fix(bicep): pin API versions and record DoNotEnforce ADR (Phase 33 P2/P4)#13
Merged
Conversation
…e API versions - bicepconfig.json: flip use-recent-api-versions from off to warning - identity.bicep: userAssignedIdentities 2023-01-31 -> 2024-11-30 - logging-siem.bicep: workspaces 2023-09-01 -> 2025-02-01 - network-hubspoke.bicep: networkSecurityGroups + virtualNetworks 2024-05-01 -> 2024-10-01 - policy-assignments.bicep: policyAssignments 2024-04-01 -> 2025-01-01 (enforcementMode untouched) Closes Phase 33 P2 item for cloud-security-service-model. Verified via az bicep build/lint on every touched module plus a full-template pass on main.bicep and a regression check on the untouched keyvault.bicep module.
Reaffirms enforcementMode: DoNotEnforce on the allowed-locations policy assignment in impl/azure/landing-zone/bicep/modules/policy-assignments.bicep is an intentional, reviewed decision (stub/reference landing zone, not a deployed environment) rather than an unreviewed gap. Closes Phase 33 P4 item for cloud-security-service-model.
3 tasks
OgeonX-Ai
added a commit
that referenced
this pull request
Jul 8, 2026
…#15) * docs: add DoNotEnforce policy pointer to README + docs-as-code wiki tree - README: one-line pointer to the DoNotEnforce policy assignment (found on main) and the in-progress ADR (PR #13) that will formally record it; freshness footer - wiki: Home, Architecture (service model + NO-AZURE deploy-lock posture of impl/ stubs), Operations, Decisions - Adds codex:generate-image placeholder per docs/VISION.md house style * fix(docs): wrap architecture image directive for markdownlint --------- Co-authored-by: Kim Harjamäki <kim.harjamaki@prosimo.fi> Co-authored-by: root <root@Kimi.localdomain>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes the two remaining Phase 33 (Azure Infra Hardening) items scoped to this repo:
P2 — Bicep linting / API version pinning
bicepconfig.json:use-recent-api-versionsflipped fromofftowarning(this repo's copy of the config, merged via ci: scan actions with codeql and add bicep linter config #10, matched cas-platform's suppressed rule).impl/azure/landing-zone/bicep/modules/had genuinely stale API versions once the rule was re-enabled; all four are bumped to a current, GA (non-preview) version:identity.bicep:userAssignedIdentities@2023-01-31->@2024-11-30logging-siem.bicep:workspaces@2023-09-01->@2025-02-01network-hubspoke.bicep:networkSecurityGroups+virtualNetworks@2024-05-01->@2024-10-01(both)policy-assignments.bicep:policyAssignments@2024-04-01->@2025-01-01(enforcementMode untouched)keyvault.bicepwas already current — untouched, regression-checked clean.P4 — DoNotEnforce policy decision
docs/adr/001-policy-assignment-enforcement-mode.mdrecords theenforcementMode: 'DoNotEnforce'setting on theallowed-locationspolicy assignment as an intentional, reviewed decision (this is a stub/reference landing zone per its own README, not a deployed environment), following this repo's existing ADR authoring convention.All changes validated locally via
az bicep build/az bicep lintonly — noaz deploymentof any kind, per this phase's environment constraints. No CI wiring changes; this repo has no existing Bicep CI gate.SDLC Verification
AGENTS.md)az bicep build/az bicep lint(see task-level verification in commit messages)impl/azure/landing-zone/bicep/; this PR treats that directory with full build/lint rigor)