Skip to content

Commit 1b4f96d

Browse files
Roopan-MicrosoftRoopan-Microsoft
authored
Merge pull request #162 from microsoft/psl-fix-nsgpolicyissue
fix: Create NSG for bastion and Pep subnet to avoid auto creation NSG by policy
2 parents 0788283 + e8cc723 commit 1b4f96d

4 files changed

Lines changed: 156 additions & 13 deletions

File tree

‎infra/modules/network.bicep‎

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,11 +128,75 @@ module network 'network/main.bicep' = {
128128
addressPrefixes: ['10.0.2.0/23'] // /23 (10.0.2.0 - 10.0.3.255), 512 addresses
129129
privateEndpointNetworkPolicies: 'Disabled'
130130
privateLinkServiceNetworkPolicies: 'Disabled'
131+
networkSecurityGroup: {
132+
name: 'nsg-peps'
133+
securityRules: []
134+
}
131135
}
132136
]
133137
bastionConfiguration: {
134138
name: 'bas-${resourcesName}'
135-
subnetAddressPrefixes: ['10.0.10.0/26']
139+
subnet: {
140+
name: 'AzureBastionSubnet'
141+
addressPrefixes: ['10.0.10.0/26']
142+
networkSecurityGroup: {
143+
name: 'nsg-AzureBastionSubnet'
144+
securityRules: [
145+
{
146+
name: 'AllowGatewayManager'
147+
properties: {
148+
access: 'Allow'
149+
direction: 'Inbound'
150+
priority: 2702
151+
protocol: '*'
152+
sourcePortRange: '*'
153+
destinationPortRange: '443'
154+
sourceAddressPrefix: 'GatewayManager'
155+
destinationAddressPrefix: '*'
156+
}
157+
}
158+
{
159+
name: 'AllowHttpsInBound'
160+
properties: {
161+
access: 'Allow'
162+
direction: 'Inbound'
163+
priority: 2703
164+
protocol: '*'
165+
sourcePortRange: '*'
166+
destinationPortRange: '443'
167+
sourceAddressPrefix: 'Internet'
168+
destinationAddressPrefix: '*'
169+
}
170+
}
171+
{
172+
name: 'AllowSshRdpOutbound'
173+
properties: {
174+
access: 'Allow'
175+
direction: 'Outbound'
176+
priority: 100
177+
protocol: '*'
178+
sourcePortRange: '*'
179+
destinationPortRanges: ['22', '3389']
180+
sourceAddressPrefix: '*'
181+
destinationAddressPrefix: 'VirtualNetwork'
182+
}
183+
}
184+
{
185+
name: 'AllowAzureCloudOutbound'
186+
properties: {
187+
access: 'Allow'
188+
direction: 'Outbound'
189+
priority: 110
190+
protocol: 'Tcp'
191+
sourcePortRange: '*'
192+
destinationPortRange: '443'
193+
sourceAddressPrefix: '*'
194+
destinationAddressPrefix: 'AzureCloud'
195+
}
196+
}
197+
]
198+
}
199+
}
136200
}
137201
jumpboxConfiguration: {
138202
name: 'vm-jumpbox-${resourcesName}'

‎infra/modules/network/bastionHost.bicep‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,6 @@ param name string
88
@description('Azure region to deploy resources.')
99
param location string = resourceGroup().location
1010

11-
@description('Conditional. List of address prefixes for the subnet. Leave empty to skip subnet creation.')
12-
param subnetAddressPrefixes string[]?
13-
1411
@description('Resource ID of the Virtual Network where the Azure Bastion Host will be deployed.')
1512
param vnetId string
1613

@@ -26,19 +23,38 @@ param tags object = {}
2623
@description('Optional. Enable/Disable usage telemetry for module.')
2724
param enableTelemetry bool = true
2825

29-
// 1. Create Azure Bastion Host using AVM Subnet Module with special config for Azure Bastion Subnet
26+
import { subnetType } from 'virtualNetwork.bicep'
27+
@description('Optional. Subnet configuration for the Jumpbox VM.')
28+
param subnet subnetType?
29+
30+
// 1. Create AzureBastionSubnet NSG
31+
// using AVM Network Security Group module
32+
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/network-security-group
33+
module nsg 'br/public:avm/res/network/network-security-group:0.5.1' = if (!empty(subnet)) {
34+
name: '${vnetName}-${subnet.?networkSecurityGroup.name}'
35+
params: {
36+
name: '${subnet.?networkSecurityGroup.name}-${vnetName}'
37+
location: location
38+
securityRules: subnet.?networkSecurityGroup.securityRules
39+
tags: tags
40+
enableTelemetry: enableTelemetry
41+
}
42+
}
43+
44+
// 2. Create Azure Bastion Host using AVM Subnet Module with special config for Azure Bastion Subnet
3045
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/virtual-network/subnet
31-
module bastionSubnet 'br/public:avm/res/network/virtual-network/subnet:0.1.2' = if (!empty(subnetAddressPrefixes)) {
46+
module bastionSubnet 'br/public:avm/res/network/virtual-network/subnet:0.1.2' = if (!empty(subnet)) {
3247
name: take('bastionSubnet-${vnetName}', 64)
3348
params: {
3449
virtualNetworkName: vnetName
3550
name: 'AzureBastionSubnet' // this name required as is for Azure Bastion Host subnet
36-
addressPrefixes: subnetAddressPrefixes
51+
addressPrefixes: subnet.?addressPrefixes
52+
networkSecurityGroupResourceId: nsg.outputs.resourceId
3753
enableTelemetry: enableTelemetry
3854
}
3955
}
4056

41-
// 2. Create Azure Bastion Host in AzureBastionsubnetSubnet using AVM Bastion Host module
57+
// 3. Create Azure Bastion Host in AzureBastionsubnetSubnet using AVM Bastion Host module
4258
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/bastion-host
4359

4460
module bastionHost 'br/public:avm/res/network/bastion-host:0.6.1' = {
@@ -64,9 +80,12 @@ module bastionHost 'br/public:avm/res/network/bastion-host:0.6.1' = {
6480
enableTelemetry: enableTelemetry
6581
publicIPAddressObject: {
6682
name: 'pip-${name}'
67-
zones:[]
83+
zones: []
6884
}
6985
}
86+
dependsOn: [
87+
bastionSubnet
88+
]
7089
}
7190

7291
output resourceId string = bastionHost.outputs.resourceId
@@ -80,6 +99,6 @@ type bastionHostConfigurationType = {
8099
@description('The name of the Bastion Host resource.')
81100
name: string
82101

83-
@description('Optional. List of address prefixes for the subnet.')
84-
subnetAddressPrefixes: string[]?
102+
@description('Optional. Subnet configuration for the Jumpbox VM.')
103+
subnet: subnetType?
85104
}

‎infra/modules/network/main.bicep‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ module bastionHost 'bastionHost.bicep' = if (!empty(bastionConfiguration)) {
6060
vnetName: virtualNetwork.outputs.name
6161
location: location
6262
logAnalyticsWorkspaceId: logAnalyticsWorkSpaceResourceId
63-
subnetAddressPrefixes: bastionConfiguration.?subnetAddressPrefixes
63+
subnet: bastionConfiguration.?subnet
6464
tags: tags
6565
enableTelemetry: enableTelemetry
6666
}

‎infra/samples/network-subnet-design.bicep‎

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,67 @@ import { bastionHostConfigurationType } from '../modules/network/bastionHost.bic
4343
@description('Optional. Configuration for the Azure Bastion Host. Leave null to omit Bastion creation.')
4444
param bastionConfiguration bastionHostConfigurationType = {
4545
name: 'bastion-${resourcesName}'
46-
subnetAddressPrefixes: ['10.0.10.0/23'] // /23 (10.0.10.0 - 10.0.11.255), 512 addresses
46+
subnet: {
47+
name: 'AzureBastionSubnet'
48+
addressPrefixes: ['10.0.10.0/23'] // /23 (10.0.10.0 - 10.0.11.255), 512 addresses
49+
networkSecurityGroup: {
50+
name: 'nsg-AzureBastionSubnet'
51+
securityRules: [
52+
{
53+
name: 'AllowGatewayManager'
54+
properties: {
55+
access: 'Allow'
56+
direction: 'Inbound'
57+
priority: 2702
58+
protocol: '*'
59+
sourcePortRange: '*'
60+
destinationPortRange: '443'
61+
sourceAddressPrefix: 'GatewayManager'
62+
destinationAddressPrefix: '*'
63+
}
64+
}
65+
{
66+
name: 'AllowHttpsInBound'
67+
properties: {
68+
access: 'Allow'
69+
direction: 'Inbound'
70+
priority: 2703
71+
protocol: '*'
72+
sourcePortRange: '*'
73+
destinationPortRange: '443'
74+
sourceAddressPrefix: 'Internet'
75+
destinationAddressPrefix: '*'
76+
}
77+
}
78+
{
79+
name: 'AllowSshRdpOutbound'
80+
properties: {
81+
access: 'Allow'
82+
direction: 'Outbound'
83+
priority: 100
84+
protocol: '*'
85+
sourcePortRange: '*'
86+
destinationPortRanges: ['22', '3389']
87+
sourceAddressPrefix: '*'
88+
destinationAddressPrefix: 'VirtualNetwork'
89+
}
90+
}
91+
{
92+
name: 'AllowAzureCloudOutbound'
93+
properties: {
94+
access: 'Allow'
95+
direction: 'Outbound'
96+
priority: 110
97+
protocol: 'Tcp'
98+
sourcePortRange: '*'
99+
destinationPortRange: '443'
100+
sourceAddressPrefix: '*'
101+
destinationAddressPrefix: 'AzureCloud'
102+
}
103+
}
104+
]
105+
}
106+
}
47107
}
48108

49109
import { jumpBoxConfigurationType } from '../modules/network/jumpbox.bicep'

0 commit comments

Comments
 (0)