diff --git a/avm/res/insights/component/README.md b/avm/res/insights/component/README.md index 34482070ba..cbae0e0677 100644 --- a/avm/res/insights/component/README.md +++ b/avm/res/insights/component/README.md @@ -15,6 +15,7 @@ This component deploys an Application Insights instance. | Resource Type | API Version | | :-- | :-- | +| `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) | | `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) | | `Microsoft.Insights/components` | [2020-02-02](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Insights/2020-02-02/components) | | `microsoft.insights/components/linkedStorageAccounts` | [2020-03-01-preview](https://learn.microsoft.com/en-us/azure/templates/microsoft.insights/2020-03-01-preview/components/linkedStorageAccounts) | @@ -137,6 +138,10 @@ module component 'br/public:avm/res/insights/component:' = { forceCustomerStorageForProfiler: true linkedStorageAccountResourceId: '' location: '' + lock: { + kind: 'CanNotDelete' + name: 'myCustomLockName' + } roleAssignments: [ { name: '8aacced3-3fce-41bc-a416-959df1acec57' @@ -216,6 +221,12 @@ module component 'br/public:avm/res/insights/component:' = { "location": { "value": "" }, + "lock": { + "value": { + "kind": "CanNotDelete", + "name": "myCustomLockName" + } + }, "roleAssignments": { "value": [ { @@ -281,6 +292,10 @@ param disableLocalAuth = true param forceCustomerStorageForProfiler = true param linkedStorageAccountResourceId = '' param location = '' +param lock = { + kind: 'CanNotDelete' + name: 'myCustomLockName' +} param roleAssignments = [ { name: '8aacced3-3fce-41bc-a416-959df1acec57' @@ -462,6 +477,7 @@ param tags = { | [`kind`](#parameter-kind) | string | The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone. | | [`linkedStorageAccountResourceId`](#parameter-linkedstorageaccountresourceid) | string | Linked storage account resource ID. | | [`location`](#parameter-location) | string | Location for all Resources. | +| [`lock`](#parameter-lock) | object | The lock settings of the service. | | [`publicNetworkAccessForIngestion`](#parameter-publicnetworkaccessforingestion) | string | The network access type for accessing Application Insights ingestion. - Enabled or Disabled. | | [`publicNetworkAccessForQuery`](#parameter-publicnetworkaccessforquery) | string | The network access type for accessing Application Insights query. - Enabled or Disabled. | | [`retentionInDays`](#parameter-retentionindays) | int | Retention period in days. | @@ -699,6 +715,42 @@ Location for all Resources. - Type: string - Default: `[resourceGroup().location]` +### Parameter: `lock` + +The lock settings of the service. + +- Required: No +- Type: object + +**Optional parameters** + +| Parameter | Type | Description | +| :-- | :-- | :-- | +| [`kind`](#parameter-lockkind) | string | Specify the type of lock. | +| [`name`](#parameter-lockname) | string | Specify the name of lock. | + +### Parameter: `lock.kind` + +Specify the type of lock. + +- Required: No +- Type: string +- Allowed: + ```Bicep + [ + 'CanNotDelete' + 'None' + 'ReadOnly' + ] + ``` + +### Parameter: `lock.name` + +Specify the name of lock. + +- Required: No +- Type: string + ### Parameter: `publicNetworkAccessForIngestion` The network access type for accessing Application Insights ingestion. - Enabled or Disabled. @@ -896,6 +948,7 @@ This section gives you an overview of all local-referenced module files (i.e., o | Reference | Type | | :-- | :-- | | `br/public:avm/utl/types/avm-common-types:0.3.0` | Remote reference | +| `br/public:avm/utl/types/avm-common-types:0.5.1` | Remote reference | ## Data Collection diff --git a/avm/res/insights/component/main.bicep b/avm/res/insights/component/main.bicep index 5e760baa36..c5e52fe4d2 100644 --- a/avm/res/insights/component/main.bicep +++ b/avm/res/insights/component/main.bicep @@ -65,6 +65,10 @@ param kind string = '' @description('Optional. Location for all Resources.') param location string = resourceGroup().location +import { lockType } from 'br/public:avm/utl/types/avm-common-types:0.5.1' +@description('Optional. The lock settings of the service.') +param lock lockType? + import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.3.0' @description('Optional. Array of role assignments to create.') param roleAssignments roleAssignmentType[]? @@ -181,6 +185,17 @@ resource appInsights_roleAssignments 'Microsoft.Authorization/roleAssignments@20 } ] +resource appInsights_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') { + name: lock.?name ?? 'lock-${name}' + properties: { + level: lock.?kind ?? '' + notes: lock.?kind == 'CanNotDelete' + ? 'Cannot delete resource or child resources.' + : 'Cannot delete or modify the resource or child resources.' + } + scope: appInsights +} + resource appInsights_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [ for (diagnosticSetting, index) in (diagnosticSettings ?? []): { name: diagnosticSetting.?name ?? '${name}-diagnosticSettings' diff --git a/avm/res/insights/component/main.json b/avm/res/insights/component/main.json index db31f8df44..677006001c 100644 --- a/avm/res/insights/component/main.json +++ b/avm/res/insights/component/main.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.32.4.45862", - "templateHash": "15805665300877328710" + "templateHash": "8234774084915355769" }, "name": "Application Insights", "description": "This component deploys an Application Insights instance." @@ -134,6 +134,36 @@ } } }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, "roleAssignmentType": { "type": "object", "properties": { @@ -325,6 +355,13 @@ "description": "Optional. Location for all Resources." } }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, "roleAssignments": { "type": "array", "items": { @@ -442,6 +479,20 @@ "appInsights" ] }, + "appInsights_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "appInsights" + ] + }, "appInsights_diagnosticSettings": { "copy": { "name": "appInsights_diagnosticSettings", diff --git a/avm/res/insights/component/tests/e2e/max/main.test.bicep b/avm/res/insights/component/tests/e2e/max/main.test.bicep index 235e8ffc48..8292a09dab 100644 --- a/avm/res/insights/component/tests/e2e/max/main.test.bicep +++ b/avm/res/insights/component/tests/e2e/max/main.test.bicep @@ -84,6 +84,10 @@ module testDeployment '../../../main.bicep' = { workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId } ] + lock: { + kind: 'CanNotDelete' + name: 'myCustomLockName' + } roleAssignments: [ { name: '8aacced3-3fce-41bc-a416-959df1acec57' diff --git a/avm/res/insights/component/version.json b/avm/res/insights/component/version.json index 13669e6601..ea4f3b6e67 100644 --- a/avm/res/insights/component/version.json +++ b/avm/res/insights/component/version.json @@ -1,6 +1,6 @@ { "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#", - "version": "0.4", + "version": "0.5", "pathFilters": [ "./main.json" ]