main.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.26.54.24096",
      "templateHash": "7027999657185847395"
    }
  },
  "parameters": {
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "minLength": 2,
      "metadata": {
        "description": "The location to use for the deployment. defaults to Resource Groups location."
      }
    },
    "resourceName": {
      "type": "string",
      "minLength": 3,
      "maxLength": 20,
      "metadata": {
        "description": "Used to name all resources"
      }
    },
    "custom_vnet": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Are you providing your own vNet CIDR blocks"
      }
    },
    "byoAKSSubnetId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Full resource id path of an existing subnet to use for AKS"
      }
    },
    "byoAKSPodSubnetId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Full resource id path of an existing pod subnet to use for AKS"
      }
    },
    "byoAGWSubnetId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Full resource id path of an existing subnet to use for Application Gateway"
      }
    },
    "byoUaiName": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The name of an existing User Assigned Identity to use for the AKS Control Plane (in the same resouce group), requires rbac assignments to be done outside of this template"
      }
    },
    "vnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.0.0/16",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for the custom vnet"
      }
    },
    "vnetAksSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.0.0/22",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for AKS in your custom vnet"
      }
    },
    "vnetAppGatewaySubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.5.0/24",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for the App Gateway in your custom vnet"
      }
    },
    "acrAgentPoolSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.4.64/26",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for the ACR in your custom vnet"
      }
    },
    "bastionSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.4.128/26",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for Azure Bastion in your custom vnet"
      }
    },
    "privateLinkSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.4.192/26",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for private link in your custom vnet"
      }
    },
    "vnetFirewallSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.50.0/24",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for Azure Firewall in your custom vnet"
      }
    },
    "vnetFirewallManagementSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.240.51.0/26",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range for Azure Firewall Management in your custom vnet"
      }
    },
    "privateLinks": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable support for private links (required custom_vnet)"
      }
    },
    "acrPrivatePool": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable support for ACR private pool"
      }
    },
    "bastion": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Deploy Azure Bastion to your vnet. (works with Custom Networking only, not BYO)"
      }
    },
    "CreateNetworkSecurityGroups": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Deploy NSGs to your vnet subnets. (works with Custom Networking only, not BYO)"
      }
    },
    "CreateNetworkSecurityGroupFlowLogs": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Configure Flow Logs for Network Security Groups in the NetworkWatcherRG resource group. Requires Contributor RBAC on NetworkWatcherRG and Reader on Subscription."
      }
    },
    "dnsZoneId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The full Azure resource ID of the DNS zone to use for the AKS cluster"
      }
    },
    "keyVaultCreate": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Creates a KeyVault"
      }
    },
    "keyVaultSoftDelete": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "If soft delete protection is enabled"
      }
    },
    "keyVaultPurgeProtection": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "If purge protection is enabled"
      }
    },
    "keyVaultIPAllowlist": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "Add IP to KV firewall allow-list"
      }
    },
    "keyVaultAksCSI": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Installs the AKS KV CSI provider"
      }
    },
    "keyVaultAksCSIPollInterval": {
      "type": "string",
      "defaultValue": "2m",
      "metadata": {
        "description": "Rotation poll interval for the AKS KV CSI provider"
      }
    },
    "keyVaultOfficerRolePrincipalId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The principal ID of the user or service principal that requires access to the Key Vault. Set automatedDeployment to toggle between user and service prinicpal"
      }
    },
    "keyVaultKmsCreate": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable encryption at rest for Kubernetes etcd data"
      }
    },
    "keyVaultKmsByoKeyId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Bring an existing Key from an existing Key Vault"
      }
    },
    "keyVaultKmsByoRG": {
      "type": "string",
      "defaultValue": "[resourceGroup().name]",
      "metadata": {
        "description": "The resource group for the existing KMS Key Vault"
      }
    },
    "keyVaultKmsOfficerRolePrincipalId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The PrincipalId of the deploying user, which is necessary when creating a Kms Key"
      }
    },
    "registries_sku": {
      "type": "string",
      "defaultValue": "",
      "allowedValues": [
        "",
        "Basic",
        "Standard",
        "Premium"
      ],
      "metadata": {
        "description": "The SKU to use for the Container Registry"
      }
    },
    "enableACRTrustPolicy": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable the ACR Content Trust Policy, SKU must be set to Premium"
      }
    },
    "acrUntaggedRetentionPolicyEnabled": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable removing of untagged manifests from ACR"
      }
    },
    "acrUntaggedRetentionPolicy": {
      "type": "int",
      "defaultValue": 30,
      "metadata": {
        "description": "The number of days to retain untagged manifests for"
      }
    },
    "acrPushRolePrincipalId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The principal ID of the service principal to assign the push role to the ACR"
      }
    },
    "imageNames": {
      "type": "array",
      "defaultValue": []
    },
    "azureFirewalls": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Create an Azure Firewall, requires custom_vnet"
      }
    },
    "certManagerFW": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Add application rules to the firewall for certificate management."
      }
    },
    "azureFirewallSku": {
      "type": "string",
      "defaultValue": "Standard",
      "allowedValues": [
        "Basic",
        "Premium",
        "Standard"
      ]
    },
    "ingressApplicationGateway": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Create an Application Gateway"
      }
    },
    "appGWcount": {
      "type": "int",
      "defaultValue": 2,
      "metadata": {
        "description": "The number of applciation gateway instances"
      }
    },
    "appGWmaxCount": {
      "type": "int",
      "defaultValue": 0,
      "metadata": {
        "description": "The maximum number of application gateway instances"
      }
    },
    "privateIpApplicationGateway": {
      "type": "string",
      "defaultValue": "",
      "maxLength": 15,
      "metadata": {
        "description": "A known private ip in the Application Gateway subnet range to be allocated for internal traffic"
      }
    },
    "appgwKVIntegration": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable key vault integration for application gateway"
      }
    },
    "appGWsku": {
      "type": "string",
      "defaultValue": "WAF_v2",
      "allowedValues": [
        "Standard_v2",
        "WAF_v2"
      ],
      "metadata": {
        "description": "The SKU for AppGw"
      }
    },
    "appGWenableFirewall": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Enable the WAF Firewall, valid for WAF_v2 SKUs"
      }
    },
    "appGwFirewallMode": {
      "type": "string",
      "defaultValue": "Prevention",
      "allowedValues": [
        "Prevention",
        "Detection"
      ]
    },
    "dnsPrefix": {
      "type": "string",
      "defaultValue": "[format('{0}-dns', parameters('resourceName'))]",
      "metadata": {
        "description": "DNS prefix. Defaults to {resourceName}-dns"
      }
    },
    "kubernetesVersion": {
      "type": "string",
      "defaultValue": "1.28.5",
      "metadata": {
        "description": "Kubernetes Version"
      }
    },
    "enable_aad": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable Azure AD integration on AKS"
      }
    },
    "aad_tenant_id": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The ID of the Azure AD tenant"
      }
    },
    "omsagent": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Create, and use a new Log Analytics workspace for AKS logs"
      }
    },
    "containerLogsV2BasicLogs": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enables the ContainerLogsV2 table to be of type Basic"
      }
    },
    "enableAzureRBAC": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable RBAC using AAD"
      }
    },
    "kedaAddon": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enables Kubernetes Event-driven Autoscaling (KEDA)"
      }
    },
    "openServiceMeshAddon": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enables Open Service Mesh"
      }
    },
    "sgxPlugin": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enables SGX Confidential Compute plugin"
      }
    },
    "blobCSIDriver": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enables the Blob CSI driver"
      }
    },
    "fileCSIDriver": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Enables the File CSI driver"
      }
    },
    "diskCSIDriver": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Enables the Disk CSI driver"
      }
    },
    "upgradeChannel": {
      "type": "string",
      "defaultValue": "none",
      "allowedValues": [
        "none",
        "patch",
        "stable",
        "rapid",
        "node-image"
      ],
      "metadata": {
        "description": "AKS upgrade channel"
      }
    },
    "osDiskType": {
      "type": "string",
      "defaultValue": "Ephemeral",
      "allowedValues": [
        "Ephemeral",
        "Managed"
      ],
      "metadata": {
        "description": "OS disk type"
      }
    },
    "agentVMSize": {
      "type": "string",
      "defaultValue": "Standard_DS3_v2",
      "metadata": {
        "description": "VM SKU"
      }
    },
    "osDiskSizeGB": {
      "type": "int",
      "defaultValue": 0,
      "metadata": {
        "description": "Disk size in GB"
      }
    },
    "agentCount": {
      "type": "int",
      "defaultValue": 3,
      "metadata": {
        "description": "The number of agents for the user node pool"
      }
    },
    "agentCountMax": {
      "type": "int",
      "defaultValue": 0,
      "metadata": {
        "description": "The maximum number of nodes for the user node pool"
      }
    },
    "nodePoolName": {
      "type": "string",
      "defaultValue": "npuser01",
      "minLength": 3,
      "maxLength": 12,
      "metadata": {
        "description": "Name for user node pool"
      }
    },
    "nodePoolSpot": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Config the user node pool as a spot instance"
      }
    },
    "cniDynamicIpAllocation": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Allocate pod ips dynamically"
      }
    },
    "maxPods": {
      "type": "int",
      "defaultValue": 30,
      "minValue": 10,
      "maxValue": 250,
      "metadata": {
        "description": "The maximum number of pods per node."
      }
    },
    "networkPlugin": {
      "type": "string",
      "defaultValue": "azure",
      "allowedValues": [
        "azure",
        "kubenet"
      ],
      "metadata": {
        "description": "The network plugin type"
      }
    },
    "networkPluginMode": {
      "type": "string",
      "defaultValue": "",
      "allowedValues": [
        "",
        "Overlay"
      ],
      "metadata": {
        "description": "The network plugin type"
      }
    },
    "networkDataplane": {
      "type": "string",
      "defaultValue": "",
      "allowedValues": [
        "",
        "cilium"
      ],
      "metadata": {
        "description": "Use Cilium dataplane (requires azure networkPlugin)"
      }
    },
    "networkPolicy": {
      "type": "string",
      "defaultValue": "",
      "allowedValues": [
        "",
        "azure",
        "calico",
        "cilium"
      ],
      "metadata": {
        "description": "The network policy to use."
      }
    },
    "azurepolicy": {
      "type": "string",
      "defaultValue": "",
      "allowedValues": [
        "",
        "audit",
        "deny"
      ],
      "metadata": {
        "description": "Enable the Azure Policy addon"
      }
    },
    "azurePolicyInitiative": {
      "type": "string",
      "defaultValue": "Baseline",
      "allowedValues": [
        "Baseline",
        "Restricted"
      ]
    },
    "authorizedIPRanges": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "The IP addresses that are allowed to access the API server"
      }
    },
    "enablePrivateCluster": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable private cluster"
      }
    },
    "privateClusterDnsMethod": {
      "type": "string",
      "defaultValue": "system",
      "allowedValues": [
        "system",
        "none",
        "privateDnsZone"
      ],
      "metadata": {
        "description": "Private cluster dns advertisment method, leverages the dnsApiPrivateZoneId parameter"
      }
    },
    "dnsApiPrivateZoneId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The full Azure resource ID of the privatelink DNS zone to use for the AKS cluster API Server"
      }
    },
    "availabilityZones": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "The zones to use for a node pool"
      }
    },
    "AksDisableLocalAccounts": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Disable local K8S accounts for AAD enabled clusters"
      }
    },
    "AksPaidSkuForSLA": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Use the paid sku for SLA rather than SLO"
      }
    },
    "podCidr": {
      "type": "string",
      "defaultValue": "10.240.100.0/22",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range to use for pods"
      }
    },
    "serviceCidr": {
      "type": "string",
      "defaultValue": "172.10.0.0/16",
      "minLength": 9,
      "maxLength": 18,
      "metadata": {
        "description": "The address range to use for services"
      }
    },
    "dnsServiceIP": {
      "type": "string",
      "defaultValue": "172.10.0.10",
      "minLength": 7,
      "maxLength": 15,
      "metadata": {
        "description": "The IP address to reserve for DNS"
      }
    },
    "defenderForContainers": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable Microsoft Defender for Containers (preview)"
      }
    },
    "JustUseSystemPool": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Only use the system node pool"
      }
    },
    "SystemPoolType": {
      "type": "string",
      "defaultValue": "CostOptimised",
      "allowedValues": [
        "CostOptimised",
        "Standard",
        "HighSpec",
        "Custom"
      ],
      "metadata": {
        "description": "The System Pool Preset sizing"
      }
    },
    "SystemPoolCustomPreset": {
      "type": "object",
      "defaultValue": {},
      "metadata": {
        "description": "A custom system pool spec"
      }
    },
    "AutoscaleProfile": {
      "type": "object",
      "defaultValue": {
        "balance-similar-node-groups": "true",
        "expander": "random",
        "max-empty-bulk-delete": "10",
        "max-graceful-termination-sec": "600",
        "max-node-provision-time": "15m",
        "max-total-unready-percentage": "45",
        "new-pod-scale-up-delay": "0s",
        "ok-total-unready-count": "3",
        "scale-down-delay-after-add": "10m",
        "scale-down-delay-after-delete": "20s",
        "scale-down-delay-after-failure": "3m",
        "scale-down-unneeded-time": "10m",
        "scale-down-unready-time": "20m",
        "scale-down-utilization-threshold": "0.5",
        "scan-interval": "10s",
        "skip-nodes-with-local-storage": "true",
        "skip-nodes-with-system-pods": "true"
      }
    },
    "aksOutboundTrafficType": {
      "type": "string",
      "defaultValue": "loadBalancer",
      "allowedValues": [
        "loadBalancer",
        "natGateway",
        "userDefinedRouting"
      ],
      "metadata": {
        "description": "Outbound traffic type for the egress traffic of your cluster"
      }
    },
    "createNatGateway": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Create a new Nat Gateway, applies to custom networking only"
      }
    },
    "natGwIpCount": {
      "type": "int",
      "defaultValue": 2,
      "minValue": 1,
      "maxValue": 16,
      "metadata": {
        "description": "The effective outbound IP resources of the cluster NAT gateway"
      }
    },
    "natGwIdleTimeout": {
      "type": "int",
      "defaultValue": 30,
      "minValue": 4,
      "maxValue": 120,
      "metadata": {
        "description": "Outbound flow idle timeout in minutes for NatGw"
      }
    },
    "oidcIssuer": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Configures the cluster as an OIDC issuer for use with Workload Identity"
      }
    },
    "workloadIdentity": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Installs Azure Workload Identity into the cluster"
      }
    },
    "enableNodePublicIP": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Assign a public IP per node for user node pools"
      }
    },
    "warIngressNginx": {
      "type": "bool",
      "defaultValue": false
    },
    "managedNodeResourceGroup": {
      "type": "string",
      "defaultValue": "",
      "maxLength": 80,
      "metadata": {
        "description": "The name of the NEW resource group to create the AKS cluster managed resources in"
      }
    },
    "restrictionLevelNodeResourceGroup": {
      "type": "string",
      "defaultValue": "Unrestricted",
      "allowedValues": [
        "ReadOnly",
        "Unrestricted"
      ],
      "metadata": {
        "description": "The restriction level applied to the cluster node resource group"
      }
    },
    "serviceMeshProfile": {
      "type": "string",
      "defaultValue": "",
      "allowedValues": [
        "",
        "Istio"
      ],
      "metadata": {
        "description": "The service mesh profile to use"
      }
    },
    "istioIngressGatewayMode": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The ingress gateway to use for the Istio service mesh"
      }
    },
    "istioRevision": {
      "type": "string",
      "defaultValue": "asm-1-20"
    },
    "osType": {
      "type": "string",
      "defaultValue": "Linux",
      "allowedValues": [
        "Linux",
        "Windows"
      ],
      "metadata": {
        "description": "The User Node pool OS"
      }
    },
    "osSKU": {
      "type": "string",
      "defaultValue": "Ubuntu",
      "allowedValues": [
        "AzureLinux",
        "Ubuntu",
        "Windows2019",
        "Windows2022"
      ],
      "metadata": {
        "description": "User Node pool OS SKU"
      }
    },
    "automatedDeployment": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "If automated deployment, for the 3 automated user assignments, set Principal Type on each to \"ServicePrincipal\" rarter than \"User\""
      }
    },
    "adminPrincipalId": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "The principal ID to assign the AKS admin role."
      }
    },
    "fluxGitOpsAddon": {
      "type": "bool",
      "defaultValue": false
    },
    "daprAddon": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Add the Dapr extension"
      }
    },
    "daprAddonHA": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable high availability (HA) mode for the Dapr control plane"
      }
    },
    "AksDiagCategories": {
      "type": "array",
      "defaultValue": [
        "cluster-autoscaler",
        "kube-controller-manager",
        "kube-audit-admin",
        "guard"
      ],
      "metadata": {
        "description": "Diagnostic categories to log"
      }
    },
    "enableSysLog": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Enable SysLogs and send to log analytics"
      }
    },
    "createAksMetricAlerts": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Enable Metric Alerts"
      }
    },
    "AksMetricAlertMetricFrequencyModel": {
      "type": "string",
      "defaultValue": "Long",
      "allowedValues": [
        "Short",
        "Long"
      ],
      "metadata": {
        "description": "Which Metric polling frequency model to use"
      }
    },
    "retentionInDays": {
      "type": "int",
      "defaultValue": 30,
      "metadata": {
        "description": "The Log Analytics retention period"
      }
    },
    "logDataCap": {
      "type": "int",
      "defaultValue": 0,
      "metadata": {
        "description": "The Log Analytics daily data cap (GB) (0=no limit)"
      }
    },
    "createEventGrid": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Create an Event Grid System Topic for AKS events"
      }
    },
    "enableTelemetry": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Enable usage and telemetry feedback to Microsoft."
      }
    },
    "automationAccountScheduledStartStop": {
      "type": "string",
      "defaultValue": "",
      "allowedValues": [
        "",
        "Weekday",
        "Day"
      ],
      "metadata": {
        "category": "Automation",
        "description": "Creates an Azure Automation Account to provide scheduled start and stop of the cluster"
      }
    },
    "automationTimeZone": {
      "type": "string",
      "defaultValue": "Etc/UTC",
      "metadata": {
        "category": "Automation",
        "description": "The IANA time zone of the automation account"
      }
    },
    "automationStartHour": {
      "type": "int",
      "defaultValue": 8,
      "metadata": {
        "category": "Automation",
        "description": "When to start the cluster"
      },
      "minValue": 0,
      "maxValue": 23
    },
    "automationStopHour": {
      "type": "int",
      "defaultValue": 19,
      "metadata": {
        "category": "Automation",
        "description": "When to stop the cluster"
      },
      "minValue": 0,
      "maxValue": 23
    }
  },
  "variables": {
    "createAksUai": "[and(or(or(or(or(parameters('custom_vnet'), not(empty(parameters('byoAKSSubnetId')))), not(empty(parameters('dnsApiPrivateZoneId')))), variables('keyVaultKmsCreateAndPrereqs')), not(empty(parameters('keyVaultKmsByoKeyId')))), empty(parameters('byoUaiName')))]",
    "existingAksVnetRG": "[if(not(empty(parameters('byoAKSSubnetId'))), if(greater(length(split(parameters('byoAKSSubnetId'), '/')), 4), split(parameters('byoAKSSubnetId'), '/')[4], ''), '')]",
    "isDnsZonePrivate": "[if(not(empty(parameters('dnsZoneId'))), equals(split(parameters('dnsZoneId'), '/')[7], 'privateDnsZones'), false())]",
    "keyVaultOfficerRolePrincipalIds": [
      "[parameters('keyVaultOfficerRolePrincipalId')]"
    ],
    "keyVaultKmsByoName": "[if(not(empty(parameters('keyVaultKmsByoKeyId'))), split(split(parameters('keyVaultKmsByoKeyId'), '/')[2], '.')[0], '')]",
    "kmsRbacWaitSeconds": 30,
    "keyVaultKmsCreateAndPrereqs": "[and(and(parameters('keyVaultKmsCreate'), not(empty(parameters('keyVaultKmsOfficerRolePrincipalId')))), equals(parameters('privateLinks'), false()))]",
    "acrContentTrustEnabled": "[if(and(parameters('enableACRTrustPolicy'), equals(parameters('registries_sku'), 'Premium')), 'enabled', 'disabled')]",
    "acrZoneRedundancyEnabled": "[if(and(not(empty(parameters('availabilityZones'))), equals(parameters('registries_sku'), 'Premium')), 'Enabled', 'Disabled')]",
    "acrName": "[format('cr{0}{1}', replace(parameters('resourceName'), '-', ''), uniqueString(resourceGroup().id, parameters('resourceName')))]",
    "AcrPullRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
    "AcrPushRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
    "deployAppGw": "[and(parameters('ingressApplicationGateway'), or(parameters('custom_vnet'), not(empty(parameters('byoAGWSubnetId')))))]",
    "appGWenableWafFirewall": "[if(equals(parameters('appGWsku'), 'Standard_v2'), false(), parameters('appGWenableFirewall'))]",
    "appgwName": "[format('agw-{0}', parameters('resourceName'))]",
    "appgwResourceId": "[if(variables('deployAppGw'), resourceId('Microsoft.Network/applicationGateways', format('{0}', variables('appgwName'))), '')]",
    "frontendPublicIpConfig": {
      "properties": {
        "publicIPAddress": {
          "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('pip-agw-{0}', parameters('resourceName')))]"
        }
      },
      "name": "appGatewayFrontendIP"
    },
    "appGwFirewallConfigOwasp": {
      "enabled": "[variables('appGWenableWafFirewall')]",
      "firewallMode": "[parameters('appGwFirewallMode')]",
      "ruleSetType": "OWASP",
      "ruleSetVersion": "3.2",
      "requestBodyCheck": true,
      "maxRequestBodySizeInKb": 128,
      "disabledRuleGroups": []
    },
    "appGWskuObj": "[union(createObject('name', parameters('appGWsku'), 'tier', parameters('appGWsku')), if(equals(parameters('appGWmaxCount'), 0), createObject('capacity', parameters('appGWcount')), createObject()))]",
    "contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
    "reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
    "managedIdentityOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]",
    "autoScale": "[greater(parameters('agentCountMax'), parameters('agentCount'))]",
    "serviceMeshProfileObj": {
      "istio": {
        "components": {
          "ingressGateways": "[if(empty(parameters('istioIngressGatewayMode')), null(), createArray(createObject('enabled', true(), 'mode', parameters('istioIngressGatewayMode'))))]"
        },
        "revisions": [
          "[parameters('istioRevision')]"
        ]
      },
      "mode": "Istio"
    },
    "outboundTrafficType": "[if(equals(parameters('aksOutboundTrafficType'), 'natGateway'), if(parameters('custom_vnet'), 'userAssignedNATGateway', 'managedNATGateway'), parameters('aksOutboundTrafficType'))]",
    "systemPoolPresets": {
      "CostOptimised": {
        "vmSize": "Standard_B4ms",
        "count": 1,
        "minCount": 1,
        "maxCount": 3,
        "enableAutoScaling": true,
        "availabilityZones": []
      },
      "Standard": {
        "vmSize": "Standard_DS2_v2",
        "count": 3,
        "minCount": 3,
        "maxCount": 5,
        "enableAutoScaling": true,
        "availabilityZones": [
          "1",
          "2",
          "3"
        ]
      },
      "HighSpec": {
        "vmSize": "Standard_D4s_v3",
        "count": 3,
        "minCount": 3,
        "maxCount": 5,
        "enableAutoScaling": true,
        "availabilityZones": [
          "1",
          "2",
          "3"
        ]
      }
    },
    "akssku": "[if(parameters('AksPaidSkuForSLA'), 'Standard', 'Free')]",
    "aks_addons": "[union(createObject('azurepolicy', createObject('config', createObject('version', if(not(empty(parameters('azurepolicy'))), 'v2', json('null'))), 'enabled', not(empty(parameters('azurepolicy')))), 'azureKeyvaultSecretsProvider', createObject('config', createObject('enableSecretRotation', 'true', 'rotationPollInterval', parameters('keyVaultAksCSIPollInterval')), 'enabled', parameters('keyVaultAksCSI')), 'openServiceMesh', createObject('enabled', parameters('openServiceMeshAddon'), 'config', createObject()), 'ACCSGXDevicePlugin', createObject('enabled', parameters('sgxPlugin'), 'config', createObject())), if(and(variables('createLaw'), parameters('omsagent')), createObject('omsagent', createObject('enabled', and(variables('createLaw'), parameters('omsagent')), 'config', createObject('logAnalyticsWorkspaceResourceID', if(and(variables('createLaw'), parameters('omsagent')), resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name')), json('null'))))), createObject()))]",
    "aks_addons1": "[if(parameters('ingressApplicationGateway'), union(variables('aks_addons'), if(variables('deployAppGw'), createObject('ingressApplicationGateway', createObject('config', createObject('applicationGatewayId', resourceId('Microsoft.Network/applicationGateways', variables('appgwName'))), 'enabled', true())), createObject('ingressApplicationGateway', createObject('enabled', true(), 'config', createObject('applicationGatewayName', variables('appgwName'), 'subnetCIDR', '10.225.0.0/16'))))), variables('aks_addons'))]",
    "aksPrivateDnsZone": "[if(equals(parameters('privateClusterDnsMethod'), 'privateDnsZone'), if(not(empty(parameters('dnsApiPrivateZoneId'))), parameters('dnsApiPrivateZoneId'), 'system'), parameters('privateClusterDnsMethod'))]",
    "managedNATGatewayProfile": {
      "natGatewayProfile": {
        "managedOutboundIPProfile": {
          "count": "[parameters('natGwIpCount')]"
        },
        "idleTimeoutInMinutes": "[parameters('natGwIdleTimeout')]"
      }
    },
    "azureDefenderSecurityProfile": {
      "securityProfile": {
        "defender": {
          "logAnalyticsWorkspaceResourceId": "[if(variables('createLaw'), resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name')), null())]",
          "securityMonitoring": {
            "enabled": "[parameters('defenderForContainers')]"
          }
        }
      }
    },
    "poolName": "[if(equals(parameters('osType'), 'Linux'), parameters('nodePoolName'), take(parameters('nodePoolName'), 6))]",
    "defaultOsDiskSizeGB": "[if(equals(parameters('osType'), 'Linux'), 30, 100)]",
    "uaiNetworkScopeRbac": "[if(and(parameters('enablePrivateCluster'), not(empty(parameters('dnsApiPrivateZoneId')))), 'Vnet', 'Subnet')]",
    "policySetBaseline": "/providers/Microsoft.Authorization/policySetDefinitions/a8640138-9b0a-4a28-b8cb-1666c838647d",
    "policySetRestrictive": "/providers/Microsoft.Authorization/policySetDefinitions/42b8ef37-b724-4e24-bbc8-7a7708edfe00",
    "buildInAKSRBACClusterAdmin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b')]",
    "AlertFrequencyLookup": {
      "Short": {
        "evalFrequency": "PT1M",
        "windowSize": "PT5M"
      },
      "Long": {
        "evalFrequency": "PT15M",
        "windowSize": "PT1H"
      }
    },
    "AlertFrequency": "[variables('AlertFrequencyLookup')[parameters('AksMetricAlertMetricFrequencyModel')]]",
    "aks_law_name": "[format('log-{0}', parameters('resourceName'))]",
    "createLaw": "[or(or(or(or(parameters('omsagent'), variables('deployAppGw')), parameters('azureFirewalls')), parameters('CreateNetworkSecurityGroups')), parameters('defenderForContainers'))]",
    "MonitoringMetricsPublisherRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
    "telemetryId": "[format('3c1e2fc6-1c4b-44f9-8694-25d00ae30a3a-{0}', parameters('location'))]",
    "automationFrequency": "[if(equals(parameters('automationAccountScheduledStartStop'), 'Day'), 'Day', 'Weekday')]"
  },
  "resources": [
    {
      "condition": "[variables('createAksUai')]",
      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
      "apiVersion": "2023-01-31",
      "name": "[format('id-aks-{0}', parameters('resourceName'))]",
      "location": "[parameters('location')]"
    },
    {
      "condition": "[not(empty(parameters('registries_sku')))]",
      "type": "Microsoft.ContainerRegistry/registries",
      "apiVersion": "2023-07-01",
      "name": "[variables('acrName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "[parameters('registries_sku')]"
      },
      "properties": {
        "policies": {
          "trustPolicy": "[if(parameters('enableACRTrustPolicy'), createObject('status', variables('acrContentTrustEnabled'), 'type', 'Notary'), createObject())]",
          "retentionPolicy": "[if(parameters('acrUntaggedRetentionPolicyEnabled'), createObject('status', 'enabled', 'days', parameters('acrUntaggedRetentionPolicy')), null())]"
        },
        "publicNetworkAccess": "[if(parameters('privateLinks'), 'Disabled', 'Enabled')]",
        "zoneRedundancy": "[variables('acrZoneRedundancyEnabled')]"
      }
    },
    {
      "condition": "[and(variables('createLaw'), not(empty(parameters('registries_sku'))))]",
      "type": "Microsoft.Insights/diagnosticSettings",
      "apiVersion": "2021-05-01-preview",
      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', variables('acrName'))]",
      "name": "acrDiags",
      "properties": {
        "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "logs": [
          {
            "category": "ContainerRegistryRepositoryEvents",
            "enabled": true
          },
          {
            "category": "ContainerRegistryLoginEvents",
            "enabled": true
          }
        ],
        "metrics": [
          {
            "category": "AllMetrics",
            "enabled": true,
            "timeGrain": "PT1M"
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerRegistry/registries', variables('acrName'))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]"
      ]
    },
    {
      "condition": "[not(empty(parameters('registries_sku')))]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', variables('acrName'))]",
      "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Acr', variables('AcrPullRole'))]",
      "properties": {
        "roleDefinitionId": "[variables('AcrPullRole')]",
        "principalType": "ServicePrincipal",
        "principalId": "[reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').identityProfile.kubeletidentity.objectId]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerRegistry/registries', variables('acrName'))]",
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[and(not(empty(parameters('registries_sku'))), not(empty(parameters('acrPushRolePrincipalId'))))]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', variables('acrName'))]",
      "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Acr', variables('AcrPushRole'))]",
      "properties": {
        "roleDefinitionId": "[variables('AcrPushRole')]",
        "principalType": "[if(parameters('automatedDeployment'), 'ServicePrincipal', 'User')]",
        "principalId": "[parameters('acrPushRolePrincipalId')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerRegistry/registries', variables('acrName'))]",
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[variables('deployAppGw')]",
      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
      "apiVersion": "2023-01-31",
      "name": "[format('id-appgw-{0}', parameters('resourceName'))]",
      "location": "[parameters('location')]"
    },
    {
      "condition": "[variables('deployAppGw')]",
      "type": "Microsoft.Network/publicIPAddresses",
      "apiVersion": "2023-04-01",
      "name": "[format('pip-agw-{0}', parameters('resourceName'))]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard"
      },
      "zones": "[if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), createArray())]",
      "properties": {
        "publicIPAllocationMethod": "Static"
      }
    },
    {
      "condition": "[variables('deployAppGw')]",
      "type": "Microsoft.Network/applicationGateways",
      "apiVersion": "2023-04-01",
      "name": "[variables('appgwName')]",
      "location": "[parameters('location')]",
      "zones": "[if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), createArray())]",
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
          "[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-appgw-{0}', parameters('resourceName'))))]": {}
        }
      },
      "properties": "[union(createObject('sku', variables('appGWskuObj'), 'sslPolicy', createObject('policyType', 'Predefined', 'policyName', 'AppGwSslPolicy20170401S'), 'webApplicationFirewallConfiguration', if(variables('appGWenableWafFirewall'), variables('appGwFirewallConfigOwasp'), json('null')), 'gatewayIPConfigurations', createArray(createObject('name', 'besubnet', 'properties', createObject('subnet', createObject('id', if(parameters('ingressApplicationGateway'), if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.appGwSubnetId.value, parameters('byoAGWSubnetId')), ''))))), 'frontendIPConfigurations', if(empty(parameters('privateIpApplicationGateway')), array(variables('frontendPublicIpConfig')), concat(array(variables('frontendPublicIpConfig')), array(createObject('properties', createObject('privateIPAllocationMethod', 'Static', 'privateIPAddress', parameters('privateIpApplicationGateway'), 'subnet', createObject('id', if(parameters('ingressApplicationGateway'), if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.appGwSubnetId.value, parameters('byoAGWSubnetId')), ''))), 'name', 'appGatewayPrivateIP')))), 'frontendPorts', createArray(createObject('name', 'appGatewayFrontendPort', 'properties', createObject('port', 80))), 'backendAddressPools', createArray(createObject('name', 'defaultaddresspool')), 'backendHttpSettingsCollection', createArray(createObject('name', 'defaulthttpsetting', 'properties', createObject('port', 80, 'protocol', 'Http', 'cookieBasedAffinity', 'Disabled', 'requestTimeout', 30, 'pickHostNameFromBackendAddress', true()))), 'httpListeners', createArray(createObject('name', 'hlisten', 'properties', createObject('frontendIPConfiguration', createObject('id', if(empty(parameters('privateIpApplicationGateway')), format('{0}/frontendIPConfigurations/appGatewayFrontendIP', variables('appgwResourceId')), format('{0}/frontendIPConfigurations/appGatewayPrivateIP', variables('appgwResourceId')))), 'frontendPort', createObject('id', format('{0}/frontendPorts/appGatewayFrontendPort', variables('appgwResourceId'))), 'protocol', 'Http'))), 'requestRoutingRules', createArray(createObject('name', 'appGwRoutingRuleName', 'properties', createObject('ruleType', 'Basic', 'priority', '1', 'httpListener', createObject('id', format('{0}/httpListeners/hlisten', variables('appgwResourceId'))), 'backendAddressPool', createObject('id', format('{0}/backendAddressPools/defaultaddresspool', variables('appgwResourceId'))), 'backendHttpSettings', createObject('id', format('{0}/backendHttpSettingsCollection/defaulthttpsetting', variables('appgwResourceId'))))))), if(greater(parameters('appGWmaxCount'), 0), createObject('autoscaleConfiguration', createObject('minCapacity', parameters('appGWcount'), 'maxCapacity', parameters('appGWmaxCount'))), createObject()))]",
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-appgw-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Network/publicIPAddresses', format('pip-agw-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64))]"
      ]
    },
    {
      "condition": "[and(parameters('ingressApplicationGateway'), variables('deployAppGw'))]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.Network/applicationGateways/{0}', variables('appgwName'))]",
      "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Agic', variables('contributor'))]",
      "properties": {
        "roleDefinitionId": "[variables('contributor')]",
        "principalType": "ServicePrincipal",
        "principalId": "[reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').addonProfiles.ingressApplicationGateway.identity.objectId]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Network/applicationGateways', variables('appgwName'))]"
      ]
    },
    {
      "condition": "[and(parameters('ingressApplicationGateway'), variables('deployAppGw'))]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Agic', variables('reader'))]",
      "properties": {
        "roleDefinitionId": "[variables('reader')]",
        "principalType": "ServicePrincipal",
        "principalId": "[reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').addonProfiles.ingressApplicationGateway.identity.objectId]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[and(parameters('ingressApplicationGateway'), variables('deployAppGw'))]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', format('id-appgw-{0}', parameters('resourceName')))]",
      "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Agic', variables('managedIdentityOperator'))]",
      "properties": {
        "roleDefinitionId": "[variables('managedIdentityOperator')]",
        "principalType": "ServicePrincipal",
        "principalId": "[reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').addonProfiles.ingressApplicationGateway.identity.objectId]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-appgw-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[and(variables('createLaw'), variables('deployAppGw'))]",
      "type": "Microsoft.Insights/diagnosticSettings",
      "apiVersion": "2021-05-01-preview",
      "scope": "[format('Microsoft.Network/applicationGateways/{0}', variables('appgwName'))]",
      "name": "appgwDiag",
      "properties": {
        "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "logs": [
          {
            "category": "ApplicationGatewayAccessLog",
            "enabled": true
          },
          {
            "category": "ApplicationGatewayPerformanceLog",
            "enabled": true
          },
          {
            "category": "ApplicationGatewayFirewallLog",
            "enabled": true
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "[resourceId('Microsoft.Network/applicationGateways', variables('appgwName'))]"
      ]
    },
    {
      "type": "Microsoft.ContainerService/managedClusters",
      "apiVersion": "2024-01-01",
      "name": "[format('aks-{0}', parameters('resourceName'))]",
      "location": "[parameters('location')]",
      "properties": "[union(createObject('kubernetesVersion', parameters('kubernetesVersion'), 'enableRBAC', true(), 'dnsPrefix', parameters('dnsPrefix'), 'aadProfile', if(parameters('enable_aad'), createObject('managed', true(), 'enableAzureRBAC', parameters('enableAzureRBAC'), 'tenantID', parameters('aad_tenant_id')), null()), 'apiServerAccessProfile', if(not(empty(parameters('authorizedIPRanges'))), createObject('authorizedIPRanges', if(parameters('createNatGateway'), concat(parameters('authorizedIPRanges'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.natGwIpArr.value), parameters('authorizedIPRanges'))), createObject('enablePrivateCluster', parameters('enablePrivateCluster'), 'privateDNSZone', if(parameters('enablePrivateCluster'), variables('aksPrivateDnsZone'), ''), 'enablePrivateClusterPublicFQDN', and(parameters('enablePrivateCluster'), equals(parameters('privateClusterDnsMethod'), 'none')))), 'agentPoolProfiles', if(parameters('JustUseSystemPool'), array(createObject('name', if(parameters('JustUseSystemPool'), parameters('nodePoolName'), 'npsystem'), 'vmSize', parameters('agentVMSize'), 'count', parameters('agentCount'), 'mode', 'System', 'osType', 'Linux', 'osSku', if(equals(parameters('osSKU'), 'AzureLinux'), parameters('osSKU'), 'Ubuntu'), 'maxPods', 30, 'type', 'VirtualMachineScaleSets', 'vnetSubnetID', if(not(empty(if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksSubnetId.value, parameters('byoAKSSubnetId')))), if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksSubnetId.value, parameters('byoAKSSubnetId')), null()), 'podSubnetID', if(not(empty(if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksPodSubnetId.value, parameters('byoAKSPodSubnetId')))), if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksPodSubnetId.value, parameters('byoAKSPodSubnetId')), null()), 'upgradeSettings', createObject('maxSurge', '33%'), 'nodeTaints', createArray(if(parameters('JustUseSystemPool'), '', 'CriticalAddonsOnly=true:NoSchedule')))), concat(array(union(createObject('name', if(parameters('JustUseSystemPool'), parameters('nodePoolName'), 'npsystem'), 'vmSize', parameters('agentVMSize'), 'count', parameters('agentCount'), 'mode', 'System', 'osType', 'Linux', 'osSku', if(equals(parameters('osSKU'), 'AzureLinux'), parameters('osSKU'), 'Ubuntu'), 'maxPods', 30, 'type', 'VirtualMachineScaleSets', 'vnetSubnetID', if(not(empty(if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksSubnetId.value, parameters('byoAKSSubnetId')))), if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksSubnetId.value, parameters('byoAKSSubnetId')), null()), 'podSubnetID', if(not(empty(if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksPodSubnetId.value, parameters('byoAKSPodSubnetId')))), if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksPodSubnetId.value, parameters('byoAKSPodSubnetId')), null()), 'upgradeSettings', createObject('maxSurge', '33%'), 'nodeTaints', createArray(if(parameters('JustUseSystemPool'), '', 'CriticalAddonsOnly=true:NoSchedule'))), if(and(equals(parameters('SystemPoolType'), 'Custom'), not(equals(parameters('SystemPoolCustomPreset'), createObject()))), parameters('SystemPoolCustomPreset'), variables('systemPoolPresets')[parameters('SystemPoolType')]))))), 'workloadAutoScalerProfile', createObject('keda', createObject('enabled', parameters('kedaAddon'))), 'networkProfile', createObject('loadBalancerSku', 'standard', 'networkPlugin', parameters('networkPlugin'), 'networkPolicy', parameters('networkPolicy'), 'networkPluginMode', if(equals(parameters('networkPlugin'), 'azure'), parameters('networkPluginMode'), ''), 'podCidr', if(or(or(equals(parameters('networkPlugin'), 'kubenet'), equals(parameters('networkPluginMode'), 'Overlay')), parameters('cniDynamicIpAllocation')), parameters('podCidr'), json('null')), 'serviceCidr', parameters('serviceCidr'), 'dnsServiceIP', parameters('dnsServiceIP'), 'outboundType', variables('outboundTrafficType'), 'networkDataplane', if(equals(parameters('networkPlugin'), 'azure'), parameters('networkDataplane'), '')), 'disableLocalAccounts', and(parameters('AksDisableLocalAccounts'), parameters('enable_aad')), 'autoUpgradeProfile', createObject('upgradeChannel', parameters('upgradeChannel')), 'addonProfiles', if(not(empty(variables('aks_addons1'))), variables('aks_addons1'), variables('aks_addons')), 'autoScalerProfile', if(variables('autoScale'), parameters('AutoscaleProfile'), createObject()), 'oidcIssuerProfile', createObject('enabled', parameters('oidcIssuer')), 'securityProfile', createObject('workloadIdentity', createObject('enabled', parameters('workloadIdentity'))), 'ingressProfile', createObject('webAppRouting', createObject('enabled', parameters('warIngressNginx'))), 'storageProfile', createObject('blobCSIDriver', createObject('enabled', parameters('blobCSIDriver')), 'diskCSIDriver', createObject('enabled', parameters('diskCSIDriver')), 'fileCSIDriver', createObject('enabled', parameters('fileCSIDriver')))), if(equals(variables('outboundTrafficType'), 'managedNATGateway'), variables('managedNATGatewayProfile'), createObject()), if(and(parameters('defenderForContainers'), variables('createLaw')), variables('azureDefenderSecurityProfile'), createObject()), if(or(variables('keyVaultKmsCreateAndPrereqs'), not(empty(parameters('keyVaultKmsByoKeyId')))), createObject('securityProfile', createObject('azureKeyVaultKms', createObject('enabled', or(variables('keyVaultKmsCreateAndPrereqs'), not(empty(parameters('keyVaultKmsByoKeyId')))), 'keyId', if(variables('keyVaultKmsCreateAndPrereqs'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKmsKeys-{1}', deployment().name, parameters('resourceName')), 64)), '2022-09-01').outputs.keyVaultKmsKeyUri.value, if(not(empty(parameters('keyVaultKmsByoKeyId'))), parameters('keyVaultKmsByoKeyId'), '')), 'keyVaultNetworkAccess', if(parameters('privateLinks'), 'private', 'public'), 'keyVaultResourceId', if(and(parameters('privateLinks'), not(empty(parameters('keyVaultKmsByoKeyId')))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('keyVaultKmsByoRG')), 'Microsoft.KeyVault/vaults', variables('keyVaultKmsByoName')), '')))), createObject()), if(not(empty(parameters('managedNodeResourceGroup'))), createObject('nodeResourceGroup', parameters('managedNodeResourceGroup')), createObject()), if(not(empty(parameters('serviceMeshProfile'))), createObject('serviceMeshProfile', variables('serviceMeshProfileObj')), createObject()))]",
      "identity": "[if(variables('createAksUai'), createObject('type', 'UserAssigned', 'userAssignedIdentities', createObject(format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName')))), createObject())), if(not(empty(parameters('byoUaiName'))), createObject('type', 'UserAssigned', 'userAssignedIdentities', createObject(format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('byoUaiName'))), createObject())), createObject('type', 'SystemAssigned')))]",
      "sku": {
        "name": "Base",
        "tier": "[variables('akssku')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Network/applicationGateways', variables('appgwName'))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKmsKeys-{1}', deployment().name, parameters('resourceName')), 64))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-addPrivateK8sApiDnsContributor', deployment().name), 64))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKmsRbac-waits-{1}', deployment().name, parameters('resourceName')), 64))]"
      ]
    },
    {
      "condition": "[not(empty(parameters('azurepolicy')))]",
      "type": "Microsoft.Authorization/policyAssignments",
      "apiVersion": "2022-06-01",
      "name": "[format('{0}-{1}', parameters('resourceName'), parameters('azurePolicyInitiative'))]",
      "location": "[parameters('location')]",
      "properties": {
        "policyDefinitionId": "[if(equals(parameters('azurePolicyInitiative'), 'Baseline'), variables('policySetBaseline'), variables('policySetRestrictive'))]",
        "parameters": {
          "excludedNamespaces": {
            "value": [
              "kube-system",
              "gatekeeper-system",
              "azure-arc",
              "cluster-baseline-setting"
            ]
          },
          "effect": {
            "value": "[parameters('azurepolicy')]"
          }
        },
        "metadata": {
          "assignedBy": "Aks Construction"
        },
        "displayName": "[format('Kubernetes cluster pod security {0} standards for Linux-based workloads', parameters('azurePolicyInitiative'))]",
        "description": "As per: https://github.com/Azure/azure-policy/blob/master/built-in-policies/policySetDefinitions/Kubernetes/"
      }
    },
    {
      "condition": "[and(parameters('enableAzureRBAC'), not(empty(parameters('adminPrincipalId'))))]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.ContainerService/managedClusters/{0}', format('aks-{0}', parameters('resourceName')))]",
      "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'aksadmin', variables('buildInAKSRBACClusterAdmin'))]",
      "properties": {
        "roleDefinitionId": "[variables('buildInAKSRBACClusterAdmin')]",
        "principalType": "[if(parameters('automatedDeployment'), 'ServicePrincipal', 'User')]",
        "principalId": "[parameters('adminPrincipalId')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[parameters('fluxGitOpsAddon')]",
      "type": "Microsoft.KubernetesConfiguration/extensions",
      "apiVersion": "2022-11-01",
      "scope": "[format('Microsoft.ContainerService/managedClusters/{0}', format('aks-{0}', parameters('resourceName')))]",
      "name": "flux",
      "properties": {
        "extensionType": "microsoft.flux",
        "autoUpgradeMinorVersion": true,
        "releaseTrain": "Stable",
        "scope": {
          "cluster": {
            "releaseNamespace": "flux-system"
          }
        },
        "configurationProtectedSettings": {}
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[extensionResourceId(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Microsoft.KubernetesConfiguration/extensions', 'dapr')]"
      ]
    },
    {
      "condition": "[parameters('daprAddon')]",
      "type": "Microsoft.KubernetesConfiguration/extensions",
      "apiVersion": "2022-11-01",
      "scope": "[format('Microsoft.ContainerService/managedClusters/{0}', format('aks-{0}', parameters('resourceName')))]",
      "name": "dapr",
      "properties": {
        "extensionType": "Microsoft.Dapr",
        "autoUpgradeMinorVersion": true,
        "releaseTrain": "Stable",
        "configurationSettings": {
          "global.ha.enabled": "[format('{0}', parameters('daprAddonHA'))]"
        },
        "scope": {
          "cluster": {
            "releaseNamespace": "dapr-system"
          }
        },
        "configurationProtectedSettings": {}
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[and(variables('createLaw'), parameters('omsagent'))]",
      "type": "Microsoft.Insights/diagnosticSettings",
      "apiVersion": "2021-05-01-preview",
      "scope": "[format('Microsoft.ContainerService/managedClusters/{0}', format('aks-{0}', parameters('resourceName')))]",
      "name": "aksDiags",
      "properties": {
        "copy": [
          {
            "name": "logs",
            "count": "[length(parameters('AksDiagCategories'))]",
            "input": {
              "category": "[parameters('AksDiagCategories')[copyIndex('logs')]]",
              "enabled": true
            }
          }
        ],
        "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "metrics": [
          {
            "category": "AllMetrics",
            "enabled": true
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]"
      ]
    },
    {
      "condition": "[and(and(variables('createLaw'), parameters('omsagent')), parameters('enableSysLog'))]",
      "type": "Microsoft.Insights/dataCollectionRules",
      "apiVersion": "2022-06-01",
      "name": "[format('MSCI-{0}-{1}', parameters('location'), format('aks-{0}', parameters('resourceName')))]",
      "location": "[parameters('location')]",
      "kind": "Linux",
      "properties": {
        "dataFlows": [
          {
            "destinations": [
              "ciworkspace"
            ],
            "streams": [
              "Microsoft-Syslog",
              "Microsoft-ContainerInsights-Group-Default"
            ]
          }
        ],
        "dataSources": {
          "extensions": [
            {
              "streams": [
                "Microsoft-ContainerInsights-Group-Default"
              ],
              "extensionName": "ContainerInsights",
              "extensionSettings": {
                "dataCollectionSettings": {
                  "interval": "1m",
                  "namespaceFilteringMode": "Off"
                }
              },
              "name": "ContainerInsightsExtension"
            }
          ],
          "syslog": [
            {
              "facilityNames": [
                "auth",
                "authpriv",
                "cron",
                "daemon",
                "mark",
                "kern",
                "local0",
                "local1",
                "local2",
                "local3",
                "local4",
                "local5",
                "local6",
                "local7",
                "lpr",
                "mail",
                "news",
                "syslog",
                "user",
                "uucp"
              ],
              "logLevels": [
                "Debug",
                "Info",
                "Notice",
                "Warning",
                "Error",
                "Critical",
                "Alert",
                "Emergency"
              ],
              "name": "sysLogsDataSource",
              "streams": [
                "Microsoft-Syslog"
              ]
            }
          ]
        },
        "destinations": {
          "logAnalytics": [
            {
              "name": "ciworkspace",
              "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]"
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]"
      ]
    },
    {
      "condition": "[and(and(variables('createLaw'), parameters('omsagent')), parameters('enableSysLog'))]",
      "type": "Microsoft.Insights/dataCollectionRuleAssociations",
      "apiVersion": "2022-06-01",
      "scope": "[format('Microsoft.ContainerService/managedClusters/{0}', format('aks-{0}', parameters('resourceName')))]",
      "name": "[format('{0}-{1}-association', format('aks-{0}', parameters('resourceName')), variables('aks_law_name'))]",
      "properties": {
        "dataCollectionRuleId": "[resourceId('Microsoft.Insights/dataCollectionRules', format('MSCI-{0}-{1}', parameters('location'), format('aks-{0}', parameters('resourceName'))))]",
        "description": "Association of data collection rule. Deleting this association will break the data collection for this AKS Cluster."
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "[resourceId('Microsoft.Insights/dataCollectionRules', format('MSCI-{0}-{1}', parameters('location'), format('aks-{0}', parameters('resourceName'))))]"
      ]
    },
    {
      "condition": "[variables('createLaw')]",
      "type": "Microsoft.OperationalInsights/workspaces",
      "apiVersion": "2022-10-01",
      "name": "[variables('aks_law_name')]",
      "location": "[parameters('location')]",
      "properties": "[union(createObject('retentionInDays', parameters('retentionInDays'), 'sku', createObject('name', 'PerGB2018')), if(greater(parameters('logDataCap'), 0), createObject('workspaceCapping', createObject('dailyQuotaGb', parameters('logDataCap'))), createObject()))]"
    },
    {
      "condition": "[parameters('containerLogsV2BasicLogs')]",
      "type": "Microsoft.OperationalInsights/workspaces/tables",
      "apiVersion": "2022-10-01",
      "name": "[format('{0}/{1}', variables('aks_law_name'), 'ContainerLogV2')]",
      "properties": {
        "plan": "Basic"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]"
      ]
    },
    {
      "condition": "[parameters('omsagent')]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.ContainerService/managedClusters/{0}', format('aks-{0}', parameters('resourceName')))]",
      "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'omsagent', variables('MonitoringMetricsPublisherRole'))]",
      "properties": {
        "roleDefinitionId": "[variables('MonitoringMetricsPublisherRole')]",
        "principalId": "[reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').addonProfiles.omsagent.identity.objectId]",
        "principalType": "ServicePrincipal"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[parameters('createEventGrid')]",
      "type": "Microsoft.EventGrid/systemTopics",
      "apiVersion": "2023-06-01-preview",
      "name": "[format('evgt-{0}', format('aks-{0}', parameters('resourceName')))]",
      "location": "[parameters('location')]",
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "source": "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "topicType": "Microsoft.ContainerService.ManagedClusters"
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[and(variables('createLaw'), parameters('createEventGrid'))]",
      "type": "Microsoft.Insights/diagnosticSettings",
      "apiVersion": "2021-05-01-preview",
      "scope": "[format('Microsoft.EventGrid/systemTopics/{0}', format('evgt-{0}', format('aks-{0}', parameters('resourceName'))))]",
      "name": "eventGridDiags",
      "properties": {
        "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "logs": [
          {
            "category": "DeliveryFailures",
            "enabled": true
          }
        ],
        "metrics": [
          {
            "category": "AllMetrics",
            "enabled": true
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "[resourceId('Microsoft.EventGrid/systemTopics', format('evgt-{0}', format('aks-{0}', parameters('resourceName'))))]"
      ]
    },
    {
      "condition": "[parameters('enableTelemetry')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2023-07-01",
      "name": "[variables('telemetryId')]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
          "contentVersion": "1.0.0.0",
          "resources": {}
        }
      }
    },
    {
      "condition": "[and(not(empty(parameters('byoAKSSubnetId'))), variables('createAksUai'))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-addAksNetContributor', deployment().name), 64)]",
      "resourceGroup": "[variables('existingAksVnetRG')]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "byoAKSSubnetId": {
            "value": "[parameters('byoAKSSubnetId')]"
          },
          "byoAKSPodSubnetId": {
            "value": "[parameters('byoAKSPodSubnetId')]"
          },
          "user_identity_principalId": "[if(variables('createAksUai'), createObject('value', reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName'))), '2023-01-31').principalId), createObject('value', ''))]",
          "rbacAssignmentScope": {
            "value": "[variables('uaiNetworkScopeRbac')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "9140043254340848035"
            }
          },
          "parameters": {
            "byoAKSSubnetId": {
              "type": "string"
            },
            "byoAKSPodSubnetId": {
              "type": "string"
            },
            "user_identity_principalId": {
              "type": "string"
            },
            "rbacAssignmentScope": {
              "type": "string",
              "defaultValue": "Subnet",
              "allowedValues": [
                "Subnet",
                "Vnet"
              ]
            }
          },
          "variables": {
            "networkContributorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
            "existingAksPodSubnetName": "[if(not(empty(parameters('byoAKSPodSubnetId'))), split(parameters('byoAKSPodSubnetId'), '/')[10], '')]",
            "existingAksSubnetName": "[if(not(empty(parameters('byoAKSSubnetId'))), split(parameters('byoAKSSubnetId'), '/')[10], '')]",
            "existingAksVnetName": "[if(not(empty(parameters('byoAKSSubnetId'))), split(parameters('byoAKSSubnetId'), '/')[8], '')]"
          },
          "resources": [
            {
              "condition": "[equals(parameters('rbacAssignmentScope'), 'subnet')]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.Network/virtualNetworks/{0}/subnets/{1}', variables('existingAksVnetName'), variables('existingAksSubnetName'))]",
              "name": "[guid(parameters('user_identity_principalId'), variables('networkContributorRole'), variables('existingAksSubnetName'))]",
              "properties": {
                "roleDefinitionId": "[variables('networkContributorRole')]",
                "principalId": "[parameters('user_identity_principalId')]",
                "principalType": "ServicePrincipal"
              }
            },
            {
              "condition": "[equals(parameters('rbacAssignmentScope'), 'subnet')]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.Network/virtualNetworks/{0}/subnets/{1}', variables('existingAksVnetName'), variables('existingAksPodSubnetName'))]",
              "name": "[guid(parameters('user_identity_principalId'), variables('networkContributorRole'), variables('existingAksPodSubnetName'))]",
              "properties": {
                "roleDefinitionId": "[variables('networkContributorRole')]",
                "principalId": "[parameters('user_identity_principalId')]",
                "principalType": "ServicePrincipal"
              }
            },
            {
              "condition": "[not(equals(parameters('rbacAssignmentScope'), 'subnet'))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.Network/virtualNetworks/{0}', variables('existingAksVnetName'))]",
              "name": "[guid(parameters('user_identity_principalId'), variables('networkContributorRole'), variables('existingAksVnetName'))]",
              "properties": {
                "roleDefinitionId": "[variables('networkContributorRole')]",
                "principalId": "[parameters('user_identity_principalId')]",
                "principalType": "ServicePrincipal"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[parameters('custom_vnet')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-network', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "resourceName": {
            "value": "[parameters('resourceName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "networkPluginIsKubenet": {
            "value": "[equals(parameters('networkPlugin'), 'kubenet')]"
          },
          "vnetAddressPrefix": {
            "value": "[parameters('vnetAddressPrefix')]"
          },
          "vnetPodAddressPrefix": "[if(parameters('cniDynamicIpAllocation'), createObject('value', parameters('podCidr')), createObject('value', ''))]",
          "cniDynamicIpAllocation": {
            "value": "[parameters('cniDynamicIpAllocation')]"
          },
          "aksPrincipleId": "[if(not(empty(parameters('byoUaiName'))), createObject('value', reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('byoUaiName')), '2023-01-31').principalId), if(variables('createAksUai'), createObject('value', reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName'))), '2023-01-31').principalId), createObject('value', '')))]",
          "vnetAksSubnetAddressPrefix": {
            "value": "[parameters('vnetAksSubnetAddressPrefix')]"
          },
          "ingressApplicationGateway": {
            "value": "[parameters('ingressApplicationGateway')]"
          },
          "vnetAppGatewaySubnetAddressPrefix": {
            "value": "[parameters('vnetAppGatewaySubnetAddressPrefix')]"
          },
          "azureFirewalls": {
            "value": "[parameters('azureFirewalls')]"
          },
          "azureFirewallSku": {
            "value": "[parameters('azureFirewallSku')]"
          },
          "vnetFirewallSubnetAddressPrefix": {
            "value": "[parameters('vnetFirewallSubnetAddressPrefix')]"
          },
          "vnetFirewallManagementSubnetAddressPrefix": {
            "value": "[parameters('vnetFirewallManagementSubnetAddressPrefix')]"
          },
          "privateLinks": {
            "value": "[parameters('privateLinks')]"
          },
          "privateLinkSubnetAddressPrefix": {
            "value": "[parameters('privateLinkSubnetAddressPrefix')]"
          },
          "privateLinkAcrId": "[if(and(parameters('privateLinks'), not(empty(parameters('registries_sku')))), createObject('value', resourceId('Microsoft.ContainerRegistry/registries', variables('acrName'))), createObject('value', ''))]",
          "privateLinkAkvId": "[if(and(parameters('privateLinks'), parameters('keyVaultCreate')), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultApps', deployment().name), 64)), '2022-09-01').outputs.keyVaultId.value), createObject('value', ''))]",
          "acrPrivatePool": {
            "value": "[parameters('acrPrivatePool')]"
          },
          "acrAgentPoolSubnetAddressPrefix": {
            "value": "[parameters('acrAgentPoolSubnetAddressPrefix')]"
          },
          "bastion": {
            "value": "[parameters('bastion')]"
          },
          "bastionSubnetAddressPrefix": {
            "value": "[parameters('bastionSubnetAddressPrefix')]"
          },
          "availabilityZones": {
            "value": "[parameters('availabilityZones')]"
          },
          "workspaceName": "[if(variables('createLaw'), createObject('value', variables('aks_law_name')), createObject('value', ''))]",
          "workspaceResourceGroupName": "[if(variables('createLaw'), createObject('value', resourceGroup().name), createObject('value', ''))]",
          "networkSecurityGroups": {
            "value": "[parameters('CreateNetworkSecurityGroups')]"
          },
          "CreateNsgFlowLogs": {
            "value": "[and(parameters('CreateNetworkSecurityGroups'), parameters('CreateNetworkSecurityGroupFlowLogs'))]"
          },
          "ingressApplicationGatewayPublic": {
            "value": "[empty(parameters('privateIpApplicationGateway'))]"
          },
          "natGateway": {
            "value": "[parameters('createNatGateway')]"
          },
          "natGatewayIdleTimeoutMins": {
            "value": "[parameters('natGwIdleTimeout')]"
          },
          "natGatewayPublicIps": {
            "value": "[parameters('natGwIpCount')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "4012224702172118079"
            }
          },
          "parameters": {
            "resourceName": {
              "type": "string"
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]"
            },
            "networkPluginIsKubenet": {
              "type": "bool",
              "defaultValue": false
            },
            "aksPrincipleId": {
              "type": "string",
              "defaultValue": ""
            },
            "vnetAddressPrefix": {
              "type": "string"
            },
            "vnetAksSubnetAddressPrefix": {
              "type": "string"
            },
            "cniDynamicIpAllocation": {
              "type": "bool",
              "defaultValue": false
            },
            "vnetPodAddressPrefix": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Provide the vnetPodAddressPrefix when using cniDynamicIpAllocation"
              }
            },
            "workspaceName": {
              "type": "string",
              "defaultValue": ""
            },
            "workspaceResourceGroupName": {
              "type": "string",
              "defaultValue": ""
            },
            "networkSecurityGroups": {
              "type": "bool",
              "defaultValue": true
            },
            "azureFirewalls": {
              "type": "bool",
              "defaultValue": false
            },
            "azureFirewallSku": {
              "type": "string",
              "defaultValue": "Basic"
            },
            "azureFirewallsManagementSeperation": {
              "type": "bool",
              "defaultValue": "[and(parameters('azureFirewalls'), equals(parameters('azureFirewallSku'), 'Basic'))]"
            },
            "vnetFirewallSubnetAddressPrefix": {
              "type": "string",
              "defaultValue": ""
            },
            "vnetFirewallManagementSubnetAddressPrefix": {
              "type": "string",
              "defaultValue": ""
            },
            "ingressApplicationGateway": {
              "type": "bool",
              "defaultValue": false
            },
            "ingressApplicationGatewayPublic": {
              "type": "bool",
              "defaultValue": false
            },
            "vnetAppGatewaySubnetAddressPrefix": {
              "type": "string",
              "defaultValue": ""
            },
            "privateLinks": {
              "type": "bool",
              "defaultValue": false
            },
            "privateLinkSubnetAddressPrefix": {
              "type": "string",
              "defaultValue": ""
            },
            "privateLinkAcrId": {
              "type": "string",
              "defaultValue": ""
            },
            "privateLinkAkvId": {
              "type": "string",
              "defaultValue": ""
            },
            "acrPrivatePool": {
              "type": "bool",
              "defaultValue": false
            },
            "acrAgentPoolSubnetAddressPrefix": {
              "type": "string",
              "defaultValue": ""
            },
            "natGateway": {
              "type": "bool",
              "defaultValue": false
            },
            "natGatewayPublicIps": {
              "type": "int",
              "defaultValue": 2
            },
            "natGatewayIdleTimeoutMins": {
              "type": "int",
              "defaultValue": 30
            },
            "bastion": {
              "type": "bool",
              "defaultValue": false
            },
            "bastionSubnetAddressPrefix": {
              "type": "string",
              "defaultValue": ""
            },
            "availabilityZones": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Used by the Bastion Public IP"
              }
            },
            "bastionHostName": {
              "type": "string",
              "defaultValue": "[format('bas-{0}', parameters('resourceName'))]"
            },
            "bastionSku": {
              "type": "string",
              "defaultValue": "Standard",
              "allowedValues": [
                "Standard",
                "Basic"
              ]
            },
            "CreateNsgFlowLogs": {
              "type": "bool",
              "defaultValue": false
            }
          },
          "variables": {
            "bastion_subnet_name": "AzureBastionSubnet",
            "bastion_baseSubnet": {
              "name": "[variables('bastion_subnet_name')]",
              "properties": {
                "addressPrefix": "[parameters('bastionSubnetAddressPrefix')]"
              }
            },
            "NatAvailabilityZone": "[array(first(parameters('availabilityZones')))]",
            "acrpool_subnet_name": "acrpool-sn",
            "acrpool_baseSubnet": {
              "name": "[variables('acrpool_subnet_name')]",
              "properties": {
                "addressPrefix": "[parameters('acrAgentPoolSubnetAddressPrefix')]"
              }
            },
            "private_link_subnet_name": "privatelinks-sn",
            "private_link_baseSubnet": {
              "name": "[variables('private_link_subnet_name')]",
              "properties": {
                "addressPrefix": "[parameters('privateLinkSubnetAddressPrefix')]",
                "privateEndpointNetworkPolicies": "Disabled",
                "privateLinkServiceNetworkPolicies": "Enabled"
              }
            },
            "appgw_subnet_name": "appgw-sn",
            "appgw_baseSubnet": {
              "name": "[variables('appgw_subnet_name')]",
              "properties": {
                "addressPrefix": "[parameters('vnetAppGatewaySubnetAddressPrefix')]"
              }
            },
            "fw_subnet_name": "AzureFirewallSubnet",
            "fw_subnet": {
              "name": "[variables('fw_subnet_name')]",
              "properties": {
                "addressPrefix": "[parameters('vnetFirewallSubnetAddressPrefix')]"
              }
            },
            "fwmgmt_subnet_name": "AzureFirewallManagementSubnet",
            "fwmgmt_subnet": {
              "name": "[variables('fwmgmt_subnet_name')]",
              "properties": {
                "addressPrefix": "[parameters('vnetFirewallManagementSubnetAddressPrefix')]"
              }
            },
            "routeFwTableName": "[format('rt-afw-{0}', parameters('resourceName'))]",
            "contributorRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
            "aks_subnet_name": "aks-sn",
            "aks_baseSubnet": {
              "name": "[variables('aks_subnet_name')]",
              "properties": "[union(createObject('addressPrefix', parameters('vnetAksSubnetAddressPrefix')), if(parameters('privateLinks'), createObject('privateEndpointNetworkPolicies', 'Disabled', 'privateLinkServiceNetworkPolicies', 'Enabled'), createObject()), if(parameters('natGateway'), createObject('natGateway', createObject('id', resourceId('Microsoft.Network/natGateways', variables('natGwName')))), createObject()), if(parameters('azureFirewalls'), createObject('routeTable', createObject('id', resourceId('Microsoft.Network/routeTables', variables('routeFwTableName')))), createObject()))]"
            },
            "aks_podSubnet_name": "aks-pods-sn",
            "aks_podSubnet": {
              "name": "[variables('aks_podSubnet_name')]",
              "properties": "[union(createObject('addressPrefix', parameters('vnetPodAddressPrefix')), if(parameters('privateLinks'), createObject('privateEndpointNetworkPolicies', 'Disabled', 'privateLinkServiceNetworkPolicies', 'Enabled'), createObject()), if(parameters('natGateway'), createObject('natGateway', createObject('id', resourceId('Microsoft.Network/natGateways', variables('natGwName')))), createObject()), if(parameters('azureFirewalls'), createObject('routeTable', createObject('id', resourceId('Microsoft.Network/routeTables', variables('routeFwTableName')))), createObject()))]"
            },
            "vnetName": "[format('vnet-{0}', parameters('resourceName'))]",
            "privateLinkAcrName": "[format('pl-acr-{0}', parameters('resourceName'))]",
            "privateDnsAcrLinkName": "[format('vnet-dnscr-{0}', parameters('resourceName'))]",
            "privateLinkAkvName": "[format('pl-akv-{0}', parameters('resourceName'))]",
            "privateDnsAkvLinkName": "[format('vnet-dnscr-{0}', parameters('resourceName'))]",
            "publicIpAddressName": "[format('pip-{0}', parameters('bastionHostName'))]",
            "flowLogStorageName": "[take(replace(toLower(format('stflow{0}{1}', parameters('resourceName'), uniqueString(resourceGroup().id, parameters('resourceName')))), '-', ''), 24)]",
            "natGwName": "[format('ng-{0}', parameters('resourceName'))]"
          },
          "resources": [
            {
              "condition": "[parameters('azureFirewalls')]",
              "type": "Microsoft.Network/routeTables",
              "apiVersion": "2023-04-01",
              "name": "[variables('routeFwTableName')]",
              "location": "[parameters('location')]",
              "properties": {
                "routes": [
                  {
                    "name": "AKSNodesEgress",
                    "properties": {
                      "addressPrefix": "0.0.0.0/0",
                      "nextHopType": "VirtualAppliance",
                      "nextHopIpAddress": "[if(parameters('azureFirewalls'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-calcAzFwIp', deployment().name), 64)), '2022-09-01').outputs.FirewallPrivateIp.value, null())]"
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-calcAzFwIp', deployment().name), 64))]"
              ]
            },
            {
              "condition": "[and(and(parameters('azureFirewalls'), not(empty(parameters('aksPrincipleId')))), parameters('networkPluginIsKubenet'))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.Network/routeTables/{0}', variables('routeFwTableName'))]",
              "name": "[guid(resourceId('Microsoft.Network/routeTables', variables('routeFwTableName')), parameters('aksPrincipleId'), variables('contributorRoleId'))]",
              "properties": {
                "principalId": "[parameters('aksPrincipleId')]",
                "roleDefinitionId": "[variables('contributorRoleId')]",
                "principalType": "ServicePrincipal"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/routeTables', variables('routeFwTableName'))]"
              ],
              "metadata": {
                "description": "Required for kubenet networking."
              }
            },
            {
              "type": "Microsoft.Network/virtualNetworks",
              "apiVersion": "2023-04-01",
              "name": "[variables('vnetName')]",
              "location": "[parameters('location')]",
              "properties": {
                "addressSpace": {
                  "addressPrefixes": [
                    "[parameters('vnetAddressPrefix')]"
                  ]
                },
                "subnets": "[union(array(if(parameters('networkSecurityGroups'), union(variables('aks_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAks', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('aks_baseSubnet'))), if(parameters('cniDynamicIpAllocation'), array(if(parameters('networkSecurityGroups'), union(variables('aks_podSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAks', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('aks_podSubnet'))), createArray()), if(parameters('azureFirewalls'), array(variables('fw_subnet')), createArray()), if(parameters('privateLinks'), array(if(and(parameters('privateLinks'), parameters('networkSecurityGroups')), union(variables('private_link_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgPrivateLinks', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('private_link_baseSubnet'))), createArray()), if(parameters('acrPrivatePool'), array(if(and(parameters('privateLinks'), parameters('networkSecurityGroups')), union(variables('acrpool_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAcrPool', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('acrpool_baseSubnet'))), createArray()), if(parameters('bastion'), array(if(and(parameters('bastion'), parameters('networkSecurityGroups')), union(variables('bastion_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgBastion', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('bastion_baseSubnet'))), createArray()), if(parameters('ingressApplicationGateway'), array(if(and(parameters('ingressApplicationGateway'), parameters('networkSecurityGroups')), union(variables('appgw_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAppGw', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('appgw_baseSubnet'))), createArray()), if(parameters('azureFirewallsManagementSeperation'), array(variables('fwmgmt_subnet')), createArray()))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/natGateways', variables('natGwName'))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAcrPool', deployment().name), 64))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAks', deployment().name), 64))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAppGw', deployment().name), 64))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgBastion', deployment().name), 64))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgPrivateLinks', deployment().name), 64))]",
                "[resourceId('Microsoft.Network/routeTables', variables('routeFwTableName'))]"
              ]
            },
            {
              "condition": "[not(empty(parameters('privateLinkAcrId')))]",
              "type": "Microsoft.Network/privateEndpoints",
              "apiVersion": "2023-04-01",
              "name": "[variables('privateLinkAcrName')]",
              "location": "[parameters('location')]",
              "properties": {
                "customNetworkInterfaceName": "[format('nic-{0}', variables('privateLinkAcrName'))]",
                "privateLinkServiceConnections": [
                  {
                    "name": "Acr-Connection",
                    "properties": {
                      "privateLinkServiceId": "[parameters('privateLinkAcrId')]",
                      "groupIds": [
                        "registry"
                      ]
                    }
                  }
                ],
                "subnet": {
                  "id": "[format('{0}/subnets/{1}', resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), variables('private_link_subnet_name'))]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
              ]
            },
            {
              "condition": "[not(empty(parameters('privateLinkAcrId')))]",
              "type": "Microsoft.Network/privateDnsZones",
              "apiVersion": "2020-09-01",
              "name": "privatelink.azurecr.io",
              "location": "global"
            },
            {
              "condition": "[not(empty(parameters('privateLinkAcrId')))]",
              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
              "apiVersion": "2020-09-01",
              "name": "[format('{0}/{1}', 'privatelink.azurecr.io', variables('privateDnsAcrLinkName'))]",
              "location": "global",
              "properties": {
                "registrationEnabled": false,
                "virtualNetwork": {
                  "id": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.azurecr.io')]",
                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
              ]
            },
            {
              "condition": "[not(empty(parameters('privateLinkAcrId')))]",
              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
              "apiVersion": "2023-04-01",
              "name": "[format('{0}/{1}', variables('privateLinkAcrName'), 'default')]",
              "properties": {
                "privateDnsZoneConfigs": [
                  {
                    "name": "vnet-pl-acr",
                    "properties": {
                      "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.azurecr.io')]"
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.azurecr.io')]",
                "[resourceId('Microsoft.Network/privateEndpoints', variables('privateLinkAcrName'))]"
              ]
            },
            {
              "condition": "[not(empty(parameters('privateLinkAkvId')))]",
              "type": "Microsoft.Network/privateEndpoints",
              "apiVersion": "2023-04-01",
              "name": "[variables('privateLinkAkvName')]",
              "location": "[parameters('location')]",
              "properties": {
                "customNetworkInterfaceName": "[format('nic-{0}', variables('privateLinkAkvName'))]",
                "privateLinkServiceConnections": [
                  {
                    "name": "Akv-Connection",
                    "properties": {
                      "privateLinkServiceId": "[parameters('privateLinkAkvId')]",
                      "groupIds": [
                        "vault"
                      ]
                    }
                  }
                ],
                "subnet": {
                  "id": "[format('{0}/subnets/{1}', resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), variables('private_link_subnet_name'))]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
              ]
            },
            {
              "condition": "[not(empty(parameters('privateLinkAkvId')))]",
              "type": "Microsoft.Network/privateDnsZones",
              "apiVersion": "2020-09-01",
              "name": "privatelink.vaultcore.azure.net",
              "location": "global"
            },
            {
              "condition": "[not(empty(parameters('privateLinkAkvId')))]",
              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
              "apiVersion": "2020-09-01",
              "name": "[format('{0}/{1}', 'privatelink.vaultcore.azure.net', variables('privateDnsAkvLinkName'))]",
              "location": "global",
              "properties": {
                "registrationEnabled": false,
                "virtualNetwork": {
                  "id": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.vaultcore.azure.net')]",
                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
              ]
            },
            {
              "condition": "[not(empty(parameters('privateLinkAkvId')))]",
              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
              "apiVersion": "2023-04-01",
              "name": "[format('{0}/{1}', variables('privateLinkAkvName'), 'default')]",
              "properties": {
                "privateDnsZoneConfigs": [
                  {
                    "name": "vnet-pl-akv",
                    "properties": {
                      "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.vaultcore.azure.net')]"
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.vaultcore.azure.net')]",
                "[resourceId('Microsoft.Network/privateEndpoints', variables('privateLinkAkvName'))]"
              ]
            },
            {
              "condition": "[parameters('bastion')]",
              "type": "Microsoft.Network/publicIPAddresses",
              "apiVersion": "2023-04-01",
              "name": "[variables('publicIpAddressName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "zones": "[if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), createArray())]",
              "properties": {
                "publicIPAllocationMethod": "Static"
              }
            },
            {
              "condition": "[parameters('bastion')]",
              "type": "Microsoft.Network/bastionHosts",
              "apiVersion": "2023-04-01",
              "name": "[parameters('bastionHostName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "[parameters('bastionSku')]"
              },
              "properties": {
                "enableTunneling": true,
                "ipConfigurations": [
                  {
                    "name": "IpConf",
                    "properties": {
                      "subnet": {
                        "id": "[format('{0}/subnets/{1}', resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), variables('bastion_subnet_name'))]"
                      },
                      "publicIPAddress": {
                        "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIpAddressName'))]"
                      }
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIpAddressName'))]",
                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
              ]
            },
            {
              "condition": "[and(parameters('CreateNsgFlowLogs'), parameters('networkSecurityGroups'))]",
              "type": "Microsoft.Storage/storageAccounts",
              "apiVersion": "2023-01-01",
              "name": "[variables('flowLogStorageName')]",
              "kind": "StorageV2",
              "sku": {
                "name": "Standard_LRS"
              },
              "location": "[parameters('location')]",
              "properties": {
                "minimumTlsVersion": "TLS1_2"
              }
            },
            {
              "copy": {
                "name": "natGwIp",
                "count": "[length(range(0, parameters('natGatewayPublicIps')))]"
              },
              "condition": "[parameters('natGateway')]",
              "type": "Microsoft.Network/publicIPAddresses",
              "apiVersion": "2023-04-01",
              "name": "[format('pip-{0}-{1}', variables('natGwName'), add(range(0, parameters('natGatewayPublicIps'))[copyIndex()], 1))]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "zones": "[if(not(empty(parameters('availabilityZones'))), variables('NatAvailabilityZone'), createArray())]",
              "properties": {
                "publicIPAllocationMethod": "Static"
              }
            },
            {
              "condition": "[parameters('natGateway')]",
              "type": "Microsoft.Network/natGateways",
              "apiVersion": "2023-04-01",
              "name": "[variables('natGwName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "zones": "[if(not(empty(parameters('availabilityZones'))), variables('NatAvailabilityZone'), createArray())]",
              "properties": {
                "copy": [
                  {
                    "name": "publicIpAddresses",
                    "count": "[length(range(0, parameters('natGatewayPublicIps')))]",
                    "input": {
                      "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('pip-{0}-{1}', variables('natGwName'), add(range(0, parameters('natGatewayPublicIps'))[range(0, parameters('natGatewayPublicIps'))[copyIndex('publicIpAddresses')]], 1)))]"
                    }
                  }
                ],
                "idleTimeoutInMinutes": "[parameters('natGatewayIdleTimeoutMins')]"
              },
              "dependsOn": [
                "natGwIp"
              ]
            },
            {
              "condition": "[parameters('azureFirewalls')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-calcAzFwIp', deployment().name), 64)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "vnetFirewallSubnetAddressPrefix": {
                    "value": "[parameters('vnetFirewallSubnetAddressPrefix')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "3417997589173941883"
                    }
                  },
                  "parameters": {
                    "vnetFirewallSubnetAddressPrefix": {
                      "type": "string",
                      "metadata": {
                        "description": "A subnet address for the Azure Firewall"
                      }
                    }
                  },
                  "variables": {
                    "subnetOctets": "[split(parameters('vnetFirewallSubnetAddressPrefix'), '.')]",
                    "hostIdOctet": "4"
                  },
                  "resources": [],
                  "outputs": {
                    "FirewallPrivateIp": {
                      "type": "string",
                      "value": "[format('{0}.{1}.{2}.{3}', variables('subnetOctets')[0], variables('subnetOctets')[1], variables('subnetOctets')[2], variables('hostIdOctet'))]"
                    }
                  }
                }
              }
            },
            {
              "condition": "[not(empty(parameters('aksPrincipleId')))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-subnetRbac', deployment().name), 64)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "servicePrincipalId": {
                    "value": "[parameters('aksPrincipleId')]"
                  },
                  "subnetName": {
                    "value": "[variables('aks_subnet_name')]"
                  },
                  "vnetName": {
                    "value": "[variables('vnetName')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "12620517793230757132"
                    }
                  },
                  "parameters": {
                    "vnetName": {
                      "type": "string"
                    },
                    "subnetName": {
                      "type": "string"
                    },
                    "servicePrincipalId": {
                      "type": "string"
                    }
                  },
                  "variables": {
                    "networkContributorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2022-04-01",
                      "scope": "[format('Microsoft.Network/virtualNetworks/{0}/subnets/{1}', split(format('{0}/{1}', parameters('vnetName'), parameters('subnetName')), '/')[0], split(format('{0}/{1}', parameters('vnetName'), parameters('subnetName')), '/')[1])]",
                      "name": "[guid(resourceId('Microsoft.Network/virtualNetworks/subnets', split(format('{0}/{1}', parameters('vnetName'), parameters('subnetName')), '/')[0], split(format('{0}/{1}', parameters('vnetName'), parameters('subnetName')), '/')[1]), parameters('servicePrincipalId'), variables('networkContributorRole'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('networkContributorRole')]",
                        "principalId": "[parameters('servicePrincipalId')]",
                        "principalType": "ServicePrincipal"
                      }
                    }
                  ]
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
              ]
            },
            {
              "condition": "[parameters('networkSecurityGroups')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-nsgAks', deployment().name), 64)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "resourceName": {
                    "value": "[format('{0}-{1}', variables('aks_subnet_name'), parameters('resourceName'))]"
                  },
                  "workspaceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01').customerId), createObject('value', ''))]",
                  "workspaceRegion": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01', 'full').location), createObject('value', ''))]",
                  "workspaceResourceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))), createObject('value', ''))]",
                  "ruleInAllowInternetHttp": {
                    "value": true
                  },
                  "ruleInAllowInternetHttps": {
                    "value": true
                  },
                  "ruleInDenySsh": {
                    "value": true
                  },
                  "FlowLogStorageAccountId": "[if(parameters('CreateNsgFlowLogs'), createObject('value', resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))), createObject('value', ''))]"
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "9289837448845361250"
                    }
                  },
                  "parameters": {
                    "resourceName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "workspaceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceResourceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceRegion": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "ruleInAllowGwManagement": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInGwManagementPort": {
                      "type": "string",
                      "defaultValue": "443,65200-65535"
                    },
                    "ruleInAllowAzureLoadBalancer": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenyInternet": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttp": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttps": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowBastionHostComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleOutAllowBastionComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenySsh": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "NsgDiagnosticCategories": {
                      "type": "array",
                      "defaultValue": [
                        "NetworkSecurityGroupEvent",
                        "NetworkSecurityGroupRuleCounter"
                      ]
                    },
                    "FlowLogStorageAccountId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "FlowLogTrafficAnalytics": {
                      "type": "bool",
                      "defaultValue": "[not(empty(parameters('FlowLogStorageAccountId')))]"
                    }
                  },
                  "variables": {
                    "nsgName": "[format('nsg-{0}', parameters('resourceName'))]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Network/networkSecurityGroups",
                      "apiVersion": "2023-04-01",
                      "name": "[variables('nsgName')]",
                      "location": "[parameters('location')]"
                    },
                    {
                      "condition": "[parameters('ruleInAllowGwManagement')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AppGatewayManagement')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "[parameters('ruleInGwManagementPort')]",
                        "sourceAddressPrefix": "GatewayManager",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 110,
                        "direction": "Inbound"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowAzureLoadBalancer')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AzureLoadBalancer')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "AzureLoadBalancer",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 120,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenyInternet')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Deny_AllInboundInternet')]",
                      "properties": {
                        "description": "Azure infrastructure communication",
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 4096,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttp')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Http')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttps')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Https')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowBastionHostComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Host_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 700,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_SshRdp_Outbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22",
                          "3389"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Azure_Cloud_Outbound')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "AzureCloud",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 220,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Get_Session_Info')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "Internet",
                        "access": "Allow",
                        "priority": 230,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenySsh')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'DenySshInbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 100,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('workspaceResourceId')))]",
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2021-05-01-preview",
                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', variables('nsgName'))]",
                      "name": "[format('diags-{0}', variables('nsgName'))]",
                      "properties": {
                        "copy": [
                          {
                            "name": "logs",
                            "count": "[length(parameters('NsgDiagnosticCategories'))]",
                            "input": {
                              "category": "[parameters('NsgDiagnosticCategories')[copyIndex('logs')]]",
                              "enabled": true
                            }
                          }
                        ],
                        "workspaceId": "[parameters('workspaceResourceId')]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('FlowLogStorageAccountId')))]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[take(format('{0}-flow-{1}', deployment().name, variables('nsgName')), 64)]",
                      "resourceGroup": "NetworkWatcherRG",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "name": {
                            "value": "[format('flowNsg-{0}', variables('nsgName'))]"
                          },
                          "nsgId": {
                            "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          },
                          "storageId": {
                            "value": "[parameters('FlowLogStorageAccountId')]"
                          },
                          "trafficAnalytics": {
                            "value": "[parameters('FlowLogTrafficAnalytics')]"
                          },
                          "workspaceId": {
                            "value": "[parameters('workspaceId')]"
                          },
                          "workspaceResourceId": {
                            "value": "[parameters('workspaceResourceId')]"
                          },
                          "workspaceRegion": {
                            "value": "[parameters('workspaceRegion')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.26.54.24096",
                              "templateHash": "779199993846024352"
                            }
                          },
                          "parameters": {
                            "name": {
                              "type": "string"
                            },
                            "location": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            },
                            "nsgId": {
                              "type": "string"
                            },
                            "storageId": {
                              "type": "string"
                            },
                            "trafficAnalytics": {
                              "type": "bool"
                            },
                            "trafficAnalyticsInterval": {
                              "type": "int",
                              "defaultValue": 60
                            },
                            "workspaceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "The resource guid of the attached workspace."
                              }
                            },
                            "workspaceResourceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "Resource Id of the attached workspace."
                              }
                            },
                            "workspaceRegion": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkWatchers",
                              "apiVersion": "2023-04-01",
                              "name": "[format('NetworkWatcher_{0}', parameters('location'))]",
                              "location": "[parameters('location')]",
                              "properties": {}
                            },
                            {
                              "type": "Microsoft.Network/networkWatchers/flowLogs",
                              "apiVersion": "2022-11-01",
                              "name": "[format('{0}/{1}', format('NetworkWatcher_{0}', parameters('location')), parameters('name'))]",
                              "location": "[parameters('location')]",
                              "properties": {
                                "targetResourceId": "[parameters('nsgId')]",
                                "storageId": "[parameters('storageId')]",
                                "enabled": true,
                                "retentionPolicy": {
                                  "days": 2,
                                  "enabled": true
                                },
                                "format": {
                                  "type": "JSON",
                                  "version": 2
                                },
                                "flowAnalyticsConfiguration": {
                                  "networkWatcherFlowAnalyticsConfiguration": {
                                    "enabled": "[parameters('trafficAnalytics')]",
                                    "workspaceId": "[parameters('workspaceId')]",
                                    "trafficAnalyticsInterval": "[parameters('trafficAnalyticsInterval')]",
                                    "workspaceRegion": "[parameters('workspaceRegion')]",
                                    "workspaceResourceId": "[parameters('workspaceResourceId')]"
                                  }
                                }
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/networkWatchers', format('NetworkWatcher_{0}', parameters('location')))]"
                              ]
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "nsgId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                    },
                    "nsgSubnetObj": {
                      "type": "object",
                      "value": {
                        "properties": {
                          "networkSecurityGroup": {
                            "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))]"
              ]
            },
            {
              "condition": "[and(parameters('acrPrivatePool'), parameters('networkSecurityGroups'))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-nsgAcrPool', deployment().name), 64)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "resourceName": {
                    "value": "[format('{0}-{1}', variables('acrpool_subnet_name'), parameters('resourceName'))]"
                  },
                  "workspaceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01').customerId), createObject('value', ''))]",
                  "workspaceRegion": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01', 'full').location), createObject('value', ''))]",
                  "workspaceResourceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))), createObject('value', ''))]",
                  "FlowLogStorageAccountId": "[if(parameters('CreateNsgFlowLogs'), createObject('value', resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))), createObject('value', ''))]"
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "9289837448845361250"
                    }
                  },
                  "parameters": {
                    "resourceName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "workspaceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceResourceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceRegion": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "ruleInAllowGwManagement": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInGwManagementPort": {
                      "type": "string",
                      "defaultValue": "443,65200-65535"
                    },
                    "ruleInAllowAzureLoadBalancer": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenyInternet": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttp": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttps": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowBastionHostComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleOutAllowBastionComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenySsh": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "NsgDiagnosticCategories": {
                      "type": "array",
                      "defaultValue": [
                        "NetworkSecurityGroupEvent",
                        "NetworkSecurityGroupRuleCounter"
                      ]
                    },
                    "FlowLogStorageAccountId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "FlowLogTrafficAnalytics": {
                      "type": "bool",
                      "defaultValue": "[not(empty(parameters('FlowLogStorageAccountId')))]"
                    }
                  },
                  "variables": {
                    "nsgName": "[format('nsg-{0}', parameters('resourceName'))]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Network/networkSecurityGroups",
                      "apiVersion": "2023-04-01",
                      "name": "[variables('nsgName')]",
                      "location": "[parameters('location')]"
                    },
                    {
                      "condition": "[parameters('ruleInAllowGwManagement')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AppGatewayManagement')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "[parameters('ruleInGwManagementPort')]",
                        "sourceAddressPrefix": "GatewayManager",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 110,
                        "direction": "Inbound"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowAzureLoadBalancer')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AzureLoadBalancer')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "AzureLoadBalancer",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 120,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenyInternet')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Deny_AllInboundInternet')]",
                      "properties": {
                        "description": "Azure infrastructure communication",
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 4096,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttp')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Http')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttps')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Https')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowBastionHostComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Host_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 700,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_SshRdp_Outbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22",
                          "3389"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Azure_Cloud_Outbound')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "AzureCloud",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 220,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Get_Session_Info')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "Internet",
                        "access": "Allow",
                        "priority": 230,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenySsh')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'DenySshInbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 100,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('workspaceResourceId')))]",
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2021-05-01-preview",
                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', variables('nsgName'))]",
                      "name": "[format('diags-{0}', variables('nsgName'))]",
                      "properties": {
                        "copy": [
                          {
                            "name": "logs",
                            "count": "[length(parameters('NsgDiagnosticCategories'))]",
                            "input": {
                              "category": "[parameters('NsgDiagnosticCategories')[copyIndex('logs')]]",
                              "enabled": true
                            }
                          }
                        ],
                        "workspaceId": "[parameters('workspaceResourceId')]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('FlowLogStorageAccountId')))]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[take(format('{0}-flow-{1}', deployment().name, variables('nsgName')), 64)]",
                      "resourceGroup": "NetworkWatcherRG",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "name": {
                            "value": "[format('flowNsg-{0}', variables('nsgName'))]"
                          },
                          "nsgId": {
                            "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          },
                          "storageId": {
                            "value": "[parameters('FlowLogStorageAccountId')]"
                          },
                          "trafficAnalytics": {
                            "value": "[parameters('FlowLogTrafficAnalytics')]"
                          },
                          "workspaceId": {
                            "value": "[parameters('workspaceId')]"
                          },
                          "workspaceResourceId": {
                            "value": "[parameters('workspaceResourceId')]"
                          },
                          "workspaceRegion": {
                            "value": "[parameters('workspaceRegion')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.26.54.24096",
                              "templateHash": "779199993846024352"
                            }
                          },
                          "parameters": {
                            "name": {
                              "type": "string"
                            },
                            "location": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            },
                            "nsgId": {
                              "type": "string"
                            },
                            "storageId": {
                              "type": "string"
                            },
                            "trafficAnalytics": {
                              "type": "bool"
                            },
                            "trafficAnalyticsInterval": {
                              "type": "int",
                              "defaultValue": 60
                            },
                            "workspaceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "The resource guid of the attached workspace."
                              }
                            },
                            "workspaceResourceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "Resource Id of the attached workspace."
                              }
                            },
                            "workspaceRegion": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkWatchers",
                              "apiVersion": "2023-04-01",
                              "name": "[format('NetworkWatcher_{0}', parameters('location'))]",
                              "location": "[parameters('location')]",
                              "properties": {}
                            },
                            {
                              "type": "Microsoft.Network/networkWatchers/flowLogs",
                              "apiVersion": "2022-11-01",
                              "name": "[format('{0}/{1}', format('NetworkWatcher_{0}', parameters('location')), parameters('name'))]",
                              "location": "[parameters('location')]",
                              "properties": {
                                "targetResourceId": "[parameters('nsgId')]",
                                "storageId": "[parameters('storageId')]",
                                "enabled": true,
                                "retentionPolicy": {
                                  "days": 2,
                                  "enabled": true
                                },
                                "format": {
                                  "type": "JSON",
                                  "version": 2
                                },
                                "flowAnalyticsConfiguration": {
                                  "networkWatcherFlowAnalyticsConfiguration": {
                                    "enabled": "[parameters('trafficAnalytics')]",
                                    "workspaceId": "[parameters('workspaceId')]",
                                    "trafficAnalyticsInterval": "[parameters('trafficAnalyticsInterval')]",
                                    "workspaceRegion": "[parameters('workspaceRegion')]",
                                    "workspaceResourceId": "[parameters('workspaceResourceId')]"
                                  }
                                }
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/networkWatchers', format('NetworkWatcher_{0}', parameters('location')))]"
                              ]
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "nsgId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                    },
                    "nsgSubnetObj": {
                      "type": "object",
                      "value": {
                        "properties": {
                          "networkSecurityGroup": {
                            "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAks', deployment().name), 64))]"
              ]
            },
            {
              "condition": "[and(parameters('ingressApplicationGateway'), parameters('networkSecurityGroups'))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-nsgAppGw', deployment().name), 64)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "resourceName": {
                    "value": "[format('{0}-{1}', variables('appgw_subnet_name'), parameters('resourceName'))]"
                  },
                  "workspaceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01').customerId), createObject('value', ''))]",
                  "workspaceRegion": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01', 'full').location), createObject('value', ''))]",
                  "workspaceResourceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))), createObject('value', ''))]",
                  "ruleInAllowInternetHttp": {
                    "value": "[parameters('ingressApplicationGatewayPublic')]"
                  },
                  "ruleInAllowInternetHttps": {
                    "value": "[parameters('ingressApplicationGatewayPublic')]"
                  },
                  "ruleInAllowGwManagement": {
                    "value": true
                  },
                  "ruleInAllowAzureLoadBalancer": {
                    "value": true
                  },
                  "ruleInDenyInternet": {
                    "value": true
                  },
                  "ruleInGwManagementPort": {
                    "value": "65200-65535"
                  },
                  "FlowLogStorageAccountId": "[if(parameters('CreateNsgFlowLogs'), createObject('value', resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))), createObject('value', ''))]"
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "9289837448845361250"
                    }
                  },
                  "parameters": {
                    "resourceName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "workspaceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceResourceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceRegion": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "ruleInAllowGwManagement": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInGwManagementPort": {
                      "type": "string",
                      "defaultValue": "443,65200-65535"
                    },
                    "ruleInAllowAzureLoadBalancer": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenyInternet": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttp": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttps": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowBastionHostComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleOutAllowBastionComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenySsh": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "NsgDiagnosticCategories": {
                      "type": "array",
                      "defaultValue": [
                        "NetworkSecurityGroupEvent",
                        "NetworkSecurityGroupRuleCounter"
                      ]
                    },
                    "FlowLogStorageAccountId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "FlowLogTrafficAnalytics": {
                      "type": "bool",
                      "defaultValue": "[not(empty(parameters('FlowLogStorageAccountId')))]"
                    }
                  },
                  "variables": {
                    "nsgName": "[format('nsg-{0}', parameters('resourceName'))]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Network/networkSecurityGroups",
                      "apiVersion": "2023-04-01",
                      "name": "[variables('nsgName')]",
                      "location": "[parameters('location')]"
                    },
                    {
                      "condition": "[parameters('ruleInAllowGwManagement')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AppGatewayManagement')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "[parameters('ruleInGwManagementPort')]",
                        "sourceAddressPrefix": "GatewayManager",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 110,
                        "direction": "Inbound"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowAzureLoadBalancer')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AzureLoadBalancer')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "AzureLoadBalancer",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 120,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenyInternet')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Deny_AllInboundInternet')]",
                      "properties": {
                        "description": "Azure infrastructure communication",
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 4096,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttp')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Http')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttps')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Https')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowBastionHostComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Host_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 700,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_SshRdp_Outbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22",
                          "3389"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Azure_Cloud_Outbound')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "AzureCloud",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 220,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Get_Session_Info')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "Internet",
                        "access": "Allow",
                        "priority": 230,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenySsh')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'DenySshInbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 100,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('workspaceResourceId')))]",
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2021-05-01-preview",
                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', variables('nsgName'))]",
                      "name": "[format('diags-{0}', variables('nsgName'))]",
                      "properties": {
                        "copy": [
                          {
                            "name": "logs",
                            "count": "[length(parameters('NsgDiagnosticCategories'))]",
                            "input": {
                              "category": "[parameters('NsgDiagnosticCategories')[copyIndex('logs')]]",
                              "enabled": true
                            }
                          }
                        ],
                        "workspaceId": "[parameters('workspaceResourceId')]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('FlowLogStorageAccountId')))]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[take(format('{0}-flow-{1}', deployment().name, variables('nsgName')), 64)]",
                      "resourceGroup": "NetworkWatcherRG",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "name": {
                            "value": "[format('flowNsg-{0}', variables('nsgName'))]"
                          },
                          "nsgId": {
                            "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          },
                          "storageId": {
                            "value": "[parameters('FlowLogStorageAccountId')]"
                          },
                          "trafficAnalytics": {
                            "value": "[parameters('FlowLogTrafficAnalytics')]"
                          },
                          "workspaceId": {
                            "value": "[parameters('workspaceId')]"
                          },
                          "workspaceResourceId": {
                            "value": "[parameters('workspaceResourceId')]"
                          },
                          "workspaceRegion": {
                            "value": "[parameters('workspaceRegion')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.26.54.24096",
                              "templateHash": "779199993846024352"
                            }
                          },
                          "parameters": {
                            "name": {
                              "type": "string"
                            },
                            "location": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            },
                            "nsgId": {
                              "type": "string"
                            },
                            "storageId": {
                              "type": "string"
                            },
                            "trafficAnalytics": {
                              "type": "bool"
                            },
                            "trafficAnalyticsInterval": {
                              "type": "int",
                              "defaultValue": 60
                            },
                            "workspaceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "The resource guid of the attached workspace."
                              }
                            },
                            "workspaceResourceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "Resource Id of the attached workspace."
                              }
                            },
                            "workspaceRegion": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkWatchers",
                              "apiVersion": "2023-04-01",
                              "name": "[format('NetworkWatcher_{0}', parameters('location'))]",
                              "location": "[parameters('location')]",
                              "properties": {}
                            },
                            {
                              "type": "Microsoft.Network/networkWatchers/flowLogs",
                              "apiVersion": "2022-11-01",
                              "name": "[format('{0}/{1}', format('NetworkWatcher_{0}', parameters('location')), parameters('name'))]",
                              "location": "[parameters('location')]",
                              "properties": {
                                "targetResourceId": "[parameters('nsgId')]",
                                "storageId": "[parameters('storageId')]",
                                "enabled": true,
                                "retentionPolicy": {
                                  "days": 2,
                                  "enabled": true
                                },
                                "format": {
                                  "type": "JSON",
                                  "version": 2
                                },
                                "flowAnalyticsConfiguration": {
                                  "networkWatcherFlowAnalyticsConfiguration": {
                                    "enabled": "[parameters('trafficAnalytics')]",
                                    "workspaceId": "[parameters('workspaceId')]",
                                    "trafficAnalyticsInterval": "[parameters('trafficAnalyticsInterval')]",
                                    "workspaceRegion": "[parameters('workspaceRegion')]",
                                    "workspaceResourceId": "[parameters('workspaceResourceId')]"
                                  }
                                }
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/networkWatchers', format('NetworkWatcher_{0}', parameters('location')))]"
                              ]
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "nsgId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                    },
                    "nsgSubnetObj": {
                      "type": "object",
                      "value": {
                        "properties": {
                          "networkSecurityGroup": {
                            "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAcrPool', deployment().name), 64))]"
              ]
            },
            {
              "condition": "[and(parameters('bastion'), parameters('networkSecurityGroups'))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-nsgBastion', deployment().name), 64)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "resourceName": {
                    "value": "[format('{0}-{1}', variables('bastion_subnet_name'), parameters('resourceName'))]"
                  },
                  "workspaceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01').customerId), createObject('value', ''))]",
                  "workspaceRegion": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01', 'full').location), createObject('value', ''))]",
                  "workspaceResourceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))), createObject('value', ''))]",
                  "ruleInAllowBastionHostComms": {
                    "value": true
                  },
                  "ruleInAllowInternetHttps": {
                    "value": true
                  },
                  "ruleInAllowGwManagement": {
                    "value": true
                  },
                  "ruleInAllowAzureLoadBalancer": {
                    "value": true
                  },
                  "ruleOutAllowBastionComms": {
                    "value": true
                  },
                  "ruleInGwManagementPort": {
                    "value": "443"
                  },
                  "FlowLogStorageAccountId": "[if(parameters('CreateNsgFlowLogs'), createObject('value', resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))), createObject('value', ''))]"
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "9289837448845361250"
                    }
                  },
                  "parameters": {
                    "resourceName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "workspaceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceResourceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceRegion": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "ruleInAllowGwManagement": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInGwManagementPort": {
                      "type": "string",
                      "defaultValue": "443,65200-65535"
                    },
                    "ruleInAllowAzureLoadBalancer": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenyInternet": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttp": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttps": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowBastionHostComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleOutAllowBastionComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenySsh": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "NsgDiagnosticCategories": {
                      "type": "array",
                      "defaultValue": [
                        "NetworkSecurityGroupEvent",
                        "NetworkSecurityGroupRuleCounter"
                      ]
                    },
                    "FlowLogStorageAccountId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "FlowLogTrafficAnalytics": {
                      "type": "bool",
                      "defaultValue": "[not(empty(parameters('FlowLogStorageAccountId')))]"
                    }
                  },
                  "variables": {
                    "nsgName": "[format('nsg-{0}', parameters('resourceName'))]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Network/networkSecurityGroups",
                      "apiVersion": "2023-04-01",
                      "name": "[variables('nsgName')]",
                      "location": "[parameters('location')]"
                    },
                    {
                      "condition": "[parameters('ruleInAllowGwManagement')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AppGatewayManagement')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "[parameters('ruleInGwManagementPort')]",
                        "sourceAddressPrefix": "GatewayManager",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 110,
                        "direction": "Inbound"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowAzureLoadBalancer')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AzureLoadBalancer')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "AzureLoadBalancer",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 120,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenyInternet')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Deny_AllInboundInternet')]",
                      "properties": {
                        "description": "Azure infrastructure communication",
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 4096,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttp')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Http')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttps')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Https')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowBastionHostComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Host_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 700,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_SshRdp_Outbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22",
                          "3389"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Azure_Cloud_Outbound')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "AzureCloud",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 220,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Get_Session_Info')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "Internet",
                        "access": "Allow",
                        "priority": 230,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenySsh')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'DenySshInbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 100,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('workspaceResourceId')))]",
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2021-05-01-preview",
                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', variables('nsgName'))]",
                      "name": "[format('diags-{0}', variables('nsgName'))]",
                      "properties": {
                        "copy": [
                          {
                            "name": "logs",
                            "count": "[length(parameters('NsgDiagnosticCategories'))]",
                            "input": {
                              "category": "[parameters('NsgDiagnosticCategories')[copyIndex('logs')]]",
                              "enabled": true
                            }
                          }
                        ],
                        "workspaceId": "[parameters('workspaceResourceId')]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('FlowLogStorageAccountId')))]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[take(format('{0}-flow-{1}', deployment().name, variables('nsgName')), 64)]",
                      "resourceGroup": "NetworkWatcherRG",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "name": {
                            "value": "[format('flowNsg-{0}', variables('nsgName'))]"
                          },
                          "nsgId": {
                            "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          },
                          "storageId": {
                            "value": "[parameters('FlowLogStorageAccountId')]"
                          },
                          "trafficAnalytics": {
                            "value": "[parameters('FlowLogTrafficAnalytics')]"
                          },
                          "workspaceId": {
                            "value": "[parameters('workspaceId')]"
                          },
                          "workspaceResourceId": {
                            "value": "[parameters('workspaceResourceId')]"
                          },
                          "workspaceRegion": {
                            "value": "[parameters('workspaceRegion')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.26.54.24096",
                              "templateHash": "779199993846024352"
                            }
                          },
                          "parameters": {
                            "name": {
                              "type": "string"
                            },
                            "location": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            },
                            "nsgId": {
                              "type": "string"
                            },
                            "storageId": {
                              "type": "string"
                            },
                            "trafficAnalytics": {
                              "type": "bool"
                            },
                            "trafficAnalyticsInterval": {
                              "type": "int",
                              "defaultValue": 60
                            },
                            "workspaceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "The resource guid of the attached workspace."
                              }
                            },
                            "workspaceResourceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "Resource Id of the attached workspace."
                              }
                            },
                            "workspaceRegion": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkWatchers",
                              "apiVersion": "2023-04-01",
                              "name": "[format('NetworkWatcher_{0}', parameters('location'))]",
                              "location": "[parameters('location')]",
                              "properties": {}
                            },
                            {
                              "type": "Microsoft.Network/networkWatchers/flowLogs",
                              "apiVersion": "2022-11-01",
                              "name": "[format('{0}/{1}', format('NetworkWatcher_{0}', parameters('location')), parameters('name'))]",
                              "location": "[parameters('location')]",
                              "properties": {
                                "targetResourceId": "[parameters('nsgId')]",
                                "storageId": "[parameters('storageId')]",
                                "enabled": true,
                                "retentionPolicy": {
                                  "days": 2,
                                  "enabled": true
                                },
                                "format": {
                                  "type": "JSON",
                                  "version": 2
                                },
                                "flowAnalyticsConfiguration": {
                                  "networkWatcherFlowAnalyticsConfiguration": {
                                    "enabled": "[parameters('trafficAnalytics')]",
                                    "workspaceId": "[parameters('workspaceId')]",
                                    "trafficAnalyticsInterval": "[parameters('trafficAnalyticsInterval')]",
                                    "workspaceRegion": "[parameters('workspaceRegion')]",
                                    "workspaceResourceId": "[parameters('workspaceResourceId')]"
                                  }
                                }
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/networkWatchers', format('NetworkWatcher_{0}', parameters('location')))]"
                              ]
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "nsgId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                    },
                    "nsgSubnetObj": {
                      "type": "object",
                      "value": {
                        "properties": {
                          "networkSecurityGroup": {
                            "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAppGw', deployment().name), 64))]"
              ]
            },
            {
              "condition": "[and(parameters('privateLinks'), parameters('networkSecurityGroups'))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-nsgPrivateLinks', deployment().name), 64)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "resourceName": {
                    "value": "[format('{0}-{1}', variables('private_link_subnet_name'), parameters('resourceName'))]"
                  },
                  "workspaceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01').customerId), createObject('value', ''))]",
                  "workspaceRegion": "[if(not(empty(parameters('workspaceName'))), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName')), '2022-10-01', 'full').location), createObject('value', ''))]",
                  "workspaceResourceId": "[if(not(empty(parameters('workspaceName'))), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('workspaceResourceGroupName')), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))), createObject('value', ''))]",
                  "FlowLogStorageAccountId": "[if(parameters('CreateNsgFlowLogs'), createObject('value', resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))), createObject('value', ''))]"
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "9289837448845361250"
                    }
                  },
                  "parameters": {
                    "resourceName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "workspaceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceResourceId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "workspaceRegion": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]"
                    },
                    "ruleInAllowGwManagement": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInGwManagementPort": {
                      "type": "string",
                      "defaultValue": "443,65200-65535"
                    },
                    "ruleInAllowAzureLoadBalancer": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenyInternet": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttp": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowInternetHttps": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInAllowBastionHostComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleOutAllowBastionComms": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "ruleInDenySsh": {
                      "type": "bool",
                      "defaultValue": false
                    },
                    "NsgDiagnosticCategories": {
                      "type": "array",
                      "defaultValue": [
                        "NetworkSecurityGroupEvent",
                        "NetworkSecurityGroupRuleCounter"
                      ]
                    },
                    "FlowLogStorageAccountId": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "FlowLogTrafficAnalytics": {
                      "type": "bool",
                      "defaultValue": "[not(empty(parameters('FlowLogStorageAccountId')))]"
                    }
                  },
                  "variables": {
                    "nsgName": "[format('nsg-{0}', parameters('resourceName'))]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Network/networkSecurityGroups",
                      "apiVersion": "2023-04-01",
                      "name": "[variables('nsgName')]",
                      "location": "[parameters('location')]"
                    },
                    {
                      "condition": "[parameters('ruleInAllowGwManagement')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AppGatewayManagement')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "[parameters('ruleInGwManagementPort')]",
                        "sourceAddressPrefix": "GatewayManager",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 110,
                        "direction": "Inbound"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowAzureLoadBalancer')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_AzureLoadBalancer')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "AzureLoadBalancer",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 120,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenyInternet')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Deny_AllInboundInternet')]",
                      "properties": {
                        "description": "Azure infrastructure communication",
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "destinationPortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 4096,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttp')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Http')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowInternetHttps')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Internet_Https')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "Internet",
                        "destinationAddressPrefix": "*",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInAllowBastionHostComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Host_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 700,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_SshRdp_Outbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 200,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22",
                          "3389"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Azure_Cloud_Outbound')]",
                      "properties": {
                        "protocol": "Tcp",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "AzureCloud",
                        "access": "Allow",
                        "priority": 210,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "443"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Bastion_Communication')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "VirtualNetwork",
                        "destinationAddressPrefix": "VirtualNetwork",
                        "access": "Allow",
                        "priority": 220,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "8080",
                          "5701"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleOutAllowBastionComms')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'Allow_Get_Session_Info')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "Internet",
                        "access": "Allow",
                        "priority": 230,
                        "direction": "Outbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "80"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('ruleInDenySsh')]",
                      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', variables('nsgName'), 'DenySshInbound')]",
                      "properties": {
                        "protocol": "*",
                        "sourcePortRange": "*",
                        "sourceAddressPrefix": "*",
                        "destinationAddressPrefix": "*",
                        "access": "Deny",
                        "priority": 100,
                        "direction": "Inbound",
                        "sourcePortRanges": [],
                        "destinationPortRanges": [
                          "22"
                        ],
                        "sourceAddressPrefixes": [],
                        "destinationAddressPrefixes": []
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('workspaceResourceId')))]",
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2021-05-01-preview",
                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', variables('nsgName'))]",
                      "name": "[format('diags-{0}', variables('nsgName'))]",
                      "properties": {
                        "copy": [
                          {
                            "name": "logs",
                            "count": "[length(parameters('NsgDiagnosticCategories'))]",
                            "input": {
                              "category": "[parameters('NsgDiagnosticCategories')[copyIndex('logs')]]",
                              "enabled": true
                            }
                          }
                        ],
                        "workspaceId": "[parameters('workspaceResourceId')]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    },
                    {
                      "condition": "[not(empty(parameters('FlowLogStorageAccountId')))]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[take(format('{0}-flow-{1}', deployment().name, variables('nsgName')), 64)]",
                      "resourceGroup": "NetworkWatcherRG",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "name": {
                            "value": "[format('flowNsg-{0}', variables('nsgName'))]"
                          },
                          "nsgId": {
                            "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          },
                          "storageId": {
                            "value": "[parameters('FlowLogStorageAccountId')]"
                          },
                          "trafficAnalytics": {
                            "value": "[parameters('FlowLogTrafficAnalytics')]"
                          },
                          "workspaceId": {
                            "value": "[parameters('workspaceId')]"
                          },
                          "workspaceResourceId": {
                            "value": "[parameters('workspaceResourceId')]"
                          },
                          "workspaceRegion": {
                            "value": "[parameters('workspaceRegion')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.26.54.24096",
                              "templateHash": "779199993846024352"
                            }
                          },
                          "parameters": {
                            "name": {
                              "type": "string"
                            },
                            "location": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            },
                            "nsgId": {
                              "type": "string"
                            },
                            "storageId": {
                              "type": "string"
                            },
                            "trafficAnalytics": {
                              "type": "bool"
                            },
                            "trafficAnalyticsInterval": {
                              "type": "int",
                              "defaultValue": 60
                            },
                            "workspaceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "The resource guid of the attached workspace."
                              }
                            },
                            "workspaceResourceId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "Resource Id of the attached workspace."
                              }
                            },
                            "workspaceRegion": {
                              "type": "string",
                              "defaultValue": "[resourceGroup().location]"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkWatchers",
                              "apiVersion": "2023-04-01",
                              "name": "[format('NetworkWatcher_{0}', parameters('location'))]",
                              "location": "[parameters('location')]",
                              "properties": {}
                            },
                            {
                              "type": "Microsoft.Network/networkWatchers/flowLogs",
                              "apiVersion": "2022-11-01",
                              "name": "[format('{0}/{1}', format('NetworkWatcher_{0}', parameters('location')), parameters('name'))]",
                              "location": "[parameters('location')]",
                              "properties": {
                                "targetResourceId": "[parameters('nsgId')]",
                                "storageId": "[parameters('storageId')]",
                                "enabled": true,
                                "retentionPolicy": {
                                  "days": 2,
                                  "enabled": true
                                },
                                "format": {
                                  "type": "JSON",
                                  "version": 2
                                },
                                "flowAnalyticsConfiguration": {
                                  "networkWatcherFlowAnalyticsConfiguration": {
                                    "enabled": "[parameters('trafficAnalytics')]",
                                    "workspaceId": "[parameters('workspaceId')]",
                                    "trafficAnalyticsInterval": "[parameters('trafficAnalyticsInterval')]",
                                    "workspaceRegion": "[parameters('workspaceRegion')]",
                                    "workspaceResourceId": "[parameters('workspaceResourceId')]"
                                  }
                                }
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/networkWatchers', format('NetworkWatcher_{0}', parameters('location')))]"
                              ]
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "nsgId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                    },
                    "nsgSubnetObj": {
                      "type": "object",
                      "value": {
                        "properties": {
                          "networkSecurityGroup": {
                            "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
                          }
                        }
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('flowLogStorageName'))]",
                "[resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgBastion', deployment().name), 64))]"
              ]
            }
          ],
          "outputs": {
            "debugSubnets": {
              "type": "array",
              "value": "[union(array(if(parameters('networkSecurityGroups'), union(variables('aks_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAks', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('aks_baseSubnet'))), if(parameters('cniDynamicIpAllocation'), array(if(parameters('networkSecurityGroups'), union(variables('aks_podSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAks', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('aks_podSubnet'))), createArray()), if(parameters('azureFirewalls'), array(variables('fw_subnet')), createArray()), if(parameters('privateLinks'), array(if(and(parameters('privateLinks'), parameters('networkSecurityGroups')), union(variables('private_link_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgPrivateLinks', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('private_link_baseSubnet'))), createArray()), if(parameters('acrPrivatePool'), array(if(and(parameters('privateLinks'), parameters('networkSecurityGroups')), union(variables('acrpool_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAcrPool', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('acrpool_baseSubnet'))), createArray()), if(parameters('bastion'), array(if(and(parameters('bastion'), parameters('networkSecurityGroups')), union(variables('bastion_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgBastion', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('bastion_baseSubnet'))), createArray()), if(parameters('ingressApplicationGateway'), array(if(and(parameters('ingressApplicationGateway'), parameters('networkSecurityGroups')), union(variables('appgw_baseSubnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-nsgAppGw', deployment().name), 64)), '2022-09-01').outputs.nsgSubnetObj.value), variables('appgw_baseSubnet'))), createArray()), if(parameters('azureFirewallsManagementSeperation'), array(variables('fwmgmt_subnet')), createArray()))]"
            },
            "vnetId": {
              "type": "string",
              "value": "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
            },
            "vnetName": {
              "type": "string",
              "value": "[variables('vnetName')]"
            },
            "aksSubnetId": {
              "type": "string",
              "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('aks_subnet_name'))]"
            },
            "aksPodSubnetId": {
              "type": "string",
              "value": "[if(parameters('cniDynamicIpAllocation'), resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('aks_podSubnet_name')), '')]"
            },
            "fwSubnetId": {
              "type": "string",
              "value": "[if(parameters('azureFirewalls'), format('{0}/subnets/{1}', resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), variables('fw_subnet_name')), '')]"
            },
            "fwMgmtSubnetId": {
              "type": "string",
              "value": "[if(parameters('azureFirewallsManagementSeperation'), format('{0}/subnets/{1}', resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), variables('fwmgmt_subnet_name')), '')]"
            },
            "acrPoolSubnetId": {
              "type": "string",
              "value": "[if(parameters('acrPrivatePool'), format('{0}/subnets/{1}', resourceId('Microsoft.Network/virtualNetworks', variables('vnetName')), variables('acrpool_subnet_name')), '')]"
            },
            "appGwSubnetId": {
              "type": "string",
              "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('appgw_subnet_name'))]"
            },
            "privateLinkSubnetId": {
              "type": "string",
              "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('private_link_subnet_name'))]"
            },
            "natGwIpArr": {
              "type": "array",
              "copy": {
                "count": "[length(range(0, parameters('natGatewayPublicIps')))]",
                "input": "[if(parameters('natGateway'), reference(resourceId('Microsoft.Network/publicIPAddresses', format('pip-{0}-{1}', variables('natGwName'), add(range(0, parameters('natGatewayPublicIps'))[range(0, parameters('natGatewayPublicIps'))[copyIndex()]], 1))), '2023-04-01').ipAddress, null())]"
              }
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerRegistry/registries', variables('acrName'))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultApps', deployment().name), 64))]"
      ]
    },
    {
      "condition": "[not(empty(parameters('dnsZoneId')))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-addDnsContributor', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "dnsZoneId": {
            "value": "[parameters('dnsZoneId')]"
          },
          "vnetId": "[if(variables('isDnsZonePrivate'), if(not(empty(parameters('byoAKSSubnetId'))), createObject('value', split(parameters('byoAKSSubnetId'), '/subnets')[0]), if(parameters('custom_vnet'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.vnetId.value), createObject('value', ''))), createObject('value', ''))]",
          "principalId": {
            "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').identityProfile.kubeletidentity.objectId]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "11633340609312379920"
            }
          },
          "parameters": {
            "dnsZoneId": {
              "type": "string",
              "metadata": {
                "description": "The full Azure resource ID of the DNS zone to use for the AKS cluster"
              }
            },
            "vnetId": {
              "type": "string",
              "metadata": {
                "description": "The id of a virtual network to be linked to a PRIVATE DNS Zone"
              }
            },
            "principalId": {
              "type": "string",
              "metadata": {
                "description": "The AAD identity to create the RBAC against"
              }
            }
          },
          "variables": {
            "dnsZoneIdSegments": "[split(parameters('dnsZoneId'), '/')]",
            "dnsZoneSubscriptionId": "[if(not(empty(parameters('dnsZoneId'))), variables('dnsZoneIdSegments')[2], '')]",
            "dnsZoneRg": "[if(not(empty(parameters('dnsZoneId'))), variables('dnsZoneIdSegments')[4], '')]",
            "dnsZoneName": "[if(not(empty(parameters('dnsZoneId'))), variables('dnsZoneIdSegments')[8], '')]",
            "isDnsZonePrivate": "[if(not(empty(parameters('dnsZoneId'))), equals(variables('dnsZoneIdSegments')[7], 'privateDnsZones'), false())]"
          },
          "resources": [
            {
              "condition": "[not(empty(parameters('dnsZoneId')))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-dns-{1}', deployment().name, variables('dnsZoneName')), 64)]",
              "subscriptionId": "[variables('dnsZoneSubscriptionId')]",
              "resourceGroup": "[variables('dnsZoneRg')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "dnsZoneName": {
                    "value": "[variables('dnsZoneName')]"
                  },
                  "isPrivate": {
                    "value": "[variables('isDnsZonePrivate')]"
                  },
                  "vnetId": {
                    "value": "[parameters('vnetId')]"
                  },
                  "principalId": {
                    "value": "[parameters('principalId')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "4736783265358516487"
                    }
                  },
                  "parameters": {
                    "dnsZoneName": {
                      "type": "string"
                    },
                    "principalId": {
                      "type": "string"
                    },
                    "isPrivate": {
                      "type": "bool"
                    },
                    "vnetId": {
                      "type": "string",
                      "defaultValue": ""
                    }
                  },
                  "variables": {
                    "DNSZoneContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
                    "PrivateDNSZoneContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]"
                  },
                  "resources": [
                    {
                      "condition": "[not(parameters('isPrivate'))]",
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2022-04-01",
                      "scope": "[format('Microsoft.Network/dnsZones/{0}', parameters('dnsZoneName'))]",
                      "name": "[guid(resourceId('Microsoft.Network/dnsZones', parameters('dnsZoneName')), parameters('principalId'), variables('DNSZoneContributor'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('DNSZoneContributor')]",
                        "principalType": "ServicePrincipal",
                        "principalId": "[parameters('principalId')]"
                      }
                    },
                    {
                      "condition": "[parameters('isPrivate')]",
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2022-04-01",
                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('dnsZoneName'))]",
                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones', parameters('dnsZoneName')), parameters('principalId'), variables('PrivateDNSZoneContributor'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('PrivateDNSZoneContributor')]",
                        "principalType": "ServicePrincipal",
                        "principalId": "[parameters('principalId')]"
                      }
                    },
                    {
                      "condition": "[and(parameters('isPrivate'), not(empty(parameters('vnetId'))))]",
                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
                      "apiVersion": "2020-09-01",
                      "name": "[format('{0}/{1}', parameters('dnsZoneName'), 'privatedns')]",
                      "tags": {},
                      "location": "global",
                      "properties": {
                        "virtualNetwork": {
                          "id": "[parameters('vnetId')]"
                        },
                        "registrationEnabled": false
                      }
                    }
                  ]
                }
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64))]"
      ]
    },
    {
      "condition": "[parameters('keyVaultCreate')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-keyvaultApps', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "resourceName": {
            "value": "[parameters('resourceName')]"
          },
          "keyVaultPurgeProtection": {
            "value": "[parameters('keyVaultPurgeProtection')]"
          },
          "keyVaultSoftDelete": {
            "value": "[parameters('keyVaultSoftDelete')]"
          },
          "keyVaultIPAllowlist": {
            "value": "[parameters('keyVaultIPAllowlist')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "privateLinks": {
            "value": "[parameters('privateLinks')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "2160890359984794954"
            }
          },
          "parameters": {
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "minLength": 2,
              "metadata": {
                "description": "The location to use for the deployment. defaults to Resource Groups location."
              }
            },
            "resourceName": {
              "type": "string",
              "minLength": 3,
              "maxLength": 20,
              "metadata": {
                "description": "Used to name all resources"
              }
            },
            "privateLinks": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Enable support for private links"
              }
            },
            "keyVaultSoftDelete": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "If soft delete protection is enabled"
              }
            },
            "keyVaultPurgeProtection": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "If purge protection is enabled"
              }
            },
            "keyVaultIPAllowlist": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Add IP to KV firewall allow-list"
              }
            },
            "logAnalyticsWorkspaceId": {
              "type": "string",
              "defaultValue": ""
            }
          },
          "variables": {
            "copy": [
              {
                "name": "kvIPRules",
                "count": "[length(parameters('keyVaultIPAllowlist'))]",
                "input": {
                  "value": "[parameters('keyVaultIPAllowlist')[copyIndex('kvIPRules')]]"
                }
              }
            ],
            "akvName": "[take(format('kv-{0}{1}', replace(parameters('resourceName'), '-', ''), uniqueString(resourceGroup().id, parameters('resourceName'))), 24)]"
          },
          "resources": [
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2022-07-01",
              "name": "[variables('akvName')]",
              "location": "[parameters('location')]",
              "properties": {
                "tenantId": "[subscription().tenantId]",
                "sku": {
                  "family": "A",
                  "name": "standard"
                },
                "publicNetworkAccess": "[if(and(parameters('privateLinks'), empty(parameters('keyVaultIPAllowlist'))), 'disabled', 'enabled')]",
                "networkAcls": "[if(and(parameters('privateLinks'), not(empty(parameters('keyVaultIPAllowlist')))), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny', 'ipRules', variables('kvIPRules'), 'virtualNetworkRules', createArray()), createObject())]",
                "enableRbacAuthorization": true,
                "enabledForDeployment": false,
                "enabledForDiskEncryption": false,
                "enabledForTemplateDeployment": false,
                "enableSoftDelete": "[parameters('keyVaultSoftDelete')]",
                "enablePurgeProtection": "[if(parameters('keyVaultPurgeProtection'), true(), null())]"
              }
            },
            {
              "condition": "[not(empty(parameters('logAnalyticsWorkspaceId')))]",
              "type": "Microsoft.Insights/diagnosticSettings",
              "apiVersion": "2021-05-01-preview",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', variables('akvName'))]",
              "name": "kvDiags",
              "properties": {
                "workspaceId": "[parameters('logAnalyticsWorkspaceId')]",
                "logs": [
                  {
                    "category": "AuditEvent",
                    "enabled": true
                  }
                ],
                "metrics": [
                  {
                    "category": "AllMetrics",
                    "enabled": true
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', variables('akvName'))]"
              ]
            }
          ],
          "outputs": {
            "keyVaultName": {
              "type": "string",
              "value": "[variables('akvName')]"
            },
            "keyVaultId": {
              "type": "string",
              "value": "[resourceId('Microsoft.KeyVault/vaults', variables('akvName'))]"
            }
          }
        }
      },
      "metadata": {
        "description": "Creates a KeyVault for application secrets (eg. CSI)"
      }
    },
    {
      "condition": "[parameters('keyVaultCreate')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-KeyVaultAppsRbac', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "keyVaultName": "[if(parameters('keyVaultCreate'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultApps', deployment().name), 64)), '2022-09-01').outputs.keyVaultName.value), createObject('value', ''))]",
          "rbacSecretUserSps": {
            "value": "[union(createArray(if(and(variables('deployAppGw'), parameters('appgwKVIntegration')), reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-appgw-{0}', parameters('resourceName'))), '2023-01-31').principalId, '')), createArray(if(parameters('keyVaultAksCSI'), reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').addonProfiles.azureKeyvaultSecretsProvider.identity.objectId, '')))]"
          },
          "rbacSecretOfficerSps": "[if(and(not(empty(parameters('keyVaultOfficerRolePrincipalId'))), parameters('automatedDeployment')), createObject('value', variables('keyVaultOfficerRolePrincipalIds')), createObject('value', createArray()))]",
          "rbacCertOfficerSps": "[if(and(not(empty(parameters('keyVaultOfficerRolePrincipalId'))), parameters('automatedDeployment')), createObject('value', variables('keyVaultOfficerRolePrincipalIds')), createObject('value', createArray()))]",
          "rbacSecretOfficerUsers": "[if(and(not(empty(parameters('keyVaultOfficerRolePrincipalId'))), not(parameters('automatedDeployment'))), createObject('value', variables('keyVaultOfficerRolePrincipalIds')), createObject('value', createArray()))]",
          "rbacCertOfficerUsers": "[if(and(not(empty(parameters('keyVaultOfficerRolePrincipalId'))), not(parameters('automatedDeployment'))), createObject('value', variables('keyVaultOfficerRolePrincipalIds')), createObject('value', createArray()))]"
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "6858223693548064687"
            }
          },
          "parameters": {
            "keyVaultName": {
              "type": "string"
            },
            "rbacSecretUserSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacSecretOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCertOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoUserSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoServiceEncryptSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacKvContributorSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacAdminSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacSecretOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacCertOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacAdminUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            }
          },
          "variables": {
            "keyVaultAdministratorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
            "keyVaultContributorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
            "keyVaultSecretsUserRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
            "keyVaultSecretsOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
            "keyVaultCertsOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
            "keyVaultCryptoUserRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
            "keyVaultCryptoOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
            "keyVaultCryptoServiceEncrpytionRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]"
          },
          "resources": [
            {
              "copy": {
                "name": "rbacSecretUserSp",
                "count": "[length(parameters('rbacSecretUserSps'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretUserSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretUserSps')[copyIndex()], variables('keyVaultSecretsUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsUserRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacSecretUserSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacSecretOfficerSp",
                "count": "[length(parameters('rbacSecretOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretOfficerSps')[copyIndex()], variables('keyVaultSecretsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacSecretOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCertsOfficerSp",
                "count": "[length(parameters('rbacCertOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCertOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCertOfficerSps')[copyIndex()], variables('keyVaultCertsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCertsOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCertOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoUserSp",
                "count": "[length(parameters('rbacCryptoUserSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoUserSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoUserSps')[copyIndex()], variables('keyVaultCryptoUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoUserRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoUserSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoServiceEncryptionSp",
                "count": "[length(parameters('rbacCryptoServiceEncryptSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoServiceEncryptSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoServiceEncryptSps')[copyIndex()], variables('keyVaultCryptoServiceEncrpytionRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoServiceEncrpytionRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoServiceEncryptSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacKvContributorSp",
                "count": "[length(parameters('rbacKvContributorSps'))]"
              },
              "condition": "[not(empty(parameters('rbacKvContributorSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacKvContributorSps')[copyIndex()], variables('keyVaultContributorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultContributorRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacKvContributorSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoOfficerSp",
                "count": "[length(parameters('rbacCryptoOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoOfficerSps')[copyIndex()], variables('keyVaultCryptoUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacAdminSp",
                "count": "[length(parameters('rbacAdminSps'))]"
              },
              "condition": "[not(empty(parameters('rbacAdminSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacAdminSps')[copyIndex()], variables('keyVaultAdministratorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultAdministratorRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacAdminSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoOfficerUser",
                "count": "[length(parameters('rbacCryptoOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoOfficerUsers')[copyIndex()], variables('keyVaultCryptoOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacCryptoOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacSecretOfficerUser",
                "count": "[length(parameters('rbacSecretOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretOfficerUsers')[copyIndex()], variables('keyVaultSecretsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacSecretOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCertsOfficerUser",
                "count": "[length(parameters('rbacCertOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacCertOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCertOfficerUsers')[copyIndex()], variables('keyVaultCertsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCertsOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacCertOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacAdminUser",
                "count": "[length(parameters('rbacAdminUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacAdminUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacAdminUsers')[copyIndex()], variables('keyVaultAdministratorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultAdministratorRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacAdminUsers')[copyIndex()]]"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-appgw-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultApps', deployment().name), 64))]"
      ],
      "metadata": {
        "description": "A seperate module is used for RBAC to avoid delaying the KeyVault creation and causing a circular reference."
      }
    },
    {
      "condition": "[variables('keyVaultKmsCreateAndPrereqs')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-keyvaultKms-{1}', deployment().name, parameters('resourceName')), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "resourceName": {
            "value": "[take(format('kms{0}', parameters('resourceName')), 20)]"
          },
          "keyVaultPurgeProtection": {
            "value": "[parameters('keyVaultPurgeProtection')]"
          },
          "keyVaultSoftDelete": {
            "value": "[parameters('keyVaultSoftDelete')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "privateLinks": {
            "value": "[parameters('privateLinks')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "2160890359984794954"
            }
          },
          "parameters": {
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "minLength": 2,
              "metadata": {
                "description": "The location to use for the deployment. defaults to Resource Groups location."
              }
            },
            "resourceName": {
              "type": "string",
              "minLength": 3,
              "maxLength": 20,
              "metadata": {
                "description": "Used to name all resources"
              }
            },
            "privateLinks": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Enable support for private links"
              }
            },
            "keyVaultSoftDelete": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "If soft delete protection is enabled"
              }
            },
            "keyVaultPurgeProtection": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "If purge protection is enabled"
              }
            },
            "keyVaultIPAllowlist": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Add IP to KV firewall allow-list"
              }
            },
            "logAnalyticsWorkspaceId": {
              "type": "string",
              "defaultValue": ""
            }
          },
          "variables": {
            "copy": [
              {
                "name": "kvIPRules",
                "count": "[length(parameters('keyVaultIPAllowlist'))]",
                "input": {
                  "value": "[parameters('keyVaultIPAllowlist')[copyIndex('kvIPRules')]]"
                }
              }
            ],
            "akvName": "[take(format('kv-{0}{1}', replace(parameters('resourceName'), '-', ''), uniqueString(resourceGroup().id, parameters('resourceName'))), 24)]"
          },
          "resources": [
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2022-07-01",
              "name": "[variables('akvName')]",
              "location": "[parameters('location')]",
              "properties": {
                "tenantId": "[subscription().tenantId]",
                "sku": {
                  "family": "A",
                  "name": "standard"
                },
                "publicNetworkAccess": "[if(and(parameters('privateLinks'), empty(parameters('keyVaultIPAllowlist'))), 'disabled', 'enabled')]",
                "networkAcls": "[if(and(parameters('privateLinks'), not(empty(parameters('keyVaultIPAllowlist')))), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny', 'ipRules', variables('kvIPRules'), 'virtualNetworkRules', createArray()), createObject())]",
                "enableRbacAuthorization": true,
                "enabledForDeployment": false,
                "enabledForDiskEncryption": false,
                "enabledForTemplateDeployment": false,
                "enableSoftDelete": "[parameters('keyVaultSoftDelete')]",
                "enablePurgeProtection": "[if(parameters('keyVaultPurgeProtection'), true(), null())]"
              }
            },
            {
              "condition": "[not(empty(parameters('logAnalyticsWorkspaceId')))]",
              "type": "Microsoft.Insights/diagnosticSettings",
              "apiVersion": "2021-05-01-preview",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', variables('akvName'))]",
              "name": "kvDiags",
              "properties": {
                "workspaceId": "[parameters('logAnalyticsWorkspaceId')]",
                "logs": [
                  {
                    "category": "AuditEvent",
                    "enabled": true
                  }
                ],
                "metrics": [
                  {
                    "category": "AllMetrics",
                    "enabled": true
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', variables('akvName'))]"
              ]
            }
          ],
          "outputs": {
            "keyVaultName": {
              "type": "string",
              "value": "[variables('akvName')]"
            },
            "keyVaultId": {
              "type": "string",
              "value": "[resourceId('Microsoft.KeyVault/vaults', variables('akvName'))]"
            }
          }
        }
      },
      "metadata": {
        "description": "Creates a new Key vault for a new KMS Key"
      }
    },
    {
      "condition": "[variables('keyVaultKmsCreateAndPrereqs')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-keyvaultKmsRbacs-{1}', deployment().name, parameters('resourceName')), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "keyVaultName": "[if(parameters('keyVaultKmsCreate'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKms-{1}', deployment().name, parameters('resourceName')), 64)), '2022-09-01').outputs.keyVaultName.value), createObject('value', ''))]",
          "rbacCryptoUserSps": {
            "value": [
              "[if(not(empty(parameters('byoUaiName'))), reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('byoUaiName')), '2023-01-31').principalId, if(variables('createAksUai'), reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName'))), '2023-01-31').principalId, ''))]"
            ]
          },
          "rbacCryptoOfficerUsers": {
            "value": [
              "[if(and(not(empty(parameters('keyVaultKmsOfficerRolePrincipalId'))), not(parameters('automatedDeployment'))), parameters('keyVaultKmsOfficerRolePrincipalId'), '')]"
            ]
          },
          "rbacCryptoOfficerSps": {
            "value": [
              "[if(and(not(empty(parameters('keyVaultKmsOfficerRolePrincipalId'))), parameters('automatedDeployment')), parameters('keyVaultKmsOfficerRolePrincipalId'), '')]"
            ]
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "6858223693548064687"
            }
          },
          "parameters": {
            "keyVaultName": {
              "type": "string"
            },
            "rbacSecretUserSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacSecretOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCertOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoUserSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoServiceEncryptSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacKvContributorSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacAdminSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacSecretOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacCertOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacAdminUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            }
          },
          "variables": {
            "keyVaultAdministratorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
            "keyVaultContributorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
            "keyVaultSecretsUserRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
            "keyVaultSecretsOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
            "keyVaultCertsOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
            "keyVaultCryptoUserRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
            "keyVaultCryptoOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
            "keyVaultCryptoServiceEncrpytionRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]"
          },
          "resources": [
            {
              "copy": {
                "name": "rbacSecretUserSp",
                "count": "[length(parameters('rbacSecretUserSps'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretUserSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretUserSps')[copyIndex()], variables('keyVaultSecretsUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsUserRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacSecretUserSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacSecretOfficerSp",
                "count": "[length(parameters('rbacSecretOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretOfficerSps')[copyIndex()], variables('keyVaultSecretsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacSecretOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCertsOfficerSp",
                "count": "[length(parameters('rbacCertOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCertOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCertOfficerSps')[copyIndex()], variables('keyVaultCertsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCertsOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCertOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoUserSp",
                "count": "[length(parameters('rbacCryptoUserSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoUserSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoUserSps')[copyIndex()], variables('keyVaultCryptoUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoUserRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoUserSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoServiceEncryptionSp",
                "count": "[length(parameters('rbacCryptoServiceEncryptSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoServiceEncryptSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoServiceEncryptSps')[copyIndex()], variables('keyVaultCryptoServiceEncrpytionRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoServiceEncrpytionRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoServiceEncryptSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacKvContributorSp",
                "count": "[length(parameters('rbacKvContributorSps'))]"
              },
              "condition": "[not(empty(parameters('rbacKvContributorSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacKvContributorSps')[copyIndex()], variables('keyVaultContributorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultContributorRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacKvContributorSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoOfficerSp",
                "count": "[length(parameters('rbacCryptoOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoOfficerSps')[copyIndex()], variables('keyVaultCryptoUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacAdminSp",
                "count": "[length(parameters('rbacAdminSps'))]"
              },
              "condition": "[not(empty(parameters('rbacAdminSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacAdminSps')[copyIndex()], variables('keyVaultAdministratorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultAdministratorRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacAdminSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoOfficerUser",
                "count": "[length(parameters('rbacCryptoOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoOfficerUsers')[copyIndex()], variables('keyVaultCryptoOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacCryptoOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacSecretOfficerUser",
                "count": "[length(parameters('rbacSecretOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretOfficerUsers')[copyIndex()], variables('keyVaultSecretsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacSecretOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCertsOfficerUser",
                "count": "[length(parameters('rbacCertOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacCertOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCertOfficerUsers')[copyIndex()], variables('keyVaultCertsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCertsOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacCertOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacAdminUser",
                "count": "[length(parameters('rbacAdminUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacAdminUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacAdminUsers')[copyIndex()], variables('keyVaultAdministratorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultAdministratorRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacAdminUsers')[copyIndex()]]"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKms-{1}', deployment().name, parameters('resourceName')), 64))]"
      ]
    },
    {
      "condition": "[not(empty(parameters('keyVaultKmsByoKeyId')))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-keyvaultKmsByoRbacs-{1}', deployment().name, parameters('resourceName')), 64)]",
      "resourceGroup": "[parameters('keyVaultKmsByoRG')]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "keyVaultName": {
            "value": "[variables('keyVaultKmsByoName')]"
          },
          "rbacKvContributorSps": {
            "value": [
              "[if(parameters('privateLinks'), if(not(empty(parameters('byoUaiName'))), reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('byoUaiName')), '2023-01-31').principalId, if(variables('createAksUai'), reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName'))), '2023-01-31').principalId, '')), '')]"
            ]
          },
          "rbacCryptoUserSps": {
            "value": [
              "[if(not(empty(parameters('byoUaiName'))), reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('byoUaiName')), '2023-01-31').principalId, if(variables('createAksUai'), reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName'))), '2023-01-31').principalId, ''))]"
            ]
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "6858223693548064687"
            }
          },
          "parameters": {
            "keyVaultName": {
              "type": "string"
            },
            "rbacSecretUserSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacSecretOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCertOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoUserSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoOfficerSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoServiceEncryptSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacKvContributorSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacAdminSps": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of Service Principal IDs"
              }
            },
            "rbacCryptoOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacSecretOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacCertOfficerUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            },
            "rbacAdminUsers": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "An array of User IDs"
              }
            }
          },
          "variables": {
            "keyVaultAdministratorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
            "keyVaultContributorRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
            "keyVaultSecretsUserRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
            "keyVaultSecretsOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
            "keyVaultCertsOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
            "keyVaultCryptoUserRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
            "keyVaultCryptoOfficerRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
            "keyVaultCryptoServiceEncrpytionRole": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]"
          },
          "resources": [
            {
              "copy": {
                "name": "rbacSecretUserSp",
                "count": "[length(parameters('rbacSecretUserSps'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretUserSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretUserSps')[copyIndex()], variables('keyVaultSecretsUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsUserRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacSecretUserSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacSecretOfficerSp",
                "count": "[length(parameters('rbacSecretOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretOfficerSps')[copyIndex()], variables('keyVaultSecretsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacSecretOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCertsOfficerSp",
                "count": "[length(parameters('rbacCertOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCertOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCertOfficerSps')[copyIndex()], variables('keyVaultCertsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCertsOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCertOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoUserSp",
                "count": "[length(parameters('rbacCryptoUserSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoUserSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoUserSps')[copyIndex()], variables('keyVaultCryptoUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoUserRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoUserSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoServiceEncryptionSp",
                "count": "[length(parameters('rbacCryptoServiceEncryptSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoServiceEncryptSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoServiceEncryptSps')[copyIndex()], variables('keyVaultCryptoServiceEncrpytionRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoServiceEncrpytionRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoServiceEncryptSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacKvContributorSp",
                "count": "[length(parameters('rbacKvContributorSps'))]"
              },
              "condition": "[not(empty(parameters('rbacKvContributorSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacKvContributorSps')[copyIndex()], variables('keyVaultContributorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultContributorRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacKvContributorSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoOfficerSp",
                "count": "[length(parameters('rbacCryptoOfficerSps'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoOfficerSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoOfficerSps')[copyIndex()], variables('keyVaultCryptoUserRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoOfficerRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacCryptoOfficerSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacAdminSp",
                "count": "[length(parameters('rbacAdminSps'))]"
              },
              "condition": "[not(empty(parameters('rbacAdminSps')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacAdminSps')[copyIndex()], variables('keyVaultAdministratorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultAdministratorRole')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('rbacAdminSps')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCryptoOfficerUser",
                "count": "[length(parameters('rbacCryptoOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacCryptoOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCryptoOfficerUsers')[copyIndex()], variables('keyVaultCryptoOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCryptoOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacCryptoOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacSecretOfficerUser",
                "count": "[length(parameters('rbacSecretOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacSecretOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacSecretOfficerUsers')[copyIndex()], variables('keyVaultSecretsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultSecretsOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacSecretOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacCertsOfficerUser",
                "count": "[length(parameters('rbacCertOfficerUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacCertOfficerUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacCertOfficerUsers')[copyIndex()], variables('keyVaultCertsOfficerRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultCertsOfficerRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacCertOfficerUsers')[copyIndex()]]"
              }
            },
            {
              "copy": {
                "name": "rbacAdminUser",
                "count": "[length(parameters('rbacAdminUsers'))]"
              },
              "condition": "[not(empty(parameters('rbacAdminUsers')[copyIndex()]))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), parameters('rbacAdminUsers')[copyIndex()], variables('keyVaultAdministratorRole'))]",
              "properties": {
                "roleDefinitionId": "[variables('keyVaultAdministratorRole')]",
                "principalType": "User",
                "principalId": "[parameters('rbacAdminUsers')[copyIndex()]]"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[and(variables('keyVaultKmsCreateAndPrereqs'), greater(variables('kmsRbacWaitSeconds'), 0))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-keyvaultKmsRbac-waits-{1}', deployment().name, parameters('resourceName')), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "waitSeconds": {
            "value": "[variables('kmsRbacWaitSeconds')]"
          },
          "location": {
            "value": "[parameters('location')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.8.9.13224",
              "templateHash": "2218759242619531802"
            }
          },
          "parameters": {
            "waitSeconds": {
              "type": "int",
              "metadata": {
                "description": "The number of seconds to wait for"
              },
              "maxValue": 180,
              "minValue": 1
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "The location to deploy the resources to"
              }
            }
          },
          "resources": [
            {
              "type": "Microsoft.Resources/deploymentScripts",
              "apiVersion": "2020-10-01",
              "name": "DeployDelay",
              "location": "[parameters('location')]",
              "kind": "AzurePowerShell",
              "properties": {
                "retentionInterval": "PT1H",
                "azPowerShellVersion": "6.4",
                "cleanupPreference": "OnSuccess",
                "environmentVariables": [
                  {
                    "name": "waitSeconds",
                    "value": "[format('{0}', parameters('waitSeconds'))]"
                  }
                ],
                "scriptContent": "write-output \"Sleeping for $Env:waitSeconds\"; start-sleep -Seconds $Env:waitSeconds"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKmsRbacs-{1}', deployment().name, parameters('resourceName')), 64))]"
      ],
      "metadata": {
        "description": "It can take time for the RBAC to propagate, this delays the deployment to avoid this problem"
      }
    },
    {
      "condition": "[variables('keyVaultKmsCreateAndPrereqs')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-keyvaultKmsKeys-{1}', deployment().name, parameters('resourceName')), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "keyVaultName": "[if(variables('keyVaultKmsCreateAndPrereqs'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKms-{1}', deployment().name, parameters('resourceName')), 64)), '2022-09-01').outputs.keyVaultName.value), createObject('value', ''))]"
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "15227843879918428187"
            }
          },
          "parameters": {
            "keyVaultName": {
              "type": "string"
            }
          },
          "resources": [
            {
              "type": "Microsoft.KeyVault/vaults/keys",
              "apiVersion": "2022-07-01",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'kmskey')]",
              "properties": {
                "kty": "RSA",
                "keySize": 2048,
                "keyOps": [
                  "wrapKey",
                  "unwrapKey",
                  "decrypt",
                  "encrypt",
                  "verify",
                  "sign"
                ]
              }
            }
          ],
          "outputs": {
            "keyVaultKmsKeyUri": {
              "type": "string",
              "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), 'kmskey'), '2022-07-01').keyUriWithVersion]"
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKms-{1}', deployment().name, parameters('resourceName')), 64))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKmsRbac-waits-{1}', deployment().name, parameters('resourceName')), 64))]"
      ],
      "metadata": {
        "description": "Adding a key to the keyvault... We can only do this for public key vaults"
      }
    },
    {
      "condition": "[and(and(and(parameters('custom_vnet'), not(empty(parameters('registries_sku')))), parameters('privateLinks')), parameters('acrPrivatePool'))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-acrprivatepool', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "acrName": {
            "value": "[variables('acrName')]"
          },
          "acrPoolSubnetId": "[if(parameters('custom_vnet'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.acrPoolSubnetId.value), createObject('value', ''))]",
          "location": {
            "value": "[parameters('location')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "8355596698622263077"
            }
          },
          "parameters": {
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]"
            },
            "acrName": {
              "type": "string"
            },
            "acrPoolSubnetId": {
              "type": "string",
              "defaultValue": ""
            }
          },
          "resources": [
            {
              "type": "Microsoft.ContainerRegistry/registries/agentPools",
              "apiVersion": "2019-06-01-preview",
              "name": "[format('{0}/{1}', parameters('acrName'), 'private-pool')]",
              "location": "[parameters('location')]",
              "properties": {
                "count": 1,
                "os": "Linux",
                "tier": "S1",
                "virtualNetworkSubnetResourceId": "[parameters('acrPoolSubnetId')]"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerRegistry/registries', variables('acrName'))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64))]"
      ]
    },
    {
      "condition": "[and(not(empty(parameters('registries_sku'))), not(empty(parameters('imageNames'))))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-AcrImport', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "acrName": {
            "value": "[variables('acrName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "images": {
            "value": "[parameters('imageNames')]"
          },
          "managedIdentityName": {
            "value": "[format('id-acrImport-{0}-{1}', parameters('resourceName'), parameters('location'))]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.11.1.770",
              "templateHash": "8432140579349303037"
            }
          },
          "parameters": {
            "acrName": {
              "type": "string",
              "metadata": {
                "description": "The name of the Azure Container Registry"
              }
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "The location to deploy the resources to"
              }
            },
            "forceUpdateTag": {
              "type": "string",
              "defaultValue": "[utcNow()]",
              "metadata": {
                "description": "How the deployment script should be forced to execute"
              }
            },
            "rbacRoleNeeded": {
              "type": "string",
              "defaultValue": "b24988ac-6180-42a0-ab88-20f7382dd24c",
              "metadata": {
                "description": "Azure RoleId that are required for the DeploymentScript resource to import images"
              }
            },
            "useExistingManagedIdentity": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Does the Managed Identity already exists, or should be created"
              }
            },
            "managedIdentityName": {
              "type": "string",
              "defaultValue": "id-ContainerRegistryImport",
              "metadata": {
                "description": "Name of the Managed Identity resource"
              }
            },
            "existingManagedIdentitySubId": {
              "type": "string",
              "defaultValue": "[subscription().subscriptionId]",
              "metadata": {
                "description": "For an existing Managed Identity, the Subscription Id it is located in"
              }
            },
            "existingManagedIdentityResourceGroupName": {
              "type": "string",
              "defaultValue": "[resourceGroup().name]",
              "metadata": {
                "description": "For an existing Managed Identity, the Resource Group it is located in"
              }
            },
            "images": {
              "type": "array",
              "metadata": {
                "description": "An array of fully qualified images names to import"
              }
            },
            "initialScriptDelay": {
              "type": "string",
              "defaultValue": "30s",
              "metadata": {
                "description": "A delay before the script import operation starts. Primarily to allow Azure AAD Role Assignments to propagate"
              }
            },
            "cleanupPreference": {
              "type": "string",
              "defaultValue": "OnSuccess",
              "metadata": {
                "description": "When the script resource is cleaned up"
              },
              "allowedValues": [
                "OnSuccess",
                "OnExpiration",
                "Always"
              ]
            }
          },
          "resources": [
            {
              "condition": "[not(parameters('useExistingManagedIdentity'))]",
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "apiVersion": "2018-11-30",
              "name": "[parameters('managedIdentityName')]",
              "location": "[parameters('location')]"
            },
            {
              "condition": "[not(empty(parameters('rbacRoleNeeded')))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2020-08-01-preview",
              "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('acrName'))]",
              "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName')), parameters('rbacRoleNeeded'), if(parameters('useExistingManagedIdentity'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('existingManagedIdentitySubId'), parameters('existingManagedIdentityResourceGroupName')), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName'))))]",
              "properties": {
                "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', parameters('rbacRoleNeeded'))]",
                "principalId": "[if(parameters('useExistingManagedIdentity'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('existingManagedIdentitySubId'), parameters('existingManagedIdentityResourceGroupName')), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), '2018-11-30').principalId, reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), '2018-11-30').principalId)]",
                "principalType": "ServicePrincipal"
              },
              "dependsOn": [
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName'))]"
              ]
            },
            {
              "copy": {
                "name": "createImportImage",
                "count": "[length(parameters('images'))]"
              },
              "type": "Microsoft.Resources/deploymentScripts",
              "apiVersion": "2020-10-01",
              "name": "[format('ACR-Import-{0}-{1}', parameters('acrName'), last(split(replace(parameters('images')[copyIndex()], ':', ''), '/')))]",
              "location": "[parameters('location')]",
              "identity": {
                "type": "UserAssigned",
                "userAssignedIdentities": {
                  "[format('{0}', if(parameters('useExistingManagedIdentity'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('existingManagedIdentitySubId'), parameters('existingManagedIdentityResourceGroupName')), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName'))))]": {}
                }
              },
              "kind": "AzureCLI",
              "properties": {
                "forceUpdateTag": "[parameters('forceUpdateTag')]",
                "azCliVersion": "2.30.0",
                "timeout": "PT30M",
                "retentionInterval": "P1D",
                "environmentVariables": [
                  {
                    "name": "acrName",
                    "value": "[parameters('acrName')]"
                  },
                  {
                    "name": "imageName",
                    "value": "[parameters('images')[copyIndex()]]"
                  },
                  {
                    "name": "initialDelay",
                    "value": "[parameters('initialScriptDelay')]"
                  },
                  {
                    "name": "retryMax",
                    "value": "2"
                  },
                  {
                    "name": "retrySleep",
                    "value": "5s"
                  }
                ],
                "scriptContent": "      #!/bin/bash\n      set -e\n\n      echo \"Waiting on RBAC replication ($initialDelay)\"\n      sleep $initialDelay\n      \n      #Retry loop to catch errors (usually RBAC delays, but 'Error copying blobs' is also not unheard of)\n      retryLoopCount=0\n      until [ $retryLoopCount -ge $retryMax ]\n      do\n        echo \"Importing Image: $imageName into ACR: $acrName\"\n        az acr import -n $acrName --source $imageName --force \\\n          && break\n\n        sleep $retrySleep\n        retryLoopCount=$((retryLoopCount+1))\n      done\n\n    ",
                "cleanupPreference": "[parameters('cleanupPreference')]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName'))]",
                "[extensionResourceId(resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName')), 'Microsoft.Authorization/roleAssignments', guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName')), parameters('rbacRoleNeeded'), if(parameters('useExistingManagedIdentity'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('existingManagedIdentitySubId'), parameters('existingManagedIdentityResourceGroupName')), 'Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')), resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('managedIdentityName')))))]"
              ]
            }
          ],
          "outputs": {
            "importedImages": {
              "type": "array",
              "copy": {
                "count": "[length(parameters('images'))]",
                "input": {
                  "originalImage": "[parameters('images')[copyIndex()]]",
                  "acrHostedImage": "[format('{0}{1}', reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName')), '2021-12-01-preview').loginServer, string(skip(parameters('images')[copyIndex()], indexOf(parameters('images')[copyIndex()], '/'))))]"
                }
              },
              "metadata": {
                "description": "An array of the imported images"
              }
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerRegistry/registries', variables('acrName'))]"
      ]
    },
    {
      "condition": "[and(parameters('azureFirewalls'), parameters('custom_vnet'))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-firewall', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "resourceName": {
            "value": "[parameters('resourceName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "workspaceDiagsId": "[if(variables('createLaw'), createObject('value', resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))), createObject('value', ''))]",
          "fwSubnetId": "[if(and(parameters('azureFirewalls'), parameters('custom_vnet')), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.fwSubnetId.value), createObject('value', ''))]",
          "fwSku": {
            "value": "[parameters('azureFirewallSku')]"
          },
          "fwManagementSubnetId": "[if(and(and(parameters('azureFirewalls'), parameters('custom_vnet')), equals(parameters('azureFirewallSku'), 'Basic')), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.fwMgmtSubnetId.value), createObject('value', ''))]",
          "vnetAksSubnetAddressPrefix": {
            "value": "[parameters('vnetAksSubnetAddressPrefix')]"
          },
          "certManagerFW": {
            "value": "[parameters('certManagerFW')]"
          },
          "appDnsZoneName": "[if(not(empty(parameters('dnsZoneId'))), createObject('value', split(parameters('dnsZoneId'), '/')[8]), createObject('value', ''))]",
          "acrPrivatePool": {
            "value": "[parameters('acrPrivatePool')]"
          },
          "acrAgentPoolSubnetAddressPrefix": {
            "value": "[parameters('acrAgentPoolSubnetAddressPrefix')]"
          },
          "availabilityZones": {
            "value": "[parameters('availabilityZones')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "6234959930905017757"
            }
          },
          "parameters": {
            "resourceName": {
              "type": "string"
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]"
            },
            "workspaceDiagsId": {
              "type": "string",
              "defaultValue": ""
            },
            "fwSubnetId": {
              "type": "string"
            },
            "fwManagementSubnetId": {
              "type": "string",
              "defaultValue": ""
            },
            "vnetAksSubnetAddressPrefix": {
              "type": "string"
            },
            "certManagerFW": {
              "type": "bool",
              "defaultValue": false
            },
            "acrPrivatePool": {
              "type": "bool",
              "defaultValue": false
            },
            "acrAgentPoolSubnetAddressPrefix": {
              "type": "string",
              "defaultValue": ""
            },
            "availabilityZones": {
              "type": "array",
              "defaultValue": []
            },
            "fwSku": {
              "type": "string"
            },
            "appDnsZoneName": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Whitelist dnsZone name (required by cert-manager validation process)"
              }
            }
          },
          "variables": {
            "firewallPublicIpName": "[format('pip-afw-{0}', parameters('resourceName'))]",
            "firewallManagementPublicIpName": "[format('pip-mgmt-afw-{0}', parameters('resourceName'))]",
            "managementIpConfig": {
              "name": "MgmtIpConf",
              "properties": {
                "publicIPAddress": {
                  "id": "[if(not(empty(parameters('fwManagementSubnetId'))), resourceId('Microsoft.Network/publicIPAddresses', variables('firewallManagementPublicIpName')), null())]"
                },
                "subnet": {
                  "id": "[if(not(empty(parameters('fwManagementSubnetId'))), parameters('fwManagementSubnetId'), null())]"
                }
              }
            },
            "fw_name": "[format('afw-{0}', parameters('resourceName'))]"
          },
          "resources": [
            {
              "type": "Microsoft.Network/publicIPAddresses",
              "apiVersion": "2023-04-01",
              "name": "[variables('firewallPublicIpName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "zones": "[if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), createArray())]",
              "properties": {
                "publicIPAllocationMethod": "Static",
                "publicIPAddressVersion": "IPv4"
              }
            },
            {
              "condition": "[equals(parameters('fwSku'), 'Basic')]",
              "type": "Microsoft.Network/publicIPAddresses",
              "apiVersion": "2023-04-01",
              "name": "[variables('firewallManagementPublicIpName')]",
              "location": "[parameters('location')]",
              "sku": {
                "name": "Standard"
              },
              "zones": "[if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), createArray())]",
              "properties": {
                "publicIPAllocationMethod": "Static",
                "publicIPAddressVersion": "IPv4"
              }
            },
            {
              "condition": "[not(empty(parameters('workspaceDiagsId')))]",
              "type": "Microsoft.Insights/diagnosticSettings",
              "apiVersion": "2021-05-01-preview",
              "scope": "[format('Microsoft.Network/azureFirewalls/{0}', variables('fw_name'))]",
              "name": "fwDiags",
              "properties": {
                "workspaceId": "[parameters('workspaceDiagsId')]",
                "logs": [
                  {
                    "category": "AzureFirewallApplicationRule",
                    "enabled": true,
                    "retentionPolicy": {
                      "days": 10,
                      "enabled": false
                    }
                  },
                  {
                    "category": "AzureFirewallNetworkRule",
                    "enabled": true,
                    "retentionPolicy": {
                      "days": 10,
                      "enabled": false
                    }
                  }
                ],
                "metrics": [
                  {
                    "category": "AllMetrics",
                    "enabled": true,
                    "retentionPolicy": {
                      "enabled": false,
                      "days": 0
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/azureFirewalls', variables('fw_name'))]"
              ]
            },
            {
              "type": "Microsoft.Network/azureFirewalls",
              "apiVersion": "2023-04-01",
              "name": "[variables('fw_name')]",
              "location": "[parameters('location')]",
              "zones": "[if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), createArray())]",
              "properties": {
                "sku": {
                  "tier": "[parameters('fwSku')]"
                },
                "ipConfigurations": [
                  {
                    "name": "IpConf1",
                    "properties": {
                      "subnet": {
                        "id": "[parameters('fwSubnetId')]"
                      },
                      "publicIPAddress": {
                        "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('firewallPublicIpName'))]"
                      }
                    }
                  }
                ],
                "managementIpConfiguration": "[if(not(empty(parameters('fwManagementSubnetId'))), variables('managementIpConfig'), null())]",
                "threatIntelMode": "Alert",
                "firewallPolicy": {
                  "id": "[resourceId('Microsoft.Network/firewallPolicies', format('afwp-{0}', parameters('resourceName')))]"
                },
                "applicationRuleCollections": [],
                "networkRuleCollections": []
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/publicIPAddresses', variables('firewallPublicIpName'))]",
                "[resourceId('Microsoft.Network/publicIPAddresses', variables('firewallManagementPublicIpName'))]",
                "[resourceId('Microsoft.Network/firewallPolicies', format('afwp-{0}', parameters('resourceName')))]"
              ]
            },
            {
              "type": "Microsoft.Network/firewallPolicies",
              "apiVersion": "2023-04-01",
              "name": "[format('afwp-{0}', parameters('resourceName'))]",
              "location": "[parameters('location')]",
              "properties": {
                "sku": {
                  "tier": "[parameters('fwSku')]"
                },
                "threatIntelMode": "Alert",
                "threatIntelWhitelist": {
                  "fqdns": [],
                  "ipAddresses": []
                }
              }
            },
            {
              "type": "Microsoft.Network/firewallPolicies/ruleCollectionGroups",
              "apiVersion": "2023-09-01",
              "name": "[format('{0}/{1}', format('afwp-{0}', parameters('resourceName')), 'AKSConstructionRuleGroup')]",
              "properties": {
                "priority": 200,
                "ruleCollections": [
                  {
                    "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                    "name": "CoreAksNetEgress",
                    "priority": 100,
                    "action": {
                      "type": "Allow"
                    },
                    "rules": "[concat(createArray(createObject('name', 'ControlPlaneTCP', 'ruleType', 'NetworkRule', 'ipProtocols', createArray('TCP'), 'sourceAddresses', createArray(parameters('vnetAksSubnetAddressPrefix')), 'destinationAddresses', createArray(format('AzureCloud.{0}', parameters('location'))), 'destinationPorts', createArray('9000', '22')), createObject('name', 'ControlPlaneUDP', 'ruleType', 'NetworkRule', 'ipProtocols', createArray('UDP'), 'sourceAddresses', createArray(parameters('vnetAksSubnetAddressPrefix')), 'destinationAddresses', createArray(format('AzureCloud.{0}', parameters('location'))), 'destinationPorts', createArray('1194')), createObject('name', 'AzureMonitorForContainers', 'ruleType', 'NetworkRule', 'ipProtocols', createArray('TCP'), 'sourceAddresses', createArray(parameters('vnetAksSubnetAddressPrefix')), 'destinationAddresses', createArray('AzureMonitor'), 'destinationPorts', createArray('443'))), if(parameters('acrPrivatePool'), createArray(createObject('name', 'acr-agentpool', 'ruleType', 'NetworkRule', 'ipProtocols', createArray('TCP'), 'sourceAddresses', createArray(parameters('acrAgentPoolSubnetAddressPrefix')), 'destinationAddresses', createArray('AzureKeyVault', 'Storage', 'EventHub', 'AzureActiveDirectory', 'AzureMonitor'), 'destinationPorts', createArray('443'))), createArray()))]"
                  },
                  {
                    "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                    "name": "CoreAksHttpEgress",
                    "priority": 400,
                    "action": {
                      "type": "Allow"
                    },
                    "rules": "[concat(createArray(createObject('name', 'aks', 'ruleType', 'ApplicationRule', 'protocols', createArray(createObject('port', 443, 'protocolType', 'Https'), createObject('port', 80, 'protocolType', 'Http')), 'targetFqdns', createArray(), 'fqdnTags', createArray('AzureKubernetesService'), 'sourceAddresses', createArray(parameters('vnetAksSubnetAddressPrefix')))), if(parameters('certManagerFW'), createArray(createObject('name', 'certman-quay', 'ruleType', 'ApplicationRule', 'protocols', createArray(createObject('port', 443, 'protocolType', 'Https'), createObject('port', 80, 'protocolType', 'Http')), 'targetFqdns', createArray('quay.io', '*.quay.io'), 'sourceAddresses', createArray(parameters('vnetAksSubnetAddressPrefix'))), createObject('name', 'certman-letsencrypt', 'ruleType', 'ApplicationRule', 'protocols', createArray(createObject('port', 443, 'protocolType', 'Https'), createObject('port', 80, 'protocolType', 'Http')), 'targetFqdns', createArray('letsencrypt.org', '*.letsencrypt.org'), 'sourceAddresses', createArray(parameters('vnetAksSubnetAddressPrefix')))), createArray()), if(and(parameters('certManagerFW'), not(empty(parameters('appDnsZoneName')))), createArray(createObject('name', 'certman-appDnsZoneName', 'ruleType', 'ApplicationRule', 'protocols', createArray(createObject('port', 443, 'protocolType', 'Https'), createObject('port', 80, 'protocolType', 'Http')), 'targetFqdns', createArray(parameters('appDnsZoneName'), format('*.{0}', parameters('appDnsZoneName'))), 'sourceAddresses', createArray(parameters('vnetAksSubnetAddressPrefix')))), createArray()))]"
                  },
                  {
                    "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                    "name": "AksWorkloadEgress",
                    "priority": 500,
                    "action": {
                      "type": "Allow"
                    },
                    "rules": [
                      {
                        "name": "GitHub",
                        "ruleType": "ApplicationRule",
                        "protocols": [
                          {
                            "port": 443,
                            "protocolType": "Https"
                          }
                        ],
                        "targetFqdns": [
                          "github.com",
                          "raw.githubusercontent.com"
                        ],
                        "sourceAddresses": [
                          "[parameters('vnetAksSubnetAddressPrefix')]"
                        ]
                      }
                    ]
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/firewallPolicies', format('afwp-{0}', parameters('resourceName')))]"
              ]
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64))]"
      ]
    },
    {
      "condition": "[not(parameters('JustUseSystemPool'))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-userNodePool', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "AksName": {
            "value": "[format('aks-{0}', parameters('resourceName'))]"
          },
          "PoolName": {
            "value": "[variables('poolName')]"
          },
          "subnetId": "[if(parameters('custom_vnet'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksSubnetId.value), createObject('value', parameters('byoAKSSubnetId')))]",
          "podSubnetID": "[if(not(empty(if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksPodSubnetId.value, parameters('byoAKSPodSubnetId')))), if(parameters('custom_vnet'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.aksPodSubnetId.value), createObject('value', parameters('byoAKSPodSubnetId'))), createObject('value', ''))]",
          "agentCount": {
            "value": "[parameters('agentCount')]"
          },
          "agentCountMax": {
            "value": "[parameters('agentCountMax')]"
          },
          "agentVMSize": {
            "value": "[parameters('agentVMSize')]"
          },
          "maxPods": {
            "value": "[parameters('maxPods')]"
          },
          "osDiskType": {
            "value": "[parameters('osDiskType')]"
          },
          "osType": {
            "value": "[parameters('osType')]"
          },
          "osSKU": {
            "value": "[parameters('osSKU')]"
          },
          "enableNodePublicIP": {
            "value": "[parameters('enableNodePublicIP')]"
          },
          "osDiskSizeGB": "[if(equals(parameters('osDiskSizeGB'), 0), createObject('value', variables('defaultOsDiskSizeGB')), createObject('value', parameters('osDiskSizeGB')))]",
          "availabilityZones": {
            "value": "[parameters('availabilityZones')]"
          },
          "spotInstance": {
            "value": "[parameters('nodePoolSpot')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "16424776497471606172"
            }
          },
          "parameters": {
            "AksName": {
              "type": "string"
            },
            "PoolName": {
              "type": "string"
            },
            "availabilityZones": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "The zones to use for a node pool"
              }
            },
            "osDiskType": {
              "type": "string",
              "metadata": {
                "description": "OS disk type"
              }
            },
            "agentVMSize": {
              "type": "string",
              "metadata": {
                "description": "VM SKU"
              }
            },
            "osDiskSizeGB": {
              "type": "int",
              "defaultValue": 0,
              "metadata": {
                "description": "Disk size in GB"
              }
            },
            "agentCount": {
              "type": "int",
              "defaultValue": 1,
              "metadata": {
                "description": "The number of agents for the user node pool"
              }
            },
            "agentCountMax": {
              "type": "int",
              "defaultValue": 3,
              "metadata": {
                "description": "The maximum number of nodes for the user node pool"
              }
            },
            "maxPods": {
              "type": "int",
              "defaultValue": 30,
              "metadata": {
                "description": "The maximum number of pods per node."
              }
            },
            "nodeTaints": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Any taints that should be applied to the node pool"
              }
            },
            "nodeLabels": {
              "type": "object",
              "defaultValue": {},
              "metadata": {
                "description": "Any labels that should be applied to the node pool"
              }
            },
            "subnetId": {
              "type": "string",
              "metadata": {
                "description": "The subnet the node pool will use"
              }
            },
            "podSubnetID": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "The subnet the pods will use"
              }
            },
            "osType": {
              "type": "string",
              "allowedValues": [
                "Linux",
                "Windows"
              ],
              "metadata": {
                "description": "OS Type for the node pool"
              }
            },
            "osSKU": {
              "type": "string",
              "allowedValues": [
                "AzureLinux",
                "Ubuntu",
                "Windows2019",
                "Windows2022"
              ]
            },
            "enableNodePublicIP": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Assign a public IP per node"
              }
            },
            "spotInstance": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "If the node pool should use VM spot instances"
              }
            },
            "autoTaintWindows": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Apply a default sku taint to Windows node pools"
              }
            }
          },
          "variables": {
            "autoScale": "[greater(parameters('agentCountMax'), parameters('agentCount'))]",
            "taints": "[if(parameters('autoTaintWindows'), union(parameters('nodeTaints'), createArray('sku=Windows:NoSchedule')), parameters('nodeTaints'))]",
            "spotProperties": {
              "scaleSetPriority": "Spot",
              "scaleSetEvictionPolicy": "Delete",
              "spotMaxPrice": -1
            },
            "defaultOsDiskSizeGB": "[if(equals(parameters('osType'), 'Linux'), 30, 100)]"
          },
          "resources": [
            {
              "type": "Microsoft.ContainerService/managedClusters/agentPools",
              "apiVersion": "2024-01-01",
              "name": "[format('{0}/{1}', parameters('AksName'), parameters('PoolName'))]",
              "properties": "[union(createObject('mode', 'User', 'vmSize', parameters('agentVMSize'), 'count', parameters('agentCount'), 'minCount', if(variables('autoScale'), parameters('agentCount'), null()), 'maxCount', if(variables('autoScale'), parameters('agentCountMax'), null()), 'enableAutoScaling', variables('autoScale'), 'availabilityZones', if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), null()), 'osDiskType', parameters('osDiskType'), 'osSKU', parameters('osSKU'), 'osDiskSizeGB', if(equals(parameters('osDiskSizeGB'), 0), variables('defaultOsDiskSizeGB'), parameters('osDiskSizeGB')), 'osType', parameters('osType'), 'maxPods', parameters('maxPods'), 'type', 'VirtualMachineScaleSets', 'vnetSubnetID', if(not(empty(parameters('subnetId'))), parameters('subnetId'), null()), 'podSubnetID', if(not(empty(parameters('podSubnetID'))), parameters('podSubnetID'), null()), 'upgradeSettings', if(parameters('spotInstance'), createObject(), createObject('maxSurge', '33%')), 'nodeTaints', variables('taints'), 'nodeLabels', parameters('nodeLabels'), 'enableNodePublicIP', parameters('enableNodePublicIP')), if(parameters('spotInstance'), variables('spotProperties'), createObject()))]"
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64))]"
      ]
    },
    {
      "condition": "[and(and(parameters('enablePrivateCluster'), not(empty(parameters('dnsApiPrivateZoneId')))), variables('createAksUai'))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-addPrivateK8sApiDnsContributor', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "vnetId": {
            "value": ""
          },
          "dnsZoneId": {
            "value": "[parameters('dnsApiPrivateZoneId')]"
          },
          "principalId": "[if(not(empty(parameters('byoUaiName'))), createObject('value', reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('byoUaiName')), '2023-01-31').principalId), if(variables('createAksUai'), createObject('value', reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName'))), '2023-01-31').principalId), createObject('value', '')))]"
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "11633340609312379920"
            }
          },
          "parameters": {
            "dnsZoneId": {
              "type": "string",
              "metadata": {
                "description": "The full Azure resource ID of the DNS zone to use for the AKS cluster"
              }
            },
            "vnetId": {
              "type": "string",
              "metadata": {
                "description": "The id of a virtual network to be linked to a PRIVATE DNS Zone"
              }
            },
            "principalId": {
              "type": "string",
              "metadata": {
                "description": "The AAD identity to create the RBAC against"
              }
            }
          },
          "variables": {
            "dnsZoneIdSegments": "[split(parameters('dnsZoneId'), '/')]",
            "dnsZoneSubscriptionId": "[if(not(empty(parameters('dnsZoneId'))), variables('dnsZoneIdSegments')[2], '')]",
            "dnsZoneRg": "[if(not(empty(parameters('dnsZoneId'))), variables('dnsZoneIdSegments')[4], '')]",
            "dnsZoneName": "[if(not(empty(parameters('dnsZoneId'))), variables('dnsZoneIdSegments')[8], '')]",
            "isDnsZonePrivate": "[if(not(empty(parameters('dnsZoneId'))), equals(variables('dnsZoneIdSegments')[7], 'privateDnsZones'), false())]"
          },
          "resources": [
            {
              "condition": "[not(empty(parameters('dnsZoneId')))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[take(format('{0}-dns-{1}', deployment().name, variables('dnsZoneName')), 64)]",
              "subscriptionId": "[variables('dnsZoneSubscriptionId')]",
              "resourceGroup": "[variables('dnsZoneRg')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "dnsZoneName": {
                    "value": "[variables('dnsZoneName')]"
                  },
                  "isPrivate": {
                    "value": "[variables('isDnsZonePrivate')]"
                  },
                  "vnetId": {
                    "value": "[parameters('vnetId')]"
                  },
                  "principalId": {
                    "value": "[parameters('principalId')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.26.54.24096",
                      "templateHash": "4736783265358516487"
                    }
                  },
                  "parameters": {
                    "dnsZoneName": {
                      "type": "string"
                    },
                    "principalId": {
                      "type": "string"
                    },
                    "isPrivate": {
                      "type": "bool"
                    },
                    "vnetId": {
                      "type": "string",
                      "defaultValue": ""
                    }
                  },
                  "variables": {
                    "DNSZoneContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
                    "PrivateDNSZoneContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]"
                  },
                  "resources": [
                    {
                      "condition": "[not(parameters('isPrivate'))]",
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2022-04-01",
                      "scope": "[format('Microsoft.Network/dnsZones/{0}', parameters('dnsZoneName'))]",
                      "name": "[guid(resourceId('Microsoft.Network/dnsZones', parameters('dnsZoneName')), parameters('principalId'), variables('DNSZoneContributor'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('DNSZoneContributor')]",
                        "principalType": "ServicePrincipal",
                        "principalId": "[parameters('principalId')]"
                      }
                    },
                    {
                      "condition": "[parameters('isPrivate')]",
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2022-04-01",
                      "scope": "[format('Microsoft.Network/privateDnsZones/{0}', parameters('dnsZoneName'))]",
                      "name": "[guid(resourceId('Microsoft.Network/privateDnsZones', parameters('dnsZoneName')), parameters('principalId'), variables('PrivateDNSZoneContributor'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('PrivateDNSZoneContributor')]",
                        "principalType": "ServicePrincipal",
                        "principalId": "[parameters('principalId')]"
                      }
                    },
                    {
                      "condition": "[and(parameters('isPrivate'), not(empty(parameters('vnetId'))))]",
                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
                      "apiVersion": "2020-09-01",
                      "name": "[format('{0}/{1}', parameters('dnsZoneName'), 'privatedns')]",
                      "tags": {},
                      "location": "global",
                      "properties": {
                        "virtualNetwork": {
                          "id": "[parameters('vnetId')]"
                        },
                        "registrationEnabled": false
                      }
                    }
                  ]
                }
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', format('id-aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[variables('createLaw')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[take(format('{0}-aksmetricalerts', deployment().name), 64)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "clusterName": {
            "value": "[format('aks-{0}', parameters('resourceName'))]"
          },
          "logAnalyticsWorkspaceName": {
            "value": "[variables('aks_law_name')]"
          },
          "metricAlertsEnabled": {
            "value": "[parameters('createAksMetricAlerts')]"
          },
          "evalFrequency": {
            "value": "[variables('AlertFrequency').evalFrequency]"
          },
          "windowSize": {
            "value": "[variables('AlertFrequency').windowSize]"
          },
          "alertSeverity": {
            "value": "Informational"
          },
          "logAnalyticsWorkspaceLocation": {
            "value": "[parameters('location')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "201736969119611975"
            }
          },
          "parameters": {
            "clusterName": {
              "type": "string",
              "metadata": {
                "description": "The name of the AKS Cluster to configure the alerts on"
              }
            },
            "logAnalyticsWorkspaceName": {
              "type": "string",
              "metadata": {
                "description": "The name of the Log Analytics workspace to log metric data to"
              }
            },
            "logAnalyticsWorkspaceLocation": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "The location of the Log Analytics workspace"
              }
            },
            "evalFrequency": {
              "type": "string",
              "defaultValue": "PT1M",
              "allowedValues": [
                "PT1M",
                "PT15M"
              ],
              "metadata": {
                "description": "Select the frequency on how often the alert rule should be run. Selecting frequency smaller than granularity of datapoints grouping will result in sliding window evaluation"
              }
            },
            "metricAlertsEnabled": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Create the metric alerts as either enabled or disabled"
              }
            },
            "windowSize": {
              "type": "string",
              "defaultValue": "PT5M",
              "allowedValues": [
                "PT5M",
                "PT1H"
              ],
              "metadata": {
                "description": "Defines the interval over which datapoints are grouped using the aggregation type function"
              }
            },
            "alertSeverity": {
              "type": "string",
              "defaultValue": "Informational",
              "allowedValues": [
                "Critical",
                "Error",
                "Warning",
                "Informational",
                "Verbose"
              ]
            }
          },
          "variables": {
            "alertServerityLookup": {
              "Critical": 0,
              "Error": 1,
              "Warning": 2,
              "Informational": 3,
              "Verbose": 4
            },
            "alertSeverityNumber": "[variables('alertServerityLookup')[parameters('alertSeverity')]]",
            "AksResourceId": "[resourceId('Microsoft.ContainerService/managedClusters', parameters('clusterName'))]"
          },
          "resources": [
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Node CPU utilization high for {0} CI-1', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "host",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "cpuUsagePercentage",
                      "metricNamespace": "Insights.Container/nodes",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 80,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "Node CPU utilization across the cluster.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Node working set memory utilization high for {0} CI-2', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "host",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "memoryWorkingSetPercentage",
                      "metricNamespace": "Insights.Container/nodes",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 80,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "Node working set memory utilization across the cluster.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Jobs completed more than 6 hours ago for {0} CI-11', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "completedJobsCount",
                      "metricNamespace": "Insights.Container/pods",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 0,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors completed jobs (more than 6 hours ago).",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Container CPU usage high for {0} CI-9', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "cpuExceededPercentage",
                      "metricNamespace": "Insights.Container/containers",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 90,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors container CPU utilization.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Container working set memory usage high for {0} CI-10', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "memoryWorkingSetExceededPercentage",
                      "metricNamespace": "Insights.Container/containers",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 90,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors container working set memory utilization.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Pods in failed state for {0} CI-4', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "phase",
                          "operator": "Include",
                          "values": [
                            "Failed"
                          ]
                        }
                      ],
                      "metricName": "podCount",
                      "metricNamespace": "Insights.Container/pods",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 0,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "Pod status monitoring.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Disk usage high for {0} CI-5', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "host",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "device",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "DiskUsedPercentage",
                      "metricNamespace": "Insights.Container/nodes",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 80,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors disk usage for all nodes and storage devices.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Nodes in not ready status for {0} CI-3', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "status",
                          "operator": "Include",
                          "values": [
                            "NotReady"
                          ]
                        }
                      ],
                      "metricName": "nodesCount",
                      "metricNamespace": "Insights.Container/nodes",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 0,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "Node status monitoring.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Containers getting OOM killed for {0} CI-6', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "oomKilledContainerCount",
                      "metricNamespace": "Insights.Container/pods",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 0,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors number of containers killed due to out of memory (OOM) error.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Persistent volume usage high for {0} CI-18', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "podName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetesNamespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "pvUsageExceededPercentage",
                      "metricNamespace": "Insights.Container/persistentvolumes",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 80,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors persistent volume utilization.",
                "enabled": false,
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Pods not in ready state for {0} CI-8', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "PodReadyPercentage",
                      "metricNamespace": "Insights.Container/pods",
                      "name": "Metric1",
                      "operator": "LessThan",
                      "threshold": 80,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors for excessive pods not in the ready state.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "microsoft.containerservice/managedclusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Restarting container count for {0} CI-7', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "criteria": {
                  "allOf": [
                    {
                      "criterionType": "StaticThresholdCriterion",
                      "dimensions": [
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "metricName": "restartingContainerCount",
                      "metricNamespace": "Insights.Container/pods",
                      "name": "Metric1",
                      "operator": "GreaterThan",
                      "threshold": 0,
                      "timeAggregation": "Average",
                      "skipMetricValidation": true
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                },
                "description": "This alert monitors number of containers restarting across the cluster.",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "severity": "[variables('alertSeverityNumber')]",
                "targetResourceType": "Microsoft.ContainerService/managedClusters",
                "windowSize": "[parameters('windowSize')]"
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Container CPU usage violates the configured threshold for {0} CI-19', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "description": "This alert monitors container CPU usage. It uses the threshold defined in the config map.",
                "severity": "[variables('alertSeverityNumber')]",
                "enabled": true,
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "windowSize": "[parameters('windowSize')]",
                "criteria": {
                  "allOf": [
                    {
                      "threshold": 0,
                      "name": "Metric1",
                      "metricNamespace": "Insights.Container/containers",
                      "metricName": "cpuThresholdViolated",
                      "dimensions": [
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "operator": "GreaterThan",
                      "timeAggregation": "Average",
                      "skipMetricValidation": true,
                      "criterionType": "StaticThresholdCriterion"
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                }
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('Container working set memory usage violates the configured threshold for {0} CI-20', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "description": "This alert monitors container working set memory usage. It uses the threshold defined in the config map.",
                "severity": "[variables('alertSeverityNumber')]",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "windowSize": "[parameters('windowSize')]",
                "criteria": {
                  "allOf": [
                    {
                      "threshold": 0,
                      "name": "Metric1",
                      "metricNamespace": "Insights.Container/containers",
                      "metricName": "memoryWorkingSetThresholdViolated",
                      "dimensions": [
                        {
                          "name": "controllerName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetes namespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "operator": "GreaterThan",
                      "timeAggregation": "Average",
                      "skipMetricValidation": true,
                      "criterionType": "StaticThresholdCriterion"
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                }
              }
            },
            {
              "type": "Microsoft.Insights/metricAlerts",
              "apiVersion": "2018-03-01",
              "name": "[format('PV usage violates the configured threshold for {0} CI-21', parameters('clusterName'))]",
              "location": "global",
              "properties": {
                "description": "This alert monitors PV usage. It uses the threshold defined in the config map.",
                "severity": "[variables('alertSeverityNumber')]",
                "enabled": "[parameters('metricAlertsEnabled')]",
                "scopes": [
                  "[variables('AksResourceId')]"
                ],
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "windowSize": "[parameters('windowSize')]",
                "criteria": {
                  "allOf": [
                    {
                      "threshold": 0,
                      "name": "Metric1",
                      "metricNamespace": "Insights.Container/persistentvolumes",
                      "metricName": "pvUsageThresholdViolated",
                      "dimensions": [
                        {
                          "name": "podName",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        },
                        {
                          "name": "kubernetesNamespace",
                          "operator": "Include",
                          "values": [
                            "*"
                          ]
                        }
                      ],
                      "operator": "GreaterThan",
                      "timeAggregation": "Average",
                      "skipMetricValidation": true,
                      "criterionType": "StaticThresholdCriterion"
                    }
                  ],
                  "odata.type": "Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria"
                }
              }
            },
            {
              "type": "Microsoft.Insights/scheduledQueryRules",
              "apiVersion": "2022-08-01-preview",
              "name": "[format('Daily data cap breached for workspace {0} CIQ-1', parameters('logAnalyticsWorkspaceName'))]",
              "location": "[parameters('logAnalyticsWorkspaceLocation')]",
              "properties": {
                "displayName": "[format('Daily data cap breached for workspace {0} CIQ-1', parameters('logAnalyticsWorkspaceName'))]",
                "description": "This alert monitors daily data cap defined on a workspace and fires when the daily data cap is breached.",
                "severity": 1,
                "enabled": "[parameters('metricAlertsEnabled')]",
                "evaluationFrequency": "[parameters('evalFrequency')]",
                "scopes": [
                  "[resourceId('microsoft.operationalinsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
                ],
                "windowSize": "[parameters('windowSize')]",
                "autoMitigate": false,
                "criteria": {
                  "allOf": [
                    {
                      "query": "_LogOperation | where Operation == \"Data collection Status\" | where Detail contains \"OverQuota\"",
                      "timeAggregation": "Count",
                      "operator": "GreaterThan",
                      "threshold": 0,
                      "failingPeriods": {
                        "numberOfEvaluationPeriods": 1,
                        "minFailingPeriodsToAlert": 1
                      }
                    }
                  ]
                },
                "muteActionsDuration": "P1D"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name'))]"
      ]
    },
    {
      "condition": "[not(empty(parameters('automationAccountScheduledStartStop')))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('{0}-Automation', deployment().name)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "location": {
            "value": "[parameters('location')]"
          },
          "automationAccountName": {
            "value": "[format('aa-{0}', parameters('resourceName'))]"
          },
          "runbookName": {
            "value": "aks-cluster-changestate"
          },
          "runbookUri": {
            "value": "https://raw.githubusercontent.com/finoops/aks-cluster-changestate/main/aks-cluster-changestate.ps1"
          },
          "runbookType": {
            "value": "Script"
          },
          "timezone": {
            "value": "[parameters('automationTimeZone')]"
          },
          "schedulesToCreate": {
            "value": [
              {
                "frequency": "[variables('automationFrequency')]",
                "hour": "[parameters('automationStartHour')]",
                "minute": 0
              },
              {
                "frequency": "[variables('automationFrequency')]",
                "hour": "[parameters('automationStopHour')]",
                "minute": 0
              }
            ]
          },
          "runbookJobSchedule": {
            "value": [
              {
                "scheduleName": "[format('{0} - {1}:00', variables('automationFrequency'), padLeft(parameters('automationStartHour'), 2, '0'))]",
                "parameters": {
                  "ResourceGroupName": "[resourceGroup().name]",
                  "AksClusterName": "[format('aks-{0}', parameters('resourceName'))]",
                  "Operation": "start"
                }
              },
              {
                "scheduleName": "[format('{0} - {1}:00', variables('automationFrequency'), padLeft(parameters('automationStopHour'), 2, '0'))]",
                "parameters": {
                  "ResourceGroupName": "[resourceGroup().name]",
                  "AksClusterName": "[format('aks-{0}', parameters('resourceName'))]",
                  "Operation": "stop"
                }
              }
            ]
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "11707982972862085553"
            }
          },
          "definitions": {
            "schedule": {
              "type": "object",
              "properties": {
                "frequency": {
                  "type": "string",
                  "allowedValues": [
                    "Day",
                    "Week",
                    "Weekday"
                  ]
                },
                "hour": {
                  "$ref": "#/definitions/hour"
                },
                "minute": {
                  "$ref": "#/definitions/minute"
                }
              }
            },
            "hour": {
              "type": "int",
              "minValue": 0,
              "maxValue": 23,
              "metadata": {
                "description": "Seperately declaring as a type allows for min/max validation"
              }
            },
            "minute": {
              "type": "int",
              "minValue": 0,
              "maxValue": 59,
              "metadata": {
                "description": "Seperately declaring as a type allows for min/max validation"
              }
            },
            "runbookJob": {
              "type": "object",
              "properties": {
                "scheduleName": {
                  "type": "string"
                },
                "parameters": {
                  "type": "object",
                  "nullable": true
                }
              }
            }
          },
          "parameters": {
            "automationAccountName": {
              "type": "string",
              "metadata": {
                "description": "The name of the Automation Account"
              }
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "Deployment Location"
              }
            },
            "today": {
              "type": "string",
              "defaultValue": "[utcNow('yyyyMMddTHHmmssZ')]",
              "metadata": {
                "description": "Used to reference todays date"
              }
            },
            "timezone": {
              "type": "string",
              "defaultValue": "Etc/UTC",
              "metadata": {
                "description": "The timezone to align schedules to. (Eg. \"Europe/London\" or \"America/Los_Angeles\")"
              }
            },
            "accountSku": {
              "type": "string",
              "defaultValue": "Basic",
              "allowedValues": [
                "Basic",
                "Free"
              ],
              "metadata": {
                "description": "The Automation Account SKU. See https://learn.microsoft.com/en-us/azure/automation/overview#pricing-for-azure-automation"
              }
            },
            "loganalyticsWorkspaceId": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "For Automation job logging"
              }
            },
            "diagnosticCategories": {
              "type": "array",
              "defaultValue": [
                "JobLogs",
                "JobStreams",
                "AuditEvent"
              ],
              "metadata": {
                "description": "Which logging categeories to log"
              }
            },
            "schedulesToCreate": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/schedule"
              },
              "defaultValue": [
                {
                  "frequency": "Day",
                  "hour": 9,
                  "minute": 0
                },
                {
                  "frequency": "Weekday",
                  "hour": 9,
                  "minute": 0
                },
                {
                  "frequency": "Day",
                  "hour": 19,
                  "minute": 0
                },
                {
                  "frequency": "Weekday",
                  "hour": 19,
                  "minute": 0
                },
                {
                  "frequency": "Day",
                  "hour": 0,
                  "minute": 0
                },
                {
                  "frequency": "Weekday",
                  "hour": 0,
                  "minute": 0
                }
              ],
              "metadata": {
                "description": "Automation Schedules to create"
              }
            },
            "runbookJobSchedule": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/runbookJob"
              },
              "metadata": {
                "description": "The Runbook-Schedule Jobs to create with workflow specific parameters"
              }
            },
            "runbookName": {
              "type": "string",
              "metadata": {
                "description": "The name of the runbook to create"
              }
            },
            "runbookType": {
              "type": "string",
              "defaultValue": "Script",
              "allowedValues": [
                "GraphPowerShell",
                "Script"
              ],
              "metadata": {
                "description": "The type of runbook that is being imported"
              }
            },
            "runbookUri": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "The URI to import the runbook code from"
              }
            },
            "runbookDescription": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "A description of what the runbook does"
              }
            }
          },
          "variables": {
            "runbookVersion": "1.0.0.0",
            "tomorrow": "[dateTimeAdd(parameters('today'), 'P1D', 'yyyy-MM-dd')]",
            "timebase": "1900-01-01",
            "scheduleNoExpiry": "9999-12-31T23:59:00+00:00",
            "workWeek": {
              "weekDays": [
                "Monday",
                "Tuesday",
                "Wednesday",
                "Thursday",
                "Friday"
              ]
            }
          },
          "resources": {
            "automationAccount": {
              "type": "Microsoft.Automation/automationAccounts",
              "apiVersion": "2022-08-08",
              "name": "[parameters('automationAccountName')]",
              "location": "[parameters('location')]",
              "identity": {
                "type": "SystemAssigned"
              },
              "properties": {
                "sku": {
                  "name": "[parameters('accountSku')]"
                }
              }
            },
            "automationAccountDiagLogging": {
              "condition": "[not(empty(parameters('loganalyticsWorkspaceId')))]",
              "type": "Microsoft.Insights/diagnosticSettings",
              "apiVersion": "2021-05-01-preview",
              "scope": "[format('Microsoft.Automation/automationAccounts/{0}', parameters('automationAccountName'))]",
              "name": "diags",
              "properties": {
                "copy": [
                  {
                    "name": "logs",
                    "count": "[length(parameters('diagnosticCategories'))]",
                    "input": {
                      "category": "[parameters('diagnosticCategories')[copyIndex('logs')]]",
                      "enabled": true
                    }
                  }
                ],
                "workspaceId": "[parameters('loganalyticsWorkspaceId')]"
              },
              "dependsOn": [
                "automationAccount"
              ]
            },
            "schedules": {
              "copy": {
                "name": "schedules",
                "count": "[length(parameters('schedulesToCreate'))]"
              },
              "type": "Microsoft.Automation/automationAccounts/schedules",
              "apiVersion": "2022-08-08",
              "name": "[format('{0}/{1}', parameters('automationAccountName'), format('{0} - {1}:{2}', parameters('schedulesToCreate')[copyIndex()].frequency, dateTimeAdd(variables('timebase'), format('PT{0}H', parameters('schedulesToCreate')[copyIndex()].hour), 'HH'), dateTimeAdd(variables('timebase'), format('PT{0}M', parameters('schedulesToCreate')[copyIndex()].minute), 'mm')))]",
              "properties": {
                "startTime": "[dateTimeAdd(dateTimeAdd(variables('tomorrow'), format('PT{0}H', parameters('schedulesToCreate')[copyIndex()].hour)), format('PT{0}M', parameters('schedulesToCreate')[copyIndex()].minute), 'yyyy-MM-ddTHH:mm:00+00:00')]",
                "expiryTime": "[variables('scheduleNoExpiry')]",
                "interval": 1,
                "frequency": "[if(equals(parameters('schedulesToCreate')[copyIndex()].frequency, 'Day'), 'Day', 'Week')]",
                "timeZone": "[parameters('timezone')]",
                "advancedSchedule": "[if(equals(parameters('schedulesToCreate')[copyIndex()].frequency, 'Weekday'), variables('workWeek'), createObject())]"
              },
              "dependsOn": [
                "automationAccount"
              ]
            },
            "runbook": {
              "condition": "[not(empty(parameters('runbookName')))]",
              "type": "Microsoft.Automation/automationAccounts/runbooks",
              "apiVersion": "2022-08-08",
              "name": "[format('{0}/{1}', parameters('automationAccountName'), if(not(empty(parameters('runbookName'))), parameters('runbookName'), 'armtemplatevalidationissue'))]",
              "location": "[parameters('location')]",
              "properties": {
                "logVerbose": true,
                "logProgress": true,
                "runbookType": "[parameters('runbookType')]",
                "publishContentLink": {
                  "uri": "[parameters('runbookUri')]",
                  "version": "[variables('runbookVersion')]"
                },
                "description": "[parameters('runbookDescription')]"
              },
              "dependsOn": [
                "automationAccount"
              ]
            },
            "automationJobs": {
              "copy": {
                "name": "automationJobs",
                "count": "[length(parameters('runbookJobSchedule'))]"
              },
              "condition": "[not(empty(parameters('runbookName')))]",
              "type": "Microsoft.Automation/automationAccounts/jobSchedules",
              "apiVersion": "2022-08-08",
              "name": "[format('{0}/{1}', parameters('automationAccountName'), guid(resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccountName')), if(not(empty(parameters('runbookName'))), parameters('runbookName'), 'armtemplatevalidationissue'), parameters('runbookJobSchedule')[copyIndex()].scheduleName))]",
              "properties": {
                "schedule": {
                  "name": "[parameters('runbookJobSchedule')[copyIndex()].scheduleName]"
                },
                "runbook": {
                  "name": "[if(not(empty(parameters('runbookName'))), parameters('runbookName'), 'armtemplatevalidationissue')]"
                },
                "parameters": "[parameters('runbookJobSchedule')[copyIndex()].parameters]"
              },
              "dependsOn": [
                "automationAccount",
                "runbook",
                "schedules"
              ]
            }
          },
          "outputs": {
            "automationAccountId": {
              "type": "string",
              "metadata": {
                "description": "The Automation Account resource Id"
              },
              "value": "[resourceId('Microsoft.Automation/automationAccounts', parameters('automationAccountName'))]"
            },
            "automationAccountPrincipalId": {
              "type": "string",
              "metadata": {
                "description": "The Automation Account identity Principal Id"
              },
              "value": "[reference('automationAccount', '2022-08-08', 'full').identity.principalId]"
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
      ]
    },
    {
      "condition": "[not(empty(parameters('automationAccountScheduledStartStop')))]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('{0}-AutomationRbac', deployment().name)]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "aksName": {
            "value": "[format('aks-{0}', parameters('resourceName'))]"
          },
          "principalId": "[if(not(empty(parameters('automationAccountScheduledStartStop'))), createObject('value', reference(resourceId('Microsoft.Resources/deployments', format('{0}-Automation', deployment().name)), '2022-09-01').outputs.automationAccountPrincipalId.value), createObject('value', ''))]"
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.26.54.24096",
              "templateHash": "3483134545582176875"
            }
          },
          "parameters": {
            "principalId": {
              "type": "string"
            },
            "aksName": {
              "type": "string"
            }
          },
          "variables": {
            "aksContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]"
          },
          "resources": [
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.ContainerService/managedClusters/{0}', parameters('aksName'))]",
              "name": "[guid(resourceId('Microsoft.ContainerService/managedClusters', parameters('aksName')), parameters('principalId'), variables('aksContributor'))]",
              "properties": {
                "roleDefinitionId": "[variables('aksContributor')]",
                "principalType": "ServicePrincipal",
                "principalId": "[parameters('principalId')]"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]",
        "[resourceId('Microsoft.Resources/deployments', format('{0}-Automation', deployment().name))]"
      ],
      "metadata": {
        "description": "Gives the Automation Account permission to stop/start the AKS cluster"
      }
    }
  ],
  "outputs": {
    "CustomVnetId": {
      "type": "string",
      "value": "[if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.vnetId.value, '')]"
    },
    "CustomVnetPrivateLinkSubnetId": {
      "type": "string",
      "value": "[if(parameters('custom_vnet'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-network', deployment().name), 64)), '2022-09-01').outputs.privateLinkSubnetId.value, '')]"
    },
    "keyVaultName": {
      "type": "string",
      "value": "[if(parameters('keyVaultCreate'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultApps', deployment().name), 64)), '2022-09-01').outputs.keyVaultName.value, '')]"
    },
    "keyVaultId": {
      "type": "string",
      "value": "[if(parameters('keyVaultCreate'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultApps', deployment().name), 64)), '2022-09-01').outputs.keyVaultId.value, '')]"
    },
    "keyVaultKmsName": {
      "type": "string",
      "metadata": {
        "description": "The name of the Kms Key Vault"
      },
      "value": "[if(variables('keyVaultKmsCreateAndPrereqs'), reference(resourceId('Microsoft.Resources/deployments', take(format('{0}-keyvaultKms-{1}', deployment().name, parameters('resourceName')), 64)), '2022-09-01').outputs.keyVaultName.value, if(not(empty(parameters('keyVaultKmsByoKeyId'))), variables('keyVaultKmsByoName'), ''))]"
    },
    "kmsCreatePrerequisitesMet": {
      "type": "bool",
      "metadata": {
        "description": "Indicates if the user has supplied all the correct parameter to use a AKSC Created KMS"
      },
      "value": "[variables('keyVaultKmsCreateAndPrereqs')]"
    },
    "containerRegistryName": {
      "type": "string",
      "value": "[if(not(empty(parameters('registries_sku'))), variables('acrName'), '')]"
    },
    "containerRegistryId": {
      "type": "string",
      "value": "[if(not(empty(parameters('registries_sku'))), resourceId('Microsoft.ContainerRegistry/registries', variables('acrName')), '')]"
    },
    "ApplicationGatewayName": {
      "type": "string",
      "value": "[if(variables('deployAppGw'), variables('appgwName'), '')]"
    },
    "userNodePoolName": {
      "type": "string",
      "value": "[parameters('nodePoolName')]"
    },
    "systemNodePoolName": {
      "type": "string",
      "value": "[if(parameters('JustUseSystemPool'), parameters('nodePoolName'), 'npsystem')]"
    },
    "aksPrivateDnsZone": {
      "type": "string",
      "value": "[variables('aksPrivateDnsZone')]"
    },
    "privateFQDN": {
      "type": "string",
      "value": "[if(and(parameters('enablePrivateCluster'), not(equals(parameters('privateClusterDnsMethod'), 'none'))), reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').privateFQDN, '')]"
    },
    "aksPrivateDnsZoneName": {
      "type": "string",
      "value": "[if(and(parameters('enablePrivateCluster'), not(equals(parameters('privateClusterDnsMethod'), 'none'))), join(skip(split(reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').privateFQDN, '.'), 1), '.'), '')]"
    },
    "aksClusterName": {
      "type": "string",
      "value": "[format('aks-{0}', parameters('resourceName'))]"
    },
    "aksOidcIssuerUrl": {
      "type": "string",
      "value": "[if(parameters('oidcIssuer'), reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').oidcIssuerProfile.issuerURL, '')]"
    },
    "aksOidcFedIdentityProperties": {
      "type": "object",
      "metadata": {
        "description": "This output can be directly leveraged when creating a ManagedId Federated Identity"
      },
      "value": {
        "issuer": "[if(parameters('oidcIssuer'), reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').oidcIssuerProfile.issuerURL, '')]",
        "audiences": [
          "api://AzureADTokenExchange"
        ],
        "subject": "system:serviceaccount:ns:svcaccount"
      }
    },
    "aksNodeResourceGroup": {
      "type": "string",
      "metadata": {
        "description": "The name of the managed resource group AKS uses"
      },
      "value": "[reference(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), '2024-01-01').nodeResourceGroup]"
    },
    "aksResourceId": {
      "type": "string",
      "metadata": {
        "description": "The Azure resource id for the AKS cluster"
      },
      "value": "[resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName')))]"
    },
    "fluxReleaseNamespace": {
      "type": "string",
      "value": "[if(parameters('fluxGitOpsAddon'), reference(extensionResourceId(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Microsoft.KubernetesConfiguration/extensions', 'flux'), '2022-11-01').scope.cluster.releaseNamespace, '')]"
    },
    "daprReleaseNamespace": {
      "type": "string",
      "value": "[if(parameters('daprAddon'), reference(extensionResourceId(resourceId('Microsoft.ContainerService/managedClusters', format('aks-{0}', parameters('resourceName'))), 'Microsoft.KubernetesConfiguration/extensions', 'dapr'), '2022-11-01').scope.cluster.releaseNamespace, '')]"
    },
    "LogAnalyticsName": {
      "type": "string",
      "value": "[if(variables('createLaw'), variables('aks_law_name'), '')]"
    },
    "LogAnalyticsGuid": {
      "type": "string",
      "value": "[if(variables('createLaw'), reference(resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name')), '2022-10-01').customerId, '')]"
    },
    "LogAnalyticsId": {
      "type": "string",
      "value": "[if(variables('createLaw'), resourceId('Microsoft.OperationalInsights/workspaces', variables('aks_law_name')), '')]"
    },
    "eventGridName": {
      "type": "string",
      "value": "[if(parameters('createEventGrid'), format('evgt-{0}', format('aks-{0}', parameters('resourceName'))), '')]"
    }
  }
}