Add Bicep deployment samples for SRE Agent Infrastructure as Code

samples/README.md

@@ -0,0 +1,46 @@
+# SRE Agent Samples
+
+This directory contains community-contributed samples and deployment templates for the Azure SRE Agent.
+
+## Available Samples
+
+### [Bicep Deployment](./bicep-deployment/)
+
+A comprehensive Bicep-based Infrastructure as Code (IaC) solution for deploying Azure SRE Agents with advanced configuration options.
+
+**Features:**
+- 🎯 **Subscription Targeting**: Deploy SRE Agents to specific Azure subscriptions
+- 🏗️ **Custom Resource Groups**: Deploy to any resource group with flexible naming
+- 🔐 **Multi-Resource Group Access**: Grant SRE Agent permissions across multiple resource groups
+- 🌐 **Cross-Subscription Support**: Target resource groups across different subscriptions
+- 🤖 **Interactive Deployment**: User-friendly deployment scripts with CLI and config file support
+- 📋 **Role Assignment Management**: Automated permission setup with high/low access levels
+
+**What's Included:**
+- Complete Bicep templates for SRE Agent deployment
+- Role assignment templates for security configuration
+- Interactive deployment scripts with CLI interface
+- Configuration examples and parameter files
+- Comprehensive documentation and troubleshooting guides
+
+**Quick Start:**
+```bash
+cd bicep-deployment
+chmod +x scripts/deploy.sh
+./scripts/deploy.sh
+```
+
+## Contributing
+
+We welcome community contributions! If you have samples, templates, or tools that would help others deploy and manage SRE Agents, please feel free to contribute.
+
+### Guidelines for New Samples
+- Include comprehensive documentation
+- Provide example configurations
+- Follow Azure best practices
+- Include proper error handling
+- Test thoroughly before submitting
+
+## Support
+
+For issues specific to these samples, please open a GitHub issue in this repository. For SRE Agent product support, please use the appropriate Azure support channels.

samples/bicep-deployment/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Azure SRE Agent Bicep Deployment
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

samples/bicep-deployment/README.md

@@ -0,0 +1,176 @@
+# SRE Agent Bicep Deployment
+
+This Bicep deployment allows you to deploy an SRE Agent with configurable subscription, resource group targeting, and role assignments across multiple resource groups.
+
+## New Features
+
+1. **Subscription Targeting**: Specify the subscription where the SRE Agent should be deployed
+2. **Custom Resource Group**: Deploy the SRE Agent to any resource group 
+3. **Multi-Resource Group Access**: Grant the SRE Agent permissions across multiple resource groups
+4. **Cross-Subscription Support**: Target resource groups across different subscriptions
+
+## Files Structure
+
+- `minimal-sre-agent.bicep` - Main template (subscription-scoped)
+- `sre-agent-resources.bicep` - Resource group-scoped module containing all resources
+- `role-assignments-minimal.bicep` - Role assignments for the deployment resource group
+- `role-assignments-target.bicep` - Role assignments for target resource groups
+- `minimal-sre-agent.parameters.json` - Example parameters file
+- `deploy.sh` - Interactive deployment script with command-line interface
+
+## Parameters
+
+### Required Parameters
+- `agentName`: Name of the SRE Agent
+- `deploymentResourceGroupName`: Resource group where SRE Agent will be deployed
+
+### Optional Parameters
+- `subscriptionId`: Target subscription (defaults to current subscription)
+- `location`: Azure region (default: eastus2)
+- `existingManagedIdentityId`: Use existing managed identity instead of creating new one
+- `accessLevel`: High or Low access level (default: High)
+- `agentMode`: Review, Autonomous, or ReadOnly (default: Review)
+- `targetResourceGroups`: Array of resource group names to grant access to
+- `targetSubscriptions`: Array of subscription IDs for target resource groups
+
+## Deployment Methods
+
+### Quick Start: Deploy Without Target Resource Groups
+
+If you want to deploy just the SRE Agent infrastructure without assigning it to any target resource groups:
+
+```bash
+# Interactive mode - leave target RGs empty
+./deploy.sh
+
+# Or use the no-targets config file
+./deploy.sh --config sre-agent-no-targets.config
+
+# Or command line mode
+./deploy.sh --no-interactive \
+  -s "your-subscription-id" \
+  -r "rg-sre-agent" \
+  -n "my-sre-agent" \
+  --yes
+```
+
+See [DEPLOY-NO-TARGETS.md](DEPLOY-NO-TARGETS.md) for complete details on standalone deployment.
+
+### Method 1: Using Azure CLI with Parameters File
+
+1. Update `minimal-sre-agent.parameters.json` with your values:
+```json
+{
+  "parameters": {
+    "agentName": { "value": "my-sre-agent" },
+    "subscriptionId": { "value": "12345678-1234-1234-1234-123456789012" },
+    "deploymentResourceGroupName": { "value": "rg-sre-agent" },
+    "targetResourceGroups": { 
+      "value": ["rg-production-web", "rg-production-data"] 
+    }
+  }
+}
+```
+
+2. Deploy:
+```bash
+az deployment sub create \
+  --subscription "12345678-1234-1234-1234-123456789012" \
+  --location "eastus2" \
+  --template-file minimal-sre-agent.bicep \
+  --parameters @minimal-sre-agent.parameters.json
+```
+
+### Method 2: Using the Deployment Script
+
+Make the script executable and run:
+```bash
+chmod +x deploy.sh
+./deploy.sh -s "12345678-1234-1234-1234-123456789012" \
+           -r "rg-sre-agent" \
+           -n "my-sre-agent" \
+           -l "eastus2" \
+           -a "High" \
+           -m "Review" \
+           -t "rg-prod-web,rg-prod-data,rg-staging"
+```
+
+### Method 3: Direct Azure CLI with Inline Parameters
+
+```bash
+az deployment sub create \
+  --subscription "12345678-1234-1234-1234-123456789012" \
+  --location "eastus2" \
+  --template-file minimal-sre-agent.bicep \
+  --parameters \
+    agentName="my-sre-agent" \
+    subscriptionId="12345678-1234-1234-1234-123456789012" \
+    deploymentResourceGroupName="rg-sre-agent" \
+    location="eastus2" \
+    accessLevel="High" \
+    agentMode="Review" \
+    targetResourceGroups='["rg-prod-web","rg-prod-data"]'
+```
+
+## Access Levels
+
+### Low Access Level
+- Log Analytics Reader
+- Reader
+
+### High Access Level  
+- Log Analytics Reader
+- Reader
+- Contributor
+
+## Cross-Subscription Targeting
+
+To target resource groups in different subscriptions, provide both `targetResourceGroups` and `targetSubscriptions` arrays:
+
+```json
+{
+  "targetResourceGroups": {
+    "value": ["rg-prod-web", "rg-prod-data", "rg-staging"]
+  },
+  "targetSubscriptions": {
+    "value": [
+      "12345678-1234-1234-1234-123456789012",
+      "12345678-1234-1234-1234-123456789012", 
+      "87654321-4321-4321-4321-210987654321"
+    ]
+  }
+}
+```
+
+The arrays are matched by index - the first resource group uses the first subscription, etc.
+
+## Outputs
+
+The template provides these outputs:
+- `agentName`: Name of the created SRE Agent
+- `agentId`: Resource ID of the SRE Agent
+- `agentPortalUrl`: Direct link to manage the agent in Azure Portal
+- `userAssignedIdentityId`: Resource ID of the managed identity
+- `applicationInsightsConnectionString`: Connection string for Application Insights
+- `logAnalyticsWorkspaceId`: Resource ID of the Log Analytics workspace
+- `createdNewManagedIdentity`: Boolean indicating if a new managed identity was created
+
+## Prerequisites
+
+- Azure CLI installed and authenticated
+- Appropriate permissions to create resources and assign roles
+- Owner or User Access Administrator role on target subscriptions/resource groups
+- SRE Agent resource provider registered in target subscriptions
+
+## Troubleshooting
+
+### Permission Issues
+Ensure you have:
+- Owner or Contributor + User Access Administrator roles
+- Permission to create role assignments across target resource groups
+- Permission to create resources in the deployment resource group
+
+### Cross-Subscription Scenarios
+- Ensure you have permissions in all target subscriptions
+- Verify resource group names exist in their respective subscriptions
+- Check that the SRE Agent resource provider is available in target regions

samples/bicep-deployment/bicep/minimal-sre-agent.bicep

@@ -0,0 +1,62 @@
+targetScope = 'subscription'
+
+#disable-next-line BCP081
+@description('The name of the SRE Agent')
+param agentName string
+
+@description('The subscription ID where resources will be deployed')
+param subscriptionId string = subscription().subscriptionId
+
+@description('The name of the resource group where the SRE Agent will be deployed')
+param deploymentResourceGroupName string
+
+@description('The location where the resources will be deployed')
+@allowed(['swedencentral', 'uksouth', 'eastus2', 'australiaeast'])
+param location string = 'eastus2'
+
+@description('Optional: The resource ID of an existing user-assigned managed identity. If not provided, a new one will be created.')
+param existingManagedIdentityId string = ''
+
+@description('The access level for the SRE Agent')
+@allowed(['High', 'Low'])
+param accessLevel string = 'High'
+
+@description('Array of resource group names that the SRE Agent should have permissions to manage')
+param targetResourceGroups array = []
+
+@description('Array of subscription IDs where the target resource groups exist (optional, defaults to deployment subscription)')
+param targetSubscriptions array = []
+
+// Generate unique suffix for resource names
+var uniqueSuffix = uniqueString(subscriptionId, deploymentResourceGroupName)
+
+// Reference to the deployment resource group
+resource deploymentResourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' existing = {
+  name: deploymentResourceGroupName
+  scope: subscription(subscriptionId)
+}
+
+// Deploy SRE Agent resources to the deployment resource group
+module sreAgentResourcesDeployment 'sre-agent-resources.bicep' = {
+  name: 'sre-agent-resources-${uniqueString(deployment().name)}'
+  scope: deploymentResourceGroup
+  params: {
+    agentName: agentName
+    location: location
+    existingManagedIdentityId: existingManagedIdentityId
+    accessLevel: accessLevel
+    targetResourceGroups: targetResourceGroups
+    targetSubscriptions: targetSubscriptions
+    subscriptionId: subscriptionId
+    uniqueSuffix: uniqueSuffix
+  }
+}
+
+// Outputs
+output agentName string = sreAgentResourcesDeployment.outputs.agentName
+output agentId string = sreAgentResourcesDeployment.outputs.agentId
+output agentPortalUrl string = sreAgentResourcesDeployment.outputs.agentPortalUrl
+output userAssignedIdentityId string = sreAgentResourcesDeployment.outputs.userAssignedIdentityId
+output applicationInsightsConnectionString string = sreAgentResourcesDeployment.outputs.applicationInsightsConnectionString
+output logAnalyticsWorkspaceId string = sreAgentResourcesDeployment.outputs.logAnalyticsWorkspaceId
+output createdNewManagedIdentity bool = sreAgentResourcesDeployment.outputs.createdNewManagedIdentity

samples/bicep-deployment/bicep/role-assignments-minimal.bicep

@@ -0,0 +1,80 @@
+@description('The principal ID of the user-assigned managed identity')
+param userAssignedIdentityPrincipalId string
+
+@description('The principal ID of the system-assigned managed identity (optional)')
+param systemAssignedIdentityPrincipalId string = ''
+
+@description('The access level for role assignments')
+@allowed(['Low', 'Medium', 'High'])
+param accessLevel string
+
+@description('Enable Key Vault role assignments')
+param enableKeyVault bool = true
+
+@description('Key Vault resource ID for scoped role assignments (optional)')
+param keyVaultResourceId string = ''
+
+// Define role definition IDs based on the access level
+var roleDefinitions = {
+  Low: [
+    '92aaf0da-9dab-42b6-94a3-d43ce8d16293' // Log Analytics Reader
+  ]
+  Medium: [
+    '92aaf0da-9dab-42b6-94a3-d43ce8d16293' // Log Analytics Reader
+    'acdd72a7-3385-48ef-bd42-f606fba81ae7' // Reader
+  ]
+  High: [
+    '92aaf0da-9dab-42b6-94a3-d43ce8d16293' // Log Analytics Reader
+    'acdd72a7-3385-48ef-bd42-f606fba81ae7' // Reader
+    'b24988ac-6180-42a0-ab88-20f7382dd24c' // Contributor
+  ]
+}
+
+// Create role assignments based on access level for user-assigned identity
+resource roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for (roleDefinitionId, index) in roleDefinitions[accessLevel]: {
+  name: guid(resourceGroup().id, userAssignedIdentityPrincipalId, roleDefinitionId)
+  properties: {
+    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionId)
+    principalId: userAssignedIdentityPrincipalId
+    principalType: 'ServicePrincipal'
+  }
+}]
+
+// Create Application Insights Component Contributor role assignment for system-assigned identity (if provided)
+// Note: This creates the role assignment at the resource group level for now
+resource appInsightsRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(systemAssignedIdentityPrincipalId)) {
+  name: guid(resourceGroup().id, systemAssignedIdentityPrincipalId, 'ae349356-3a1b-4a5e-921d-050484c6347e')
+  properties: {
+    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e') // Application Insights Component Contributor
+    principalId: systemAssignedIdentityPrincipalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Create Key Vault role assignments for the user-assigned identity (if Key Vault is enabled)
+// Key Vault Certificate User role
+resource keyVaultCertificateUserRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableKeyVault && !empty(keyVaultResourceId)) {
+  name: guid(keyVaultResourceId, userAssignedIdentityPrincipalId, 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')
+  scope: resourceGroup()
+  properties: {
+    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba') // Key Vault Certificate User
+    principalId: userAssignedIdentityPrincipalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Key Vault Secrets User role
+resource keyVaultSecretsUserRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableKeyVault && !empty(keyVaultResourceId)) {
+  name: guid(keyVaultResourceId, userAssignedIdentityPrincipalId, '4633458b-17de-408a-b874-0445c86b69e6')
+  scope: resourceGroup()
+  properties: {
+    roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6') // Key Vault Secrets User
+    principalId: userAssignedIdentityPrincipalId
+    principalType: 'ServicePrincipal'
+  }
+}
+
+output assignedRoles array = [for (roleDefinitionId, index) in roleDefinitions[accessLevel]: {
+  roleDefinitionId: roleDefinitionId
+  principalId: userAssignedIdentityPrincipalId
+}]