + params: { + kind: 'appsettings' + staticSiteName: staticSite.name + properties: appSettings + } +} + +module staticSite_functionAppSettings 'config/deploy.bicep' = if (!empty(functionAppSettings)) { + name: '${uniqueString(deployment().name, location)}-StaticSite-functionAppSettings' + params: { + kind: 'functionappsettings' + staticSiteName: staticSite.name + properties: functionAppSettings + } +} + +module staticSite_customDomains 'customDomains/deploy.bicep' = [for (customDomain, index) in customDomains: { + name: '${uniqueString(deployment().name, location)}-StaticSite-customDomains-${index}' + params: { + name: customDomain + staticSiteName: staticSite.name + validationMethod: indexOf(customDomain, '.') == lastIndexOf(customDomain, '.') ? 'dns-txt-token' : 'cname-delegation' + } +}] + resource staticSite_lock 'Microsoft.Authorization/locks@2017-04-01' = if (!empty(lock)) { name: '${staticSite.name}-${lock}-lock' properties: { diff --git a/modules/Microsoft.Web/staticSites/linkedBackends/deploy.bicep b/modules/Microsoft.Web/staticSites/linkedBackends/deploy.bicep new file mode 100644 index 0000000000..9f99f31843 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/linkedBackends/deploy.bicep @@ -0,0 +1,33 @@ +@description('Requried. The resource id of the backend linked to the static site.') +param backendResourceId string + +@description('Optional. The region of the backend linked to the static site.') +param region string = resourceGroup().location + +@description('Conditional. The name of the parent Static Web App. Required if the template is used in a standalone deployment.') +param staticSiteName string + +@description('Optional. Name of the backend to link to the static site.') +param linkedBackendName string = uniqueString(backendResourceId) + +resource staticSite 'Microsoft.Web/staticSites@2022-03-01' existing = { + name: staticSiteName +} + +resource linkedBackend 'Microsoft.Web/staticSites/linkedBackends@2022-03-01' = { + name: linkedBackendName + parent: staticSite + properties: { + backendResourceId: backendResourceId + region: region + } +} + +@description('The name of the static site.') +output name string = linkedBackend.name + +@description('The resource ID of the static site.') +output resourceId string = linkedBackend.id + +@description('The resource group the static site was deployed into.') +output resourceGroupName string = resourceGroup().name diff --git a/modules/Microsoft.Web/staticSites/linkedBackends/readme.md b/modules/Microsoft.Web/staticSites/linkedBackends/readme.md new file mode 100644 index 0000000000..c727338ef3 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/linkedBackends/readme.md @@ -0,0 +1,42 @@ +# Static Site Linked Backend `[Microsoft.Web/staticSites/linkedBackends]` + +This module deploys a Custom Function App into a Static Site using the linkedBackends property. + +## Navigation + +- [Resource Types](#Resource-Types) +- [Parameters](#Parameters) +- [Outputs](#Outputs) + +## Resource Types + +| Resource Type | API Version | +| :-- | :-- | +| `Microsoft.Web/staticSites/linkedBackends` | [2022-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/staticSites) | + +## Parameters + +**Conditional parameters** +| Parameter Name | Type | Description | +| :-- | :-- | :-- | +| `staticSiteName` | string | The name of the parent Static Web App. Required if the template is used in a standalone deployment. | + +**Optional parameters** +| Parameter Name | Type | Default Value | Description | +| :-- | :-- | :-- | :-- | +| `linkedBackendName` | string | `[uniqueString(parameters('backendResourceId'))]` | Name of the backend to link to the static site. | +| `region` | string | `[resourceGroup().location]` | The region of the backend linked to the static site. | + +**Requried parameters** +| Parameter Name | Type | Description | +| :-- | :-- | :-- | +| `backendResourceId` | string | The resource id of the backend linked to the static site. | + + +## Outputs + +| Output Name | Type | Description | +| :-- | :-- | :-- | +| `name` | string | The name of the static site. | +| `resourceGroupName` | string | The resource group the static site was deployed into. | +| `resourceId` | string | The resource ID of the static site. | diff --git a/modules/Microsoft.Web/staticSites/linkedBackends/version.json b/modules/Microsoft.Web/staticSites/linkedBackends/version.json new file mode 100644 index 0000000000..d52c7d0010 --- /dev/null +++ b/modules/Microsoft.Web/staticSites/linkedBackends/version.json @@ -0,0 +1,4 @@ +{ + "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json", + "version": "0.6" +} diff --git a/modules/Microsoft.Web/staticSites/readme.md b/modules/Microsoft.Web/staticSites/readme.md index 52ed72ed41..4055cb2a58 100644 --- a/modules/Microsoft.Web/staticSites/readme.md +++ b/modules/Microsoft.Web/staticSites/readme.md @@ -1,408 +1,455 @@ -# Static Web Sites `[Microsoft.Web/staticSites]` - -This module deploys a Static Web Site. - -## Navigation - -- [Resource Types](#Resource-Types) -- [Parameters](#Parameters) -- [Outputs](#Outputs) -- [Deployment examples](#Deployment-examples) - -## Resource Types - -| Resource Type | API Version | -| :-- | :-- | -| `Microsoft.Authorization/locks` | [2017-04-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2017-04-01/locks) | -| `Microsoft.Authorization/roleAssignments` | [2020-10-01-preview](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-10-01-preview/roleAssignments) | -| `Microsoft.Network/privateEndpoints` | [2021-05-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/privateEndpoints) | -| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2021-05-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/privateEndpoints/privateDnsZoneGroups) | -| `Microsoft.Web/staticSites` | [2021-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/2021-03-01/staticSites) | - -## Parameters - -**Required parameters** -| Parameter Name | Type | Description | -| :-- | :-- | :-- | -| `name` | string | Name of the static site. | - -**Optional parameters** -| Parameter Name | Type | Default Value | Allowed Values | Description | -| :-- | :-- | :-- | :-- | :-- | -| `allowConfigFileUpdates` | bool | `True` | | If config file is locked for this static web app. | -| `branch` | string | `''` | | The branch name of the GitHub repo. | -| `buildProperties` | object | `{object}` | | Build properties for the static site. | -| `enableDefaultTelemetry` | bool | `True` | | Enable telemetry via the Customer Usage Attribution ID (GUID). | -| `enterpriseGradeCdnStatus` | string | `'Disabled'` | `[Disabled, Disabling, Enabled, Enabling]` | State indicating the status of the enterprise grade CDN serving traffic to the static web app. | -| `location` | string | `[resourceGroup().location]` | | Location to deploy static site. The following locations are supported: CentralUS, EastUS2, EastAsia, WestEurope, WestUS2. | -| `lock` | string | `''` | `[, CanNotDelete, ReadOnly]` | Specify the type of lock. | -| `privateEndpoints` | array | `[]` | | Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. | -| `provider` | string | `'None'` | | The provider that submitted the last deployment to the primary environment of the static site. | -| `repositoryToken` | secureString | `''` | | The Personal Access Token for accessing the GitHub repo. | -| `repositoryUrl` | string | `''` | | The name of the GitHub repo. | -| `roleAssignments` | array | `[]` | | Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. | -| `sku` | string | `'Free'` | `[Free, Standard]` | Type of static site to deploy. | -| `stagingEnvironmentPolicy` | string | `'Enabled'` | `[Enabled, Disabled]` | State indicating whether staging environments are allowed or not allowed for a static web app. | -| `systemAssignedIdentity` | bool | `False` | | Enables system assigned managed identity on the resource. | -| `tags` | object | `{object}` | | Tags of the resource. | -| `templateProperties` | object | `{object}` | | Template Options for the static site. | -| `userAssignedIdentities` | object | `{object}` | | The ID(s) to assign to the resource. | - - -### Parameter Usage: `privateEndpoints` - -To use Private Endpoint the following dependencies must be deployed: - -- Destination subnet must be created with the following configuration option - `"privateEndpointNetworkPolicies": "Disabled"`. Setting this option acknowledges that NSG rules are not applied to Private Endpoints (this capability is coming soon). A full example is available in the Virtual Network Module. -- Although not strictly required, it is highly recommended to first create a private DNS Zone to host Private Endpoint DNS records. See [Azure Private Endpoint DNS configuration](https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns) for more information. - -
- -Parameter JSON format - -```json -"privateEndpoints": { - "value": [ - // Example showing all available fields - { - "name": "sxx-az-pe", // Optional: Name will be automatically generated if one is not provided here - "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001", - "service": "<>", // e.g. vault, registry, file, blob, queue, table etc. - "privateDnsZoneResourceIds": [ // Optional: No DNS record will be created if a private DNS zone Resource ID is not specified - "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net" - ], - "customDnsConfigs": [ // Optional - { - "fqdn": "customname.test.local", - "ipAddresses": [ - "10.10.10.10" - ] - } - ] - }, - // Example showing only mandatory fields - { - "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001", - "service": "<>" // e.g. vault, registry, file, blob, queue, table etc. - } - ] -} -``` - -
- -
- -Bicep format - -```bicep -privateEndpoints: [ - // Example showing all available fields - { - name: 'sxx-az-pe' // Optional: Name will be automatically generated if one is not provided here - subnetResourceId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001' - service: '<>' // e.g. vault registry file blob queue table etc. - privateDnsZoneResourceIds: [ // Optional: No DNS record will be created if a private DNS zone Resource ID is not specified - '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net' - ] - // Optional - customDnsConfigs: [ - { - fqdn: 'customname.test.local' - ipAddresses: [ - '10.10.10.10' - ] - } - ] - } - // Example showing only mandatory fields - { - subnetResourceId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001' - service: '<>' // e.g. vault registry file blob queue table etc. - } -] -``` - -
-

- -### Parameter Usage: `roleAssignments` - -Create a role assignment for the given resource. If you want to assign a service principal / managed identity that is created in the same deployment, make sure to also specify the `'principalType'` parameter and set it to `'ServicePrincipal'`. This will ensure the role assignment waits for the principal's propagation in Azure. - -

- -Parameter JSON format - -```json -"roleAssignments": { - "value": [ - { - "roleDefinitionIdOrName": "Reader", - "description": "Reader Role Assignment", - "principalIds": [ - "12345678-1234-1234-1234-123456789012", // object 1 - "78945612-1234-1234-1234-123456789012" // object 2 - ] - }, - { - "roleDefinitionIdOrName": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11", - "principalIds": [ - "12345678-1234-1234-1234-123456789012" // object 1 - ], - "principalType": "ServicePrincipal" - } - ] -} -``` - -
- -
- -Bicep format - -```bicep -roleAssignments: [ - { - roleDefinitionIdOrName: 'Reader' - description: 'Reader Role Assignment' - principalIds: [ - '12345678-1234-1234-1234-123456789012' // object 1 - '78945612-1234-1234-1234-123456789012' // object 2 - ] - } - { - roleDefinitionIdOrName: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11' - principalIds: [ - '12345678-1234-1234-1234-123456789012' // object 1 - ] - principalType: 'ServicePrincipal' - } -] -``` - -
-

- -### Parameter Usage: `tags` - -Tag names and tag values can be provided as needed. A tag can be left without a value. - -

- -Parameter JSON format - -```json -"tags": { - "value": { - "Environment": "Non-Prod", - "Contact": "test.user@testcompany.com", - "PurchaseOrder": "1234", - "CostCenter": "7890", - "ServiceName": "DeploymentValidation", - "Role": "DeploymentValidation" - } -} -``` - -
- -
- -Bicep format - -```bicep -tags: { - Environment: 'Non-Prod' - Contact: 'test.user@testcompany.com' - PurchaseOrder: '1234' - CostCenter: '7890' - ServiceName: 'DeploymentValidation' - Role: 'DeploymentValidation' -} -``` - -
-

- -### Parameter Usage: `userAssignedIdentities` - -You can specify multiple user assigned identities to a resource by providing additional resource IDs using the following format: - -

- -Parameter JSON format - -```json -"userAssignedIdentities": { - "value": { - "/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-001": {}, - "/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-002": {} - } -} -``` - -
- -
- -Bicep format - -```bicep -userAssignedIdentities: { - '/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-001': {} - '/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-002': {} -} -``` - -
-

- -## Outputs - -| Output Name | Type | Description | -| :-- | :-- | :-- | -| `location` | string | The location the resource was deployed into. | -| `name` | string | The name of the static site. | -| `resourceGroupName` | string | The resource group the static site was deployed into. | -| `resourceId` | string | The resource ID of the static site. | -| `systemAssignedPrincipalId` | string | The principal ID of the system assigned identity. | - -## Deployment examples - -

Example 1

- -
- -via JSON Parameter file - -```json -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-az-wss-min-001" - } - } -} -``` - -
- -
- -via Bicep module - -```bicep -module staticSites './Microsoft.Web/staticSites/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-staticSites' - params: { - name: '<>-az-wss-min-001' - } -} -``` - -
-

- -

Example 2

- -
- -via JSON Parameter file - -```json -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-az-wss-x-001" - }, - "lock": { - "value": "CanNotDelete" - }, - "sku": { - "value": "Standard" - }, - "stagingEnvironmentPolicy": { - "value": "Enabled" - }, - "allowConfigFileUpdates": { - "value": true - }, - "enterpriseGradeCdnStatus": { - "value": "Disabled" - }, - "systemAssignedIdentity": { - "value": true - }, - "userAssignedIdentities": { - "value": { - "/subscriptions/<>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<>-az-msi-x-001": {} - } - }, - "roleAssignments": { - "value": [ - { - "roleDefinitionIdOrName": "Reader", - "principalIds": [ - "<>" - ] - } - ] - }, - "privateEndpoints": { - "value": [ - { - "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<>-az-vnet-x-001/subnets/<>-az-subnet-x-005-privateEndpoints", - "service": "staticSites" - } - ] - } - } -} -``` - -
- -
- -via Bicep module - -```bicep -module staticSites './Microsoft.Web/staticSites/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-staticSites' - params: { - name: '<>-az-wss-x-001' - lock: 'CanNotDelete' - sku: 'Standard' - stagingEnvironmentPolicy: 'Enabled' - allowConfigFileUpdates: true - enterpriseGradeCdnStatus: 'Disabled' - systemAssignedIdentity: true - userAssignedIdentities: { - '/subscriptions/<>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<>-az-msi-x-001': {} - } - roleAssignments: [ - { - roleDefinitionIdOrName: 'Reader' - principalIds: [ - '<>' - ] - } - ] - privateEndpoints: [ - { - subnetResourceId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<>-az-vnet-x-001/subnets/<>-az-subnet-x-005-privateEndpoints' - service: 'staticSites' - } - ] - } -} -``` - -
-

+# Static Web Sites `[Microsoft.Web/staticSites]` + +This module deploys a Static Web Site. + +## Navigation + +- [Resource Types](#Resource-Types) +- [Parameters](#Parameters) +- [Outputs](#Outputs) +- [Deployment examples](#Deployment-examples) + +## Resource Types + +| Resource Type | API Version | +| :-- | :-- | +| `Microsoft.Authorization/locks` | [2017-04-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2017-04-01/locks) | +| `Microsoft.Authorization/roleAssignments` | [2020-10-01-preview](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-10-01-preview/roleAssignments) | +| `Microsoft.Network/privateEndpoints` | [2021-05-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/privateEndpoints) | +| `Microsoft.Network/privateEndpoints/privateDnsZoneGroups` | [2021-05-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Network/2021-05-01/privateEndpoints/privateDnsZoneGroups) | +| `Microsoft.Web/staticSites` | [2021-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/2021-03-01/staticSites) | +| `Microsoft.Web/staticSites/config` | [2022-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/staticSites/config) | +| `Microsoft.Web/staticSites/customDomains` | [2022-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/staticSites/customDomains) | +| `Microsoft.Web/staticSites/linkedBackends` | [2022-03-01](https://docs.microsoft.com/en-us/azure/templates/Microsoft.Web/staticSites) | + +## Parameters + +**Required parameters** +| Parameter Name | Type | Description | +| :-- | :-- | :-- | +| `name` | string | Name of the static site. | + +**Optional parameters** +| Parameter Name | Type | Default Value | Allowed Values | Description | +| :-- | :-- | :-- | :-- | :-- | +| `allowConfigFileUpdates` | bool | `True` | | False if config file is locked for this static web app; otherwise, true. | +| `appSettings` | object | `{object}` | | Static site app settings. | +| `branch` | string | `''` | | The branch name of the GitHub repo. | +| `buildProperties` | object | `{object}` | | Build properties for the static site. | +| `customDomains` | _[customDomains](customDomains/readme.md)_ array | `[]` | | The custom domains associated with this static site. The deployment will fail as long as the validation records are not present. | +| `enableDefaultTelemetry` | bool | `True` | | Enable telemetry via the Customer Usage Attribution ID (GUID). | +| `enterpriseGradeCdnStatus` | string | `'Disabled'` | `[Disabled, Disabling, Enabled, Enabling]` | State indicating the status of the enterprise grade CDN serving traffic to the static web app. | +| `functionAppSettings` | object | `{object}` | | Function app settings. | +| `linkedBackend` | object | `{object}` | | Object with "resourceId" and "location" of the a user defined function app. | +| `location` | string | `[resourceGroup().location]` | | Location to deploy static site. The following locations are supported: CentralUS, EastUS2, EastAsia, WestEurope, WestUS2. | +| `lock` | string | `''` | `[, CanNotDelete, ReadOnly]` | Specify the type of lock. | +| `privateEndpoints` | array | `[]` | | Configuration details for private endpoints. | +| `provider` | string | `'None'` | | The provider that submitted the last deployment to the primary environment of the static site. | +| `repositoryToken` | secureString | `''` | | The Personal Access Token for accessing the GitHub repo. | +| `repositoryUrl` | string | `''` | | The name of the GitHub repo. | +| `roleAssignments` | array | `[]` | | Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. | +| `sku` | string | `'Free'` | `[Free, Standard]` | Type of static site to deploy. | +| `stagingEnvironmentPolicy` | string | `'Enabled'` | `[Enabled, Disabled]` | State indicating whether staging environments are allowed or not allowed for a static web app. | +| `systemAssignedIdentity` | bool | `False` | | Enables system assigned managed identity on the resource. | +| `tags` | object | `{object}` | | Tags of the resource. | +| `templateProperties` | object | `{object}` | | Template Options for the static site. | +| `userAssignedIdentities` | object | `{object}` | | The ID(s) to assign to the resource. | + + +### Parameter Usage: `privateEndpoints` + +To use Private Endpoint the following dependencies must be deployed: + +- Destination subnet must be created with the following configuration option - `"privateEndpointNetworkPolicies": "Disabled"`. Setting this option acknowledges that NSG rules are not applied to Private Endpoints (this capability is coming soon). A full example is available in the Virtual Network Module. +- Although not strictly required, it is highly recommended to first create a private DNS Zone to host Private Endpoint DNS records. See [Azure Private Endpoint DNS configuration](https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns) for more information. + +

+ +Parameter JSON format + +```json +"privateEndpoints": { + "value": [ + // Example showing all available fields + { + "name": "sxx-az-pe", // Optional: Name will be automatically generated if one is not provided here + "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001", + "service": "<>", // e.g. vault, registry, file, blob, queue, table etc. + "privateDnsZoneResourceIds": [ // Optional: No DNS record will be created if a private DNS zone Resource ID is not specified + "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net" + ], + "customDnsConfigs": [ // Optional + { + "fqdn": "customname.test.local", + "ipAddresses": [ + "10.10.10.10" + ] + } + ] + }, + // Example showing only mandatory fields + { + "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001", + "service": "<>" // e.g. vault, registry, file, blob, queue, table etc. + } + ] +} +``` + +
+ +
+ +Bicep format + +```bicep +privateEndpoints: [ + // Example showing all available fields + { + name: 'sxx-az-pe' // Optional: Name will be automatically generated if one is not provided here + subnetResourceId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001' + service: '<>' // e.g. vault registry file blob queue table etc. + privateDnsZoneResourceIds: [ // Optional: No DNS record will be created if a private DNS zone Resource ID is not specified + '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net' + ] + // Optional + customDnsConfigs: [ + { + fqdn: 'customname.test.local' + ipAddresses: [ + '10.10.10.10' + ] + } + ] + } + // Example showing only mandatory fields + { + subnetResourceId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/sxx-az-vnet-x-001/subnets/sxx-az-subnet-x-001' + service: '<>' // e.g. vault registry file blob queue table etc. + } +] +``` + +
+

+ +### Parameter Usage: `roleAssignments` + +Create a role assignment for the given resource. If you want to assign a service principal / managed identity that is created in the same deployment, make sure to also specify the `'principalType'` parameter and set it to `'ServicePrincipal'`. This will ensure the role assignment waits for the principal's propagation in Azure. + +

+ +Parameter JSON format + +```json +"roleAssignments": { + "value": [ + { + "roleDefinitionIdOrName": "Reader", + "description": "Reader Role Assignment", + "principalIds": [ + "12345678-1234-1234-1234-123456789012", // object 1 + "78945612-1234-1234-1234-123456789012" // object 2 + ] + }, + { + "roleDefinitionIdOrName": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11", + "principalIds": [ + "12345678-1234-1234-1234-123456789012" // object 1 + ], + "principalType": "ServicePrincipal" + } + ] +} +``` + +
+ +
+ +Bicep format + +```bicep +roleAssignments: [ + { + roleDefinitionIdOrName: 'Reader' + description: 'Reader Role Assignment' + principalIds: [ + '12345678-1234-1234-1234-123456789012' // object 1 + '78945612-1234-1234-1234-123456789012' // object 2 + ] + } + { + roleDefinitionIdOrName: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11' + principalIds: [ + '12345678-1234-1234-1234-123456789012' // object 1 + ] + principalType: 'ServicePrincipal' + } +] +``` + +
+

+ +### Parameter Usage: `tags` + +Tag names and tag values can be provided as needed. A tag can be left without a value. + +

+ +Parameter JSON format + +```json +"tags": { + "value": { + "Environment": "Non-Prod", + "Contact": "test.user@testcompany.com", + "PurchaseOrder": "1234", + "CostCenter": "7890", + "ServiceName": "DeploymentValidation", + "Role": "DeploymentValidation" + } +} +``` + +
+ +
+ +Bicep format + +```bicep +tags: { + Environment: 'Non-Prod' + Contact: 'test.user@testcompany.com' + PurchaseOrder: '1234' + CostCenter: '7890' + ServiceName: 'DeploymentValidation' + Role: 'DeploymentValidation' +} +``` + +
+

+ +### Parameter Usage: `userAssignedIdentities` + +You can specify multiple user assigned identities to a resource by providing additional resource IDs using the following format: + +

+ +Parameter JSON format + +```json +"userAssignedIdentities": { + "value": { + "/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-001": {}, + "/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-002": {} + } +} +``` + +
+ +
+ +Bicep format + +```bicep +userAssignedIdentities: { + '/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-001': {} + '/subscriptions/12345678-1234-1234-1234-123456789012/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-sxx-az-msi-x-002': {} +} +``` + +
+

+ +## Outputs + +| Output Name | Type | Description | +| :-- | :-- | :-- | +| `location` | string | The location the resource was deployed into. | +| `name` | string | The name of the static site. | +| `resourceGroupName` | string | The resource group the static site was deployed into. | +| `resourceId` | string | The resource ID of the static site. | +| `systemAssignedPrincipalId` | string | The principal ID of the system assigned identity. | + +## Deployment examples + +

Example 1

+ +
+ +via JSON Parameter file + +```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "name": { + "value": "<>-az-wss-min-001" + } + } +} +``` + +
+ +
+ +via Bicep module + +```bicep +module staticSites './Microsoft.Web/staticSites/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-staticSites' + params: { + name: '<>-az-wss-min-001' + } +} +``` + +
+

+ +

Example 2

+ +
+ +via JSON Parameter file + +```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "name": { + "value": "<>-az-wss-x-001" + }, + "lock": { + "value": "CanNotDelete" + }, + "sku": { + "value": "Standard" + }, + "stagingEnvironmentPolicy": { + "value": "Enabled" + }, + "allowConfigFileUpdates": { + "value": true + }, + "enterpriseGradeCdnStatus": { + "value": "Disabled" + }, + "systemAssignedIdentity": { + "value": true + }, + "customDomains": { + "value": [ + "<>domain1.domain", + "<>domain2.domain.domain", + "<>domain3.domain.domain.domain" + ] + }, + "appSettings": { + "value": { + "foo": "bar", + "setting": 1 + } + }, + "functionAppSettings": { + "value": { + "foo": "bar", + "setting": 1 + } + }, + "userAssignedIdentities": { + "value": { + "/subscriptions/<>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<>-az-msi-x-001": {} + } + }, + "roleAssignments": { + "value": [ + { + "roleDefinitionIdOrName": "Reader", + "principalIds": [ + "<>" + ] + } + ] + }, + "privateEndpoints": { + "value": [ + { + "subnetResourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<>-az-vnet-x-001/subnets/<>-az-subnet-x-005-privateEndpoints", + "service": "staticSites" + } + ] + }, + "linkedBackend": { + "value": { + "resourceId": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Web/sites/<>-az-fa-x-001" + } + } + } +} +``` + +
+ +
+ +via Bicep module + +```bicep +module staticSites './Microsoft.Web/staticSites/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-staticSites' + params: { + name: '<>-az-wss-x-001' + lock: 'CanNotDelete' + sku: 'Standard' + stagingEnvironmentPolicy: 'Enabled' + allowConfigFileUpdates: true + enterpriseGradeCdnStatus: 'Disabled' + systemAssignedIdentity: true + customDomains: [ + '<>domain1.domain' + '<>domain2.domain.domain' + '<>domain3.domain.domain.domain' + ] + appSettings: { + foo: 'bar' + setting: 1 + } + functionAppSettings: { + foo: 'bar' + setting: 1 + } + userAssignedIdentities: { + '/subscriptions/<>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<>-az-msi-x-001': {} + } + roleAssignments: [ + { + roleDefinitionIdOrName: 'Reader' + principalIds: [ + '<>' + ] + } + ] + privateEndpoints: [ + { + subnetResourceId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<>-az-vnet-x-001/subnets/<>-az-subnet-x-005-privateEndpoints' + service: 'staticSites' + } + ] + linkedBackend: { + resourceId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Web/sites/<>-az-fa-x-001' + } + } +} +``` + +
+

diff --git a/modules/Microsoft.Web/staticSites/version.json b/modules/Microsoft.Web/staticSites/version.json index 41f66cc990..d52c7d0010 100644 --- a/modules/Microsoft.Web/staticSites/version.json +++ b/modules/Microsoft.Web/staticSites/version.json @@ -1,4 +1,4 @@ { "$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json", - "version": "0.1" + "version": "0.6" }