Skip to content

Commit abb00aa

Browse files
pamelafoxpamelafox
committed
Usving avm for the subnets
1 parent ced5983 commit abb00aa

File tree

2 files changed

+217
-80
lines changed

2 files changed

+217
-80
lines changed

‎infra/main.bicep‎

Lines changed: 49 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1155,14 +1155,15 @@ module cosmosDbRoleBackend 'core/security/documentdb-sql-role.bicep' = if (useAu
11551155
}
11561156
}
11571157

1158+
1159+
11581160
module isolation 'network-isolation.bicep' = if (usePrivateEndpoint) {
11591161
name: 'networks'
11601162
scope: resourceGroup
11611163
params: {
11621164
location: location
11631165
tags: tags
11641166
vnetName: '${abbrs.virtualNetworks}${resourceToken}'
1165-
usePrivateEndpoint: usePrivateEndpoint
11661167
deployVpnGateway: useVpnGateway
11671168
deploymentTarget: deploymentTarget
11681169
// Need to check deploymentTarget due to https://github.com/Azure/bicep/issues/3990
@@ -1208,11 +1209,6 @@ var otherPrivateEndpointConnections = (usePrivateEndpoint)
12081209
dnsZoneName: 'privatelink.search.windows.net'
12091210
resourceIds: [searchService.outputs.id]
12101211
}
1211-
{
1212-
groupId: 'managedEnvironments'
1213-
dnsZoneName: 'privatelink.${location}.azurecontainerapps.io'
1214-
resourceIds: [containerApps.outputs.environmentId]
1215-
}
12161212
{
12171213
groupId: 'sql'
12181214
dnsZoneName: 'privatelink.documents.azure.com'
@@ -1256,6 +1252,53 @@ module dnsResolver 'br/public:avm/res/network/dns-resolver:0.5.4' = if (useVpnGa
12561252
}
12571253
}
12581254

1255+
// Container Apps Private DNS Zone
1256+
module containerAppsPrivateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.1' = if (usePrivateEndpoint && deploymentTarget == 'containerapps') {
1257+
name: 'container-apps-dns-zone'
1258+
scope: resourceGroup
1259+
params: {
1260+
name: 'privatelink.${location}.azurecontainerapps.io'
1261+
tags: tags
1262+
virtualNetworkLinks: [
1263+
{
1264+
registrationEnabled: false
1265+
virtualNetworkResourceId: isolation.outputs.vnetId
1266+
}
1267+
]
1268+
}
1269+
}
1270+
1271+
// Container Apps Environment Private Endpoint
1272+
// https://learn.microsoft.com/azure/container-apps/how-to-use-private-endpoint
1273+
module containerAppsEnvironmentPrivateEndpoint 'br/public:avm/res/network/private-endpoint:0.11.0' = if (usePrivateEndpoint && deploymentTarget == 'containerapps') {
1274+
name: 'containerAppsEnvironmentPrivateEndpointDeployment'
1275+
scope: resourceGroup
1276+
params: {
1277+
name: 'container-apps-env-pe${resourceToken}'
1278+
location: location
1279+
tags: tags
1280+
subnetResourceId: isolation.outputs.appSubnetId
1281+
privateDnsZoneGroup: {
1282+
privateDnsZoneGroupConfigs: [
1283+
{
1284+
privateDnsZoneResourceId: containerAppsPrivateDnsZone.outputs.resourceId
1285+
}
1286+
]
1287+
}
1288+
privateLinkServiceConnections: [
1289+
{
1290+
name: 'containerAppsEnvironmentConnection'
1291+
properties: {
1292+
groupIds: [
1293+
'managedEnvironments'
1294+
]
1295+
privateLinkServiceId: containerApps.outputs.environmentId
1296+
}
1297+
}
1298+
]
1299+
}
1300+
}
1301+
12591302
module virtualNetworkGateway 'br/public:avm/res/network/virtual-network-gateway:0.8.0' = if (useVpnGateway) {
12601303
name: 'virtual-network-gateway'
12611304
scope: resourceGroup

‎infra/network-isolation.bicep‎

Lines changed: 168 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@ param location string = resourceGroup().location
99
@description('The tags to apply to all resources')
1010
param tags object = {}
1111

12-
param usePrivateEndpoint bool = false
13-
1412
@allowed(['appservice', 'containerapps'])
1513
param deploymentTarget string
1614

@@ -26,95 +24,191 @@ resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' existing = if (de
2624
name: appServicePlanName
2725
}
2826

29-
resource containerAppsEnvironment 'Microsoft.App/managedEnvironments@2023-05-01' existing = if (deploymentTarget == 'containerapps') {
30-
name: containerAppsEnvName
27+
module containerAppsNSG 'br/public:avm/res/network/network-security-group:0.5.1' = if (deploymentTarget == 'containerapps') {
28+
name: 'container-apps-nsg'
29+
params: {
30+
name: '${vnetName}-container-apps-nsg'
31+
location: location
32+
tags: tags
33+
securityRules: [
34+
{
35+
name: 'AllowHttpsInbound'
36+
properties: {
37+
protocol: 'Tcp'
38+
sourcePortRange: '*'
39+
sourceAddressPrefix: 'Internet'
40+
destinationPortRange: '443'
41+
destinationAddressPrefix: '*'
42+
access: 'Allow'
43+
priority: 100
44+
direction: 'Inbound'
45+
}
46+
}
47+
]
48+
}
3149
}
3250

33-
// Always need this one
34-
var backendSubnet = {
35-
name: 'backend-subnet'
51+
module privateEndpointsNSG 'br/public:avm/res/network/network-security-group:0.5.1' = if (deploymentTarget == 'containerapps') {
52+
name: 'private-endpoints-nsg'
53+
params: {
54+
name: '${vnetName}-private-endpoints-nsg'
55+
location: location
56+
tags: tags
57+
securityRules: [
58+
{
59+
name: 'AllowVnetInBound'
3660
properties: {
37-
addressPrefix: '10.0.1.0/24'
38-
privateEndpointNetworkPolicies: 'Enabled'
39-
privateLinkServiceNetworkPolicies: 'Enabled'
61+
protocol: '*'
62+
sourcePortRange: '*'
63+
sourceAddressPrefix: 'VirtualNetwork'
64+
destinationPortRange: '*'
65+
destinationAddressPrefix: '*'
66+
access: 'Allow'
67+
priority: 100
68+
direction: 'Inbound'
4069
}
4170
}
42-
43-
var appServiceSubnet = {
44-
name: 'app-int-subnet'
45-
properties: {
46-
addressPrefix: '10.0.3.0/24'
47-
privateEndpointNetworkPolicies: 'Enabled'
48-
privateLinkServiceNetworkPolicies: 'Enabled'
49-
delegations: [
50-
{
51-
id: appServicePlan.id
52-
name: appServicePlan.name
53-
properties: {
54-
serviceName: 'Microsoft.Web/serverFarms'
55-
}
56-
}
57-
]
71+
{
72+
name: 'AllowAzureLoadBalancerInbound'
73+
properties: {
74+
protocol: '*'
75+
sourcePortRange: '*'
76+
sourceAddressPrefix: 'AzureLoadBalancer'
77+
destinationPortRange: '*'
78+
destinationAddressPrefix: '*'
79+
access: 'Allow'
80+
priority: 110
81+
direction: 'Inbound'
82+
}
5883
}
59-
}
60-
61-
var containerAppsSubnet = {
62-
name: 'app-int-subnet'
63-
properties: {
64-
addressPrefix: '10.0.4.0/23'
65-
privateEndpointNetworkPolicies: 'Enabled'
66-
privateLinkServiceNetworkPolicies: 'Enabled'
67-
delegations: [
68-
{
69-
id: containerAppsEnvironment.id
70-
name: containerAppsEnvironment.name
71-
properties: {
72-
serviceName: 'Microsoft.App/environments'
73-
}
74-
}
75-
]
84+
{
85+
name: 'DenyInternetInbound'
86+
properties: {
87+
protocol: '*'
88+
sourcePortRange: '*'
89+
sourceAddressPrefix: 'Internet'
90+
destinationPortRange: '*'
91+
destinationAddressPrefix: '*'
92+
access: 'Deny'
93+
priority: 4096
94+
direction: 'Inbound'
95+
}
7696
}
77-
}
78-
79-
var gatewaySubnet = {
80-
name: 'GatewaySubnet' // Required name for Gateway subnet
81-
properties: {
82-
addressPrefix: '10.0.255.0/27' // Using a /27 subnet size which is minimal required size for gateway subnet
83-
}
97+
{
98+
name: 'AllowVnetOutbound'
99+
properties: {
100+
protocol: '*'
101+
sourcePortRange: '*'
102+
sourceAddressPrefix: '*'
103+
destinationPortRange: '*'
104+
destinationAddressPrefix: 'VirtualNetwork'
105+
access: 'Allow'
106+
priority: 100
107+
direction: 'Outbound'
108+
}
109+
}
110+
{
111+
name: 'AllowAzureCloudOutbound'
112+
properties: {
113+
protocol: 'Tcp'
114+
sourcePortRange: '*'
115+
sourceAddressPrefix: '*'
116+
destinationPortRange: '443'
117+
destinationAddressPrefix: 'AzureCloud'
118+
access: 'Allow'
119+
priority: 110
120+
direction: 'Outbound'
121+
}
122+
}
123+
{
124+
name: 'AllowDnsOutbound'
125+
properties: {
126+
protocol: '*'
127+
sourcePortRange: '*'
128+
sourceAddressPrefix: '*'
129+
destinationPortRange: '53'
130+
destinationAddressPrefix: '*'
131+
access: 'Allow'
132+
priority: 120
133+
direction: 'Outbound'
134+
}
135+
}
136+
{
137+
name: 'DenyInternetOutbound'
138+
properties: {
139+
protocol: '*'
140+
sourcePortRange: '*'
141+
sourceAddressPrefix: '*'
142+
destinationPortRange: '*'
143+
destinationAddressPrefix: 'Internet'
144+
access: 'Deny'
145+
priority: 4096
146+
direction: 'Outbound'
147+
}
148+
}
149+
]
84150
}
151+
}
85152

86-
var privateDnsResolverSubnet = {
87-
name: 'dns-resolver-subnet' // Dedicated subnet for Azure Private DNS Resolver
88-
properties: {
89-
addressPrefix: '10.0.11.0/28' // Original value kept as requested
90-
delegations: [
91-
{
92-
name: 'Microsoft.Network.dnsResolvers'
93-
properties: {
94-
serviceName: 'Microsoft.Network/dnsResolvers'
95-
}
153+
var appServiceSubnet = {
154+
name: 'app-int-subnet'
155+
properties: {
156+
addressPrefix: '10.0.3.0/24'
157+
privateEndpointNetworkPolicies: 'Enabled'
158+
privateLinkServiceNetworkPolicies: 'Enabled'
159+
delegations: [
160+
{
161+
id: appServicePlan.id
162+
name: appServicePlan.name
163+
properties: {
164+
serviceName: 'Microsoft.Web/serverFarms'
96165
}
97-
]
98-
}
166+
}
167+
]
99168
}
169+
}
100170

101-
var subnets = union(
102-
[backendSubnet, deploymentTarget == 'appservice' ? appServiceSubnet : containerAppsSubnet],
103-
deployVpnGateway ? [gatewaySubnet, privateDnsResolverSubnet] : [])
104-
105-
module vnet './core/networking/vnet.bicep' = if (usePrivateEndpoint) {
171+
module vnet 'br/public:avm/res/network/virtual-network:0.6.1' = {
106172
name: 'vnet'
107173
params: {
108174
name: vnetName
109175
location: location
110176
tags: tags
111-
subnets: subnets
177+
addressPrefixes: [
178+
'10.0.0.0/16'
179+
]
180+
subnets: [
181+
{
182+
name: 'backend-subnet'
183+
addressPrefix: '10.0.1.0/24'
184+
privateEndpointNetworkPolicies: 'Enabled'
185+
privateLinkServiceNetworkPolicies: 'Enabled'
186+
networkSecurityGroupResourceId: privateEndpointsNSG.outputs.resourceId
187+
}
188+
{
189+
name: 'GatewaySubnet' // Required name for Gateway subnet
190+
addressPrefix: '10.0.255.0/27' // Using a /27 subnet size which is minimal required size for gateway subnet
191+
}
192+
{
193+
name: 'dns-resolver-subnet' // Dedicated subnet for Azure Private DNS Resolver
194+
addressPrefix: '10.0.11.0/28' // Original value kept as requested
195+
delegation: 'Microsoft.Network/dnsResolvers'
196+
}
197+
{
198+
name: 'app-int-subnet'
199+
addressPrefix: '10.0.4.0/23'
200+
//privateEndpointNetworkPolicies: 'Enabled'
201+
//privateLinkServiceNetworkPolicies: 'Enabled'
202+
networkSecurityGroupResourceId: containerAppsNSG.outputs.resourceId
203+
delegation: 'Microsoft.App/environments'
204+
}
205+
]
112206
}
113207
}
114208

115-
output appSubnetId string = usePrivateEndpoint ? vnet.outputs.vnetSubnets[1].id : ''
116-
output appSubnetName string = usePrivateEndpoint ? vnet.outputs.vnetSubnets[1].name : ''
117-
output backendSubnetId string = usePrivateEndpoint ? vnet.outputs.vnetSubnets[0].id : ''
118-
output privateDnsResolverSubnetId string = deployVpnGateway ? vnet.outputs.vnetSubnets[3].id : ''
119-
output vnetName string = usePrivateEndpoint ? vnet.outputs.name : ''
120-
output vnetId string = usePrivateEndpoint ? vnet.outputs.id : ''
209+
210+
output backendSubnetId string = vnet.outputs.subnetResourceIds[0]
211+
output privateDnsResolverSubnetId string = deployVpnGateway ? vnet.outputs.subnetResourceIds[2] : ''
212+
output appSubnetId string = vnet.outputs.subnetResourceIds[3]
213+
output vnetName string = vnet.outputs.name
214+
output vnetId string = vnet.outputs.resourceId

0 commit comments

Comments
 (0)