Skip to content

Commit 20a4465

Browse files
Abdul-MicrosoftCopilot
Abdul-Microsoft
and
Copilot
committed
fix: add vnetContentShareEnabled to web and admin web app modules
When private networking is enabled, web apps need vnetContentShareEnabled to route content share traffic through VNet. Without this, DNS resolves cognitive service endpoints to public IPs, causing 403 errors from Content Safety and other services with private endpoints. This extends the earlier Function App fix to also cover the web app and admin web app modules. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent ddeb051 commit 20a4465

4 files changed

Lines changed: 36 additions & 5 deletions

File tree

‎infra/main.bicep‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1222,6 +1222,7 @@ module web 'modules/app/web.bicep' = {
12221222
userAssignedIdentityResourceId: managedIdentityModule.outputs.resourceId
12231223
diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: monitoring!.outputs.logAnalyticsWorkspaceId }] : []
12241224
vnetRouteAllEnabled: enablePrivateNetworking ? true : false
1225+
vnetContentShareEnabled: enablePrivateNetworking ? true : false
12251226
vnetImagePullEnabled: enablePrivateNetworking ? true : false
12261227
virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webSubnetResourceId : ''
12271228
publicNetworkAccess: 'Enabled' // Always enabling public network access
@@ -1409,6 +1410,7 @@ module adminweb 'modules/app/adminweb.bicep' = {
14091410
// WAF parameters
14101411
diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: monitoring!.outputs.logAnalyticsWorkspaceId }] : []
14111412
vnetImagePullEnabled: enablePrivateNetworking ? true : false
1413+
vnetContentShareEnabled: enablePrivateNetworking ? true : false
14121414
vnetRouteAllEnabled: enablePrivateNetworking ? true : false
14131415
virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webSubnetResourceId : ''
14141416
publicNetworkAccess: 'Enabled' // Always enabling public network access

‎infra/main.json‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.42.1.51946",
9-
"templateHash": "3300593623201356935"
9+
"templateHash": "17330836752643719139"
1010
}
1111
},
1212
"parameters": {
@@ -33279,6 +33279,7 @@
3327933279
},
3328033280
"diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', reference('monitoring').outputs.logAnalyticsWorkspaceId.value))), createObject('value', createArray()))]",
3328133281
"vnetRouteAllEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
33282+
"vnetContentShareEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
3328233283
"vnetImagePullEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
3328333284
"virtualNetworkSubnetId": "[if(parameters('enablePrivateNetworking'), createObject('value', reference('virtualNetwork').outputs.webSubnetResourceId.value), createObject('value', ''))]",
3328433285
"publicNetworkAccess": {
@@ -33297,7 +33298,7 @@
3329733298
"_generator": {
3329833299
"name": "bicep",
3329933300
"version": "0.42.1.51946",
33300-
"templateHash": "8683679294545259497"
33301+
"templateHash": "12236308682752581177"
3330133302
}
3330233303
},
3330333304
"parameters": {
@@ -33436,6 +33437,13 @@
3343633437
"description": "Optional. To enable pulling image over Virtual Network."
3343733438
}
3343833439
},
33440+
"vnetContentShareEnabled": {
33441+
"type": "bool",
33442+
"defaultValue": false,
33443+
"metadata": {
33444+
"description": "Optional. To enable accessing content over Virtual Network."
33445+
}
33446+
},
3343933447
"vnetRouteAllEnabled": {
3344033448
"type": "bool",
3344133449
"defaultValue": false,
@@ -33528,6 +33536,9 @@
3352833536
"vnetImagePullEnabled": {
3352933537
"value": "[parameters('vnetImagePullEnabled')]"
3353033538
},
33539+
"vnetContentShareEnabled": {
33540+
"value": "[parameters('vnetContentShareEnabled')]"
33541+
},
3353133542
"vnetRouteAllEnabled": {
3353233543
"value": "[parameters('vnetRouteAllEnabled')]"
3353333544
},
@@ -35502,6 +35513,7 @@
3550235513
"applicationInsightsName": "[if(parameters('enableMonitoring'), createObject('value', reference('monitoring').outputs.applicationInsightsName.value), createObject('value', ''))]",
3550335514
"diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', reference('monitoring').outputs.logAnalyticsWorkspaceId.value))), createObject('value', createArray()))]",
3550435515
"vnetImagePullEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
35516+
"vnetContentShareEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
3550535517
"vnetRouteAllEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
3550635518
"virtualNetworkSubnetId": "[if(parameters('enablePrivateNetworking'), createObject('value', reference('virtualNetwork').outputs.webSubnetResourceId.value), createObject('value', ''))]",
3550735519
"publicNetworkAccess": {
@@ -35516,7 +35528,7 @@
3551635528
"_generator": {
3551735529
"name": "bicep",
3551835530
"version": "0.42.1.51946",
35519-
"templateHash": "9592410913633598971"
35531+
"templateHash": "18093852877535318756"
3552035532
}
3552135533
},
3552235534
"parameters": {
@@ -35655,6 +35667,13 @@
3565535667
"description": "Optional. To enable pulling image over Virtual Network."
3565635668
}
3565735669
},
35670+
"vnetContentShareEnabled": {
35671+
"type": "bool",
35672+
"defaultValue": false,
35673+
"metadata": {
35674+
"description": "Optional. To enable accessing content over Virtual Network."
35675+
}
35676+
},
3565835677
"vnetRouteAllEnabled": {
3565935678
"type": "bool",
3566035679
"defaultValue": false,
@@ -35747,6 +35766,9 @@
3574735766
"vnetImagePullEnabled": {
3574835767
"value": "[parameters('vnetImagePullEnabled')]"
3574935768
},
35769+
"vnetContentShareEnabled": {
35770+
"value": "[parameters('vnetContentShareEnabled')]"
35771+
},
3575035772
"vnetRouteAllEnabled": {
3575135773
"value": "[parameters('vnetRouteAllEnabled')]"
3575235774
},
@@ -53873,9 +53895,9 @@
5387353895
}
5387453896
},
5387553897
"dependsOn": [
53876-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageQueue)]",
5387753898
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageFile)]",
5387853899
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
53900+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageQueue)]",
5387953901
"managedIdentityModule",
5388053902
"virtualNetwork"
5388153903
]

‎infra/modules/app/adminweb.bicep‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ param diagnosticSettings array = []
5757
@description('Optional. To enable pulling image over Virtual Network.')
5858
param vnetImagePullEnabled bool = false
5959

60+
@description('Optional. To enable accessing content over Virtual Network.')
61+
param vnetContentShareEnabled bool = false
62+
6063
@description('Optional. Virtual Network Route All enabled.')
6164
param vnetRouteAllEnabled bool = false
6265

@@ -69,7 +72,6 @@ param publicNetworkAccess string?
6972
@description('Optional. Configuration details for private endpoints.')
7073
param privateEndpoints array = []
7174

72-
7375
// Calculate the linuxFxVersion based on runtime or docker settings
7476
var linuxFxVersion = useDocker
7577
? 'DOCKER|${dockerFullImageName}'
@@ -122,6 +124,7 @@ module adminweb '../core/host/appservice.bicep' = {
122124
configs: appConfigs
123125
diagnosticSettings: diagnosticSettings
124126
vnetImagePullEnabled: vnetImagePullEnabled
127+
vnetContentShareEnabled: vnetContentShareEnabled
125128
vnetRouteAllEnabled: vnetRouteAllEnabled
126129
virtualNetworkSubnetId: virtualNetworkSubnetId
127130
publicNetworkAccess: empty(publicNetworkAccess) ? null : publicNetworkAccess

‎infra/modules/app/web.bicep‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ param diagnosticSettings array = []
5858
@description('Optional. To enable pulling image over Virtual Network.')
5959
param vnetImagePullEnabled bool = false
6060

61+
@description('Optional. To enable accessing content over Virtual Network.')
62+
param vnetContentShareEnabled bool = false
63+
6164
@description('Optional. Virtual Network Route All enabled.')
6265
param vnetRouteAllEnabled bool = false
6366

@@ -124,6 +127,7 @@ module web '../core/host/appservice.bicep' = {
124127
configs: appConfigs
125128
diagnosticSettings: diagnosticSettings
126129
vnetImagePullEnabled: vnetImagePullEnabled
130+
vnetContentShareEnabled: vnetContentShareEnabled
127131
vnetRouteAllEnabled: vnetRouteAllEnabled
128132
virtualNetworkSubnetId: virtualNetworkSubnetId
129133
publicNetworkAccess: empty(publicNetworkAccess) ? null : publicNetworkAccess

0 commit comments

Comments
 (0)