Skip to content

Commit 3d6bc04

Browse files
mrWinstonmrWinston
committed
add network security perimeter to some resources
1 parent 36898ea commit 3d6bc04

14 files changed

+373
-23
lines changed

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ require (
1515
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault v1.5.0
1616
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0
1717
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0
18+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0
1819
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1
1920
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0
2021
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0 h1:L7G3d
3232
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0/go.mod h1:Ms6gYEy0+A2knfKrwdatsggTXYA2+ICKug8w7STorFw=
3333
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0 h1:HYGD75g0bQ3VO/Omedm54v4LrD3B1cGImuRF3AJ5wLo=
3434
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0/go.mod h1:ulHyBFJOI0ONiRL4vcJTmS7rx18jQQlEPmAgo80cRdM=
35+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0 h1:qZQVUcgr3ZUsyt8lf4FS+Wjj1NxyPaMY7Nj/3UiFgO4=
36+
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0/go.mod h1:vbbC5kaJ8H3mz4GIXafT5thlUo2qzW46Zzl1dKKpZVk=
3537
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
3638
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
3739
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=

‎pkg/deploy/assets/gateway-production-predeploy.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,39 @@
114114
"enableSoftDelete": true
115115
},
116116
"apiVersion": "2019-09-01"
117+
},
118+
{
119+
"apiVersion": "2024-07-01",
120+
"location": "[resourceGroup().location]",
121+
"name": "gateway-nsp",
122+
"properties": {},
123+
"type": "Microsoft.Network/networkSecurityPerimeters"
124+
},
125+
{
126+
"apiVersion": "2024-07-01",
127+
"dependsOn": [
128+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'gateway-nsp')]"
129+
],
130+
"name": "gateway-nsp/default",
131+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
132+
},
133+
{
134+
"apiVersion": "2024-07-01",
135+
"dependsOn": [
136+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'gateway-nsp', 'default')]",
137+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-gwy'))]"
138+
],
139+
"name": "gateway-nsp/gateway-keyvault",
140+
"properties": {
141+
"accessMode": "Learning",
142+
"privateLinkResource": {
143+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-gwy'))]"
144+
},
145+
"profile": {
146+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'gateway-nsp', 'default')]"
147+
}
148+
},
149+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
117150
}
118151
]
119152
}

‎pkg/deploy/assets/rp-development-predeploy.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,75 @@
320320
]
321321
}
322322
}
323+
},
324+
{
325+
"apiVersion": "2024-07-01",
326+
"location": "[resourceGroup().location]",
327+
"name": "aro-keyvaults-nsp",
328+
"properties": {},
329+
"type": "Microsoft.Network/networkSecurityPerimeters"
330+
},
331+
{
332+
"apiVersion": "2024-07-01",
333+
"dependsOn": [
334+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'aro-keyvaults-nsp')]"
335+
],
336+
"name": "aro-keyvaults-nsp/default",
337+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
338+
},
339+
{
340+
"apiVersion": "2024-07-01",
341+
"dependsOn": [
342+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
343+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
344+
],
345+
"name": "aro-keyvaults-nsp/nsp-cls",
346+
"properties": {
347+
"accessMode": "Learning",
348+
"privateLinkResource": {
349+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
350+
},
351+
"profile": {
352+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
353+
}
354+
},
355+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
356+
},
357+
{
358+
"apiVersion": "2024-07-01",
359+
"dependsOn": [
360+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
361+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
362+
],
363+
"name": "aro-keyvaults-nsp/nsp-por",
364+
"properties": {
365+
"accessMode": "Learning",
366+
"privateLinkResource": {
367+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
368+
},
369+
"profile": {
370+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
371+
}
372+
},
373+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
374+
},
375+
{
376+
"apiVersion": "2024-07-01",
377+
"dependsOn": [
378+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
379+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
380+
],
381+
"name": "aro-keyvaults-nsp/nsp-svc",
382+
"properties": {
383+
"accessMode": "Learning",
384+
"privateLinkResource": {
385+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
386+
},
387+
"profile": {
388+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
389+
}
390+
},
391+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
323392
}
324393
]
325394
}

‎pkg/deploy/assets/rp-development.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,39 @@
117117
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
118118
]
119119
},
120+
{
121+
"apiVersion": "2024-07-01",
122+
"location": "[resourceGroup().location]",
123+
"name": "cosmos-nsp",
124+
"properties": {},
125+
"type": "Microsoft.Network/networkSecurityPerimeters"
126+
},
127+
{
128+
"apiVersion": "2024-07-01",
129+
"dependsOn": [
130+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'cosmos-nsp')]"
131+
],
132+
"name": "cosmos-nsp/default",
133+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
134+
},
135+
{
136+
"apiVersion": "2024-07-01",
137+
"dependsOn": [
138+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]",
139+
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
140+
],
141+
"name": "cosmos-nsp/cosmos-nsp-association",
142+
"properties": {
143+
"accessMode": "Learning",
144+
"privateLinkResource": {
145+
"id": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
146+
},
147+
"profile": {
148+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]"
149+
}
150+
},
151+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
152+
},
120153
{
121154
"name": "[guid(resourceGroup().id, parameters('rpServicePrincipalId'), 'RP / Reader')]",
122155
"type": "Microsoft.Authorization/roleAssignments",

‎pkg/deploy/assets/rp-production-predeploy.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,6 +317,75 @@
317317
}
318318
}
319319
},
320+
{
321+
"apiVersion": "2024-07-01",
322+
"location": "[resourceGroup().location]",
323+
"name": "aro-keyvaults-nsp",
324+
"properties": {},
325+
"type": "Microsoft.Network/networkSecurityPerimeters"
326+
},
327+
{
328+
"apiVersion": "2024-07-01",
329+
"dependsOn": [
330+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'aro-keyvaults-nsp')]"
331+
],
332+
"name": "aro-keyvaults-nsp/default",
333+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
334+
},
335+
{
336+
"apiVersion": "2024-07-01",
337+
"dependsOn": [
338+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
339+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
340+
],
341+
"name": "aro-keyvaults-nsp/nsp-cls",
342+
"properties": {
343+
"accessMode": "Learning",
344+
"privateLinkResource": {
345+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
346+
},
347+
"profile": {
348+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
349+
}
350+
},
351+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
352+
},
353+
{
354+
"apiVersion": "2024-07-01",
355+
"dependsOn": [
356+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
357+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
358+
],
359+
"name": "aro-keyvaults-nsp/nsp-por",
360+
"properties": {
361+
"accessMode": "Learning",
362+
"privateLinkResource": {
363+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
364+
},
365+
"profile": {
366+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
367+
}
368+
},
369+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
370+
},
371+
{
372+
"apiVersion": "2024-07-01",
373+
"dependsOn": [
374+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
375+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
376+
],
377+
"name": "aro-keyvaults-nsp/nsp-svc",
378+
"properties": {
379+
"accessMode": "Learning",
380+
"privateLinkResource": {
381+
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
382+
},
383+
"profile": {
384+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
385+
}
386+
},
387+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
388+
},
320389
{
321390
"apiVersion": "2020-08-01",
322391
"condition": "[not(empty(parameters('rpNsgPortalSourceAddressPrefixes')))]",

‎pkg/deploy/assets/rp-production.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1220,6 +1220,39 @@
12201220
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
12211221
]
12221222
},
1223+
{
1224+
"apiVersion": "2024-07-01",
1225+
"location": "[resourceGroup().location]",
1226+
"name": "cosmos-nsp",
1227+
"properties": {},
1228+
"type": "Microsoft.Network/networkSecurityPerimeters"
1229+
},
1230+
{
1231+
"apiVersion": "2024-07-01",
1232+
"dependsOn": [
1233+
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'cosmos-nsp')]"
1234+
],
1235+
"name": "cosmos-nsp/default",
1236+
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
1237+
},
1238+
{
1239+
"apiVersion": "2024-07-01",
1240+
"dependsOn": [
1241+
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]",
1242+
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
1243+
],
1244+
"name": "cosmos-nsp/cosmos-nsp-association",
1245+
"properties": {
1246+
"accessMode": "Learning",
1247+
"privateLinkResource": {
1248+
"id": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
1249+
},
1250+
"profile": {
1251+
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]"
1252+
}
1253+
},
1254+
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
1255+
},
12231256
{
12241257
"name": "[guid(resourceGroup().id, parameters('rpServicePrincipalId'), 'RP / Reader')]",
12251258
"type": "Microsoft.Authorization/roleAssignments",

‎pkg/deploy/generator/resources.go‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ package generator
66
import (
77
"fmt"
88

9-
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
9+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7"
1010
mgmtdns "github.com/Azure/azure-sdk-for-go/services/dns/mgmt/2018-05-01/dns"
1111
mgmtkeyvault "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2019-09-01/keyvault"
1212
mgmtinsights "github.com/Azure/azure-sdk-for-go/services/preview/monitor/mgmt/2018-03-01/insights"
@@ -44,6 +44,55 @@ func (g *generator) dnsZone(name string) *arm.Resource {
4444
}
4545
}
4646

47+
func (g *generator) networkSecurityPerimeter(name string) *arm.Resource {
48+
return &arm.Resource{
49+
Resource: &armnetwork.SecurityPerimeter{
50+
Location: pointerutils.ToPtr("[resourceGroup().location]"),
51+
Properties: &armnetwork.SecurityPerimeterProperties{},
52+
Name: &name,
53+
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters"),
54+
},
55+
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters"),
56+
}
57+
}
58+
59+
// networkSecurityPerimeterProfile creates a new nsp profile with the hardcoded name `default`.
60+
func (g *generator) networkSecurityPerimeterProfile(nspName string) *arm.Resource {
61+
return &arm.Resource{
62+
Resource: &armnetwork.NspProfile{
63+
Name: pointerutils.ToPtr(fmt.Sprintf("%s/default", nspName)),
64+
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters/profiles"),
65+
},
66+
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters/profiles"),
67+
DependsOn: []string{
68+
fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters', '%s')]", nspName),
69+
},
70+
}
71+
}
72+
73+
func (g *generator) networkSecurityPerimeterAssociation(nspName string, associationName string, targetResourceId string) *arm.Resource {
74+
return &arm.Resource{
75+
Resource: &armnetwork.NspAssociation{
76+
Properties: &armnetwork.NspAssociationProperties{
77+
AccessMode: pointerutils.ToPtr(armnetwork.AssociationAccessModeLearning),
78+
PrivateLinkResource: &armnetwork.SubResource{
79+
ID: &targetResourceId,
80+
},
81+
Profile: &armnetwork.SubResource{
82+
ID: pointerutils.ToPtr(fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', '%s', 'default')]", nspName)),
83+
},
84+
},
85+
Name: pointerutils.ToPtr(fmt.Sprintf("%s/%s", nspName, associationName)),
86+
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters/resourceAssociations"),
87+
},
88+
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters/resourceAssociations"),
89+
DependsOn: []string{
90+
fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', '%s', 'default')]", nspName),
91+
targetResourceId,
92+
},
93+
}
94+
}
95+
4796
func (g *generator) securityGroup(name string, securityRules []*armnetwork.SecurityRule, condition interface{}) *arm.Resource {
4897
return &arm.Resource{
4998
Resource: &armnetwork.SecurityGroup{

‎pkg/deploy/generator/resources_dev.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"fmt"
99
"strings"
1010

11-
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
11+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7"
1212
mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2021-12-01/compute"
1313
mgmtkeyvault "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2019-09-01/keyvault"
1414

‎pkg/deploy/generator/resources_gateway.go‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"fmt"
99
"strings"
1010

11-
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
11+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7"
1212
mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2021-12-01/compute"
1313
mgmtkeyvault "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2019-09-01/keyvault"
1414
mgmtmsi "github.com/Azure/azure-sdk-for-go/services/msi/mgmt/2018-11-30/msi"
@@ -32,6 +32,23 @@ func (g *generator) gatewayManagedIdentity() *arm.Resource {
3232
}
3333
}
3434

35+
func (g *generator) gatewayKeyvaultPerimeterAssociation() *arm.Resource {
36+
gwKvResId := fmt.Sprintf(
37+
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '%s'))]",
38+
env.GatewayKeyvaultSuffix,
39+
)
40+
41+
return g.networkSecurityPerimeterAssociation("gateway-nsp", "gateway-keyvault", gwKvResId)
42+
}
43+
44+
func (g *generator) gatewayNetworkSecurityPerimeterProfile() *arm.Resource {
45+
return g.networkSecurityPerimeterProfile("gateway-nsp")
46+
}
47+
48+
func (g *generator) gatewayNetworkSecurityPerimeter() *arm.Resource {
49+
return g.networkSecurityPerimeter("gateway-nsp")
50+
}
51+
3552
func (g *generator) gatewaySecurityGroup() *arm.Resource {
3653
return g.securityGroup("gateway-nsg", nil, g.conditionStanza("deployNSGs"))
3754
}

0 commit comments

Comments
 (0)