Skip to content

Commit 434ceca

Browse files
spelluruspelluru
committed
updated CLI code
1 parent 3e52cd2 commit 434ceca

File tree

3 files changed

+172
-72
lines changed

3 files changed

+172
-72
lines changed

‎articles/event-grid/configure-firewall.md

Lines changed: 94 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: spelluru
66

77
ms.service: event-grid
88
ms.topic: conceptual
9-
ms.date: 03/11/2020
9+
ms.date: 04/22/2020
1010
ms.author: spelluru
1111
---
1212

@@ -34,57 +34,121 @@ This section shows you how to use the Azure portal to create inbound IP firewall
3434
## Use Azure CLI
3535
This section shows you how to use Azure CLI commands to create topics with inbound IP rules. The steps shown in this section are for topics. You can use similar steps to create inbound IP rules for **domains**.
3636

37+
### Enable or disable public network access
38+
By default, the public network access is enabled for topics and domains. You can also enable it explicitly or disable it. You can restrict traffic by configuring inbound IP firewall rules.
3739

38-
### Enable public network access for an existing topic
39-
By default, the public network access is enabled for topics and domains. You can restrict traffic by configuring inbound IP firewall rules.
40+
#### Enable public network access while creating a topic
4041

4142
```azurecli-interactive
42-
az rest --method patch --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" --body "{\""properties\"": {\""publicNetworkAccess\"": \""Enabled\""}}"
43+
az eventgrid topic create \
44+
--resource-group $resourceGroupName \
45+
--name $topicName \
46+
--location $location \
47+
--public-network-access enabled
4348
```
4449

45-
### Disable public network access for an existing topic
46-
When public network access is disabled for a topic or domain, traffic over public internet isn't allowed. Only private endpoint connections will be allowed to access these resources.
50+
51+
#### Disable public network access while creating a topic
52+
53+
```azurecli-interactive
54+
az eventgrid topic create \
55+
--resource-group $resourceGroupName \
56+
--name $topicName \
57+
--location $location \
58+
--public-network-access disabled
59+
```
60+
61+
> [!NOTE]
62+
> When public network access is disabled for a topic or domain, traffic over public internet isn't allowed. Only private endpoint connections will be allowed to access these resources.
63+
64+
65+
#### Enable public network access for an existing topic
66+
67+
```azurecli-interactive
68+
az eventgrid topic update \
69+
--resource-group $resourceGroupName \
70+
--name $topicName \
71+
--public-network-access enabled
72+
```
73+
74+
#### Disable public network access for an existing topic
75+
76+
```azurecli-interactive
77+
az eventgrid topic update \
78+
--resource-group $resourceGroupName \
79+
--name $topicName \
80+
--public-network-access disabled
81+
```
82+
83+
### Create a topic with single inbound ip rule
84+
The following sample CLI command creates an event grid topic with inbound IP rules.
4785

4886
```azurecli-interactive
49-
az rest --method patch --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" --body "{\""properties\"": {\""publicNetworkAccess\"": \""Disabled\""}}"
87+
az eventgrid topic create \
88+
--resource-group $resourceGroupName \
89+
--name $topicName \
90+
--location $location \
91+
--public-network-access enabled \
92+
--inbound-ip-rules <IP ADDR or CIDR MASK> allow
5093
```
5194

52-
### Create topic with inbound ip rules
53-
The following sample CLI command creates an event grid topic with inbound IP rules in one step.
95+
### Create a topic with multiple inbound ip rules
96+
97+
The following sample CLI command creates an event grid topic two inbound IP rules in one step:
5498

5599
```azurecli-interactive
56-
az rest --method put \
57-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" \
58-
--body {\""location\"":\""<LOCATION>\", \""properties\"" :{\""publicNetworkAccess\"":\""enabled\"",\""InboundIpRules\"": [ {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""} ]}}
100+
az eventgrid topic create \
101+
--resource-group $resourceGroupName \
102+
--name $topicName \
103+
--location $location \
104+
--public-network-access enabled \
105+
--inbound-ip-rules <IP ADDR 1 or CIDR MASK 1> allow <IP ADDR 2 or CIDR MASK 2> allow
59106
```
60107

61-
### Create topic first and then add inbound ip rules
108+
### Update an existing topic to add inbound IP rules
62109
This example creates an event grid topic first and then adds inbound IP rules for the topic in a separate command. It also updates the inbound IP rules that were set in the second command.
63110

64111
```azurecli-interactive
65112
66113
# create the event grid topic first
67-
az rest --method put \
68-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" \
69-
--body {\""location\"":\""<LOCATION>\""}
70-
71-
# add inbound IP rules
72-
az rest --method put \
73-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview"
74-
--body {\""location\"":\""<LOCATION>\", \""properties\"" :{\""publicNetworkAccess\"":\""enabled\"", \""InboundIpRules\"": [ {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""} ]}}
75-
76-
# later, update topic with additional ip rules or remove them.
77-
az rest --method put \
78-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview"
79-
--body {\""location\"":\""<LOCATION>\", \""properties\"" :{\""publicNetworkAccess\"":\""enabled\"", \""InboundIpRules\"": [ {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""}, {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""} ]}}
114+
az eventgrid topic create \
115+
--resource-group $resourceGroupName \
116+
--name $topicName \
117+
--location $location
118+
119+
# add inbound IP rules to an existing topic
120+
az eventgrid topic update \
121+
--resource-group $resourceGroupName \
122+
--name $topicName \
123+
--public-network-access enabled \
124+
--inbound-ip-rules <IP ADDR or CIDR MASK> allow
125+
126+
# later, update topic with additional ip rules
127+
az eventgrid topic update \
128+
--resource-group $resourceGroupName \
129+
--name $topicName \
130+
--public-network-access enabled \
131+
--inbound-ip-rules <IP ADDR 1 or CIDR MASK 1> allow \
132+
--inbound-ip-rules <IP ADDR 2 or CIDR MASK 2> allow
133+
```
134+
135+
### Remove an inbound IP rule
136+
The following command removes the second rule you created in the previous step by specifying only the first rule while updating the setting.
137+
138+
```azurecli-interactive
139+
az eventgrid topic update \
140+
--resource-group $resourceGroupName \
141+
--name $topicName \
142+
--public-network-access enabled \
143+
--inbound-ip-rules <IP ADDR 1 or CIDR MASK 1> allow
80144
```
81145

82146

83147
## Use PowerShell
84148
This section shows you how to use Azure PowerShell commands to create Azure Event Grid topics with inbound IP firewall rules. The steps shown in this section are for topics. You can use similar steps to create inbound IP rules for **domains**.
85149

86-
### Prerequisite
87-
Follow instructions from [How to: Use the portal to create an Azure AD application and service principal that can access resources](../active-directory/develop/howto-create-service-principal-portal.md) to create an Azure Active Directory application and note down the following values:
150+
### Prerequisites
151+
Follow instructions from [How to: Use the portal to create an Azure AD application and service principal that can access resources](../../active-directory/develop/howto-create-service-principal-portal.md) to create an Azure Active Directory application and note down the following values:
88152

89153
- Directory (tenant) ID
90154
- Application (Client) ID
@@ -140,7 +204,7 @@ Invoke-RestMethod -Method 'Patch' `
140204
```azurepowershell-interactive
141205
142206
# prepare the body for the REST PUT method. Notice that inbound IP rules are included.
143-
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>";"action"="allow"})}} | ConvertTo-Json -Depth 5
207+
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDR or CIDR MASK>";"action"="allow"})}} | ConvertTo-Json -Depth 5
144208
145209
# create the event grid topic with inbound IP rules
146210
Invoke-RestMethod -Method 'Put' `
@@ -176,7 +240,7 @@ Invoke-RestMethod -Method 'Get' `
176240
| ConvertTo-Json -Depth 5
177241
178242
# prepare the body for REST PUT method. Notice that it includes inbound IP rules now. This feature available in both basic and premium tiers.
179-
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>";"action"="allow"}, @{"ipmask"="<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>";"action"="allow"})}} | ConvertTo-Json -Depth 5
243+
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDR or CIDR MASK>";"action"="allow"}, @{"ipmask"="<IP ADDR or CIDR MASK>";"action"="allow"})}} | ConvertTo-Json -Depth 5
180244
181245
# update the topic with inbound IP rules
182246
Invoke-RestMethod -Method 'Put' `

‎articles/event-grid/configure-private-endpoints.md

Lines changed: 63 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: spelluru
66

77
ms.service: event-grid
88
ms.topic: how-to
9-
ms.date: 03/11/2020
9+
ms.date: 04/22/2020
1010
ms.author: spelluru
1111
---
1212

@@ -152,6 +152,35 @@ az network private-endpoint delete --resource-group <RESOURECE GROUP NAME> --nam
152152
> The steps shown in this section are for topics. You can use similar steps to create private endpoints for **domains**.
153153
154154
### Create a private endpoint
155+
To create a private endpoint, use the [az network private-endpoint create](/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-create) method as shown in the following example:
156+
157+
```azurecli-interactive
158+
az network private-endpoint create \
159+
--resource-group <RESOURECE GROUP NAME> \
160+
--name <PRIVATE ENDPOINT NAME> \
161+
--vnet-name <VIRTUAL NETWORK NAME> \
162+
--subnet <SUBNET NAME> \
163+
--private-connection-resource-id "/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<TOPIC NAME> \
164+
--connection-name <PRIVATE LINK SERVICE CONNECTION NAME> \
165+
--location <LOCATION> \
166+
--group-ids topic
167+
```
168+
169+
For descriptions of the parameters used in the example, see documentation for [az network private-endpoint create](/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-create). A few points to note in this example are:
170+
171+
- For `private-connection-resource-id`, specify the resource ID of the **topic** or **domain**. The preceding example uses the type: topic.
172+
- for `group-ids`, specify `topic` or `domain`. In the preceding example, `topic` is used.
173+
174+
To delete a private endpoint, use the [az network private-endpoint delete](/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-delete) method as shown in the following example:
175+
176+
```azurecli-interactive
177+
az network private-endpoint delete --resource-group <RESOURECE GROUP NAME> --name <PRIVATE ENDPOINT NAME>
178+
```
179+
180+
> [!NOTE]
181+
> The steps shown in this section are for topics. You can use similar steps to create private endpoints for **domains**.
182+
183+
#### Sample script
155184
Here's a sample script that creates the following Azure resources:
156185

157186
- Resource group
@@ -173,9 +202,6 @@ topicName = "<TOPIC NAME>"
173202
connectionName="<ENDPOINT CONNECTION NAME>"
174203
endpointName=<ENDPOINT NAME>
175204
176-
# URI for the topic. replace <SUBSCRIPTION ID>, <RESOURCE GROUP NAME>, and <TOPIC NAME>
177-
topicUri="/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<TOPIC NAME>?api-version=2020-04-01-preview"
178-
179205
# resource ID of the topic. replace <SUBSCRIPTION ID>, <RESOURCE GROUP NAME>, and <TOPIC NAME>
180206
topicResourceID="/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<TOPIC NAME>"
181207
@@ -206,13 +232,16 @@ az network vnet subnet update \
206232
--disable-private-endpoint-network-policies true
207233
208234
# create event grid topic. update <LOCATION>
209-
az rest --method put \
210-
--uri $topicUri \
211-
--body "{\""location\"":\""LOCATION\"", \""sku\"": {\""name\"": \""premium\""}, \""properties\"": {\""publicNetworkAccess\"":\""Disabled\""}}"
235+
az eventgrid topic create \
236+
--resource-group $resourceGroupName \
237+
--name $topicName \
238+
--location $location \
239+
--sku "Premium"
212240
213241
# verify that the topic was created.
214-
az rest --method get \
215-
--uri $topicUri
242+
az eventgrid topic show \
243+
--resource-group $resourceGroupName \
244+
--name $topicName
216245
217246
# create private endpoint for the topic you created
218247
az network private-endpoint create
@@ -226,24 +255,43 @@ az network private-endpoint create
226255
--group-ids topic
227256
228257
# get topic
229-
az rest --method get \
230-
--uri $topicUri
258+
az eventgrid topic show \
259+
--resource-group $resourceGroupName \
260+
--name $topicName
231261
232262
```
233263

234-
### Approve a private endpoint connection
264+
### Approve a private endpoint
235265
The following sample CLI snippet shows you how to approve a private endpoint connection.
236266

237267
```azurecli-interactive
238-
az rest --method put --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>/privateEndpointConnections/<PRIVATE ENDPOINT NAME>.<GUID>?api-version=2020-04-01-preview" --body "{\""properties\"":{\""privateLinkServiceConnectionState\"": {\""status\"":\""approved\"",\""description\"":\""connection approved\"", \""actionsRequired\"": \""none\""}}}"
268+
az eventgrid topic private-endpoint-connection approve \
269+
--resource-group $resourceGroupName \
270+
--topic-name $topicName \
271+
--name $endpointName \
272+
--description "connection approved"
239273
```
240274

241275

242-
### Reject a private endpoint connection
276+
### Reject a private endpoint
243277
The following sample CLI snippet shows you how to reject a private endpoint connection.
244278

245279
```azurecli-interactive
246-
az rest --method put --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>/privateEndpointConnections/<PRIVATE ENDPOINT NAME>.<GUID>?api-version=2020-04-01-preview" --body "{\""properties\"":{\""privateLinkServiceConnectionState\"": {\""status\"":\""rejected\"",\""description\"":\""connection rejected\"", \""actionsRequired\"": \""none\""}}}"
280+
az eventgrid topic private-endpoint-connection reject \
281+
--resource-group $resourceGroupName \
282+
--topic-name $topicName \
283+
--name $endpointName \
284+
--description "Connection rejected"
285+
```
286+
287+
### Disable public network access
288+
By default, public network access is enabled for an Event Grid topic or domain. To allow access via private endpoints only, disable public network access by running the following command:
289+
290+
```azurecli-interactive
291+
az eventgrid topic update \
292+
--resource-group $resourceGroupName \
293+
--name $topicName \
294+
--public-network-access disabled
247295
```
248296

249297

‎articles/event-grid/update-tier.md

Lines changed: 15 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: spelluru
66

77
ms.service: event-grid
88
ms.topic: conceptual
9-
ms.date: 03/11/2020
9+
ms.date: 04/22/2020
1010
ms.author: spelluru
1111
---
1212

@@ -51,41 +51,29 @@ You can **upgrade** from the basic tier to the premium tier on the **Networking*
5151

5252

5353
## Use Azure CLI
54-
This section shows you how to use Azure CLI commands to change the pricing tier of a topic or domain.
54+
This section shows you how to use Azure CLI commands to change the pricing tier of a topic. To update pricing tier of a domain, use the `az eventgrid domain update` command in a similar fashion.
55+
5556

56-
### Upgrade a topic from basic to premium
57+
## Upgrade a topic from basic to premium
5758

5859
```azurecli-interactive
59-
az rest --method patch \
60-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" \
61-
--body "{\""sku\"": {\""name\"": \""premium\""}}"
60+
az eventgrid topic update \
61+
--resource-group $resourceGroupName \
62+
--name $topicName \
63+
--location $location \
64+
--sku "Premium"
6265
```
6366

64-
### Downgrade a topic from premium to basic
65-
66-
```azurecli-interactive
67-
az rest --method patch \
68-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" \
69-
--body "{\""sku\"": {\""name\"": \""basic\""}}"
70-
```
71-
72-
### Upgrade a domain from basic to premium
67+
## Downgrade a topic from premium to basic
7368

7469
```azurecli-interactive
75-
az rest --method patch \
76-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/domains/<EVENT GRID DOMAIN NAME>?api-version=2020-04-01-preview" \
77-
--body "{\""sku\"": {\""name\"": \""premium\""}}"
70+
az eventgrid topic update \
71+
--resource-group $resourceGroupName \
72+
--name $topicName \
73+
--location $location \
74+
--sku "Basic"
7875
```
7976

80-
### Downgrade a domain from premium to basic
81-
82-
```azurecli-interactive
83-
az rest --method patch \
84-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/domains/<EVENT GRID DOMAIN NAME>?api-version=2020-04-01-preview" \
85-
--body "{\""sku\"": {\""name\"": \""basic\""}}"
86-
```
87-
88-
8977

9078
## Use Azure PowerShell
9179
This section shows you how to use PowerShell commands to change the pricing tier of a topic or domain.

0 commit comments

Comments
 (0)