AzureResource¶

The AzureResource resource deploys generic Azure resources such as Key Vaults, Storage Accounts, and other Azure services. It maps to Azure PowerShell New-Az* cmdlets under the hood.

Structure¶

- type: azureResource
  resourceType: AzKeyVault               # Azure resource type
  name: azkeyvault                       # unique identifier within the RGT
  displayName: Azure Key Vault           # human-readable name
  properties:                            # required — Azure resource configuration
    name: keyvaultname
    EnabledForDiskEncryption: true
    EnablePurgeProtection: true
  config:                                # optional — predefined resource-specific config
    allowedIpAddressRange:
      - 20.13.72.0/24
  roles:                                 # optional — role assignments
    Key Vault Administrator:
      - Engineers
      - john.doe@example.com

Keys¶

Key	Type	Required	Description
`type`	string	Yes	Must be `azureResource`
`resourceType`	string	Yes	The Azure resource type, Noun of the Powershell New-Az* cmdlet (e.g., `AzKeyVault`)
`name`	string	Yes	Unique identifier within the RGT
`displayName`	string	Yes	Human-readable name
`properties`	dictionary	Yes	Azure resource configuration — maps to `New-Az*` cmdlet parameters
`config`	dictionary	No	Predefined resource-type-specific configuration (see below)
`roles`	dictionary or string	No	Role assignments for the resource (see below)

Properties¶

The properties dictionary maps to the parameters of the corresponding Azure PowerShell cmdlet. Refer to the Azure documentation for available properties per resource type.

Config¶

Some resource types require additional configuration beyond the standard Azure properties. This configuration is predefined per resource type:

Resource Type	Config Key	Type	Description
`AzKeyVault`	`allowedIpAddressRange`	list	Public IP addresses or CIDR ranges to allow on the Key Vault firewall

Config values support expressions:

config:
  allowedIpAddressRange:
    - "{{parameters.allowedIpAddressRange}}"

Roles¶

Role assignments grant users and groups access to the created Azure resource. Specify a dictionary with role names as keys and lists of members (user emails or group names) as values:

roles:
  Key Vault Administrator:
    - Engineers
    - john.doe@example.com
  Key Vault Secrets User:
    - AppTeam

Roles can also be specified as a JSON string, which is useful when passing roles as a parameter:

roles: '{"Key Vault Administrator":["Engineers","john.doe@example.com"]}'

Or via an expression:

roles: "{{parameters.roles}}"

Example¶

A Key Vault with IP firewall rules and role assignments:

resources:
  - type: azureResource
    resourceType: AzKeyVault
    name: azkeyvault
    displayName: Azure Key Vault
    properties:
      name: keyvaultname
      EnabledForDiskEncryption: true
      EnablePurgeProtection: true
    config:
      allowedIpAddressRange:
        - 20.13.72.0/24
    roles:
      Key Vault Administrator:
        - Engineers
        - john.doe@example.com

Next: Action Template