Merge pull request #20 from seesharprun/rework-fixed

Rework project

infra/abbreviations.json

@@ -1,6 +1,8 @@
-{
+{  
+  "logAnalyticsWorkspace": "log-analytics",
   "containerRegistry": "containerreg",
   "containerAppsEnv": "container-env",
   "containerAppsApp": "container-app",
-  "cosmosDbAccount": "cosmos-db-nosql"
+  "cosmosDbAccount": "cosmos-db-nosql",
+  "userAssignedIdentity": "managed-identity"
 }

infra/app/database.bicep

@@ -4,14 +4,69 @@ param accountName string
 param location string = resourceGroup().location
 param tags object = {}
 
-module cosmosDbAccount '../core/database/cosmos-db/nosql/account.bicep' = {
+@description('Id of the service principals to assign database and application roles.')
+param appPrincipalId string
+
+@description('Id of the user principals to assign database and application roles.')
+param userPrincipalId string = ''
+
+var database = {
+  name: 'cosmicworks' // Based on AdventureWorksLT data set
+}
+
+var containers = [
+  {
+    name: 'products' // Set of products
+    partitionKeyPaths: [
+      '/category' // Partition on the product category
+    ]
+    autoscale: true // Scale at the container level
+    throughput: 1000 // Enable autoscale with a minimum of 100 RUs and a maximum of 1,000 RUs
+  }
+]
+
+module cosmosDbAccount 'br/public:avm/res/document-db/database-account:0.6.1' = {
   name: 'cosmos-db-account'
   params: {
     name: accountName
     location: location
     tags: tags
+    disableKeyBasedMetadataWriteAccess: true
+    disableLocalAuth: true
+    sqlRoleDefinitions: [
+      {
+        name: 'nosql-data-plane-contributor'
+        dataAction: [
+          'Microsoft.DocumentDB/databaseAccounts/readMetadata' // Read account metadata
+          'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*' // Create items
+          'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*' // Manage items      
+        ]
+      }
+    ]
+    sqlRoleAssignmentsPrincipalIds: union(
+      [
+        appPrincipalId
+      ],
+      !empty(userPrincipalId)
+        ? [
+            userPrincipalId
+          ]
+        : []
+    )
+    sqlDatabases: [
+      {
+        name: database.name
+        containers: [
+          for container in containers: {
+            name: container.name
+            paths: container.partitionKeyPaths
+            autoscaleSettingsMaxThroughput: container.throughput
+          }
+        ]
+      }
+    ]
   }
 }
 
+output name string = cosmosDbAccount.outputs.name
 output endpoint string = cosmosDbAccount.outputs.endpoint
-output accountName string = cosmosDbAccount.outputs.name

infra/app/identity.bicep

@@ -0,0 +1,19 @@
+metadata description = 'Create identity resources.'
+
+param identityName string
+param location string = resourceGroup().location
+param tags object = {}
+
+module userAssignedIdentity 'br/public:avm/res/managed-identity/user-assigned-identity:0.4.0' = {
+  name: 'user-assigned-identity'
+  params: {
+    name: identityName
+    location: location
+    tags: tags
+  }
+}
+
+output name string = userAssignedIdentity.outputs.name
+output resourceId string = userAssignedIdentity.outputs.resourceId
+output principalId string = userAssignedIdentity.outputs.principalId
+output clientId string = userAssignedIdentity.outputs.clientId

infra/app/registry.bicep

@@ -4,18 +4,33 @@ param registryName string
 param location string = resourceGroup().location
 param tags object = {}
 
-module containerRegistry '../core/host/container-registry/registry.bicep' = {
+@description('Id of the user principals to assign database and application roles.')
+param userPrincipalId string = ''
+
+module containerRegistry 'br/public:avm/res/container-registry/registry:0.5.1' = {
   name: 'container-registry'
   params: {
     name: registryName
     location: location
     tags: tags
-    adminUserEnabled: false
+    acrAdminUserEnabled: false
     anonymousPullEnabled: true
-    publicNetworkAccessEnabled: true
-    skuName: 'Standard'
+    publicNetworkAccess: 'Enabled'
+    acrSku: 'Standard'
+  }
+}
+
+module registryUserAssignment 'br/public:avm/ptn/authorization/resource-role-assignment:0.1.1' = if (!empty(userPrincipalId)) {
+  name: 'container-registry-role-assignment-push-user'
+  params: {
+    principalId: userPrincipalId
+    resourceId: containerRegistry.outputs.resourceId
+    roleDefinitionId: subscriptionResourceId(
+      'Microsoft.Authorization/roleDefinitions',
+      '8311e382-0749-4cb8-b61a-304f252e45ec' // AcrPush built-in role
+    )
   }
 }
 
-output endpoint string = containerRegistry.outputs.endpoint
 output name string = containerRegistry.outputs.name
+output endpoint string = containerRegistry.outputs.loginServer