fix: Create NSG for bastion and Pep subnet to avoid auto creation NSG by policy

[Abdul-Microsoft]

Purpose

• This pull request refactors and enhances the Azure Bastion Host module by introducing a more structured and reusable subnet configuration, integrating Network Security Groups (NSGs) for improved security, and updating dependent modules to align with these changes. The most significant updates include replacing the flat subnetAddressPrefixes parameter with a new subnet object, adding NSG definitions, and updating module dependencies and outputs accordingly.

Subnet Configuration Enhancements:

• Replaced subnetAddressPrefixes with a new subnet object in bastionHostConfigurationType, enabling more detailed configuration of subnets, including name, address prefixes, and associated NSG details. (infra/modules/network/bastionHost.bicep, [1] [2]
• Updated the bastionConfiguration parameter in infra/samples/network-subnet-design.bicep to use the new subnet object, including NSG rules for inbound and outbound traffic. (infra/samples/network-subnet-design.bicep, infra/samples/network-subnet-design.bicepL46-R106)

Network Security Group (NSG) Integration:

• Introduced NSG definitions for the Azure Bastion subnet, including rules for Gateway Manager, HTTPS, SSH/RDP, and Azure Cloud traffic. These are now part of the subnet object configuration. (infra/modules/network.bicep, infra/modules/network.bicepR131-R199)
• Added a new nsg module to dynamically create NSGs based on the subnet configuration, using the Azure Bicep Registry module for NSGs. (infra/modules/network/bastionHost.bicep, infra/modules/network/bastionHost.bicepL29-R57)

Module and Dependency Updates:

• Updated the bastionSubnet and bastionHost modules to use the new subnet object, ensuring proper linkage to the dynamically created NSG. (infra/modules/network/bastionHost.bicep, [1] [2]
• Adjusted the bastionHost module in infra/modules/network/main.bicep to pass the updated subnet object instead of the deprecated subnetAddressPrefixes. (infra/modules/network/main.bicep, infra/modules/network/main.bicepL63-R63)

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

🎉 This PR is included in version 1.5.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀