{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "publisherEmail": {
      "type": "string",
      "defaultValue" : "contoso@contoso.com",
      "minLength": 1,
      "metadata": {
        "description": "The email address of the owner of the service"
      }
    },
    "publisherName": {
      "type": "string",
      "defaultValue" : "Contoso",
      "minLength": 1,
      "metadata": {
        "description": "The name of the owner of the service"
      }
    },
    "sku": {
      "type": "string",
      "allowedValues": [
        "Basic",
        "Consumption",
        "Developer",
        "Standard",
        "Premium"
      ],
      "defaultValue": "Standard",
      "metadata": {
        "description": "The pricing tier of this API Management service"
      }
    },
    "skuCount": {
      "type": "int",
      "defaultValue": 1,
      "metadata": {
        "description": "The instance size of this API Management service."
      }
    },
    "Secrets": {
      "type": "array",
      "metadata": {
        "description": "An array of json objects like this : {'name':name, 'value':value}"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    },
    "keyVaultName": {
      "type": "string",
      "defaultValue": "[concat('kv-', uniqueString(resourceGroup().id))]",
      "metadata": {
        "description": "Name of the KeyVault to provision"
      }
    },
    "gatewayCustomHostname": {
      "type": "string",
      "metadata": {
        "description": "Name of the gateway custom hostname"
      }
    }
  },
  "variables": {
    "apiManagementServiceName": "[concat('apim-', uniqueString(resourceGroup().id))]",
    "identityName": "[concat('id-', uniqueString(resourceGroup().id))]",
    "identityID": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
      "name": "[variables('identityName')]",
      "apiVersion": "2018-11-30",
      "location": "[parameters('location')]"
    },
    {
      "type": "Microsoft.KeyVault/vaults",
      "apiVersion": "2019-09-01",
      "name": "[parameters('keyVaultName')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))]"
      ],
      "properties": {
        "sku": {
          "name": "standard",
          "family": "A"
        },
        "tenantId": "[reference(variables('identityID')).tenantId]",
        "accessPolicies": [
          {
            "tenantId": "[reference(variables('identityID')).tenantId]",
            "objectId": "[reference(variables('identityID')).principalId]",
            "permissions": {
              "secrets": [
                "get"
              ]
            }
          }
        ],
        "enableSoftDelete": true
      }
    },
    {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "apiVersion": "2019-09-01",
      "name": "[concat(parameters('keyVaultName'), '/', parameters('Secrets')[copyIndex()].name)]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
      ],
      "copy": {
        "name": "secretcopy",
        "count": "[length(parameters('Secrets'))]"
      },
      "properties": {
        "value": "[parameters('Secrets')[copyIndex()].value]",
        "recoveryLevel": "Purgeable",
        "contentType": "application/x-pkcs12",
        "attributes": {
          "enabled": true,
          "nbf": 1585206000,
          "exp": 1679814000
        }
      }
    },
    {
      "apiVersion": "2020-06-01-preview",
      "type": "Microsoft.ApiManagement/service",
      "name": "[variables('apiManagementServiceName')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
      ],
      "identity": {
        "type": "UserAssigned",
        "userAssignedIdentities": {
          "[variables('identityID')]": {
          }
        }
      },
      "sku": {
        "name": "[parameters('sku')]",
        "capacity": "[parameters('skuCount')]"
      },
      "properties": {
        "hostnameConfigurations": [
          {
            "type": "Proxy",
            "hostName": "[parameters('gatewayCustomHostname')]",
            "keyVaultId": "[concat(reference(parameters('keyVaultName')).vaultUri,'secrets/sslcert')]",
            "identityClientId": "[reference(variables('identityID')).clientId]",
            "defaultSslBinding": true
          }
        ],
        "publisherEmail": "[parameters('publisherEmail')]",
        "publisherName": "[parameters('publisherName')]",
        "customProperties": {
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_GCM_SHA256": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA256": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA256": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_256_CBC_SHA": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TLS_RSA_WITH_AES_128_CBC_SHA": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30": false,
          "Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2": false
        }
      }
    }
  ]
}
