Private endpoints

[cveld]

I have two private endpoints to manage. In terraform I would have set up an key/value object structure, en loop through it with foreach. In bicep I currently just have this flattened resource structure. Any suggestions how this could be improved?

resource privateDnsZoneKeyVault 'Microsoft.Network/privateDnsZones@2020-06-01' = {
  name: 'privatelink.vaultcore.azure.net'
  location: 'global'
}

resource privateDnsZoneBlob 'Microsoft.Network/privateDnsZones@2020-06-01' = {
  name: 'privatelink.blob.${az.environment().suffixes.storage}'
  location: 'global'
}

resource privateDnsZoneKeyVaultLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = {
  parent: privateDnsZoneKeyVault
  name: '${privateDnsZoneKeyVault.name}-link'
  location: 'global'
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: vnet.outputs.vnetId
    }
  }
}

resource privateDnsZoneBlobLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = {
  parent: privateDnsZoneBlob
  name: '${privateDnsZoneBlob.name}-link'
  location: 'global'
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: vnet.outputs.vnetId
    }
  }
}

resource privateEndpointBlobDnsGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2021-05-01' = {
  parent: privateEndpointBlob
  name: 'default'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: 'default'
        properties: {
          privateDnsZoneId: privateDnsZoneBlob.id
        }
      }
    ]
  }
}

module vnet './vnet.bicep' = {
  name: '${deployment().name}-vnet'
  params: {
    randomSuffix: randomSuffix
    environment: environment
    vnetName: vnetName
    location: location
  }
}

resource privateEndpointBlob 'Microsoft.Network/privateEndpoints@2024-07-01' = {
  name: 'pe-${storageAccount.name}-blob'
  location: location

  properties: {
    subnet: {
      id: vnet.outputs.privateEndpointSubnetId
    }
    privateLinkServiceConnections: [
      {
        name: 'storageConnection'
        properties: {
          privateLinkServiceId: storageAccount.id
          groupIds: ['blob']
        }
      }
    ]
  }
}

resource keyVault 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
  name: 'mykeyvault${environment}${randomSuffix}'
}

resource privateEndpointKeyVault 'Microsoft.Network/privateEndpoints@2024-07-01' = {
  name: 'pe-${keyVault.name}'
  location: location

  properties: {
    subnet: {
      id: vnet.outputs.privateEndpointSubnetId
    }
    privateLinkServiceConnections: [
      {
        name: 'storageConnection'
        properties: {
          privateLinkServiceId: storageAccount.id
          groupIds: ['blob']
        }
      }
    ]
  }
}

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: 'mystorage${environment}${randomSuffix}'
}

[slavizh]

with bicep you can also have object and loop over it https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/loops#dictionary-object so I do not see any issue.

[johnlokerse]

This, but I don't see why you would loop in this case though.

@cveld I would like to suggest to take a look at AVM too https://aka.ms/avm. AVM has built-in support for private endpoints for each resource. Also, I see a potential bug for privateEndpointKeyVault it refers to a storage account instead of key vault. 😄