azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.33.93.31351",
      "templateHash": "1377408791130358480"
    }
  },
  "parameters": {
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "The name of the Storage account to create."
      }
    },
    "containerName": {
      "type": "string",
      "defaultValue": "tfstate",
      "metadata": {
        "description": "The name of the blob container to create."
      }
    },
    "allowSharedKeyAccess": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Allow authenticating to the storage account using a shared access key?"
      }
    },
    "ipRules": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of IP addresses or IP ranges that should be allowed to bypass the firewall of the Terraform backend. If empty, the firewall will be disabled."
      }
    },
    "principalIds": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of object IDs of user, group or service principals that should have access to the Terraform backend."
      }
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('containerName'))]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), 'default')]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
      "properties": {
        "deleteRetentionPolicy": {
          "allowPermanentDelete": false,
          "enabled": true,
          "days": 30
        },
        "containerDeleteRetentionPolicy": {
          "enabled": true,
          "days": 30
        },
        "isVersioningEnabled": true,
        "changeFeed": {
          "enabled": true
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts/managementPolicies",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
      "properties": {
        "policy": {
          "rules": [
            {
              "name": "Delete old tfstate versions",
              "enabled": true,
              "type": "Lifecycle",
              "definition": {
                "actions": {
                  "version": {
                    "delete": {
                      "daysAfterCreationGreaterThan": 30
                    }
                  }
                },
                "filters": {
                  "blobTypes": [
                    "blockBlob"
                  ]
                }
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-05-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard_GRS"
      },
      "kind": "StorageV2",
      "properties": {
        "accessTier": "Hot",
        "supportsHttpsTrafficOnly": true,
        "minimumTlsVersion": "TLS1_2",
        "allowBlobPublicAccess": false,
        "allowSharedKeyAccess": "[parameters('allowSharedKeyAccess')]",
        "allowCrossTenantReplication": false,
        "networkAcls": {
          "copy": [
            {
              "name": "ipRules",
              "count": "[length(parameters('ipRules'))]",
              "input": {
                "value": "[parameters('ipRules')[copyIndex('ipRules')]]",
                "action": "Allow"
              }
            }
          ],
          "defaultAction": "[if(equals(length(parameters('ipRules')), 0), 'Allow', 'Deny')]",
          "virtualNetworkRules": []
        }
      }
    },
    {
      "copy": {
        "name": "roleAssignment",
        "count": "[length(parameters('principalIds'))]"
      },
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
      "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), parameters('principalIds')[copyIndex()], subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b'))]",
      "properties": {
        "principalId": "[parameters('principalIds')[copyIndex()]]",
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ]
    },
    {
      "type": "Microsoft.Authorization/locks",
      "apiVersion": "2020-05-01",
      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
      "name": "Terraform",
      "properties": {
        "level": "ReadOnly",
        "notes": "Prevent changes to Terraform backend configuration"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), 'default')]",
        "[resourceId('Microsoft.Storage/storageAccounts/managementPolicies', parameters('storageAccountName'), 'default')]",
        "roleAssignment",
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
      ]
    }
  ],
  "outputs": {
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "The name of the Storage account that was created."
      },
      "value": "[parameters('storageAccountName')]"
    },
    "containerName": {
      "type": "string",
      "metadata": {
        "description": "The name of the blob container that was created."
      },
      "value": "[parameters('containerName')]"
    }
  }
}