Skip to content

[ARO-21136] add network security perimeter to some resources #4396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[ARO-21136] add network security perimeter to some resources #4396

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ require (
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/keyvault/armkeyvault v1.5.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0 h1:L7G3d
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0/go.mod h1:Ms6gYEy0+A2knfKrwdatsggTXYA2+ICKug8w7STorFw=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0 h1:HYGD75g0bQ3VO/Omedm54v4LrD3B1cGImuRF3AJ5wLo=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6 v6.2.0/go.mod h1:ulHyBFJOI0ONiRL4vcJTmS7rx18jQQlEPmAgo80cRdM=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0 h1:qZQVUcgr3ZUsyt8lf4FS+Wjj1NxyPaMY7Nj/3UiFgO4=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7 v7.0.0/go.mod h1:vbbC5kaJ8H3mz4GIXafT5thlUo2qzW46Zzl1dKKpZVk=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=
Expand Down
33 changes: 33 additions & 0 deletions pkg/deploy/assets/gateway-production-predeploy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,39 @@
"enableSoftDelete": true
},
"apiVersion": "2019-09-01"
},
{
"apiVersion": "2024-07-01",
"location": "[resourceGroup().location]",
"name": "gateway-nsp",
"properties": {},
"type": "Microsoft.Network/networkSecurityPerimeters"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'gateway-nsp')]"
],
"name": "gateway-nsp/default",
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'gateway-nsp', 'default')]",
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-gwy'))]"
],
"name": "gateway-nsp/gateway-keyvault",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-gwy'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'gateway-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
}
]
}
69 changes: 69 additions & 0 deletions pkg/deploy/assets/rp-development-predeploy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,6 +320,75 @@
]
}
}
},
{
"apiVersion": "2024-07-01",
"location": "[resourceGroup().location]",
"name": "aro-keyvaults-nsp",
"properties": {},
"type": "Microsoft.Network/networkSecurityPerimeters"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'aro-keyvaults-nsp')]"
],
"name": "aro-keyvaults-nsp/default",
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
],
"name": "aro-keyvaults-nsp/nsp-cls",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
],
"name": "aro-keyvaults-nsp/nsp-por",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
],
"name": "aro-keyvaults-nsp/nsp-svc",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
}
]
}
33 changes: 33 additions & 0 deletions pkg/deploy/assets/rp-development.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,39 @@
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
]
},
{
"apiVersion": "2024-07-01",
"location": "[resourceGroup().location]",
"name": "cosmos-nsp",
"properties": {},
"type": "Microsoft.Network/networkSecurityPerimeters"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'cosmos-nsp')]"
],
"name": "cosmos-nsp/default",
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]",
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
],
"name": "cosmos-nsp/cosmos-nsp-association",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
},
{
"name": "[guid(resourceGroup().id, parameters('rpServicePrincipalId'), 'RP / Reader')]",
"type": "Microsoft.Authorization/roleAssignments",
Expand Down
69 changes: 69 additions & 0 deletions pkg/deploy/assets/rp-production-predeploy.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,6 +317,75 @@
}
}
},
{
"apiVersion": "2024-07-01",
"location": "[resourceGroup().location]",
"name": "aro-keyvaults-nsp",
"properties": {},
"type": "Microsoft.Network/networkSecurityPerimeters"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'aro-keyvaults-nsp')]"
],
"name": "aro-keyvaults-nsp/default",
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
],
"name": "aro-keyvaults-nsp/nsp-cls",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-cls'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
],
"name": "aro-keyvaults-nsp/nsp-por",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-por'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]",
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
],
"name": "aro-keyvaults-nsp/nsp-svc",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '-svc'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'aro-keyvaults-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
},
{
"apiVersion": "2020-08-01",
"condition": "[not(empty(parameters('rpNsgPortalSourceAddressPrefixes')))]",
Expand Down
33 changes: 33 additions & 0 deletions pkg/deploy/assets/rp-production.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1236,6 +1236,39 @@
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
]
},
{
"apiVersion": "2024-07-01",
"location": "[resourceGroup().location]",
"name": "cosmos-nsp",
"properties": {},
"type": "Microsoft.Network/networkSecurityPerimeters"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters', 'cosmos-nsp')]"
],
"name": "cosmos-nsp/default",
"type": "Microsoft.Network/networkSecurityPerimeters/profiles"
},
{
"apiVersion": "2024-07-01",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]",
"[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
],
"name": "cosmos-nsp/cosmos-nsp-association",
"properties": {
"accessMode": "Learning",
"privateLinkResource": {
"id": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
},
"profile": {
"id": "[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', 'cosmos-nsp', 'default')]"
}
},
"type": "Microsoft.Network/networkSecurityPerimeters/resourceAssociations"
},
{
"name": "[guid(resourceGroup().id, parameters('rpServicePrincipalId'), 'RP / Reader')]",
"type": "Microsoft.Authorization/roleAssignments",
Expand Down
51 changes: 50 additions & 1 deletion pkg/deploy/generator/resources.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ package generator
import (
"fmt"

"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7"
mgmtdns "github.com/Azure/azure-sdk-for-go/services/dns/mgmt/2018-05-01/dns"
mgmtkeyvault "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2019-09-01/keyvault"
mgmtinsights "github.com/Azure/azure-sdk-for-go/services/preview/monitor/mgmt/2018-03-01/insights"
Expand Down Expand Up @@ -44,6 +44,55 @@ func (g *generator) dnsZone(name string) *arm.Resource {
}
}

func (g *generator) networkSecurityPerimeter(name string) *arm.Resource {
return &arm.Resource{
Resource: &armnetwork.SecurityPerimeter{
Location: pointerutils.ToPtr("[resourceGroup().location]"),
Properties: &armnetwork.SecurityPerimeterProperties{},
Name: &name,
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters"),
},
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters"),
}
}

// networkSecurityPerimeterProfile creates a new nsp profile with the hardcoded name `default`.
Copy link
Collaborator

@alcasim alcasim Oct 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reading the code, this func creates a resource with name nspname/default which is not exactly "hardcoded default".

func (g *generator) networkSecurityPerimeterProfile(nspName string) *arm.Resource {
return &arm.Resource{
Resource: &armnetwork.NspProfile{
Name: pointerutils.ToPtr(fmt.Sprintf("%s/default", nspName)),
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters/profiles"),
},
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters/profiles"),
DependsOn: []string{
fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters', '%s')]", nspName),
},
}
}

func (g *generator) networkSecurityPerimeterAssociation(nspName string, associationName string, targetResourceId string) *arm.Resource {
return &arm.Resource{
Resource: &armnetwork.NspAssociation{
Properties: &armnetwork.NspAssociationProperties{
AccessMode: pointerutils.ToPtr(armnetwork.AssociationAccessModeLearning),
Copy link
Collaborator

@alcasim alcasim Oct 15, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minor: if some day we want to move this to enforce or audit... would it be worth to have it as a func parameter? I like how clean looks right now, so it's not a deal breaker.

PrivateLinkResource: &armnetwork.SubResource{
ID: &targetResourceId,
},
Profile: &armnetwork.SubResource{
ID: pointerutils.ToPtr(fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', '%s', 'default')]", nspName)),
},
},
Name: pointerutils.ToPtr(fmt.Sprintf("%s/%s", nspName, associationName)),
Type: pointerutils.ToPtr("Microsoft.Network/networkSecurityPerimeters/resourceAssociations"),
},
APIVersion: azureclient.APIVersion("Microsoft.Network/networkSecurityPerimeters/resourceAssociations"),
DependsOn: []string{
fmt.Sprintf("[resourceId('Microsoft.Network/networkSecurityPerimeters/profiles', '%s', 'default')]", nspName),
targetResourceId,
},
}
}

func (g *generator) securityGroup(name string, securityRules []*armnetwork.SecurityRule, condition interface{}) *arm.Resource {
return &arm.Resource{
Resource: &armnetwork.SecurityGroup{
Expand Down
2 changes: 1 addition & 1 deletion pkg/deploy/generator/resources_dev.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import (
"fmt"
"strings"

"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7"
mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2021-12-01/compute"
mgmtkeyvault "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2019-09-01/keyvault"

Expand Down
19 changes: 18 additions & 1 deletion pkg/deploy/generator/resources_gateway.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import (
"fmt"
"strings"

"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v7"
mgmtcompute "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2021-12-01/compute"
mgmtkeyvault "github.com/Azure/azure-sdk-for-go/services/keyvault/mgmt/2019-09-01/keyvault"
mgmtmsi "github.com/Azure/azure-sdk-for-go/services/msi/mgmt/2018-11-30/msi"
Expand All @@ -32,6 +32,23 @@ func (g *generator) gatewayManagedIdentity() *arm.Resource {
}
}

func (g *generator) gatewayKeyvaultPerimeterAssociation() *arm.Resource {
gwKvResId := fmt.Sprintf(
"[resourceId('Microsoft.KeyVault/vaults', concat(parameters('keyvaultPrefix'), '%s'))]",
env.GatewayKeyvaultSuffix,
)

return g.networkSecurityPerimeterAssociation("gateway-nsp", "gateway-keyvault", gwKvResId)
}

func (g *generator) gatewayNetworkSecurityPerimeterProfile() *arm.Resource {
return g.networkSecurityPerimeterProfile("gateway-nsp")
}

func (g *generator) gatewayNetworkSecurityPerimeter() *arm.Resource {
return g.networkSecurityPerimeter("gateway-nsp")
}

func (g *generator) gatewaySecurityGroup() *arm.Resource {
return g.securityGroup("gateway-nsg", nil, g.conditionStanza("deployNSGs"))
}
Expand Down
Loading
Loading