Skip to content

Commit 14a1b79

Browse files
eerhardteerhardt
committed
Address PR feedback
Make helper methods for easily adding rules to subnets. Make NSG a top-level resource.
1 parent 0b36cd3 commit 14a1b79

File tree

23 files changed

+1112
-654
lines changed

23 files changed

+1112
-654
lines changed

‎playground/AzureVirtualNetworkEndToEnd/AzureVirtualNetworkEndToEnd.AppHost/Program.cs‎

Lines changed: 7 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33

44
#pragma warning disable AZPROVISION001 // Azure.Provisioning.Network is experimental
55

6-
using Aspire.Hosting.Azure;
76
using Azure.Provisioning.Network;
87

98
var builder = DistributedApplication.CreateBuilder(args);
@@ -13,76 +12,14 @@
1312
// - One for private endpoints
1413
var vnet = builder.AddAzureVirtualNetwork("vnet");
1514

16-
var containerAppsSubnet = vnet.AddSubnet("container-apps", "10.0.0.0/23");
17-
var privateEndpointsSubnet = vnet.AddSubnet("private-endpoints", "10.0.2.0/27");
15+
var containerAppsSubnet = vnet.AddSubnet("container-apps", "10.0.0.0/23")
16+
.AllowInbound(port: "443", from: "AzureLoadBalancer", protocol: SecurityRuleProtocol.Tcp)
17+
.DenyInbound(from: "VirtualNetwork")
18+
.DenyInbound(from: "Internet");
1819

19-
// Create Network Security Groups for each subnet
20-
var acaNsg = vnet.AddNetworkSecurityGroup("aca-nsg")
21-
.WithSecurityRule(new AzureSecurityRule
22-
{
23-
Name = "allow-https-from-azure-lb",
24-
Priority = 100,
25-
Direction = SecurityRuleDirection.Inbound,
26-
Access = SecurityRuleAccess.Allow,
27-
Protocol = SecurityRuleProtocol.Tcp,
28-
SourceAddressPrefix = "AzureLoadBalancer",
29-
SourcePortRange = "*",
30-
DestinationAddressPrefix = "*",
31-
DestinationPortRange = "443"
32-
})
33-
.WithSecurityRule(new AzureSecurityRule
34-
{
35-
Name = "deny-vnet-inbound",
36-
Priority = 110,
37-
Direction = SecurityRuleDirection.Inbound,
38-
Access = SecurityRuleAccess.Deny,
39-
Protocol = SecurityRuleProtocol.Asterisk,
40-
SourceAddressPrefix = "VirtualNetwork",
41-
SourcePortRange = "*",
42-
DestinationAddressPrefix = "*",
43-
DestinationPortRange = "*"
44-
})
45-
.WithSecurityRule(new AzureSecurityRule
46-
{
47-
Name = "deny-internet-inbound",
48-
Priority = 4096,
49-
Direction = SecurityRuleDirection.Inbound,
50-
Access = SecurityRuleAccess.Deny,
51-
Protocol = SecurityRuleProtocol.Asterisk,
52-
SourceAddressPrefix = "Internet",
53-
SourcePortRange = "*",
54-
DestinationAddressPrefix = "*",
55-
DestinationPortRange = "*"
56-
});
57-
58-
var peNsg = vnet.AddNetworkSecurityGroup("pe-nsg")
59-
.WithSecurityRule(new AzureSecurityRule
60-
{
61-
Name = "allow-https-from-vnet",
62-
Priority = 100,
63-
Direction = SecurityRuleDirection.Inbound,
64-
Access = SecurityRuleAccess.Allow,
65-
Protocol = SecurityRuleProtocol.Tcp,
66-
SourceAddressPrefix = "VirtualNetwork",
67-
SourcePortRange = "*",
68-
DestinationAddressPrefix = "*",
69-
DestinationPortRange = "443"
70-
})
71-
.WithSecurityRule(new AzureSecurityRule
72-
{
73-
Name = "deny-all-internet-inbound",
74-
Priority = 4096,
75-
Direction = SecurityRuleDirection.Inbound,
76-
Access = SecurityRuleAccess.Deny,
77-
Protocol = SecurityRuleProtocol.Asterisk,
78-
SourceAddressPrefix = "Internet",
79-
SourcePortRange = "*",
80-
DestinationAddressPrefix = "*",
81-
DestinationPortRange = "*"
82-
});
83-
84-
containerAppsSubnet.WithNetworkSecurityGroup(acaNsg);
85-
privateEndpointsSubnet.WithNetworkSecurityGroup(peNsg);
20+
var privateEndpointsSubnet = vnet.AddSubnet("private-endpoints", "10.0.2.0/27")
21+
.AllowInbound(port: "443", from: "VirtualNetwork", protocol: SecurityRuleProtocol.Tcp)
22+
.DenyInbound(from: "Internet");
8623

8724
// Configure the Container App Environment to use the VNet
8825
builder.AddAzureContainerAppEnvironment("env")

‎playground/AzureVirtualNetworkEndToEnd/AzureVirtualNetworkEndToEnd.AppHost/aspire-manifest.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,19 @@
33
"resources": {
44
"vnet": {
55
"type": "azure.bicep.v0",
6-
"path": "vnet.module.bicep"
6+
"path": "vnet.module.bicep",
7+
"params": {
8+
"container_apps_nsg_outputs_id": "{container-apps-nsg.outputs.id}",
9+
"private_endpoints_nsg_outputs_id": "{private-endpoints-nsg.outputs.id}"
10+
}
11+
},
12+
"container-apps-nsg": {
13+
"type": "azure.bicep.v0",
14+
"path": "container-apps-nsg.module.bicep"
15+
},
16+
"private-endpoints-nsg": {
17+
"type": "azure.bicep.v0",
18+
"path": "private-endpoints-nsg.module.bicep"
719
},
820
"env-acr": {
921
"type": "azure.bicep.v0",

‎playground/AzureVirtualNetworkEndToEnd/AzureVirtualNetworkEndToEnd.AppHost/container-apps-nsg.module.bicep‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
@description('The location for the resource(s) to be deployed.')
2+
param location string = resourceGroup().location
3+
4+
resource container_apps_nsg_allow_inbound_443_AzureLoadBalancer 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
5+
name: 'allow-inbound-443-AzureLoadBalancer'
6+
properties: {
7+
access: 'Allow'
8+
destinationAddressPrefix: '*'
9+
destinationPortRange: '443'
10+
direction: 'Inbound'
11+
priority: 100
12+
protocol: 'Tcp'
13+
sourceAddressPrefix: 'AzureLoadBalancer'
14+
sourcePortRange: '*'
15+
}
16+
parent: container_apps_nsg
17+
}
18+
19+
resource container_apps_nsg_deny_inbound_VirtualNetwork 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
20+
name: 'deny-inbound-VirtualNetwork'
21+
properties: {
22+
access: 'Deny'
23+
destinationAddressPrefix: '*'
24+
destinationPortRange: '*'
25+
direction: 'Inbound'
26+
priority: 200
27+
protocol: '*'
28+
sourceAddressPrefix: 'VirtualNetwork'
29+
sourcePortRange: '*'
30+
}
31+
parent: container_apps_nsg
32+
}
33+
34+
resource container_apps_nsg_deny_inbound_Internet 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
35+
name: 'deny-inbound-Internet'
36+
properties: {
37+
access: 'Deny'
38+
destinationAddressPrefix: '*'
39+
destinationPortRange: '*'
40+
direction: 'Inbound'
41+
priority: 300
42+
protocol: '*'
43+
sourceAddressPrefix: 'Internet'
44+
sourcePortRange: '*'
45+
}
46+
parent: container_apps_nsg
47+
}
48+
49+
resource container_apps_nsg 'Microsoft.Network/networkSecurityGroups@2025-05-01' = {
50+
name: take('container_apps_nsg-${uniqueString(resourceGroup().id)}', 80)
51+
location: location
52+
tags: {
53+
'aspire-resource-name': 'container-apps-nsg'
54+
}
55+
}
56+
57+
output id string = container_apps_nsg.id
58+
59+
output name string = container_apps_nsg.name

‎playground/AzureVirtualNetworkEndToEnd/AzureVirtualNetworkEndToEnd.AppHost/private-endpoints-nsg.module.bicep‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
@description('The location for the resource(s) to be deployed.')
2+
param location string = resourceGroup().location
3+
4+
resource private_endpoints_nsg_allow_inbound_443_VirtualNetwork 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
5+
name: 'allow-inbound-443-VirtualNetwork'
6+
properties: {
7+
access: 'Allow'
8+
destinationAddressPrefix: '*'
9+
destinationPortRange: '443'
10+
direction: 'Inbound'
11+
priority: 100
12+
protocol: 'Tcp'
13+
sourceAddressPrefix: 'VirtualNetwork'
14+
sourcePortRange: '*'
15+
}
16+
parent: private_endpoints_nsg
17+
}
18+
19+
resource private_endpoints_nsg_deny_inbound_Internet 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
20+
name: 'deny-inbound-Internet'
21+
properties: {
22+
access: 'Deny'
23+
destinationAddressPrefix: '*'
24+
destinationPortRange: '*'
25+
direction: 'Inbound'
26+
priority: 200
27+
protocol: '*'
28+
sourceAddressPrefix: 'Internet'
29+
sourcePortRange: '*'
30+
}
31+
parent: private_endpoints_nsg
32+
}
33+
34+
resource private_endpoints_nsg 'Microsoft.Network/networkSecurityGroups@2025-05-01' = {
35+
name: take('private_endpoints_nsg-${uniqueString(resourceGroup().id)}', 80)
36+
location: location
37+
tags: {
38+
'aspire-resource-name': 'private-endpoints-nsg'
39+
}
40+
}
41+
42+
output id string = private_endpoints_nsg.id
43+
44+
output name string = private_endpoints_nsg.name

‎playground/AzureVirtualNetworkEndToEnd/AzureVirtualNetworkEndToEnd.AppHost/vnet.module.bicep‎

Lines changed: 6 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
@description('The location for the resource(s) to be deployed.')
22
param location string = resourceGroup().location
33

4+
param container_apps_nsg_outputs_id string
5+
6+
param private_endpoints_nsg_outputs_id string
7+
48
resource vnet 'Microsoft.Network/virtualNetworks@2025-05-01' = {
59
name: take('vnet-${uniqueString(resourceGroup().id)}', 64)
610
properties: {
@@ -16,91 +20,6 @@ resource vnet 'Microsoft.Network/virtualNetworks@2025-05-01' = {
1620
}
1721
}
1822

19-
resource aca_nsg 'Microsoft.Network/networkSecurityGroups@2025-05-01' = {
20-
name: take('aca_nsg-${uniqueString(resourceGroup().id)}', 80)
21-
location: location
22-
}
23-
24-
resource aca_nsg_allow_https_from_azure_lb 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
25-
name: 'allow-https-from-azure-lb'
26-
properties: {
27-
access: 'Allow'
28-
destinationAddressPrefix: '*'
29-
destinationPortRange: '443'
30-
direction: 'Inbound'
31-
priority: 100
32-
protocol: 'Tcp'
33-
sourceAddressPrefix: 'AzureLoadBalancer'
34-
sourcePortRange: '*'
35-
}
36-
parent: aca_nsg
37-
}
38-
39-
resource aca_nsg_deny_vnet_inbound 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
40-
name: 'deny-vnet-inbound'
41-
properties: {
42-
access: 'Deny'
43-
destinationAddressPrefix: '*'
44-
destinationPortRange: '*'
45-
direction: 'Inbound'
46-
priority: 110
47-
protocol: '*'
48-
sourceAddressPrefix: 'VirtualNetwork'
49-
sourcePortRange: '*'
50-
}
51-
parent: aca_nsg
52-
}
53-
54-
resource aca_nsg_deny_internet_inbound 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
55-
name: 'deny-internet-inbound'
56-
properties: {
57-
access: 'Deny'
58-
destinationAddressPrefix: '*'
59-
destinationPortRange: '*'
60-
direction: 'Inbound'
61-
priority: 4096
62-
protocol: '*'
63-
sourceAddressPrefix: 'Internet'
64-
sourcePortRange: '*'
65-
}
66-
parent: aca_nsg
67-
}
68-
69-
resource pe_nsg 'Microsoft.Network/networkSecurityGroups@2025-05-01' = {
70-
name: take('pe_nsg-${uniqueString(resourceGroup().id)}', 80)
71-
location: location
72-
}
73-
74-
resource pe_nsg_allow_https_from_vnet 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
75-
name: 'allow-https-from-vnet'
76-
properties: {
77-
access: 'Allow'
78-
destinationAddressPrefix: '*'
79-
destinationPortRange: '443'
80-
direction: 'Inbound'
81-
priority: 100
82-
protocol: 'Tcp'
83-
sourceAddressPrefix: 'VirtualNetwork'
84-
sourcePortRange: '*'
85-
}
86-
parent: pe_nsg
87-
}
88-
89-
resource pe_nsg_deny_all_internet_inbound 'Microsoft.Network/networkSecurityGroups/securityRules@2025-05-01' = {
90-
name: 'deny-all-internet-inbound'
91-
properties: {
92-
access: 'Deny'
93-
destinationAddressPrefix: '*'
94-
destinationPortRange: '*'
95-
direction: 'Inbound'
96-
priority: 4096
97-
protocol: '*'
98-
sourceAddressPrefix: 'Internet'
99-
sourcePortRange: '*'
100-
}
101-
parent: pe_nsg
102-
}
103-
10423
resource container_apps 'Microsoft.Network/virtualNetworks/subnets@2025-05-01' = {
10524
name: 'container-apps'
10625
properties: {
@@ -114,7 +33,7 @@ resource container_apps 'Microsoft.Network/virtualNetworks/subnets@2025-05-01' =
11433
}
11534
]
11635
networkSecurityGroup: {
117-
id: aca_nsg.id
36+
id: container_apps_nsg_outputs_id
11837
}
11938
}
12039
parent: vnet
@@ -125,7 +44,7 @@ resource private_endpoints 'Microsoft.Network/virtualNetworks/subnets@2025-05-01
12544
properties: {
12645
addressPrefix: '10.0.2.0/27'
12746
networkSecurityGroup: {
128-
id: pe_nsg.id
47+
id: private_endpoints_nsg_outputs_id
12948
}
13049
}
13150
parent: vnet

0 commit comments

Comments
 (0)