Skip to content

Commit 904006e

Browse files
DocGailZhouDocGailZhou
committed
reverted back to main.bicep prior
1 parent cc27b06 commit 904006e

2 files changed

Lines changed: 320 additions & 215 deletions

File tree

‎infra/modules/network/Test_Network.bicep‎

Lines changed: 292 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,292 @@
1+
// /****************************************************************************************************************************/
2+
// This is an example test program to create private networking resources independently to show the usage of the modules
3+
// with sample inputs.
4+
//
5+
// Next Steps:
6+
// Review infra/main.bicep and infra/modules/network.bicep for intended usage of the modules
7+
// Please infra/modules/network.bicep on how to customize the networking resources for your application.
8+
//
9+
// /****************************************************************************************************************************/
10+
11+
@minLength(6)
12+
@maxLength(25)
13+
@description('Default name used for all resources.')
14+
param resourcesName string = 'testNetwork'
15+
16+
@minLength(3)
17+
@description('Azure region for all services.')
18+
param location string = 'eastus'
19+
20+
@description('Optional. Tags to be applied to the resources.')
21+
param tags object = {}
22+
23+
var vnetName = 'vnet-${resourcesName}'
24+
@description('Networking address prefix for the VNET only')
25+
param addressPrefixes array = ['10.0.0.0/20'] // 4096 addresses (enough for 8 /23 subnets or 16 /24 subnets)
26+
27+
param enableBastionHost bool = true
28+
var bastionHostName = 'bastionHost-${resourcesName}'
29+
30+
param jumpboxVM bool = true
31+
param jumpboxAdminUser string = 'JumpboxAdminUser'
32+
@secure()
33+
param jumpboxAdminPassword string = 'JumpboxAdminP@ssw0rd1234!'
34+
param jumpboxVmSize string = 'Standard_D2s_v3'
35+
var jumpboxVmName = 'jumpboxVM-${resourcesName}'
36+
37+
@description('Array of subnets to be created within the VNET.')
38+
param subnets array = [
39+
// Only one delegation per subnet is supported by the AVM module as of June 2025.
40+
// For subnets that do not require delegation, leave the array empty.
41+
{
42+
name: 'web'
43+
addressPrefixes: ['10.0.0.0/23'] // /23 (10.0.0.0 - 10.0.1.255), 512 addresses
44+
networkSecurityGroup: {
45+
name: 'web-nsg'
46+
securityRules: [
47+
{
48+
name: 'AllowHttpsInbound'
49+
properties: {
50+
access: 'Allow'
51+
direction: 'Inbound'
52+
priority: 100
53+
protocol: 'Tcp'
54+
sourcePortRange: '*'
55+
destinationPortRange: '443'
56+
sourceAddressPrefixes: ['0.0.0.0/0']
57+
destinationAddressPrefixes: ['10.0.0.0/23']
58+
}
59+
}
60+
]
61+
}
62+
delegations: [
63+
{
64+
name: 'containerapps-delegation'
65+
serviceName: 'Microsoft.App/environments'
66+
}
67+
]
68+
}
69+
{
70+
name: 'app'
71+
addressPrefixes: ['10.0.2.0/23'] // /23 (10.0.2.0 - 10.0.3.255), 512 addresses
72+
networkSecurityGroup: {
73+
name: 'app-nsg'
74+
securityRules: [
75+
{
76+
name: 'AllowWebToApp'
77+
properties: {
78+
access: 'Allow'
79+
direction: 'Inbound'
80+
priority: 100
81+
protocol: 'Tcp'
82+
sourcePortRange: '*'
83+
destinationPortRange: '*'
84+
sourceAddressPrefixes: ['10.0.0.0/23'] // web subnet
85+
destinationAddressPrefixes: ['10.0.2.0/23']
86+
}
87+
}
88+
]
89+
}
90+
delegations: [
91+
{
92+
name: 'containerapps-delegation'
93+
serviceName: 'Microsoft.App/environments'
94+
}
95+
]
96+
}
97+
{
98+
name: 'ai'
99+
addressPrefixes: ['10.0.4.0/23'] // /23 (10.0.4.0 - 10.0.5.255), 512 addresses
100+
networkSecurityGroup: {
101+
name: 'ai-nsg'
102+
securityRules: [
103+
{
104+
name: 'AllowWebAppToAI'
105+
properties: {
106+
access: 'Allow'
107+
direction: 'Inbound'
108+
priority: 100
109+
protocol: 'Tcp'
110+
sourcePortRange: '*'
111+
destinationPortRange: '*'
112+
sourceAddressPrefixes: [
113+
'10.0.0.0/23' // web subnet
114+
'10.0.2.0/23' // app subnet
115+
]
116+
destinationAddressPrefixes: ['10.0.4.0/23']
117+
}
118+
}
119+
]
120+
}
121+
delegations: [] // No delegation required for this subnet.
122+
}
123+
{
124+
name: 'data'
125+
addressPrefixes: ['10.0.6.0/23'] // /23 (10.0.6.0 - 10.0.7.255)
126+
networkSecurityGroup: {
127+
name: 'data-nsg'
128+
securityRules: [
129+
{
130+
name: 'AllowWebAppAiToData'
131+
properties: {
132+
access: 'Allow'
133+
direction: 'Inbound'
134+
priority: 100
135+
protocol: 'Tcp'
136+
sourcePortRange: '*'
137+
destinationPortRange: '*'
138+
sourceAddressPrefixes: [
139+
'10.0.0.0/23' // web subnet
140+
'10.0.2.0/23' // app subnet
141+
'10.0.4.0/23' // ai subnet
142+
]
143+
destinationAddressPrefixes: ['10.0.6.0/23']
144+
}
145+
}
146+
]
147+
}
148+
delegations: [] // No delegation required for this subnet.
149+
}
150+
{
151+
name: 'services'
152+
addressPrefixes: ['10.0.8.0/23'] // /23 (10.0.8.0 - 10.0.9.255), 512 addresses
153+
networkSecurityGroup: {
154+
name: 'services-nsg'
155+
securityRules: [
156+
{
157+
name: 'AllowWebAppAiToServices'
158+
properties: {
159+
access: 'Allow'
160+
direction: 'Inbound'
161+
priority: 100
162+
protocol: 'Tcp'
163+
sourcePortRange: '*'
164+
destinationPortRange: '*'
165+
sourceAddressPrefixes: [
166+
'10.0.0.0/23' // web subnet
167+
'10.0.2.0/23' // app subnet
168+
'10.0.4.0/23' // ai subnet
169+
]
170+
destinationAddressPrefixes: ['10.0.8.0/23']
171+
}
172+
}
173+
]
174+
}
175+
delegations: [] // No delegation required for this subnet.
176+
}
177+
]
178+
179+
// jumpbox parameters
180+
param jumpboxSubnet object = {
181+
name: 'jumpbox'
182+
addressPrefixes: ['10.0.12.0/23'] // /23 (10.0.12.0 - 10.0.13.255), 512 addresses
183+
networkSecurityGroup: {
184+
name: 'jumpbox-nsg'
185+
securityRules: [
186+
{
187+
name: 'AllowJumpboxInbound'
188+
properties: {
189+
access: 'Allow'
190+
direction: 'Inbound'
191+
priority: 100
192+
protocol: 'Tcp'
193+
sourcePortRange: '*'
194+
destinationPortRange: '22'
195+
sourceAddressPrefixes: [
196+
'10.0.7.0/24' // Azure Bastion subnet as an example here. You can adjust this as needed by adding more
197+
]
198+
destinationAddressPrefixes: ['10.0.12.0/23']
199+
}
200+
}
201+
]
202+
}
203+
}
204+
205+
// Azure Bastion Host parameters
206+
param bastionSubnet object = {
207+
addressPrefixes: ['10.0.10.0/23'] // /23 (10.0.10.0 - 10.0.11.255), 512 addresses
208+
networkSecurityGroup: null // Azure Bastion subnet must NOT have an NSG
209+
}
210+
211+
212+
// /****************************************************************************************************************************/
213+
// Create Log Analytics Workspace for monitoring and diagnostics
214+
// /****************************************************************************************************************************/
215+
216+
module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.2' = {
217+
name: take('log-analytics-${resourcesName}-deployment', 64)
218+
params: {
219+
name: 'log-${resourcesName}'
220+
location: location
221+
skuName: 'PerGB2018'
222+
dataRetention: 30
223+
diagnosticSettings: [{ useThisWorkspace: true }]
224+
tags: tags
225+
}
226+
}
227+
228+
// /****************************************************************************************************************************/
229+
// Networking - NSGs, VNET and Subnets. Each subnet has its own NSG
230+
// /****************************************************************************************************************************/
231+
232+
module virtualNetwork 'virtualNetwork.bicep' = {
233+
name: '${resourcesName}-virtualNetwork'
234+
params: {
235+
name: vnetName
236+
addressPrefixes: addressPrefixes
237+
subnets: subnets
238+
location: location
239+
tags: tags
240+
logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.resourceId
241+
}
242+
}
243+
244+
// /****************************************************************************************************************************/
245+
// // Create Azure Bastion Subnet and Azure Bastion Host
246+
// /****************************************************************************************************************************/
247+
248+
module bastionHost 'bastionHost.bicep' = if(enableBastionHost && !empty(bastionSubnet)) {
249+
name: '${resourcesName}-bastionHost'
250+
params: {
251+
subnet: bastionSubnet
252+
location: location
253+
vnetName: virtualNetwork.outputs.name
254+
vnetId: virtualNetwork.outputs.resourceId
255+
name: bastionHostName
256+
logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.resourceId
257+
tags: tags
258+
}
259+
}
260+
261+
// /****************************************************************************************************************************/
262+
// // create Jumpbox NSG and Jumpbox Subnet, then create Jumpbox VM
263+
// /****************************************************************************************************************************/
264+
265+
module jumpbox 'jumpbox.bicep' = if (jumpboxVM && !empty(jumpboxSubnet)) {
266+
name: '${resourcesName}-jumpbox'
267+
params: {
268+
vmName: jumpboxVmName
269+
location: location
270+
vnetName: virtualNetwork.outputs.name
271+
jumpboxVmSize: jumpboxVmSize
272+
jumpboxSubnet: jumpboxSubnet
273+
jumpboxAdminUser: jumpboxAdminUser
274+
jumpboxAdminPassword: jumpboxAdminPassword
275+
tags: tags
276+
logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.resourceId
277+
}
278+
}
279+
280+
output vnetName string = virtualNetwork.outputs.name
281+
output vnetResourceId string = virtualNetwork.outputs.resourceId
282+
output subnets array = virtualNetwork.outputs.subnets // This one holds critical info for subnets, including NSGs
283+
284+
output bastionSubnetId string = bastionHost.outputs.subnetId
285+
output bastionSubnetName string = bastionHost.outputs.subnetName
286+
output bastionHostId string = bastionHost.outputs.resourceId
287+
output bastionHostName string = bastionHost.outputs.name
288+
289+
output jumpboxSubnetName string = jumpbox.outputs.subnetId
290+
output jumpboxSubnetId string = jumpbox.outputs.subnetId
291+
output jumpboxVmName string = jumpbox.outputs.vmName
292+
output jumpboxVmId string = jumpbox.outputs.vmId

0 commit comments

Comments
 (0)