Skip to content

Commit 5bd75c4

Browse files
DocGailZhouDocGailZhou
committed
made it a true testing program
1 parent f57a00a commit 5bd75c4

1 file changed

Lines changed: 216 additions & 30 deletions

File tree

‎infra/modules/network/main.bicep‎

Lines changed: 216 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,232 @@
1+
// /****************************************************************************************************************************/
2+
// This is an example test program to create private networking resources independently to show the usage of the modules
3+
// with sample inputs.
4+
//
5+
// Next Steps:
6+
// Review infra/main.bicep and infra/modules/network.bicep for intended usage of the modules
7+
// Please infra/modules/network.bicep on how to customize the networking resources for your application.
8+
//
9+
// /****************************************************************************************************************************/
10+
111
@minLength(6)
212
@maxLength(25)
313
@description('Default name used for all resources.')
4-
param resourcesName string
14+
param resourcesName string = 'testNetwork'
515

616
@minLength(3)
717
@description('Azure region for all services.')
8-
param location string
9-
10-
@description('Resource ID of the Log Analytics Workspace for monitoring and diagnostics.')
11-
param logAnalyticsWorkSpaceResourceId string
12-
13-
@description('Networking address prefix for the VNET only.')
14-
param addressPrefixes array
15-
16-
@description('Array of subnets to be created within the VNET.')
17-
param subnets array
18+
param location string = 'eastus'
1819

1920
@description('Optional. Tags to be applied to the resources.')
2021
param tags object = {}
2122

22-
2323
var vnetName = 'vnet-${resourcesName}'
24+
@description('Networking address prefix for the VNET only')
25+
param addressPrefixes array = ['10.0.0.0/20'] // 4096 addresses (enough for 8 /23 subnets or 16 /24 subnets)
2426

25-
// jumpbox parameters
26-
param jumpboxVM bool = false
27-
param jumpboxSubnet object = {}
28-
param jumpboxAdminUser string = 'JumpboxAdminUser'
27+
param enableBastionHost bool = true
28+
var bastionHostName = 'bastionHost-${resourcesName}'
29+
30+
param jumpboxVM bool = true
31+
param jumpboxAdminUser string = 'JumpboxAdminUser'
2932
@secure()
30-
param jumpboxAdminPassword string
31-
param jumpboxVmSize string = 'Standard_D2s_v3'
32-
var jumpboxVmName = 'jumpboxVM-${resourcesName}'
33+
param jumpboxAdminPassword string = 'JumpboxAdminP@ssw0rd1234!'
34+
param jumpboxVmSize string = 'Standard_D2s_v3'
35+
var jumpboxVmName = 'jumpboxVM-${resourcesName}'
36+
37+
@description('Array of subnets to be created within the VNET.')
38+
param subnets array = [
39+
// Only one delegation per subnet is supported by the AVM module as of June 2025.
40+
// For subnets that do not require delegation, leave the array empty.
41+
{
42+
name: 'web'
43+
addressPrefixes: ['10.0.0.0/23'] // /23 (10.0.0.0 - 10.0.1.255), 512 addresses
44+
networkSecurityGroup: {
45+
name: 'web-nsg'
46+
securityRules: [
47+
{
48+
name: 'AllowHttpsInbound'
49+
properties: {
50+
access: 'Allow'
51+
direction: 'Inbound'
52+
priority: 100
53+
protocol: 'Tcp'
54+
sourcePortRange: '*'
55+
destinationPortRange: '443'
56+
sourceAddressPrefixes: ['0.0.0.0/0']
57+
destinationAddressPrefixes: ['10.0.0.0/23']
58+
}
59+
}
60+
]
61+
}
62+
delegations: [
63+
{
64+
name: 'containerapps-delegation'
65+
serviceName: 'Microsoft.App/environments'
66+
}
67+
]
68+
}
69+
{
70+
name: 'app'
71+
addressPrefixes: ['10.0.2.0/23'] // /23 (10.0.2.0 - 10.0.3.255), 512 addresses
72+
networkSecurityGroup: {
73+
name: 'app-nsg'
74+
securityRules: [
75+
{
76+
name: 'AllowWebToApp'
77+
properties: {
78+
access: 'Allow'
79+
direction: 'Inbound'
80+
priority: 100
81+
protocol: 'Tcp'
82+
sourcePortRange: '*'
83+
destinationPortRange: '*'
84+
sourceAddressPrefixes: ['10.0.0.0/23'] // web subnet
85+
destinationAddressPrefixes: ['10.0.2.0/23']
86+
}
87+
}
88+
]
89+
}
90+
delegations: [
91+
{
92+
name: 'containerapps-delegation'
93+
serviceName: 'Microsoft.App/environments'
94+
}
95+
]
96+
}
97+
{
98+
name: 'ai'
99+
addressPrefixes: ['10.0.4.0/23'] // /23 (10.0.4.0 - 10.0.5.255), 512 addresses
100+
networkSecurityGroup: {
101+
name: 'ai-nsg'
102+
securityRules: [
103+
{
104+
name: 'AllowWebAppToAI'
105+
properties: {
106+
access: 'Allow'
107+
direction: 'Inbound'
108+
priority: 100
109+
protocol: 'Tcp'
110+
sourcePortRange: '*'
111+
destinationPortRange: '*'
112+
sourceAddressPrefixes: [
113+
'10.0.0.0/23' // web subnet
114+
'10.0.2.0/23' // app subnet
115+
]
116+
destinationAddressPrefixes: ['10.0.4.0/23']
117+
}
118+
}
119+
]
120+
}
121+
delegations: [] // No delegation required for this subnet.
122+
}
123+
{
124+
name: 'data'
125+
addressPrefixes: ['10.0.6.0/23'] // /23 (10.0.6.0 - 10.0.7.255)
126+
networkSecurityGroup: {
127+
name: 'data-nsg'
128+
securityRules: [
129+
{
130+
name: 'AllowWebAppAiToData'
131+
properties: {
132+
access: 'Allow'
133+
direction: 'Inbound'
134+
priority: 100
135+
protocol: 'Tcp'
136+
sourcePortRange: '*'
137+
destinationPortRange: '*'
138+
sourceAddressPrefixes: [
139+
'10.0.0.0/23' // web subnet
140+
'10.0.2.0/23' // app subnet
141+
'10.0.4.0/23' // ai subnet
142+
]
143+
destinationAddressPrefixes: ['10.0.6.0/23']
144+
}
145+
}
146+
]
147+
}
148+
delegations: [] // No delegation required for this subnet.
149+
}
150+
{
151+
name: 'services'
152+
addressPrefixes: ['10.0.8.0/23'] // /23 (10.0.8.0 - 10.0.9.255), 512 addresses
153+
networkSecurityGroup: {
154+
name: 'services-nsg'
155+
securityRules: [
156+
{
157+
name: 'AllowWebAppAiToServices'
158+
properties: {
159+
access: 'Allow'
160+
direction: 'Inbound'
161+
priority: 100
162+
protocol: 'Tcp'
163+
sourcePortRange: '*'
164+
destinationPortRange: '*'
165+
sourceAddressPrefixes: [
166+
'10.0.0.0/23' // web subnet
167+
'10.0.2.0/23' // app subnet
168+
'10.0.4.0/23' // ai subnet
169+
]
170+
destinationAddressPrefixes: ['10.0.8.0/23']
171+
}
172+
}
173+
]
174+
}
175+
delegations: [] // No delegation required for this subnet.
176+
}
177+
]
178+
179+
// jumpbox parameters
180+
param jumpboxSubnet object = {
181+
name: 'jumpbox'
182+
addressPrefixes: ['10.0.12.0/23'] // /23 (10.0.12.0 - 10.0.13.255), 512 addresses
183+
networkSecurityGroup: {
184+
name: 'jumpbox-nsg'
185+
securityRules: [
186+
{
187+
name: 'AllowJumpboxInbound'
188+
properties: {
189+
access: 'Allow'
190+
direction: 'Inbound'
191+
priority: 100
192+
protocol: 'Tcp'
193+
sourcePortRange: '*'
194+
destinationPortRange: '22'
195+
sourceAddressPrefixes: [
196+
'10.0.7.0/24' // Azure Bastion subnet as an example here. You can adjust this as needed by adding more
197+
]
198+
destinationAddressPrefixes: ['10.0.12.0/23']
199+
}
200+
}
201+
]
202+
}
203+
}
33204

34205
// Azure Bastion Host parameters
35-
param enableBastionHost bool = true
36-
param bastionSubnet object = {}
37-
var bastionHostName = 'bastionHost-${resourcesName}'
206+
param bastionSubnet object = {
207+
addressPrefixes: ['10.0.10.0/23'] // /23 (10.0.10.0 - 10.0.11.255), 512 addresses
208+
networkSecurityGroup: null // Azure Bastion subnet must NOT have an NSG
209+
}
210+
211+
212+
// /****************************************************************************************************************************/
213+
// Create Log Analytics Workspace for monitoring and diagnostics
214+
// /****************************************************************************************************************************/
38215

216+
module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.2' = {
217+
name: take('log-analytics-${resourcesName}-deployment', 64)
218+
params: {
219+
name: 'log-${resourcesName}'
220+
location: location
221+
skuName: 'PerGB2018'
222+
dataRetention: 30
223+
diagnosticSettings: [{ useThisWorkspace: true }]
224+
tags: tags
225+
}
226+
}
39227

40228
// /****************************************************************************************************************************/
41-
// Networking - NSGs, VNET and Subnets. Each subnet has its own NSG
229+
// Networking - NSGs, VNET and Subnets. Each subnet has its own NSG
42230
// /****************************************************************************************************************************/
43231

44232
module virtualNetwork 'virtualNetwork.bicep' = {
@@ -49,23 +237,23 @@ module virtualNetwork 'virtualNetwork.bicep' = {
49237
subnets: subnets
50238
location: location
51239
tags: tags
52-
logAnalyticsWorkspaceId: logAnalyticsWorkSpaceResourceId
240+
logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.resourceId
53241
}
54242
}
55243

56244
// /****************************************************************************************************************************/
57245
// // Create Azure Bastion Subnet and Azure Bastion Host
58246
// /****************************************************************************************************************************/
59247

60-
module bastionHost 'bastionHost.bicep' = if (enableBastionHost && !empty(bastionSubnet)) {
248+
module bastionHost 'bastionHost.bicep' = if(enableBastionHost && !empty(bastionSubnet)) {
61249
name: '${resourcesName}-bastionHost'
62250
params: {
63251
subnet: bastionSubnet
64252
location: location
65253
vnetName: virtualNetwork.outputs.name
66254
vnetId: virtualNetwork.outputs.resourceId
67255
name: bastionHostName
68-
logAnalyticsWorkspaceId: logAnalyticsWorkSpaceResourceId
256+
logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.resourceId
69257
tags: tags
70258
}
71259
}
@@ -74,7 +262,7 @@ module bastionHost 'bastionHost.bicep' = if (enableBastionHost && !empty(bastion
74262
// // create Jumpbox NSG and Jumpbox Subnet, then create Jumpbox VM
75263
// /****************************************************************************************************************************/
76264

77-
module jumpbox 'jumpbox.bicep' = if (jumpboxVM && !empty(jumpboxSubnet)) {
265+
module jumpbox 'jumpbox.bicep' = if (jumpboxVM && !empty(jumpboxSubnet)) {
78266
name: '${resourcesName}-jumpbox'
79267
params: {
80268
vmName: jumpboxVmName
@@ -85,7 +273,7 @@ module jumpbox 'jumpbox.bicep' = if (jumpboxVM && !empty(jumpboxSubnet)) {
85273
jumpboxAdminUser: jumpboxAdminUser
86274
jumpboxAdminPassword: jumpboxAdminPassword
87275
tags: tags
88-
logAnalyticsWorkspaceId: logAnalyticsWorkSpaceResourceId
276+
logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.resourceId
89277
}
90278
}
91279

@@ -102,5 +290,3 @@ output jumpboxSubnetName string = jumpbox.outputs.subnetId
102290
output jumpboxSubnetId string = jumpbox.outputs.subnetId
103291
output jumpboxVmName string = jumpbox.outputs.vmName
104292
output jumpboxVmId string = jumpbox.outputs.vmId
105-
106-

0 commit comments

Comments
 (0)