feat: WAF Security recommendations res/api-management/service

avm/res/api-management/service/README.md

@@ -8,14 +8,15 @@ This module deploys an API Management Service. The default deployment is set to
 - [Usage examples](#Usage-examples)
 - [Parameters](#Parameters)
 - [Outputs](#Outputs)
+- [Cross-referenced modules](#Cross-referenced-modules)
 - [Notes](#Notes)
 - [Data Collection](#Data-Collection)
 
 ## Resource Types
 
 | Resource Type | API Version |
 | :-- | :-- |
-| `Microsoft.ApiManagement/service` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/service) |
+| `Microsoft.ApiManagement/service` | [2023-05-01-preview](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2023-05-01-preview/service) |
 | `Microsoft.ApiManagement/service/apis` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/apis) |
 | `Microsoft.ApiManagement/service/apis/diagnostics` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/apis/diagnostics) |
 | `Microsoft.ApiManagement/service/apis/policies` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/apis/policies) |
@@ -27,7 +28,7 @@ This module deploys an API Management Service. The default deployment is set to
 | `Microsoft.ApiManagement/service/loggers` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/loggers) |
 | `Microsoft.ApiManagement/service/namedValues` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/namedValues) |
 | `Microsoft.ApiManagement/service/policies` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/policies) |
-| `Microsoft.ApiManagement/service/portalsettings` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/service) |
+| `Microsoft.ApiManagement/service/portalsettings` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/portalsettings) |
 | `Microsoft.ApiManagement/service/products` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/products) |
 | `Microsoft.ApiManagement/service/products/apis` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/products/apis) |
 | `Microsoft.ApiManagement/service/products/groups` | [2022-08-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.ApiManagement/2022-08-01/service/products/groups) |
@@ -336,6 +337,10 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
         displayName: 'Echo API'
         name: 'echo-api'
         path: 'echo'
+        protocols: [
+          'http'
+          'https'
+        ]
         serviceUrl: 'http://echoapi.cloudapp.net/api'
       }
     ]
@@ -572,6 +577,10 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
           "displayName": "Echo API",
           "name": "echo-api",
           "path": "echo",
+          "protocols": [
+            "http",
+            "https"
+          ],
           "serviceUrl": "http://echoapi.cloudapp.net/api"
         }
       ]
@@ -834,6 +843,10 @@ param apis = [
     displayName: 'Echo API'
     name: 'echo-api'
     path: 'echo'
+    protocols: [
+      'http'
+      'https'
+    ]
     serviceUrl: 'http://echoapi.cloudapp.net/api'
   }
 ]
@@ -1129,6 +1142,9 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
         displayName: 'Echo API'
         name: 'echo-api'
         path: 'echo'
+        protocols: [
+          'https'
+        ]
         serviceUrl: 'https://echoapi.cloudapp.net/api'
       }
     ]
@@ -1152,8 +1168,8 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
       {
         name: 'backend'
         tls: {
-          validateCertificateChain: false
-          validateCertificateName: false
+          validateCertificateChain: true
+          validateCertificateName: true
         }
         url: 'https://echoapi.cloudapp.net/api'
       }
@@ -1340,6 +1356,9 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
           "displayName": "Echo API",
           "name": "echo-api",
           "path": "echo",
+          "protocols": [
+            "https"
+          ],
           "serviceUrl": "https://echoapi.cloudapp.net/api"
         }
       ]
@@ -1367,8 +1386,8 @@ module service 'br/public:avm/res/api-management/service:<version>' = {
         {
           "name": "backend",
           "tls": {
-            "validateCertificateChain": false,
-            "validateCertificateName": false
+            "validateCertificateChain": true,
+            "validateCertificateName": true
           },
           "url": "https://echoapi.cloudapp.net/api"
         }
@@ -1573,6 +1592,9 @@ param apis = [
     displayName: 'Echo API'
     name: 'echo-api'
     path: 'echo'
+    protocols: [
+      'https'
+    ]
     serviceUrl: 'https://echoapi.cloudapp.net/api'
   }
 ]
@@ -1596,8 +1618,8 @@ param backends = [
   {
     name: 'backend'
     tls: {
-      validateCertificateChain: false
-      validateCertificateName: false
+      validateCertificateChain: true
+      validateCertificateName: true
     }
     url: 'https://echoapi.cloudapp.net/api'
   }
@@ -1921,7 +1943,7 @@ The diagnostic settings of the service.
 | [`logCategoriesAndGroups`](#parameter-diagnosticsettingslogcategoriesandgroups) | array | The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to `[]` to disable log collection. |
 | [`marketplacePartnerResourceId`](#parameter-diagnosticsettingsmarketplacepartnerresourceid) | string | The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs. |
 | [`metricCategories`](#parameter-diagnosticsettingsmetriccategories) | array | The name of metrics that will be streamed. "allMetrics" includes all possible metrics for the resource. Set to `[]` to disable metric collection. |
-| [`name`](#parameter-diagnosticsettingsname) | string | The name of diagnostic setting. |
+| [`name`](#parameter-diagnosticsettingsname) | string | The name of the diagnostic setting. |
 | [`storageAccountResourceId`](#parameter-diagnosticsettingsstorageaccountresourceid) | string | Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
 | [`workspaceResourceId`](#parameter-diagnosticsettingsworkspaceresourceid) | string | Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
 
@@ -2031,7 +2053,7 @@ Enable or disable the category explicitly. Default is `true`.
 
 ### Parameter: `diagnosticSettings.name`
 
-The name of diagnostic setting.
+The name of the diagnostic setting.
 
 - Required: No
 - Type: string
@@ -2154,7 +2176,7 @@ The managed identity definition for this resource.
 | Parameter | Type | Description |
 | :-- | :-- | :-- |
 | [`systemAssigned`](#parameter-managedidentitiessystemassigned) | bool | Enables system assigned managed identity on the resource. |
-| [`userAssignedResourceIds`](#parameter-managedidentitiesuserassignedresourceids) | array | The resource ID(s) to assign to the resource. |
+| [`userAssignedResourceIds`](#parameter-managedidentitiesuserassignedresourceids) | array | The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption. |
 
 ### Parameter: `managedIdentities.systemAssigned`
 
@@ -2165,7 +2187,7 @@ Enables system assigned managed identity on the resource.
 
 ### Parameter: `managedIdentities.userAssignedResourceIds`
 
-The resource ID(s) to assign to the resource.
+The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption.
 
 - Required: No
 - Type: array
@@ -2429,6 +2451,14 @@ A list of availability zones denoting where the resource needs to come from. Onl
 | `resourceId` | string | The resource ID of the API management service. |
 | `systemAssignedMIPrincipalId` | string | The principal ID of the system assigned identity. |
 
+## Cross-referenced modules
+
+This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
+
+| Reference | Type |
+| :-- | :-- |
+| `br/public:avm/utl/types/avm-common-types:0.4.0` | Remote reference |
+
 ## Notes
 
 The latest version of this module only includes supported versions of the API Management resource. All unsupported versions of API Management have been removed from the related parameters. See the [API Management stv1 platform retirement](https://learn.microsoft.com/en-us/azure/api-management/breaking-changes/stv1-platform-retirement-august-2024) article for more details.

avm/res/api-management/service/api-version-set/main.json

@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "4169716301128870956"
+      "version": "0.32.4.45862",
+      "templateHash": "2984286284615323058"
     },
     "name": "API Management Service API Version Sets",
     "description": "This module deploys an API Management Service API Version Set.",

avm/res/api-management/service/api/diagnostics/main.json

@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "5353729184860596208"
+      "version": "0.32.4.45862",
+      "templateHash": "12634911878831297857"
     },
     "name": "API Management Service APIs Diagnostics.",
     "description": "This module deploys an API Management Service API Diagnostics.",

avm/res/api-management/service/api/main.json

@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "79502668979653596"
+      "version": "0.32.4.45862",
+      "templateHash": "18387862600358779253"
     },
     "name": "API Management Service APIs",
     "description": "This module deploys an API Management Service API.",
@@ -280,8 +280,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.31.34.60546",
-              "templateHash": "7084313641171504315"
+              "version": "0.32.4.45862",
+              "templateHash": "907926791460586140"
             },
             "name": "API Management Service APIs Policies",
             "description": "This module deploys an API Management Service API Policy.",
@@ -427,8 +427,8 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.31.34.60546",
-              "templateHash": "5353729184860596208"
+              "version": "0.32.4.45862",
+              "templateHash": "12634911878831297857"
             },
             "name": "API Management Service APIs Diagnostics.",
             "description": "This module deploys an API Management Service API Diagnostics.",

avm/res/api-management/service/api/policy/main.json

@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "7084313641171504315"
+      "version": "0.32.4.45862",
+      "templateHash": "907926791460586140"
     },
     "name": "API Management Service APIs Policies",
     "description": "This module deploys an API Management Service API Policy.",

avm/res/api-management/service/authorization-server/main.json

@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "7143680740173420481"
+      "version": "0.32.4.45862",
+      "templateHash": "524425489707629463"
     },
     "name": "API Management Service Authorization Servers",
     "description": "This module deploys an API Management Service Authorization Server.",

avm/res/api-management/service/backend/main.json

@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "8388368953433969607"
+      "version": "0.32.4.45862",
+      "templateHash": "2165388618911761186"
     },
     "name": "API Management Service Backends",
     "description": "This module deploys an API Management Service Backend.",

avm/res/api-management/service/cache/main.json

@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "11909687365337883274"
+      "version": "0.32.4.45862",
+      "templateHash": "11874790944759917192"
     },
     "name": "API Management Service Caches",
     "description": "This module deploys an API Management Service Cache.",

avm/res/api-management/service/identity-provider/main.json

@@ -5,8 +5,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "11902978823059118045"
+      "version": "0.32.4.45862",
+      "templateHash": "5753800904617438816"
     },
     "name": "API Management Service Identity Providers",
     "description": "This module deploys an API Management Service Identity Provider.",

avm/res/api-management/service/logger/main.json

@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.31.34.60546",
-      "templateHash": "11518344218995825129"
+      "version": "0.32.4.45862",
+      "templateHash": "18266779272587485714"
     },
     "name": "API Management Service Loggers",
     "description": "This module deploys an API Management Service Logger.",