Skip to content

Commit 4b555ca

Browse files
author
Seth
committed
WAF - sln name update, networking param types
1 parent 25e2d4d commit 4b555ca

5 files changed

Lines changed: 139 additions & 110 deletions

File tree

‎infra/main.bicepparam‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
using './main.bicep'
22

3-
param environmentName = readEnvironmentVariable('AZURE_ENV_NAME')
3+
param solutionName = readEnvironmentVariable('AZURE_ENV_NAME')
44
param location = readEnvironmentVariable('AZURE_LOCATION')

‎infra/modules/network.bicep‎

Lines changed: 32 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -81,37 +81,38 @@ module network 'network/main.bicep' = {
8181
privateLinkServiceNetworkPolicies: 'Disabled'
8282
}
8383
]
84-
enableBastionHost: true // Set to true to enable Azure Bastion Host creation.
85-
bastionSubnet: {
86-
addressPrefixes: ['10.0.10.0/23'] // /23 (10.0.10.0 - 10.0.11.255), 512 addresses
87-
networkSecurityGroup: null // Azure Bastion subnet must NOT have an NSG
84+
bastionConfiguration: {
85+
name: 'bastion-${resourcesName}'
86+
subnetAddressPrefixes: ['10.0.10.0/23']
8887
}
89-
jumpboxVM: true // Set to true to enable Jumpbox VM creation.
90-
jumpboxVmSize: 'Standard_D2s_v3'
91-
jumpboxAdminUser: 'JumpboxAdminUser'
92-
jumpboxAdminPassword: 'JumpboxAdminP@ssw0rd1234!'
93-
jumpboxSubnet: {
94-
name: 'jumpbox'
95-
addressPrefixes: ['10.0.12.0/23'] // /23 (10.0.12.0 - 10.0.13.255), 512 addresses
96-
networkSecurityGroup: {
97-
name: 'jumpbox-nsg'
98-
securityRules: [
99-
{
100-
name: 'AllowJumpboxInbound'
101-
properties: {
102-
access: 'Allow'
103-
direction: 'Inbound'
104-
priority: 100
105-
protocol: 'Tcp'
106-
sourcePortRange: '*'
107-
destinationPortRange: '22'
108-
sourceAddressPrefixes: [
109-
'10.0.7.0/24' // Azure Bastion subnet as an example here. You can adjust this as needed by adding more
110-
]
111-
destinationAddressPrefixes: ['10.0.12.0/23']
88+
jumpboxConfiguration: {
89+
name: 'vm-jumpbox-${resourcesName}'
90+
size: 'Standard_D2s_v3'
91+
username: 'JumpboxAdminUser'
92+
password: 'JumpboxAdminP@ssw0rd1234!'
93+
subnet: {
94+
name: 'jumpbox'
95+
addressPrefixes: ['10.0.12.0/23'] // /23 (10.0.12.0 - 10.0.13.255), 512 addresses
96+
networkSecurityGroup: {
97+
name: 'jumpbox-nsg'
98+
securityRules: [
99+
{
100+
name: 'AllowJumpboxInbound'
101+
properties: {
102+
access: 'Allow'
103+
direction: 'Inbound'
104+
priority: 100
105+
protocol: 'Tcp'
106+
sourcePortRange: '*'
107+
destinationPortRange: '22'
108+
sourceAddressPrefixes: [
109+
'10.0.7.0/24' // Azure Bastion subnet as an example here. You can adjust this as needed by adding more
110+
]
111+
destinationAddressPrefixes: ['10.0.12.0/23']
112+
}
112113
}
113-
}
114-
]
114+
]
115+
}
115116
}
116117
}
117118
}
@@ -130,5 +131,5 @@ output bastionHostName string = network.outputs.bastionHostName
130131

131132
output jumpboxSubnetName string = network.outputs.jumpboxSubnetName
132133
output jumpboxSubnetId string = network.outputs.jumpboxSubnetId
133-
output jumpboxVmName string = network.outputs.jumpboxVmName
134-
output jumpboxVmId string = network.outputs.jumpboxVmId
134+
output jumpboxName string = network.outputs.jumpboxName
135+
output jumpboxResourceId string = network.outputs.jumpboxResourceId

‎infra/modules/network/bastionHost.bicep‎

Lines changed: 31 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,30 +2,43 @@
22
// Create Azure Bastion Subnet and Azure Bastion Host
33
// /****************************************************************************************************************************/
44

5-
param subnet object = {}
5+
@description('Name of the Azure Bastion Host resource.')
6+
param name string
7+
8+
@description('Azure region to deploy resources.')
69
param location string = resourceGroup().location
7-
param vnetName string
8-
param vnetId string // Resource ID of the Virtual Network
9-
param name string = 'AzureBastionHost' // Default name for Azure Bastion Host
10+
11+
@description('Conditional. List of address prefixes for the subnet. Leave empty to skip subnet creation.')
12+
param subnetAddressPrefixes string[]?
13+
14+
@description('Resource ID of the Virtual Network where the Azure Bastion Host will be deployed.')
15+
param vnetId string
16+
17+
@description('Name of the Virtual Network where the Azure Bastion Host will be deployed.')
18+
param vnetName string
19+
20+
@description('Resource ID of the Log Analytics Workspace for monitoring and diagnostics.')
1021
param logAnalyticsWorkspaceId string
22+
23+
@description('Optional. Tags to apply to the resources.')
1124
param tags object = {}
1225

1326
// 1. Create Azure Bastion Host using AVM Subnet Module with special config for Azure Bastion Subnet
1427
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/virtual-network/subnet
15-
module bastionSubnet 'br/public:avm/res/network/virtual-network/subnet:0.1.2' = if (!empty(subnet)) {
28+
module bastionSubnet 'br/public:avm/res/network/virtual-network/subnet:0.1.2' = if (!empty(subnetAddressPrefixes)) {
1629
name: take('bastionSubnet-${vnetName}', 64)
1730
params: {
1831
virtualNetworkName: vnetName
1932
name: 'AzureBastionSubnet'
20-
addressPrefixes: subnet.addressPrefixes
33+
addressPrefixes: subnetAddressPrefixes
2134
}
2235
}
2336

2437
// 2. Create Azure Bastion Host in AzureBastionsubnetSubnet using AVM Bastion Host module
2538
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/bastion-host
2639

27-
module bastionHost 'br/public:avm/res/network/bastion-host:0.6.1' = if (!empty(subnet)) {
28-
name: name
40+
module bastionHost 'br/public:avm/res/network/bastion-host:0.6.1' = {
41+
name: take('bastionHost-${vnetName}-${name}', 64)
2942
params: {
3043
name: name
3144
skuName: 'Standard'
@@ -51,3 +64,13 @@ output resourceId string = bastionHost.outputs.resourceId
5164
output name string = bastionHost.outputs.name
5265
output subnetId string = bastionSubnet.outputs.resourceId
5366
output subnetName string = bastionSubnet.outputs.name
67+
68+
@export()
69+
@description('Custom type definition for establishing Bastion Host for remote connection.')
70+
type bastionHostConfigurationType = {
71+
@description('The name of the Bastion Host resource.')
72+
name: string
73+
74+
@description('Optional. List of address prefixes for the subnet.')
75+
subnetAddressPrefixes: string[]?
76+
}

‎infra/modules/network/jumpbox.bicep‎

Lines changed: 50 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,75 @@
11
// /****************************************************************************************************************************/
22
// Create Jumpbox NSG and Jumpbox Subnet, then create Jumpbox VM
33
// /****************************************************************************************************************************/
4-
param vmName string = 'jumpboxVM' // Default name for Jumpbox VM
4+
5+
@description('Name of the Jumpbox Virtual Machine.')
6+
param name string
7+
8+
@description('Azure region to deploy resources.')
59
param location string = resourceGroup().location
10+
11+
@description('Name of the Virtual Network where the Jumpbox VM will be deployed.')
612
param vnetName string
7-
param jumpboxVmSize string = 'Standard_D2s_v3' // Default VM size for Jumpbox, can be overridden
813

9-
param jumpboxSubnet object = {} // This was defined in the .param file as a complex object
10-
param jumpboxAdminUser string = 'JumpboxAdminUser' // Default admin username for Jumpbox VM
14+
@description('Size of the Jumpbox Virtual Machine.')
15+
param size string
16+
17+
import { subnetType } from 'virtualNetwork.bicep'
18+
@description('Optional. Subnet configuration for the Jumpbox VM.')
19+
param subnet subnetType?
20+
21+
@description('Username to access the Jumpbox VM.')
22+
param username string
23+
1124
@secure()
12-
param jumpboxAdminPassword string
25+
@description('Password to access the Jumpbox VM.')
26+
param password string
1327

28+
@description('Optional. Tags to apply to the resources.')
1429
param tags object = {}
30+
31+
@description('Log Analytics Workspace Resource ID for VM diagnostics.')
1532
param logAnalyticsWorkspaceId string
1633

1734
// 1. Create Jumpbox NSG
1835
// using AVM Network Security Group module
1936
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/network-security-group
20-
module jbNsg 'br/public:avm/res/network/network-security-group:0.5.1' = if (!empty(jumpboxSubnet)) {
21-
name: '${vnetName}-${jumpboxSubnet.networkSecurityGroup.name}'
37+
module nsg 'br/public:avm/res/network/network-security-group:0.5.1' = if (!empty(subnet)) {
38+
name: '${vnetName}-${subnet.?networkSecurityGroup.name}'
2239
params: {
23-
name: '${vnetName}-${jumpboxSubnet.networkSecurityGroup.name}'
40+
name: '${vnetName}-${subnet.?networkSecurityGroup.name}'
2441
location: location
25-
securityRules: jumpboxSubnet.networkSecurityGroup.securityRules
42+
securityRules: subnet.?networkSecurityGroup.securityRules
2643
tags: tags
2744
}
2845
}
2946

3047
// 2. Create Jumpbox subnet as part of the existing VNet
3148
// using AVM Virtual Network Subnet module
3249
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/network/virtual-network/subnet
33-
module jbSubnet 'br/public:avm/res/network/virtual-network/subnet:0.1.2' = if (!empty(jumpboxSubnet)) {
34-
name: jumpboxSubnet.name
50+
module subnetResource 'br/public:avm/res/network/virtual-network/subnet:0.1.2' = if (!empty(subnet)) {
51+
name: subnet.?name ?? '${vnetName}-jumpbox-subnet'
3552
params: {
3653
virtualNetworkName: vnetName
37-
name: jumpboxSubnet.name
38-
addressPrefixes: jumpboxSubnet.addressPrefixes
39-
networkSecurityGroupResourceId: jbNsg.outputs.resourceId
54+
name: subnet.?name ?? ''
55+
addressPrefixes: subnet.?addressPrefixes
56+
networkSecurityGroupResourceId: nsg.outputs.resourceId
4057
}
4158
}
4259

4360
// 3. Create Jumpbox VM
4461
// using AVM Virtual Machine module
4562
// https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/compute/virtual-machine
46-
var limitedVmName = take(vmName, 15) // Shorten VM name to 15 characters to avoid Azure limits
47-
module jbVm 'br/public:avm/res/compute/virtual-machine:0.15.0' = {
48-
name: vmName
63+
var vmName = take(name, 15) // Shorten VM name to 15 characters to avoid Azure limits
64+
65+
module vm 'br/public:avm/res/compute/virtual-machine:0.15.0' = {
66+
name: take('${vmName}-jumpbox', 64)
4967
params: {
50-
name: limitedVmName
51-
vmSize: jumpboxVmSize
68+
name: vmName
69+
vmSize: size
5270
location: location
53-
adminUsername: jumpboxAdminUser
54-
adminPassword: jumpboxAdminPassword
71+
adminUsername: username
72+
adminPassword: password
5573
tags: tags
5674
zone: 2
5775
imageReference: {
@@ -69,14 +87,14 @@ module jbVm 'br/public:avm/res/compute/virtual-machine:0.15.0' = {
6987
encryptionAtHost: false // Some Azure subscriptions do not support encryption at host
7088
nicConfigurations: [
7189
{
72-
name: '${limitedVmName}-nic'
90+
name: '${vmName}-nic'
7391
ipConfigurations: [
7492
{
7593
name: 'ipconfig1'
76-
subnetResourceId: jbSubnet.outputs.resourceId
94+
subnetResourceId: subnetResource.outputs.resourceId
7795
}
7896
]
79-
networkSecurityGroupResourceId: jbNsg.outputs.resourceId
97+
networkSecurityGroupResourceId: nsg.outputs.resourceId
8098
diagnosticSettings: [
8199
{
82100
name: 'jumpboxDiagnostics'
@@ -100,16 +118,14 @@ module jbVm 'br/public:avm/res/compute/virtual-machine:0.15.0' = {
100118
}
101119
}
102120

103-
output vmId string = jbVm.outputs.resourceId
104-
output vmName string = jbVm.outputs.name
105-
output vMLocation string = jbVm.outputs.location
121+
output resourceId string = vm.outputs.resourceId
122+
output name string = vm.outputs.name
123+
output location string = vm.outputs.location
106124

107-
output subnetId string = jbSubnet.outputs.resourceId
108-
output subnetName string = jbSubnet.outputs.name
109-
output nsgId string = jbNsg.outputs.resourceId
110-
output nsgName string = jbNsg.outputs.name
111-
112-
import { subnetType } from 'virtualNetwork.bicep'
125+
output subnetId string = subnetResource.outputs.resourceId
126+
output subnetName string = subnetResource.outputs.name
127+
output nsgId string = nsg.outputs.resourceId
128+
output nsgName string = nsg.outputs.name
113129

114130
@export()
115131
@description('Custom type definition for establishing Jumpbox Virtual Machine and its associated resources.')
@@ -118,7 +134,7 @@ type jumpBoxConfigurationType = {
118134
name: string
119135

120136
@description('The size of the VM.')
121-
size: string
137+
size: string?
122138

123139
@description('Username to access VM.')
124140
username: string

0 commit comments

Comments
 (0)