From f1da85b5d88ad9261c933f8b745aaa78540438e4 Mon Sep 17 00:00:00 2001 From: Marvin Buss Date: Tue, 2 Nov 2021 00:52:33 +0100 Subject: [PATCH 1/4] Added Virtual Network Manager --- ...iseScaleAnalytics-AzureDevOpsDeployment.md | 2 ++ ...eScaleAnalytics-GitHubActionsDeployment.md | 2 ++ docs/reference/enterpriseScaleAnalytics.bicep | 12 +++++-- docs/reference/enterpriseScaleAnalytics.json | 23 ++++++++++++- infra/main.bicep | 6 ++++ infra/main.json | 33 +++++++++++++++++-- infra/modules/network.bicep | 22 +++++++++++++ infra/params.dev.json | 6 ++++ infra/params.prod.json | 6 ++++ infra/params.test.json | 6 ++++ 10 files changed, 113 insertions(+), 5 deletions(-) diff --git a/docs/EnterpriseScaleAnalytics-AzureDevOpsDeployment.md b/docs/EnterpriseScaleAnalytics-AzureDevOpsDeployment.md index b4ab5380..0c2a4d17 100644 --- a/docs/EnterpriseScaleAnalytics-AzureDevOpsDeployment.md +++ b/docs/EnterpriseScaleAnalytics-AzureDevOpsDeployment.md @@ -81,6 +81,8 @@ To begin, please open the [infra/params.dev.json](/infra/params.dev.json). In th | firewallPrivateIp | Specifies the private IP address of the central firewall. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `10.0.0.4` | | dnsServerAdresses | Specifies the private IP addresses of the dns servers. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | [ `10.0.0.4` ] | | firewallPolicyId | Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/firewallPolicies/{firewallpolicy-name}` | +| virtualNetworkManagerManagementGroupScopes | Specifies the management group scopes for the Azure Virtual Network Manager. | [`{management-group-id-1}`, `{management-group-id-2}`] | +| virtualNetworkManagerSubscriptionScopes | Specifies the subscription scopes for the Azure Virtual Network Manager. | [`/subscriptions/{subscription-id-1}`, `/subscriptions/{subscription-id-2}`] | | privateDnsZoneIdContainerRegistry | Specifies the resource ID of the private DNS zone for Container Registry. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io` | | privateDnsZoneIdKeyVault | Specifies the resource ID of the private DNS zone for Key Vault. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net` | | privateDnsZoneIdNamespace | Specifies the resource ID of the private DNS zone for EventHub namespaces. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.servicebus.windows.net` | diff --git a/docs/EnterpriseScaleAnalytics-GitHubActionsDeployment.md b/docs/EnterpriseScaleAnalytics-GitHubActionsDeployment.md index 71fb51d7..a033f037 100644 --- a/docs/EnterpriseScaleAnalytics-GitHubActionsDeployment.md +++ b/docs/EnterpriseScaleAnalytics-GitHubActionsDeployment.md @@ -72,6 +72,8 @@ To begin, please open the [infra/params.dev.json](/infra/params.dev.json). In th | firewallPrivateIp | Specifies the private IP address of the central firewall. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `10.0.0.4` | | dnsServerAdresses | Specifies the private IP addresses of the dns servers. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | [ `10.0.0.4` ] | | firewallPolicyId | Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/firewallPolicies/{firewallpolicy-name}` | +| virtualNetworkManagerManagementGroupScopes | Specifies the management group scopes for the Azure Virtual Network Manager. | [`{management-group-id-1}`, `{management-group-id-2}`] | +| virtualNetworkManagerSubscriptionScopes | Specifies the subscription scopes for the Azure Virtual Network Manager. | [`/subscriptions/{subscription-id-1}`, `/subscriptions/{subscription-id-2}`] | | privateDnsZoneIdContainerRegistry | Specifies the resource ID of the private DNS zone for Container Registry. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io` | | privateDnsZoneIdKeyVault | Specifies the resource ID of the private DNS zone for Key Vault. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net` | | privateDnsZoneIdNamespace | Specifies the resource ID of the private DNS zone for EventHub namespaces. Optional if `enableDnsAndFirewallDeployment` is set to `true`. | `/subscriptions/{subscription-id}/resourceGroups/{rg-name}/providers/Microsoft.Network/privateDnsZones/privatelink.servicebus.windows.net` | diff --git a/docs/reference/enterpriseScaleAnalytics.bicep b/docs/reference/enterpriseScaleAnalytics.bicep index 6c23b617..59093f3c 100644 --- a/docs/reference/enterpriseScaleAnalytics.bicep +++ b/docs/reference/enterpriseScaleAnalytics.bicep @@ -12,7 +12,7 @@ targetScope = 'subscription' @description('Specifies the environment.') param environment string = 'dev' @description('Specifies the tags that you want to apply to all resources.') -param tags object +param tags object = {} // Data Management Parameters @description('Specifies the subscription ID where your Data Management Zone will be deployed.') @@ -21,6 +21,8 @@ param dataManagementZoneSubscriptionId string param dataManagementZonePrefix string @description('Specifies the location of your Data Management Zone.') param dataManagementZoneLocation string +@description('Specifies the management group scopes for the Azure Virtual Network Manager.') +param virtualNetworkManagerManagementGroupScopes array = [] // Data Landing Zone Parameters @description('Specifies the administrator password of the Synapse workspace and the virtual machine scale sets.') @@ -30,7 +32,7 @@ param dataLandingZoneDetails array @description('Specifies the prefix of Data Landing Zones.') param dataLandingZonePrefix string @description('Specifies whether Azure Bastion will be deployed in the first Data Landing Zone.') -param enableBastionHostDeployment bool +param enableBastionHostDeployment bool = false // Variables var dataManagementZoneTemplateLink = 'https://raw.githubusercontent.com/Azure/data-management-zone/main/infra/main.json' @@ -83,6 +85,12 @@ resource dataManagementZoneDeployment 'Microsoft.Resources/deployments@2021-04-0 firewallPolicyId: { value: '' } + virtualNetworkManagerManagementGroupScopes: { + value: virtualNetworkManagerManagementGroupScopes + } + virtualNetworkManagerSubscriptionScopes: { + value: [for dataLandingZoneDetail in dataLandingZoneDetails: '/subscriptions/${dataLandingZoneDetail.subscription}'] + } privateDnsZoneIdBlob: { value: '' } diff --git a/docs/reference/enterpriseScaleAnalytics.json b/docs/reference/enterpriseScaleAnalytics.json index f60cfa1e..43d2356b 100644 --- a/docs/reference/enterpriseScaleAnalytics.json +++ b/docs/reference/enterpriseScaleAnalytics.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.4.1008.15138", - "templateHash": "6171096669672601699" + "templateHash": "7641487951163438098" } }, "parameters": { @@ -23,6 +23,7 @@ }, "tags": { "type": "object", + "defaultValue": {}, "metadata": { "description": "Specifies the tags that you want to apply to all resources." } @@ -45,6 +46,13 @@ "description": "Specifies the location of your Data Management Zone." } }, + "virtualNetworkManagerManagementGroupScopes": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Specifies the management group scopes for the Azure Virtual Network Manager." + } + }, "administratorPassword": { "type": "string", "metadata": { @@ -65,6 +73,7 @@ }, "enableBastionHostDeployment": { "type": "bool", + "defaultValue": false, "metadata": { "description": "Specifies whether Azure Bastion will be deployed in the first Data Landing Zone." } @@ -124,6 +133,18 @@ "firewallPolicyId": { "value": "" }, + "virtualNetworkManagerManagementGroupScopes": { + "value": "[parameters('virtualNetworkManagerManagementGroupScopes')]" + }, + "virtualNetworkManagerSubscriptionScopes": { + "copy": [ + { + "name": "value", + "count": "[length(parameters('dataLandingZoneDetails'))]", + "input": "[format('/subscriptions/{0}', parameters('dataLandingZoneDetails')[copyIndex('value')].subscription)]" + } + ] + }, "privateDnsZoneIdBlob": { "value": "" }, diff --git a/infra/main.bicep b/infra/main.bicep index 1d0133d3..73435919 100644 --- a/infra/main.bicep +++ b/infra/main.bicep @@ -41,6 +41,10 @@ param dnsServerAdresses array = [ ] @description('Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`.') param firewallPolicyId string = '' +@description('Specifies the management group scopes for the Azure Virtual Network Manager.') +param virtualNetworkManagerManagementGroupScopes array = [] +@description('Specifies the subscription scopes for the Azure Virtual Network Manager.') +param virtualNetworkManagerSubscriptionScopes array = [] // Private DNS Zone parameters @description('Specifies the resource ID of the private DNS zone for Key Vault. Optional if `enableDnsAndFirewallDeployment` is set to `true`.') @@ -93,6 +97,8 @@ module networkServices 'modules/network.bicep' = { enableDnsAndFirewallDeployment: enableDnsAndFirewallDeployment firewallPrivateIp: firewallPrivateIp firewallPolicyId: firewallPolicyId + virtualNetworkManagerManagementGroupScopes: virtualNetworkManagerManagementGroupScopes + virtualNetworkManagerSubscriptionScopes: virtualNetworkManagerSubscriptionScopes } } diff --git a/infra/main.json b/infra/main.json index 91d97a64..d9adbf95 100644 --- a/infra/main.json +++ b/infra/main.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.4.1008.15138", - "templateHash": "16584189192184544370" + "templateHash": "11642189854978205880" } }, "parameters": { @@ -100,6 +100,20 @@ "description": "Specifies the resource ID of the Azure Firewall Policy. Optional parameter allows you to deploy Firewall rules to an existing Firewall Policy if `enableDnsAndFirewallDeployment` is set to `false`." } }, + "virtualNetworkManagerManagementGroupScopes": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Specifies the management group scopes for the Azure Virtual Network Manager." + } + }, + "virtualNetworkManagerSubscriptionScopes": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Specifies the subscription scopes for the Azure Virtual Network Manager." + } + }, "privateDnsZoneIdKeyVault": { "type": "string", "defaultValue": "", @@ -266,6 +280,12 @@ }, "firewallPolicyId": { "value": "[parameters('firewallPolicyId')]" + }, + "virtualNetworkManagerManagementGroupScopes": { + "value": "[parameters('virtualNetworkManagerManagementGroupScopes')]" + }, + "virtualNetworkManagerSubscriptionScopes": { + "value": "[parameters('virtualNetworkManagerSubscriptionScopes')]" } }, "template": { @@ -275,7 +295,7 @@ "_generator": { "name": "bicep", "version": "0.4.1008.15138", - "templateHash": "10662562629090602323" + "templateHash": "8026746478805981104" } }, "parameters": { @@ -317,12 +337,21 @@ "firewallPolicyId": { "type": "string", "defaultValue": "" + }, + "virtualNetworkManagerManagementGroupScopes": { + "type": "array", + "defaultValue": [] + }, + "virtualNetworkManagerSubscriptionScopes": { + "type": "array", + "defaultValue": [] } }, "functions": [], "variables": { "azureFirewallSubnetName": "AzureFirewallSubnet", "servicesSubnetName": "ServicesSubnet", + "virtualNetworkManagerName": "[format('{0}-vnm', parameters('prefix'))]", "firewallPolicySubscriptionId": "[if(greaterOrEquals(length(split(parameters('firewallPolicyId'), '/')), 9), split(parameters('firewallPolicyId'), '/')[2], subscription().subscriptionId)]", "firewallPolicyResourceGroupName": "[if(greaterOrEquals(length(split(parameters('firewallPolicyId'), '/')), 9), split(parameters('firewallPolicyId'), '/')[4], resourceGroup().name)]", "firewallPolicyName": "[if(greaterOrEquals(length(split(parameters('firewallPolicyId'), '/')), 9), last(split(parameters('firewallPolicyId'), '/')), 'incorrectSegmentLength')]" diff --git a/infra/modules/network.bicep b/infra/modules/network.bicep index 14a7120c..628a4c78 100644 --- a/infra/modules/network.bicep +++ b/infra/modules/network.bicep @@ -18,10 +18,13 @@ param azureFirewallSubnetAddressPrefix string = '10.0.0.0/24' param servicesSubnetAddressPrefix string = '10.0.1.0/24' param enableDnsAndFirewallDeployment bool = true param firewallPolicyId string = '' +param virtualNetworkManagerManagementGroupScopes array = [] +param virtualNetworkManagerSubscriptionScopes array = [] // Variables var azureFirewallSubnetName = 'AzureFirewallSubnet' var servicesSubnetName = 'ServicesSubnet' +var virtualNetworkManagerName = '${prefix}-vnm' var firewallPolicySubscriptionId = length(split(firewallPolicyId, '/')) >= 9 ? split(firewallPolicyId, '/')[2] : subscription().subscriptionId var firewallPolicyResourceGroupName = length(split(firewallPolicyId, '/')) >= 9 ? split(firewallPolicyId, '/')[4] : resourceGroup().name var firewallPolicyName = length(split(firewallPolicyId, '/')) >= 9 ? last(split(firewallPolicyId, '/')) : 'incorrectSegmentLength' @@ -221,6 +224,25 @@ resource firewall 'Microsoft.Network/azureFirewalls@2020-11-01' = if(enableDnsAn } } +resource virtualNetworkManager 'Microsoft.Network/networkManagers@2021-02-01-preview' = { + name: virtualNetworkManagerName + location: location + tags: tags + properties: { + displayName: virtualNetworkManagerName + description: 'Network Manager for ESA Mesh Network Architecture' + networkManagerScopeAccesses: [ + 'Connectivity' + 'SecurityAdmin' + 'SecurityUser' + ] + networkManagerScopes: { + managementGroups: union(virtualNetworkManagerManagementGroupScopes, []) + subscriptions: union([subscription().id], virtualNetworkManagerSubscriptionScopes) + } + } +} + // module dnsforwarder001 'services/dnsforwarder.bicep' = { // Uncomment if you want to use a VMSS as DNS Forwarder instead of the Azure Firewall // name: 'dnsforwarder001' // scope: resourceGroup() diff --git a/infra/params.dev.json b/infra/params.dev.json index 4c7b8900..b9e968ed 100644 --- a/infra/params.dev.json +++ b/infra/params.dev.json @@ -40,6 +40,12 @@ "firewallPolicyId": { "value": "" }, + "virtualNetworkManagerManagementGroupScopes": { + "value": [] + }, + "virtualNetworkManagerSubscriptionScopes": { + "value": [] + }, "privateDnsZoneIdBlob": { "value": "" }, diff --git a/infra/params.prod.json b/infra/params.prod.json index b08f5a3a..42b59d39 100644 --- a/infra/params.prod.json +++ b/infra/params.prod.json @@ -37,6 +37,12 @@ "firewallPolicyId": { "value": "" }, + "virtualNetworkManagerManagementGroupScopes": { + "value": [] + }, + "virtualNetworkManagerSubscriptionScopes": { + "value": [] + }, "privateDnsZoneIdBlob": { "value": "" }, diff --git a/infra/params.test.json b/infra/params.test.json index 59cfdf32..62b7ed6d 100644 --- a/infra/params.test.json +++ b/infra/params.test.json @@ -37,6 +37,12 @@ "firewallPolicyId": { "value": "" }, + "virtualNetworkManagerManagementGroupScopes": { + "value": [] + }, + "virtualNetworkManagerSubscriptionScopes": { + "value": [] + }, "privateDnsZoneIdBlob": { "value": "" }, From 811e25615cb293969dff7e70379c6c13e779f784 Mon Sep 17 00:00:00 2001 From: Marvin Buss Date: Tue, 2 Nov 2021 23:16:20 +0100 Subject: [PATCH 2/4] fixed azure cli version --- .github/workflows/dataManagementZoneDeployment.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dataManagementZoneDeployment.yml b/.github/workflows/dataManagementZoneDeployment.yml index 7a5cdb55..14ecfe04 100644 --- a/.github/workflows/dataManagementZoneDeployment.yml +++ b/.github/workflows/dataManagementZoneDeployment.yml @@ -56,7 +56,7 @@ jobs: id: data_management_zone_whatif uses: azure/CLI@v1 with: - azcliversion: "latest" + azcliversion: "2.29.2" inlineScript: | az account set \ --subscription ${{ env.AZURE_SUBSCRIPTION_ID }} From 275a1accadec81d5715d7598794d4582d52bb0e2 Mon Sep 17 00:00:00 2001 From: Marvin Buss Date: Tue, 2 Nov 2021 23:28:07 +0100 Subject: [PATCH 3/4] updated network manager template --- infra/modules/network.bicep | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/infra/modules/network.bicep b/infra/modules/network.bicep index 628a4c78..21f96de8 100644 --- a/infra/modules/network.bicep +++ b/infra/modules/network.bicep @@ -229,20 +229,32 @@ resource virtualNetworkManager 'Microsoft.Network/networkManagers@2021-02-01-pre location: location tags: tags properties: { - displayName: virtualNetworkManagerName description: 'Network Manager for ESA Mesh Network Architecture' + displayName: virtualNetworkManagerName networkManagerScopeAccesses: [ 'Connectivity' 'SecurityAdmin' 'SecurityUser' ] networkManagerScopes: { - managementGroups: union(virtualNetworkManagerManagementGroupScopes, []) - subscriptions: union([subscription().id], virtualNetworkManagerSubscriptionScopes) + managementGroups: union(array(null), virtualNetworkManagerManagementGroupScopes) + subscriptions: union(array(subscription().id), virtualNetworkManagerSubscriptionScopes) } } } +resource test 'Microsoft.Network/networkManagers/networkGroups@2021-02-01-preview' = { + parent: virtualNetworkManager + name: 'DevelopmentEnterpriseScaleAnalytics' + properties: { + description: 'Development Group for Enterprise-Scale Analytics' + displayName: 'DevelopmentEnterpriseScaleAnalytics' + conditionalMembership: + groupMembers: [] + memberType: '' + } +} + // module dnsforwarder001 'services/dnsforwarder.bicep' = { // Uncomment if you want to use a VMSS as DNS Forwarder instead of the Azure Firewall // name: 'dnsforwarder001' // scope: resourceGroup() From f4a6ea3f28ba3159358f8fa1460116db034f4535 Mon Sep 17 00:00:00 2001 From: Marvin Buss Date: Wed, 3 Nov 2021 00:25:25 +0100 Subject: [PATCH 4/4] added network groups and config --- infra/main.json | 105 +++++++++++++++++++++++++++++++++++- infra/modules/network.bicep | 62 +++++++++++++++++++-- 2 files changed, 161 insertions(+), 6 deletions(-) diff --git a/infra/main.json b/infra/main.json index d9adbf95..b0dd428b 100644 --- a/infra/main.json +++ b/infra/main.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.4.1008.15138", - "templateHash": "11642189854978205880" + "templateHash": "18257694432751193303" } }, "parameters": { @@ -295,7 +295,7 @@ "_generator": { "name": "bicep", "version": "0.4.1008.15138", - "templateHash": "8026746478805981104" + "templateHash": "2364844395026092218" } }, "parameters": { @@ -557,6 +557,107 @@ "[resourceId('Microsoft.Network/virtualNetworks', format('{0}-vnet', parameters('prefix')))]" ] }, + { + "type": "Microsoft.Network/networkManagers", + "apiVersion": "2021-02-01-preview", + "name": "[variables('virtualNetworkManagerName')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "description": "Network Manager for ESA Mesh Network Architecture", + "displayName": "[variables('virtualNetworkManagerName')]", + "networkManagerScopeAccesses": [ + "Connectivity", + "SecurityAdmin", + "SecurityUser" + ], + "networkManagerScopes": { + "managementGroups": "[union(array(null()), parameters('virtualNetworkManagerManagementGroupScopes'))]", + "subscriptions": "[union(array(subscription().id), parameters('virtualNetworkManagerSubscriptionScopes'))]" + } + } + }, + { + "type": "Microsoft.Network/networkManagers/networkGroups", + "apiVersion": "2021-02-01-preview", + "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsDevNetworkGroup')]", + "properties": { + "description": "Development Group for Enterprise-Scale Analytics", + "displayName": "Enterprise-Scale Analytics Dev Network Group", + "conditionalMembership": "{ \"allOf\": [ { \"field\": \"tags['Environment']\", \"equals\": \"dev\" }, { \"value\": \"[resourceGroup().Name]\", \"contains\": \"-network\" } ] }", + "groupMembers": [], + "memberType": "" + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]" + ] + }, + { + "type": "Microsoft.Network/networkManagers/networkGroups", + "apiVersion": "2021-02-01-preview", + "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsTestNetworkGroup')]", + "properties": { + "description": "Test Group for Enterprise-Scale Analytics", + "displayName": "Enterprise-Scale Analytics Test Network Group", + "conditionalMembership": "{ \"allOf\": [ { \"field\": \"tags['Environment']\", \"equals\": \"tst\" }, { \"value\": \"[resourceGroup().Name]\", \"contains\": \"-network\" } ] }", + "groupMembers": [], + "memberType": "" + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]" + ] + }, + { + "type": "Microsoft.Network/networkManagers/networkGroups", + "apiVersion": "2021-02-01-preview", + "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsProdNetworkGroup')]", + "properties": { + "description": "Production Group for Enterprise-Scale Analytics", + "displayName": "Enterprise-Scale Analytics Prod Network Group", + "conditionalMembership": "{ \"allOf\": [ { \"field\": \"tags['Environment']\", \"equals\": \"prd\" }, { \"value\": \"[resourceGroup().Name]\", \"contains\": \"-network\" } ] }", + "groupMembers": [], + "memberType": "" + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]" + ] + }, + { + "type": "Microsoft.Network/networkManagers/connectivityConfigurations", + "apiVersion": "2021-02-01-preview", + "name": "[format('{0}/{1}', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsConnectivityConfig')]", + "properties": { + "connectivityTopology": "Mesh", + "appliesToGroups": [ + { + "groupConnectivity": "DirectlyConnected", + "isGlobal": "False", + "networkGroupId": "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsDevNetworkGroup')]" + }, + { + "groupConnectivity": "DirectlyConnected", + "isGlobal": "False", + "networkGroupId": "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsTestNetworkGroup')]" + }, + { + "groupConnectivity": "DirectlyConnected", + "isGlobal": "False", + "networkGroupId": "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsProdNetworkGroup')]" + } + ], + "deleteExistingPeering": "True", + "description": "Enterprise-Scale Analytics Mesh Network Topology", + "displayName": "Enterprise-Scale Analytics Connectivity Config", + "hubs": [], + "isGlobal": "False" + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkManagers', variables('virtualNetworkManagerName'))]", + "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsDevNetworkGroup')]", + "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsProdNetworkGroup')]", + "[resourceId('Microsoft.Network/networkManagers/networkGroups', variables('virtualNetworkManagerName'), 'EnterpriseScaleAnalyticsTestNetworkGroup')]" + ] + }, { "condition": "[parameters('enableDnsAndFirewallDeployment')]", "type": "Microsoft.Resources/deployments", diff --git a/infra/modules/network.bicep b/infra/modules/network.bicep index 21f96de8..6a59a666 100644 --- a/infra/modules/network.bicep +++ b/infra/modules/network.bicep @@ -243,18 +243,72 @@ resource virtualNetworkManager 'Microsoft.Network/networkManagers@2021-02-01-pre } } -resource test 'Microsoft.Network/networkManagers/networkGroups@2021-02-01-preview' = { +resource virtualNetworkManagerDevNetworkGroup 'Microsoft.Network/networkManagers/networkGroups@2021-02-01-preview' = { parent: virtualNetworkManager - name: 'DevelopmentEnterpriseScaleAnalytics' + name: 'EnterpriseScaleAnalyticsDevNetworkGroup' properties: { description: 'Development Group for Enterprise-Scale Analytics' - displayName: 'DevelopmentEnterpriseScaleAnalytics' - conditionalMembership: + displayName: 'Enterprise-Scale Analytics Dev Network Group' + conditionalMembership: '{ "allOf": [ { "field": "tags[\'Environment\']", "equals": "dev" }, { "value": "[resourceGroup().Name]", "contains": "-network" } ] }' groupMembers: [] memberType: '' } } +resource virtualNetworkManagerTestNetworkGroup 'Microsoft.Network/networkManagers/networkGroups@2021-02-01-preview' = { + parent: virtualNetworkManager + name: 'EnterpriseScaleAnalyticsTestNetworkGroup' + properties: { + description: 'Test Group for Enterprise-Scale Analytics' + displayName: 'Enterprise-Scale Analytics Test Network Group' + conditionalMembership: '{ "allOf": [ { "field": "tags[\'Environment\']", "equals": "tst" }, { "value": "[resourceGroup().Name]", "contains": "-network" } ] }' + groupMembers: [] + memberType: '' + } +} + +resource virtualNetworkManagerProdNetworkGroup 'Microsoft.Network/networkManagers/networkGroups@2021-02-01-preview' = { + parent: virtualNetworkManager + name: 'EnterpriseScaleAnalyticsProdNetworkGroup' + properties: { + description: 'Production Group for Enterprise-Scale Analytics' + displayName: 'Enterprise-Scale Analytics Prod Network Group' + conditionalMembership: '{ "allOf": [ { "field": "tags[\'Environment\']", "equals": "prd" }, { "value": "[resourceGroup().Name]", "contains": "-network" } ] }' + groupMembers: [] + memberType: '' + } +} + +resource virtualNetworkManagerConnectivityConfiguration 'Microsoft.Network/networkManagers/connectivityConfigurations@2021-02-01-preview' = { + parent: virtualNetworkManager + name: 'EnterpriseScaleAnalyticsConnectivityConfig' + properties: { + connectivityTopology: 'Mesh' + appliesToGroups: [ + { + groupConnectivity: 'DirectlyConnected' + isGlobal: 'False' + networkGroupId: virtualNetworkManagerDevNetworkGroup.id + } + { + groupConnectivity: 'DirectlyConnected' + isGlobal: 'False' + networkGroupId: virtualNetworkManagerTestNetworkGroup.id + } + { + groupConnectivity: 'DirectlyConnected' + isGlobal: 'False' + networkGroupId: virtualNetworkManagerProdNetworkGroup.id + } + ] + deleteExistingPeering: 'True' + description: 'Enterprise-Scale Analytics Mesh Network Topology' + displayName: 'Enterprise-Scale Analytics Connectivity Config' + hubs: [] + isGlobal: 'False' + } +} + // module dnsforwarder001 'services/dnsforwarder.bicep' = { // Uncomment if you want to use a VMSS as DNS Forwarder instead of the Azure Firewall // name: 'dnsforwarder001' // scope: resourceGroup()