@gradientedge/cdk-utils-azure 2.19.0 → 2.21.0

package/dist/src/common/tagging.js

@@ -14,6 +14,9 @@ export function isTaggableResource(resourceType) {
         return false;
     if (resourceType.startsWith('pulumi:'))
         return false;
+    if (resourceType.startsWith('azure-native:apimanagement:') &&
+        resourceType !== 'azure-native:apimanagement:ApiManagementService')
+        return false;
     // Extract the resource name from the type (e.g., 'ResourceGroup' from 'azure-native:resources:ResourceGroup')
     const resourceName = resourceType.split(':').pop() || '';
     // Check if this resource is in the exclusion list

package/dist/src/construct/function-app/main.js

@@ -3,6 +3,7 @@ import * as path from 'path';
 import * as archive from '@pulumi/archive';
 import { getConfigurationStoreOutput, } from '@pulumi/azure-native/appconfiguration/index.js';
 import { getComponentOutput } from '@pulumi/azure-native/applicationinsights/index.js';
+import { PrincipalType } from '@pulumi/azure-native/authorization/index.js';
 import { SkuFamily, SkuName } from '@pulumi/azure-native/keyvault/index.js';
 import { listStorageAccountKeysOutput } from '@pulumi/azure-native/storage/index.js';
 import { AuthenticationType, FunctionsDeploymentStorageType, } from '@pulumi/azure-native/web/index.js';
@@ -93,6 +94,7 @@ export class AzureFunctionApp extends CommonAzureConstruct {
         this.appServicePlan = this.appServiceManager.createAppServicePlan(`${this.id}-app-service-plan`, this, {
             ...this.props.functionApp.servicePlan,
             name: this.id,
+            kind: this.props.functionApp.servicePlan?.kind ?? 'functionapp',
             resourceGroupName: this.resourceGroup.name,
             location: this.resourceGroup.location,
         });
@@ -240,7 +242,7 @@ export class AzureFunctionApp extends CommonAzureConstruct {
      * @summary Method to create and configure the function host.json
      */
     createFunctionHosts() {
-        const currentDirectory = path.resolve();
+        const currentDirectory = path.resolve(process.cwd(), '..');
         const hostsJsonFile = `${currentDirectory}/${this.props.functionApp.deploySource}/host.json`;
         if (!fs.existsSync(hostsJsonFile))
             return;
@@ -252,7 +254,7 @@ export class AzureFunctionApp extends CommonAzureConstruct {
      * @summary Method to create the code package archive for deployment
      */
     createCodePackage() {
-        const currentDirectory = path.resolve();
+        const currentDirectory = path.resolve(process.cwd(), '..');
         this.appCodeArchiveFile = archive.getFileOutput({
             type: 'zip',
             sourceDir: `${currentDirectory}/${this.props.functionApp.deploySource}`,
@@ -272,6 +274,7 @@ export class AzureFunctionApp extends CommonAzureConstruct {
         this.app = this.functionManager.createFunctionAppFlexConsumption(`${this.id}-function-app-flex`, this, {
             ...this.props.functionApp,
             name: this.props.functionApp.app?.name ?? this.id,
+            scaleAndConcurrency: this.props.functionApp.app?.scaleAndConcurrency,
             serverFarmId: this.appServicePlan.id,
             resourceGroupName: this.resourceGroup.name,
             functionAppConfig: {
@@ -281,7 +284,7 @@ export class AzureFunctionApp extends CommonAzureConstruct {
                         value: pulumi.interpolate `${this.appStorageAccount.primaryEndpoints.apply(e => e?.blob)}${this.appDeploymentStorageContainer.name}`,
                         authentication: {
                             type: AuthenticationType.StorageAccountConnectionString,
-                            storageAccountConnectionStringName: 'AzureWebJobsStorage',
+                            storageAccountConnectionStringName: 'DEPLOYMENT_STORAGE_CONNECTION_STRING',
                         },
                     },
                 },
@@ -298,7 +301,7 @@ export class AzureFunctionApp extends CommonAzureConstruct {
                         value: this.applicationInsights.instrumentationKey,
                     },
                     {
-                        name: 'AzureWebJobsStorage',
+                        name: 'DEPLOYMENT_STORAGE_CONNECTION_STRING',
                         value: pulumi.interpolate `DefaultEndpointsProtocol=https;AccountName=${this.appStorageAccount.name};AccountKey=${listStorageAccountKeysOutput({
                             resourceGroupName: this.resourceGroup.name,
                             accountName: this.appStorageAccount.name,
@@ -321,11 +324,11 @@ export class AzureFunctionApp extends CommonAzureConstruct {
      */
     createRoleAssignments() {
         if (this.props.dataStorageAccount) {
-            this.authorisationManager.grantRoleAssignmentToStorageAccount(`${this.id}-data`, this, this.dataStorageAccount.id, this.getFunctionAppPrincipalId(), RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR);
+            this.authorisationManager.grantRoleAssignmentToStorageAccount(`${this.id}-data`, this, this.dataStorageAccount.id, this.getFunctionAppPrincipalId(), PrincipalType.ServicePrincipal, this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR));
         }
-        this.authorisationManager.grantRoleAssignmentToStorageAccount(this.id, this, this.appStorageAccount.id, this.getFunctionAppPrincipalId(), RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR);
+        this.authorisationManager.grantRoleAssignmentToStorageAccount(this.id, this, this.appStorageAccount.id, this.getFunctionAppPrincipalId(), PrincipalType.ServicePrincipal, this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.STORAGE_BLOB_DATA_CONTRIBUTOR));
         if (!this.props.useConfigOverride) {
-            this.authorisationManager.grantRoleAssignmentToApplicationConfiguration(this.id, this, this.appConfig.id, this.getFunctionAppPrincipalId(), RoleDefinitionId.APP_CONFIGURATION_DATA_READER);
+            this.authorisationManager.grantRoleAssignmentToApplicationConfiguration(this.id, this, this.appConfig.id, this.getFunctionAppPrincipalId(), PrincipalType.ServicePrincipal, this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.APP_CONFIGURATION_DATA_READER));
         }
         if (this.appConfigurationsParsedConfig &&
             AzureAppConfigurationManager.hasCosmosDependencies(this.appConfigurationsParsedConfig)) {
@@ -334,12 +337,12 @@ export class AzureFunctionApp extends CommonAzureConstruct {
         if (this.appKeyVaultsByResourceGroup && this.appKeyVaultsByResourceGroup.size > 0) {
             this.appKeyVaultsByResourceGroup.forEach((keyVaultNames, resourceGroup) => {
                 keyVaultNames.forEach(keyVaultName => {
-                    this.authorisationManager.grantRoleAssignmentToKeyVault(this.id, this, keyVaultName, resourceGroup, this.getFunctionAppPrincipalId(), RoleDefinitionId.KEY_VAULT_SECRETS_USER);
+                    this.authorisationManager.grantRoleAssignmentToKeyVault(this.id, this, keyVaultName, resourceGroup, this.getFunctionAppPrincipalId(), PrincipalType.ServicePrincipal, this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_SECRETS_USER));
                 });
             });
         }
         if (AzureAppConfigurationManager.hasEventGridTargets(this.appConfigurationsParsedConfig)) {
-            this.authorisationManager.grantRoleAssignmentToEventgridTopic(this.id, this, this.props.existingTopicName, this.props.existingTopicResourceGroupName, this.getFunctionAppPrincipalId(), RoleDefinitionId.EVENTGRID_DATA_SENDER);
+            this.authorisationManager.grantRoleAssignmentToEventgridTopic(this.id, this, this.props.existingTopicName, this.props.existingTopicResourceGroupName, this.getFunctionAppPrincipalId(), PrincipalType.ServicePrincipal, this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.EVENTGRID_DATA_SENDER));
         }
     }
     /**

package/dist/src/construct/rest-api/main.js

@@ -1,5 +1,6 @@
-import { HostnameType, LoggerType } from '@pulumi/azure-native/apimanagement/index.js';
+import { getApiManagementServiceOutput, HostnameType, LoggerType } from '@pulumi/azure-native/apimanagement/index.js';
 import { getComponentOutput } from '@pulumi/azure-native/applicationinsights/index.js';
+import { PrincipalType } from '@pulumi/azure-native/authorization/index.js';
 import { getVaultOutput } from '@pulumi/azure-native/keyvault/index.js';
 import * as pulumi from '@pulumi/pulumi';
 import { CommonAzureConstruct } from '../../common/index.js';
@@ -83,7 +84,7 @@ export class AzureRestApi extends CommonAzureConstruct {
                     {
                         hostName: `api-${this.props.locationConfig?.[this.props.location].name}.${this.props.domainName}`,
                         keyVaultId: this.props.apiManagement.certificateKeyVaultId,
-                        type: HostnameType.Management,
+                        type: HostnameType.Proxy,
                     },
                 ];
             }
@@ -97,10 +98,15 @@ export class AzureRestApi extends CommonAzureConstruct {
             this.api.id = this.api.apim.id;
             this.api.name = this.api.apim.name;
             this.api.resourceGroupName = this.resourceGroup.name;
-            if (this.props.apiManagement.certificateKeyVaultId) {
+            const apimIdentity = getApiManagementServiceOutput({
+                serviceName: this.api.apim.name,
+                resourceGroupName: this.resourceGroup.name,
+            }).identity;
+            if (this.props.apiManagement.certificateKeyVaultId && apimIdentity) {
                 this.authorisationManager.createRoleAssignment(`${this.id}-kv-role`, this, {
-                    principalId: this.api.apim.identity.apply(identity => identity?.principalId ?? ''),
-                    roleDefinitionId: RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER,
+                    principalId: apimIdentity.apply(id => id?.principalId ?? ''),
+                    roleDefinitionId: this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER),
+                    principalType: PrincipalType.ServicePrincipal,
                     scope: this.props.apiManagement.certificateKeyVaultId,
                 });
             }
@@ -117,11 +123,18 @@ export class AzureRestApi extends CommonAzureConstruct {
     createNamespaceSecretRole() {
         if (this.props.apiManagement.useExistingApiManagement)
             return;
-        this.api.namedValueRoleAssignment = this.authorisationManager.createRoleAssignment(`${this.id}-key-vault-role-api-namespace`, this, {
-            principalId: this.api.apim.identity.apply(identity => identity?.principalId ?? ''),
-            roleDefinitionId: `/subscriptions/${this.props.subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6`,
-            scope: this.api.authKeyVault.id,
-        });
+        const apimIdentity = getApiManagementServiceOutput({
+            serviceName: this.api.apim.name,
+            resourceGroupName: this.resourceGroup.name,
+        }).identity;
+        if (apimIdentity) {
+            this.api.namedValueRoleAssignment = this.authorisationManager.createRoleAssignment(`${this.id}-key-vault-role-api-namespace`, this, {
+                principalId: apimIdentity.apply(id => id?.principalId ?? ''),
+                principalType: PrincipalType.ServicePrincipal,
+                roleDefinitionId: this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_SECRETS_USER),
+                scope: this.api.authKeyVault.id,
+            });
+        }
     }
     /**
      * @summary Method to create the namespace secret in Key Vault for Application Insights
@@ -131,8 +144,8 @@ export class AzureRestApi extends CommonAzureConstruct {
             return;
         this.api.namedValueSecret = this.keyVaultManager.createKeyVaultSecret(`${this.id}-key-vault-api-namespace-secret`, this, {
             vaultName: this.api.authKeyVault.name,
-            secretName: `${this.applicationInsights.name}-${this.id}-key`,
-            resourceGroupName: this.resourceGroup.name,
+            secretName: pulumi.interpolate `${this.applicationInsights.name}-${this.id}-key`,
+            resourceGroupName: this.props.apiAuthKeyVault.resourceGroupName,
             properties: {
                 value: this.applicationInsights.instrumentationKey,
             },
@@ -150,12 +163,12 @@ export class AzureRestApi extends CommonAzureConstruct {
             displayName: 'all-apis',
             state: 'active',
             allowTracing: false,
-            scope: '', // todo
+            scope: '/apis',
         });
         this.keyVaultManager.createKeyVaultSecret(`${this.id}-key-vault-api-subscription-key-secret`, this, {
             vaultName: this.api.authKeyVault.name,
             secretName: `${this.id}-subscription-key`,
-            resourceGroupName: this.resourceGroup.name,
+            resourceGroupName: this.props.apiAuthKeyVault.resourceGroupName,
             properties: {
                 value: apiManagementSubscription.primaryKey.apply(key => key ?? ''),
             },
@@ -171,21 +184,22 @@ export class AzureRestApi extends CommonAzureConstruct {
             displayName: this.applicationInsights.name,
             resourceGroupName: this.resourceGroup.name,
             serviceName: this.api.apim.name,
-            namedValueId: `${this.applicationInsights.name}-key`,
+            namedValueId: pulumi.interpolate `${this.applicationInsights.name}-key`,
             secret: true,
             keyVault: {
-                secretIdentifier: this.api.namedValueSecret.id,
+                secretIdentifier: this.api.namedValueSecret.properties.apply(p => p.secretUri),
             },
         });
         this.api.logger = this.apiManagementManager.createLogger(`${this.id}-am-logger`, this, {
+            loggerId: this.applicationInsights.name,
             resourceGroupName: this.resourceGroup.name,
             serviceName: this.api.apim.name,
             resourceId: this.applicationInsights.id,
             loggerType: LoggerType.ApplicationInsights,
             credentials: {
-                instrumentationKey: `{{${apiAppNamedValue.displayName}}}`,
+                instrumentationKey: pulumi.interpolate `{{${apiAppNamedValue.displayName}}}`,
             },
-        });
+        }, { dependsOn: [apiAppNamedValue] });
     }
     /**
      * @summary Method to create the API diagnostic settings for API Management

package/dist/src/construct/rest-api-function/main.js

@@ -1,4 +1,4 @@
-import { HostnameType, NamedValue } from '@pulumi/azure-native/apimanagement/index.js';
+import { HostnameType, NamedValue, PolicyContentFormat } from '@pulumi/azure-native/apimanagement/index.js';
 import { getVaultOutput } from '@pulumi/azure-native/keyvault/index.js';
 import { listWebAppHostKeysOutput } from '@pulumi/azure-native/web/index.js';
 import * as pulumi from '@pulumi/pulumi';
@@ -81,7 +81,7 @@ export class AzureRestApiFunction extends AzureFunctionApp {
         this.api.namedValueSecret = this.keyVaultManager.createKeyVaultSecret(`${this.id}-key-vault-api-namespace-secret`, this, {
             vaultName: this.api.authKeyVault.name,
             secretName: pulumi.interpolate `${this.app.name}key`,
-            resourceGroupName: this.resourceGroup.name,
+            resourceGroupName: this.props.apiAuthKeyVault.resourceGroupName,
             properties: {
                 value: functionDefaultKey.functionKeys?.apply(keys => keys?.['default'] ?? ''),
             },
@@ -94,9 +94,10 @@ export class AzureRestApiFunction extends AzureFunctionApp {
         if (this.props.apiManagement.useExistingApiManagement) {
             if (this.props.apiManagement.apiStackName) {
                 const apiStack = new pulumi.StackReference(this.props.apiManagement.apiStackName);
-                this.api.id = apiStack.getOutput('apiId');
-                this.api.name = apiStack.getOutput('apiName');
-                this.api.resourceGroupName = apiStack.getOutput('apiResourceGroupName');
+                const stackOutputs = apiStack.getOutput('stackOutputs');
+                this.api.id = stackOutputs.apply(o => o.apiId);
+                this.api.name = stackOutputs.apply(o => o.apiName);
+                this.api.resourceGroupName = stackOutputs.apply(o => o.resourceGroupName);
             }
         }
         else {
@@ -123,7 +124,7 @@ export class AzureRestApiFunction extends AzureFunctionApp {
             if (this.props.apiManagement.certificateKeyVaultId) {
                 this.authorisationManager.createRoleAssignment(`${this.id}-kv-role`, this, {
                     principalId: this.api.apim.identity.apply(identity => identity?.principalId ?? ''),
-                    roleDefinitionId: RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER,
+                    roleDefinitionId: this.authorisationManager.resolveRoleDefinitionId(this, RoleDefinitionId.KEY_VAULT_CERTIFICATE_USER),
                     scope: this.props.apiManagement.certificateKeyVaultId,
                 });
             }
@@ -136,14 +137,15 @@ export class AzureRestApiFunction extends AzureFunctionApp {
         this.api.namedValue = new NamedValue(`${this.id}-am-nv`, {
             displayName: this.app.name,
             keyVault: {
-                secretIdentifier: this.api.namedValueSecret.id,
+                secretIdentifier: this.api.namedValueSecret.properties.apply(p => p.secretUri),
             },
             resourceGroupName: this.api.resourceGroupName,
             secret: true,
             serviceName: this.api.name,
-        });
+        }, { parent: this });
         this.api.backend = this.apiManagementManager.createBackend(this.id, this, {
             ...this.props.apiManagementBackend,
+            backendId: this.id,
             title: this.id,
             resourceGroupName: this.api.resourceGroupName,
             serviceName: this.api.name,
@@ -151,7 +153,7 @@ export class AzureRestApiFunction extends AzureFunctionApp {
             resourceId: pulumi.interpolate `https://management.azure.com/subscriptions/${this.props.subscriptionId}/resourceGroups/${this.resourceGroup.name}/providers/Microsoft.Web/sites/${this.app.name}`,
             credentials: {
                 header: {
-                    'x-functions-key': [`{{${this.api.namedValue.name}}}`],
+                    'x-functions-key': [pulumi.interpolate `{{${this.api.namedValue.name}}}`],
                 },
             },
         });
@@ -162,6 +164,7 @@ export class AzureRestApiFunction extends AzureFunctionApp {
     createApiManagementRoutes() {
         this.api.managementApi = this.apiManagementManager.createApi(`${this.id}-apim-api`, this, {
             ...this.props.apiManagementApi,
+            apiId: this.id,
             displayName: this.props.apiManagementApi.displayName ?? this.id,
             serviceName: this.api.name,
             resourceGroupName: this.api.resourceGroupName,
@@ -182,7 +185,7 @@ export class AzureRestApiFunction extends AzureFunctionApp {
             method: operation.method.toString().toUpperCase(),
             serviceName: this.api.name,
             resourceGroupName: this.api.resourceGroupName,
-            apiId: this.api.id,
+            apiId: this.resourceNameFormatter.format(this.id, this.props.resourceNameOptions?.apiManagementApi),
             displayName: operation.displayName,
             urlTemplate: operation.urlTemplate,
             templateParameters: operation.templateParameters,
@@ -195,28 +198,28 @@ export class AzureRestApiFunction extends AzureFunctionApp {
         if (!operation.caching || !operation.caching.enableCacheSet)
             return;
         this.apiManagementManager.createOperationPolicy(`${this.id}-apim-api-operation-policy-${operation.displayName}-${operation.method}`, this, {
-            apiId: this.api.id,
+            apiId: this.resourceNameFormatter.format(this.id, this.props.resourceNameOptions?.apiManagementApi),
             resourceGroupName: this.api.resourceGroupName,
             serviceName: this.api.name,
             operationId: `${operation.displayName}-${operation.method}`,
+            format: PolicyContentFormat.Rawxml,
             value: `
         <policies>
-          <policies>
-            <inbound>
-              <base />
-                ${this.props.apiManagementApi.cacheSetInboundPolicy}
-            </inbound>
-            <backend>
-              <base />
-            </backend>
-            <outbound>
-              <base />
-                ${this.props.apiManagementApi.cacheSetOutboundPolicy}
-            </outbound>
-            <on-error>
-              <base />
-            </on-error>
-        </policies>`.replace(/\n[ \t]*\n/g, '\n'), // move to utils
+          <inbound>
+            <base />
+              ${this.props.apiManagementApi.cacheSetInboundPolicy ?? ''}
+          </inbound>
+          <backend>
+            <base />
+          </backend>
+          <outbound>
+            <base />
+              ${this.props.apiManagementApi.cacheSetOutboundPolicy ?? ''}
+          </outbound>
+          <on-error>
+            <base />
+          </on-error>
+        </policies>`.replace(/\n[ \t]*\n/g, '\n'),
         });
     }
     /**
@@ -287,8 +290,9 @@ export class AzureRestApiFunction extends AzureFunctionApp {
       </policies>`;
         this.apiManagementManager.createPolicy(`${this.id}-apim-api-policy`, this, {
             serviceName: this.api.name,
-            apiId: this.api.id,
+            apiId: this.resourceNameFormatter.format(this.id, this.props.resourceNameOptions?.apiManagementApi),
             resourceGroupName: this.api.resourceGroupName,
+            format: PolicyContentFormat.Rawxml,
             value: policyXmlContent.apply(xml => xml.replace(/\n[ \t]*\n/g, '\n')),
         });
     }

package/dist/src/construct/rest-api-with-cache/main.js

@@ -64,8 +64,8 @@ export class AzureRestApiWithCache extends AzureRestApi {
         }).apply(keys => `${hostName}:10000,password=${keys.primaryKey},ssl=True,abortConnect=False`));
         this.api.redisNamedValueSecret = this.keyVaultManager.createKeyVaultSecret(`${this.id}-key-vault-redis-namespace-secret`, this, {
             vaultName: this.api.authKeyVault.name,
-            secretName: `${this.api.redisCluster.name}key`,
-            resourceGroupName: this.resourceGroup.name,
+            secretName: pulumi.interpolate `${this.api.redisCluster.name}key`,
+            resourceGroupName: this.props.apiAuthKeyVault.resourceGroupName,
             properties: {
                 value: connectionString,
             },
@@ -76,13 +76,13 @@ export class AzureRestApiWithCache extends AzureRestApi {
      */
     createRedisCacheNamespace() {
         this.api.redisNamedValue = this.apiManagementManager.createNamedValue(`${this.id}-redis-nv`, this, {
-            displayName: `${this.api.redisCluster.name}key`,
+            displayName: pulumi.interpolate `${this.api.redisCluster.name}key`,
             resourceGroupName: this.resourceGroup.name,
             serviceName: this.api.apim.name,
-            namedValueId: `${this.api.redisCluster.name}key`,
+            namedValueId: pulumi.interpolate `${this.api.redisCluster.name}key`,
             secret: true,
             keyVault: {
-                secretIdentifier: this.api.redisNamedValueSecret.id,
+                secretIdentifier: this.api.redisNamedValueSecret.properties.apply(p => p.secretUri),
             },
         });
     }
@@ -92,11 +92,11 @@ export class AzureRestApiWithCache extends AzureRestApi {
     createRedisCacheApiManagement() {
         this.apiManagementManager.createCache(`${this.id}-am-redis-cache`, this, {
             serviceName: this.api.apim.name,
-            connectionString: `{{${this.api.redisNamedValue.name}}}`,
-            cacheId: this.api.redisCluster.id,
+            connectionString: pulumi.interpolate `{{${this.api.redisNamedValue.name}}}`,
+            cacheId: this.api.redisCluster.name,
             resourceGroupName: this.resourceGroup.name,
             useFromLocation: this.api.redisCluster.location,
-            description: `Redis cache for ${this.api.apim.name}`,
+            description: pulumi.interpolate `Redis cache for ${this.api.apim.name}`,
         });
     }
 }

package/dist/src/construct/site-with-webapp/main.js

@@ -60,6 +60,8 @@ export class SiteWithWebApp extends CommonAzureConstruct {
     createSiteAppServicePlan() {
         this.site.appServicePlan = this.appServiceManager.createAppServicePlan(`${this.id}-app-service-plan`, this, {
             ...this.props.site.appServicePlan,
+            name: this.id,
+            kind: this.props.site.appServicePlan?.kind ?? 'linux',
             location: this.resourceGroup.location,
             resourceGroupName: this.resourceGroup.name,
         });
@@ -131,6 +133,7 @@ export class SiteWithWebApp extends CommonAzureConstruct {
     createWebApp(resourceOptions) {
         this.site.webApp = this.appServiceManager.createLinuxWebApp(`${this.id}-web-app`, this, {
             ...this.props.site.webApp,
+            kind: this.props.site.webApp.kind ?? 'app,linux',
             location: this.resourceGroup.location,
             resourceGroupName: this.resourceGroup.name,
             serverFarmId: this.site.appServicePlan.id,

package/dist/src/services/api-management/main.d.ts

@@ -71,7 +71,7 @@ export declare class AzureApiManagementManager {
      * @param resourceOptions Optional settings to control resource behaviour
      * @see [Pulumi Azure Native API Management Diagnostic]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/apimanagement/apidiagnostic/}
      */
-    createApiDiagnostic(id: string, scope: CommonAzureConstruct, props: ApiDiagnosticProps, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/apimanagement/apiDiagnostic.js").ApiDiagnostic;
+    createApiDiagnostic(id: string, scope: CommonAzureConstruct, props: ApiDiagnosticProps, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/apimanagement/diagnostic.js").Diagnostic;
     /**
      * @summary Method to create a new API Logger
      * @param id scoped id of the resource

package/dist/src/services/api-management/main.js

@@ -1,4 +1,4 @@
-import { Api, ApiDiagnostic, ApiManagementService, ApiOperation, ApiOperationPolicy, ApiPolicy, Backend, BackendProtocol, Cache, getApiManagementServiceOutput, Logger, LoggerType, NamedValue, Protocol, Subscription, } from '@pulumi/azure-native/apimanagement/index.js';
+import { Api, ApiManagementService, ApiOperation, ApiOperationPolicy, ApiPolicy, Backend, BackendProtocol, Cache, Diagnostic, getApiManagementServiceOutput, Logger, LoggerType, NamedValue, Protocol, Subscription, } from '@pulumi/azure-native/apimanagement/index.js';
 import { listDatabaseKeysOutput } from '@pulumi/azure-native/redisenterprise/index.js';
 import * as pulumi from '@pulumi/pulumi';
 /**
@@ -148,7 +148,7 @@ export class AzureApiManagementManager {
     createApiDiagnostic(id, scope, props, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        return new ApiDiagnostic(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new Diagnostic(`${id}`, props, { parent: scope, ...resourceOptions });
     }
     /**
      * @summary Method to create a new API Logger
@@ -222,7 +222,7 @@ export class AzureApiManagementManager {
      * @see [Pulumi Azure Native API Management Operation Policy]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/apimanagement/apioperationpolicy/}
      */
     createOperationPolicy(id, scope, props, resourceOptions) {
-        return new ApiOperationPolicy(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new ApiOperationPolicy(`${id}`, { ...props, policyId: 'policy' }, { parent: scope, ...resourceOptions });
     }
     /**
      * @summary Method to create a new API policy
@@ -233,7 +233,7 @@ export class AzureApiManagementManager {
      * @see [Pulumi Azure Native API Management Policy]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/apimanagement/apipolicy/}
      */
     createPolicy(id, scope, props, resourceOptions) {
-        return new ApiPolicy(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new ApiPolicy(`${id}`, { ...props, policyId: 'policy' }, { parent: scope, ...resourceOptions });
     }
     /**
      * @summary Method to create a new API Management custom domain

package/dist/src/services/app-service/main.js

@@ -36,6 +36,7 @@ export class AzureAppServiceManager {
             name: scope.resourceNameFormatter.format(props.name?.toString(), scope.props.resourceNameOptions?.appServicePlan),
             resourceGroupName,
             location: props.location ?? scope.props.location,
+            kind: props.kind ?? 'functionapp',
             sku: props.sku ?? {
                 name: 'FC1',
                 tier: 'FlexConsumption',

package/dist/src/services/application-insights/main.js

@@ -30,14 +30,13 @@ export class AzureApplicationInsightsManager {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
         // Get resource group name
-        const resourceGroupName = (props.resourceGroupName ?? scope.props.resourceGroupName)
-            ? `${scope.props.resourceGroupName}-${scope.props.stage}`
-            : props.resourceGroupName;
+        const resourceGroupName = props.resourceGroupName ?? scope.resourceNameFormatter.format(scope.props.resourceGroupName);
         if (!resourceGroupName)
             throw new Error(`Resource group name undefined for ${id}`);
-        const component = new Component(`${id}-ai`, {
+        const resourceName = scope.resourceNameFormatter.format(props.resourceName?.toString(), scope.props.resourceNameOptions?.applicationInsights);
+        const component = new Component(`${id}`, {
             ...props,
-            resourceName: scope.resourceNameFormatter.format(props.resourceName?.toString(), scope.props.resourceNameOptions?.applicationInsights),
+            resourceName,
             resourceGroupName,
             applicationType: props.applicationType ?? ApplicationType.Web,
             kind: props.kind ?? 'web',
@@ -48,7 +47,12 @@ export class AzureApplicationInsightsManager {
             },
         }, { parent: scope, ...resourceOptions });
         if (props.billingFeatures) {
-            this.createComponentCurrentBillingFeature(`${id}-billing`, scope, props.billingFeatures, {
+            this.createComponentCurrentBillingFeature(`${id}-billing`, scope, {
+                ...props.billingFeatures,
+                currentBillingFeatures: props.billingFeatures?.currentBillingFeatures ?? ['Basic'],
+                resourceName,
+                resourceGroupName,
+            }, {
                 parent: scope,
                 ...resourceOptions,
             });

package/dist/src/services/authorisation/main.d.ts

@@ -1,3 +1,4 @@
+import { PrincipalType } from '@pulumi/azure-native/authorization/index.js';
 import { Input, ResourceOptions } from '@pulumi/pulumi';
 import { CommonAzureConstruct } from '../../common/index.js';
 import { RoleDefinitionId } from './constants.js';
@@ -40,7 +41,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToKeyVault(id: string, scope: CommonAzureConstruct, vaultName: string, resourceGroupName: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToKeyVault(id: string, scope: CommonAzureConstruct, vaultName: string, resourceGroupName: Input<string>, principalId: Input<string>, principalType: Input<PrincipalType>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to event grid topic
      * @param id scoped id of the resource
@@ -51,7 +52,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToEventgridTopic(id: string, scope: CommonAzureConstruct, topicName: Input<string>, resourceGroupName: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToEventgridTopic(id: string, scope: CommonAzureConstruct, topicName: Input<string>, resourceGroupName: Input<string>, principalId: Input<string>, principalType: Input<PrincipalType>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to application configuration
      * @param id scoped id of the resource
@@ -61,7 +62,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToApplicationConfiguration(id: string, scope: CommonAzureConstruct, appConfigId: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToApplicationConfiguration(id: string, scope: CommonAzureConstruct, appConfigId: Input<string>, principalId: Input<string>, principalType: Input<PrincipalType>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to storage account
      * @param id scoped id of the resource
@@ -71,7 +72,7 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToStorageAccount(id: string, scope: CommonAzureConstruct, accountId: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToStorageAccount(id: string, scope: CommonAzureConstruct, accountId: Input<string>, principalId: Input<string>, principalType: Input<PrincipalType>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
     /**
      * @summary Method to grant a role assignment to storage table
      * @param id scoped id of the resource
@@ -81,5 +82,6 @@ export declare class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToStorageTable(id: string, scope: CommonAzureConstruct, tableId: Input<string>, principalId: Input<string>, roleDefinitionId: RoleDefinitionId, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    grantRoleAssignmentToStorageTable(id: string, scope: CommonAzureConstruct, tableId: Input<string>, principalId: Input<string>, principalType: Input<PrincipalType>, roleDefinitionId: string, resourceOptions?: ResourceOptions): import("@pulumi/azure-native/authorization/roleAssignment.js").RoleAssignment;
+    resolveRoleDefinitionId(scope: CommonAzureConstruct, roleDefinitionId: RoleDefinitionId): string;
 }

package/dist/src/services/authorisation/main.js

@@ -29,7 +29,7 @@ export class AzureAuthorisationManager {
     createRoleAssignment(id, scope, props, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        return new RoleAssignment(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new RoleAssignment(`${id}`, props, { parent: scope, ignoreChanges: ['scope'], ...resourceOptions });
     }
     /**
      * @summary Method to grant a role assignment to key vault
@@ -41,10 +41,11 @@ export class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToKeyVault(id, scope, vaultName, resourceGroupName, principalId, roleDefinitionId, resourceOptions) {
+    grantRoleAssignmentToKeyVault(id, scope, vaultName, resourceGroupName, principalId, principalType, roleDefinitionId, resourceOptions) {
         const keyVault = scope.keyVaultManager.resolveKeyVault(scope, vaultName, resourceGroupName, resourceOptions);
         return this.createRoleAssignment(`${id}-kv-role-${vaultName}`, scope, {
             principalId,
+            principalType,
             roleDefinitionId,
             scope: keyVault.id,
         }, resourceOptions);
@@ -59,13 +60,14 @@ export class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToEventgridTopic(id, scope, topicName, resourceGroupName, principalId, roleDefinitionId, resourceOptions) {
+    grantRoleAssignmentToEventgridTopic(id, scope, topicName, resourceGroupName, principalId, principalType, roleDefinitionId, resourceOptions) {
         const topic = scope.eventgridManager.resolveEventgridTopic(`${id}-egt-role-${topicName}`, scope, {
             topicName,
             resourceGroupName,
         }, resourceOptions);
         return this.createRoleAssignment(`${id}-egt-role-${topicName}`, scope, {
             principalId,
+            principalType,
             roleDefinitionId,
             scope: topic.id,
         }, resourceOptions);
@@ -79,9 +81,10 @@ export class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToApplicationConfiguration(id, scope, appConfigId, principalId, roleDefinitionId, resourceOptions) {
+    grantRoleAssignmentToApplicationConfiguration(id, scope, appConfigId, principalId, principalType, roleDefinitionId, resourceOptions) {
         return this.createRoleAssignment(`${id}-ac-role`, scope, {
             principalId,
+            principalType,
             roleDefinitionId,
             scope: appConfigId,
         }, resourceOptions);
@@ -95,9 +98,10 @@ export class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToStorageAccount(id, scope, accountId, principalId, roleDefinitionId, resourceOptions) {
+    grantRoleAssignmentToStorageAccount(id, scope, accountId, principalId, principalType, roleDefinitionId, resourceOptions) {
         return this.createRoleAssignment(`${id}-sa-role`, scope, {
             principalId,
+            principalType,
             roleDefinitionId,
             scope: accountId,
         }, resourceOptions);
@@ -111,11 +115,17 @@ export class AzureAuthorisationManager {
      * @param roleDefinitionId the role definition id
      * @param resourceOptions Optional settings to control resource behaviour
      */
-    grantRoleAssignmentToStorageTable(id, scope, tableId, principalId, roleDefinitionId, resourceOptions) {
+    grantRoleAssignmentToStorageTable(id, scope, tableId, principalId, principalType, roleDefinitionId, resourceOptions) {
         return this.createRoleAssignment(`${id}-st-role`, scope, {
             principalId,
+            principalType,
             roleDefinitionId,
             scope: tableId,
         }, resourceOptions);
     }
+    resolveRoleDefinitionId(scope, roleDefinitionId) {
+        if (!scope.props.subscriptionId)
+            throw Error('Subscription id undefined');
+        return `/subscriptions/${scope.props.subscriptionId}${roleDefinitionId}`;
+    }
 }

package/dist/src/services/cosmosdb/main.js

@@ -1,4 +1,5 @@
 import { DatabaseAccount, getDatabaseAccountOutput, getSqlResourceSqlRoleDefinitionOutput, ResourceIdentityType, SqlResourceSqlContainer, SqlResourceSqlDatabase, SqlResourceSqlRoleAssignment, } from '@pulumi/azure-native/cosmosdb/index.js';
+import { v5 as uuidv5 } from 'uuid';
 import { CosmosRoleDefinition, CosmosRoleDefinitionId } from './constants.js';
 /**
  * Provides operations on Azure CosmosDB using Pulumi
@@ -78,14 +79,14 @@ export class AzureCosmosDbManager {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
         // Get resource group name
-        const resourceGroupName = (props.resourceGroupName ?? scope.props.resourceGroupName)
-            ? `${scope.props.resourceGroupName}-${scope.props.stage}`
-            : props.resourceGroupName;
+        const resourceGroupName = props.resourceGroupName ?? scope.resourceNameFormatter.format(scope.props.resourceGroupName);
         if (!resourceGroupName)
             throw new Error(`Resource group name undefined for ${id}`);
         return new SqlResourceSqlContainer(`${id}-cc`, {
             ...props,
-            containerName: scope.resourceNameFormatter.format(props.containerName?.toString(), scope.props.resourceNameOptions?.cosmosDbSqlContainer),
+            ...(props.containerName && {
+                containerName: scope.resourceNameFormatter.format(props.containerName.toString(), scope.props.resourceNameOptions?.cosmosDbSqlContainer),
+            }),
             resourceGroupName,
         }, { parent: scope, ...resourceOptions });
     }
@@ -98,7 +99,11 @@ export class AzureCosmosDbManager {
      * @see [Pulumi Azure Native CosmosDB SQL Role Assignment]{@link https://www.pulumi.com/registry/packages/azure-native/api-docs/documentdb/sqlresourcesqlroleassignment/}
      */
     createSqlResourceSqlRoleAssignment(id, scope, props, resourceOptions) {
-        return new SqlResourceSqlRoleAssignment(`${id}`, props, { parent: scope, ...resourceOptions });
+        const namespace = uuidv5(`${scope.id}-${id}`, uuidv5.URL);
+        return new SqlResourceSqlRoleAssignment(`${id}`, {
+            ...props,
+            roleAssignmentId: props.roleAssignmentId ?? uuidv5(id, namespace),
+        }, { parent: scope, ...resourceOptions });
     }
     /**
      * @summary Method to resolve an existing cosmosdb account

package/dist/src/services/eventgrid/main.js

@@ -1,4 +1,4 @@
-import { EventDeliverySchema, EventSubscription, getTopicOutput, SystemTopic, SystemTopicEventSubscription, Topic, } from '@pulumi/azure-native/eventgrid/index.js';
+import { DataResidencyBoundary, EventDeliverySchema, EventSubscription, getTopicOutput, SystemTopic, SystemTopicEventSubscription, TlsVersion, Topic, } from '@pulumi/azure-native/eventgrid/index.js';
 /**
  * Provides operations on Azure Event Grid using Pulumi
  * - A new instance of this class is injected into {@link CommonAzureConstruct} constructor.
@@ -36,6 +36,8 @@ export class AzureEventgridManager {
             topicName: scope.resourceNameFormatter.format(props.topicName?.toString(), scope.props.resourceNameOptions?.eventGridTopic),
             location: props.location ?? scope.props.location,
             resourceGroupName,
+            dataResidencyBoundary: props.dataResidencyBoundary ?? DataResidencyBoundary.WithinGeopair,
+            minimumTlsVersionAllowed: props.minimumTlsVersionAllowed ?? TlsVersion.TlsVersion_1_2,
             tags: {
                 environment: scope.props.stage,
                 ...scope.props.defaultTags,

package/dist/src/services/function/main.js

@@ -1,5 +1,5 @@
 import { Deployment, DeploymentMode, Resource } from '@pulumi/azure-native/resources/index.js';
-import { ManagedServiceIdentityType, WebApp, WebAppFunction } from '@pulumi/azure-native/web/index.js';
+import { ClientCertMode, ManagedServiceIdentityType, WebApp, WebAppFunction } from '@pulumi/azure-native/web/index.js';
 import { CommonAzureStack } from '../../common/index.js';
 /**
  * Provides operations on Azure Functions using Pulumi
@@ -92,11 +92,17 @@ export class AzureFunctionManager {
             location: props.location ?? scope.props.location,
             resourceGroupName,
             kind: props.kind ?? 'functionapp,linux',
+            reserved: props.reserved ?? true,
             httpsOnly: props.httpsOnly ?? true,
             identity: props.identity ?? {
                 type: ManagedServiceIdentityType.SystemAssigned,
             },
-            functionAppConfig: props.functionAppConfig ?? {
+            clientAffinityEnabled: props.clientAffinityEnabled ?? false,
+            clientAffinityProxyEnabled: props.clientAffinityProxyEnabled ?? false,
+            clientCertMode: props.clientCertMode ?? ClientCertMode.Optional,
+            clientCertEnabled: props.clientCertEnabled ?? false,
+            functionAppConfig: {
+                ...props.functionAppConfig,
                 runtime: {
                     ...props.runtime,
                     name: props.runtime?.name ?? 'node',
@@ -119,7 +125,7 @@ export class AzureFunctionManager {
             },
         }, { parent: scope, ...resourceOptions });
         const functionAppConfig = props.functionAppConfig;
-        new Deployment(`${id}-deployment`, {
+        new Deployment(`${id}-depl`, {
             resourceGroupName,
             properties: {
                 mode: DeploymentMode.Incremental,
@@ -144,12 +150,8 @@ export class AzureFunctionManager {
                                     },
                                     scaleAndConcurrency: {
                                         ...props.scaleAndConcurrency,
-                                        instanceMemoryMB: props.scaleAndConcurrency?.instanceMemoryMB ??
-                                            functionAppConfig?.scaleAndConcurrency?.instanceMemoryMB ??
-                                            4096,
-                                        maximumInstanceCount: props.scaleAndConcurrency?.maximumInstanceCount ??
-                                            functionAppConfig?.scaleAndConcurrency?.maximumInstanceCount ??
-                                            40,
+                                        instanceMemoryMB: props.scaleAndConcurrency?.instanceMemoryMB ?? 4096,
+                                        maximumInstanceCount: props.scaleAndConcurrency?.maximumInstanceCount ?? 40,
                                     },
                                     siteUpdateStrategy: {
                                         type: 'RollingUpdate',
@@ -160,7 +162,7 @@ export class AzureFunctionManager {
                     ],
                 },
             },
-        }, { parent: scope, ...resourceOptions });
+        }, { parent: functionApp, ...resourceOptions });
         return functionApp;
     }
     /**

package/dist/src/services/monitor/main.js

@@ -32,6 +32,6 @@ export class AzureMonitorManager {
         return new DiagnosticSetting(`${id}-ds`, {
             ...props,
             name: scope.resourceNameFormatter.format(props.name?.toString(), scope.props.resourceNameOptions?.monitorDiagnosticSetting),
-        }, { parent: scope, ...resourceOptions });
+        }, { parent: scope, ignoreChanges: ['resourceUri'], ...resourceOptions });
     }
 }

package/dist/src/services/operational-insights/main.js

@@ -1,4 +1,4 @@
-import { Table, Workspace, WorkspaceSkuNameEnum } from '@pulumi/azure-native/operationalinsights/index.js';
+import { Table, TablePlanEnum, Workspace, WorkspaceSkuNameEnum, } from '@pulumi/azure-native/operationalinsights/index.js';
 /**
  * Provides operations on Azure Log Analytics Workspace using Pulumi
  * - A new instance of this class is injected into {@link CommonAzureConstruct} constructor.
@@ -58,6 +58,11 @@ export class AzureOperationalInsightsManager {
     createTable(id, scope, props, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        return new Table(`${id}`, props, { parent: scope, ...resourceOptions });
+        return new Table(`${id}`, {
+            ...props,
+            plan: props.plan ?? TablePlanEnum.Analytics,
+            retentionInDays: props.retentionInDays ?? 30,
+            totalRetentionInDays: props.totalRetentionInDays ?? 30,
+        }, { parent: scope, ...resourceOptions });
     }
 }

package/dist/src/services/portal/main.js

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import { Dashboard } from '@pulumi/azure-native/portal/index.js';
+import * as pulumi from '@pulumi/pulumi';
 import { AzureDashboardRenderer } from './renderer.js';
 /**
  * Provides operations on Azure Portal Dashboards using Pulumi
@@ -32,21 +33,27 @@ export class AzurePortalManager {
     createDashBoard(id, scope, props, renderer, resourceOptions) {
         if (!props)
             throw new Error(`Props undefined for ${id}`);
-        const resourceGroup = scope.resourceGroupManager.resolveResourceGroup(scope, props.resourceGroupName.toString() ?? scope.props.resourceGroupName, resourceOptions);
+        const resourceGroup = scope.resourceGroup ??
+            scope.resourceGroupManager.resolveResourceGroup(scope, props.resourceGroupName.toString() ?? scope.props.resourceGroupName, resourceOptions);
         const dashboardName = scope.resourceNameFormatter.format(props.dashboardName?.toString(), scope.props.resourceNameOptions?.portalDashboard);
         const dashboardRenderer = renderer ?? new AzureDashboardRenderer();
         const templateFile = dashboardRenderer.renderToFile(dashboardName, props);
         const template = fs.readFileSync(templateFile, 'utf-8');
-        const content = Object.entries(props.variables).reduce((result, [key, value]) => result.replaceAll(`\${${key}}`, JSON.stringify(String(value)).slice(1, -1)), template);
+        const keys = Object.keys(props.variables);
+        const values = Object.values(props.variables);
+        const properties = pulumi.all(values).apply(resolved => {
+            const content = keys.reduce((result, key, i) => result.replaceAll(`\${${key}}`, JSON.stringify(String(resolved[i])).slice(1, -1)), template);
+            return JSON.parse(content);
+        });
         return new Dashboard(`${id}-dashboard`, {
             ...props,
             dashboardName: scope.resourceNameFormatter.format(props.dashboardName?.toString(), scope.props.resourceNameOptions?.portalDashboard),
             resourceGroupName: resourceGroup.name,
             location: props.location ?? resourceGroup.location,
-            properties: JSON.parse(content),
+            properties,
             tags: {
                 'hidden-title': `${props.location} - ${props.displayName}`,
             },
-        }, { ...resourceOptions, ignoreChanges: ['location'] });
+        }, { parent: scope, ...resourceOptions, ignoreChanges: ['location'] });
     }
 }

package/dist/src/services/portal/renderer.js

@@ -35,9 +35,8 @@ export class AzureDashboardRenderer {
     render(params) {
         _.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
         // if client is used instead of hosts
-        let partsIndex = 0;
         let yIndex = 0;
-        const parts = {};
+        const parts = [];
         for (const pane of params.panes) {
             try {
                 const paneTemplate = this.getPaneId(pane.id);
@@ -91,8 +90,7 @@ export class AzureDashboardRenderer {
                 const paneJSON = JSON.parse(paneContent);
                 const templateParts = paneJSON.parts;
                 for (const part of templateParts) {
-                    parts[`${partsIndex}`] = part;
-                    partsIndex++;
+                    parts.push(part);
                 }
                 yIndex += paneTemplate.dimensions.height;
             }
@@ -104,12 +102,12 @@ export class AzureDashboardRenderer {
             }
         }
         const dashboard = {
-            lenses: {
-                '0': {
+            lenses: [
+                {
                     order: 0,
                     parts,
                 },
-            },
+            ],
             metadata: {
                 model: {
                     timeRange: {

package/dist/src/services/redis/main.js

@@ -1,4 +1,4 @@
-import { Database, RedisEnterprise, SkuName } from '@pulumi/azure-native/redisenterprise/index.js';
+import { AccessKeysAuthentication, ClusteringPolicy, Database, DeferUpgradeSetting, EvictionPolicy, Protocol, RedisEnterprise, SkuName, } from '@pulumi/azure-native/redisenterprise/index.js';
 /**
  * Provides operations on Azure Managed Redis (Enterprise) using Pulumi
  * - A new instance of this class is injected into {@link CommonAzureConstruct} constructor.
@@ -49,6 +49,13 @@ export class AzureRedisManager {
             clusterName: cluster.name,
             resourceGroupName,
             databaseName: databaseProps?.databaseName ?? 'default',
+            accessKeysAuthentication: databaseProps?.accessKeysAuthentication ?? AccessKeysAuthentication.Enabled,
+            clientProtocol: databaseProps?.clientProtocol ?? Protocol.Encrypted,
+            clusteringPolicy: databaseProps?.clusteringPolicy ?? ClusteringPolicy.OSSCluster,
+            evictionPolicy: databaseProps?.evictionPolicy ?? EvictionPolicy.VolatileLRU,
+            port: databaseProps?.port ?? 10000,
+            persistence: databaseProps?.persistence ?? { aofEnabled: false, rdbEnabled: false },
+            deferUpgrade: databaseProps?.deferUpgrade ?? DeferUpgradeSetting.NotDeferred,
         }, { parent: scope, dependsOn: [cluster], ...resourceOptions });
         return { cluster, database };
     }

package/dist/src/services/storage/main.js

@@ -38,6 +38,7 @@ export class AzureStorageManager {
                 .replace(/\W/g, '')
                 .toLowerCase(),
             allowBlobPublicAccess: props.allowBlobPublicAccess ?? false,
+            isHnsEnabled: props.isHnsEnabled ?? false,
             resourceGroupName,
             sku: props.sku ?? {
                 name: SkuName.Standard_LRS,
@@ -61,7 +62,7 @@ export class AzureStorageManager {
                 enabled: true,
                 days: 7,
             },
-        });
+        }, { parent: scope, ...resourceOptions });
         return storageAccount;
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradientedge/cdk-utils-azure",
-  "version": "2.19.0",
+  "version": "2.21.0",
   "description": "Azure Pulumi utilities for @gradientedge/cdk-utils",
   "type": "module",
   "main": "dist/src/index.js",
@@ -17,10 +17,11 @@
     "@pulumi/archive": "0.3.7",
     "@pulumi/azure-native": "3.16.0",
     "@pulumi/azuread": "6.9.0",
-    "@pulumi/pulumi": "3.230.0",
+    "@pulumi/pulumi": "3.231.0",
     "@types/lodash": "4.17.24",
     "app-root-path": "3.1.0",
     "lodash": "4.18.1",
+    "uuid": "13.0.0",
     "yaml": "2.8.3",
     "@gradientedge/cdk-utils-common": "2.1.0"
   },