Skip to content

Commit cb250d1

Browse files
author
Seth
committed
Merge branch 'feature/avm-waf-aligned' of https://github.com/microsoft/Modernize-your-code-solution-accelerator into feature/avm-waf-aligned
2 parents 1946720 + 71f3fe6 commit cb250d1

2 files changed

Lines changed: 51 additions & 46 deletions

File tree

‎infra/Deployment_Plan.md‎

Lines changed: 22 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Deployment Plan
1+
# Deployment Plan
22

33
The deployment code will be in the **infra** folder. The **modules** subfolder contains reusable, parameterized modules.
44

@@ -9,11 +9,9 @@ Creates a Virtual Network with subnets, private endpoints for all solution resou
99

1010
If you are new to AVM BICEP implementation, refer to [AVM Bicep Quickstart Guide](https://azure.github.io/Azure-Verified-Modules/usage/quickstart/bicep/).
1111

12+
## Network & Subnets for Components
1213

13-
14-
Below is an example deployment design. The Group (module) Name column shows how to group code in BICEP modules.
15-
16-
**Solution Components and placements the Vnet/Subnets**
14+
**Solution Components and placements in the Vnet/Subnets**
1715

1816
| # | Component Name | Notes | Subnet |
1917
| ----------------------------------------- | ------------------------------------------------------------ | ----------------- | ----------------- |
@@ -56,36 +54,32 @@ Below is an example deployment design. The Group (module) Name column shows how
5654

5755
#### Network Design
5856

59-
addressPrefixes = [
60-
61-
'10.0.0.0/21' // /21: **2048 addresses, good for up to 8-16 subnets**. Other options: /23:512, /22:1024, /21:2048, /20:4096, /16: 65,536 (max for a VNet)
57+
**addressPrefixes** = ['10.0.0.0/20' ] // 4096 addresses (enough for 8 /23 subnets or 16 /24)
6258

63-
]
59+
512 x 7 = 3584 allocated
6460

65-
256 x 7 = 1792 allocated
66-
67-
| Subnet | Address Prefix | IP Range | Total IPs | Usable IPs* |
68-
| ----------- | -------------- | --------------------- | --------- | ----------- |
69-
| web | 10.0.0.0/24 | 10.0.0.0 – 10.0.0.255 | 256 | 251 |
70-
| app | 10.0.1.0/24 | 10.0.1.0 – 10.0.1.255 | 256 | 251 |
71-
| ai | 10.0.2.0/24 | 10.0.2.0 – 10.0.2.255 | 256 | 251 |
72-
| data | 10.0.3.0/24 | 10.0.3.0 – 10.0.3.255 | 256 | 251 |
73-
| services | 10.0.4.0/24 | 10.0.4.0 – 10.0.4.255 | 256 | 251 |
74-
| jumpbox | 10.0.5.0/24 | 10.0.5.0 – 10.0.5.255 | 256 | 251 |
75-
| bastionHost | 10.0.6.0/27 | 10.0.6.0 – 10.0.6.255 | 256 | 251 |
61+
| Subnet | Address Prefix | IP Range | Total IPs | Usable IPs* |
62+
| ----------- | -------------- | ------------------------- | --------- | ----------- |
63+
| web | 10.0.0.0/23 | (10.0.0.0 - 10.0.1.255) | 512 | 507 |
64+
| app | 10.0.2.0/23 | (10.0.2.0 - 10.0.3.255) | 512 | 507 |
65+
| ai | 10.0.4.0/23 | (10.0.4.0 - 10.0.5.255) | 512 | 507 |
66+
| data | 10.0.6.0/23 | (10.0.6.0 - 10.0.7.255) | 512 | 507 |
67+
| services | 10.0.8.0/23 | (10.0.8.0 - 10.0.9.255) | 512 | 507 |
68+
| bastionHost | 10.0.10.0/23 | (10.0.10.0 - 10.0.11.255) | 512 | 507 |
69+
| jumpbox | 10.0.12.0/23 | (10.0.12.0 - 10.0.13.255) | 512 | 507 |
7670

7771
*Usable IPs = Total IPs minus 5 reserved by Azure per subnet.
7872

7973
### **Example Subnet/NSG Table**
8074

81-
| Subnet | NSG Rules (Inbound) | NSG Rules (Outbound) |
82-
|----------|-----------------------------------------------------|-----------------------------|
83-
| web | 80/443 from internet or allowed IPs | To app, internet |
84-
| app | From web subnet only | To data, PaaS |
85-
| ai | From app subnet only | To data, PaaS |
86-
| data | From app/ai/private endpoints | To PaaS, as needed |
87-
| jumpbox | RDP/SSH from allowed IPs or Bastion | To internet, as needed |
88-
| bastion | Platform-managed (Bastion Host only, no direct NSG) | To VMs for RDP/SSH |
75+
| Subnet | NSG Rules (Inbound) | NSG Rules (Outbound) |
76+
| ------- | --------------------------------------------------- | ---------------------- |
77+
| web | 80/443 from internet or allowed IPs | To app, internet |
78+
| app | From web subnet only | To data, PaaS |
79+
| ai | From web and app subnets only | To data, PaaS |
80+
| data | From web/app/ai/private endpoints | To PaaS, as needed |
81+
| bastion | Platform-managed (Bastion Host only, no direct NSG) | To VMs for RDP/SSH |
82+
| jumpbox | RDP/SSH from allowed IPs or Bastion | To internet, as needed |
8983

9084
## **Monitoring & Logging**
9185
- Enable diagnostic logs for all resources, send to Log Analytics Workspace.
@@ -94,9 +88,6 @@ addressPrefixes = [
9488
## **DDoS Protection**
9589
- Enable at the VNet level for public-facing workloads.
9690

97-
## **Route Tables (UDRs)**
98-
- Optional, but recommended for advanced routing (e.g., force tunneling through Azure Firewall if used).
99-
10091
## Azure Bastion Host
10192

10293
**Function:**

‎infra/modules/network.bicep‎

Lines changed: 29 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,35 @@ param location string
44
param tags object = {}
55

66

7-
// The address prefixes for the subnets - use below CIDR as a reference
8-
// /24 subnet = 256 addresses
9-
// /23 = 512 addresses (enough for 2 /24 subnets)
10-
// /22 = 1024 addresses (enough for 4 /24 subnets)
11-
// /21 = 2048 addresses (enough for 8 /24 subnets)
12-
// /20 = 4096 addresses (enough for 16 /24 subnets) // This was used for the default VNet address prefix
13-
// /19 = 8192 addresses (enough for 32 /24 subnets)
14-
// /18 = 16,384 addresses (enough for 64 /24 subnets)
15-
// /17 = 32,768 addresses (enough for 128 /24 subnets)
16-
// /16 = 65,536 addresses (enough for 256 /24 subnets)
17-
// /15 = 131,072 addresses (enough for 512 /24 subnets)
18-
// /14 = 262,144 addresses (enough for 1024 /24 subnets)
19-
// /13 = 524,288 addresses (enough for 2048 /24 subnets)
20-
// /12 = 1,048,576 addresses (enough for 4096 /24 subnets)
21-
7+
// Subnet Classless Inter-Doman Routing (CIDR) Sizing Reference Table (Best Practices)
8+
// | CIDR | # of Addresses | # of /24s | Notes |
9+
// |-----------|---------------|-----------|----------------------------------------|
10+
// | /24 | 256 | 1 | Smallest recommended for Azure subnets |
11+
// | /23 | 512 | 2 | Good for 1-2 workloads per subnet |
12+
// | /22 | 1024 | 4 | Good for 2-4 workloads per subnet |
13+
// | /21 | 2048 | 8 | |
14+
// | /20 | 4096 | 16 | Used for default VNet in this solution |
15+
// | /19 | 8192 | 32 | |
16+
// | /18 | 16384 | 64 | |
17+
// | /17 | 32768 | 128 | |
18+
// | /16 | 65536 | 256 | |
19+
// | /15 | 131072 | 512 | |
20+
// | /14 | 262144 | 1024 | |
21+
// | /13 | 524288 | 2048 | |
22+
// | /12 | 1048576 | 4096 | |
23+
// | /11 | 2097152 | 8192 | |
24+
// | /10 | 4194304 | 16384 | |
25+
// | /9 | 8388608 | 32768 | |
26+
// | /8 | 16777216 | 65536 | |
27+
//
28+
// Best Practice Notes:
29+
// - Use /24 as the minimum subnet size for Azure (smaller subnets are not supported for most services).
30+
// - Plan for future growth: allocate larger address spaces (e.g., /20 or /21 for VNets) to allow for new subnets.
31+
// - Avoid overlapping address spaces with on-premises or other VNets.
32+
// - Use contiguous, non-overlapping ranges for subnets.
33+
// - Document subnet usage and purpose in code comments.
34+
// - For AVM modules, ensure only one delegation per subnet and leave delegations empty if not required.
35+
//
2236

2337
module network 'network/main.bicep' = {
2438
name: take('network-${resourcesName}-create', 64)

0 commit comments

Comments
 (0)