Skip to content

Commit 28a758c

Browse files
Prekshith-MicrosoftPrekshith-Microsoft
committed
Optimize the network module
1 parent 65ed02b commit 28a758c

File tree

7 files changed

+469
-811
lines changed

7 files changed

+469
-811
lines changed

‎infra/main.bicep‎

Lines changed: 112 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -329,21 +329,109 @@ module applicationInsights 'br/public:avm/res/insights/component:0.6.0' = if (en
329329
diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null
330330
}
331331
}
332+
// ========== Virtual Network and Networking Components ========== //
332333

333-
module network 'modules/network.bicep' = if (enablePrivateNetworking) {
334-
name: take('module.network.${solutionSuffix}', 64)
334+
// Virtual Network with NSGs and Subnets
335+
module virtualNetwork 'modules/virtualNetwork.bicep' = if (enablePrivateNetworking) {
336+
name: take('module.virtualNetwork.${solutionSuffix}', 64)
335337
params: {
336-
resourcesName: solutionSuffix
337-
logAnalyticsWorkSpaceResourceId: logAnalyticsWorkspaceResourceId
338-
vmAdminUsername: vmAdminUsername ?? 'JumpboxAdminUser'
339-
vmAdminPassword: vmAdminPassword ?? 'JumpboxAdminP@ssw0rd1234!'
340-
vmSize: vmSize ?? 'Standard_DS2_v2' // Default VM size
338+
name: 'vnet-${solutionSuffix}'
339+
addressPrefixes: ['10.0.0.0/20'] // 4096 addresses (enough for 8 /23 subnets or 16 /24)
341340
location: location
342341
tags: tags
342+
logAnalyticsWorkspaceId: logAnalyticsWorkspaceResourceId
343+
resourceSuffix: solutionSuffix
343344
enableTelemetry: enableTelemetry
344345
}
345346
}
347+
// Azure Bastion Host
348+
var bastionHostName = 'bas-${solutionSuffix}'
349+
module bastionHost 'br/public:avm/res/network/bastion-host:0.6.1' = if (enablePrivateNetworking) {
350+
name: take('avm.res.network.bastion-host.${bastionHostName}', 64)
351+
params: {
352+
name: bastionHostName
353+
skuName: 'Standard'
354+
location: location
355+
virtualNetworkResourceId: virtualNetwork!.outputs.resourceId
356+
diagnosticSettings: [
357+
{
358+
name: 'bastionDiagnostics'
359+
workspaceResourceId: logAnalyticsWorkspaceResourceId
360+
logCategoriesAndGroups: [
361+
{
362+
categoryGroup: 'allLogs'
363+
enabled: true
364+
}
365+
]
366+
}
367+
]
368+
tags: tags
369+
enableTelemetry: enableTelemetry
370+
publicIPAddressObject: {
371+
name: 'pip-${bastionHostName}'
372+
zones: []
373+
}
374+
}
375+
}
346376

377+
// Jumpbox Virtual Machine
378+
var jumpboxVmName = take('vm-jumpbox-${solutionSuffix}', 15)
379+
module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.15.0' = if (enablePrivateNetworking) {
380+
name: take('avm.res.compute.virtual-machine.${jumpboxVmName}', 64)
381+
params: {
382+
name: take(jumpboxVmName, 15) // Shorten VM name to 15 characters to avoid Azure limits
383+
vmSize: vmSize ?? 'Standard_DS2_v2'
384+
location: location
385+
adminUsername: vmAdminUsername ?? 'JumpboxAdminUser'
386+
adminPassword: vmAdminPassword ?? 'JumpboxAdminP@ssw0rd1234!'
387+
tags: tags
388+
zone: 0
389+
imageReference: {
390+
offer: 'WindowsServer'
391+
publisher: 'MicrosoftWindowsServer'
392+
sku: '2019-datacenter'
393+
version: 'latest'
394+
}
395+
osType: 'Windows'
396+
osDisk: {
397+
name: 'osdisk-${jumpboxVmName}'
398+
managedDisk: {
399+
storageAccountType: 'Standard_LRS'
400+
}
401+
}
402+
encryptionAtHost: false // Some Azure subscriptions do not support encryption at host
403+
nicConfigurations: [
404+
{
405+
name: 'nic-${jumpboxVmName}'
406+
ipConfigurations: [
407+
{
408+
name: 'ipconfig1'
409+
subnetResourceId: virtualNetwork!.outputs.jumpboxSubnetResourceId
410+
}
411+
]
412+
diagnosticSettings: [
413+
{
414+
name: 'jumpboxDiagnostics'
415+
workspaceResourceId: logAnalyticsWorkspaceResourceId
416+
logCategoriesAndGroups: [
417+
{
418+
categoryGroup: 'allLogs'
419+
enabled: true
420+
}
421+
]
422+
metricCategories: [
423+
{
424+
category: 'AllMetrics'
425+
enabled: true
426+
}
427+
]
428+
}
429+
]
430+
}
431+
]
432+
enableTelemetry: enableTelemetry
433+
}
434+
}
347435
// ========== Private DNS Zones ========== //
348436
var privateDnsZones = [
349437
'privatelink.cognitiveservices.azure.com'
@@ -394,8 +482,8 @@ module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.7.1' = [
394482
enableTelemetry: enableTelemetry
395483
virtualNetworkLinks: [
396484
{
397-
name: take('vnetlink-${network!.outputs.vnetName}-${split(zone, '.')[1]}', 80)
398-
virtualNetworkResourceId: network!.outputs.vnetResourceId
485+
name: take('vnetlink-${virtualNetwork!.outputs.name}-${split(zone, '.')[1]}', 80)
486+
virtualNetworkResourceId: virtualNetwork!.outputs.resourceId
399487
}
400488
]
401489
}
@@ -463,7 +551,7 @@ module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
463551
]
464552
}
465553
service: 'vault'
466-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
554+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
467555
}
468556
]
469557
: []
@@ -698,7 +786,7 @@ module aiFoundryAiServices 'modules/ai-services.bicep' = if (aiFoundryAIservices
698786
{
699787
name: 'pep-${aiFoundryAiServicesResourceName}'
700788
customNetworkInterfaceName: 'nic-${aiFoundryAiServicesResourceName}'
701-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
789+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
702790
privateDnsZoneGroup: {
703791
privateDnsZoneGroupConfigs: [
704792
{
@@ -780,7 +868,7 @@ module cognitiveServicesCu 'br/public:avm/res/cognitive-services/account:0.10.1'
780868
{
781869
name: 'pep-${aiFoundryAiServicesCUResourceName}'
782870
customNetworkInterfaceName: 'nic-${aiFoundryAiServicesCUResourceName}'
783-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
871+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
784872
privateDnsZoneGroup: {
785873
privateDnsZoneGroupConfigs: [
786874
{
@@ -887,7 +975,7 @@ module searchSearchServices 'br/public:avm/res/search/search-service:0.11.1' = {
887975
]
888976
}
889977
service: 'searchService'
890-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
978+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
891979
}
892980
]
893981
: []
@@ -990,7 +1078,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
9901078
{
9911079
name: 'pep-blob-${solutionSuffix}'
9921080
service: 'blob'
993-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
1081+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
9941082
privateDnsZoneGroup: {
9951083
privateDnsZoneGroupConfigs: [
9961084
{
@@ -1003,7 +1091,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
10031091
{
10041092
name: 'pep-queue-${solutionSuffix}'
10051093
service: 'queue'
1006-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
1094+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
10071095
privateDnsZoneGroup: {
10081096
privateDnsZoneGroupConfigs: [
10091097
{
@@ -1016,7 +1104,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
10161104
{
10171105
name: 'pep-file-${solutionSuffix}'
10181106
service: 'file'
1019-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
1107+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
10201108
privateDnsZoneGroup: {
10211109
privateDnsZoneGroupConfigs: [
10221110
{
@@ -1029,7 +1117,7 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
10291117
{
10301118
name: 'pep-dfs-${solutionSuffix}'
10311119
service: 'dfs'
1032-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
1120+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
10331121
privateDnsZoneGroup: {
10341122
privateDnsZoneGroupConfigs: [
10351123
{
@@ -1115,7 +1203,7 @@ module cosmosDb 'br/public:avm/res/document-db/database-account:0.15.0' = {
11151203
]
11161204
}
11171205
service: 'Sql'
1118-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
1206+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
11191207
}
11201208
]
11211209
: []
@@ -1204,7 +1292,7 @@ module sqlDBModule 'br/public:avm/res/sql/server:0.20.1' = {
12041292
]
12051293
}
12061294
service: 'sqlServer'
1207-
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
1295+
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
12081296
tags: tags
12091297
}
12101298
]
@@ -1246,7 +1334,7 @@ module uploadFiles 'br/public:avm/res/resources/deployment-script:0.5.1' = {
12461334
arguments: '${storageAccount.outputs.name} data ${baseUrl} ${userAssignedIdentity.outputs.clientId}'
12471335
storageAccountResourceId: storageAccount.outputs.resourceId
12481336
subnetResourceIds: enablePrivateNetworking ? [
1249-
network!.outputs.subnetDeploymentScriptsResourceId
1337+
virtualNetwork!.outputs.deploymentScriptsSubnetResourceId
12501338
] : null
12511339
tags: tags
12521340
timeout: 'PT1H'
@@ -1278,7 +1366,7 @@ module createIndex 'br/public:avm/res/resources/deployment-script:0.5.1' = {
12781366
cleanupPreference: 'OnSuccess'
12791367
storageAccountResourceId: storageAccount.outputs.resourceId
12801368
subnetResourceIds: enablePrivateNetworking ? [
1281-
network!.outputs.subnetDeploymentScriptsResourceId
1369+
virtualNetwork!.outputs.deploymentScriptsSubnetResourceId
12821370
] : null
12831371
}
12841372
dependsOn:[sqlDBModule,uploadFiles]
@@ -1321,7 +1409,7 @@ module createSqlUserAndRole 'br/public:avm/res/resources/deployment-script:0.5.1
13211409
cleanupPreference: 'OnSuccess'
13221410
storageAccountResourceId: storageAccount.outputs.resourceId
13231411
subnetResourceIds: enablePrivateNetworking ? [
1324-
network!.outputs.subnetDeploymentScriptsResourceId
1412+
virtualNetwork!.outputs.deploymentScriptsSubnetResourceId
13251413
] : null
13261414
}
13271415
dependsOn:[sqlDBModule]
@@ -1471,7 +1559,7 @@ module webSiteBackend 'modules/web-sites.bicep' = {
14711559
// WAF aligned configuration for Private Networking
14721560
vnetRouteAllEnabled: enablePrivateNetworking ? true : false
14731561
vnetImagePullEnabled: enablePrivateNetworking ? true : false
1474-
virtualNetworkSubnetId: enablePrivateNetworking ? network!.outputs.subnetWebResourceId : null
1562+
virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webSubnetResourceId : null
14751563
publicNetworkAccess: 'Enabled'
14761564
}
14771565
}
@@ -1503,7 +1591,7 @@ module webSiteFrontend 'modules/web-sites.bicep' = {
15031591
]
15041592
vnetRouteAllEnabled: enablePrivateNetworking ? true : false
15051593
vnetImagePullEnabled: enablePrivateNetworking ? true : false
1506-
virtualNetworkSubnetId: enablePrivateNetworking ? network!.outputs.subnetWebResourceId : null
1594+
virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webSubnetResourceId : null
15071595
diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null
15081596
publicNetworkAccess: 'Enabled'
15091597
}

0 commit comments

Comments
 (0)