v0.21.0

Summary

This release includes our Q2 FY2025 Policy Refresh, with policy versioning support as the most significant update.

Additionally, this release includes updates to API versions and various bug fixes to enhance stability and functionality.

What's Changed

• docs: Update Accelerator links by @oZakari in #940
• fix: Adding missing permissions for AMA policies by @oZakari in #946
• chore: Update apiversions by @oZakari in #945
• fix: Pin to ALZ PowerShell version which supports line endings function to fix policy workflow by @oZakari in #955
• fix: Update update-policy.yml by @oZakari in #956
• fix: improve handling of definition versions in Bicep output by @jtracey93 in #963
• fix: Fix formatting and add logic for null values from custom policies by @oZakari in #966
• fix: Adding changes that werent saved for policy script by @oZakari in #967
• feat: Q2 FY25 Policy Refresh by @cae-pr-creator in #957
• chore: update version.json for release by @oZakari in #968

Breaking Changes

The policy definition Azure AI Search services should use customer-managed keys to encrypt data at rest has been updated to version 2.0.0. This changes the default effect value from "Deny" to "AuditIfNotExists" while removing "Deny" from allowedValues, therefore we needed to adopt this change in our initiative.

Full Changelog: v0.20.2...v0.21.0

v0.20.2

What's Changed

• feat: move bootstrap examples by @jaredfholgate in #924
• chore: Delete .github/workflows/gh-ado-sync.yml by @jtracey93 in #927
• feat: Add SQL ATP status stream to DCR by @arjenhuitema in #931
• build: bump actions/upload-artifact from 4.4.3 to 4.5.0 by @dependabot in #930
• refactor: Allow option to specify virtual network gateway ip configuration names by @oZakari in #921
• build: bump softprops/action-gh-release from 2.1.0 to 2.2.0 by @dependabot in #926
• build: bump github/codeql-action from 3.27.5 to 3.28.0 by @dependabot in #929
• fix: Add missing DNS zones to policy assignment by @oZakari in #933
• chore: Update version.json by @oZakari in #934

Breaking Changes

None 👍🏼

New Contributors

• @arjenhuitema made their first contribution in #931

Full Changelog: v0.20.1...v0.20.2

v0.20.1

What's Changed

• build: Bump github/codeql-action from 3.27.0 to 3.27.1 by @dependabot in #900
• chore: Adjust permission scopes by @oZakari in #898
• docs: Update known issues wiki by @oZakari in #908
• build: Bump softprops/action-gh-release from 2.0.9 to 2.1.0 by @dependabot in #906
• build: Bump github/codeql-action from 3.27.1 to 3.27.4 by @dependabot in #905
• build: Update permissions at top level and add environment by @oZakari in #904
• docs: Update known issues with Azure PowerShell v13.0.0 by @oZakari in #910
• feat: updates to fix Region name now being appended to azFw policy name #914 by @jtracey93 in #915
• build: Bump github/codeql-action from 3.27.4 to 3.27.5 by @dependabot in #911
• build: Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #913
• build: Bump actions/dependency-review-action from 4.4.0 to 4.5.0 by @dependabot in #912

Breaking Changes

None 👍🏼

Full Changelog: v0.20.0...v0.20.1

v0.20.0

Summary

In this release, the primary update is alignment with the Q1 2025 Policy Refresh.

We've also fixed several bugs, one of which results in some breaking changes, so please see the Breaking Changes section below for additional information.

What's Changed

• feat: Policy Refresh Q1 FY25 by @oZakari in #806
• feat: Update Policy Library (automated) by @cae-pr-creator in #894
• fix: Private DNS Zones Bug (#695) by @jtracey93 in #891
• fix: Resolve a variety of bugs and update api version of private dns zone links resource by @oZakari in #896
• chore: artifact workflow trigger fix by @jaredfholgate in #872
• chore: [StepSecurity] Apply security best practices by @step-security-bot in #876
• build: Bump github/codeql-action from 3.26.10 to 3.26.13 by @dependabot in #879
• build: Bump actions/checkout from 4.1.1 to 4.2.1 by @dependabot in #881
• build: Bump actions/upload-artifact from 4.4.0 to 4.4.3 by @dependabot in #880
• build: Bump softprops/action-gh-release from 2.0.8 to 2.0.9 by @dependabot in #893
• build: Bump github/codeql-action from 3.26.13 to 3.27.0 by @dependabot in #887
• build: Bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot in #889
• build: Bump actions/dependency-review-action from 4.3.4 to 4.4.0 by @dependabot in #892
  Bicep/pull/896

Breaking Changes

Private DNS Zones Breaking Changes

The local private DNS zones modules (privateDnsZones.bicep) has been replaced in the networking related modules in this repo with the AVM Pattern module of avm/ptn/network/private-link-private-dns-zones to resolve bug #695.

This has meant some breaking changes to each of the networking modules that are detailed below.

privateDnsZones.bicep

• This module has been removed as of v0.20.0 and replaced with the AVM Pattern Module of avm/ptn/network/private-link-private-dns-zones. Please use this module going forward.

hubNetworking.bicep & hubNetworking-multiRegion.bicep

• parPrivateDnsZones default value changed to an empty array ([])
  • Only enter values in here if you want to override the defaults in the underlying AVM pattern module. See: https://github.com/Azure/bicep-registry-modules/tree/main/avm/ptn/network/private-link-private-dns-zones#parameter-privatelinkprivatednszones
• parPrivateDnsZoneAutoMergeAzureBackupZone removed from module
• parVirtualNetworkResourceIdsToLinkTo added to module, you can prefer to use this parameter instead of parVirtualNetworkIdToLink & parVirtualNetworkIdToLinkFailover if you wish (they are automatically all merged together by the module anyway)
• The value returned in outPrivateDnsZones has changed

From:

[
  {
    "name": "privatelink.api.azureml.ms",
    "id": "/subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/privateDnsZones/privatelink.api.azureml.ms"
  },
  {
    "name": "privatelink.notebooks.azure.net",
    "id": "subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/privateDnsZones/privatelink.notebooks.azure.net"
  },
  …
]

To:

[
  {
    "pdnsZoneName": "privatelink.api.azureml.ms",
    "virtualNetworkResourceIdsToLinkTo": [
      "/subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/virtualNetworks/alz-hub-uksouth"
    ]
  },
  {
    "pdnsZoneName": "privatelink.notebooks.azure.net",
    "virtualNetworkResourceIdsToLinkTo": [
      "/subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/virtualNetworks/alz-hub-uksouth"
    ]
  },
  …
]

vwanConnectivity.bicep

• parPrivateDnsZones default value changed to an empty array ([])
  • Only enter values in here if you want to override the defaults in the underlying AVM pattern module. See: https://github.com/Azure/bicep-registry-modules/tree/main/avm/ptn/network/private-link-private-dns-zones#parameter-privatelinkprivatednszones
• parVirtualNetworkIdToLink & parVirtualNetworkIdToLinkFailover removed from module and replaced with parVirtualNetworkResourceIdsToLinkTo
• The value returned in outPrivateDnsZones has changed

From:

[
  {
    "name": "privatelink.api.azureml.ms",
    "id": "/subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/privateDnsZones/privatelink.api.azureml.ms"
  },
  {
    "name": "privatelink.notebooks.azure.net",
    "id": "subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/privateDnsZones/privatelink.notebooks.azure.net"
  },
  …
]

To:

[
  {
    "pdnsZoneName": "privatelink.api.azureml.ms",
    "virtualNetworkResourceIdsToLinkTo": [
      "/subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/virtualNetworks/alz-hub-uksouth"
    ]
  },
  {
    "pdnsZoneName": "privatelink.notebooks.azure.net",
    "virtualNetworkResourceIdsToLinkTo": [
      "/subscriptions/<subID>/resourceGroups/<rgID>/providers/Microsoft.Network/virtualNetworks/alz-hub-uksouth"
    ]
  },
  …
]

New Contributors

• @step-security-bot made their first contribution in #876

Full Changelog: v0.19.4...v0.20.0

v0.20.0-pre

Used for testing only.

v0.19.4

Compatibility

This version of the Bicep starter module is only compatible with with versions of the ALZ PowerShell module > 4.0.0: https://github.com/Azure/ALZ-PowerShell-Module/releases/tag/4.0.0

Older version of the PowerShell module will fail.

Summary

Deprecation Notice: ALZ Bicep Accelerator (Classic)

The classic version of the ALZ Bicep Accelerator has been officially deprecated and removed from the ALZ PowerShell Module (supported only in version 3.1.2 or earlier). Users are encouraged to transition to the updated version, which automates the bootstrapping of your Version Control System and Azure resources.

However, if you prefer, you can hold off on updating and wait for the upcoming ALZ-Bicep Refactor that will leverage Azure Verified Modules, providing an enhanced and standardized framework.

Additionally, the Azure Monitor Baseline Alerts (AMBA) guidance is specific to the deprecated classic version. While integration into the updated ALZ-Bicep Accelerator is underway, you can still deploy AMBA as a standalone solution or wait for the upcoming integration.

For more information, see the updated documentation.

What's Changed

• refactor: remove ui support and other hygiene by @jaredfholgate and @oZakari in #869
• build: Bump github/codeql-action from 3.26.9 to 3.26.10 by @dependabot in #870

Breaking Changes

None 👍🏼

Full Changelog: v0.19.3...v0.19.4

v0.19.3

Summary

This release introduces several new capabilities and improvements to the networking modules:

• SNAT Configuration for Azure Firewall: Added support to configure Source Network Address Translation (SNAT) for Azure Firewall resources.
• Active/Active Virtual Network Gateways: Networking modules now support the deployment of active/active virtual network gateways.
• Bug Fixes:
  • Resolved an issue in the ALZ Default Policy Assignments module, where a specific assignment was missing a required role.
  • Fixed an issue with the DDOS resource output, which was missing a condition that caused failures when parDdosEnabled was set to true.

We’ve also introduced a hub networking module and an associated parameter file for use in the Accelerator for deployments targeting two regions. Along with this, a new parameter file for the VWAN module has been added, supporting multi-region deployments within the Accelerator.

Finally, we've added a note in the README indicating that starting in Q4 2024, applicable resources in all modules will be configured to be zone-redundant by default.

What's Changed

• feat: Add SNAT property to firewall resources by @oZakari in #854
• fix: Fix hubNetworking module output when DDoS is disabled by @cconstantin in #861
• chore: Bump github/codeql-action from 3.26.6 to 3.26.8 by @dependabot in #858
• fix: Add role connectedMachineResourceAdministrator to Deploy-vmHybr-Monitoring by @baartch in #862
• fix: General networking fixes and add active-active capability for vnet gateway by @oZakari in #863
• ci: Bump github/codeql-action from 3.26.8 to 3.26.9 by @dependabot in #864
• feat: Multi region support for accelerator by @sebassem in #857

Breaking Changes

None 👍🏼

New Contributors

• @cconstantin made their first contribution in #861

Full Changelog: v0.19.2...v0.19.3

v0.19.2

Summary

This release addresses an issue where the compiled ARM template for the Default Policy Assignments Module was excessively large, resulting in deployment failures.

What's Changed

• fix: Reduce descriptions further by @oZakari in #853

Breaking Changes

None 👍🏼

Full Changelog: v0.19.1...v0.19.2

v0.19.1

Summary

This update introduces the ability to use constrained delegation, adds new linter rules, updates API versions, and includes several bug fixes.

What's Changed

• fix: rename private DNS zone privatelink.dp.kubernetesconfiguration.azure.com by @baartch in #814
• Adding RBAC constrained delegation parameters and guidance in the roleAssignment modules by @sebassem in #816
• Fix safe access linter warnings by @picccard in #827
• Added newer linter-rules by @picccard in #826
• Updated api version for automation account by @picccard in #829
• Bump github/codeql-action from 3.24.9 to 3.26.5 by @dependabot in #840
• Bump gaurav-nelson/github-action-markdown-link-check from 1.0.13 to 1.0.15 by @dependabot in #839
• Bump actions/upload-artifact from 3.pre.node20 to 4.3.6 by @dependabot in #838
• Bump github/super-linter from 4 to 6 by @dependabot in #836
• Bump azure/powershell from 1 to 2 by @dependabot in #837
• Bump ossf/scorecard-action from 2.3.1 to 2.4.0 by @dependabot in #842
• Bump github/codeql-action from 3.26.5 to 3.26.6 by @dependabot in #844
• Bump a11smiles/GitSync from 1.1.4 to 1.2.3 by @dependabot in #843
• Adding a link to RBAC constrained delegation limitations by @sebassem in #847
• fix: Condensed descriptions and add known issue for ALZ Default Policy Assignments Module by @oZakari in #831
• Bump github/super-linter from 6 to 7 by @dependabot in #846
• hygiene: Add semantic versioning by @oZakari in #849
• Bump actions/upload-artifact from 4.3.6 to 4.4.0 by @dependabot in #848

Breaking Changes

None 👍🏼

Full Changelog: v0.19.0...v0.19.1

v0.19.0

Summary

This update brings multi-region support along with guidance for deploying networking components across multiple regions.

We are also excited to introduce V2 of the ALZ-Bicep Accelerator! Expanding on the features of the V1 Accelerator, V2 provides complete automation for setting up continuous integration and deployment environments in both Azure DevOps and GitHub.
New Features and Improvements:

• Support for self-hosted container instances for GitHub Runners and Azure DevOps Agents.
• Templatized pipelines with options to toggle module deployments.
• Group/member approval processes for deployments.
• And many more enhancements!

Note: The classic version of the ALZ Bicep Accelerator will be maintained for a limited time. We recommend migrating to the new version as soon as possible.

What's Changed

• Add DdosEnabled toggle and fix logic modPolicyAssignmentConnEnableDdos by @oZakari in #810
• Bug: Several hygiene fixes and/or cleanup by @oZakari in #809
• bug: Fix deploymentnames in pipeline-scripts to max 64 char by @picccard in #801
• Sentinel onboarding via OnboardingStates API by @cloudchristoph in #811
• [vwanConnectivity] Refactor to support multi-region hubs by @sebassem in #805
• Enhancement: Remove secret references for login by @oZakari in #793
• ALZ bicep modules multi-region guidance by @sebassem in #804
• Implement bicep bootstrap by @jaredfholgate in #799

Breaking Changes

With PR #805, the following parameters were moved into the user-defined type of virtualWanOptionsType to allow for different firewall configurations per hub/region

• parAzFirewallDnsServers
• parAzFirewallIntelMode
• parAzFirewallDnsProxyEnabled
• parAzFirewallTier
• parAzFirewallAvailabilityZones

Full Changelog: v0.18.0...v0.19.0