JCore-Add CMK option for Storage / ZT

workload/bicep/deploy-baseline.bicep

@@ -185,6 +185,9 @@ param avdVnetPrivateDnsZoneKeyvaultId string = ''
 @sys.description('Does the hub contains a virtual network gateway. (Default: false)')
 param vNetworkGatewayOnHub bool = false
 
+@sys.description('This option will configure the Storage Account(s) to utilize Customer Managed Keys and include an additional Key Vault deployment. (Default: false)')
+param storageZeroTrust bool = false
+
 @sys.description('Deploy Fslogix setup. (Default: true)')
 param createAvdFslogixDeployment bool = true
 
@@ -420,6 +423,10 @@ param msixFileShareCustomName string = 'msix-app1-dev-use2-001'
 //@sys.description('AVD fslogix storage account office container file share prefix custom name. (Default: fslogix-oc-app1-dev-001)')
 //param avdFslogixOfficeContainerFileShareCustomName string = 'fslogix-oc-app1-dev-001'
 
+@maxLength(6)
+@sys.description('AVD keyvault prefix custom name (with Zero Trust to store keys for FSLogix and AppAttach Storage / CMK option). (Default: kv-st)')
+param ztKvStPrefixCustomName string = 'kv-st'
+
 @maxLength(6)
 @sys.description('AVD keyvault prefix custom name (with Zero Trust to store credentials to domain join and local admin). (Default: kv-sec)')
 param avdWrklKvPrefixCustomName string = 'kv-sec'
@@ -433,8 +440,8 @@ param ztDiskEncryptionSetCustomNamePrefix string = 'des-zt'
 param ztManagedIdentityCustomName string = 'id-zt'
 
 @maxLength(6)
-@sys.description('AVD key vault custom name for zero trust and store store disk encryption key (Default: kv-key)')
-param ztKvPrefixCustomName string = 'kv-key'
+@sys.description('AVD key vault custom name for zero trust and store disk encryption keys for VMs (Default: kv-vms)')
+param ztKvPrefixCustomName string = 'kv-vms'
 
 //
 // Resource tagging
@@ -607,6 +614,13 @@ var varPrivateEndPointWorkspaceName = 'pe-${varWorkSpaceName}-global'
 var varScalingPlanExclusionTag = 'exclude-${varScalingPlanName}'
 var varScalingPlanWeekdaysScheduleName = 'Weekdays-${varManagementPlaneNamingStandard}'
 var varScalingPlanWeekendScheduleName = 'Weekend-${varManagementPlaneNamingStandard}'
+var varStrgKvName = avdUseCustomNaming
+  ? '${ztKvStPrefixCustomName}-${varComputeStorageResourcesNamingStandard}-${varNamingUniqueStringTwoChar}'
+  : 'kv-str-${varComputeStorageResourcesNamingStandard}-${varNamingUniqueStringTwoChar}' // max length limit 24 characters
+var varStrgKvPrivateEndpointName = 'pe-${varStrgKvName}-vault'
+var varStrgKeyVaultSku = (varAzureCloudName == 'AzureCloud' || varAzureCloudName == 'AzureUSGovernment')
+  ? 'premium'
+  : (varAzureCloudName == 'AzureChinaCloud' ? 'standard' : null)
 var varWrklKvName = avdUseCustomNaming
   ? '${avdWrklKvPrefixCustomName}-${varComputeStorageResourcesNamingStandard}-${varNamingUniqueStringTwoChar}'
   : 'kv-sec-${varComputeStorageResourcesNamingStandard}-${varNamingUniqueStringTwoChar}' // max length limit 24 characters
@@ -971,6 +985,9 @@ var varAvdDefaultTags = {
   ServiceWorkload: 'AVD'
   CreationTimeUTC: time
 }
+var varStorageKeyvaultTag = {
+  Purpose: 'Customer Managed Keys for FSLogix and MSIX storage accounts'
+}
 var varWorkloadKeyvaultTag = {
   Purpose: 'Secrets for local admin and domain join credentials'
 }
@@ -999,6 +1016,29 @@ var verResourceGroups = [
       : union(varAvdDefaultTags, varAllComputeStorageTags)
   }
 ]
+var varZtStorageKeyRotation = {
+  attributes: {
+    expiryTime: 'P1Y'
+  }
+  lifetimeActions: [
+    {
+      action: {
+        type: 'Rotate'
+      }
+      trigger: {
+        timeBeforeExpiry: 'P1M'
+      }
+    }
+    {
+      action: {
+        type: 'Notify'
+      }
+      trigger: {
+        timeBeforeExpiry: 'P1M'
+      }
+    }
+  ]
+}
 
 // =========== //
 // Deployments //
@@ -1376,6 +1416,82 @@ module managementVm './modules/storageAzureFiles/.bicep/managementVm.bicep' = if
     wrklKeyVault
   ]
 }
+// Key vault for Storage Account(s) with key for each, 1y expiry and rotation policy for FSLogix and MSIX (CMK)
+module strgKeyVault '../../avm/1.0.0/res/key-vault/vault/main.bicep' = if ((varCreateStorageDeployment) && (storageZeroTrust)) {
+  scope: resourceGroup('${avdWorkloadSubsId}', '${varStorageObjectsRgName}')
+  name: 'Storage-KeyVault-${time}'
+  params: {
+    name: varStrgKvName
+    location: avdSessionHostLocation
+    enableRbacAuthorization: true
+    enablePurgeProtection: enableKvPurgeProtection
+    roleAssignments: [
+      {
+        principalId: identity.outputs.managedIdentityStoragePrincipalId
+        principalType: 'ServicePrincipal'
+        roleDefinitionIdOrName: 'Key Vault Crypto Service Encryption User'
+      }
+    ]
+    keys: varCreateMsixDeployment ? [
+      {
+        name: 'key-${varMsixStorageName}'
+        kty: 'RSA'
+        keySize: 2048
+        rotationPolicy: varZtStorageKeyRotation
+      }
+      {
+        name: 'key-${varFslogixStorageName}'
+        kty: 'RSA'
+        keySize: 2048
+        rotationPolicy: varZtStorageKeyRotation
+      }
+    ]:[
+      {
+        name: 'key-${varFslogixStorageName}'
+        kty: 'RSA'
+        keySize: 2048
+        rotationPolicy: varZtStorageKeyRotation
+      }
+    ]
+    sku: varStrgKeyVaultSku
+    softDeleteRetentionInDays: 7
+    publicNetworkAccess: deployPrivateEndpointKeyvaultStorage ? 'Disabled' : 'Enabled'
+    networkAcls: deployPrivateEndpointKeyvaultStorage
+      ? {
+          bypass: 'AzureServices'
+          defaultAction: 'Deny'
+          virtualNetworkRules: []
+          ipRules: []
+        }
+      : {}
+    privateEndpoints: deployPrivateEndpointKeyvaultStorage? [
+          {
+            name: varStrgKvPrivateEndpointName
+            subnetResourceId: createAvdVnet
+              ? '${networking.outputs.virtualNetworkResourceId}/subnets/${varVnetPrivateEndpointSubnetName}'
+              : existingVnetPrivateEndpointSubnetResourceId
+            customNetworkInterfaceName: 'nic-01-${varStrgKvPrivateEndpointName}'
+            service: 'vault'
+            privateDnsZoneGroupName: createPrivateDnsZones ? split(networking.outputs.keyVaultDnsZoneResourceId, '/')[8] : split(avdVnetPrivateDnsZoneKeyvaultId, '/')[8]
+            privateDnsZoneResourceIds: [
+                createPrivateDnsZones ? networking.outputs.keyVaultDnsZoneResourceId : avdVnetPrivateDnsZoneKeyvaultId
+            ]
+          }
+      ]
+      : []
+    tags: createResourceTags
+      ? union(varCustomResourceTags, varAvdDefaultTags, varStorageKeyvaultTag)
+      : union(varAvdDefaultTags, varStorageKeyvaultTag)
+  }
+  dependsOn: [
+    identity
+    networking
+    managementVm
+    baselineResourceGroups
+    monitoringDiagnosticSettings
+  ]
+}
+
 
 // FSLogix storage
 module fslogixAzureFilesStorage './modules/storageAzureFiles/deploy.bicep' = if (createAvdFslogixDeployment) {
@@ -1426,6 +1542,7 @@ module fslogixAzureFilesStorage './modules/storageAzureFiles/deploy.bicep' = if
     wrklKeyVault
     managementVm
     monitoringDiagnosticSettings
+    strgKeyVault
   ]
 }
 
@@ -1479,6 +1596,50 @@ module msixAzureFilesStorage './modules/storageAzureFiles/deploy.bicep' = if (va
     wrklKeyVault
     managementVm
     monitoringDiagnosticSettings
+    strgKeyVault
+  ]
+}
+
+// Coniguring CMK after storage deployment ensures key rotation is automatic
+// https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-existing-account?tabs=azure-portal#configure-encryption-for-automatic-updating-of-key-versions
+
+// Storage Zero Trust / Configure CMK - FSLogix
+module fslogixCmk './modules/zeroTrust/.bicep/storageCmkConfig.bicep' = if (storageZeroTrust && createAvdFslogixDeployment) {
+  name: 'FSLogixStorage-CMK-${time}'
+  scope: resourceGroup('${avdWorkloadSubsId}', '${varStorageObjectsRgName}')
+  params: {
+    storageAccountName: varFslogixStorageName
+    location: avdSessionHostLocation
+    managedIdentityStorageResourceId: identity.outputs.managedIdentityStorageResourceId
+    keyVaultUri: strgKeyVault.outputs.uri
+    storageSkuName: varFslogixStorageSku
+    }
+  dependsOn: [
+    baselineResourceGroups
+    baselineStorageResourceGroup
+    identity
+    fslogixAzureFilesStorage
+    strgKeyVault
+  ]
+}
+
+// Storage Zero Trust / Configure CMK - MSIX
+module msixCmk './modules/zeroTrust/.bicep/storageCmkConfig.bicep' = if (storageZeroTrust && varCreateMsixDeployment) {
+  name: 'MSIXStorage-CMK-${time}'
+  scope: resourceGroup('${avdWorkloadSubsId}', '${varStorageObjectsRgName}')
+  params: {
+    storageAccountName: varMsixStorageName
+    location: avdSessionHostLocation
+    managedIdentityStorageResourceId: identity.outputs.managedIdentityStorageResourceId
+    keyVaultUri: strgKeyVault.outputs.uri
+    storageSkuName: varMsixStorageSku
+    }
+  dependsOn: [
+    baselineResourceGroups
+    baselineStorageResourceGroup
+    identity
+    msixAzureFilesStorage
+    strgKeyVault
   ]
 }
 

workload/bicep/modules/identity/deploy.bicep

@@ -187,3 +187,4 @@ module aadIdentityLoginAccessServiceObjects '../../../../avm/1.0.0/ptn/authoriza
 // =========== //
 output managedIdentityStorageResourceId string = (createStorageDeployment) ? managedIdentityStorage.outputs.resourceId : ''
 output managedIdentityStorageClientId string = (createStorageDeployment) ? managedIdentityStorage.outputs.clientId : ''
+output managedIdentityStoragePrincipalId string = (createStorageDeployment) ? managedIdentityStorage.outputs.principalId : ''

workload/bicep/modules/storageAzureFiles/deploy.bicep

@@ -114,9 +114,10 @@ var varStorageToDomainScriptArgs = '-DscPath ${dscAgentPackageLocation} -Storage
 var varDiagnosticSettings = !empty(alaWorkspaceResourceId) ? [
     {
         workspaceResourceId: alaWorkspaceResourceId
-        logCategoriesAndGroups: [] 
+        logCategoriesAndGroups: []
     }
 ]: []
+
 // =========== //
 // Deployments //
 // =========== //

workload/bicep/modules/zeroTrust/.bicep/StorageCmkConfig.bicep

@@ -0,0 +1,66 @@
+// Called from deploy-baseline.bicep as storage needs to be created first.
+
+targetScope = 'resourceGroup'
+
+// ========== //
+// Parameters //
+// ========== //
+@sys.description('Name of storage account.')
+param storageAccountName string
+
+@sys.description('Location where to deploy compute services.')
+param location string = resourceGroup().location
+
+@sys.description('Key Vault URI associated with Storage Account.')
+param keyVaultUri string
+
+@sys.description('Managed Identity Resource ID associated with Storage Account and used for Zero Trust.')
+param managedIdentityStorageResourceId string
+
+@sys.description('Specifies the SKU for the Storage Account.')
+param storageSkuName string
+
+// =========== //
+// Variable declaration //
+// =========== //
+
+var keyName = 'key-${storageAccountName}'
+
+// =========== //
+// Deployments //
+// =========== //
+// Using AVM - the key rotation is not enabled on the Storage Account.
+resource storageAccount 'Microsoft.Storage/storageAccounts@2021-04-01' = {
+  name: storageAccountName
+  location: location
+  kind: ((storageSkuName == 'Premium_LRS') || (storageSkuName == 'Premium_ZRS')) ? 'FileStorage' : 'StorageV2'
+  identity: {
+    type: 'userAssigned'
+    userAssignedIdentities: {
+      '${managedIdentityStorageResourceId}': {}
+    }
+  }
+  sku: {
+    name: storageSkuName
+  }
+  properties: {
+    encryption: {
+      identity: {
+        userAssignedIdentity: managedIdentityStorageResourceId
+      }
+      keySource: 'Microsoft.Keyvault'
+      keyvaultproperties: {
+        keyname: keyName
+        keyvaulturi: keyVaultUri
+        keyversion: ''
+      }
+      services: {
+        file: {
+          enabled: true
+        }
+      }
+    }
+  }
+}
+
+

workload/bicep/modules/zeroTrust/.bicep/zeroTrustKeyVault.bicep

@@ -59,7 +59,7 @@ param enableKvPurgeProtection bool = true
 // Deployments //
 // =========== //
 
-// Key vault for Zero Trust.
+// Key vault for Zero Trust - Session Host Encryption Keys.
 module ztKeyVault '../../../../../avm/1.0.0/res/key-vault/vault/main.bicep' = {
     scope: resourceGroup('${subscriptionId}', '${rgName}')
     name: 'ZT-KeyVault-${time}'
@@ -95,7 +95,7 @@ module ztKeyVault '../../../../../avm/1.0.0/res/key-vault/vault/main.bicep' = {
     dependsOn: []
 }
 
-// Disk Encryption Key for Zero Trust.
+// Session Host Disk Encryption Key for Zero Trust.
 module ztKeyVaultKey '../../../../../avm/1.0.0/res/key-vault/vault/key/main.bicep' = {
     scope: resourceGroup('${subscriptionId}', '${rgName}')
     name: 'ZT-KeyVaultKey-${time}'
@@ -150,6 +150,7 @@ module ztDiskEncryptionSet '../../../../../avm/1.0.0/res/compute/disk-encryption
     }
 }
 
+
 // =========== //
 // Outputs //
 // =========== //

workload/bicep/modules/zeroTrust/deploy.bicep

@@ -181,7 +181,7 @@ module ztRoleAssignmentCompute '../../../../avm/1.0.0/ptn/authorization/role-ass
     params: {
         principalId: diskZeroTrust ? ztPolicyAssignmentCompute[i].outputs.principalId : ''
         roleDefinitionIdOrName: '/providers/Microsoft.Authorization/roleDefinitions/60fc6e62-5479-42d4-8bf4-67625fcc2840'
-        principalType: ''
+        principalType: 'ServicePrincipal'
     }
     dependsOn: [
         ztPolicyAssignmentCompute
@@ -196,7 +196,7 @@ module ztRoleAssignmentServObj '../../../../avm/1.0.0/ptn/authorization/role-ass
     params: {
         principalId: diskZeroTrust ? ztPolicyAssignmentServiceObjects[i].outputs.principalId : ''
         roleDefinitionIdOrName: '/providers/Microsoft.Authorization/roleDefinitions/60fc6e62-5479-42d4-8bf4-67625fcc2840'
-        principalType: ''
+        principalType: 'ServicePrincipal'
     }
     dependsOn: [
         ztPolicyAssignmentServiceObjects
@@ -240,7 +240,6 @@ module ztKeyVault './.bicep/zeroTrustKeyVault.bicep' = if (diskZeroTrust) {
         enableKvPurgeProtection: enableKvPurgeProtection
     }
     dependsOn: [
-
     ]
 }