CodeGenDeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.33.93.31351",
      "templateHash": "9660674520198312441"
    }
  },
  "parameters": {
    "ResourcePrefix": {
      "type": "string",
      "metadata": {
        "description": "Prefix for all resources created by this template.  This prefix will be used to create unique names for all resources.  The prefix must be unique within the resource group."
      }
    },
    "Authorization": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Authorization requires permission to create an app identity in the subscription.  See readme for details."
      }
    },
    "AiLocation": {
      "type": "string",
      "allowedValues": [
        "australiaeast",
        "brazilsouth",
        "canadacentral",
        "canadaeast",
        "eastus",
        "eastus2",
        "francecentral",
        "germanywestcentral",
        "japaneast",
        "koreacentral",
        "northcentralus",
        "norwayeast",
        "polandcentral",
        "southafricanorth",
        "southcentralus",
        "southindia",
        "swedencentral",
        "switzerlandnorth",
        "uaenorth",
        "uksouth",
        "westeurope",
        "westus",
        "westus3"
      ],
      "metadata": {
        "description": "Location for all Ai services resources. This location can be different from the resource group location."
      }
    },
    "capacity": {
      "type": "int",
      "defaultValue": 5
    }
  },
  "variables": {
    "uniqueSuffix": "[uniqueString(resourceGroup().id, parameters('ResourcePrefix'))]",
    "randomSuffix": "[substring(variables('uniqueSuffix'), 0, 4)]",
    "finalName": "[format('{0}-{1}', parameters('ResourcePrefix'), variables('randomSuffix'))]",
    "backEndVersion": "[if(parameters('Authorization'), 'rcauth', 'rcnoauth')]",
    "frontEndVersion": "[if(parameters('Authorization'), 'rcauth', 'rcnoauth')]",
    "location": "[resourceGroup().location]",
    "dblocation": "[resourceGroup().location]",
    "cosmosdbDatabase": "cmsadb",
    "cosmosdbBatchContainer": "cmsabatch",
    "cosmosdbFileContainer": "cmsafile",
    "cosmosdbLogContainer": "cmsalog",
    "deploymentType": "GlobalStandard",
    "containerName": "appstorage",
    "llmModel": "gpt-4o",
    "prefixCleaned": "[replace(toLower(variables('finalName')), '-', '')]",
    "storageSkuName": "Standard_LRS",
    "storageContainerName": "[format('{0}contstorage', variables('prefixCleaned'))]",
    "gptModelVersion": "2024-08-06",
    "storageNameCleanedContainer": "[replace(variables('storageContainerName'), '-', '')]",
    "aiServicesName": "[format('{0}-aiservices', variables('prefixCleaned'))]",
    "aiModelDeployments": [
      {
        "name": "[variables('llmModel')]",
        "model": "[variables('llmModel')]",
        "version": "[variables('gptModelVersion')]",
        "sku": {
          "name": "[variables('deploymentType')]",
          "capacity": "[parameters('capacity')]"
        },
        "raiPolicyName": "Microsoft.Default"
      }
    ],
    "openAiContributorRoleId": "a001fd3d-188f-4b5d-821b-7da978bf7442",
    "containerNames": [
      "[variables('containerName')]"
    ]
  },
  "resources": [
    {
      "type": "Microsoft.CognitiveServices/accounts",
      "apiVersion": "2024-04-01-preview",
      "name": "[variables('aiServicesName')]",
      "location": "[variables('location')]",
      "sku": {
        "name": "S0"
      },
      "kind": "AIServices",
      "properties": {
        "customSubDomainName": "[variables('aiServicesName')]",
        "apiProperties": {
          "statisticsEnabled": false
        }
      }
    },
    {
      "copy": {
        "name": "aiServicesDeployments",
        "count": "[length(variables('aiModelDeployments'))]",
        "mode": "serial",
        "batchSize": 1
      },
      "type": "Microsoft.CognitiveServices/accounts/deployments",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/{1}', variables('aiServicesName'), variables('aiModelDeployments')[copyIndex()].name)]",
      "properties": {
        "model": {
          "format": "OpenAI",
          "name": "[variables('aiModelDeployments')[copyIndex()].model]",
          "version": "[variables('aiModelDeployments')[copyIndex()].version]"
        },
        "raiPolicyName": "[variables('aiModelDeployments')[copyIndex()].raiPolicyName]"
      },
      "sku": {
        "name": "[variables('aiModelDeployments')[copyIndex()].sku.name]",
        "capacity": "[variables('aiModelDeployments')[copyIndex()].sku.capacity]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiServicesName'))]"
      ]
    },
    {
      "type": "Microsoft.App/containerApps",
      "apiVersion": "2023-05-01",
      "name": "[toLower(format('{0}containerBackend', variables('prefixCleaned')))]",
      "location": "[variables('location')]",
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "managedEnvironmentId": "[reference(resourceId('Microsoft.Resources/deployments', toLower(format('{0}conAppsEnv', variables('prefixCleaned')))), '2022-09-01').outputs.resourceId.value]",
        "configuration": {
          "ingress": {
            "external": true,
            "targetPort": 8000
          }
        },
        "template": {
          "scale": {
            "minReplicas": 1,
            "maxReplicas": 1
          },
          "containers": [
            {
              "name": "cmsabackend",
              "image": "[format('cmsacontainerreg.azurecr.io/cmsabackend:{0}', variables('backEndVersion'))]",
              "env": [
                {
                  "name": "COSMOSDB_ENDPOINT",
                  "value": "[reference(resourceId('Microsoft.Resources/deployments', toLower(format('{0}database', variables('prefixCleaned')))), '2022-09-01').outputs.endpoint.value]"
                },
                {
                  "name": "COSMOSDB_DATABASE",
                  "value": "[variables('cosmosdbDatabase')]"
                },
                {
                  "name": "COSMOSDB_BATCH_CONTAINER",
                  "value": "[variables('cosmosdbBatchContainer')]"
                },
                {
                  "name": "COSMOSDB_FILE_CONTAINER",
                  "value": "[variables('cosmosdbFileContainer')]"
                },
                {
                  "name": "COSMOSDB_LOG_CONTAINER",
                  "value": "[variables('cosmosdbLogContainer')]"
                },
                {
                  "name": "AZURE_BLOB_ACCOUNT_NAME",
                  "value": "[variables('storageNameCleanedContainer')]"
                },
                {
                  "name": "AZURE_BLOB_CONTAINER_NAME",
                  "value": "[variables('containerName')]"
                },
                {
                  "name": "AZURE_OPENAI_ENDPOINT",
                  "value": "[format('https://{0}.openai.azure.com/', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.aiServicesName.value)]"
                },
                {
                  "name": "MIGRATOR_AGENT_MODEL_DEPLOY",
                  "value": "[variables('llmModel')]"
                },
                {
                  "name": "PICKER_AGENT_MODEL_DEPLOY",
                  "value": "[variables('llmModel')]"
                },
                {
                  "name": "FIXER_AGENT_MODEL_DEPLOY",
                  "value": "[variables('llmModel')]"
                },
                {
                  "name": "SEMANTIC_VERIFIER_AGENT_MODEL_DEPLOY",
                  "value": "[variables('llmModel')]"
                },
                {
                  "name": "SYNTAX_CHECKER_AGENT_MODEL_DEPLOY",
                  "value": "[variables('llmModel')]"
                },
                {
                  "name": "SELECTION_MODEL_DEPLOY",
                  "value": "[variables('llmModel')]"
                },
                {
                  "name": "TERMINATION_MODEL_DEPLOY",
                  "value": "[variables('llmModel')]"
                }
              ],
              "resources": {
                "cpu": 1,
                "memory": "2.0Gi"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry')]",
        "[resourceId('Microsoft.Resources/deployments', toLower(format('{0}conAppsEnv', variables('prefixCleaned'))))]",
        "[resourceId('Microsoft.Resources/deployments', toLower(format('{0}database', variables('prefixCleaned'))))]",
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleanedContainer'))]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "[variables('storageNameCleanedContainer')]",
      "location": "[variables('location')]",
      "sku": {
        "name": "[variables('storageSkuName')]"
      },
      "kind": "StorageV2",
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "accessTier": "Hot",
        "allowBlobPublicAccess": false,
        "allowCrossTenantReplication": false,
        "allowSharedKeyAccess": false,
        "encryption": {
          "keySource": "Microsoft.Storage",
          "requireInfrastructureEncryption": false,
          "services": {
            "blob": {
              "enabled": true,
              "keyType": "Account"
            },
            "file": {
              "enabled": true,
              "keyType": "Account"
            },
            "queue": {
              "enabled": true,
              "keyType": "Service"
            },
            "table": {
              "enabled": true,
              "keyType": "Service"
            }
          }
        },
        "isHnsEnabled": false,
        "isNfsV3Enabled": false,
        "keyPolicy": {
          "keyExpirationPeriodInDays": 7
        },
        "largeFileSharesState": "Disabled",
        "minimumTlsVersion": "TLS1_2",
        "networkAcls": {
          "bypass": "AzureServices",
          "defaultAction": "Allow"
        },
        "supportsHttpsTrafficOnly": true
      }
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', variables('storageNameCleanedContainer'))]",
      "name": "[guid(resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned')))), 'Storage Blob Data Contributor')]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
        "principalId": "[reference(resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned')))), '2023-05-01', 'full').identity.principalId]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned'))))]",
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleanedContainer'))]"
      ]
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', variables('aiServicesName'))]",
      "name": "[guid(resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned')))), variables('openAiContributorRoleId'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('openAiContributorRoleId'))]",
        "principalId": "[reference(resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned')))), '2023-05-01', 'full').identity.principalId]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiServicesName'))]",
        "[resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned'))))]"
      ]
    },
    {
      "copy": {
        "name": "containers",
        "count": "[length(variables('containerNames'))]"
      },
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2021-08-01",
      "name": "[format('{0}/default/{1}', variables('storageNameCleanedContainer'), variables('containerNames')[copyIndex()])]",
      "properties": {
        "publicAccess": "None"
      },
      "dependsOn": [
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "deploy_managed_identity",
      "resourceGroup": "[resourceGroup().name]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "solutionName": {
            "value": "[variables('prefixCleaned')]"
          },
          "solutionLocation": {
            "value": "[variables('location')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.33.93.31351",
              "templateHash": "11665286146084422127"
            }
          },
          "parameters": {
            "solutionName": {
              "type": "string",
              "minLength": 3,
              "maxLength": 15,
              "metadata": {
                "description": "Solution Name"
              }
            },
            "solutionLocation": {
              "type": "string",
              "metadata": {
                "description": "Solution Location"
              }
            },
            "miName": {
              "type": "string",
              "defaultValue": "[format('{0}-managed-identity', parameters('solutionName'))]",
              "metadata": {
                "description": "Name"
              }
            }
          },
          "resources": [
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "apiVersion": "2023-01-31",
              "name": "[parameters('miName')]",
              "location": "[parameters('solutionLocation')]",
              "tags": {
                "app": "[parameters('solutionName')]",
                "location": "[parameters('solutionLocation')]"
              }
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(resourceGroup().id, resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName')), resourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635'))]",
              "properties": {
                "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName')), '2023-01-31').principalId]",
                "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
                "principalType": "ServicePrincipal"
              },
              "dependsOn": [
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName'))]"
              ]
            }
          ],
          "outputs": {
            "managedIdentityOutput": {
              "type": "object",
              "value": {
                "id": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName'))]",
                "objectId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName')), '2023-01-31').principalId]",
                "resourceId": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName'))]",
                "location": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName')), '2023-01-31', 'full').location]",
                "name": "[parameters('miName')]"
              }
            },
            "managedIdentityId": {
              "type": "string",
              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('miName'))]"
            }
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "deploy_keyvault",
      "resourceGroup": "[resourceGroup().name]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "solutionName": {
            "value": "[variables('prefixCleaned')]"
          },
          "solutionLocation": {
            "value": "[variables('location')]"
          },
          "managedIdentityObjectId": {
            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityOutput.value.objectId]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.33.93.31351",
              "templateHash": "4388214478635448075"
            }
          },
          "parameters": {
            "solutionName": {
              "type": "string",
              "minLength": 3,
              "maxLength": 15,
              "metadata": {
                "description": "Solution Name"
              }
            },
            "solutionLocation": {
              "type": "string"
            },
            "managedIdentityObjectId": {
              "type": "string"
            }
          },
          "variables": {
            "keyvaultName": "[format('{0}-kv', parameters('solutionName'))]"
          },
          "resources": [
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2022-07-01",
              "name": "[variables('keyvaultName')]",
              "location": "[parameters('solutionLocation')]",
              "properties": {
                "createMode": "default",
                "accessPolicies": [
                  {
                    "objectId": "[parameters('managedIdentityObjectId')]",
                    "permissions": {
                      "certificates": [
                        "all"
                      ],
                      "keys": [
                        "all"
                      ],
                      "secrets": [
                        "all"
                      ],
                      "storage": [
                        "all"
                      ]
                    },
                    "tenantId": "[subscription().tenantId]"
                  }
                ],
                "enabledForDeployment": true,
                "enabledForDiskEncryption": true,
                "enabledForTemplateDeployment": true,
                "enableSoftDelete": false,
                "enableRbacAuthorization": true,
                "enablePurgeProtection": true,
                "publicNetworkAccess": "enabled",
                "sku": {
                  "family": "A",
                  "name": "standard"
                },
                "softDeleteRetentionInDays": 7,
                "tenantId": "[subscription().tenantId]"
              }
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(resourceGroup().id, parameters('managedIdentityObjectId'), resourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483'))]",
              "properties": {
                "principalId": "[parameters('managedIdentityObjectId')]",
                "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
                "principalType": "ServicePrincipal"
              }
            }
          ],
          "outputs": {
            "keyvaultName": {
              "type": "string",
              "value": "[variables('keyvaultName')]"
            },
            "keyvaultId": {
              "type": "string",
              "value": "[resourceId('Microsoft.KeyVault/vaults', variables('keyvaultName'))]"
            }
          }
        }
      },
      "dependsOn": [
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "deploy_ai_foundry",
      "resourceGroup": "[resourceGroup().name]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "solutionName": {
            "value": "[variables('prefixCleaned')]"
          },
          "solutionLocation": {
            "value": "[parameters('AiLocation')]"
          },
          "keyVaultName": {
            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_keyvault'), '2022-09-01').outputs.keyvaultName.value]"
          },
          "gptModelName": {
            "value": "[variables('llmModel')]"
          },
          "gptModelVersion": {
            "value": "[variables('gptModelVersion')]"
          },
          "managedIdentityObjectId": {
            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityOutput.value.objectId]"
          },
          "aiServicesEndpoint": {
            "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', variables('aiServicesName')), '2024-04-01-preview').endpoint]"
          },
          "aiServicesKey": {
            "value": "[listKeys(resourceId('Microsoft.CognitiveServices/accounts', variables('aiServicesName')), '2024-04-01-preview').key1]"
          },
          "aiServicesId": {
            "value": "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiServicesName'))]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.33.93.31351",
              "templateHash": "10270252950808398257"
            }
          },
          "parameters": {
            "solutionName": {
              "type": "string"
            },
            "solutionLocation": {
              "type": "string"
            },
            "keyVaultName": {
              "type": "string"
            },
            "gptModelName": {
              "type": "string"
            },
            "gptModelVersion": {
              "type": "string"
            },
            "managedIdentityObjectId": {
              "type": "string"
            },
            "aiServicesEndpoint": {
              "type": "string"
            },
            "aiServicesKey": {
              "type": "string"
            },
            "aiServicesId": {
              "type": "string"
            }
          },
          "variables": {
            "storageName": "[format('{0}hubstorage', parameters('solutionName'))]",
            "storageSkuName": "Standard_LRS",
            "aiServicesName": "[format('{0}-aiservices', parameters('solutionName'))]",
            "workspaceName": "[format('{0}-workspace', parameters('solutionName'))]",
            "keyvaultName": "[format('{0}-kv', parameters('solutionName'))]",
            "location": "[parameters('solutionLocation')]",
            "aiHubName": "[format('{0}-aihub', parameters('solutionName'))]",
            "aiHubFriendlyName": "[variables('aiHubName')]",
            "aiHubDescription": "AI Hub for KM template",
            "aiProjectName": "[format('{0}-aiproject', parameters('solutionName'))]",
            "aiProjectFriendlyName": "[variables('aiProjectName')]",
            "aiSearchName": "[format('{0}-search', parameters('solutionName'))]",
            "storageNameCleaned": "[replace(variables('storageName'), '-', '')]"
          },
          "resources": [
            {
              "type": "Microsoft.MachineLearningServices/workspaces/connections",
              "apiVersion": "2024-07-01-preview",
              "name": "[format('{0}/{1}', variables('aiHubName'), format('{0}-connection-AzureOpenAI', variables('aiHubName')))]",
              "properties": {
                "category": "AIServices",
                "target": "[parameters('aiServicesEndpoint')]",
                "authType": "ApiKey",
                "isSharedToAll": true,
                "credentials": {
                  "key": "[parameters('aiServicesKey')]"
                },
                "metadata": {
                  "ApiType": "Azure",
                  "ResourceId": "[parameters('aiServicesId')]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.MachineLearningServices/workspaces', variables('aiHubName'))]"
              ]
            },
            {
              "type": "Microsoft.OperationalInsights/workspaces",
              "apiVersion": "2023-09-01",
              "name": "[variables('workspaceName')]",
              "location": "[variables('location')]",
              "tags": {},
              "properties": {
                "retentionInDays": 30,
                "sku": {
                  "name": "PerGB2018"
                }
              }
            },
            {
              "type": "Microsoft.Storage/storageAccounts",
              "apiVersion": "2022-09-01",
              "name": "[variables('storageNameCleaned')]",
              "location": "[variables('location')]",
              "sku": {
                "name": "[variables('storageSkuName')]"
              },
              "kind": "StorageV2",
              "identity": {
                "type": "SystemAssigned"
              },
              "properties": {
                "accessTier": "Hot",
                "allowBlobPublicAccess": false,
                "allowCrossTenantReplication": false,
                "allowSharedKeyAccess": false,
                "encryption": {
                  "keySource": "Microsoft.Storage",
                  "requireInfrastructureEncryption": false,
                  "services": {
                    "blob": {
                      "enabled": true,
                      "keyType": "Account"
                    },
                    "file": {
                      "enabled": true,
                      "keyType": "Account"
                    },
                    "queue": {
                      "enabled": true,
                      "keyType": "Service"
                    },
                    "table": {
                      "enabled": true,
                      "keyType": "Service"
                    }
                  }
                },
                "isHnsEnabled": false,
                "isNfsV3Enabled": false,
                "keyPolicy": {
                  "keyExpirationPeriodInDays": 7
                },
                "largeFileSharesState": "Disabled",
                "minimumTlsVersion": "TLS1_2",
                "networkAcls": {
                  "bypass": "AzureServices",
                  "defaultAction": "Allow"
                },
                "supportsHttpsTrafficOnly": true
              }
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', variables('storageNameCleaned'))]",
              "name": "[guid(resourceGroup().id, parameters('managedIdentityObjectId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'))]",
              "properties": {
                "principalId": "[parameters('managedIdentityObjectId')]",
                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
                "principalType": "ServicePrincipal"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleaned'))]"
              ]
            },
            {
              "type": "Microsoft.MachineLearningServices/workspaces",
              "apiVersion": "2023-08-01-preview",
              "name": "[variables('aiHubName')]",
              "location": "[variables('location')]",
              "identity": {
                "type": "SystemAssigned"
              },
              "properties": {
                "friendlyName": "[variables('aiHubFriendlyName')]",
                "description": "[variables('aiHubDescription')]",
                "keyVault": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
                "storageAccount": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleaned'))]"
              },
              "kind": "hub",
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleaned'))]"
              ]
            },
            {
              "type": "Microsoft.MachineLearningServices/workspaces",
              "apiVersion": "2024-01-01-preview",
              "name": "[variables('aiProjectName')]",
              "location": "[variables('location')]",
              "kind": "Project",
              "identity": {
                "type": "SystemAssigned"
              },
              "properties": {
                "friendlyName": "[variables('aiProjectFriendlyName')]",
                "hubResourceId": "[resourceId('Microsoft.MachineLearningServices/workspaces', variables('aiHubName'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.MachineLearningServices/workspaces', variables('aiHubName'))]"
              ]
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'TENANT-ID')]",
              "properties": {
                "value": "[subscription().tenantId]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-OPENAI-INFERENCE-ENDPOINT')]",
              "properties": {
                "value": ""
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-OPENAI-INFERENCE-KEY')]",
              "properties": {
                "value": ""
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-OPENAI-KEY')]",
              "properties": {
                "value": "[parameters('aiServicesKey')]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-OPEN-AI-DEPLOYMENT-MODEL')]",
              "properties": {
                "value": "[parameters('gptModelName')]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-OPENAI-PREVIEW-API-VERSION')]",
              "properties": {
                "value": "[parameters('gptModelVersion')]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-OPENAI-ENDPOINT')]",
              "properties": {
                "value": "[parameters('aiServicesEndpoint')]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-AI-PROJECT-CONN-STRING')]",
              "properties": {
                "value": "[format('{0};{1};{2};{3}', split(reference(resourceId('Microsoft.MachineLearningServices/workspaces', variables('aiProjectName')), '2024-01-01-preview').discoveryUrl, '/')[2], subscription().subscriptionId, resourceGroup().name, variables('aiProjectName'))]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.MachineLearningServices/workspaces', variables('aiProjectName'))]"
              ]
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-OPENAI-CU-VERSION')]",
              "properties": {
                "value": "?api-version=2024-12-01-preview"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-SEARCH-INDEX')]",
              "properties": {
                "value": "transcripts_index"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'COG-SERVICES-ENDPOINT')]",
              "properties": {
                "value": "[parameters('aiServicesEndpoint')]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'COG-SERVICES-KEY')]",
              "properties": {
                "value": "[parameters('aiServicesKey')]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'COG-SERVICES-NAME')]",
              "properties": {
                "value": "[variables('aiServicesName')]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-SUBSCRIPTION-ID')]",
              "properties": {
                "value": "[subscription().subscriptionId]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-RESOURCE-GROUP')]",
              "properties": {
                "value": "[resourceGroup().name]"
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "apiVersion": "2021-11-01-preview",
              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'AZURE-LOCATION')]",
              "properties": {
                "value": "[parameters('solutionLocation')]"
              }
            }
          ],
          "outputs": {
            "keyvaultName": {
              "type": "string",
              "value": "[variables('keyvaultName')]"
            },
            "keyvaultId": {
              "type": "string",
              "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
            },
            "aiServicesName": {
              "type": "string",
              "value": "[variables('aiServicesName')]"
            },
            "aiSearchName": {
              "type": "string",
              "value": "[variables('aiSearchName')]"
            },
            "aiProjectName": {
              "type": "string",
              "value": "[variables('aiProjectName')]"
            },
            "storageAccountName": {
              "type": "string",
              "value": "[variables('storageNameCleaned')]"
            },
            "logAnalyticsId": {
              "type": "string",
              "value": "[resourceId('Microsoft.OperationalInsights/workspaces', variables('workspaceName'))]"
            },
            "storageAccountId": {
              "type": "string",
              "value": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageNameCleaned'))]"
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiServicesName'))]",
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_keyvault')]",
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[toLower(format('{0}conAppsEnv', variables('prefixCleaned')))]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "logAnalyticsWorkspaceResourceId": {
            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry'), '2022-09-01').outputs.logAnalyticsId.value]"
          },
          "name": {
            "value": "[toLower(format('{0}manenv', variables('prefixCleaned')))]"
          },
          "location": {
            "value": "[variables('location')]"
          },
          "zoneRedundant": {
            "value": false
          },
          "managedIdentities": {
            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.33.93.31351",
              "templateHash": "9269440843859343895"
            },
            "name": "App ManagedEnvironments",
            "description": "This module deploys an App Managed Environment (also known as a Container App Environment)."
          },
          "definitions": {
            "managedIdentitiesType": {
              "type": "object",
              "properties": {
                "systemAssigned": {
                  "type": "bool",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Enables system assigned managed identity on the resource."
                  }
                },
                "userAssignedResourceIds": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The resource ID(s) to assign to the resource."
                  }
                }
              },
              "nullable": true
            },
            "lockType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the name of lock."
                  }
                },
                "kind": {
                  "type": "string",
                  "allowedValues": [
                    "CanNotDelete",
                    "None",
                    "ReadOnly"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the type of lock."
                  }
                }
              },
              "nullable": true
            },
            "roleAssignmentType": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
                    }
                  },
                  "roleDefinitionIdOrName": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                    }
                  },
                  "principalId": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                    }
                  },
                  "principalType": {
                    "type": "string",
                    "allowedValues": [
                      "Device",
                      "ForeignGroup",
                      "Group",
                      "ServicePrincipal",
                      "User"
                    ],
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The principal type of the assigned principal ID."
                    }
                  },
                  "description": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The description of the role assignment."
                    }
                  },
                  "condition": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                    }
                  },
                  "conditionVersion": {
                    "type": "string",
                    "allowedValues": [
                      "2.0"
                    ],
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Version of the condition."
                    }
                  },
                  "delegatedManagedIdentityResourceId": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The Resource Id of the delegated managed identity resource."
                    }
                  }
                }
              },
              "nullable": true
            },
            "certificateKeyVaultPropertiesType": {
              "type": "object",
              "properties": {
                "identityResourceId": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
                  }
                },
                "keyVaultUrl": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
                  }
                }
              },
              "nullable": true
            },
            "storageType": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "accessMode": {
                    "type": "string",
                    "allowedValues": [
                      "ReadOnly",
                      "ReadWrite"
                    ],
                    "metadata": {
                      "description": "Required. Access mode for storage: \"ReadOnly\" or \"ReadWrite\"."
                    }
                  },
                  "kind": {
                    "type": "string",
                    "allowedValues": [
                      "NFS",
                      "SMB"
                    ],
                    "metadata": {
                      "description": "Required. Type of storage: \"SMB\" or \"NFS\"."
                    }
                  },
                  "storageAccountName": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. Storage account name."
                    }
                  },
                  "shareName": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. File share name."
                    }
                  }
                }
              },
              "nullable": true
            }
          },
          "parameters": {
            "name": {
              "type": "string",
              "metadata": {
                "description": "Required. Name of the Container Apps Managed Environment."
              }
            },
            "logAnalyticsWorkspaceResourceId": {
              "type": "string",
              "metadata": {
                "description": "Required. Existing Log Analytics Workspace resource ID. Note: This value is not required as per the resource type. However, not providing it currently causes an issue that is tracked [here](https://github.com/Azure/bicep/issues/9990)."
              }
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "Optional. Location for all Resources."
              }
            },
            "tags": {
              "type": "object",
              "nullable": true,
              "metadata": {
                "description": "Optional. Tags of the resource."
              }
            },
            "managedIdentities": {
              "$ref": "#/definitions/managedIdentitiesType",
              "metadata": {
                "description": "Optional. The managed identity definition for this resource."
              }
            },
            "roleAssignments": {
              "$ref": "#/definitions/roleAssignmentType",
              "metadata": {
                "description": "Optional. Array of role assignments to create."
              }
            },
            "logsDestination": {
              "type": "string",
              "defaultValue": "log-analytics",
              "metadata": {
                "description": "Optional. Logs destination."
              }
            },
            "enableTelemetry": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Enable/Disable usage telemetry for module."
              }
            },
            "appInsightsConnectionString": {
              "type": "securestring",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. Application Insights connection string."
              }
            },
            "daprAIConnectionString": {
              "type": "securestring",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
              }
            },
            "daprAIInstrumentationKey": {
              "type": "securestring",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
              }
            },
            "dockerBridgeCidr": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
              }
            },
            "infrastructureSubnetId": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
              }
            },
            "internal": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
              }
            },
            "platformReservedCidr": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
              }
            },
            "platformReservedDnsIP": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
              }
            },
            "peerTrafficEncryption": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Whether or not to encrypt peer traffic."
              }
            },
            "zoneRedundant": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Whether or not this Managed Environment is zone-redundant."
              }
            },
            "certificatePassword": {
              "type": "securestring",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. Password of the certificate used by the custom domain."
              }
            },
            "certificateValue": {
              "type": "securestring",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
              }
            },
            "certificateKeyVaultProperties": {
              "$ref": "#/definitions/certificateKeyVaultPropertiesType",
              "metadata": {
                "description": "Optional. A key vault reference to the certificate to use for the custom domain."
              }
            },
            "dnsSuffix": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. DNS suffix for the environment domain."
              }
            },
            "lock": {
              "$ref": "#/definitions/lockType",
              "metadata": {
                "description": "Optional. The lock settings of the service."
              }
            },
            "openTelemetryConfiguration": {
              "type": "object",
              "defaultValue": {},
              "metadata": {
                "description": "Optional. Open Telemetry configuration."
              }
            },
            "workloadProfiles": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
              }
            },
            "infrastructureResourceGroupName": {
              "type": "string",
              "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
              "metadata": {
                "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
              }
            },
            "storages": {
              "$ref": "#/definitions/storageType",
              "metadata": {
                "description": "Optional. The list of storages to mount on the environment."
              }
            }
          },
          "variables": {
            "copy": [
              {
                "name": "formattedRoleAssignments",
                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
              }
            ],
            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
            "builtInRoleNames": {
              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
            }
          },
          "resources": {
            "managedEnvironment::storage": {
              "copy": {
                "name": "managedEnvironment::storage",
                "count": "[length(coalesce(parameters('storages'), createArray()))]"
              },
              "type": "Microsoft.App/managedEnvironments/storages",
              "apiVersion": "2024-02-02-preview",
              "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
              "properties": {
                "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
                "azureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'SMB'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'accountName', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, 'accountKey', listkeys(resourceId('Microsoft.Storage/storageAccounts', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName), '2023-01-01').keys[0].value, 'shareName', coalesce(parameters('storages'), createArray())[copyIndex()].shareName), null())]"
              },
              "dependsOn": [
                "managedEnvironment"
              ]
            },
            "avmTelemetry": {
              "condition": "[parameters('enableTelemetry')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2024-03-01",
              "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('0.9.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
              "properties": {
                "mode": "Incremental",
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "resources": [],
                  "outputs": {
                    "telemetry": {
                      "type": "String",
                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
                    }
                  }
                }
              }
            },
            "logAnalyticsWorkspace": {
              "condition": "[not(empty(parameters('logAnalyticsWorkspaceResourceId')))]",
              "existing": true,
              "type": "Microsoft.OperationalInsights/workspaces",
              "apiVersion": "2023-09-01",
              "subscriptionId": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2]]",
              "resourceGroup": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]]",
              "name": "[last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))]"
            },
            "managedEnvironment": {
              "type": "Microsoft.App/managedEnvironments",
              "apiVersion": "2024-02-02-preview",
              "name": "[parameters('name')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('tags')]",
              "identity": "[variables('identity')]",
              "properties": {
                "appInsightsConfiguration": {
                  "connectionString": "[parameters('appInsightsConnectionString')]"
                },
                "appLogsConfiguration": {
                  "destination": "[parameters('logsDestination')]",
                  "logAnalyticsConfiguration": {
                    "customerId": "[reference('logAnalyticsWorkspace').customerId]",
                    "sharedKey": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', last(split(parameters('logAnalyticsWorkspaceResourceId'), '/'))), '2023-09-01').primarySharedKey]"
                  }
                },
                "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
                "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
                "customDomainConfiguration": {
                  "certificatePassword": "[parameters('certificatePassword')]",
                  "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
                  "dnsSuffix": "[parameters('dnsSuffix')]",
                  "certificateKeyVaultProperties": "[if(not(empty(parameters('certificateKeyVaultProperties'))), createObject('identity', parameters('certificateKeyVaultProperties').identityResourceId, 'keyVaultUrl', parameters('certificateKeyVaultProperties').keyVaultUrl), null())]"
                },
                "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
                "peerTrafficConfiguration": {
                  "encryption": {
                    "enabled": "[parameters('peerTrafficEncryption')]"
                  }
                },
                "vnetConfiguration": {
                  "internal": "[parameters('internal')]",
                  "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('infrastructureSubnetId'), null())]",
                  "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetId'))), parameters('dockerBridgeCidr'), null())]",
                  "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedCidr'), null())]",
                  "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetId')))), parameters('platformReservedDnsIP'), null())]"
                },
                "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
                "zoneRedundant": "[parameters('zoneRedundant')]",
                "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
              },
              "dependsOn": [
                "logAnalyticsWorkspace"
              ]
            },
            "managedEnvironment_roleAssignments": {
              "copy": {
                "name": "managedEnvironment_roleAssignments",
                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
              },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
              "properties": {
                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
              },
              "dependsOn": [
                "managedEnvironment"
              ]
            },
            "managedEnvironment_lock": {
              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
              "type": "Microsoft.Authorization/locks",
              "apiVersion": "2020-05-01",
              "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
              "properties": {
                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
              },
              "dependsOn": [
                "managedEnvironment"
              ]
            }
          },
          "outputs": {
            "resourceGroupName": {
              "type": "string",
              "metadata": {
                "description": "The name of the resource group the Managed Environment was deployed into."
              },
              "value": "[resourceGroup().name]"
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "The location the resource was deployed into."
              },
              "value": "[reference('managedEnvironment', '2024-02-02-preview', 'full').location]"
            },
            "name": {
              "type": "string",
              "metadata": {
                "description": "The name of the Managed Environment."
              },
              "value": "[parameters('name')]"
            },
            "resourceId": {
              "type": "string",
              "metadata": {
                "description": "The resource ID of the Managed Environment."
              },
              "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
            },
            "systemAssignedMIPrincipalId": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "The principal ID of the system assigned identity."
              },
              "value": "[tryGet(tryGet(reference('managedEnvironment', '2024-02-02-preview', 'full'), 'identity'), 'principalId')]"
            },
            "defaultDomain": {
              "type": "string",
              "metadata": {
                "description": "The Default domain of the Managed Environment."
              },
              "value": "[reference('managedEnvironment').defaultDomain]"
            },
            "staticIp": {
              "type": "string",
              "metadata": {
                "description": "The IP address of the Managed Environment."
              },
              "value": "[reference('managedEnvironment').staticIp]"
            },
            "domainVerificationId": {
              "type": "string",
              "metadata": {
                "description": "The domain verification id for custom domains."
              },
              "value": "[reference('managedEnvironment').customDomainConfiguration.customDomainVerificationId]"
            }
          }
        }
      },
      "dependsOn": [
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_ai_foundry')]",
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[toLower(format('{0}database', variables('prefixCleaned')))]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "name": {
            "value": "[toLower(format('{0}databaseAccount', variables('prefixCleaned')))]"
          },
          "enableAnalyticalStorage": {
            "value": true
          },
          "location": {
            "value": "[variables('dblocation')]"
          },
          "managedIdentities": {
            "value": {
              "systemAssigned": true,
              "userAssignedResourceIds": [
                "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityOutput.value.resourceId]"
              ]
            }
          },
          "networkRestrictions": {
            "value": {
              "networkAclBypass": "AzureServices",
              "publicNetworkAccess": "Enabled",
              "ipRules": [],
              "virtualNetworkRules": []
            }
          },
          "disableKeyBasedMetadataWriteAccess": {
            "value": false
          },
          "locations": {
            "value": [
              {
                "failoverPriority": 0,
                "isZoneRedundant": false,
                "locationName": "[variables('dblocation')]"
              }
            ]
          },
          "sqlDatabases": {
            "value": [
              {
                "containers": [
                  {
                    "indexingPolicy": {
                      "automatic": true
                    },
                    "name": "[variables('cosmosdbBatchContainer')]",
                    "paths": [
                      "/batch_id"
                    ]
                  },
                  {
                    "indexingPolicy": {
                      "automatic": true
                    },
                    "name": "[variables('cosmosdbFileContainer')]",
                    "paths": [
                      "/file_id"
                    ]
                  },
                  {
                    "indexingPolicy": {
                      "automatic": true
                    },
                    "name": "[variables('cosmosdbLogContainer')]",
                    "paths": [
                      "/log_id"
                    ]
                  }
                ],
                "name": "[variables('cosmosdbDatabase')]"
              }
            ]
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.31.92.45157",
              "templateHash": "1366944588516308546"
            },
            "name": "DocumentDB Database Accounts",
            "description": "This module deploys a DocumentDB Database Account.",
            "owner": "Azure/module-maintainers"
          },
          "definitions": {
            "managedIdentitiesType": {
              "type": "object",
              "properties": {
                "systemAssigned": {
                  "type": "bool",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Enables system assigned managed identity on the resource."
                  }
                },
                "userAssignedResourceIds": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The resource ID(s) to assign to the resource."
                  }
                }
              },
              "nullable": true
            },
            "lockType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the name of lock."
                  }
                },
                "kind": {
                  "type": "string",
                  "allowedValues": [
                    "CanNotDelete",
                    "None",
                    "ReadOnly"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the type of lock."
                  }
                }
              },
              "nullable": true
            },
            "roleAssignmentType": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
                    }
                  },
                  "roleDefinitionIdOrName": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                    }
                  },
                  "principalId": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                    }
                  },
                  "principalType": {
                    "type": "string",
                    "allowedValues": [
                      "Device",
                      "ForeignGroup",
                      "Group",
                      "ServicePrincipal",
                      "User"
                    ],
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The principal type of the assigned principal ID."
                    }
                  },
                  "description": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The description of the role assignment."
                    }
                  },
                  "condition": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                    }
                  },
                  "conditionVersion": {
                    "type": "string",
                    "allowedValues": [
                      "2.0"
                    ],
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Version of the condition."
                    }
                  },
                  "delegatedManagedIdentityResourceId": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The Resource Id of the delegated managed identity resource."
                    }
                  }
                }
              },
              "nullable": true
            },
            "privateEndpointType": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The name of the private endpoint."
                    }
                  },
                  "location": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The location to deploy the private endpoint to."
                    }
                  },
                  "privateLinkServiceConnectionName": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The name of the private link connection to create."
                    }
                  },
                  "service": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\"."
                    }
                  },
                  "subnetResourceId": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
                    }
                  },
                  "privateDnsZoneGroup": {
                    "type": "object",
                    "properties": {
                      "name": {
                        "type": "string",
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. The name of the Private DNS Zone Group."
                        }
                      },
                      "privateDnsZoneGroupConfigs": {
                        "type": "array",
                        "items": {
                          "type": "object",
                          "properties": {
                            "name": {
                              "type": "string",
                              "nullable": true,
                              "metadata": {
                                "description": "Optional. The name of the private DNS zone group config."
                              }
                            },
                            "privateDnsZoneResourceId": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. The resource id of the private DNS zone."
                              }
                            }
                          }
                        },
                        "metadata": {
                          "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
                        }
                      }
                    },
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The private DNS zone group to configure for the private endpoint."
                    }
                  },
                  "isManualConnection": {
                    "type": "bool",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. If Manual Private Link Connection is required."
                    }
                  },
                  "manualConnectionRequestMessage": {
                    "type": "string",
                    "nullable": true,
                    "maxLength": 140,
                    "metadata": {
                      "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
                    }
                  },
                  "customDnsConfigs": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "fqdn": {
                          "type": "string",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. FQDN that resolves to private endpoint IP address."
                          }
                        },
                        "ipAddresses": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          },
                          "metadata": {
                            "description": "Required. A list of private ip addresses of the private endpoint."
                          }
                        }
                      }
                    },
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Custom DNS configurations."
                    }
                  },
                  "ipConfigurations": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string",
                          "metadata": {
                            "description": "Required. The name of the resource that is unique within a resource group."
                          }
                        },
                        "properties": {
                          "type": "object",
                          "properties": {
                            "groupId": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
                              }
                            },
                            "memberName": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
                              }
                            },
                            "privateIPAddress": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. A private ip address obtained from the private endpoint's subnet."
                              }
                            }
                          },
                          "metadata": {
                            "description": "Required. Properties of private endpoint IP configurations."
                          }
                        }
                      }
                    },
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
                    }
                  },
                  "applicationSecurityGroupResourceIds": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    },
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
                    }
                  },
                  "customNetworkInterfaceName": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The custom name of the network interface attached to the private endpoint."
                    }
                  },
                  "lock": {
                    "$ref": "#/definitions/lockType",
                    "metadata": {
                      "description": "Optional. Specify the type of lock."
                    }
                  },
                  "roleAssignments": {
                    "$ref": "#/definitions/roleAssignmentType",
                    "metadata": {
                      "description": "Optional. Array of role assignments to create."
                    }
                  },
                  "tags": {
                    "type": "object",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
                    }
                  },
                  "enableTelemetry": {
                    "type": "bool",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Enable/Disable usage telemetry for module."
                    }
                  },
                  "resourceGroupName": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource."
                    }
                  }
                }
              },
              "nullable": true
            },
            "diagnosticSettingType": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The name of diagnostic setting."
                    }
                  },
                  "logCategoriesAndGroups": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "category": {
                          "type": "string",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
                          }
                        },
                        "categoryGroup": {
                          "type": "string",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
                          }
                        },
                        "enabled": {
                          "type": "bool",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
                          }
                        }
                      }
                    },
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
                    }
                  },
                  "metricCategories": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "category": {
                          "type": "string",
                          "metadata": {
                            "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
                          }
                        },
                        "enabled": {
                          "type": "bool",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. Enable or disable the category explicitly. Default is `true`."
                          }
                        }
                      }
                    },
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
                    }
                  },
                  "logAnalyticsDestinationType": {
                    "type": "string",
                    "allowedValues": [
                      "AzureDiagnostics",
                      "Dedicated"
                    ],
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
                    }
                  },
                  "workspaceResourceId": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
                    }
                  },
                  "storageAccountResourceId": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
                    }
                  },
                  "eventHubAuthorizationRuleResourceId": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
                    }
                  },
                  "eventHubName": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
                    }
                  },
                  "marketplacePartnerResourceId": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
                    }
                  }
                }
              },
              "nullable": true
            },
            "failoverLocationsType": {
              "type": "object",
              "properties": {
                "failoverPriority": {
                  "type": "int",
                  "metadata": {
                    "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
                  }
                },
                "isZoneRedundant": {
                  "type": "bool",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Default to true. Flag to indicate whether or not this region is an AvailabilityZone region."
                  }
                },
                "locationName": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The name of the region."
                  }
                }
              }
            },
            "sqlRoleDefinitionsType": {
              "type": "array",
              "items": {
                "type": "object",
                "properties": {
                  "name": {
                    "type": "string",
                    "metadata": {
                      "description": "Required. Name of the SQL Role Definition."
                    }
                  },
                  "dataAction": {
                    "type": "array",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. An array of data actions that are allowed."
                    }
                  },
                  "roleName": {
                    "type": "string",
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
                    }
                  },
                  "roleType": {
                    "type": "string",
                    "allowedValues": [
                      "BuiltInRole",
                      "CustomRole"
                    ],
                    "nullable": true,
                    "metadata": {
                      "description": "Optional. Indicates whether the Role Definition was built-in or user created."
                    }
                  }
                }
              },
              "nullable": true
            },
            "sqlDatabaseType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. Name of the SQL database ."
                  }
                },
                "throughput": {
                  "type": "int",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Default to 400. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
                  }
                },
                "autoscaleSettingsMaxThroughput": {
                  "type": "int",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to.  The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled."
                  }
                },
                "containers": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "name": {
                        "type": "string",
                        "metadata": {
                          "description": "Required. Name of the container."
                        }
                      },
                      "paths": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        },
                        "minLength": 1,
                        "maxLength": 3,
                        "metadata": {
                          "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
                        }
                      },
                      "analyticalStorageTtl": {
                        "type": "int",
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
                        }
                      },
                      "autoscaleSettingsMaxThroughput": {
                        "type": "int",
                        "nullable": true,
                        "maxValue": 1000000,
                        "metadata": {
                          "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled."
                        }
                      },
                      "conflictResolutionPolicy": {
                        "type": "object",
                        "properties": {
                          "conflictResolutionPath": {
                            "type": "string",
                            "nullable": true,
                            "metadata": {
                              "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
                            }
                          },
                          "conflictResolutionProcedure": {
                            "type": "string",
                            "nullable": true,
                            "metadata": {
                              "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
                            }
                          },
                          "mode": {
                            "type": "string",
                            "allowedValues": [
                              "Custom",
                              "LastWriterWins"
                            ],
                            "metadata": {
                              "description": "Required. Indicates the conflict resolution mode."
                            }
                          }
                        },
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
                        }
                      },
                      "defaultTtl": {
                        "type": "int",
                        "nullable": true,
                        "minValue": -1,
                        "maxValue": 2147483647,
                        "metadata": {
                          "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
                        }
                      },
                      "indexingPolicy": {
                        "type": "object",
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. Indexing policy of the container."
                        }
                      },
                      "kind": {
                        "type": "string",
                        "allowedValues": [
                          "Hash",
                          "MultiHash"
                        ],
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
                        }
                      },
                      "version": {
                        "type": "int",
                        "allowedValues": [
                          1,
                          2
                        ],
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
                        }
                      },
                      "throughput": {
                        "type": "int",
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
                        }
                      },
                      "uniqueKeyPolicyKeys": {
                        "type": "array",
                        "items": {
                          "type": "object",
                          "properties": {
                            "paths": {
                              "type": "array",
                              "items": {
                                "type": "string"
                              },
                              "metadata": {
                                "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
                              }
                            }
                          }
                        },
                        "nullable": true,
                        "metadata": {
                          "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
                        }
                      }
                    }
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Array of containers to deploy in the SQL database."
                  }
                }
              }
            },
            "secretsExportConfigurationType": {
              "type": "object",
              "properties": {
                "keyVaultResourceId": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The resource ID of the key vault where to store the secrets of this module."
                  }
                },
                "primaryWriteKeySecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary write key secret name to create."
                  }
                },
                "primaryReadOnlyKeySecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary readonly key secret name to create."
                  }
                },
                "primaryWriteConnectionStringSecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary write connection string secret name to create."
                  }
                },
                "primaryReadonlyConnectionStringSecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary readonly connection string secret name to create."
                  }
                },
                "secondaryWriteKeySecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary write key secret name to create."
                  }
                },
                "secondaryReadonlyKeySecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary readonly key secret name to create."
                  }
                },
                "secondaryWriteConnectionStringSecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary write connection string secret name to create."
                  }
                },
                "secondaryReadonlyConnectionStringSecretName": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The primary readonly connection string secret name to create."
                  }
                }
              }
            },
            "secretsOutputType": {
              "type": "object",
              "properties": {},
              "additionalProperties": {
                "$ref": "#/definitions/secretSetType",
                "metadata": {
                  "description": "An exported secret's references."
                }
              }
            },
            "networkRestrictionsType": {
              "type": "object",
              "properties": {
                "ipRules": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "metadata": {
                    "description": "Required. A single IPv4 address or a single IPv4 address range in CIDR format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, since these are not enforceable by the IP address filter. Example of valid inputs: \"23.40.210.245\" or \"23.40.210.0/8\"."
                  }
                },
                "networkAclBypass": {
                  "type": "string",
                  "allowedValues": [
                    "AzureServices",
                    "None"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Default to AzureServices. Specifies the network ACL bypass for Azure services."
                  }
                },
                "publicNetworkAccess": {
                  "type": "string",
                  "allowedValues": [
                    "Disabled",
                    "Enabled"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Default to Enabled. Whether requests from Public Network are allowed."
                  }
                },
                "virtualNetworkRules": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "subnetResourceId": {
                        "type": "string",
                        "metadata": {
                          "description": "Required. Resource ID of a subnet."
                        }
                      }
                    }
                  },
                  "metadata": {
                    "description": "Required. List of Virtual Network ACL rules configured for the Cosmos DB account.."
                  }
                }
              }
            },
            "secretSetType": {
              "type": "object",
              "properties": {
                "secretResourceId": {
                  "type": "string",
                  "metadata": {
                    "description": "The resourceId of the exported secret."
                  }
                },
                "secretUri": {
                  "type": "string",
                  "metadata": {
                    "description": "The secret URI of the exported secret."
                  }
                }
              },
              "metadata": {
                "__bicep_imported_from!": {
                  "sourceTemplate": "modules/keyVaultExport.bicep"
                }
              }
            }
          },
          "parameters": {
            "name": {
              "type": "string",
              "metadata": {
                "description": "Required. Name of the Database Account."
              }
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "Optional. Default to current resource group scope location. Location for all resources."
              }
            },
            "tags": {
              "type": "object",
              "nullable": true,
              "metadata": {
                "description": "Optional. Tags of the Database Account resource."
              }
            },
            "managedIdentities": {
              "$ref": "#/definitions/managedIdentitiesType",
              "metadata": {
                "description": "Optional. The managed identity definition for this resource."
              }
            },
            "databaseAccountOfferType": {
              "type": "string",
              "defaultValue": "Standard",
              "allowedValues": [
                "Standard"
              ],
              "metadata": {
                "description": "Optional. Default to Standard. The offer type for the Azure Cosmos DB database account."
              }
            },
            "locations": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/failoverLocationsType"
              },
              "defaultValue": [],
              "metadata": {
                "description": "Optional. Default to the location where the account is deployed. Locations enabled for the Cosmos DB account."
              }
            },
            "defaultConsistencyLevel": {
              "type": "string",
              "defaultValue": "Session",
              "allowedValues": [
                "Eventual",
                "ConsistentPrefix",
                "Session",
                "BoundedStaleness",
                "Strong"
              ],
              "metadata": {
                "description": "Optional. Default to Session. The default consistency level of the Cosmos DB account."
              }
            },
            "disableLocalAuth": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Opt-out of local authentication and ensure only MSI and AAD can be used exclusively for authentication."
              }
            },
            "enableAnalyticalStorage": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Optional. Flag to indicate whether to enable storage analytics."
              }
            },
            "automaticFailover": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Enable automatic failover for regions."
              }
            },
            "enableFreeTier": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Optional. Flag to indicate whether Free Tier is enabled."
              }
            },
            "enableMultipleWriteLocations": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled."
              }
            },
            "disableKeyBasedMetadataWriteAccess": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys."
              }
            },
            "maxStalenessPrefix": {
              "type": "int",
              "defaultValue": 100000,
              "minValue": 1,
              "maxValue": 2147483647,
              "metadata": {
                "description": "Optional. Default to 100000. Max stale requests. Required for BoundedStaleness. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000."
              }
            },
            "maxIntervalInSeconds": {
              "type": "int",
              "defaultValue": 300,
              "minValue": 5,
              "maxValue": 86400,
              "metadata": {
                "description": "Optional. Default to 300. Max lag time (minutes). Required for BoundedStaleness. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400."
              }
            },
            "serverVersion": {
              "type": "string",
              "defaultValue": "4.2",
              "allowedValues": [
                "3.2",
                "3.6",
                "4.0",
                "4.2",
                "5.0",
                "6.0",
                "7.0"
              ],
              "metadata": {
                "description": "Optional. Default to 4.2. Specifies the MongoDB server version to use."
              }
            },
            "sqlDatabases": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/sqlDatabaseType"
              },
              "defaultValue": [],
              "metadata": {
                "description": "Optional. SQL Databases configurations."
              }
            },
            "sqlRoleAssignmentsPrincipalIds": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. SQL Role Definitions configurations."
              }
            },
            "sqlRoleDefinitions": {
              "$ref": "#/definitions/sqlRoleDefinitionsType",
              "metadata": {
                "description": "Optional. SQL Role Definitions configurations."
              }
            },
            "mongodbDatabases": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. MongoDB Databases configurations."
              }
            },
            "gremlinDatabases": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. Gremlin Databases configurations."
              }
            },
            "tables": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. Table configurations."
              }
            },
            "enableTelemetry": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Enable/Disable usage telemetry for module."
              }
            },
            "lock": {
              "$ref": "#/definitions/lockType",
              "metadata": {
                "description": "Optional. The lock settings of the service."
              }
            },
            "roleAssignments": {
              "$ref": "#/definitions/roleAssignmentType",
              "metadata": {
                "description": "Optional. Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalIds' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
              }
            },
            "diagnosticSettings": {
              "$ref": "#/definitions/diagnosticSettingType",
              "metadata": {
                "description": "Optional. The diagnostic settings of the service."
              }
            },
            "capabilitiesToAdd": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "defaultValue": [],
              "allowedValues": [
                "EnableCassandra",
                "EnableTable",
                "EnableGremlin",
                "EnableMongo",
                "DisableRateLimitingResponses",
                "EnableServerless",
                "EnableNoSQLVectorSearch",
                "EnableNoSQLFullTextSearch",
                "EnableMaterializedViews"
              ],
              "metadata": {
                "description": "Optional. List of Cosmos DB capabilities for the account."
              }
            },
            "backupPolicyType": {
              "type": "string",
              "defaultValue": "Continuous",
              "allowedValues": [
                "Periodic",
                "Continuous"
              ],
              "metadata": {
                "description": "Optional. Default to Continuous. Describes the mode of backups. Periodic backup must be used if multiple write locations are used."
              }
            },
            "backupPolicyContinuousTier": {
              "type": "string",
              "defaultValue": "Continuous30Days",
              "allowedValues": [
                "Continuous30Days",
                "Continuous7Days"
              ],
              "metadata": {
                "description": "Optional. Default to Continuous30Days. Configuration values for continuous mode backup."
              }
            },
            "backupIntervalInMinutes": {
              "type": "int",
              "defaultValue": 240,
              "minValue": 60,
              "maxValue": 1440,
              "metadata": {
                "description": "Optional. Default to 240. An integer representing the interval in minutes between two backups. Only applies to periodic backup type."
              }
            },
            "backupRetentionIntervalInHours": {
              "type": "int",
              "defaultValue": 8,
              "minValue": 2,
              "maxValue": 720,
              "metadata": {
                "description": "Optional. Default to 8. An integer representing the time (in hours) that each backup is retained. Only applies to periodic backup type."
              }
            },
            "backupStorageRedundancy": {
              "type": "string",
              "defaultValue": "Local",
              "allowedValues": [
                "Geo",
                "Local",
                "Zone"
              ],
              "metadata": {
                "description": "Optional. Default to Local. Enum to indicate type of backup residency. Only applies to periodic backup type."
              }
            },
            "privateEndpoints": {
              "$ref": "#/definitions/privateEndpointType",
              "metadata": {
                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
              }
            },
            "secretsExportConfiguration": {
              "$ref": "#/definitions/secretsExportConfigurationType",
              "nullable": true,
              "metadata": {
                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
              }
            },
            "networkRestrictions": {
              "$ref": "#/definitions/networkRestrictionsType",
              "defaultValue": {
                "ipRules": [],
                "virtualNetworkRules": [],
                "publicNetworkAccess": "Disabled"
              },
              "metadata": {
                "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
              }
            },
            "minimumTlsVersion": {
              "type": "string",
              "defaultValue": "Tls12",
              "allowedValues": [
                "Tls",
                "Tls11",
                "Tls12"
              ],
              "metadata": {
                "description": "Optional. Default to TLS 1.2. Enum to indicate the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later."
              }
            }
          },
          "variables": {
            "copy": [
              {
                "name": "databaseAccount_locations",
                "count": "[length(parameters('locations'))]",
                "input": {
                  "failoverPriority": "[parameters('locations')[copyIndex('databaseAccount_locations')].failoverPriority]",
                  "locationName": "[parameters('locations')[copyIndex('databaseAccount_locations')].locationName]",
                  "isZoneRedundant": "[coalesce(tryGet(parameters('locations')[copyIndex('databaseAccount_locations')], 'isZoneRedundant'), true())]"
                }
              },
              {
                "name": "capabilities",
                "count": "[length(parameters('capabilitiesToAdd'))]",
                "input": {
                  "name": "[parameters('capabilitiesToAdd')[copyIndex('capabilities')]]"
                }
              },
              {
                "name": "ipRules",
                "count": "[length(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()))]",
                "input": {
                  "ipAddressOrRange": "[coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray())[copyIndex('ipRules')]]"
                }
              },
              {
                "name": "virtualNetworkRules",
                "count": "[length(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()))]",
                "input": {
                  "id": "[coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray())[copyIndex('virtualNetworkRules')].subnetResourceId]",
                  "ignoreMissingVnetServiceEndpoint": false
                }
              },
              {
                "name": "formattedRoleAssignments",
                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
              }
            ],
            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
            "consistencyPolicy": {
              "Eventual": {
                "defaultConsistencyLevel": "Eventual"
              },
              "ConsistentPrefix": {
                "defaultConsistencyLevel": "ConsistentPrefix"
              },
              "Session": {
                "defaultConsistencyLevel": "Session"
              },
              "BoundedStaleness": {
                "defaultConsistencyLevel": "BoundedStaleness",
                "maxStalenessPrefix": "[parameters('maxStalenessPrefix')]",
                "maxIntervalInSeconds": "[parameters('maxIntervalInSeconds')]"
              },
              "Strong": {
                "defaultConsistencyLevel": "Strong"
              }
            },
            "defaultFailoverLocation": [
              {
                "failoverPriority": 0,
                "locationName": "[parameters('location')]",
                "isZoneRedundant": true
              }
            ],
            "kind": "[if(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('gremlinDatabases')))), 'GlobalDocumentDB', if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB'))]",
            "backupPolicy": "[if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('type', parameters('backupPolicyType'), 'continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject('type', parameters('backupPolicyType'), 'periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))))]",
            "databaseAccountProperties": "[union(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', variables('backupPolicy'), 'minimalTlsVersion', parameters('minimumTlsVersion')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', variables('consistencyPolicy')[parameters('defaultConsistencyLevel')], 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(empty(variables('databaseAccount_locations')), variables('defaultFailoverLocation'), variables('databaseAccount_locations')), 'ipRules', variables('ipRules'), 'virtualNetworkRules', variables('virtualNetworkRules'), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'AzureServices'), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Enabled'), 'isVirtualNetworkFilterEnabled', or(not(empty(variables('ipRules'))), not(empty(variables('virtualNetworkRules')))), 'capabilities', variables('capabilities'), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('tables')))), createObject('disableLocalAuth', parameters('disableLocalAuth'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess')), createObject()), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject()))]",
            "builtInRoleNames": {
              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
              "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
              "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
              "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
              "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
              "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
              "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
            }
          },
          "resources": {
            "avmTelemetry": {
              "condition": "[parameters('enableTelemetry')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2024-03-01",
              "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.9.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
              "properties": {
                "mode": "Incremental",
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "resources": [],
                  "outputs": {
                    "telemetry": {
                      "type": "String",
                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
                    }
                  }
                }
              }
            },
            "databaseAccount": {
              "type": "Microsoft.DocumentDB/databaseAccounts",
              "apiVersion": "2023-04-15",
              "name": "[parameters('name')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('tags')]",
              "identity": "[variables('identity')]",
              "kind": "[variables('kind')]",
              "properties": "[variables('databaseAccountProperties')]"
            },
            "databaseAccount_lock": {
              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
              "type": "Microsoft.Authorization/locks",
              "apiVersion": "2020-05-01",
              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
              "properties": {
                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_diagnosticSettings": {
              "copy": {
                "name": "databaseAccount_diagnosticSettings",
                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
              },
              "type": "Microsoft.Insights/diagnosticSettings",
              "apiVersion": "2021-05-01-preview",
              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
              "properties": {
                "copy": [
                  {
                    "name": "metrics",
                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
                    "input": {
                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
                      "timeGrain": null
                    }
                  },
                  {
                    "name": "logs",
                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
                    "input": {
                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
                    }
                  }
                ],
                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_roleAssignments": {
              "copy": {
                "name": "databaseAccount_roleAssignments",
                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
              },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
              "properties": {
                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_sqlDatabases": {
              "copy": {
                "name": "databaseAccount_sqlDatabases",
                "count": "[length(parameters('sqlDatabases'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), parameters('sqlDatabases')[copyIndex()].name)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "name": {
                    "value": "[parameters('sqlDatabases')[copyIndex()].name]"
                  },
                  "containers": {
                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'containers')]"
                  },
                  "throughput": {
                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'throughput')]"
                  },
                  "databaseAccountName": {
                    "value": "[parameters('name')]"
                  },
                  "autoscaleSettingsMaxThroughput": {
                    "value": "[tryGet(parameters('sqlDatabases')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "languageVersion": "2.0",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.31.92.45157",
                      "templateHash": "14039021912249335209"
                    },
                    "name": "DocumentDB Database Account SQL Databases",
                    "description": "This module deploys a SQL Database in a CosmosDB Account.",
                    "owner": "Azure/module-maintainers"
                  },
                  "parameters": {
                    "databaseAccountName": {
                      "type": "string",
                      "metadata": {
                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
                      }
                    },
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. Name of the SQL database ."
                      }
                    },
                    "containers": {
                      "type": "array",
                      "items": {
                        "type": "object"
                      },
                      "defaultValue": [],
                      "metadata": {
                        "description": "Optional. Array of containers to deploy in the SQL database."
                      }
                    },
                    "throughput": {
                      "type": "int",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
                      }
                    },
                    "autoscaleSettingsMaxThroughput": {
                      "type": "int",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to.  The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled."
                      }
                    },
                    "tags": {
                      "type": "object",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Tags of the SQL database resource."
                      }
                    }
                  },
                  "resources": {
                    "databaseAccount": {
                      "existing": true,
                      "type": "Microsoft.DocumentDB/databaseAccounts",
                      "apiVersion": "2023-04-15",
                      "name": "[parameters('databaseAccountName')]"
                    },
                    "sqlDatabase": {
                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
                      "apiVersion": "2023-04-15",
                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
                      "tags": "[parameters('tags')]",
                      "properties": {
                        "resource": {
                          "id": "[parameters('name')]"
                        },
                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
                      },
                      "dependsOn": [
                        "databaseAccount"
                      ]
                    },
                    "container": {
                      "copy": {
                        "name": "container",
                        "count": "[length(parameters('containers'))]"
                      },
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), parameters('containers')[copyIndex()].name)]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "databaseAccountName": {
                            "value": "[parameters('databaseAccountName')]"
                          },
                          "sqlDatabaseName": {
                            "value": "[parameters('name')]"
                          },
                          "name": {
                            "value": "[parameters('containers')[copyIndex()].name]"
                          },
                          "analyticalStorageTtl": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'analyticalStorageTtl')]"
                          },
                          "autoscaleSettingsMaxThroughput": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
                          },
                          "conflictResolutionPolicy": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'conflictResolutionPolicy')]"
                          },
                          "defaultTtl": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'defaultTtl')]"
                          },
                          "indexingPolicy": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'indexingPolicy')]"
                          },
                          "kind": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'kind')]"
                          },
                          "version": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'version')]"
                          },
                          "paths": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'paths')]"
                          },
                          "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(parameters('containers')[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(parameters('containers')[copyIndex()], 'throughput')))]",
                          "uniqueKeyPolicyKeys": {
                            "value": "[tryGet(parameters('containers')[copyIndex()], 'uniqueKeyPolicyKeys')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "languageVersion": "2.0",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.31.92.45157",
                              "templateHash": "1471754747460263407"
                            },
                            "name": "DocumentDB Database Account SQL Database Containers",
                            "description": "This module deploys a SQL Database Container in a CosmosDB Account.",
                            "owner": "Azure/module-maintainers"
                          },
                          "parameters": {
                            "databaseAccountName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
                              }
                            },
                            "sqlDatabaseName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
                              }
                            },
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. Name of the container."
                              }
                            },
                            "analyticalStorageTtl": {
                              "type": "int",
                              "defaultValue": 0,
                              "metadata": {
                                "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
                              }
                            },
                            "conflictResolutionPolicy": {
                              "type": "object",
                              "defaultValue": {},
                              "metadata": {
                                "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
                              }
                            },
                            "defaultTtl": {
                              "type": "int",
                              "defaultValue": -1,
                              "minValue": -1,
                              "maxValue": 2147483647,
                              "metadata": {
                                "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
                              }
                            },
                            "throughput": {
                              "type": "int",
                              "defaultValue": 400,
                              "metadata": {
                                "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
                              }
                            },
                            "autoscaleSettingsMaxThroughput": {
                              "type": "int",
                              "nullable": true,
                              "maxValue": 1000000,
                              "metadata": {
                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled."
                              }
                            },
                            "tags": {
                              "type": "object",
                              "nullable": true,
                              "metadata": {
                                "description": "Optional. Tags of the SQL Database resource."
                              }
                            },
                            "paths": {
                              "type": "array",
                              "items": {
                                "type": "string"
                              },
                              "minLength": 1,
                              "maxLength": 3,
                              "metadata": {
                                "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
                              }
                            },
                            "indexingPolicy": {
                              "type": "object",
                              "defaultValue": {},
                              "metadata": {
                                "description": "Optional. Indexing policy of the container."
                              }
                            },
                            "uniqueKeyPolicyKeys": {
                              "type": "array",
                              "defaultValue": [],
                              "metadata": {
                                "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
                              }
                            },
                            "kind": {
                              "type": "string",
                              "defaultValue": "Hash",
                              "allowedValues": [
                                "Hash",
                                "MultiHash"
                              ],
                              "metadata": {
                                "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
                              }
                            },
                            "version": {
                              "type": "int",
                              "defaultValue": 1,
                              "allowedValues": [
                                1,
                                2
                              ],
                              "metadata": {
                                "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
                              }
                            }
                          },
                          "variables": {
                            "copy": [
                              {
                                "name": "partitionKeyPaths",
                                "count": "[length(parameters('paths'))]",
                                "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
                              }
                            ],
                            "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]"
                          },
                          "resources": {
                            "databaseAccount::sqlDatabase": {
                              "existing": true,
                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
                              "apiVersion": "2023-04-15",
                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]",
                              "dependsOn": [
                                "databaseAccount"
                              ]
                            },
                            "databaseAccount": {
                              "existing": true,
                              "type": "Microsoft.DocumentDB/databaseAccounts",
                              "apiVersion": "2023-04-15",
                              "name": "[parameters('databaseAccountName')]"
                            },
                            "container": {
                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
                              "apiVersion": "2023-04-15",
                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
                              "tags": "[parameters('tags')]",
                              "properties": {
                                "resource": "[variables('containerResourceParams')]",
                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
                              },
                              "dependsOn": [
                                "databaseAccount::sqlDatabase"
                              ]
                            }
                          },
                          "outputs": {
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the container."
                              },
                              "value": "[parameters('name')]"
                            },
                            "resourceId": {
                              "type": "string",
                              "metadata": {
                                "description": "The resource ID of the container."
                              },
                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
                            },
                            "resourceGroupName": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the resource group the container was created in."
                              },
                              "value": "[resourceGroup().name]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "sqlDatabase"
                      ]
                    }
                  },
                  "outputs": {
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the SQL database."
                      },
                      "value": "[parameters('name')]"
                    },
                    "resourceId": {
                      "type": "string",
                      "metadata": {
                        "description": "The resource ID of the SQL database."
                      },
                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
                    },
                    "resourceGroupName": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the resource group the SQL database was created in."
                      },
                      "value": "[resourceGroup().name]"
                    }
                  }
                }
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_sqlRoleDefinitions": {
              "copy": {
                "name": "databaseAccount_sqlRoleDefinitions",
                "count": "[length(coalesce(parameters('sqlRoleDefinitions'), createArray()))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].name)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "name": {
                    "value": "[coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].name]"
                  },
                  "databaseAccountName": {
                    "value": "[parameters('name')]"
                  },
                  "dataActions": {
                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
                  },
                  "roleName": {
                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'roleName')]"
                  },
                  "roleType": {
                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'roleType')]"
                  },
                  "principalIds": {
                    "value": "[parameters('sqlRoleAssignmentsPrincipalIds')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.31.92.45157",
                      "templateHash": "3860121931480041680"
                    },
                    "name": "DocumentDB Database Account SQL Role.",
                    "description": "This module deploys SQL Role Definision and Assignment in a CosmosDB Account.",
                    "owner": "Azure/module-maintainers"
                  },
                  "parameters": {
                    "databaseAccountName": {
                      "type": "string",
                      "metadata": {
                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
                      }
                    },
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. Name of the SQL Role."
                      }
                    },
                    "dataActions": {
                      "type": "array",
                      "defaultValue": [
                        "Microsoft.DocumentDB/databaseAccounts/readMetadata",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*",
                        "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*"
                      ],
                      "metadata": {
                        "description": "Optional. An array of data actions that are allowed."
                      }
                    },
                    "principalIds": {
                      "type": "array",
                      "defaultValue": [],
                      "metadata": {
                        "description": "Optional. Ids needs to be granted."
                      }
                    },
                    "roleName": {
                      "type": "string",
                      "defaultValue": "Reader Writer",
                      "metadata": {
                        "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
                      }
                    },
                    "roleType": {
                      "type": "string",
                      "defaultValue": "CustomRole",
                      "allowedValues": [
                        "CustomRole",
                        "BuiltInRole"
                      ],
                      "metadata": {
                        "description": "Optional. Indicates whether the Role Definition was built-in or user created."
                      }
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('sql-role-definition-{0}', uniqueString(parameters('name')))]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "databaseAccountName": {
                            "value": "[parameters('databaseAccountName')]"
                          },
                          "dataActions": {
                            "value": "[parameters('dataActions')]"
                          },
                          "roleName": {
                            "value": "[parameters('roleName')]"
                          },
                          "roleType": {
                            "value": "[parameters('roleType')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.31.92.45157",
                              "templateHash": "2222650596260487600"
                            },
                            "name": "DocumentDB Database Account SQL Role Definitions.",
                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account.",
                            "owner": "Azure/module-maintainers"
                          },
                          "parameters": {
                            "databaseAccountName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
                              }
                            },
                            "dataActions": {
                              "type": "array",
                              "defaultValue": [],
                              "metadata": {
                                "description": "Optional. An array of data actions that are allowed."
                              }
                            },
                            "roleName": {
                              "type": "string",
                              "defaultValue": "Reader Writer",
                              "metadata": {
                                "description": "Optional. A user-friendly name for the Role Definition. Must be unique for the database account."
                              }
                            },
                            "roleType": {
                              "type": "string",
                              "defaultValue": "CustomRole",
                              "allowedValues": [
                                "CustomRole",
                                "BuiltInRole"
                              ],
                              "metadata": {
                                "description": "Optional. Indicates whether the Role Definition was built-in or user created."
                              }
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
                              "apiVersion": "2023-04-15",
                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]",
                              "properties": {
                                "assignableScopes": [
                                  "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
                                ],
                                "permissions": [
                                  {
                                    "dataActions": "[parameters('dataActions')]"
                                  }
                                ],
                                "roleName": "[parameters('roleName')]",
                                "type": "[parameters('roleType')]"
                              }
                            }
                          ],
                          "outputs": {
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the SQL database."
                              },
                              "value": "[guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')]"
                            },
                            "resourceId": {
                              "type": "string",
                              "metadata": {
                                "description": "The resource ID of the SQL database."
                              },
                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]"
                            },
                            "resourceGroupName": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the resource group the SQL database was created in."
                              },
                              "value": "[resourceGroup().name]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "copy": {
                        "name": "sqlRoleAssignment",
                        "count": "[length(parameters('principalIds'))]",
                        "mode": "serial",
                        "batchSize": 1
                      },
                      "condition": "[not(empty(parameters('principalIds')[copyIndex()]))]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('sql-role-assign-{0}', uniqueString(parameters('principalIds')[copyIndex()]))]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "name": {
                            "value": "[guid(reference(resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name')))), '2022-09-01').outputs.resourceId.value, parameters('principalIds')[copyIndex()], resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
                          },
                          "databaseAccountName": {
                            "value": "[parameters('databaseAccountName')]"
                          },
                          "roleDefinitionId": {
                            "value": "[reference(resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name')))), '2022-09-01').outputs.resourceId.value]"
                          },
                          "principalId": {
                            "value": "[parameters('principalIds')[copyIndex()]]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.31.92.45157",
                              "templateHash": "12993275952067538651"
                            },
                            "name": "DocumentDB Database Account SQL Role Assignments.",
                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account.",
                            "owner": "Azure/module-maintainers"
                          },
                          "parameters": {
                            "databaseAccountName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
                              }
                            },
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. Name of the SQL Role Assignment."
                              }
                            },
                            "principalId": {
                              "type": "string",
                              "defaultValue": "",
                              "metadata": {
                                "description": "Optional. Id needs to be granted."
                              }
                            },
                            "roleDefinitionId": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. Id of the SQL Role Definition."
                              }
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
                              "apiVersion": "2023-04-15",
                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
                              "properties": {
                                "principalId": "[parameters('principalId')]",
                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
                                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
                              }
                            }
                          ],
                          "outputs": {
                            "resourceGroupName": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the resource group the SQL Role Assignment was created in."
                              },
                              "value": "[resourceGroup().name]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Resources/deployments', format('sql-role-definition-{0}', uniqueString(parameters('name'))))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "resourceGroupName": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the resource group the SQL Role Definition and Assignment were created in."
                      },
                      "value": "[resourceGroup().name]"
                    }
                  }
                }
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_mongodbDatabases": {
              "copy": {
                "name": "databaseAccount_mongodbDatabases",
                "count": "[length(parameters('mongodbDatabases'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), parameters('mongodbDatabases')[copyIndex()].name)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "databaseAccountName": {
                    "value": "[parameters('name')]"
                  },
                  "name": {
                    "value": "[parameters('mongodbDatabases')[copyIndex()].name]"
                  },
                  "tags": {
                    "value": "[coalesce(tryGet(parameters('mongodbDatabases')[copyIndex()], 'tags'), parameters('tags'))]"
                  },
                  "collections": {
                    "value": "[tryGet(parameters('mongodbDatabases')[copyIndex()], 'collections')]"
                  },
                  "throughput": {
                    "value": "[tryGet(parameters('mongodbDatabases')[copyIndex()], 'throughput')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "languageVersion": "2.0",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.31.92.45157",
                      "templateHash": "18295016247574474595"
                    },
                    "name": "DocumentDB Database Account MongoDB Databases",
                    "description": "This module deploys a MongoDB Database within a CosmosDB Account.",
                    "owner": "Azure/module-maintainers"
                  },
                  "parameters": {
                    "databaseAccountName": {
                      "type": "string",
                      "metadata": {
                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
                      }
                    },
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. Name of the mongodb database."
                      }
                    },
                    "throughput": {
                      "type": "int",
                      "defaultValue": 400,
                      "metadata": {
                        "description": "Optional. Request Units per second."
                      }
                    },
                    "collections": {
                      "type": "array",
                      "defaultValue": [],
                      "metadata": {
                        "description": "Optional. Collections in the mongodb database."
                      }
                    },
                    "tags": {
                      "type": "object",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Tags of the resource."
                      }
                    }
                  },
                  "resources": {
                    "databaseAccount": {
                      "existing": true,
                      "type": "Microsoft.DocumentDB/databaseAccounts",
                      "apiVersion": "2023-04-15",
                      "name": "[parameters('databaseAccountName')]"
                    },
                    "mongodbDatabase": {
                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
                      "apiVersion": "2023-04-15",
                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
                      "tags": "[parameters('tags')]",
                      "properties": {
                        "resource": {
                          "id": "[parameters('name')]"
                        },
                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]"
                      },
                      "dependsOn": [
                        "databaseAccount"
                      ]
                    },
                    "mongodbDatabase_collections": {
                      "copy": {
                        "name": "mongodbDatabase_collections",
                        "count": "[length(parameters('collections'))]"
                      },
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), parameters('collections')[copyIndex()].name)]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "databaseAccountName": {
                            "value": "[parameters('databaseAccountName')]"
                          },
                          "mongodbDatabaseName": {
                            "value": "[parameters('name')]"
                          },
                          "name": {
                            "value": "[parameters('collections')[copyIndex()].name]"
                          },
                          "indexes": {
                            "value": "[parameters('collections')[copyIndex()].indexes]"
                          },
                          "shardKey": {
                            "value": "[parameters('collections')[copyIndex()].shardKey]"
                          },
                          "throughput": {
                            "value": "[tryGet(parameters('collections')[copyIndex()], 'throughput')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.31.92.45157",
                              "templateHash": "9799909568020880663"
                            },
                            "name": "DocumentDB Database Account MongoDB Database Collections",
                            "description": "This module deploys a MongoDB Database Collection.",
                            "owner": "Azure/module-maintainers"
                          },
                          "parameters": {
                            "databaseAccountName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
                              }
                            },
                            "mongodbDatabaseName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
                              }
                            },
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. Name of the collection."
                              }
                            },
                            "throughput": {
                              "type": "int",
                              "defaultValue": 400,
                              "metadata": {
                                "description": "Optional. Request Units per second."
                              }
                            },
                            "indexes": {
                              "type": "array",
                              "metadata": {
                                "description": "Required. Indexes for the collection."
                              }
                            },
                            "shardKey": {
                              "type": "object",
                              "metadata": {
                                "description": "Required. ShardKey for the collection."
                              }
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
                              "apiVersion": "2023-04-15",
                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
                              "properties": {
                                "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2023-04-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
                                "resource": {
                                  "id": "[parameters('name')]",
                                  "indexes": "[parameters('indexes')]",
                                  "shardKey": "[parameters('shardKey')]"
                                }
                              }
                            }
                          ],
                          "outputs": {
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the mongodb database collection."
                              },
                              "value": "[parameters('name')]"
                            },
                            "resourceId": {
                              "type": "string",
                              "metadata": {
                                "description": "The resource ID of the mongodb database collection."
                              },
                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
                            },
                            "resourceGroupName": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the resource group the mongodb database collection was created in."
                              },
                              "value": "[resourceGroup().name]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "mongodbDatabase"
                      ]
                    }
                  },
                  "outputs": {
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the mongodb database."
                      },
                      "value": "[parameters('name')]"
                    },
                    "resourceId": {
                      "type": "string",
                      "metadata": {
                        "description": "The resource ID of the mongodb database."
                      },
                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
                    },
                    "resourceGroupName": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the resource group the mongodb database was created in."
                      },
                      "value": "[resourceGroup().name]"
                    }
                  }
                }
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_gremlinDatabases": {
              "copy": {
                "name": "databaseAccount_gremlinDatabases",
                "count": "[length(parameters('gremlinDatabases'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), parameters('gremlinDatabases')[copyIndex()].name)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "databaseAccountName": {
                    "value": "[parameters('name')]"
                  },
                  "name": {
                    "value": "[parameters('gremlinDatabases')[copyIndex()].name]"
                  },
                  "tags": {
                    "value": "[coalesce(tryGet(parameters('gremlinDatabases')[copyIndex()], 'tags'), parameters('tags'))]"
                  },
                  "graphs": {
                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'graphs')]"
                  },
                  "maxThroughput": {
                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'maxThroughput')]"
                  },
                  "throughput": {
                    "value": "[tryGet(parameters('gremlinDatabases')[copyIndex()], 'throughput')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "languageVersion": "2.0",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.31.92.45157",
                      "templateHash": "6528096364275148764"
                    },
                    "name": "DocumentDB Database Account Gremlin Databases",
                    "description": "This module deploys a Gremlin Database within a CosmosDB Account.",
                    "owner": "Azure/module-maintainers"
                  },
                  "parameters": {
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. Name of the Gremlin database."
                      }
                    },
                    "tags": {
                      "type": "object",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Tags of the Gremlin database resource."
                      }
                    },
                    "databaseAccountName": {
                      "type": "string",
                      "metadata": {
                        "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
                      }
                    },
                    "graphs": {
                      "type": "array",
                      "defaultValue": [],
                      "metadata": {
                        "description": "Optional. Array of graphs to deploy in the Gremlin database."
                      }
                    },
                    "maxThroughput": {
                      "type": "int",
                      "defaultValue": 4000,
                      "metadata": {
                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
                      }
                    },
                    "throughput": {
                      "type": "int",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
                      }
                    }
                  },
                  "resources": {
                    "databaseAccount": {
                      "existing": true,
                      "type": "Microsoft.DocumentDB/databaseAccounts",
                      "apiVersion": "2023-04-15",
                      "name": "[parameters('databaseAccountName')]"
                    },
                    "gremlinDatabase": {
                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
                      "apiVersion": "2023-04-15",
                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
                      "tags": "[parameters('tags')]",
                      "properties": {
                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
                        "resource": {
                          "id": "[parameters('name')]"
                        }
                      },
                      "dependsOn": [
                        "databaseAccount"
                      ]
                    },
                    "gremlinDatabase_gremlinGraphs": {
                      "copy": {
                        "name": "gremlinDatabase_gremlinGraphs",
                        "count": "[length(parameters('graphs'))]"
                      },
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "name": {
                            "value": "[parameters('graphs')[copyIndex()].name]"
                          },
                          "gremlinDatabaseName": {
                            "value": "[parameters('name')]"
                          },
                          "databaseAccountName": {
                            "value": "[parameters('databaseAccountName')]"
                          },
                          "indexingPolicy": {
                            "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]"
                          },
                          "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]"
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "languageVersion": "2.0",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.31.92.45157",
                              "templateHash": "16994331830326213766"
                            },
                            "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
                            "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph.",
                            "owner": "Azure/module-maintainers"
                          },
                          "parameters": {
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "Required. Name of the graph."
                              }
                            },
                            "tags": {
                              "type": "object",
                              "nullable": true,
                              "metadata": {
                                "description": "Optional. Tags of the Gremlin graph resource."
                              }
                            },
                            "databaseAccountName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
                              }
                            },
                            "gremlinDatabaseName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
                              }
                            },
                            "indexingPolicy": {
                              "type": "object",
                              "defaultValue": {},
                              "metadata": {
                                "description": "Optional. Indexing policy of the graph."
                              }
                            },
                            "partitionKeyPaths": {
                              "type": "array",
                              "defaultValue": [],
                              "metadata": {
                                "description": "Optional. List of paths using which data within the container can be partitioned."
                              }
                            }
                          },
                          "resources": {
                            "databaseAccount::gremlinDatabase": {
                              "existing": true,
                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
                              "apiVersion": "2023-04-15",
                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]",
                              "dependsOn": [
                                "databaseAccount"
                              ]
                            },
                            "databaseAccount": {
                              "existing": true,
                              "type": "Microsoft.DocumentDB/databaseAccounts",
                              "apiVersion": "2023-04-15",
                              "name": "[parameters('databaseAccountName')]"
                            },
                            "gremlinGraph": {
                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
                              "apiVersion": "2023-04-15",
                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
                              "tags": "[parameters('tags')]",
                              "properties": {
                                "resource": {
                                  "id": "[parameters('name')]",
                                  "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]",
                                  "partitionKey": {
                                    "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]"
                                  }
                                }
                              },
                              "dependsOn": [
                                "databaseAccount::gremlinDatabase"
                              ]
                            }
                          },
                          "outputs": {
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the graph."
                              },
                              "value": "[parameters('name')]"
                            },
                            "resourceId": {
                              "type": "string",
                              "metadata": {
                                "description": "The resource ID of the graph."
                              },
                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
                            },
                            "resourceGroupName": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the resource group the graph was created in."
                              },
                              "value": "[resourceGroup().name]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "gremlinDatabase"
                      ]
                    }
                  },
                  "outputs": {
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the Gremlin database."
                      },
                      "value": "[parameters('name')]"
                    },
                    "resourceId": {
                      "type": "string",
                      "metadata": {
                        "description": "The resource ID of the Gremlin database."
                      },
                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
                    },
                    "resourceGroupName": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the resource group the Gremlin database was created in."
                      },
                      "value": "[resourceGroup().name]"
                    }
                  }
                }
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_tables": {
              "copy": {
                "name": "databaseAccount_tables",
                "count": "[length(parameters('tables'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), parameters('tables')[copyIndex()].name)]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "databaseAccountName": {
                    "value": "[parameters('name')]"
                  },
                  "name": {
                    "value": "[parameters('tables')[copyIndex()].name]"
                  },
                  "tags": {
                    "value": "[coalesce(tryGet(parameters('tables')[copyIndex()], 'tags'), parameters('tags'))]"
                  },
                  "maxThroughput": {
                    "value": "[tryGet(parameters('tables')[copyIndex()], 'maxThroughput')]"
                  },
                  "throughput": {
                    "value": "[tryGet(parameters('tables')[copyIndex()], 'throughput')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "languageVersion": "2.0",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.31.92.45157",
                      "templateHash": "6722170581524078621"
                    },
                    "name": "Azure Cosmos DB account tables",
                    "description": "This module deploys a table within an Azure Cosmos DB Account.",
                    "owner": "Azure/module-maintainers"
                  },
                  "parameters": {
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. Name of the table."
                      }
                    },
                    "tags": {
                      "type": "object",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Tags for the table."
                      }
                    },
                    "databaseAccountName": {
                      "type": "string",
                      "metadata": {
                        "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
                      }
                    },
                    "maxThroughput": {
                      "type": "int",
                      "defaultValue": 4000,
                      "metadata": {
                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
                      }
                    },
                    "throughput": {
                      "type": "int",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
                      }
                    }
                  },
                  "resources": {
                    "databaseAccount": {
                      "existing": true,
                      "type": "Microsoft.DocumentDB/databaseAccounts",
                      "apiVersion": "2023-04-15",
                      "name": "[parameters('databaseAccountName')]"
                    },
                    "table": {
                      "type": "Microsoft.DocumentDB/databaseAccounts/tables",
                      "apiVersion": "2023-04-15",
                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
                      "tags": "[parameters('tags')]",
                      "properties": {
                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
                        "resource": {
                          "id": "[parameters('name')]"
                        }
                      },
                      "dependsOn": [
                        "databaseAccount"
                      ]
                    }
                  },
                  "outputs": {
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the table."
                      },
                      "value": "[parameters('name')]"
                    },
                    "resourceId": {
                      "type": "string",
                      "metadata": {
                        "description": "The resource ID of the table."
                      },
                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
                    },
                    "resourceGroupName": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the resource group the table was created in."
                      },
                      "value": "[resourceGroup().name]"
                    }
                  }
                }
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "databaseAccount_privateEndpoints": {
              "copy": {
                "name": "databaseAccount_privateEndpoints",
                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('{0}-databaseAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
              "resourceGroup": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupName'), '')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "name": {
                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
                  },
                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
                  "subnetResourceId": {
                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
                  },
                  "enableTelemetry": {
                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'enableTelemetry'), parameters('enableTelemetry'))]"
                  },
                  "location": {
                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
                  },
                  "lock": {
                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
                  },
                  "privateDnsZoneGroup": {
                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
                  },
                  "roleAssignments": {
                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
                  },
                  "tags": {
                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
                  },
                  "customDnsConfigs": {
                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
                  },
                  "ipConfigurations": {
                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
                  },
                  "applicationSecurityGroupResourceIds": {
                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
                  },
                  "customNetworkInterfaceName": {
                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "languageVersion": "2.0",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.29.47.4906",
                      "templateHash": "1277254088602407590"
                    },
                    "name": "Private Endpoints",
                    "description": "This module deploys a Private Endpoint.",
                    "owner": "Azure/module-maintainers"
                  },
                  "definitions": {
                    "privateDnsZoneGroupType": {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. The name of the Private DNS Zone Group."
                          }
                        },
                        "privateDnsZoneGroupConfigs": {
                          "type": "array",
                          "items": {
                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
                          },
                          "metadata": {
                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
                          }
                        }
                      }
                    },
                    "roleAssignmentType": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string",
                            "nullable": true,
                            "metadata": {
                              "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
                            }
                          },
                          "roleDefinitionIdOrName": {
                            "type": "string",
                            "metadata": {
                              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                            }
                          },
                          "principalId": {
                            "type": "string",
                            "metadata": {
                              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                            }
                          },
                          "principalType": {
                            "type": "string",
                            "allowedValues": [
                              "Device",
                              "ForeignGroup",
                              "Group",
                              "ServicePrincipal",
                              "User"
                            ],
                            "nullable": true,
                            "metadata": {
                              "description": "Optional. The principal type of the assigned principal ID."
                            }
                          },
                          "description": {
                            "type": "string",
                            "nullable": true,
                            "metadata": {
                              "description": "Optional. The description of the role assignment."
                            }
                          },
                          "condition": {
                            "type": "string",
                            "nullable": true,
                            "metadata": {
                              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                            }
                          },
                          "conditionVersion": {
                            "type": "string",
                            "allowedValues": [
                              "2.0"
                            ],
                            "nullable": true,
                            "metadata": {
                              "description": "Optional. Version of the condition."
                            }
                          },
                          "delegatedManagedIdentityResourceId": {
                            "type": "string",
                            "nullable": true,
                            "metadata": {
                              "description": "Optional. The Resource Id of the delegated managed identity resource."
                            }
                          }
                        }
                      },
                      "nullable": true
                    },
                    "lockType": {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. Specify the name of lock."
                          }
                        },
                        "kind": {
                          "type": "string",
                          "allowedValues": [
                            "CanNotDelete",
                            "None",
                            "ReadOnly"
                          ],
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. Specify the type of lock."
                          }
                        }
                      },
                      "nullable": true
                    },
                    "ipConfigurationsType": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string",
                            "metadata": {
                              "description": "Required. The name of the resource that is unique within a resource group."
                            }
                          },
                          "properties": {
                            "type": "object",
                            "properties": {
                              "groupId": {
                                "type": "string",
                                "metadata": {
                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                                }
                              },
                              "memberName": {
                                "type": "string",
                                "metadata": {
                                  "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
                                }
                              },
                              "privateIPAddress": {
                                "type": "string",
                                "metadata": {
                                  "description": "Required. A private IP address obtained from the private endpoint's subnet."
                                }
                              }
                            },
                            "metadata": {
                              "description": "Required. Properties of private endpoint IP configurations."
                            }
                          }
                        }
                      },
                      "nullable": true
                    },
                    "manualPrivateLinkServiceConnectionsType": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string",
                            "metadata": {
                              "description": "Required. The name of the private link service connection."
                            }
                          },
                          "properties": {
                            "type": "object",
                            "properties": {
                              "groupIds": {
                                "type": "array",
                                "items": {
                                  "type": "string"
                                },
                                "metadata": {
                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                                }
                              },
                              "privateLinkServiceId": {
                                "type": "string",
                                "metadata": {
                                  "description": "Required. The resource id of private link service."
                                }
                              },
                              "requestMessage": {
                                "type": "string",
                                "metadata": {
                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
                                }
                              }
                            },
                            "metadata": {
                              "description": "Required. Properties of private link service connection."
                            }
                          }
                        }
                      },
                      "nullable": true
                    },
                    "privateLinkServiceConnectionsType": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string",
                            "metadata": {
                              "description": "Required. The name of the private link service connection."
                            }
                          },
                          "properties": {
                            "type": "object",
                            "properties": {
                              "groupIds": {
                                "type": "array",
                                "items": {
                                  "type": "string"
                                },
                                "metadata": {
                                  "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
                                }
                              },
                              "privateLinkServiceId": {
                                "type": "string",
                                "metadata": {
                                  "description": "Required. The resource id of private link service."
                                }
                              },
                              "requestMessage": {
                                "type": "string",
                                "nullable": true,
                                "metadata": {
                                  "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
                                }
                              }
                            },
                            "metadata": {
                              "description": "Required. Properties of private link service connection."
                            }
                          }
                        }
                      },
                      "nullable": true
                    },
                    "customDnsConfigType": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "fqdn": {
                            "type": "string",
                            "metadata": {
                              "description": "Required. Fqdn that resolves to private endpoint IP address."
                            }
                          },
                          "ipAddresses": {
                            "type": "array",
                            "items": {
                              "type": "string"
                            },
                            "metadata": {
                              "description": "Required. A list of private IP addresses of the private endpoint."
                            }
                          }
                        }
                      },
                      "nullable": true
                    },
                    "privateDnsZoneGroupConfigType": {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string",
                          "nullable": true,
                          "metadata": {
                            "description": "Optional. The name of the private DNS zone group config."
                          }
                        },
                        "privateDnsZoneResourceId": {
                          "type": "string",
                          "metadata": {
                            "description": "Required. The resource id of the private DNS zone."
                          }
                        }
                      },
                      "metadata": {
                        "__bicep_imported_from!": {
                          "sourceTemplate": "private-dns-zone-group/main.bicep"
                        }
                      }
                    }
                  },
                  "parameters": {
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. Name of the private endpoint resource to create."
                      }
                    },
                    "subnetResourceId": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
                      }
                    },
                    "applicationSecurityGroupResourceIds": {
                      "type": "array",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
                      }
                    },
                    "customNetworkInterfaceName": {
                      "type": "string",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
                      }
                    },
                    "ipConfigurations": {
                      "$ref": "#/definitions/ipConfigurationsType",
                      "metadata": {
                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
                      }
                    },
                    "privateDnsZoneGroup": {
                      "$ref": "#/definitions/privateDnsZoneGroupType",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
                      }
                    },
                    "location": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]",
                      "metadata": {
                        "description": "Optional. Location for all Resources."
                      }
                    },
                    "lock": {
                      "$ref": "#/definitions/lockType",
                      "metadata": {
                        "description": "Optional. The lock settings of the service."
                      }
                    },
                    "roleAssignments": {
                      "$ref": "#/definitions/roleAssignmentType",
                      "metadata": {
                        "description": "Optional. Array of role assignments to create."
                      }
                    },
                    "tags": {
                      "type": "object",
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
                      }
                    },
                    "customDnsConfigs": {
                      "$ref": "#/definitions/customDnsConfigType",
                      "metadata": {
                        "description": "Optional. Custom DNS configurations."
                      }
                    },
                    "manualPrivateLinkServiceConnections": {
                      "$ref": "#/definitions/manualPrivateLinkServiceConnectionsType",
                      "metadata": {
                        "description": "Optional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource."
                      }
                    },
                    "privateLinkServiceConnections": {
                      "$ref": "#/definitions/privateLinkServiceConnectionsType",
                      "metadata": {
                        "description": "Optional. A grouping of information about the connection to the remote resource."
                      }
                    },
                    "enableTelemetry": {
                      "type": "bool",
                      "defaultValue": true,
                      "metadata": {
                        "description": "Optional. Enable/Disable usage telemetry for module."
                      }
                    }
                  },
                  "variables": {
                    "copy": [
                      {
                        "name": "formattedRoleAssignments",
                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
                      }
                    ],
                    "builtInRoleNames": {
                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
                      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
                    }
                  },
                  "resources": {
                    "avmTelemetry": {
                      "condition": "[parameters('enableTelemetry')]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2024-03-01",
                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
                      "properties": {
                        "mode": "Incremental",
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "resources": [],
                          "outputs": {
                            "telemetry": {
                              "type": "String",
                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
                            }
                          }
                        }
                      }
                    },
                    "privateEndpoint": {
                      "type": "Microsoft.Network/privateEndpoints",
                      "apiVersion": "2023-11-01",
                      "name": "[parameters('name')]",
                      "location": "[parameters('location')]",
                      "tags": "[parameters('tags')]",
                      "properties": {
                        "copy": [
                          {
                            "name": "applicationSecurityGroups",
                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
                            "input": {
                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
                            }
                          }
                        ],
                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
                        "subnet": {
                          "id": "[parameters('subnetResourceId')]"
                        }
                      }
                    },
                    "privateEndpoint_lock": {
                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
                      "type": "Microsoft.Authorization/locks",
                      "apiVersion": "2020-05-01",
                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
                      "properties": {
                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
                      },
                      "dependsOn": [
                        "privateEndpoint"
                      ]
                    },
                    "privateEndpoint_roleAssignments": {
                      "copy": {
                        "name": "privateEndpoint_roleAssignments",
                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
                      },
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2022-04-01",
                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
                      "properties": {
                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
                      },
                      "dependsOn": [
                        "privateEndpoint"
                      ]
                    },
                    "privateEndpoint_privateDnsZoneGroup": {
                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "name": {
                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
                          },
                          "privateEndpointName": {
                            "value": "[parameters('name')]"
                          },
                          "privateDnsZoneConfigs": {
                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "languageVersion": "2.0",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.29.47.4906",
                              "templateHash": "5805178546717255803"
                            },
                            "name": "Private Endpoint Private DNS Zone Groups",
                            "description": "This module deploys a Private Endpoint Private DNS Zone Group.",
                            "owner": "Azure/module-maintainers"
                          },
                          "definitions": {
                            "privateDnsZoneGroupConfigType": {
                              "type": "object",
                              "properties": {
                                "name": {
                                  "type": "string",
                                  "nullable": true,
                                  "metadata": {
                                    "description": "Optional. The name of the private DNS zone group config."
                                  }
                                },
                                "privateDnsZoneResourceId": {
                                  "type": "string",
                                  "metadata": {
                                    "description": "Required. The resource id of the private DNS zone."
                                  }
                                }
                              },
                              "metadata": {
                                "__bicep_export!": true
                              }
                            }
                          },
                          "parameters": {
                            "privateEndpointName": {
                              "type": "string",
                              "metadata": {
                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                              }
                            },
                            "privateDnsZoneConfigs": {
                              "type": "array",
                              "items": {
                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
                              },
                              "minLength": 1,
                              "maxLength": 5,
                              "metadata": {
                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
                              }
                            },
                            "name": {
                              "type": "string",
                              "defaultValue": "default",
                              "metadata": {
                                "description": "Optional. The name of the private DNS zone group."
                              }
                            }
                          },
                          "variables": {
                            "copy": [
                              {
                                "name": "privateDnsZoneConfigsVar",
                                "count": "[length(parameters('privateDnsZoneConfigs'))]",
                                "input": {
                                  "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
                                  "properties": {
                                    "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
                                  }
                                }
                              }
                            ]
                          },
                          "resources": {
                            "privateEndpoint": {
                              "existing": true,
                              "type": "Microsoft.Network/privateEndpoints",
                              "apiVersion": "2023-11-01",
                              "name": "[parameters('privateEndpointName')]"
                            },
                            "privateDnsZoneGroup": {
                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                              "apiVersion": "2023-11-01",
                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
                              "properties": {
                                "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
                              },
                              "dependsOn": [
                                "privateEndpoint"
                              ]
                            }
                          },
                          "outputs": {
                            "name": {
                              "type": "string",
                              "metadata": {
                                "description": "The name of the private endpoint DNS zone group."
                              },
                              "value": "[parameters('name')]"
                            },
                            "resourceId": {
                              "type": "string",
                              "metadata": {
                                "description": "The resource ID of the private endpoint DNS zone group."
                              },
                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
                            },
                            "resourceGroupName": {
                              "type": "string",
                              "metadata": {
                                "description": "The resource group the private endpoint DNS zone group was deployed into."
                              },
                              "value": "[resourceGroup().name]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "privateEndpoint"
                      ]
                    }
                  },
                  "outputs": {
                    "resourceGroupName": {
                      "type": "string",
                      "metadata": {
                        "description": "The resource group the private endpoint was deployed into."
                      },
                      "value": "[resourceGroup().name]"
                    },
                    "resourceId": {
                      "type": "string",
                      "metadata": {
                        "description": "The resource ID of the private endpoint."
                      },
                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
                    },
                    "name": {
                      "type": "string",
                      "metadata": {
                        "description": "The name of the private endpoint."
                      },
                      "value": "[parameters('name')]"
                    },
                    "location": {
                      "type": "string",
                      "metadata": {
                        "description": "The location the resource was deployed into."
                      },
                      "value": "[reference('privateEndpoint', '2023-11-01', 'full').location]"
                    },
                    "customDnsConfig": {
                      "$ref": "#/definitions/customDnsConfigType",
                      "metadata": {
                        "description": "The custom DNS configurations of the private endpoint."
                      },
                      "value": "[reference('privateEndpoint').customDnsConfigs]"
                    },
                    "networkInterfaceIds": {
                      "type": "array",
                      "metadata": {
                        "description": "The IDs of the network interfaces associated with the private endpoint."
                      },
                      "value": "[reference('privateEndpoint').networkInterfaces]"
                    },
                    "groupId": {
                      "type": "string",
                      "metadata": {
                        "description": "The group Id for the private endpoint Group."
                      },
                      "value": "[if(and(not(empty(reference('privateEndpoint').manualPrivateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').manualPrivateLinkServiceConnections[0].properties, 'groupIds', 0), ''), if(and(not(empty(reference('privateEndpoint').privateLinkServiceConnections)), greater(length(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds')), 0)), coalesce(tryGet(reference('privateEndpoint').privateLinkServiceConnections[0].properties, 'groupIds', 0), ''), ''))]"
                    }
                  }
                }
              },
              "dependsOn": [
                "databaseAccount"
              ]
            },
            "secretsExport": {
              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
              "subscriptionId": "[split(coalesce(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '//'), '/')[2]]",
              "resourceGroup": "[split(coalesce(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '////'), '/')[4]]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "keyVaultName": {
                    "value": "[last(split(coalesce(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '//'), '/'))]"
                  },
                  "secretsToSet": {
                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryWriteKeySecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').primaryWriteKeySecretName, 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').primaryMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryReadOnlyKeySecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').primaryReadOnlyKeySecretName, 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').primaryReadonlyMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryWriteConnectionStringSecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').primaryWriteConnectionStringSecretName, 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').connectionStrings[0].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'primaryReadonlyConnectionStringSecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').primaryReadonlyConnectionStringSecretName, 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').connectionStrings[2].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryWriteKeySecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').secondaryWriteKeySecretName, 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').secondaryMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryReadonlyKeySecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').secondaryReadonlyKeySecretName, 'value', listKeys(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').secondaryReadonlyMasterKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryWriteConnectionStringSecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').secondaryWriteConnectionStringSecretName, 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').connectionStrings[1].connectionString)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryReadonlyConnectionStringSecretName'), createArray(createObject('name', parameters('secretsExportConfiguration').secondaryReadonlyConnectionStringSecretName, 'value', listConnectionStrings(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2023-04-15').connectionStrings[3].connectionString)), createArray()))]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "languageVersion": "2.0",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.31.92.45157",
                      "templateHash": "7954388693868310378"
                    }
                  },
                  "definitions": {
                    "secretSetType": {
                      "type": "object",
                      "properties": {
                        "secretResourceId": {
                          "type": "string",
                          "metadata": {
                            "description": "The resourceId of the exported secret."
                          }
                        },
                        "secretUri": {
                          "type": "string",
                          "metadata": {
                            "description": "The secret URI of the exported secret."
                          }
                        }
                      },
                      "metadata": {
                        "__bicep_export!": true
                      }
                    },
                    "secretToSetType": {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string",
                          "metadata": {
                            "description": "Required. The name of the secret to set."
                          }
                        },
                        "value": {
                          "type": "securestring",
                          "metadata": {
                            "description": "Required. The value of the secret to set."
                          }
                        }
                      }
                    }
                  },
                  "parameters": {
                    "keyVaultName": {
                      "type": "string",
                      "metadata": {
                        "description": "Required. The name of the Key Vault to set the ecrets in."
                      }
                    },
                    "secretsToSet": {
                      "type": "array",
                      "items": {
                        "$ref": "#/definitions/secretToSetType"
                      },
                      "metadata": {
                        "description": "Required. The secrets to set in the Key Vault."
                      }
                    }
                  },
                  "resources": {
                    "keyVault": {
                      "existing": true,
                      "type": "Microsoft.KeyVault/vaults",
                      "apiVersion": "2022-07-01",
                      "name": "[parameters('keyVaultName')]"
                    },
                    "secrets": {
                      "copy": {
                        "name": "secrets",
                        "count": "[length(parameters('secretsToSet'))]"
                      },
                      "type": "Microsoft.KeyVault/vaults/secrets",
                      "apiVersion": "2023-07-01",
                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
                      "properties": {
                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
                      },
                      "dependsOn": [
                        "keyVault"
                      ]
                    }
                  },
                  "outputs": {
                    "secretsSet": {
                      "type": "array",
                      "items": {
                        "$ref": "#/definitions/secretSetType"
                      },
                      "metadata": {
                        "description": "The references to the secrets exported to the provided Key Vault."
                      },
                      "copy": {
                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
                        "input": {
                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
                        }
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "databaseAccount"
              ]
            }
          },
          "outputs": {
            "exportedSecrets": {
              "$ref": "#/definitions/secretsOutputType",
              "metadata": {
                "description": "The references to the secrets exported to the provided Key Vault."
              },
              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
            },
            "name": {
              "type": "string",
              "metadata": {
                "description": "The name of the database account."
              },
              "value": "[parameters('name')]"
            },
            "resourceId": {
              "type": "string",
              "metadata": {
                "description": "The resource ID of the database account."
              },
              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
            },
            "resourceGroupName": {
              "type": "string",
              "metadata": {
                "description": "The name of the resource group the database account was created in."
              },
              "value": "[resourceGroup().name]"
            },
            "systemAssignedMIPrincipalId": {
              "type": "string",
              "metadata": {
                "description": "The principal ID of the system assigned identity."
              },
              "value": "[coalesce(tryGet(tryGet(reference('databaseAccount', '2023-04-15', 'full'), 'identity'), 'principalId'), '')]"
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "The location the resource was deployed into."
              },
              "value": "[reference('databaseAccount', '2023-04-15', 'full').location]"
            },
            "endpoint": {
              "type": "string",
              "metadata": {
                "description": "The endpoint of the database account."
              },
              "value": "[reference('databaseAccount').documentEndpoint]"
            },
            "privateEndpoints": {
              "type": "array",
              "metadata": {
                "description": "The private endpoints of the database account."
              },
              "copy": {
                "count": "[length(if(not(empty(parameters('privateEndpoints'))), array(parameters('privateEndpoints')), createArray()))]",
                "input": {
                  "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
                  "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
                  "groupId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.groupId.value]",
                  "customDnsConfig": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfig.value]",
                  "networkInterfaceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceIds.value]"
                }
              }
            }
          }
        }
      },
      "dependsOn": [
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[toLower(format('{0}containerAppFrontend', variables('prefixCleaned')))]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "managedIdentities": {
            "value": {
              "systemAssigned": true,
              "userAssignedResourceIds": [
                "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityOutput.value.resourceId]"
              ]
            }
          },
          "containers": {
            "value": [
              {
                "env": [
                  {
                    "name": "API_URL",
                    "value": "[format('https://{0}', reference(resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned')))), '2023-05-01').configuration.ingress.fqdn)]"
                  }
                ],
                "image": "[format('cmsacontainerreg.azurecr.io/cmsafrontend:{0}', variables('frontEndVersion'))]",
                "name": "cmsafrontend",
                "resources": {
                  "cpu": "1",
                  "memory": "2.0Gi"
                }
              }
            ]
          },
          "ingressTargetPort": {
            "value": 3000
          },
          "ingressExternal": {
            "value": true
          },
          "scaleMinReplicas": {
            "value": 1
          },
          "scaleMaxReplicas": {
            "value": 1
          },
          "environmentResourceId": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', toLower(format('{0}conAppsEnv', variables('prefixCleaned')))), '2022-09-01').outputs.resourceId.value]"
          },
          "name": {
            "value": "[toLower(format('{0}containerFrontend', variables('prefixCleaned')))]"
          },
          "location": {
            "value": "[variables('location')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.33.93.31351",
              "templateHash": "1964938100334091991"
            },
            "name": "Container Apps",
            "description": "This module deploys a Container App."
          },
          "definitions": {
            "containerType": {
              "type": "object",
              "properties": {
                "args": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Container start command arguments."
                  }
                },
                "command": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Container start command."
                  }
                },
                "env": {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/environmentVarType"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Container environment variables."
                  }
                },
                "image": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. Container image tag."
                  }
                },
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Custom container name."
                  }
                },
                "probes": {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/containerAppProbeType"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. List of probes for the container."
                  }
                },
                "resources": {
                  "type": "object",
                  "metadata": {
                    "description": "Required. Container resource requirements."
                  }
                },
                "volumeMounts": {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/volumeMountType"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Container volume mounts."
                  }
                }
              },
              "metadata": {
                "__bicep_export!": true,
                "description": "The type for a container."
              }
            },
            "ingressPortMappingType": {
              "type": "object",
              "properties": {
                "exposedPort": {
                  "type": "int",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
                  }
                },
                "external": {
                  "type": "bool",
                  "metadata": {
                    "description": "Required. Specifies whether the app port is accessible outside of the environment."
                  }
                },
                "targetPort": {
                  "type": "int",
                  "metadata": {
                    "description": "Required. Specifies the port the container listens on."
                  }
                }
              },
              "metadata": {
                "__bicep_export!": true,
                "description": "The type for an ingress port mapping."
              }
            },
            "serviceBindingType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The name of the service."
                  }
                },
                "serviceId": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The service ID."
                  }
                }
              },
              "metadata": {
                "description": "The type for a service binding."
              }
            },
            "environmentVarType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. Environment variable name."
                  }
                },
                "secretRef": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
                  }
                },
                "value": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Non-secret environment variable value."
                  }
                }
              },
              "metadata": {
                "__bicep_export!": true,
                "description": "The type for an environment variable."
              }
            },
            "containerAppProbeType": {
              "type": "object",
              "properties": {
                "failureThreshold": {
                  "type": "int",
                  "nullable": true,
                  "minValue": 1,
                  "maxValue": 10,
                  "metadata": {
                    "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
                  }
                },
                "httpGet": {
                  "$ref": "#/definitions/containerAppProbeHttpGetType",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. HTTPGet specifies the http request to perform."
                  }
                },
                "initialDelaySeconds": {
                  "type": "int",
                  "nullable": true,
                  "minValue": 1,
                  "maxValue": 60,
                  "metadata": {
                    "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
                  }
                },
                "periodSeconds": {
                  "type": "int",
                  "nullable": true,
                  "minValue": 1,
                  "maxValue": 240,
                  "metadata": {
                    "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
                  }
                },
                "successThreshold": {
                  "type": "int",
                  "nullable": true,
                  "minValue": 1,
                  "maxValue": 10,
                  "metadata": {
                    "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
                  }
                },
                "tcpSocket": {
                  "$ref": "#/definitions/containerAppProbeTcpSocketType",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
                  }
                },
                "terminationGracePeriodSeconds": {
                  "type": "int",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
                  }
                },
                "timeoutSeconds": {
                  "type": "int",
                  "nullable": true,
                  "minValue": 1,
                  "maxValue": 240,
                  "metadata": {
                    "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
                  }
                },
                "type": {
                  "type": "string",
                  "allowedValues": [
                    "Liveness",
                    "Readiness",
                    "Startup"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The type of probe."
                  }
                }
              },
              "metadata": {
                "description": "The type for a container app probe."
              }
            },
            "corsPolicyType": {
              "type": "object",
              "properties": {
                "allowCredentials": {
                  "type": "bool",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Switch to determine whether the resource allows credentials."
                  }
                },
                "allowedHeaders": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specifies the content for the access-control-allow-headers header."
                  }
                },
                "allowedMethods": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specifies the content for the access-control-allow-methods header."
                  }
                },
                "allowedOrigins": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specifies the content for the access-control-allow-origins header."
                  }
                },
                "exposeHeaders": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specifies the content for the access-control-expose-headers header."
                  }
                },
                "maxAge": {
                  "type": "int",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specifies the content for the access-control-max-age header."
                  }
                }
              },
              "metadata": {
                "__bicep_export!": true,
                "description": "The type for a CORS policy."
              }
            },
            "containerAppProbeHttpGetType": {
              "type": "object",
              "properties": {
                "host": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Host name to connect to. Defaults to the pod IP."
                  }
                },
                "httpHeaders": {
                  "type": "array",
                  "items": {
                    "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. HTTP headers to set in the request."
                  }
                },
                "path": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. Path to access on the HTTP server."
                  }
                },
                "port": {
                  "type": "int",
                  "metadata": {
                    "description": "Required. Name or number of the port to access on the container."
                  }
                },
                "scheme": {
                  "type": "string",
                  "allowedValues": [
                    "HTTP",
                    "HTTPS"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
                  }
                }
              },
              "metadata": {
                "description": "The type for a container app probe HTTP GET."
              }
            },
            "containerAppProbeHttpGetHeadersItemType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. Name of the header."
                  }
                },
                "value": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. Value of the header."
                  }
                }
              },
              "metadata": {
                "description": "The type for a container app probe HTTP GET header."
              }
            },
            "containerAppProbeTcpSocketType": {
              "type": "object",
              "properties": {
                "host": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Host name to connect to, defaults to the pod IP."
                  }
                },
                "port": {
                  "type": "int",
                  "minValue": 1,
                  "maxValue": 65535,
                  "metadata": {
                    "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
                  }
                }
              },
              "metadata": {
                "description": "The type for a container app probe TCP socket."
              }
            },
            "volumeMountType": {
              "type": "object",
              "properties": {
                "mountPath": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
                  }
                },
                "subPath": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
                  }
                },
                "volumeName": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. This must match the Name of a Volume."
                  }
                }
              },
              "metadata": {
                "description": "The type for a volume mount."
              }
            },
            "runtimeType": {
              "type": "object",
              "properties": {
                "dotnet": {
                  "type": "object",
                  "properties": {
                    "autoConfigureDataProtection": {
                      "type": "bool",
                      "metadata": {
                        "description": "Required. Enable to auto configure the ASP.NET Core Data Protection feature."
                      }
                    }
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Runtime configuration for ASP.NET Core."
                  }
                },
                "java": {
                  "type": "object",
                  "properties": {
                    "enableMetrics": {
                      "type": "bool",
                      "metadata": {
                        "description": "Required. Enable JMX core metrics for the Java app."
                      }
                    },
                    "enableJavaAgent": {
                      "type": "bool",
                      "metadata": {
                        "description": "Required. Enable Java agent injection for the Java app."
                      }
                    },
                    "loggerSettings": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "logger": {
                            "type": "string",
                            "metadata": {
                              "description": "Required. Name of the logger."
                            }
                          },
                          "level": {
                            "type": "string",
                            "allowedValues": [
                              "debug",
                              "error",
                              "info",
                              "off",
                              "trace",
                              "warn"
                            ],
                            "metadata": {
                              "description": "Required. Java agent logging level."
                            }
                          }
                        }
                      },
                      "nullable": true,
                      "metadata": {
                        "description": "Optional. Java agent logging configuration."
                      }
                    }
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Runtime configuration for Java."
                  }
                }
              },
              "nullable": true,
              "metadata": {
                "__bicep_export!": true,
                "description": "Optional. App runtime configuration for the Container App."
              }
            },
            "secretType": {
              "type": "object",
              "properties": {
                "identity": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
                  }
                },
                "keyVaultUrl": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Conditional. Azure Key Vault URL pointing to the secret referenced by the Container App Job. Required if `value` is null."
                  }
                },
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The name of the secret."
                  }
                },
                "value": {
                  "type": "securestring",
                  "nullable": true,
                  "metadata": {
                    "description": "Conditional. The secret value, if not fetched from Key Vault. Required if `keyVaultUrl` is not null."
                  }
                }
              },
              "metadata": {
                "__bicep_export!": true,
                "description": "The type for a secret."
              }
            },
            "lockType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the name of lock."
                  }
                },
                "kind": {
                  "type": "string",
                  "allowedValues": [
                    "CanNotDelete",
                    "None",
                    "ReadOnly"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the type of lock."
                  }
                }
              },
              "metadata": {
                "description": "An AVM-aligned type for a lock.",
                "__bicep_imported_from!": {
                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
                }
              }
            },
            "managedIdentityAllType": {
              "type": "object",
              "properties": {
                "systemAssigned": {
                  "type": "bool",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Enables system assigned managed identity on the resource."
                  }
                },
                "userAssignedResourceIds": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
                  }
                }
              },
              "metadata": {
                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
                "__bicep_imported_from!": {
                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
                }
              }
            },
            "roleAssignmentType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
                  }
                },
                "roleDefinitionIdOrName": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                  }
                },
                "principalId": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                  }
                },
                "principalType": {
                  "type": "string",
                  "allowedValues": [
                    "Device",
                    "ForeignGroup",
                    "Group",
                    "ServicePrincipal",
                    "User"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The principal type of the assigned principal ID."
                  }
                },
                "description": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The description of the role assignment."
                  }
                },
                "condition": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                  }
                },
                "conditionVersion": {
                  "type": "string",
                  "allowedValues": [
                    "2.0"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Version of the condition."
                  }
                },
                "delegatedManagedIdentityResourceId": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The Resource Id of the delegated managed identity resource."
                  }
                }
              },
              "metadata": {
                "description": "An AVM-aligned type for a role assignment.",
                "__bicep_imported_from!": {
                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
                }
              }
            }
          },
          "parameters": {
            "name": {
              "type": "string",
              "metadata": {
                "description": "Required. Name of the Container App."
              }
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "Optional. Location for all Resources."
              }
            },
            "disableIngress": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Optional. Bool to disable all ingress traffic for the container app."
              }
            },
            "ingressExternal": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
              }
            },
            "clientCertificateMode": {
              "type": "string",
              "defaultValue": "ignore",
              "allowedValues": [
                "accept",
                "ignore",
                "require"
              ],
              "metadata": {
                "description": "Optional. Client certificate mode for mTLS."
              }
            },
            "corsPolicy": {
              "$ref": "#/definitions/corsPolicyType",
              "nullable": true,
              "metadata": {
                "description": "Optional. Object userd to configure CORS policy."
              }
            },
            "stickySessionsAffinity": {
              "type": "string",
              "defaultValue": "none",
              "allowedValues": [
                "none",
                "sticky"
              ],
              "metadata": {
                "description": "Optional. Bool indicating if the Container App should enable session affinity."
              }
            },
            "ingressTransport": {
              "type": "string",
              "defaultValue": "auto",
              "allowedValues": [
                "auto",
                "http",
                "http2",
                "tcp"
              ],
              "metadata": {
                "description": "Optional. Ingress transport protocol."
              }
            },
            "service": {
              "type": "object",
              "defaultValue": {},
              "metadata": {
                "description": "Optional. Dev ContainerApp service type."
              }
            },
            "includeAddOns": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Optional. Toggle to include the service configuration."
              }
            },
            "additionalPortMappings": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/ingressPortMappingType"
              },
              "nullable": true,
              "metadata": {
                "description": "Optional. Settings to expose additional ports on container app."
              }
            },
            "ingressAllowInsecure": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
              }
            },
            "ingressTargetPort": {
              "type": "int",
              "defaultValue": 80,
              "metadata": {
                "description": "Optional. Target Port in containers for traffic from ingress."
              }
            },
            "scaleMaxReplicas": {
              "type": "int",
              "defaultValue": 10,
              "metadata": {
                "description": "Optional. Maximum number of container replicas. Defaults to 10 if not set."
              }
            },
            "scaleMinReplicas": {
              "type": "int",
              "defaultValue": 3,
              "metadata": {
                "description": "Optional. Minimum number of container replicas. Defaults to 3 if not set."
              }
            },
            "scaleRules": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. Scaling rules."
              }
            },
            "serviceBinds": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/serviceBindingType"
              },
              "nullable": true,
              "metadata": {
                "description": "Optional. List of container app services bound to the app."
              }
            },
            "activeRevisionsMode": {
              "type": "string",
              "defaultValue": "Single",
              "allowedValues": [
                "Multiple",
                "Single"
              ],
              "metadata": {
                "description": "Optional. Controls how active revisions are handled for the Container app."
              }
            },
            "environmentResourceId": {
              "type": "string",
              "metadata": {
                "description": "Required. Resource ID of environment."
              }
            },
            "lock": {
              "$ref": "#/definitions/lockType",
              "nullable": true,
              "metadata": {
                "description": "Optional. The lock settings of the service."
              }
            },
            "tags": {
              "type": "object",
              "nullable": true,
              "metadata": {
                "description": "Optional. Tags of the resource."
              }
            },
            "registries": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
              }
            },
            "managedIdentities": {
              "$ref": "#/definitions/managedIdentityAllType",
              "nullable": true,
              "metadata": {
                "description": "Optional. The managed identity definition for this resource."
              }
            },
            "roleAssignments": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/roleAssignmentType"
              },
              "nullable": true,
              "metadata": {
                "description": "Optional. Array of role assignments to create."
              }
            },
            "enableTelemetry": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Enable/Disable usage telemetry for module."
              }
            },
            "customDomains": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. Custom domain bindings for Container App hostnames."
              }
            },
            "exposedPort": {
              "type": "int",
              "defaultValue": 0,
              "metadata": {
                "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
              }
            },
            "ipSecurityRestrictions": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. Rules to restrict incoming IP address."
              }
            },
            "trafficLabel": {
              "type": "string",
              "defaultValue": "label-1",
              "metadata": {
                "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
              }
            },
            "trafficLatestRevision": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
              }
            },
            "trafficRevisionName": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. Name of a revision."
              }
            },
            "trafficWeight": {
              "type": "int",
              "defaultValue": 100,
              "metadata": {
                "description": "Optional. Traffic weight assigned to a revision."
              }
            },
            "dapr": {
              "type": "object",
              "defaultValue": {},
              "metadata": {
                "description": "Optional. Dapr configuration for the Container App."
              }
            },
            "maxInactiveRevisions": {
              "type": "int",
              "defaultValue": 0,
              "metadata": {
                "description": "Optional. Max inactive revisions a Container App can have."
              }
            },
            "runtime": {
              "$ref": "#/definitions/runtimeType",
              "metadata": {
                "description": "Optional. Runtime configuration for the Container App."
              }
            },
            "containers": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/containerType"
              },
              "metadata": {
                "description": "Required. List of container definitions for the Container App."
              }
            },
            "initContainersTemplate": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. List of specialized containers that run before app containers."
              }
            },
            "secrets": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/secretType"
              },
              "nullable": true,
              "metadata": {
                "description": "Optional. The secrets of the Container App."
              }
            },
            "revisionSuffix": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. User friendly suffix that is appended to the revision name."
              }
            },
            "volumes": {
              "type": "array",
              "defaultValue": [],
              "metadata": {
                "description": "Optional. List of volume definitions for the Container App."
              }
            },
            "workloadProfileName": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. Workload profile name to pin for container app execution."
              }
            }
          },
          "variables": {
            "copy": [
              {
                "name": "formattedRoleAssignments",
                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
              }
            ],
            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
            "builtInRoleNames": {
              "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
            }
          },
          "resources": {
            "avmTelemetry": {
              "condition": "[parameters('enableTelemetry')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2024-03-01",
              "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.13.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
              "properties": {
                "mode": "Incremental",
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "resources": [],
                  "outputs": {
                    "telemetry": {
                      "type": "String",
                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
                    }
                  }
                }
              }
            },
            "containerApp": {
              "type": "Microsoft.App/containerApps",
              "apiVersion": "2024-10-02-preview",
              "name": "[parameters('name')]",
              "tags": "[parameters('tags')]",
              "location": "[parameters('location')]",
              "identity": "[variables('identity')]",
              "properties": {
                "environmentId": "[parameters('environmentResourceId')]",
                "configuration": {
                  "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
                  "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
                  "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
                  "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
                  "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
                  "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
                  "secrets": "[parameters('secrets')]",
                  "runtime": {
                    "dotnet": "[if(not(empty(tryGet(parameters('runtime'), 'dotnet'))), createObject('autoConfigureDataProtection', tryGet(parameters('runtime'), 'dotnet', 'autoConfigureDataProtection')), null())]",
                    "java": "[if(not(empty(tryGet(parameters('runtime'), 'java'))), createObject('enableMetrics', tryGet(parameters('runtime'), 'java', 'enableMetrics'), 'javaAgent', createObject('enabled', tryGet(parameters('runtime'), 'java', 'enableJavaAgent'), 'logging', createObject('loggerSettings', tryGet(tryGet(parameters('runtime'), 'java'), 'loggerSettings')))), null())]"
                  }
                },
                "template": {
                  "containers": "[parameters('containers')]",
                  "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
                  "revisionSuffix": "[parameters('revisionSuffix')]",
                  "scale": {
                    "maxReplicas": "[parameters('scaleMaxReplicas')]",
                    "minReplicas": "[parameters('scaleMinReplicas')]",
                    "rules": "[if(not(empty(parameters('scaleRules'))), parameters('scaleRules'), null())]"
                  },
                  "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
                  "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
                },
                "workloadProfileName": "[parameters('workloadProfileName')]"
              }
            },
            "containerApp_lock": {
              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
              "type": "Microsoft.Authorization/locks",
              "apiVersion": "2020-05-01",
              "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
              "properties": {
                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
              },
              "dependsOn": [
                "containerApp"
              ]
            },
            "containerApp_roleAssignments": {
              "copy": {
                "name": "containerApp_roleAssignments",
                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
              },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
              "properties": {
                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
              },
              "dependsOn": [
                "containerApp"
              ]
            }
          },
          "outputs": {
            "resourceId": {
              "type": "string",
              "metadata": {
                "description": "The resource ID of the Container App."
              },
              "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
            },
            "fqdn": {
              "type": "string",
              "metadata": {
                "description": "The configuration of ingress fqdn."
              },
              "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
            },
            "resourceGroupName": {
              "type": "string",
              "metadata": {
                "description": "The name of the resource group the Container App was deployed into."
              },
              "value": "[resourceGroup().name]"
            },
            "name": {
              "type": "string",
              "metadata": {
                "description": "The name of the Container App."
              },
              "value": "[parameters('name')]"
            },
            "systemAssignedMIPrincipalId": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "The principal ID of the system assigned identity."
              },
              "value": "[tryGet(tryGet(reference('containerApp', '2024-10-02-preview', 'full'), 'identity'), 'principalId')]"
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "The location the resource was deployed into."
              },
              "value": "[reference('containerApp', '2024-10-02-preview', 'full').location]"
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned'))))]",
        "[resourceId('Microsoft.Resources/deployments', toLower(format('{0}conAppsEnv', variables('prefixCleaned'))))]",
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "deploymentScriptCLI",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "kind": {
            "value": "AzureCLI"
          },
          "name": {
            "value": "rdsmin001"
          },
          "azCliVersion": {
            "value": "2.69.0"
          },
          "location": {
            "value": "[resourceGroup().location]"
          },
          "managedIdentities": {
            "value": {
              "userAssignedResourceIds": [
                "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity'), '2022-09-01').outputs.managedIdentityId.value]"
              ]
            }
          },
          "scriptContent": {
            "value": "[format('az cosmosdb sql role assignment create --resource-group \"{0}\" --account-name \"{1}\" --role-definition-id \"{2}\" --scope \"{3}\" --principal-id \"{4}\"', resourceGroup().name, reference(resourceId('Microsoft.Resources/deployments', toLower(format('{0}database', variables('prefixCleaned')))), '2022-09-01').outputs.name.value, resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', split(format('{0}/00000000-0000-0000-0000-000000000002', toLower(format('{0}database', variables('prefixCleaned')))), '/')[0], split(format('{0}/00000000-0000-0000-0000-000000000002', toLower(format('{0}database', variables('prefixCleaned')))), '/')[1]), reference(resourceId('Microsoft.Resources/deployments', toLower(format('{0}database', variables('prefixCleaned')))), '2022-09-01').outputs.resourceId.value, reference(resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned')))), '2023-05-01', 'full').identity.principalId)]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.32.4.45862",
              "templateHash": "8965217851411422458"
            },
            "name": "Deployment Scripts",
            "description": "This module deploys Deployment Scripts.",
            "owner": "Azure/module-maintainers"
          },
          "definitions": {
            "environmentVariableType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The name of the environment variable."
                  }
                },
                "secureValue": {
                  "type": "securestring",
                  "nullable": true,
                  "metadata": {
                    "description": "Conditional. The value of the secure environment variable. Required if `value` is null."
                  }
                },
                "value": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Conditional. The value of the environment variable. Required if `secureValue` is null."
                  }
                }
              }
            },
            "lockType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the name of lock."
                  }
                },
                "kind": {
                  "type": "string",
                  "allowedValues": [
                    "CanNotDelete",
                    "None",
                    "ReadOnly"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Specify the type of lock."
                  }
                }
              },
              "metadata": {
                "description": "An AVM-aligned type for a lock.",
                "__bicep_imported_from!": {
                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
                }
              }
            },
            "managedIdentityOnlyUserAssignedType": {
              "type": "object",
              "properties": {
                "userAssignedResourceIds": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  },
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
                  }
                }
              },
              "metadata": {
                "description": "An AVM-aligned type for a managed identity configuration. To be used if only user-assigned identities are supported by the resource provider.",
                "__bicep_imported_from!": {
                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
                }
              }
            },
            "roleAssignmentType": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
                  }
                },
                "roleDefinitionIdOrName": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
                  }
                },
                "principalId": {
                  "type": "string",
                  "metadata": {
                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
                  }
                },
                "principalType": {
                  "type": "string",
                  "allowedValues": [
                    "Device",
                    "ForeignGroup",
                    "Group",
                    "ServicePrincipal",
                    "User"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The principal type of the assigned principal ID."
                  }
                },
                "description": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The description of the role assignment."
                  }
                },
                "condition": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
                  }
                },
                "conditionVersion": {
                  "type": "string",
                  "allowedValues": [
                    "2.0"
                  ],
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. Version of the condition."
                  }
                },
                "delegatedManagedIdentityResourceId": {
                  "type": "string",
                  "nullable": true,
                  "metadata": {
                    "description": "Optional. The Resource Id of the delegated managed identity resource."
                  }
                }
              },
              "metadata": {
                "description": "An AVM-aligned type for a role assignment.",
                "__bicep_imported_from!": {
                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
                }
              }
            }
          },
          "parameters": {
            "name": {
              "type": "string",
              "maxLength": 90,
              "metadata": {
                "description": "Required. Name of the Deployment Script."
              }
            },
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "Optional. Location for all resources."
              }
            },
            "kind": {
              "type": "string",
              "allowedValues": [
                "AzureCLI",
                "AzurePowerShell"
              ],
              "metadata": {
                "description": "Required. Specifies the Kind of the Deployment Script."
              }
            },
            "managedIdentities": {
              "$ref": "#/definitions/managedIdentityOnlyUserAssignedType",
              "nullable": true,
              "metadata": {
                "description": "Optional. The managed identity definition for this resource."
              }
            },
            "tags": {
              "type": "object",
              "nullable": true,
              "metadata": {
                "description": "Optional. Resource tags."
              }
            },
            "azPowerShellVersion": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "Optional. Azure PowerShell module version to be used. See a list of supported Azure PowerShell versions: https://mcr.microsoft.com/v2/azuredeploymentscripts-powershell/tags/list."
              }
            },
            "azCliVersion": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "Optional. Azure CLI module version to be used. See a list of supported Azure CLI versions: https://mcr.microsoft.com/v2/azure-cli/tags/list."
              }
            },
            "scriptContent": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "Optional. Script body. Max length: 32000 characters. To run an external script, use primaryScriptURI instead."
              }
            },
            "primaryScriptUri": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "Optional. Uri for the external script. This is the entry point for the external script. To run an internal script, use the scriptContent parameter instead."
              }
            },
            "environmentVariables": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/environmentVariableType"
              },
              "nullable": true,
              "metadata": {
                "description": "Optional. The environment variables to pass over to the script."
              }
            },
            "supportingScriptUris": {
              "type": "array",
              "nullable": true,
              "metadata": {
                "description": "Optional. List of supporting files for the external script (defined in primaryScriptUri). Does not work with internal scripts (code defined in scriptContent)."
              }
            },
            "subnetResourceIds": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "nullable": true,
              "metadata": {
                "description": "Optional. List of subnet IDs to use for the container group. This is required if you want to run the deployment script in a private network. When using a private network, the `Storage File Data Privileged Contributor` role needs to be assigned to the user-assigned managed identity and the deployment principal needs to have permissions to list the storage account keys. Also, Shared-Keys must not be disabled on the used storage account [ref](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-vnet)."
              }
            },
            "arguments": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "Optional. Command-line arguments to pass to the script. Arguments are separated by spaces."
              }
            },
            "retentionInterval": {
              "type": "string",
              "defaultValue": "P1D",
              "metadata": {
                "description": "Optional. Interval for which the service retains the script resource after it reaches a terminal state. Resource will be deleted when this duration expires. Duration is based on ISO 8601 pattern (for example P7D means one week)."
              }
            },
            "baseTime": {
              "type": "string",
              "defaultValue": "[utcNow('yyyy-MM-dd-HH-mm-ss')]",
              "metadata": {
                "description": "Generated. Do not provide a value! This date value is used to make sure the script run every time the template is deployed."
              }
            },
            "runOnce": {
              "type": "bool",
              "defaultValue": false,
              "metadata": {
                "description": "Optional. When set to false, script will run every time the template is deployed. When set to true, the script will only run once."
              }
            },
            "cleanupPreference": {
              "type": "string",
              "defaultValue": "Always",
              "allowedValues": [
                "Always",
                "OnSuccess",
                "OnExpiration"
              ],
              "metadata": {
                "description": "Optional. The clean up preference when the script execution gets in a terminal state. Specify the preference on when to delete the deployment script resources. The default value is Always, which means the deployment script resources are deleted despite the terminal state (Succeeded, Failed, canceled)."
              }
            },
            "containerGroupName": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "Optional. Container group name, if not specified then the name will get auto-generated. Not specifying a 'containerGroupName' indicates the system to generate a unique name which might end up flagging an Azure Policy as non-compliant. Use 'containerGroupName' when you have an Azure Policy that expects a specific naming convention or when you want to fully control the name. 'containerGroupName' property must be between 1 and 63 characters long, must contain only lowercase letters, numbers, and dashes and it cannot start or end with a dash and consecutive dashes are not allowed."
              }
            },
            "storageAccountResourceId": {
              "type": "string",
              "defaultValue": "",
              "metadata": {
                "description": "Optional. The resource ID of the storage account to use for this deployment script. If none is provided, the deployment script uses a temporary, managed storage account."
              }
            },
            "timeout": {
              "type": "string",
              "nullable": true,
              "metadata": {
                "description": "Optional. Maximum allowed script execution time specified in ISO 8601 format. Default value is PT1H - 1 hour; 'PT30M' - 30 minutes; 'P5D' - 5 days; 'P1Y' 1 year."
              }
            },
            "lock": {
              "$ref": "#/definitions/lockType",
              "nullable": true,
              "metadata": {
                "description": "Optional. The lock settings of the service."
              }
            },
            "roleAssignments": {
              "type": "array",
              "items": {
                "$ref": "#/definitions/roleAssignmentType"
              },
              "nullable": true,
              "metadata": {
                "description": "Optional. Array of role assignments to create."
              }
            },
            "enableTelemetry": {
              "type": "bool",
              "defaultValue": true,
              "metadata": {
                "description": "Optional. Enable/Disable usage telemetry for module."
              }
            }
          },
          "variables": {
            "copy": [
              {
                "name": "formattedRoleAssignments",
                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
              },
              {
                "name": "subnetIds",
                "count": "[length(coalesce(parameters('subnetResourceIds'), createArray()))]",
                "input": {
                  "id": "[coalesce(parameters('subnetResourceIds'), createArray())[copyIndex('subnetIds')]]"
                }
              }
            ],
            "builtInRoleNames": {
              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
            },
            "containerSettings": {
              "containerGroupName": "[parameters('containerGroupName')]",
              "subnetIds": "[if(not(empty(coalesce(variables('subnetIds'), createArray()))), variables('subnetIds'), null())]"
            },
            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null()), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
          },
          "resources": {
            "storageAccount": {
              "condition": "[not(empty(parameters('storageAccountResourceId')))]",
              "existing": true,
              "type": "Microsoft.Storage/storageAccounts",
              "apiVersion": "2023-05-01",
              "subscriptionId": "[split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), '//'), '/')[2]]",
              "resourceGroup": "[split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), '////'), '/')[4]]",
              "name": "[last(split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), 'dummyAccount'), '/'))]"
            },
            "avmTelemetry": {
              "condition": "[parameters('enableTelemetry')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2024-03-01",
              "name": "[format('46d3xbcp.res.resources-deploymentscript.{0}.{1}', replace('0.5.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
              "properties": {
                "mode": "Incremental",
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "resources": [],
                  "outputs": {
                    "telemetry": {
                      "type": "String",
                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
                    }
                  }
                }
              }
            },
            "deploymentScript": {
              "type": "Microsoft.Resources/deploymentScripts",
              "apiVersion": "2023-08-01",
              "name": "[parameters('name')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('tags')]",
              "identity": "[variables('identity')]",
              "kind": "[parameters('kind')]",
              "properties": {
                "azPowerShellVersion": "[if(equals(parameters('kind'), 'AzurePowerShell'), parameters('azPowerShellVersion'), null())]",
                "azCliVersion": "[if(equals(parameters('kind'), 'AzureCLI'), parameters('azCliVersion'), null())]",
                "containerSettings": "[if(not(empty(variables('containerSettings'))), variables('containerSettings'), null())]",
                "storageAccountSettings": "[if(not(empty(parameters('storageAccountResourceId'))), if(not(empty(parameters('storageAccountResourceId'))), createObject('storageAccountKey', if(empty(parameters('subnetResourceIds')), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), '//'), '/')[2], split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), '////'), '/')[4]), 'Microsoft.Storage/storageAccounts', last(split(if(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountResourceId'), 'dummyAccount'), '/'))), '2023-01-01').keys[0].value, null()), 'storageAccountName', last(split(parameters('storageAccountResourceId'), '/'))), null()), null())]",
                "arguments": "[parameters('arguments')]",
                "environmentVariables": "[parameters('environmentVariables')]",
                "scriptContent": "[if(not(empty(parameters('scriptContent'))), parameters('scriptContent'), null())]",
                "primaryScriptUri": "[if(not(empty(parameters('primaryScriptUri'))), parameters('primaryScriptUri'), null())]",
                "supportingScriptUris": "[if(not(empty(parameters('supportingScriptUris'))), parameters('supportingScriptUris'), null())]",
                "cleanupPreference": "[parameters('cleanupPreference')]",
                "forceUpdateTag": "[if(parameters('runOnce'), resourceGroup().name, parameters('baseTime'))]",
                "retentionInterval": "[parameters('retentionInterval')]",
                "timeout": "[parameters('timeout')]"
              }
            },
            "deploymentScript_lock": {
              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
              "type": "Microsoft.Authorization/locks",
              "apiVersion": "2020-05-01",
              "scope": "[format('Microsoft.Resources/deploymentScripts/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
              "properties": {
                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
              },
              "dependsOn": [
                "deploymentScript"
              ]
            },
            "deploymentScript_roleAssignments": {
              "copy": {
                "name": "deploymentScript_roleAssignments",
                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
              },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[format('Microsoft.Resources/deploymentScripts/{0}', parameters('name'))]",
              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Resources/deploymentScripts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
              "properties": {
                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
              },
              "dependsOn": [
                "deploymentScript"
              ]
            },
            "deploymentScriptLogs": {
              "existing": true,
              "type": "Microsoft.Resources/deploymentScripts/logs",
              "apiVersion": "2023-08-01",
              "name": "[format('{0}/{1}', parameters('name'), 'default')]",
              "dependsOn": [
                "deploymentScript"
              ]
            }
          },
          "outputs": {
            "resourceId": {
              "type": "string",
              "metadata": {
                "description": "The resource ID of the deployment script."
              },
              "value": "[resourceId('Microsoft.Resources/deploymentScripts', parameters('name'))]"
            },
            "resourceGroupName": {
              "type": "string",
              "metadata": {
                "description": "The resource group the deployment script was deployed into."
              },
              "value": "[resourceGroup().name]"
            },
            "name": {
              "type": "string",
              "metadata": {
                "description": "The name of the deployment script."
              },
              "value": "[parameters('name')]"
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "The location the resource was deployed into."
              },
              "value": "[reference('deploymentScript', '2023-08-01', 'full').location]"
            },
            "outputs": {
              "type": "object",
              "metadata": {
                "description": "The output of the deployment script."
              },
              "value": "[coalesce(tryGet(reference('deploymentScript'), 'outputs'), createObject())]"
            },
            "deploymentScriptLogs": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "metadata": {
                "description": "The logs of the deployment script."
              },
              "value": "[split(reference('deploymentScriptLogs').log, '\n')]"
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.App/containerApps', toLower(format('{0}containerBackend', variables('prefixCleaned'))))]",
        "[resourceId('Microsoft.Resources/deployments', toLower(format('{0}database', variables('prefixCleaned'))))]",
        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', 'deploy_managed_identity')]"
      ]
    }
  ]
}