Skip to content

Commit 8ff4272

Browse files
GitHubber17GitHubber17
authored
Merge pull request #112393 from spelluru/egridcli0422
updated CLI code
2 parents f3abfde + c72bd39 commit 8ff4272

File tree

3 files changed

+206
-64
lines changed

3 files changed

+206
-64
lines changed

‎articles/event-grid/configure-firewall.md

Lines changed: 108 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: spelluru
66

77
ms.service: event-grid
88
ms.topic: conceptual
9-
ms.date: 03/11/2020
9+
ms.date: 04/22/2020
1010
ms.author: spelluru
1111
---
1212

@@ -35,55 +35,134 @@ This section shows you how to use the Azure portal to create inbound IP firewall
3535
This section shows you how to use Azure CLI commands to create topics with inbound IP rules. The steps shown in this section are for topics. You can use similar steps to create inbound IP rules for **domains**.
3636

3737

38-
### Enable public network access for an existing topic
39-
By default, the public network access is enabled for topics and domains. You can restrict traffic by configuring inbound IP firewall rules.
38+
### Prerequisites
39+
Update the Azure Event Grid extension for CLI by running the following command:
4040

4141
```azurecli-interactive
42-
az rest --method patch --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" --body "{\""properties\"": {\""publicNetworkAccess\"": \""Enabled\""}}"
42+
az extension update -n eventgrid
4343
```
4444

45-
### Disable public network access for an existing topic
46-
When public network access is disabled for a topic or domain, traffic over public internet isn't allowed. Only private endpoint connections will be allowed to access these resources.
45+
If the extension isn't installed, run the following command to install it:
4746

4847
```azurecli-interactive
49-
az rest --method patch --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" --body "{\""properties\"": {\""publicNetworkAccess\"": \""Disabled\""}}"
48+
az extension add -n eventgrid
5049
```
5150

52-
### Create topic with inbound ip rules
53-
The following sample CLI command creates an event grid topic with inbound IP rules in one step.
51+
### Enable or disable public network access
52+
By default, the public network access is enabled for topics and domains. You can also enable it explicitly or disable it. You can restrict traffic by configuring inbound IP firewall rules.
53+
54+
#### Enable public network access while creating a topic
5455

5556
```azurecli-interactive
56-
az rest --method put \
57-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" \
58-
--body {\""location\"":\""<LOCATION>\", \""properties\"" :{\""publicNetworkAccess\"":\""enabled\"",\""InboundIpRules\"": [ {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""} ]}}
57+
az eventgrid topic create \
58+
--resource-group $resourceGroupName \
59+
--name $topicName \
60+
--location $location \
61+
--public-network-access enabled
5962
```
6063

61-
### Create topic first and then add inbound ip rules
64+
65+
#### Disable public network access while creating a topic
66+
67+
```azurecli-interactive
68+
az eventgrid topic create \
69+
--resource-group $resourceGroupName \
70+
--name $topicName \
71+
--location $location \
72+
--public-network-access disabled
73+
```
74+
75+
> [!NOTE]
76+
> When public network access is disabled for a topic or domain, traffic over public internet isn't allowed. Only private endpoint connections will be allowed to access these resources.
77+
78+
79+
#### Enable public network access for an existing topic
80+
81+
```azurecli-interactive
82+
az eventgrid topic update \
83+
--resource-group $resourceGroupName \
84+
--name $topicName \
85+
--public-network-access enabled
86+
```
87+
88+
#### Disable public network access for an existing topic
89+
90+
```azurecli-interactive
91+
az eventgrid topic update \
92+
--resource-group $resourceGroupName \
93+
--name $topicName \
94+
--public-network-access disabled
95+
```
96+
97+
### Create a topic with single inbound ip rule
98+
The following sample CLI command creates an event grid topic with inbound IP rules.
99+
100+
```azurecli-interactive
101+
az eventgrid topic create \
102+
--resource-group $resourceGroupName \
103+
--name $topicName \
104+
--location $location \
105+
--public-network-access enabled \
106+
--inbound-ip-rules <IP ADDR or CIDR MASK> allow
107+
```
108+
109+
### Create a topic with multiple inbound ip rules
110+
111+
The following sample CLI command creates an event grid topic two inbound IP rules in one step:
112+
113+
```azurecli-interactive
114+
az eventgrid topic create \
115+
--resource-group $resourceGroupName \
116+
--name $topicName \
117+
--location $location \
118+
--public-network-access enabled \
119+
--inbound-ip-rules <IP ADDR 1 or CIDR MASK 1> allow \
120+
--inbound-ip-rules <IP ADDR 2 or CIDR MASK 2> allow
121+
```
122+
123+
### Update an existing topic to add inbound IP rules
62124
This example creates an event grid topic first and then adds inbound IP rules for the topic in a separate command. It also updates the inbound IP rules that were set in the second command.
63125

64126
```azurecli-interactive
65127
66128
# create the event grid topic first
67-
az rest --method put \
68-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview" \
69-
--body {\""location\"":\""<LOCATION>\""}
70-
71-
# add inbound IP rules
72-
az rest --method put \
73-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview"
74-
--body {\""location\"":\""<LOCATION>\", \""properties\"" :{\""publicNetworkAccess\"":\""enabled\"", \""InboundIpRules\"": [ {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""} ]}}
75-
76-
# later, update topic with additional ip rules or remove them.
77-
az rest --method put \
78-
--uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>?api-version=2020-04-01-preview"
79-
--body {\""location\"":\""<LOCATION>\", \""properties\"" :{\""publicNetworkAccess\"":\""enabled\"", \""InboundIpRules\"": [ {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""}, {\""ipMask\"": \""<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>\"", \""action\"": \""allow\""} ]}}
129+
az eventgrid topic create \
130+
--resource-group $resourceGroupName \
131+
--name $topicName \
132+
--location $location
133+
134+
# add inbound IP rules to an existing topic
135+
az eventgrid topic update \
136+
--resource-group $resourceGroupName \
137+
--name $topicName \
138+
--public-network-access enabled \
139+
--inbound-ip-rules <IP ADDR or CIDR MASK> allow
140+
141+
# later, update topic with additional ip rules
142+
az eventgrid topic update \
143+
--resource-group $resourceGroupName \
144+
--name $topicName \
145+
--public-network-access enabled \
146+
--inbound-ip-rules <IP ADDR 1 or CIDR MASK 1> allow \
147+
--inbound-ip-rules <IP ADDR 2 or CIDR MASK 2> allow
148+
```
149+
150+
### Remove an inbound IP rule
151+
The following command removes the second rule you created in the previous step by specifying only the first rule while updating the setting.
152+
153+
```azurecli-interactive
154+
az eventgrid topic update \
155+
--resource-group $resourceGroupName \
156+
--name $topicName \
157+
--public-network-access enabled \
158+
--inbound-ip-rules <IP ADDR 1 or CIDR MASK 1> allow
80159
```
81160

82161

83162
## Use PowerShell
84163
This section shows you how to use Azure PowerShell commands to create Azure Event Grid topics with inbound IP firewall rules. The steps shown in this section are for topics. You can use similar steps to create inbound IP rules for **domains**.
85164

86-
### Prerequisite
165+
### Prerequisites
87166
Follow instructions from [How to: Use the portal to create an Azure AD application and service principal that can access resources](../active-directory/develop/howto-create-service-principal-portal.md) to create an Azure Active Directory application and note down the following values:
88167

89168
- Directory (tenant) ID
@@ -140,7 +219,7 @@ Invoke-RestMethod -Method 'Patch' `
140219
```azurepowershell-interactive
141220
142221
# prepare the body for the REST PUT method. Notice that inbound IP rules are included.
143-
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>";"action"="allow"})}} | ConvertTo-Json -Depth 5
222+
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDR or CIDR MASK>";"action"="allow"})}} | ConvertTo-Json -Depth 5
144223
145224
# create the event grid topic with inbound IP rules
146225
Invoke-RestMethod -Method 'Put' `
@@ -176,7 +255,7 @@ Invoke-RestMethod -Method 'Get' `
176255
| ConvertTo-Json -Depth 5
177256
178257
# prepare the body for REST PUT method. Notice that it includes inbound IP rules now. This feature available in both basic and premium tiers.
179-
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>";"action"="allow"}, @{"ipmask"="<IP ADDRESS or IP ADDRESS RANGE in CIDR notation>";"action"="allow"})}} | ConvertTo-Json -Depth 5
258+
$body = @{"location"="<LOCATION>"; "sku"= @{"name"="basic"}; "properties"=@{"publicNetworkAccess"="enabled"; "inboundIpRules"=@(@{"ipmask"="<IP ADDR or CIDR MASK>";"action"="allow"}, @{"ipmask"="<IP ADDR or CIDR MASK>";"action"="allow"})}} | ConvertTo-Json -Depth 5
180259
181260
# update the topic with inbound IP rules
182261
Invoke-RestMethod -Method 'Put' `

‎articles/event-grid/configure-private-endpoints.md

Lines changed: 79 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: spelluru
66

77
ms.service: event-grid
88
ms.topic: how-to
9-
ms.date: 03/11/2020
9+
ms.date: 04/22/2020
1010
ms.author: spelluru
1111
---
1212

@@ -64,7 +64,7 @@ This section shows you how to use the Azure portal to create a private endpoint
6464
![Private endpoint - review & create page](./media/configure-private-endpoints/review-create-page.png)
6565

6666

67-
## Manage private link connection
67+
### Manage private link connection
6868

6969
When you create a private endpoint, the connection must be approved. If the resource for which you're creating a private endpoint is in your directory, you can approve the connection request provided you have sufficient permissions. If you're connecting to an Azure resource in another directory, you must wait for the owner of that resource to approve your connection request.
7070

@@ -151,7 +151,51 @@ az network private-endpoint delete --resource-group <RESOURECE GROUP NAME> --nam
151151
> [!NOTE]
152152
> The steps shown in this section are for topics. You can use similar steps to create private endpoints for **domains**.
153153
154+
155+
156+
### Prerequisites
157+
Update the Azure Event Grid extension for CLI by running the following command:
158+
159+
```azurecli-interactive
160+
az extension update -n eventgrid
161+
```
162+
163+
If the extension isn't installed, run the following command to install it:
164+
165+
```azurecli-interactive
166+
az extension add -n eventgrid
167+
```
168+
154169
### Create a private endpoint
170+
To create a private endpoint, use the [az network private-endpoint create](/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-create) method as shown in the following example:
171+
172+
```azurecli-interactive
173+
az network private-endpoint create \
174+
--resource-group <RESOURECE GROUP NAME> \
175+
--name <PRIVATE ENDPOINT NAME> \
176+
--vnet-name <VIRTUAL NETWORK NAME> \
177+
--subnet <SUBNET NAME> \
178+
--private-connection-resource-id "/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<TOPIC NAME> \
179+
--connection-name <PRIVATE LINK SERVICE CONNECTION NAME> \
180+
--location <LOCATION> \
181+
--group-ids topic
182+
```
183+
184+
For descriptions of the parameters used in the example, see documentation for [az network private-endpoint create](/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-create). A few points to note in this example are:
185+
186+
- For `private-connection-resource-id`, specify the resource ID of the **topic** or **domain**. The preceding example uses the type: topic.
187+
- for `group-ids`, specify `topic` or `domain`. In the preceding example, `topic` is used.
188+
189+
To delete a private endpoint, use the [az network private-endpoint delete](/cli/azure/network/private-endpoint?view=azure-cli-latest#az-network-private-endpoint-delete) method as shown in the following example:
190+
191+
```azurecli-interactive
192+
az network private-endpoint delete --resource-group <RESOURECE GROUP NAME> --name <PRIVATE ENDPOINT NAME>
193+
```
194+
195+
> [!NOTE]
196+
> The steps shown in this section are for topics. You can use similar steps to create private endpoints for **domains**.
197+
198+
#### Sample script
155199
Here's a sample script that creates the following Azure resources:
156200

157201
- Resource group
@@ -173,9 +217,6 @@ topicName = "<TOPIC NAME>"
173217
connectionName="<ENDPOINT CONNECTION NAME>"
174218
endpointName=<ENDPOINT NAME>
175219
176-
# URI for the topic. replace <SUBSCRIPTION ID>, <RESOURCE GROUP NAME>, and <TOPIC NAME>
177-
topicUri="/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<TOPIC NAME>?api-version=2020-04-01-preview"
178-
179220
# resource ID of the topic. replace <SUBSCRIPTION ID>, <RESOURCE GROUP NAME>, and <TOPIC NAME>
180221
topicResourceID="/subscriptions/<SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<TOPIC NAME>"
181222
@@ -206,13 +247,16 @@ az network vnet subnet update \
206247
--disable-private-endpoint-network-policies true
207248
208249
# create event grid topic. update <LOCATION>
209-
az rest --method put \
210-
--uri $topicUri \
211-
--body "{\""location\"":\""LOCATION\"", \""sku\"": {\""name\"": \""premium\""}, \""properties\"": {\""publicNetworkAccess\"":\""Disabled\""}}"
250+
az eventgrid topic create \
251+
--resource-group $resourceGroupName \
252+
--name $topicName \
253+
--location $location \
254+
--sku "Premium"
212255
213256
# verify that the topic was created.
214-
az rest --method get \
215-
--uri $topicUri
257+
az eventgrid topic show \
258+
--resource-group $resourceGroupName \
259+
--name $topicName
216260
217261
# create private endpoint for the topic you created
218262
az network private-endpoint create
@@ -226,24 +270,43 @@ az network private-endpoint create
226270
--group-ids topic
227271
228272
# get topic
229-
az rest --method get \
230-
--uri $topicUri
273+
az eventgrid topic show \
274+
--resource-group $resourceGroupName \
275+
--name $topicName
231276
232277
```
233278

234-
### Approve a private endpoint connection
279+
### Approve a private endpoint
235280
The following sample CLI snippet shows you how to approve a private endpoint connection.
236281

237282
```azurecli-interactive
238-
az rest --method put --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>/privateEndpointConnections/<PRIVATE ENDPOINT NAME>.<GUID>?api-version=2020-04-01-preview" --body "{\""properties\"":{\""privateLinkServiceConnectionState\"": {\""status\"":\""approved\"",\""description\"":\""connection approved\"", \""actionsRequired\"": \""none\""}}}"
283+
az eventgrid topic private-endpoint-connection approve \
284+
--resource-group $resourceGroupName \
285+
--topic-name $topicName \
286+
--name $endpointName \
287+
--description "connection approved"
239288
```
240289

241290

242-
### Reject a private endpoint connection
291+
### Reject a private endpoint
243292
The following sample CLI snippet shows you how to reject a private endpoint connection.
244293

245294
```azurecli-interactive
246-
az rest --method put --uri "/subscriptions/<AZURE SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventGrid/topics/<EVENT GRID TOPIC NAME>/privateEndpointConnections/<PRIVATE ENDPOINT NAME>.<GUID>?api-version=2020-04-01-preview" --body "{\""properties\"":{\""privateLinkServiceConnectionState\"": {\""status\"":\""rejected\"",\""description\"":\""connection rejected\"", \""actionsRequired\"": \""none\""}}}"
295+
az eventgrid topic private-endpoint-connection reject \
296+
--resource-group $resourceGroupName \
297+
--topic-name $topicName \
298+
--name $endpointName \
299+
--description "Connection rejected"
300+
```
301+
302+
### Disable public network access
303+
By default, public network access is enabled for an Event Grid topic or domain. To allow access via private endpoints only, disable public network access by running the following command:
304+
305+
```azurecli-interactive
306+
az eventgrid topic update \
307+
--resource-group $resourceGroupName \
308+
--name $topicName \
309+
--public-network-access disabled
247310
```
248311

249312

0 commit comments

Comments
 (0)