Merge pull request #294358 from eak13/main

Updates to add firewall info for SA & KV

Author: prmerger-automator[bot]

articles/operator-nexus/howto-cluster-managed-identity-user-provided-resources.md

@@ -62,6 +62,9 @@ The following steps should be followed for using UAMIs with Nexus Clusters and a
 1. Create a storage account, or identify an existing storage account that you want to use. See [Create an Azure storage account](/azure/storage/common/storage-account-create?tabs=azure-portal).
 1. Create a blob storage container in the storage account. See [Create a container](/azure/storage/blobs/storage-quickstart-blobs-portal#create-a-container).
 1. Assign the `Storage Blob Data Contributor` role to users and the UAMI which need access to the run-\* command output. See [Assign an Azure role for access to blob data](/azure/storage/blobs/assign-azure-role-data-access?tabs=portal).
+1. To limit access to the Storage Account to a select set of IP or virtual networks, see [Configure Azure Storage firewalls and virtual networks](/azure/storage/common/storage-network-security?tabs=azure-portal).
+   1. The IPs for all users executing run-\* commands need to be added to the Storage Account's `Virtual Networks` and/or `Firewall` lists.
+   1. Ensure `Allow Azure services on the trusted services list to access this storage account.` under `Exceptions` is selected.
 
 #### Log Analytics Workspaces setup
 
@@ -81,6 +84,9 @@ The following steps should be followed for using UAMIs with Nexus Clusters and a
    1. Assign access to: **User, group, or service principal**.
    1. Select **Member**: AFOI-NC-MGMT-PME-PROD application.
    1. Review and assign.
+1. To limit access to the Key Vault to a select set of IP or virtual networks, see [Configure Azure Key Vault firewalls and virtual networks](/azure/key-vault/general/network-security?WT.mc_id=Portal-Microsoft_Azure_KeyVault).
+   1. The IPs for all users requiring access to the Key Vault need to be added to the Key Vault's `Virtual Networks` and/or `Firewall` lists.
+   1. Ensure the `Allow trusted Microsoft services to bypass this firewall.` under `Exceptions` is selected.
 
 ### Create or update the Nexus Cluster to use User Assigned Managed Identities and user provided resources
 
@@ -289,6 +295,9 @@ System-assigned identity example:
 1. Create a storage account, or identify an existing storage account that you want to use. See [Create an Azure storage account](/azure/storage/common/storage-account-create?tabs=azure-portal).
 1. Create a blob storage container in the storage account. See [Create a container](/azure/storage/blobs/storage-quickstart-blobs-portal#create-a-container).
 1. Assign the `Storage Blob Data Contributor` role to users and the SAMI which need access to the run-\* command output. See [Assign an Azure role for access to blob data](/azure/storage/blobs/assign-azure-role-data-access?tabs=portal).
+1. 1. To limit access to the Storage Account to a select set of IP or virtual networks, see [Configure Azure Storage firewalls and virtual networks](/azure/storage/common/storage-network-security?tabs=azure-portal).
+   1. The IPs for all users executing run-\* commands need to be added to the Storage Account's `Virtual Networks` and/or `Firewall` lists.
+   1. Ensure `Allow Azure services on the trusted services list to access this storage account.` under `Exceptions` is selected.
 
 #### Log Analytics Workspaces setup
 
@@ -301,6 +310,9 @@ System-assigned identity example:
 1. Enable the Key Vault for Role Based Access Control (RBAC). See [Enable Azure RBAC permissions on Key Vault](/azure/key-vault/general/rbac-guide?tabs=azure-cli#enable-azure-rbac-permissions-on-key-vault).
 1. Assign the `Operator Nexus Key Vault Writer Service Role (Preview)` role to the SAMI for the Key Vault. See [Assign role](/azure/key-vault/general/rbac-guide?tabs=azure-cli#assign-role).
    1. The role definition ID for the Operator Nexus Key Vault Writer Service Role is `44f0a1a8-6fea-4b35-980a-8ff50c487c97`. This format is required if using the Azure command line to do the role assignment.
+1. To limit access to the Key Vault to a select set of IP or virtual networks, see [Configure Azure Key Vault firewalls and virtual networks](/azure/key-vault/general/network-security?WT.mc_id=Portal-Microsoft_Azure_KeyVault).
+   1. The IPs for all users requiring access to the Key Vault need to be added to the Key Vault's `Virtual Networks` and/or `Firewall` lists.
+   1. Ensure the `Allow trusted Microsoft services to bypass this firewall.` under `Exceptions` is selected.
 
 ### Update the Cluster with the user provided resources information