azure.domainservices.Service

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
using AzureAD = Pulumi.AzureAD;

return await Deployment.RunAsync(() => 
{
    var deployResourceGroup = new Azure.Core.ResourceGroup("deployResourceGroup", new()
    {
        Location = "West Europe",
    });

    var deployVirtualNetwork = new Azure.Network.VirtualNetwork("deployVirtualNetwork", new()
    {
        Location = deployResourceGroup.Location,
        ResourceGroupName = deployResourceGroup.Name,
        AddressSpaces = new[]
        {
            "10.0.1.0/16",
        },
    });

    var deploySubnet = new Azure.Network.Subnet("deploySubnet", new()
    {
        ResourceGroupName = deployResourceGroup.Name,
        VirtualNetworkName = deployVirtualNetwork.Name,
        AddressPrefixes = new[]
        {
            "10.0.1.0/24",
        },
    });

    var deployNetworkSecurityGroup = new Azure.Network.NetworkSecurityGroup("deployNetworkSecurityGroup", new()
    {
        Location = deployResourceGroup.Location,
        ResourceGroupName = deployResourceGroup.Name,
        SecurityRules = new[]
        {
            new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
            {
                Name = "AllowSyncWithAzureAD",
                Priority = 101,
                Direction = "Inbound",
                Access = "Allow",
                Protocol = "Tcp",
                SourcePortRange = "*",
                DestinationPortRange = "443",
                SourceAddressPrefix = "AzureActiveDirectoryDomainServices",
                DestinationAddressPrefix = "*",
            },
            new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
            {
                Name = "AllowRD",
                Priority = 201,
                Direction = "Inbound",
                Access = "Allow",
                Protocol = "Tcp",
                SourcePortRange = "*",
                DestinationPortRange = "3389",
                SourceAddressPrefix = "CorpNetSaw",
                DestinationAddressPrefix = "*",
            },
            new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
            {
                Name = "AllowPSRemoting",
                Priority = 301,
                Direction = "Inbound",
                Access = "Allow",
                Protocol = "Tcp",
                SourcePortRange = "*",
                DestinationPortRange = "5986",
                SourceAddressPrefix = "AzureActiveDirectoryDomainServices",
                DestinationAddressPrefix = "*",
            },
            new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
            {
                Name = "AllowLDAPS",
                Priority = 401,
                Direction = "Inbound",
                Access = "Allow",
                Protocol = "Tcp",
                SourcePortRange = "*",
                DestinationPortRange = "636",
                SourceAddressPrefix = "*",
                DestinationAddressPrefix = "*",
            },
        },
    });

    var deploySubnetNetworkSecurityGroupAssociation = new Azure.Network.SubnetNetworkSecurityGroupAssociation("deploySubnetNetworkSecurityGroupAssociation", new()
    {
        SubnetId = deploySubnet.Id,
        NetworkSecurityGroupId = deployNetworkSecurityGroup.Id,
    });

    var dcAdmins = new AzureAD.Group("dcAdmins", new()
    {
        DisplayName = "AAD DC Administrators",
        SecurityEnabled = true,
    });

    var adminUser = new AzureAD.User("adminUser", new()
    {
        UserPrincipalName = "dc-admin@hashicorp-example.com",
        DisplayName = "DC Administrator",
        Password = "Pa55w0Rd!!1",
    });

    var adminGroupMember = new AzureAD.GroupMember("adminGroupMember", new()
    {
        GroupObjectId = dcAdmins.ObjectId,
        MemberObjectId = adminUser.ObjectId,
    });

    var exampleServicePrincipal = new AzureAD.ServicePrincipal("exampleServicePrincipal", new()
    {
        ApplicationId = "2565bd9d-da50-47d4-8b85-4c97f669dc36",
    });

    // published app for domain services
    var aadds = new Azure.Core.ResourceGroup("aadds", new()
    {
        Location = "westeurope",
    });

    var exampleService = new Azure.DomainServices.Service("exampleService", new()
    {
        Location = aadds.Location,
        ResourceGroupName = aadds.Name,
        DomainName = "widgetslogin.net",
        Sku = "Enterprise",
        FilteredSyncEnabled = false,
        InitialReplicaSet = new Azure.DomainServices.Inputs.ServiceInitialReplicaSetArgs
        {
            SubnetId = deploySubnet.Id,
        },
        Notifications = new Azure.DomainServices.Inputs.ServiceNotificationsArgs
        {
            AdditionalRecipients = new[]
            {
                "notifyA@example.net",
                "notifyB@example.org",
            },
            NotifyDcAdmins = true,
            NotifyGlobalAdmins = true,
        },
        Security = new Azure.DomainServices.Inputs.ServiceSecurityArgs
        {
            SyncKerberosPasswords = true,
            SyncNtlmPasswords = true,
            SyncOnPremPasswords = true,
        },
        Tags = 
        {
            { "Environment", "prod" },
        },
    }, new CustomResourceOptions
    {
        DependsOn = new[]
        {
            exampleServicePrincipal,
            deploySubnetNetworkSecurityGroupAssociation,
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/domainservices"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/network"
	"github.com/pulumi/pulumi-azuread/sdk/v5/go/azuread"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		deployResourceGroup, err := core.NewResourceGroup(ctx, "deployResourceGroup", &core.ResourceGroupArgs{
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		deployVirtualNetwork, err := network.NewVirtualNetwork(ctx, "deployVirtualNetwork", &network.VirtualNetworkArgs{
			Location:          deployResourceGroup.Location,
			ResourceGroupName: deployResourceGroup.Name,
			AddressSpaces: pulumi.StringArray{
				pulumi.String("10.0.1.0/16"),
			},
		})
		if err != nil {
			return err
		}
		deploySubnet, err := network.NewSubnet(ctx, "deploySubnet", &network.SubnetArgs{
			ResourceGroupName:  deployResourceGroup.Name,
			VirtualNetworkName: deployVirtualNetwork.Name,
			AddressPrefixes: pulumi.StringArray{
				pulumi.String("10.0.1.0/24"),
			},
		})
		if err != nil {
			return err
		}
		deployNetworkSecurityGroup, err := network.NewNetworkSecurityGroup(ctx, "deployNetworkSecurityGroup", &network.NetworkSecurityGroupArgs{
			Location:          deployResourceGroup.Location,
			ResourceGroupName: deployResourceGroup.Name,
			SecurityRules: network.NetworkSecurityGroupSecurityRuleArray{
				&network.NetworkSecurityGroupSecurityRuleArgs{
					Name:                     pulumi.String("AllowSyncWithAzureAD"),
					Priority:                 pulumi.Int(101),
					Direction:                pulumi.String("Inbound"),
					Access:                   pulumi.String("Allow"),
					Protocol:                 pulumi.String("Tcp"),
					SourcePortRange:          pulumi.String("*"),
					DestinationPortRange:     pulumi.String("443"),
					SourceAddressPrefix:      pulumi.String("AzureActiveDirectoryDomainServices"),
					DestinationAddressPrefix: pulumi.String("*"),
				},
				&network.NetworkSecurityGroupSecurityRuleArgs{
					Name:                     pulumi.String("AllowRD"),
					Priority:                 pulumi.Int(201),
					Direction:                pulumi.String("Inbound"),
					Access:                   pulumi.String("Allow"),
					Protocol:                 pulumi.String("Tcp"),
					SourcePortRange:          pulumi.String("*"),
					DestinationPortRange:     pulumi.String("3389"),
					SourceAddressPrefix:      pulumi.String("CorpNetSaw"),
					DestinationAddressPrefix: pulumi.String("*"),
				},
				&network.NetworkSecurityGroupSecurityRuleArgs{
					Name:                     pulumi.String("AllowPSRemoting"),
					Priority:                 pulumi.Int(301),
					Direction:                pulumi.String("Inbound"),
					Access:                   pulumi.String("Allow"),
					Protocol:                 pulumi.String("Tcp"),
					SourcePortRange:          pulumi.String("*"),
					DestinationPortRange:     pulumi.String("5986"),
					SourceAddressPrefix:      pulumi.String("AzureActiveDirectoryDomainServices"),
					DestinationAddressPrefix: pulumi.String("*"),
				},
				&network.NetworkSecurityGroupSecurityRuleArgs{
					Name:                     pulumi.String("AllowLDAPS"),
					Priority:                 pulumi.Int(401),
					Direction:                pulumi.String("Inbound"),
					Access:                   pulumi.String("Allow"),
					Protocol:                 pulumi.String("Tcp"),
					SourcePortRange:          pulumi.String("*"),
					DestinationPortRange:     pulumi.String("636"),
					SourceAddressPrefix:      pulumi.String("*"),
					DestinationAddressPrefix: pulumi.String("*"),
				},
			},
		})
		if err != nil {
			return err
		}
		deploySubnetNetworkSecurityGroupAssociation, err := network.NewSubnetNetworkSecurityGroupAssociation(ctx, "deploySubnetNetworkSecurityGroupAssociation", &network.SubnetNetworkSecurityGroupAssociationArgs{
			SubnetId:               deploySubnet.ID(),
			NetworkSecurityGroupId: deployNetworkSecurityGroup.ID(),
		})
		if err != nil {
			return err
		}
		dcAdmins, err := azuread.NewGroup(ctx, "dcAdmins", &azuread.GroupArgs{
			DisplayName:     pulumi.String("AAD DC Administrators"),
			SecurityEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		adminUser, err := azuread.NewUser(ctx, "adminUser", &azuread.UserArgs{
			UserPrincipalName: pulumi.String("dc-admin@hashicorp-example.com"),
			DisplayName:       pulumi.String("DC Administrator"),
			Password:          pulumi.String("Pa55w0Rd!!1"),
		})
		if err != nil {
			return err
		}
		_, err = azuread.NewGroupMember(ctx, "adminGroupMember", &azuread.GroupMemberArgs{
			GroupObjectId:  dcAdmins.ObjectId,
			MemberObjectId: adminUser.ObjectId,
		})
		if err != nil {
			return err
		}
		exampleServicePrincipal, err := azuread.NewServicePrincipal(ctx, "exampleServicePrincipal", &azuread.ServicePrincipalArgs{
			ApplicationId: pulumi.String("2565bd9d-da50-47d4-8b85-4c97f669dc36"),
		})
		if err != nil {
			return err
		}
		aadds, err := core.NewResourceGroup(ctx, "aadds", &core.ResourceGroupArgs{
			Location: pulumi.String("westeurope"),
		})
		if err != nil {
			return err
		}
		_, err = domainservices.NewService(ctx, "exampleService", &domainservices.ServiceArgs{
			Location:            aadds.Location,
			ResourceGroupName:   aadds.Name,
			DomainName:          pulumi.String("widgetslogin.net"),
			Sku:                 pulumi.String("Enterprise"),
			FilteredSyncEnabled: pulumi.Bool(false),
			InitialReplicaSet: &domainservices.ServiceInitialReplicaSetArgs{
				SubnetId: deploySubnet.ID(),
			},
			Notifications: &domainservices.ServiceNotificationsArgs{
				AdditionalRecipients: pulumi.StringArray{
					pulumi.String("notifyA@example.net"),
					pulumi.String("notifyB@example.org"),
				},
				NotifyDcAdmins:     pulumi.Bool(true),
				NotifyGlobalAdmins: pulumi.Bool(true),
			},
			Security: &domainservices.ServiceSecurityArgs{
				SyncKerberosPasswords: pulumi.Bool(true),
				SyncNtlmPasswords:     pulumi.Bool(true),
				SyncOnPremPasswords:   pulumi.Bool(true),
			},
			Tags: pulumi.StringMap{
				"Environment": pulumi.String("prod"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleServicePrincipal,
			deploySubnetNetworkSecurityGroupAssociation,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.network.VirtualNetwork;
import com.pulumi.azure.network.VirtualNetworkArgs;
import com.pulumi.azure.network.Subnet;
import com.pulumi.azure.network.SubnetArgs;
import com.pulumi.azure.network.NetworkSecurityGroup;
import com.pulumi.azure.network.NetworkSecurityGroupArgs;
import com.pulumi.azure.network.inputs.NetworkSecurityGroupSecurityRuleArgs;
import com.pulumi.azure.network.SubnetNetworkSecurityGroupAssociation;
import com.pulumi.azure.network.SubnetNetworkSecurityGroupAssociationArgs;
import com.pulumi.azuread.Group;
import com.pulumi.azuread.GroupArgs;
import com.pulumi.azuread.User;
import com.pulumi.azuread.UserArgs;
import com.pulumi.azuread.GroupMember;
import com.pulumi.azuread.GroupMemberArgs;
import com.pulumi.azuread.ServicePrincipal;
import com.pulumi.azuread.ServicePrincipalArgs;
import com.pulumi.azure.domainservices.Service;
import com.pulumi.azure.domainservices.ServiceArgs;
import com.pulumi.azure.domainservices.inputs.ServiceInitialReplicaSetArgs;
import com.pulumi.azure.domainservices.inputs.ServiceNotificationsArgs;
import com.pulumi.azure.domainservices.inputs.ServiceSecurityArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var deployResourceGroup = new ResourceGroup("deployResourceGroup", ResourceGroupArgs.builder()        
            .location("West Europe")
            .build());

        var deployVirtualNetwork = new VirtualNetwork("deployVirtualNetwork", VirtualNetworkArgs.builder()        
            .location(deployResourceGroup.location())
            .resourceGroupName(deployResourceGroup.name())
            .addressSpaces("10.0.1.0/16")
            .build());

        var deploySubnet = new Subnet("deploySubnet", SubnetArgs.builder()        
            .resourceGroupName(deployResourceGroup.name())
            .virtualNetworkName(deployVirtualNetwork.name())
            .addressPrefixes("10.0.1.0/24")
            .build());

        var deployNetworkSecurityGroup = new NetworkSecurityGroup("deployNetworkSecurityGroup", NetworkSecurityGroupArgs.builder()        
            .location(deployResourceGroup.location())
            .resourceGroupName(deployResourceGroup.name())
            .securityRules(            
                NetworkSecurityGroupSecurityRuleArgs.builder()
                    .name("AllowSyncWithAzureAD")
                    .priority(101)
                    .direction("Inbound")
                    .access("Allow")
                    .protocol("Tcp")
                    .sourcePortRange("*")
                    .destinationPortRange("443")
                    .sourceAddressPrefix("AzureActiveDirectoryDomainServices")
                    .destinationAddressPrefix("*")
                    .build(),
                NetworkSecurityGroupSecurityRuleArgs.builder()
                    .name("AllowRD")
                    .priority(201)
                    .direction("Inbound")
                    .access("Allow")
                    .protocol("Tcp")
                    .sourcePortRange("*")
                    .destinationPortRange("3389")
                    .sourceAddressPrefix("CorpNetSaw")
                    .destinationAddressPrefix("*")
                    .build(),
                NetworkSecurityGroupSecurityRuleArgs.builder()
                    .name("AllowPSRemoting")
                    .priority(301)
                    .direction("Inbound")
                    .access("Allow")
                    .protocol("Tcp")
                    .sourcePortRange("*")
                    .destinationPortRange("5986")
                    .sourceAddressPrefix("AzureActiveDirectoryDomainServices")
                    .destinationAddressPrefix("*")
                    .build(),
                NetworkSecurityGroupSecurityRuleArgs.builder()
                    .name("AllowLDAPS")
                    .priority(401)
                    .direction("Inbound")
                    .access("Allow")
                    .protocol("Tcp")
                    .sourcePortRange("*")
                    .destinationPortRange("636")
                    .sourceAddressPrefix("*")
                    .destinationAddressPrefix("*")
                    .build())
            .build());

        var deploySubnetNetworkSecurityGroupAssociation = new SubnetNetworkSecurityGroupAssociation("deploySubnetNetworkSecurityGroupAssociation", SubnetNetworkSecurityGroupAssociationArgs.builder()        
            .subnetId(deploySubnet.id())
            .networkSecurityGroupId(deployNetworkSecurityGroup.id())
            .build());

        var dcAdmins = new Group("dcAdmins", GroupArgs.builder()        
            .displayName("AAD DC Administrators")
            .securityEnabled(true)
            .build());

        var adminUser = new User("adminUser", UserArgs.builder()        
            .userPrincipalName("dc-admin@hashicorp-example.com")
            .displayName("DC Administrator")
            .password("Pa55w0Rd!!1")
            .build());

        var adminGroupMember = new GroupMember("adminGroupMember", GroupMemberArgs.builder()        
            .groupObjectId(dcAdmins.objectId())
            .memberObjectId(adminUser.objectId())
            .build());

        var exampleServicePrincipal = new ServicePrincipal("exampleServicePrincipal", ServicePrincipalArgs.builder()        
            .applicationId("2565bd9d-da50-47d4-8b85-4c97f669dc36")
            .build());

        var aadds = new ResourceGroup("aadds", ResourceGroupArgs.builder()        
            .location("westeurope")
            .build());

        var exampleService = new Service("exampleService", ServiceArgs.builder()        
            .location(aadds.location())
            .resourceGroupName(aadds.name())
            .domainName("widgetslogin.net")
            .sku("Enterprise")
            .filteredSyncEnabled(false)
            .initialReplicaSet(ServiceInitialReplicaSetArgs.builder()
                .subnetId(deploySubnet.id())
                .build())
            .notifications(ServiceNotificationsArgs.builder()
                .additionalRecipients(                
                    "notifyA@example.net",
                    "notifyB@example.org")
                .notifyDcAdmins(true)
                .notifyGlobalAdmins(true)
                .build())
            .security(ServiceSecurityArgs.builder()
                .syncKerberosPasswords(true)
                .syncNtlmPasswords(true)
                .syncOnPremPasswords(true)
                .build())
            .tags(Map.of("Environment", "prod"))
            .build(), CustomResourceOptions.builder()
                .dependsOn(                
                    exampleServicePrincipal,
                    deploySubnetNetworkSecurityGroupAssociation)
                .build());

    }
}

import pulumi
import pulumi_azure as azure
import pulumi_azuread as azuread

deploy_resource_group = azure.core.ResourceGroup("deployResourceGroup", location="West Europe")
deploy_virtual_network = azure.network.VirtualNetwork("deployVirtualNetwork",
    location=deploy_resource_group.location,
    resource_group_name=deploy_resource_group.name,
    address_spaces=["10.0.1.0/16"])
deploy_subnet = azure.network.Subnet("deploySubnet",
    resource_group_name=deploy_resource_group.name,
    virtual_network_name=deploy_virtual_network.name,
    address_prefixes=["10.0.1.0/24"])
deploy_network_security_group = azure.network.NetworkSecurityGroup("deployNetworkSecurityGroup",
    location=deploy_resource_group.location,
    resource_group_name=deploy_resource_group.name,
    security_rules=[
        azure.network.NetworkSecurityGroupSecurityRuleArgs(
            name="AllowSyncWithAzureAD",
            priority=101,
            direction="Inbound",
            access="Allow",
            protocol="Tcp",
            source_port_range="*",
            destination_port_range="443",
            source_address_prefix="AzureActiveDirectoryDomainServices",
            destination_address_prefix="*",
        ),
        azure.network.NetworkSecurityGroupSecurityRuleArgs(
            name="AllowRD",
            priority=201,
            direction="Inbound",
            access="Allow",
            protocol="Tcp",
            source_port_range="*",
            destination_port_range="3389",
            source_address_prefix="CorpNetSaw",
            destination_address_prefix="*",
        ),
        azure.network.NetworkSecurityGroupSecurityRuleArgs(
            name="AllowPSRemoting",
            priority=301,
            direction="Inbound",
            access="Allow",
            protocol="Tcp",
            source_port_range="*",
            destination_port_range="5986",
            source_address_prefix="AzureActiveDirectoryDomainServices",
            destination_address_prefix="*",
        ),
        azure.network.NetworkSecurityGroupSecurityRuleArgs(
            name="AllowLDAPS",
            priority=401,
            direction="Inbound",
            access="Allow",
            protocol="Tcp",
            source_port_range="*",
            destination_port_range="636",
            source_address_prefix="*",
            destination_address_prefix="*",
        ),
    ])
deploy_subnet_network_security_group_association = azure.network.SubnetNetworkSecurityGroupAssociation("deploySubnetNetworkSecurityGroupAssociation",
    subnet_id=deploy_subnet.id,
    network_security_group_id=deploy_network_security_group.id)
dc_admins = azuread.Group("dcAdmins",
    display_name="AAD DC Administrators",
    security_enabled=True)
admin_user = azuread.User("adminUser",
    user_principal_name="dc-admin@hashicorp-example.com",
    display_name="DC Administrator",
    password="Pa55w0Rd!!1")
admin_group_member = azuread.GroupMember("adminGroupMember",
    group_object_id=dc_admins.object_id,
    member_object_id=admin_user.object_id)
example_service_principal = azuread.ServicePrincipal("exampleServicePrincipal", application_id="2565bd9d-da50-47d4-8b85-4c97f669dc36")
# published app for domain services
aadds = azure.core.ResourceGroup("aadds", location="westeurope")
example_service = azure.domainservices.Service("exampleService",
    location=aadds.location,
    resource_group_name=aadds.name,
    domain_name="widgetslogin.net",
    sku="Enterprise",
    filtered_sync_enabled=False,
    initial_replica_set=azure.domainservices.ServiceInitialReplicaSetArgs(
        subnet_id=deploy_subnet.id,
    ),
    notifications=azure.domainservices.ServiceNotificationsArgs(
        additional_recipients=[
            "notifyA@example.net",
            "notifyB@example.org",
        ],
        notify_dc_admins=True,
        notify_global_admins=True,
    ),
    security=azure.domainservices.ServiceSecurityArgs(
        sync_kerberos_passwords=True,
        sync_ntlm_passwords=True,
        sync_on_prem_passwords=True,
    ),
    tags={
        "Environment": "prod",
    },
    opts=pulumi.ResourceOptions(depends_on=[
            example_service_principal,
            deploy_subnet_network_security_group_association,
        ]))

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
import * as azuread from "@pulumi/azuread";

const deployResourceGroup = new azure.core.ResourceGroup("deployResourceGroup", {location: "West Europe"});
const deployVirtualNetwork = new azure.network.VirtualNetwork("deployVirtualNetwork", {
    location: deployResourceGroup.location,
    resourceGroupName: deployResourceGroup.name,
    addressSpaces: ["10.0.1.0/16"],
});
const deploySubnet = new azure.network.Subnet("deploySubnet", {
    resourceGroupName: deployResourceGroup.name,
    virtualNetworkName: deployVirtualNetwork.name,
    addressPrefixes: ["10.0.1.0/24"],
});
const deployNetworkSecurityGroup = new azure.network.NetworkSecurityGroup("deployNetworkSecurityGroup", {
    location: deployResourceGroup.location,
    resourceGroupName: deployResourceGroup.name,
    securityRules: [
        {
            name: "AllowSyncWithAzureAD",
            priority: 101,
            direction: "Inbound",
            access: "Allow",
            protocol: "Tcp",
            sourcePortRange: "*",
            destinationPortRange: "443",
            sourceAddressPrefix: "AzureActiveDirectoryDomainServices",
            destinationAddressPrefix: "*",
        },
        {
            name: "AllowRD",
            priority: 201,
            direction: "Inbound",
            access: "Allow",
            protocol: "Tcp",
            sourcePortRange: "*",
            destinationPortRange: "3389",
            sourceAddressPrefix: "CorpNetSaw",
            destinationAddressPrefix: "*",
        },
        {
            name: "AllowPSRemoting",
            priority: 301,
            direction: "Inbound",
            access: "Allow",
            protocol: "Tcp",
            sourcePortRange: "*",
            destinationPortRange: "5986",
            sourceAddressPrefix: "AzureActiveDirectoryDomainServices",
            destinationAddressPrefix: "*",
        },
        {
            name: "AllowLDAPS",
            priority: 401,
            direction: "Inbound",
            access: "Allow",
            protocol: "Tcp",
            sourcePortRange: "*",
            destinationPortRange: "636",
            sourceAddressPrefix: "*",
            destinationAddressPrefix: "*",
        },
    ],
});
const deploySubnetNetworkSecurityGroupAssociation = new azure.network.SubnetNetworkSecurityGroupAssociation("deploySubnetNetworkSecurityGroupAssociation", {
    subnetId: deploySubnet.id,
    networkSecurityGroupId: deployNetworkSecurityGroup.id,
});
const dcAdmins = new azuread.Group("dcAdmins", {
    displayName: "AAD DC Administrators",
    securityEnabled: true,
});
const adminUser = new azuread.User("adminUser", {
    userPrincipalName: "dc-admin@hashicorp-example.com",
    displayName: "DC Administrator",
    password: "Pa55w0Rd!!1",
});
const adminGroupMember = new azuread.GroupMember("adminGroupMember", {
    groupObjectId: dcAdmins.objectId,
    memberObjectId: adminUser.objectId,
});
const exampleServicePrincipal = new azuread.ServicePrincipal("exampleServicePrincipal", {applicationId: "2565bd9d-da50-47d4-8b85-4c97f669dc36"});
// published app for domain services
const aadds = new azure.core.ResourceGroup("aadds", {location: "westeurope"});
const exampleService = new azure.domainservices.Service("exampleService", {
    location: aadds.location,
    resourceGroupName: aadds.name,
    domainName: "widgetslogin.net",
    sku: "Enterprise",
    filteredSyncEnabled: false,
    initialReplicaSet: {
        subnetId: deploySubnet.id,
    },
    notifications: {
        additionalRecipients: [
            "notifyA@example.net",
            "notifyB@example.org",
        ],
        notifyDcAdmins: true,
        notifyGlobalAdmins: true,
    },
    security: {
        syncKerberosPasswords: true,
        syncNtlmPasswords: true,
        syncOnPremPasswords: true,
    },
    tags: {
        Environment: "prod",
    },
}, {
    dependsOn: [
        exampleServicePrincipal,
        deploySubnetNetworkSecurityGroupAssociation,
    ],
});

resources:
  deployResourceGroup:
    type: azure:core:ResourceGroup
    properties:
      location: West Europe
  deployVirtualNetwork:
    type: azure:network:VirtualNetwork
    properties:
      location: ${deployResourceGroup.location}
      resourceGroupName: ${deployResourceGroup.name}
      addressSpaces:
        - 10.0.1.0/16
  deploySubnet:
    type: azure:network:Subnet
    properties:
      resourceGroupName: ${deployResourceGroup.name}
      virtualNetworkName: ${deployVirtualNetwork.name}
      addressPrefixes:
        - 10.0.1.0/24
  deployNetworkSecurityGroup:
    type: azure:network:NetworkSecurityGroup
    properties:
      location: ${deployResourceGroup.location}
      resourceGroupName: ${deployResourceGroup.name}
      securityRules:
        - name: AllowSyncWithAzureAD
          priority: 101
          direction: Inbound
          access: Allow
          protocol: Tcp
          sourcePortRange: '*'
          destinationPortRange: '443'
          sourceAddressPrefix: AzureActiveDirectoryDomainServices
          destinationAddressPrefix: '*'
        - name: AllowRD
          priority: 201
          direction: Inbound
          access: Allow
          protocol: Tcp
          sourcePortRange: '*'
          destinationPortRange: '3389'
          sourceAddressPrefix: CorpNetSaw
          destinationAddressPrefix: '*'
        - name: AllowPSRemoting
          priority: 301
          direction: Inbound
          access: Allow
          protocol: Tcp
          sourcePortRange: '*'
          destinationPortRange: '5986'
          sourceAddressPrefix: AzureActiveDirectoryDomainServices
          destinationAddressPrefix: '*'
        - name: AllowLDAPS
          priority: 401
          direction: Inbound
          access: Allow
          protocol: Tcp
          sourcePortRange: '*'
          destinationPortRange: '636'
          sourceAddressPrefix: '*'
          destinationAddressPrefix: '*'
  deploySubnetNetworkSecurityGroupAssociation:
    type: azure:network:SubnetNetworkSecurityGroupAssociation
    properties:
      subnetId: ${deploySubnet.id}
      networkSecurityGroupId: ${deployNetworkSecurityGroup.id}
  dcAdmins:
    type: azuread:Group
    properties:
      displayName: AAD DC Administrators
      securityEnabled: true
  adminUser:
    type: azuread:User
    properties:
      userPrincipalName: dc-admin@hashicorp-example.com
      displayName: DC Administrator
      password: Pa55w0Rd!!1
  adminGroupMember:
    type: azuread:GroupMember
    properties:
      groupObjectId: ${dcAdmins.objectId}
      memberObjectId: ${adminUser.objectId}
  exampleServicePrincipal:
    type: azuread:ServicePrincipal
    properties:
      applicationId: 2565bd9d-da50-47d4-8b85-4c97f669dc36
  aadds:
    type: azure:core:ResourceGroup
    properties:
      location: westeurope
  exampleService:
    type: azure:domainservices:Service
    properties:
      location: ${aadds.location}
      resourceGroupName: ${aadds.name}
      domainName: widgetslogin.net
      sku: Enterprise
      filteredSyncEnabled: false
      initialReplicaSet:
        subnetId: ${deploySubnet.id}
      notifications:
        additionalRecipients:
          - notifyA@example.net
          - notifyB@example.org
        notifyDcAdmins: true
        notifyGlobalAdmins: true
      security:
        syncKerberosPasswords: true
        syncNtlmPasswords: true
        syncOnPremPasswords: true
      tags:
        Environment: prod
    options:
      dependson:
        - ${exampleServicePrincipal}
        - ${deploySubnetNetworkSecurityGroupAssociation}