Skip to content

Commit 0579bc6

Browse files
Prekshith-MicrosoftPrekshith-Microsoft
committed
updated
1 parent 7ebc4dc commit 0579bc6

File tree

2 files changed

+103
-164
lines changed

2 files changed

+103
-164
lines changed

‎infra/main.bicep‎

Lines changed: 1 addition & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -670,64 +670,7 @@ module virtualNetwork 'modules/virtualNetwork.bicep' = if (enablePrivateNetworki
670670
}
671671
]
672672
*/
673-
// Jumpbox Virtual Machine
674-
var jumpboxVmName = take('vm-jumpbox-${solutionSuffix}', 15)
675-
module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.15.0' = if (enablePrivateNetworking) {
676-
name: take('avm.res.compute.virtual-machine.${jumpboxVmName}', 64)
677-
params: {
678-
name: take(jumpboxVmName, 15) // Shorten VM name to 15 characters to avoid Azure limits
679-
vmSize: 'Standard_DS2_v2'
680-
location: location
681-
adminUsername: virtualMachineAdminUsername
682-
adminPassword: virtualMachineAdminPassword
683-
tags: tags
684-
zone: 0
685-
imageReference: {
686-
offer: 'WindowsServer'
687-
publisher: 'MicrosoftWindowsServer'
688-
sku: '2019-datacenter'
689-
version: 'latest'
690-
}
691-
osType: 'Windows'
692-
osDisk: {
693-
name: 'osdisk-${jumpboxVmName}'
694-
managedDisk: {
695-
storageAccountType: 'Standard_LRS'
696-
}
697-
}
698-
encryptionAtHost: false // Some Azure subscriptions do not support encryption at host
699-
nicConfigurations: [
700-
{
701-
name: 'nic-${jumpboxVmName}'
702-
ipConfigurations: [
703-
{
704-
name: 'ipconfig1'
705-
subnetResourceId: virtualNetwork!.outputs.jumpboxSubnetResourceId
706-
}
707-
]
708-
diagnosticSettings: [
709-
{
710-
name: 'jumpboxDiagnostics'
711-
workspaceResourceId: logAnalyticsWorkspaceResourceId
712-
logCategoriesAndGroups: [
713-
{
714-
categoryGroup: 'allLogs'
715-
enabled: true
716-
}
717-
]
718-
metricCategories: [
719-
{
720-
category: 'AllMetrics'
721-
enabled: true
722-
}
723-
]
724-
}
725-
]
726-
}
727-
]
728-
enableTelemetry: enableTelemetry
729-
}
730-
}
673+
731674
var bastionResourceName = 'bas-${solutionSuffix}'
732675
// ========== Bastion host ========== //
733676
// WAF best practices for virtual networks: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/virtual-network

‎infra/modules/virtualNetwork.bicep‎

Lines changed: 102 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -13,89 +13,7 @@ param addressPrefixes array
1313
@description('An array of subnets to be created within the virtual network. Each subnet can have its own configuration and associated Network Security Group (NSG).')
1414
param subnets subnetType[] = [
1515

16-
{
17-
name: 'AzureBastionSubnet' // Required name for Azure Bastion
18-
addressPrefixes: ['10.0.0.64/26']
19-
networkSecurityGroup: {
20-
name: 'nsg-bastion'
21-
securityRules: [
22-
{
23-
name: 'AllowGatewayManager'
24-
properties: {
25-
access: 'Allow'
26-
direction: 'Inbound'
27-
priority: 2702
28-
protocol: '*'
29-
sourcePortRange: '*'
30-
destinationPortRange: '443'
31-
sourceAddressPrefix: 'GatewayManager'
32-
destinationAddressPrefix: '*'
33-
}
34-
}
35-
{
36-
name: 'AllowHttpsInBound'
37-
properties: {
38-
access: 'Allow'
39-
direction: 'Inbound'
40-
priority: 2703
41-
protocol: '*'
42-
sourcePortRange: '*'
43-
destinationPortRange: '443'
44-
sourceAddressPrefix: 'Internet'
45-
destinationAddressPrefix: '*'
46-
}
47-
}
48-
{
49-
name: 'AllowSshRdpOutbound'
50-
properties: {
51-
access: 'Allow'
52-
direction: 'Outbound'
53-
priority: 100
54-
protocol: '*'
55-
sourcePortRange: '*'
56-
destinationPortRanges: ['22', '3389']
57-
sourceAddressPrefix: '*'
58-
destinationAddressPrefix: 'VirtualNetwork'
59-
}
60-
}
61-
{
62-
name: 'AllowAzureCloudOutbound'
63-
properties: {
64-
access: 'Allow'
65-
direction: 'Outbound'
66-
priority: 110
67-
protocol: 'Tcp'
68-
sourcePortRange: '*'
69-
destinationPortRange: '443'
70-
sourceAddressPrefix: '*'
71-
destinationAddressPrefix: 'AzureCloud'
72-
}
73-
}
74-
]
75-
}
76-
}
77-
{
78-
name: 'jumpbox'
79-
addressPrefixes: ['10.0.12.0/23'] // /23 (10.0.12.0 - 10.0.13.255), 512 addresses
80-
networkSecurityGroup: {
81-
name: 'nsg-jumpbox'
82-
securityRules: [
83-
{
84-
name: 'AllowRdpFromBastion'
85-
properties: {
86-
access: 'Allow'
87-
direction: 'Inbound'
88-
priority: 100
89-
protocol: 'Tcp'
90-
sourcePortRange: '*'
91-
destinationPortRange: '3389'
92-
sourceAddressPrefixes: ['10.0.10.0/26'] // Azure Bastion subnet
93-
destinationAddressPrefixes: ['10.0.12.0/23']
94-
}
95-
}
96-
]
97-
}
98-
}
16+
9917
{
10018
name:'backend'
10119
addressPrefixes: ['10.0.0.0/27']
@@ -121,11 +39,14 @@ param subnets subnetType[] = [
12139
]
12240
}
12341
}
124-
{
125-
name: 'administration'
126-
addressPrefixes: ['10.0.0.32/27']
42+
{
43+
name: 'containers'
44+
addressPrefixes: ['10.0.2.0/23']
45+
delegation: 'Microsoft.App/environments'
46+
privateEndpointNetworkPolicies: 'Enabled'
47+
privateLinkServiceNetworkPolicies: 'Enabled'
12748
networkSecurityGroup: {
128-
name: 'nsg-administration'
49+
name: 'nsg-containers'
12950
securityRules: [
13051
{
13152
name: 'deny-hop-outbound'
@@ -147,12 +68,15 @@ param subnets subnetType[] = [
14768
}
14869
}
14970
{
150-
name: 'containers'
151-
addressPrefixes: ['10.0.2.0/23']
71+
name: 'webserverfarm'
72+
addressPrefixes: ['10.0.4.0/27']
73+
delegation: 'Microsoft.Web/serverfarms'
74+
privateEndpointNetworkPolicies: 'Enabled'
75+
privateLinkServiceNetworkPolicies: 'Enabled'
15276
networkSecurityGroup: {
153-
name: 'nsg-containers'
77+
name: 'nsg-webserverfarm'
15478
securityRules: [
155-
{
79+
{
15680
name: 'deny-hop-outbound'
15781
properties: {
15882
access: 'Deny'
@@ -172,12 +96,12 @@ param subnets subnetType[] = [
17296
}
17397
}
17498
{
175-
name: 'webserverfarm'
176-
addressPrefixes: ['10.0.4.0/27']
99+
name: 'administration'
100+
addressPrefixes: ['10.0.0.32/27']
177101
networkSecurityGroup: {
178-
name: 'nsg-webserverfarm'
102+
name: 'nsg-administration'
179103
securityRules: [
180-
{
104+
{
181105
name: 'deny-hop-outbound'
182106
properties: {
183107
access: 'Deny'
@@ -197,14 +121,87 @@ param subnets subnetType[] = [
197121
}
198122
}
199123
{
200-
name: 'deployment-scripts'
201-
addressPrefixes: ['10.0.4.0/24']
202-
networkSecurityGroup: {
203-
name: 'nsg-deployment-scripts'
204-
securityRules: []
124+
name: 'AzureBastionSubnet' // Required name for Azure Bastion
125+
addressPrefixes: ['10.0.0.64/26']
126+
networkSecurityGroup: {
127+
name: 'nsg-bastion'
128+
securityRules: [
129+
{
130+
name: 'AllowGatewayManager'
131+
properties: {
132+
access: 'Allow'
133+
direction: 'Inbound'
134+
priority: 2702
135+
protocol: '*'
136+
sourcePortRange: '*'
137+
destinationPortRange: '443'
138+
sourceAddressPrefix: 'GatewayManager'
139+
destinationAddressPrefix: '*'
140+
}
141+
}
142+
{
143+
name: 'AllowHttpsInBound'
144+
properties: {
145+
access: 'Allow'
146+
direction: 'Inbound'
147+
priority: 2703
148+
protocol: '*'
149+
sourcePortRange: '*'
150+
destinationPortRange: '443'
151+
sourceAddressPrefix: 'Internet'
152+
destinationAddressPrefix: '*'
153+
}
205154
}
206-
delegation: 'Microsoft.ContainerInstance/containerGroups'
207-
serviceEndpoints: ['Microsoft.Storage']
155+
{
156+
name: 'AllowSshRdpOutbound'
157+
properties: {
158+
access: 'Allow'
159+
direction: 'Outbound'
160+
priority: 100
161+
protocol: '*'
162+
sourcePortRange: '*'
163+
destinationPortRanges: ['22', '3389']
164+
sourceAddressPrefix: '*'
165+
destinationAddressPrefix: 'VirtualNetwork'
166+
}
167+
}
168+
{
169+
name: 'AllowAzureCloudOutbound'
170+
properties: {
171+
access: 'Allow'
172+
direction: 'Outbound'
173+
priority: 110
174+
protocol: 'Tcp'
175+
sourcePortRange: '*'
176+
destinationPortRange: '443'
177+
sourceAddressPrefix: '*'
178+
destinationAddressPrefix: 'AzureCloud'
179+
}
180+
}
181+
]
182+
}
183+
}
184+
{
185+
name: 'jumpbox'
186+
addressPrefixes: ['10.0.12.0/23'] // /23 (10.0.12.0 - 10.0.13.255), 512 addresses
187+
networkSecurityGroup: {
188+
name: 'nsg-jumpbox'
189+
securityRules: [
190+
{
191+
name: 'AllowRdpFromBastion'
192+
properties: {
193+
access: 'Allow'
194+
direction: 'Inbound'
195+
priority: 100
196+
protocol: 'Tcp'
197+
sourcePortRange: '*'
198+
destinationPortRange: '3389'
199+
sourceAddressPrefixes: ['10.0.10.0/26'] // Azure Bastion subnet
200+
destinationAddressPrefixes: ['10.0.12.0/23']
201+
}
202+
}
203+
]
204+
}
208205
}
209206
]
210207

@@ -332,13 +329,12 @@ output subnets subnetOutputType[] = [
332329
]
333330

334331
// Dynamic outputs for individual subnets for backward compatibility
335-
output bastionSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'AzureBastionSubnet') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'AzureBastionSubnet')] : ''
336-
output jumpboxSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'jumpbox') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'jumpbox')] : ''
337-
output deploymentScriptsSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'deployment-scripts') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'deployment-scripts')] : ''
338332
output backendSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'backend') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'backend')] : ''
339-
output containerSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'container') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'container')] : ''
333+
output containerSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'containers') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'containers')] : ''
340334
output administrationSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'administration') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'administration')] : ''
341335
output webserverfarmSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'webserverfarm') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'webserverfarm')] : ''
336+
output bastionSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'AzureBastionSubnet') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'AzureBastionSubnet')] : ''
337+
output jumpboxSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'jumpbox') ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'jumpbox')] : ''
342338

343339
@export()
344340
@description('Custom type definition for subnet resource information as output')

0 commit comments

Comments
 (0)