fix(azure): remove default values in params and ensure secure on para…

…ms (#415)
Altinn · Feb 6, 2024 · 94b9885 · 94b9885
1 parent a293842
commit 94b9885
Show file tree

Hide file tree

Showing 16 changed files with 77 additions and 49 deletions.
diff --git a/.azure/applications/web-api-eu/main.bicep b/.azure/applications/web-api-eu/main.bicep
@@ -1,13 +1,22 @@
 targetScope = 'resourceGroup'
 
+@minLength(3)
 param imageTag string
+@minLength(3)
 param environment string
+@minLength(3)
 param location string
 
+@minLength(3)
+@secure()
 param containerAppEnvironmentId string
+@minLength(3)
+@secure()
 param appInsightConnectionString string
+@minLength(3)
+@secure()
 param appConfigurationName string
-
+@minLength(3)
 @secure()
 param environmentKeyVaultName string
 

diff --git a/.azure/applications/web-api-eu/staging.bicepparam b/.azure/applications/web-api-eu/staging.bicepparam
@@ -2,10 +2,10 @@ using './main.bicep'
 
 param environment = 'staging'
 param location = 'norwayeast'
-param imageTag = readEnvironmentVariable('IMAGE_TAG', '')
+param imageTag = readEnvironmentVariable('IMAGE_TAG')
 
 // secrets
-param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME', '')
-param containerAppEnvironmentId = readEnvironmentVariable('CONTAINTER_APP_ENVIRONMENT_ID', '')
-param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING', '')
-param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME', '')
+param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME')
+param containerAppEnvironmentId = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_ID')
+param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
+param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
diff --git a/.azure/applications/web-api-eu/test.bicepparam b/.azure/applications/web-api-eu/test.bicepparam
@@ -2,10 +2,10 @@ using './main.bicep'
 
 param environment = 'test'
 param location = 'norwayeast'
-param imageTag = readEnvironmentVariable('IMAGE_TAG', '')
+param imageTag = readEnvironmentVariable('IMAGE_TAG')
 
 // secrets
-param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME', '')
-param containerAppEnvironmentId = readEnvironmentVariable('CONTAINTER_APP_ENVIRONMENT_ID', '')
-param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING', '')
-param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME', '')
+param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME')
+param containerAppEnvironmentId = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_ID')
+param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
+param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
diff --git a/.azure/applications/web-api-migration-job/main.bicep b/.azure/applications/web-api-migration-job/main.bicep
@@ -1,12 +1,16 @@
 targetScope = 'resourceGroup'
 
+@minLength(3)
 param imageTag string
-
+@minLength(3)
 param environment string
+@minLength(3)
 param location string
 
+@minLength(3)
+@secure()
 param containerAppEnvironmentId string
-
+@minLength(3)
 @secure()
 param adoConnectionStringSecretUri string
 

diff --git a/.azure/applications/web-api-migration-job/staging.bicepparam b/.azure/applications/web-api-migration-job/staging.bicepparam
@@ -3,7 +3,7 @@ using './main.bicep'
 param environment = 'staging'
 param location = 'norwayeast'
 param imageTag = readEnvironmentVariable('IMAGE_TAG', '')
-param containerAppEnvironmentId = readEnvironmentVariable('CONTAINTER_APP_ENVIRONMENT_ID', '')
+param containerAppEnvironmentId = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_ID', '')
 
 //secrets
 param adoConnectionStringSecretUri = readEnvironmentVariable('ADO_CONNECTION_STRING_SECRET_URI', '')
diff --git a/.azure/applications/web-api-migration-job/test.bicepparam b/.azure/applications/web-api-migration-job/test.bicepparam
@@ -2,8 +2,8 @@ using './main.bicep'
 
 param environment = 'test'
 param location = 'norwayeast'
-param imageTag = readEnvironmentVariable('IMAGE_TAG', '')
-param containerAppEnvironmentId = readEnvironmentVariable('CONTAINTER_APP_ENVIRONMENT_ID', '')
 
 //secrets
-param adoConnectionStringSecretUri = readEnvironmentVariable('ADO_CONNECTION_STRING_SECRET_URI', '')
+param imageTag = readEnvironmentVariable('IMAGE_TAG')
+param containerAppEnvironmentId = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_ID')
+param adoConnectionStringSecretUri = readEnvironmentVariable('ADO_CONNECTION_STRING_SECRET_URI')
diff --git a/.azure/applications/web-api-so/main.bicep b/.azure/applications/web-api-so/main.bicep
@@ -1,13 +1,22 @@
 targetScope = 'resourceGroup'
 
+@minLength(1)
 param imageTag string
+@minLength(1)
 param environment string
+@minLength(1)
 param location string
 
+@minLength(1)
+@secure()
 param containerAppEnvironmentId string
+@minLength(1)
+@secure()
 param appInsightConnectionString string
+@minLength(1)
+@secure()
 param appConfigurationName string
-
+@minLength(1)
 @secure()
 param environmentKeyVaultName string
 

diff --git a/.azure/applications/web-api-so/staging.bicepparam b/.azure/applications/web-api-so/staging.bicepparam
@@ -2,10 +2,10 @@ using './main.bicep'
 
 param environment = 'staging'
 param location = 'norwayeast'
-param imageTag = readEnvironmentVariable('IMAGE_TAG', '')
+param imageTag = readEnvironmentVariable('IMAGE_TAG')
 
 // secrets
-param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME', '')
-param containerAppEnvironmentId = readEnvironmentVariable('CONTAINTER_APP_ENVIRONMENT_ID', '')
-param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING', '')
-param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME', '')
+param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME')
+param containerAppEnvironmentId = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_ID')
+param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
+param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
diff --git a/.azure/applications/web-api-so/test.bicepparam b/.azure/applications/web-api-so/test.bicepparam
@@ -2,10 +2,10 @@ using './main.bicep'
 
 param environment = 'test'
 param location = 'norwayeast'
-param imageTag = readEnvironmentVariable('IMAGE_TAG', '')
+param imageTag = readEnvironmentVariable('IMAGE_TAG')
 
 // secrets
-param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME', '')
-param containerAppEnvironmentId = readEnvironmentVariable('CONTAINTER_APP_ENVIRONMENT_ID', '')
-param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING', '')
-param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME', '')
+param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_NAME')
+param containerAppEnvironmentId = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_ID')
+param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
+param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
diff --git a/.azure/infrastructure/main.bicep b/.azure/infrastructure/main.bicep
@@ -1,16 +1,22 @@
 targetScope = 'subscription'
 @minLength(3)
 param environment string
+@minLength(3)
 param location string
+
 param keyVaultSourceKeys array
 
 @secure()
+@minLength(3)
 param dialogportenPgAdminPassword string
 @secure()
+@minLength(3)
 param sourceKeyVaultSubscriptionId string
 @secure()
+@minLength(3)
 param sourceKeyVaultResourceGroup string
 @secure()
+@minLength(3)
 param sourceKeyVaultName string
 
 @allowed(

diff --git a/.azure/infrastructure/production.bicepparam b/.azure/infrastructure/production.bicepparam
@@ -5,10 +5,10 @@ param location = 'norwayeast'
 param keyVaultSourceKeys = json(readEnvironmentVariable('KEY_VAULT_SOURCE_KEYS', '[]'))
 
 // secrets
-param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD', '')
-param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEYVAULT_SUBSCRIPTION_ID', '')
-param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEYVAULT_RESOURCE_GROUP', '')
-param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEYVAULT_NAME', '')
+param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD')
+param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEY_VAULT_SUBSCRIPTION_ID')
+param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEY_VAULT_RESOURCE_GROUP')
+param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEY_VAULT_NAME')
 
 // SKUs
 param keyVaultSKUName = 'standard'

diff --git a/.azure/infrastructure/soak.bicepparam b/.azure/infrastructure/soak.bicepparam
@@ -2,13 +2,13 @@ using './main.bicep'
 
 param environment = 'soak'
 param location = 'norwayeast'
-param keyVaultSourceKeys = json(readEnvironmentVariable('KEYVAULT_SOURCE_KEYS', '[]'))
+param keyVaultSourceKeys = json(readEnvironmentVariable('KEY_VAULT_SOURCE_KEYS'))
 
 // secrets
-param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD', '')
-param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEYVAULT_SUBSCRIPTION_ID', '')
-param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEYVAULT_RESOURCE_GROUP', '')
-param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEYVAULT_NAME', '')
+param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD')
+param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEY_VAULT_SUBSCRIPTION_ID')
+param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEY_VAULT_RESOURCE_GROUP')
+param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEY_VAULT_NAME')
 
 // SKUs
 param keyVaultSKUName = 'standard'

diff --git a/.azure/infrastructure/staging.bicepparam b/.azure/infrastructure/staging.bicepparam
@@ -2,13 +2,13 @@ using './main.bicep'
 
 param environment = 'staging'
 param location = 'norwayeast'
-param keyVaultSourceKeys = json(readEnvironmentVariable('KEYVAULT_SOURCE_KEYS', '[]'))
+param keyVaultSourceKeys = json(readEnvironmentVariable('KEY_VAULT_SOURCE_KEYS'))
 
 // secrets
-param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD', '')
-param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEYVAULT_SUBSCRIPTION_ID', '')
-param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEYVAULT_RESOURCE_GROUP', '')
-param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEYVAULT_NAME', '')
+param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD')
+param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEY_VAULT_SUBSCRIPTION_ID')
+param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEY_VAULT_RESOURCE_GROUP')
+param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEY_VAULT_NAME')
 
 // SKUs
 param keyVaultSKUName = 'standard'

diff --git a/.azure/infrastructure/test.bicepparam b/.azure/infrastructure/test.bicepparam
@@ -2,13 +2,13 @@ using './main.bicep'
 
 param environment = 'test'
 param location = 'norwayeast'
-param keyVaultSourceKeys = json(readEnvironmentVariable('KEYVAULT_SOURCE_KEYS', '[]'))
+param keyVaultSourceKeys = json(readEnvironmentVariable('KEY_VAULT_SOURCE_KEYS', '[]'))
 
 // secrets
-param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD', '')
-param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEY_VAULT_SUBSCRIPTION_ID', '')
-param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEY_VAULT_RESOURCE_GROUP', '')
-param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEY_VAULT_NAME', '')
+param dialogportenPgAdminPassword = readEnvironmentVariable('PG_ADMIN_PASSWORD')
+param sourceKeyVaultSubscriptionId = readEnvironmentVariable('SOURCE_KEY_VAULT_SUBSCRIPTION_ID')
+param sourceKeyVaultResourceGroup = readEnvironmentVariable('SOURCE_KEY_VAULT_RESOURCE_GROUP')
+param sourceKeyVaultName = readEnvironmentVariable('SOURCE_KEY_VAULT_NAME')
 
 // SKUs
 param keyVaultSKUName = 'standard'

diff --git a/.github/workflows/action-build-and-test.yml b/.github/workflows/action-build-and-test.yml
@@ -1,4 +1,4 @@
-name: BuildAndTest
+name: Build and test .NET
 
 on:
   workflow_dispatch:

diff --git a/.github/workflows/ci-cd-pull-request.yml b/.github/workflows/ci-cd-pull-request.yml
@@ -1,4 +1,4 @@
-name: CI/CD PullRequest
+name: CI/CD Pull Request
 
 on:
   pull_request: