Key vault IP Restriction for Cosmos apps

{{cookiecutter.__src_folder_name}}/infra/core/security/keyvault.bicep

@@ -5,13 +5,27 @@
 
 param principalId string = ''
 
+// Allow public network access to Key Vault
+param allowPublicNetworkAccess bool = true
+
+// Allow all Azure services to bypass Key Vault network rules
+param allowAzureServicesAccess bool = true
+
+param networkAcls object = {
+  bypass: allowAzureServicesAccess ? 'AzureServices' : 'None'
+  defaultAction: allowPublicNetworkAccess ? 'Allow' : 'Deny'
+  ipRules: []
+  virtualNetworkRules: []
+}
+
 resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
   name: name
   location: location
   tags: tags
   properties: {
     tenantId: subscription().tenantId
     sku: { family: 'A', name: 'standard' }
+    networkAcls: networkAcls
     accessPolicies: !empty(principalId) ? [
       {
         objectId: principalId

{{cookiecutter.__src_folder_name}}/infra/main.bicep

@@ -32,6 +32,10 @@ var resourceToken = toLower(uniqueString(subscription().id, name, location))
 var prefix = '${name}-${resourceToken}'
 var tags = { 'azd-env-name': name }
 
+var allowAzureServicesAccess = true
+var defaultAction = false
+
+
 resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
   name: '${name}-rg'
   location: location
@@ -47,6 +51,11 @@ module keyVault './core/security/keyvault.bicep' = {
     location: location
     tags: tags
     principalId: principalId
+    allowPublicNetworkAccess: false
+    networkAcls: {
+      allowAzureServicesAccess: allowAzureServicesAccess
+      defaultAction: defaultAction
+    }
   }
 }