Add Lint ARM Templates step

.github/workflows/arm-template-lint.yml

@@ -0,0 +1,36 @@
+name: ARM Templates
+
+on:
+  pull_request:
+    paths:
+      - "deploy/azure/*.json"
+  push:
+    branches:
+      - main
+    paths:
+      - "deploy/azure/*.json"
+
+jobs:
+  lint-arm-ttk:
+    name: Lint
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        template: [ "ARM-for-organization-account", "ARM-for-single-account" ]
+    steps:
+      - uses: actions/checkout@v4
+
+        # Copy files to its own folder because it's what the official ARM-TTK action expects
+        # Docs https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/test-toolkit#test-parameters
+      - name: copy file
+        working-directory: ./deploy/azure
+        run: |
+          mkdir ${{ matrix.template }}
+          cp ${{ matrix.template }}.json ${{ matrix.template }}/azuredeploy.json
+
+      - uses: microsoft/action-armttk@v1
+        name: lint ${{ matrix.template }}
+        with:
+          github_token: ${{ secrets.github_token }}
+          workdir: "./deploy/azure/${{ matrix.template }}"

deploy/azure/ARM-for-organization-account.dev.json

@@ -41,6 +41,13 @@
                 "description": "The enrollment token of elastic-agent"
             }
         },
+        "DeploymentLocation": {
+            "type": "string",
+            "defaultValue": "[deployment().location]",
+            "metadata": {
+                "description": "Deployment location"
+            }
+        },
         "PublicKeyDevOnly": {
             "type": "string",
             "metadata": {
@@ -49,16 +56,16 @@
         }
     },
     "variables": {
-        "resourceGroupDeployment": "[concat('resource-group-deployment-', deployment().location)]",
-        "roleAssignmentDeployment": "[concat('role-assignment-deployment-', deployment().location)]",
-        "roleGUID": "[guid(parameters('SubscriptionId'))]"
+        "resourceGroupDeployment": "[concat('resource-group-deployment-', parameters('DeploymentLocation'))]",
+        "roleAssignmentDeployment": "[concat('role-assignment-deployment-', parameters('DeploymentLocation'))]",
+        "roleGUID": "[guid(parameters('SubscriptionId'), parameters('ResourceGroupName'))]"
     },
     "resources": [
         {
             "type": "Microsoft.Resources/deployments",
             "apiVersion": "2022-09-01",
             "name": "[variables('resourceGroupDeployment')]",
-            "location": "[deployment().location]",
+            "location": "[parameters('DeploymentLocation')]",
             "subscriptionId": "[parameters('SubscriptionId')]",
             "properties": {
                 "expressionEvaluationOptions": {
@@ -69,8 +76,8 @@
                     "ResourceGroupName": {
                         "value": "[parameters('ResourceGroupName')]"
                     },
-                    "Location": {
-                        "value": "[deployment().location]"
+                    "DeploymentLocation": {
+                        "value": "[parameters('DeploymentLocation')]"
                     }
                 },
                 "template": {
@@ -80,7 +87,7 @@
                         "ResourceGroupName": {
                             "type": "string"
                         },
-                        "Location": {
+                        "DeploymentLocation": {
                             "type": "string"
                         }
                     },
@@ -89,7 +96,7 @@
                             "type": "Microsoft.Resources/resourceGroups",
                             "apiVersion": "2022-09-01",
                             "name": "[parameters('ResourceGroupName')]",
-                            "location": "[parameters('Location')]"
+                            "location": "[parameters('DeploymentLocation')]"
                         }
                     ]
                 }
@@ -99,7 +106,7 @@
             "type": "Microsoft.Resources/deployments",
             "apiVersion": "2022-09-01",
             "name": "[variables('roleAssignmentDeployment')]",
-            "location": "[deployment().location]",
+            "location": "[parameters('DeploymentLocation')]",
             "properties": {
                 "expressionEvaluationOptions": {
                     "scope": "inner"
@@ -143,7 +150,7 @@
                             "name": "[guid(parameters('ManagementGroupID'), parameters('SubscriptionId'), parameters('ResourceGroupName'), deployment().name, 'securityaudit')]",
                             "properties": {
                                 "roleDefinitionId": "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
-                                "principalId": "[reference(resourceId(parameters('SubscriptionId'), parameters('ResourceGroupName'), 'Microsoft.Compute/virtualMachines', 'cloudbeatVM'), '2019-07-01', 'Full').identity.principalId]",
+                                "principalId": "[reference(resourceId(parameters('SubscriptionId'), parameters('ResourceGroupName'), 'Microsoft.Compute/virtualMachines', 'cloudbeatVM'), '2023-09-01', 'Full').identity.principalId]",
                                 "principalType": "ServicePrincipal"
                             }
                         },
@@ -153,7 +160,7 @@
                             "name": "[guid(parameters('SubscriptionId'), parameters('ResourceGroupName'), deployment().name, 'additional-role')]",
                             "properties": {
                                 "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', parameters('AdditionalRoleGUID'))]",
-                                "principalId": "[reference(resourceId(parameters('SubscriptionId'), parameters('ResourceGroupName'), 'Microsoft.Compute/virtualMachines', 'cloudbeatVM'), '2019-07-01', 'Full').identity.principalId]",
+                                "principalId": "[reference(resourceId(parameters('SubscriptionId'), parameters('ResourceGroupName'), 'Microsoft.Compute/virtualMachines', 'cloudbeatVM'), '2023-09-01', 'Full').identity.principalId]",
                                 "principalType": "ServicePrincipal"
                             }
                         }
@@ -192,15 +199,15 @@
                     "resources": [
                         {
                             "type": "Microsoft.Compute/virtualMachines",
-                            "apiVersion": "2021-04-01",
+                            "apiVersion": "2023-09-01",
                             "name": "cloudbeatVM",
-                            "location": "[resourceGroup().location]",
+                            "location": "[parameters('ResourceGroupLocation')]",
                             "dependsOn": [
                                 "cloudbeatNic"
                             ],
                             "properties": {
                                 "hardwareProfile": {
-                                    "vmSize": "Standard_DS2_v2"
+                                    "vmSize": "[parameters('VMSize')]"
                                 },
                                 "storageProfile": {
                                     "osDisk": {
@@ -218,7 +225,7 @@
                                 },
                                 "osProfile": {
                                     "computerName": "cloudbeatVM",
-                                    "adminUsername": "cloudbeat",
+                                    "adminUsername": "[parameters('AdminUsername')]",
                                     "linuxConfiguration": {
                                         "disablePasswordAuthentication": true,
                                         "ssh": {
@@ -245,9 +252,9 @@
                         },
                         {
                             "type": "Microsoft.Network/virtualNetworks",
-                            "apiVersion": "2021-04-01",
+                            "apiVersion": "2023-06-01",
                             "name": "cloudbeatVNet",
-                            "location": "[resourceGroup().location]",
+                            "location": "[parameters('ResourceGroupLocation')]",
                             "properties": {
                                 "addressSpace": {
                                     "addressPrefixes": [
@@ -272,9 +279,9 @@
                         },
                         {
                             "type": "Microsoft.Network/networkInterfaces",
-                            "apiVersion": "2021-04-01",
+                            "apiVersion": "2023-06-01",
                             "name": "cloudbeatNic",
-                            "location": "[resourceGroup().location]",
+                            "location": "[parameters('ResourceGroupLocation')]",
                             "dependsOn": [
                                 "cloudbeatVNet",
                                 "[resourceId('Microsoft.Network/publicIPAddresses', 'cloudbeatPublicIPDevOnly')]"
@@ -295,24 +302,6 @@
                                 ]
                             }
                         },
-                        {
-                            "type": "Microsoft.Compute/virtualMachines/extensions",
-                            "apiVersion": "2021-04-01",
-                            "name": "cloudbeatVM/EnableMSIExtension",
-                            "location": "[resourceGroup().location]",
-                            "dependsOn": [
-                                "cloudbeatVM"
-                            ],
-                            "properties": {
-                                "publisher": "Microsoft.ManagedIdentity",
-                                "type": "ManagedIdentityExtensionForLinux",
-                                "typeHandlerVersion": "1.0",
-                                "autoUpgradeMinorVersion": true,
-                                "settings": {
-                                    "port": 50342
-                                }
-                            }
-                        },
                         {
                             "type": "Microsoft.Authorization/roleDefinitions",
                             "apiVersion": "2022-04-01",
@@ -330,13 +319,10 @@
                                             "Microsoft.Web/sites/*/read",
                                             "Microsoft.Web/sites/config/Read",
                                             "Microsoft.Web/sites/config/list/Action"
-                                        ],
-                                        "dataActions": [],
-                                        "notActions": [],
-                                        "notDataActions": []
+                                        ]
                                     }
                                 ],
-                                "roleName": "cloudbeatVM additional permissions",
+                                "roleName": "[concat('cloudbeatVM additional permissions ', parameters('ResourceGroupName'))]",
                                 "type": "CustomRole"
                             }
                         },
@@ -419,14 +405,21 @@
                         },
                         "ElasticAgentVersion": {
                             "type": "string"
+                        },
+                        "ResourceGroupLocation": {
+                            "type": "string",
+                            "defaultValue": "[resourceGroup().location]",
+                            "metadata": {
+                                "description": "Resource Group Location"
+                            }
                         }
                     },
                     "resources": [
                         {
                             "type": "Microsoft.Compute/virtualMachines/extensions",
-                            "apiVersion": "2021-04-01",
+                            "apiVersion": "2023-09-01",
                             "name": "cloudbeatVM/customScriptExtension",
-                            "location": "[resourceGroup().location]",
+                            "location": "[parameters('ResourceGroupLocation')]",
                             "properties": {
                                 "publisher": "Microsoft.Azure.Extensions",
                                 "type": "CustomScript",