@gradientedge/cdk-utils-azure 2.19.0 → 2.20.0

package/dist/src/common/tagging.js

@@ -14,6 +14,9 @@ export function isTaggableResource(resourceType) {
         return false;
     if (resourceType.startsWith('pulumi:'))
         return false;
+    if (resourceType.startsWith('azure-native:apimanagement:') &&
+        resourceType !== 'azure-native:apimanagement:ApiManagementService')
+        return false;
     // Extract the resource name from the type (e.g., 'ResourceGroup' from 'azure-native:resources:ResourceGroup')
     const resourceName = resourceType.split(':').pop() || '';
     // Check if this resource is in the exclusion list

package/dist/src/construct/function-app/main.js

@@ -3,6 +3,7 @@ import * as path from 'path';
 import * as archive from '@pulumi/archive';
 import { getConfigurationStoreOutput, } from '@pulumi/azure-native/appconfiguration/index.js';
 import { getComponentOutput } from '@pulumi/azure-native/applicationinsights/index.js';
+import { PrincipalType } from '@pulumi/azure-native/authorization/index.js';
 import { SkuFamily, SkuName } from '@pulumi/azure-native/keyvault/index.js';
 import { listStorageAccountKeysOutput } from '@pulumi/azure-native/storage/index.js';
 import { AuthenticationType, FunctionsDeploymentStorageType, } from '@pulumi/azure-native/web/index.js';
@@ -321,11 +322,11 @@ export class AzureFunctionApp extends CommonAzureConstruct {
      */
     createRoleAssignments() {
         if (this.props.dataStorageAccount) {
-            this.authorisationManager.grantRoleAssignmentToStorageAccount(`${this.id}-data`, this, this.dataStorageAccount.id, this.getFunctionAppPrincipalId(), RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR);
+            this.authorisationManager.grantRoleAssignmentToStorageAccount(`${this.id}-data`, this, this.dataStorageAccount.id, this.getFunctionAppPrincipalId(), this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR));
         }
-        this.authorisationManager.grantRoleAssignmentToStorageAccount(this.id, this, this.appStorageAccount.id, this.getFunctionAppPrincipalId(), RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR);
+        this.authorisationManager.grantRoleAssignmentToStorageAccount(this.id, this, this.appStorageAccount.id, this.getFunctionAppPrincipalId(), this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR));
         if (!this.props.useConfigOverride) {
-            this.authorisationManager.grantRoleAssignmentToApplicationConfiguration(this.id, this, this.appConfig.id, this.getFunctionAppPrincipalId(), RoleDefinitionId.APP_CONFIGURATION_DATA_READER);
+            this.authorisationManager.grantRoleAssignmentToApplicationConfiguration(this.id, this, this.appConfig.id, this.getFunctionAppPrincipalId(), PrincipalType.ServicePrincipal, this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.APP_CONFIGURATION_DATA_READER));
         }
         if (this.appConfigurationsParsedConfig &&
             AzureAppConfigurationManager.hasCosmosDependencies(this.appConfigurationsParsedConfig)) {
@@ -334,12 +335,12 @@ export class AzureFunctionApp extends CommonAzureConstruct {
         if (this.appKeyVaultsByResourceGroup && this.appKeyVaultsByResourceGroup.size > 0) {
             this.appKeyVaultsByResourceGroup.forEach((keyVaultNames, resourceGroup) => {
                 keyVaultNames.forEach(keyVaultName => {
-                    this.authorisationManager.grantRoleAssignmentToKeyVault(this.id, this, keyVaultName, resourceGroup, this.getFunctionAppPrincipalId(), RoleDefinitionId.KEY_VAULT_SECRETS_USER);
+                    this.authorisationManager.grantRoleAssignmentToKeyVault(this.id, this, keyVaultName, resourceGroup, this.getFunctionAppPrincipalId(), this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_SECRETS_USER));
                 });
             });
         }
         if (AzureAppConfigurationManager.hasEventGridTargets(this.appConfigurationsParsedConfig)) {
-            this.authorisationManager.grantRoleAssignmentToEventgridTopic(this.id, this, this.props.existingTopicName, this.props.existingTopicResourceGroupName, this.getFunctionAppPrincipalId(), RoleDefinitionId.EVENTGRID_DATA_SENDER);
+            this.authorisationManager.grantRoleAssignmentToEventgridTopic(this.id, this, this.props.existingTopicName, this.props.existingTopicResourceGroupName, this.getFunctionAppPrincipalId(), this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.EVENTGRID_DATA_SENDER));
         }
     }
     /**

package/dist/src/construct/rest-api/main.js

@@ -1,5 +1,6 @@
-import { HostnameType, LoggerType } from '@pulumi/azure-native/apimanagement/index.js';
+import { getApiManagementServiceOutput, HostnameType, LoggerType } from '@pulumi/azure-native/apimanagement/index.js';
 import { getComponentOutput } from '@pulumi/azure-native/applicationinsights/index.js';
+import { PrincipalType } from '@pulumi/azure-native/authorization/index.js';
 import { getVaultOutput } from '@pulumi/azure-native/keyvault/index.js';
 import * as pulumi from '@pulumi/pulumi';
 import { CommonAzureConstruct } from '../../common/index.js';
@@ -83,7 +84,7 @@ export class AzureRestApi extends CommonAzureConstruct {
                     {
                         hostName: `api-${this.props.locationConfig?.[this.props.location].name}.${this.props.domainName}`,
                         keyVaultId: this.props.apiManagement.certificateKeyVaultId,
-                        type: HostnameType.Management,
+                        type: HostnameType.Proxy,
                     },
                 ];
             }
@@ -97,10 +98,15 @@ export class AzureRestApi extends CommonAzureConstruct {
             this.api.id = this.api.apim.id;
             this.api.name = this.api.apim.name;
             this.api.resourceGroupName = this.resourceGroup.name;
-            if (this.props.apiManagement.certificateKeyVaultId) {
+            const apimIdentity = getApiManagementServiceOutput({
+                serviceName: this.api.apim.name,
+                resourceGroupName: this.resourceGroup.name,
+            }).identity;
+            if (this.props.apiManagement.certificateKeyVaultId && apimIdentity) {
                 this.authorisationManager.createRoleAssignment(`${this.id}-kv-role`, this, {
-                    principalId: this.api.apim.identity.apply(identity => identity?.principalId ?? ''),
-                    roleDefinitionId: RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER,
+                    principalId: apimIdentity.apply(id => id?.principalId ?? ''),
+                    roleDefinitionId: this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER),
+                    principalType: PrincipalType.ServicePrincipal,
                     scope: this.props.apiManagement.certificateKeyVaultId,
                 });
             }
@@ -117,11 +123,18 @@ export class AzureRestApi extends CommonAzureConstruct {
     createNamespaceSecretRole() {
         if (this.props.apiManagement.useExistingApiManagement)
             return;
-        this.api.namedValueRoleAssignment = this.authorisationManager.createRoleAssignment(`${this.id}-key-vault-role-api-namespace`, this, {
-            principalId: this.api.apim.identity.apply(identity => identity?.principalId ?? ''),
-            roleDefinitionId: `/subscriptions/${this.props.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6`,
-            scope: this.api.authKeyVault.id,
-        });
+        const apimIdentity = getApiManagementServiceOutput({
+            serviceName: this.api.apim.name,
+            resourceGroupName: this.resourceGroup.name,
+        }).identity;
+        if (apimIdentity) {
+            this.api.namedValueRoleAssignment = this.authorisationManager.createRoleAssignment(`${this.id}-key-vault-role-api-namespace`, this, {
+                principalId: apimIdentity.apply(id => id?.principalId ?? ''),
+                principalType: PrincipalType.ServicePrincipal,
+                roleDefinitionId: this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_SECRETS_USER),
+                scope: this.api.authKeyVault.id,
+            });
+        }
     }
     /**
      * @summary Method to create the namespace secret in Key Vault for Application Insights
@@ -131,8 +144,8 @@ export class AzureRestApi extends CommonAzureConstruct {
             return;
         this.api.namedValueSecret = this.keyVaultManager.createKeyVaultSecret(`${this.id}-key-vault-api-namespace-secret`, this, {
             vaultName: this.api.authKeyVault.name,
-            secretName: `${this.applicationInsights.name}-${this.id}-key`,
-            resourceGroupName: this.resourceGroup.name,
+            secretName: pulumi.interpolate `${this.applicationInsights.name}-${this.id}-key`,
+            resourceGroupName: this.props.apiAuthKeyVault.resourceGroupName,
             properties: {
                 value: this.applicationInsights.instrumentationKey,
             },
@@ -150,12 +163,12 @@ export class AzureRestApi extends CommonAzureConstruct {
             displayName: 'all-apis',
             state: 'active',
             allowTracing: false,
-            scope: '', // todo
+            scope: '/apis',
         });
         this.keyVaultManager.createKeyVaultSecret(`${this.id}-key-vault-api-subscription-key-secret`, this, {
             vaultName: this.api.authKeyVault.name,
             secretName: `${this.id}-subscription-key`,
-            resourceGroupName: this.resourceGroup.name,
+            resourceGroupName: this.props.apiAuthKeyVault.resourceGroupName,
             properties: {
                 value: apiManagementSubscription.primaryKey.apply(key => key ?? ''),
             },
@@ -171,21 +184,22 @@ export class AzureRestApi extends CommonAzureConstruct {
             displayName: this.applicationInsights.name,
             resourceGroupName: this.resourceGroup.name,
             serviceName: this.api.apim.name,
-            namedValueId: `${this.applicationInsights.name}-key`,
+            namedValueId: pulumi.interpolate `${this.applicationInsights.name}-key`,
             secret: true,
             keyVault: {
-                secretIdentifier: this.api.namedValueSecret.id,
+                secretIdentifier: this.api.namedValueSecret.properties.apply(p => p.secretUri),
             },
         });
         this.api.logger = this.apiManagementManager.createLogger(`${this.id}-am-logger`, this, {
+            loggerId: this.applicationInsights.name,
             resourceGroupName: this.resourceGroup.name,
             serviceName: this.api.apim.name,
             resourceId: this.applicationInsights.id,
             loggerType: LoggerType.ApplicationInsights,
             credentials: {
-                instrumentationKey: `{{${apiAppNamedValue.displayName}}}`,
+                instrumentationKey: pulumi.interpolate `{{${apiAppNamedValue.displayName}}}`,
             },
-        });
+        }, { dependsOn: [apiAppNamedValue] });
     }
     /**
      * @summary Method to create the API diagnostic settings for API Management

package/dist/src/construct/rest-api-function/main.js

@@ -123,7 +123,7 @@ export class AzureRestApiFunction extends AzureFunctionApp {
             if (this.props.apiManagement.certificateKeyVaultId) {
                 this.authorisationManager.createRoleAssignment(`${this.id}-kv-role`, this, {
                     principalId: this.api.apim.identity.apply(identity => identity?.principalId ?? ''),
-                    roleDefinitionId: RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER,
+                    roleDefinitionId: this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER),
                     scope: this.props.apiManagement.certificateKeyVaultId,
                 });
             }

package/dist/src/construct/rest-api-with-cache/main.js

@@ -64,8 +64,8 @@ export class AzureRestApiWithCache extends AzureRestApi {
         }).apply(keys => `${hostName}:10000,password=${keys.primaryKey},ssl=True,abortConnect=False`));
         this.api.redisNamedValueSecret = this.keyVaultManager.createKeyVaultSecret(`${this.id}-key-vault-redis-namespace-secret`, this, {
             vaultName: this.api.authKeyVault.name,
-            secretName: `${this.api.redisCluster.name}key`,
-            resourceGroupName: this.resourceGroup.name,
+            secretName: pulumi.interpolate `${this.api.redisCluster.name}key`,
+            resourceGroupName: this.props.apiAuthKeyVault.resourceGroupName,
             properties: {
                 value: connectionString,
             },
@@ -76,13 +76,13 @@ export class AzureRestApiWithCache extends AzureRestApi {
      */
     createRedisCacheNamespace() {
         this.api.redisNamedValue = this.apiManagementManager.createNamedValue(`${this.id}-redis-nv`, this, {
-            displayName: `${this.api.redisCluster.name}key`,
+            displayName: pulumi.interpolate `${this.api.redisCluster.name}key`,
             resourceGroupName: this.resourceGroup.name,
             serviceName: this.api.apim.name,
-            namedValueId: `${this.api.redisCluster.name}key`,
+            namedValueId: pulumi.interpolate `${this.api.redisCluster.name}key`,
             secret: true,
             keyVault: {
-                secretIdentifier: this.api.redisNamedValueSecret.id,
+                secretIdentifier: this.api.redisNamedValueSecret.properties.apply(p => p.secretUri),
             },
         });
     }
@@ -92,11 +92,11 @@ export class AzureRestApiWithCache extends AzureRestApi {
     createRedisCacheApiManagement() {
         this.apiManagementManager.createCache(`${this.id}-am-redis-cache`, this, {
             serviceName: this.api.apim.name,
-            connectionString: `{{${this.api.redisNamedValue.name}}}`,
-            cacheId: this.api.redisCluster.id,
+            connectionString: pulumi.interpolate `{{${this.api.redisNamedValue.name}}}`,
+            cacheId: this.api.redisCluster.name,
             resourceGroupName: this.resourceGroup.name,
             useFromLocation: this.api.redisCluster.location,
-            description: `Redis cache for ${this.api.apim.name}`,
+            description: pulumi.interpolate `Redis cache for ${this.api.apim.name}`,
         });
     }
 }

package/dist/src/services/api-management/main.d.ts

@@ -71,7 +71,7 @@ export declare class AzureApiManagementManager {
      * @param resourceOptions Optional settings to control resource behaviour
      * @see [Pulumi Azure Native API Management Diagnostic]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/apimanagement/apidiagnostic/}
      */
-    createApiDiagnostic(id: string, scope: CommonAzureConstruct, props: ApiDiagnosticProps, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/apimanagement/apiDiagnostic.js").ApiDiagnostic;
+    createApiDiagnostic(id: string, scope: CommonAzureConstruct, props: ApiDiagnosticProps, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/apimanagement/diagnostic.js").Diagnostic;
     /**
      * @summary Method to create a new API Logger
      * @param id scoped id of the resource

package/dist/src/services/api-management/main.js

@@ -1,4 +1,4 @@
-import { Api, ApiDiagnostic, ApiManagementService, ApiOperation, ApiOperationPolicy, ApiPolicy, Backend, BackendProtocol, Cache, getApiManagementServiceOutput, Logger, LoggerType, NamedValue, Protocol, Subscription, } from '@pulumi/azure-native/apimanagement/index.js';
+import { Api, ApiManagementService, ApiOperation, ApiOperationPolicy, ApiPolicy, Backend, BackendProtocol, Cache, Diagnostic, getApiManagementServiceOutput, Logger, LoggerType, NamedValue, Protocol, Subscription, } from '@pulumi/azure-native/apimanagement/index.js';
 import { listDatabaseKeysOutput } from '@pulumi/azure-native/redisenterprise/index.js';
 import * as pulumi from '@pulumi/pulumi';
 /**
@@ -148,7 +148,7 @@ export class AzureApiManagementManager {
     createApiDiagnostic(id, scope, props, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        return new ApiDiagnostic(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new Diagnostic(`${id}`, props, { parent: scope, ...resourceOptions });
     }
     /**
      * @summary Method to create a new API Logger

package/dist/src/services/application-insights/main.js

@@ -30,14 +30,13 @@ export class AzureApplicationInsightsManager {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
         // Get resource group name
-        const resourceGroupName = (props.resourceGroupName ?? scope.props.resourceGroupName)
-            ? `${scope.props.resourceGroupName}-${scope.props.stage}`
-            : props.resourceGroupName;
+        const resourceGroupName = props.resourceGroupName ?? scope.resourceNameFormatter.format(scope.props.resourceGroupName);
         if (!resourceGroupName)
             throw new Error(`Resource group name undefined for ${id}`);
-        const component = new Component(`${id}-ai`, {
+        const resourceName = scope.resourceNameFormatter.format(props.resourceName?.toString(), scope.props.resourceNameOptions?.applicationInsights);
+        const component = new Component(`${id}`, {
             ...props,
-            resourceName: scope.resourceNameFormatter.format(props.resourceName?.toString(), scope.props.resourceNameOptions?.applicationInsights),
+            resourceName,
             resourceGroupName,
             applicationType: props.applicationType ?? ApplicationType.Web,
             kind: props.kind ?? 'web',
@@ -48,7 +47,12 @@ export class AzureApplicationInsightsManager {
             },
         }, { parent: scope, ...resourceOptions });
         if (props.billingFeatures) {
-            this.createComponentCurrentBillingFeature(`${id}-billing`, scope, props.billingFeatures, {
+            this.createComponentCurrentBillingFeature(`${id}-billing`, scope, {
+                ...props.billingFeatures,
+                currentBillingFeatures: props.billingFeatures?.currentBillingFeatures ?? ['Basic'],
+                resourceName,
+                resourceGroupName,
+            }, {
                 parent: scope,
                 ...resourceOptions,
             });

package/dist/src/services/authorisation/main.d.ts

@@ -1,3 +1,4 @@
+import { PrincipalType } from '@pulumi/azure-native/authorization/index.js';
 import { Input, ResourceOptions } from '@pulumi/pulumi';
 import { CommonAzureConstruct } from '../../common/index.js';
 import { RoleDefinitionId } from './constants.js';
@@ -40,7 +41,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToKeyVault(id: string, scope: CommonAzureConstruct, vaultName: string, resourceGroupName: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToKeyVault(id: string, scope: CommonAzureConstruct, vaultName: string, resourceGroupName: Input<string>, principalId: Input<string>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to event grid topic
      * @param id scoped id of the resource
@@ -51,7 +52,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToEventgridTopic(id: string, scope: CommonAzureConstruct, topicName: Input<string>, resourceGroupName: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToEventgridTopic(id: string, scope: CommonAzureConstruct, topicName: Input<string>, resourceGroupName: Input<string>, principalId: Input<string>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to application configuration
      * @param id scoped id of the resource
@@ -61,7 +62,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToApplicationConfiguration(id: string, scope: CommonAzureConstruct, appConfigId: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToApplicationConfiguration(id: string, scope: CommonAzureConstruct, appConfigId: Input<string>, principalId: Input<string>, principalType: Input<PrincipalType>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to storage account
      * @param id scoped id of the resource
@@ -71,7 +72,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToStorageAccount(id: string, scope: CommonAzureConstruct, accountId: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToStorageAccount(id: string, scope: CommonAzureConstruct, accountId: Input<string>, principalId: Input<string>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to storage table
      * @param id scoped id of the resource
@@ -81,5 +82,6 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToStorageTable(id: string, scope: CommonAzureConstruct, tableId: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToStorageTable(id: string, scope: CommonAzureConstruct, tableId: Input<string>, principalId: Input<string>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    resolveRoleDefinitionId(scope: CommonAzureConstruct, roleDefinitionId: RoleDefinitionId): string;
 }

package/dist/src/services/authorisation/main.js

@@ -29,7 +29,7 @@ export class AzureAuthorisationManager {
     createRoleAssignment(id, scope, props, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        return new RoleAssignment(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new RoleAssignment(`${id}`, props, { parent: scope, ignoreChanges: ['scope'], ...resourceOptions });
     }
     /**
      * @summary Method to grant a role assignment to key vault
@@ -79,9 +79,10 @@ export class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToApplicationConfiguration(id, scope, appConfigId, principalId, roleDefinitionId, resourceOptions) {
+    grantRoleAssignmentToApplicationConfiguration(id, scope, appConfigId, principalId, principalType, roleDefinitionId, resourceOptions) {
         return this.createRoleAssignment(`${id}-ac-role`, scope, {
             principalId,
+            principalType,
             roleDefinitionId,
             scope: appConfigId,
         }, resourceOptions);
@@ -118,4 +119,9 @@ export class AzureAuthorisationManager {
             scope: tableId,
         }, resourceOptions);
     }
+    resolveRoleDefinitionId(scope, roleDefinitionId) {
+        if (!scope.props.subscriptionId)
+            throw Error('Subscription id undefined');
+        return `/subscriptions/${scope.props.subscriptionId}${roleDefinitionId}`;
+    }
 }

package/dist/src/services/cosmosdb/main.js

@@ -1,4 +1,5 @@
 import { DatabaseAccount, getDatabaseAccountOutput, getSqlResourceSqlRoleDefinitionOutput, ResourceIdentityType, SqlResourceSqlContainer, SqlResourceSqlDatabase, SqlResourceSqlRoleAssignment, } from '@pulumi/azure-native/cosmosdb/index.js';
+import { v5 as uuidv5 } from 'uuid';
 import { CosmosRoleDefinition, CosmosRoleDefinitionId } from './constants.js';
 /**
  * Provides operations on Azure CosmosDB using Pulumi
@@ -78,14 +79,14 @@ export class AzureCosmosDbManager {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
         // Get resource group name
-        const resourceGroupName = (props.resourceGroupName ?? scope.props.resourceGroupName)
-            ? `${scope.props.resourceGroupName}-${scope.props.stage}`
-            : props.resourceGroupName;
+        const resourceGroupName = props.resourceGroupName ?? scope.resourceNameFormatter.format(scope.props.resourceGroupName);
         if (!resourceGroupName)
             throw new Error(`Resource group name undefined for ${id}`);
         return new SqlResourceSqlContainer(`${id}-cc`, {
             ...props,
-            containerName: scope.resourceNameFormatter.format(props.containerName?.toString(), scope.props.resourceNameOptions?.cosmosDbSqlContainer),
+            ...(props.containerName && {
+                containerName: scope.resourceNameFormatter.format(props.containerName.toString(), scope.props.resourceNameOptions?.cosmosDbSqlContainer),
+            }),
             resourceGroupName,
         }, { parent: scope, ...resourceOptions });
     }
@@ -98,7 +99,11 @@ export class AzureCosmosDbManager {
      * @see [Pulumi Azure Native CosmosDB SQL Role Assignment]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/documentdb/sqlresourcesqlroleassignment/}
      */
     createSqlResourceSqlRoleAssignment(id, scope, props, resourceOptions) {
-        return new SqlResourceSqlRoleAssignment(`${id}`, props, { parent: scope, ...resourceOptions });
+        const namespace = uuidv5(`${scope.id}-${id}`, uuidv5.URL);
+        return new SqlResourceSqlRoleAssignment(`${id}`, {
+            ...props,
+            roleAssignmentId: props.roleAssignmentId ?? uuidv5(id, namespace),
+        }, { parent: scope, ...resourceOptions });
     }
     /**
      * @summary Method to resolve an existing cosmosdb account

package/dist/src/services/eventgrid/main.js

@@ -1,4 +1,4 @@
-import { EventDeliverySchema, EventSubscription, getTopicOutput, SystemTopic, SystemTopicEventSubscription, Topic, } from '@pulumi/azure-native/eventgrid/index.js';
+import { DataResidencyBoundary, EventDeliverySchema, EventSubscription, getTopicOutput, SystemTopic, SystemTopicEventSubscription, TlsVersion, Topic, } from '@pulumi/azure-native/eventgrid/index.js';
 /**
  * Provides operations on Azure Event Grid using Pulumi
  * - A new instance of this class is injected into {@link CommonAzureConstruct} constructor.
@@ -36,6 +36,8 @@ export class AzureEventgridManager {
             topicName: scope.resourceNameFormatter.format(props.topicName?.toString(), scope.props.resourceNameOptions?.eventGridTopic),
             location: props.location ?? scope.props.location,
             resourceGroupName,
+            dataResidencyBoundary: props.dataResidencyBoundary ?? DataResidencyBoundary.WithinGeopair,
+            minimumTlsVersionAllowed: props.minimumTlsVersionAllowed ?? TlsVersion.TlsVersion_1_2,
             tags: {
                 environment: scope.props.stage,
                 ...scope.props.defaultTags,

package/dist/src/services/monitor/main.js

@@ -32,6 +32,6 @@ export class AzureMonitorManager {
         return new DiagnosticSetting(`${id}-ds`, {
             ...props,
             name: scope.resourceNameFormatter.format(props.name?.toString(), scope.props.resourceNameOptions?.monitorDiagnosticSetting),
-        }, { parent: scope, ...resourceOptions });
+        }, { parent: scope, ignoreChanges: ['resourceUri'], ...resourceOptions });
     }
 }

package/dist/src/services/operational-insights/main.js

@@ -1,4 +1,4 @@
-import { Table, Workspace, WorkspaceSkuNameEnum } from '@pulumi/azure-native/operationalinsights/index.js';
+import { Table, TablePlanEnum, Workspace, WorkspaceSkuNameEnum, } from '@pulumi/azure-native/operationalinsights/index.js';
 /**
  * Provides operations on Azure Log Analytics Workspace using Pulumi
  * - A new instance of this class is injected into {@link CommonAzureConstruct} constructor.
@@ -58,6 +58,11 @@ export class AzureOperationalInsightsManager {
     createTable(id, scope, props, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        return new Table(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new Table(`${id}`, {
+            ...props,
+            plan: props.plan ?? TablePlanEnum.Analytics,
+            retentionInDays: props.retentionInDays ?? 30,
+            totalRetentionInDays: props.totalRetentionInDays ?? 30,
+        }, { parent: scope, ...resourceOptions });
     }
 }

package/dist/src/services/portal/main.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import { Dashboard } from '@pulumi/azure-native/portal/index.js';
+import * as pulumi from '@pulumi/pulumi';
 import { AzureDashboardRenderer } from './renderer.js';
 /**
  * Provides operations on Azure Portal Dashboards using Pulumi
@@ -32,21 +33,27 @@ export class AzurePortalManager {
     createDashBoard(id, scope, props, renderer, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        const resourceGroup = scope.resourceGroupManager.resolveResourceGroup(scope, props.resourceGroupName.toString() ?? scope.props.resourceGroupName, resourceOptions);
+        const resourceGroup = scope.resourceGroup ??
+            scope.resourceGroupManager.resolveResourceGroup(scope, props.resourceGroupName.toString() ?? scope.props.resourceGroupName, resourceOptions);
         const dashboardName = scope.resourceNameFormatter.format(props.dashboardName?.toString(), scope.props.resourceNameOptions?.portalDashboard);
         const dashboardRenderer = renderer ?? new AzureDashboardRenderer();
         const templateFile = dashboardRenderer.renderToFile(dashboardName, props);
         const template = fs.readFileSync(templateFile, 'utf-8');
-        const content = Object.entries(props.variables).reduce((result, [key, value]) => result.replaceAll(`\${${key}}`, JSON.stringify(String(value)).slice(1, -1)), template);
+        const keys = Object.keys(props.variables);
+        const values = Object.values(props.variables);
+        const properties = pulumi.all(values).apply(resolved => {
+            const content = keys.reduce((result, key, i) => result.replaceAll(`\${${key}}`, JSON.stringify(String(resolved[i])).slice(1, -1)), template);
+            return JSON.parse(content);
+        });
         return new Dashboard(`${id}-dashboard`, {
             ...props,
             dashboardName: scope.resourceNameFormatter.format(props.dashboardName?.toString(), scope.props.resourceNameOptions?.portalDashboard),
             resourceGroupName: resourceGroup.name,
             location: props.location ?? resourceGroup.location,
-            properties: JSON.parse(content),
+            properties,
             tags: {
                 'hidden-title': `${props.location} - ${props.displayName}`,
             },
-        }, { ...resourceOptions, ignoreChanges: ['location'] });
+        }, { parent: scope, ...resourceOptions, ignoreChanges: ['location'] });
     }
 }

package/dist/src/services/portal/renderer.js

@@ -35,9 +35,8 @@ export class AzureDashboardRenderer {
     render(params) {
         _.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
         // if client is used instead of hosts
-        let partsIndex = 0;
         let yIndex = 0;
-        const parts = {};
+        const parts = [];
         for (const pane of params.panes) {
             try {
                 const paneTemplate = this.getPaneId(pane.id);
@@ -91,8 +90,7 @@ export class AzureDashboardRenderer {
                 const paneJSON = JSON.parse(paneContent);
                 const templateParts = paneJSON.parts;
                 for (const part of templateParts) {
-                    parts[`${partsIndex}`] = part;
-                    partsIndex++;
+                    parts.push(part);
                 }
                 yIndex += paneTemplate.dimensions.height;
             }
@@ -104,12 +102,12 @@ export class AzureDashboardRenderer {
             }
         }
         const dashboard = {
-            lenses: {
-                '0': {
+            lenses: [
+                {
                     order: 0,
                     parts,
                 },
-            },
+            ],
             metadata: {
                 model: {
                     timeRange: {

package/dist/src/services/redis/main.js

@@ -1,4 +1,4 @@
-import { Database, RedisEnterprise, SkuName } from '@pulumi/azure-native/redisenterprise/index.js';
+import { AccessKeysAuthentication, ClusteringPolicy, Database, DeferUpgradeSetting, EvictionPolicy, Protocol, RedisEnterprise, SkuName, } from '@pulumi/azure-native/redisenterprise/index.js';
 /**
  * Provides operations on Azure Managed Redis (Enterprise) using Pulumi
  * - A new instance of this class is injected into {@link CommonAzureConstruct} constructor.
@@ -49,6 +49,13 @@ export class AzureRedisManager {
             clusterName: cluster.name,
             resourceGroupName,
             databaseName: databaseProps?.databaseName ?? 'default',
+            accessKeysAuthentication: databaseProps?.accessKeysAuthentication ?? AccessKeysAuthentication.Enabled,
+            clientProtocol: databaseProps?.clientProtocol ?? Protocol.Encrypted,
+            clusteringPolicy: databaseProps?.clusteringPolicy ?? ClusteringPolicy.OSSCluster,
+            evictionPolicy: databaseProps?.evictionPolicy ?? EvictionPolicy.VolatileLRU,
+            port: databaseProps?.port ?? 10000,
+            persistence: databaseProps?.persistence ?? { aofEnabled: false, rdbEnabled: false },
+            deferUpgrade: databaseProps?.deferUpgrade ?? DeferUpgradeSetting.NotDeferred,
         }, { parent: scope, dependsOn: [cluster], ...resourceOptions });
         return { cluster, database };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradientedge/cdk-utils-azure",
-  "version": "2.19.0",
+  "version": "2.20.0",
   "description": "Azure Pulumi utilities for @gradientedge/cdk-utils",
   "type": "module",
   "main": "dist/src/index.js",
@@ -17,10 +17,11 @@
     "@pulumi/archive": "0.3.7",
     "@pulumi/azure-native": "3.16.0",
     "@pulumi/azuread": "6.9.0",
-    "@pulumi/pulumi": "3.230.0",
+    "@pulumi/pulumi": "3.231.0",
     "@types/lodash": "4.17.24",
     "app-root-path": "3.1.0",
     "lodash": "4.18.1",
+    "uuid": "13.0.0",
     "yaml": "2.8.3",
     "@gradientedge/cdk-utils-common": "2.1.0"
   },