data/template/template.json
|
{ "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "input": { "type": "object" }, "_artifactsLocation": { "type": "string", "defaultValue": "https://raw.githubusercontent.com/Azure/AzOps/main/src/data/template/template.json", "metadata": { "description": "This is the link to the nested template that must to be accessible to ARM to be able to use as a part of nested deployment. Please feel free to use template hosted here or override with choice of your location. If you chose to do so, please ensure future bug fixes are incorporated from above location to your private location." } }, "_artifactsLocationSasToken": { "type": "string", "defaultValue": "" }, "roleAssignmentEnabledForPolicy": { "type": "bool", "defaultValue": true }, "deploymentEnabledForPolicy": { "type": "bool", "defaultValue": true }, "remediationEnabledForPolicy": { "type": "bool", "defaultValue": false }, "debug": { "type": "bool", "defaultValue": true } }, "variables": { "debug": "[parameters('debug')]", "roleAssignmentEnabledForPolicy": "[parameters('roleAssignmentEnabledForPolicy')]", "deploymentEnabledForPolicy": "[parameters('deploymentEnabledForPolicy')]", "remediationEnabledForPolicy": "[parameters('remediationEnabledForPolicy')]", "input": "[parameters('input')]", "resourceType": "[if( and(contains(parameters('input'), 'ResourceType'),not(empty(parameters('input').ResourceType))), parameters('input').ResourceType, json('null') )]", "ExtensionResourceType": "[if( and(contains(parameters('input'), 'ExtensionResourceType'),not(empty(parameters('input').ExtensionResourceType))), parameters('input').ExtensionResourceType, json('null') )]", "type": "[if( and(contains(parameters('input'), 'type'),not(empty(parameters('input').type))), parameters('input').type, json('null') )]", "effectiveResourceType": "[coalesce( variables('ExtensionResourceType'), variables('ResourceType'), variables('type') )]", "identity": "[if( and( contains(variables('input'),'identity'), not(empty(variables('input').identity)) ), variables('input').identity, json('null') )]", "location": "[if( and( contains(variables('input'),'Location'), not(empty(variables('input').location)) ), variables('input').location, deployment().location )]", "tags": "[if( and( contains(variables('input'),'tags'), not(empty(variables('input').tags)) ), variables('input').tags, json('null') )]", "apiVersionLookup": { "Microsoft.Resources/resourceGroups":"2023-07-01", "Microsoft.Authorization/policyAssignments": "2023-04-01", "Microsoft.Authorization/policyDefinitions": "2023-04-01", "Microsoft.Authorization/policySetDefinitions": "2023-04-01", "Microsoft.Authorization/roleDefinitions": "2022-04-01", "Microsoft.Authorization/roleAssignments": "2022-04-01", "Microsoft.PolicyInsights/remediations": "2021-10-01", "Microsoft.ContainerService/managedClusters": "2024-02-01", "Microsoft.KeyVault/vaults":"2023-07-01", "Microsoft.Network/virtualWans": "2020-05-01", "Microsoft.Network/virtualHubs": "2020-05-01", "Microsoft.Network/virtualNetworks": "2020-06-01", "Microsoft.Network/azureFirewalls": "2020-06-01", "/providers/Microsoft.Management/managementGroups": "2023-04-01", "/subscriptions": "2021-10-01", "na": "9999-99-99", "": "0000-00-00" }, "apiVersion": "[if(empty(variables('effectiveResourceType')),variables('apiVersionLookup')[''], variables('apiVersionLookup')[variables('effectiveResourceType')])]" }, "resources": [ { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Resources/resourceGroups'))]", "type": "Microsoft.Resources/resourceGroups", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[variables('location')]", "tags": "[variables('tags')]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Authorization/policyDefinitions'))]", "type": "Microsoft.Authorization/policyDefinitions", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Authorization/policySetDefinitions'))]", "type": "Microsoft.Authorization/policySetDefinitions", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Authorization/policyAssignments'))]", "type": "Microsoft.Authorization/policyAssignments", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "identity": "[variables('identity')]", "location": "[variables('location')]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Authorization/roleDefinitions'))]", "type": "Microsoft.Authorization/roleDefinitions", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[and( variables('roleAssignmentEnabledForPolicy'), equals( toLower(variables('effectiveResourceType')), toLower('Microsoft.Authorization/policyAssignments') ), contains(variables('input'),'Identity'), not(empty(variables('input').Identity)) )]", "type": "Microsoft.Authorization/roleAssignments", "name": "[guid(variables('input').name)]", "apiVersion": "2019-04-01-preview", "location": "[deployment().location]", "Properties": { "principalType": "ServicePrincipal", //"roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", "roleDefinitionId": "[ if( and( variables('roleAssignmentEnabledForPolicy'), equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Authorization/policyAssignments')), and( contains(reference(variables('input').Properties.policyDefinitionId,'2019-06-01'), 'policyRule'), contains(reference(variables('input').Properties.policyDefinitionId,'2019-06-01').policyRule, 'then'), contains(reference(variables('input').Properties.policyDefinitionId,'2019-06-01').policyRule.then.details, 'roleDefinitionIds') ) ), reference(variables('input').Properties.policyDefinitionId,'2019-06-01').policyRule.then.details.roleDefinitionIds[0], 'na' )]", "principalId": "[ if( and( variables('roleAssignmentEnabledForPolicy'), equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Authorization/policyAssignments')), contains(reference(concat('Microsoft.Authorization/policyAssignments/' , variables('input').name), '2018-05-01', 'Full'),'identity') ), reference(concat('Microsoft.Authorization/policyAssignments/' , variables('input').name), '2018-05-01', 'Full').identity.principalId, 'na' )]" } }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Authorization/roleAssignments'))]", "type": "Microsoft.Authorization/roleAssignments", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.PolicyInsights/remediations'))]", "type": "Microsoft.PolicyInsights/remediations", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Network/virtualWans'))]", "type": "Microsoft.Network/virtualWans", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Network/virtualHubs'))]", "type": "Microsoft.Network/virtualHubs", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.Network/azureFirewalls'))]", "type": "Microsoft.Network/azureFirewalls", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { "condition": "[equals(toLower(variables('effectiveResourceType')),toLower('Microsoft.KeyVault/vaults'))]", "type": "Microsoft.KeyVault/vaults", "name": "[variables('input').name]", "apiVersion": "[variables('apiversion')]", "location": "[deployment().location]", "Properties": "[variables('input').Properties]" }, { /* Intent: Upsert Management Group Required Parameters: 1. Name: Management Group Name 2. DisplayName: Management Group Display Name 3. ParentID - To determine where to place Management Group. It could be root or any other valid ID of the Management Group. For the top level manage 4. Id - ResourceID of the management group '/providers/Microsoft.Management/managementGroups/<name>' Scope: Tenant root Condition: We have Parent ID available to ensure inadvertently place Management Group directly the root. Details: If ParentID do not exist, then it is a child and creation of Management Group would have happened when parent's children were iterated upon. Change Log: 1. Initial Definition */ "condition": "[contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups'))]", "type": "Microsoft.Management/managementGroups", "apiVersion": "2020-05-01", "name": "[parameters('input').Name]", "scope": "/", "properties": { "displayName": "[parameters('input').DisplayName]", "details": "[if( and(contains(parameters('input'), 'ParentId'), not(empty(parameters('input').ParentId)) ), json(concat('{\"parent\": {\"id\": \"', replace(parameters('input').ParentId,'/','\/') ,'\"}}')), json('{}') )]" } }, { /* Intent: Upsert Management Group Children Required Parameters: 1. Name: Management Group Name 2. DisplayName: Management Group Display Name 3. ParentID - To determine where to place Management Group. It could be root or any other valid ID of the Management Group. For the top level manage Scope: Tenant root Condition: If Children property bag not null or empty. Change Log: 1. Initial Definition */ "condition": "[and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(parameters('input'), 'children'), not(empty(parameters('input').children)) )]", "dependsOn": [ "[parameters('input').Name]" ], "copy": { "name": "create-mg-child", "count": "[length( if( and(contains(parameters('input'), 'Children'),not(empty(parameters('input').Children))), parameters('input').Children, json('[]') ) )]" }, /* Note: Disabling scoped deployment for child management group due to validation API error. Issue: Validation API throws an error for nested deployment for the scope that is yet to be created. "scope": "[concat('Microsoft.Management/managementGroups/',parameters('input').name)]", */ "type": "Microsoft.Resources/deployments", "apiVersion": "2023-07-01", "location": "[deployment().location]", "name": "[if( and(contains(parameters('input'), 'children'),not(empty(parameters('input').children))), if( greaterOrEquals(length(concat(parameters('input').Name,'-',parameters('input').children[copyIndex()].Name)),63), take(concat(parameters('input').Name,'-',parameters('input').children[copyIndex()].Name),63), concat(parameters('input').Name,'-',parameters('input').children[copyIndex()].Name) ), 'create-mg-child-na' )]", "properties": { "mode": "Incremental", "templateLink": { "uri": "[uri(parameters('_artifactsLocation'), concat('template.json', parameters('_artifactsLocationSasToken')))]", "contentVersion": "1.0.0.0" }, "parameters": { "input": { "value": { "Name": "[parameters('input').children[copyIndex()].Name]", "DisplayName": "[parameters('input').children[copyIndex()].DisplayName]", "Id": "[parameters('input').children[copyIndex()].Id]", "ParentId": "[parameters('input').Id]", "Type": "[parameters('input').children[copyIndex()].Type]", "Children": "[if(and(contains(parameters('input').children[copyIndex()], 'Children'),not(empty(parameters('input').children[copyIndex()].Children))),parameters('input').children[copyIndex()].Children,json('[]'))]", "properties": "[if( and( contains(parameters('input').children[copyIndex()], 'properties'), not(empty(parameters('input').children[copyIndex()].properties)) ), parameters('input').children[copyIndex()].properties, json('{}') )]" } }, "_artifactsLocation": { "value": "[parameters('_artifactsLocation')]" }, "_artifactsLocationSasToken": { "value": "[parameters('_artifactsLocationSasToken')]" }, "roleAssignmentEnabledForPolicy": { "value": "[variables('roleAssignmentEnabledForPolicy')]" }, "deploymentEnabledForPolicy": { "value": "[variables('deploymentEnabledForPolicy')]" }, "remediationEnabledForPolicy": { "value": "[variables('remediationEnabledForPolicy')]" } } } }, { /* Intent: Create Nested Deployment for properties.policyDefinitions Required Parameters: 1. Name: Management Group Name 3. Properties.policyDefinitions[] Scope: Management Group Condition: If properties.policyDefinitions[] not null or empty. Change Log: 1. Initial Definition */ "condition": "[and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyDefinitions'), not(empty(variables('input').Properties.policyDefinitions)) )]", "dependsOn": [ "[variables('input').Name]" ], "copy": { "name": "copy-properties-policyDefinitions", "count": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyDefinitions'), not(empty(variables('input').Properties.policyDefinitions)) ), length(variables('input').Properties.policyDefinitions), 0) ]" }, "scope": "[concat('Microsoft.Management/managementGroups/',parameters('input').name)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2023-07-01", "location": "[deployment().location]", "name": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyDefinitions'), not(empty(variables('input').Properties.policyDefinitions)) ), if( greaterOrEquals(length(concat('PolicyDefinition-', parameters('input').properties.policyDefinitions[copyIndex()].Name)),63), take(concat('PolicyDefinition-', parameters('input').properties.policyDefinitions[copyIndex()].Name),63), concat('PolicyDefinition-', parameters('input').properties.policyDefinitions[copyIndex()].Name) ), 'PolicyDefinition-na' )]", "properties": { "mode": "Incremental", "templateLink": { "uri": "[uri(parameters('_artifactsLocation'), concat('template.json', parameters('_artifactsLocationSasToken')))]", "contentVersion": "1.0.0.0" }, "parameters": { "input": { "value": "[ if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyDefinitions'), not(empty(variables('input').Properties.policyDefinitions)) ), parameters('input').properties.policyDefinitions[copyIndex()], json('[]') )]" }, "_artifactsLocation": { "value": "[parameters('_artifactsLocation')]" }, "_artifactsLocationSasToken": { "value": "[parameters('_artifactsLocationSasToken')]" }, "roleAssignmentEnabledForPolicy": { "value": "[variables('roleAssignmentEnabledForPolicy')]" }, "deploymentEnabledForPolicy": { "value": "[variables('deploymentEnabledForPolicy')]" }, "remediationEnabledForPolicy": { "value": "[variables('remediationEnabledForPolicy')]" } } } }, { /* Intent: Create Nested Deployment for properties.policySetDefinitions Required Parameters: 1. Name: Management Group Name 3. Properties.policySetDefinitions[] Scope: Management Group Condition: If properties.policySetDefinitions[] not null or empty. Change Log: 1. Initial Definition */ "condition": "[and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policySetDefinitions'), not(empty(variables('input').Properties.policySetDefinitions)) )]", "dependsOn": [ "[variables('input').Name]", "copy-properties-policyDefinitions" ], "copy": { "name": "copy-properties-policySetDefinitions", "count": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policySetDefinitions'), not(empty(variables('input').Properties.policySetDefinitions)) ), length(variables('input').Properties.policySetDefinitions), 0) ]" }, "scope": "[concat('Microsoft.Management/managementGroups/',parameters('input').name)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2023-07-01", "location": "[deployment().location]", "name": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policySetDefinitions'), not(empty(variables('input').Properties.policySetDefinitions)) ), if( greaterOrEquals(length(concat('policySetDefinitions-', parameters('input').properties.policySetDefinitions[copyIndex()].Name)),63), take(concat('policySetDefinitions-', parameters('input').properties.policySetDefinitions[copyIndex()].Name),63), concat('policySetDefinitions-', parameters('input').properties.policySetDefinitions[copyIndex()].Name) ), 'policySetDefinitions-na' )]", "properties": { "mode": "Incremental", "templateLink": { "uri": "[uri(parameters('_artifactsLocation'), concat('template.json', parameters('_artifactsLocationSasToken')))]", "contentVersion": "1.0.0.0" }, "parameters": { "input": { "value": "[ if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policySetDefinitions'), not(empty(variables('input').Properties.policySetDefinitions)) ), parameters('input').properties.policySetDefinitions[copyIndex()], json('[]') )]" }, "_artifactsLocation": { "value": "[parameters('_artifactsLocation')]" }, "_artifactsLocationSasToken": { "value": "[parameters('_artifactsLocationSasToken')]" }, "roleAssignmentEnabledForPolicy": { "value": "[variables('roleAssignmentEnabledForPolicy')]" }, "deploymentEnabledForPolicy": { "value": "[variables('deploymentEnabledForPolicy')]" }, "remediationEnabledForPolicy": { "value": "[variables('remediationEnabledForPolicy')]" } } } }, { /* Intent: Create Nested Deployment for properties.policyAssignments Required Parameters: 1. Name: Management Group Name 3. Properties.policyAssignments[] Scope: Management Group Condition: If properties.policyAssignments[] not null or empty. Change Log: 1. Initial Definition */ "condition": "[and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyAssignments'), not(empty(variables('input').Properties.policyAssignments)) )]", "dependsOn": [ "[variables('input').Name]", "copy-properties-policyDefinitions", "copy-properties-policySetDefinitions" ], "copy": { "name": "copy-properties-policyAssignments", "count": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyAssignments'), not(empty(variables('input').Properties.policyAssignments)) ), length(variables('input').Properties.policyAssignments), 0) ]" }, "scope": "[concat('Microsoft.Management/managementGroups/',parameters('input').name)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2023-07-01", "location": "[deployment().location]", "name": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyAssignments'), not(empty(variables('input').Properties.policyAssignments)) ), if( greaterOrEquals(length(concat('PolicyAssignments-', parameters('input').properties.policyAssignments[copyIndex()].Name)),63), take(concat('PolicyAssignments-', parameters('input').properties.policyAssignments[copyIndex()].Name),63), concat('PolicyAssignments-', parameters('input').properties.policyAssignments[copyIndex()].Name) ), 'PolicyAssignments-na' )]", "properties": { "mode": "Incremental", "templateLink": { "uri": "[uri(parameters('_artifactsLocation'), concat('template.json', parameters('_artifactsLocationSasToken')))]", "contentVersion": "1.0.0.0" }, "parameters": { "input": { "value": "[ if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'policyAssignments'), not(empty(variables('input').Properties.policyAssignments)) ), parameters('input').properties.policyAssignments[copyIndex()], json('[]') )]" }, "_artifactsLocation": { "value": "[parameters('_artifactsLocation')]" }, "_artifactsLocationSasToken": { "value": "[parameters('_artifactsLocationSasToken')]" }, "roleAssignmentEnabledForPolicy": { "value": "[variables('roleAssignmentEnabledForPolicy')]" }, "deploymentEnabledForPolicy": { "value": "[variables('deploymentEnabledForPolicy')]" }, "remediationEnabledForPolicy": { "value": "[variables('remediationEnabledForPolicy')]" } } } }, { /* Intent: Create Nested Deployment for properties.roleDefinitions Required Parameters: 1. Name: Management Group Name 3. Properties.roleDefinitions[] Scope: Management Group Condition: If properties.roleDefinitions[] not null or empty. Change Log: 1. Initial Definition */ "condition": "[and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleDefinitions'), not(empty(variables('input').Properties.roleDefinitions)) )]", "dependsOn": [ "[variables('input').Name]" ], "copy": { "name": "copy-properties-roleDefinitions", "count": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleDefinitions'), not(empty(variables('input').Properties.roleDefinitions)) ), length(variables('input').Properties.roleDefinitions), 0) ]" }, "scope": "[concat('Microsoft.Management/managementGroups/',parameters('input').name)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2023-07-01", "location": "[deployment().location]", "name": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleDefinitions'), not(empty(variables('input').Properties.roleDefinitions)) ), if( greaterOrEquals(length(concat('RoleDefinitions-', parameters('input').properties.roleDefinitions[copyIndex()].Name)),63), take(concat('RoleDefinitions-', parameters('input').properties.roleDefinitions[copyIndex()].Name),63), concat('RoleDefinitions-', parameters('input').properties.roleDefinitions[copyIndex()].Name) ), 'RoleDefinitions-na' )]", "properties": { "mode": "Incremental", "templateLink": { "uri": "[uri(parameters('_artifactsLocation'), concat('template.json', parameters('_artifactsLocationSasToken')))]", "contentVersion": "1.0.0.0" }, "parameters": { "input": { "value": "[ if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleDefinitions'), not(empty(variables('input').Properties.roleDefinitions)) ), parameters('input').properties.roleDefinitions[copyIndex()], json('[]') )]" }, "_artifactsLocation": { "value": "[parameters('_artifactsLocation')]" }, "_artifactsLocationSasToken": { "value": "[parameters('_artifactsLocationSasToken')]" }, "roleAssignmentEnabledForPolicy": { "value": "[variables('roleAssignmentEnabledForPolicy')]" }, "deploymentEnabledForPolicy": { "value": "[variables('deploymentEnabledForPolicy')]" }, "remediationEnabledForPolicy": { "value": "[variables('remediationEnabledForPolicy')]" } } } }, { /* Intent: Create Nested Deployment for properties.roleAssignments Required Parameters: 1. Name: Management Group Name 3. Properties.roleAssignments[] Scope: Management Group Condition: If properties.roleAssignments[] not null or empty. Change Log: 1. Initial Definition */ "condition": "[and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleAssignments'), not(empty(variables('input').Properties.roleAssignments)) )]", "dependsOn": [ "[variables('input').Name]" ], "copy": { "name": "copy-properties-roleAssignments", "count": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleAssignments'), not(empty(variables('input').Properties.roleAssignments)) ), length(variables('input').Properties.roleAssignments), 0) ]" }, "scope": "[concat('Microsoft.Management/managementGroups/',parameters('input').name)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2023-07-01", "location": "[deployment().location]", "name": "[if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleAssignments'), not(empty(variables('input').Properties.roleAssignments)) ), if( greaterOrEquals(length(concat('RoleAssignments-', parameters('input').properties.roleAssignments[copyIndex()].Name)),63), take(concat('RoleAssignments-', parameters('input').properties.roleAssignments[copyIndex()].Name),63), concat('RoleAssignments-', parameters('input').properties.roleAssignments[copyIndex()].Name) ), 'RoleAssignments-na' )]", "properties": { "mode": "Incremental", "templateLink": { "uri": "[uri(parameters('_artifactsLocation'), concat('template.json', parameters('_artifactsLocationSasToken')))]", "contentVersion": "1.0.0.0" }, "parameters": { "input": { "value": "[ if( and( contains(tolower(variables('effectiveResourceType')),toLower('Microsoft.Management/managementGroups')), contains(variables('input'),'Properties'), not(empty(variables('input').Properties)), contains(variables('input').Properties, 'roleAssignments'), not(empty(variables('input').Properties.roleAssignments)) ), parameters('input').properties.roleAssignments[copyIndex()], json('[]') )]" }, "_artifactsLocation": { "value": "[parameters('_artifactsLocation')]" }, "_artifactsLocationSasToken": { "value": "[parameters('_artifactsLocationSasToken')]" }, "roleAssignmentEnabledForPolicy": { "value": "[variables('roleAssignmentEnabledForPolicy')]" }, "deploymentEnabledForPolicy": { "value": "[variables('deploymentEnabledForPolicy')]" }, "remediationEnabledForPolicy": { "value": "[variables('remediationEnabledForPolicy')]" } } } } ], "outputs": { "hobo": { "condition": "[and(variables('debug'),bool('false'))]", "type": "object", "value": "[variables('input')]" }, "effectiveResourceType": { "condition": "[variables('debug')]", "type": "string", "value": "[variables('effectiveResourceType')]" }, "apiversion": { "condition": "[variables('debug')]", "type": "string", "value": "[if( empty(variables('effectiveResourceType')), variables('apiVersionLookup')[''], variables('apiVersionLookup')[variables('effectiveResourceType')] )]" }, "templateLocation": { "condition": "[variables('debug')]", "type": "string", "value": "[uri(parameters('_artifactsLocation'), concat('template.json', parameters('_artifactsLocationSasToken')))]" } } } |