Skip to content

Commit 6d62c07

Browse files
Prachig-MicrosoftPrachig-Microsoft
committed
fix: enforce HTTPS-only ingress and refactor DCR destination name
- Set ingressAllowInsecure: false on backend and frontend container apps in main.bicep and main_custom.bicep (SFI: disallow plain HTTP at public ingress). - Extract DCR Log Analytics destination name into a new variable 'dcrLogAnalyticsDestinationName' and use it across the destination definition and dataflows in both bicep files.
1 parent fdf9237 commit 6d62c07

3 files changed

Lines changed: 23 additions & 11 deletions

File tree

‎infra/main.bicep‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -518,6 +518,7 @@ var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
518518
var dataCollectionRulesLocation = useExistingLogAnalytics
519519
? existingLogAnalyticsWorkspace!.location
520520
: logAnalyticsWorkspace!.outputs.location
521+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceName}-destination'
521522
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
522523
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
523524
params: {
@@ -602,7 +603,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
602603
logAnalytics: [
603604
{
604605
workspaceResourceId: logAnalyticsWorkspaceResourceId
605-
name: 'la-${dataCollectionRulesResourceName}'
606+
name: dcrLogAnalyticsDestinationName
606607
}
607608
]
608609
}
@@ -612,15 +613,15 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
612613
'Microsoft-Perf'
613614
]
614615
destinations: [
615-
'la-${dataCollectionRulesResourceName}'
616+
dcrLogAnalyticsDestinationName
616617
]
617618
}
618619
{
619620
streams: [
620621
'Microsoft-Event'
621622
]
622623
destinations: [
623-
'la-${dataCollectionRulesResourceName}'
624+
dcrLogAnalyticsDestinationName
624625
]
625626
transformKql: 'source'
626627
outputStream: 'Microsoft-Event'
@@ -1098,6 +1099,7 @@ module containerAppBackend 'br/public:avm/res/app/container-app:0.22.0' = {
10981099
]
10991100
ingressTargetPort: 8000
11001101
ingressExternal: true
1102+
ingressAllowInsecure: false
11011103
scaleSettings: {
11021104
// maxReplicas: enableScalability ? 3 : 1
11031105
maxReplicas: 1 // maxReplicas set to 1 (not 3) due to multiple agents created per type during WAF deployment
@@ -1153,6 +1155,7 @@ module containerAppFrontend 'br/public:avm/res/app/container-app:0.22.0' = {
11531155
]
11541156
ingressTargetPort: 3000
11551157
ingressExternal: true
1158+
ingressAllowInsecure: false
11561159
scaleSettings: {
11571160
maxReplicas: enableScalability ? 3 : 1
11581161
minReplicas: 1

‎infra/main.json‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.42.1.51946",
9-
"templateHash": "16719390237009495333"
9+
"templateHash": "18156607440911418905"
1010
},
1111
"name": "Modernize Your Code Solution Accelerator",
1212
"description": "CSA CTO Gold Standard Solution Accelerator for Modernize Your Code. \r\n"
@@ -15368,7 +15368,7 @@
1536815368
"logAnalytics": [
1536915369
{
1537015370
"workspaceResourceId": "[if(variables('useExistingLogAnalytics'), parameters('existingLogAnalyticsWorkspaceId'), reference('logAnalyticsWorkspace').outputs.resourceId.value)]",
15371-
"name": "[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
15371+
"name": "[format('la-{0}-destination', if(variables('useExistingLogAnalytics'), variables('existingLawName'), reference('logAnalyticsWorkspace').outputs.name.value))]"
1537215372
}
1537315373
]
1537415374
},
@@ -15378,15 +15378,15 @@
1537815378
"Microsoft-Perf"
1537915379
],
1538015380
"destinations": [
15381-
"[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
15381+
"[format('la-{0}-destination', if(variables('useExistingLogAnalytics'), variables('existingLawName'), reference('logAnalyticsWorkspace').outputs.name.value))]"
1538215382
]
1538315383
},
1538415384
{
1538515385
"streams": [
1538615386
"Microsoft-Event"
1538715387
],
1538815388
"destinations": [
15389-
"[format('la-{0}', variables('dataCollectionRulesResourceName'))]"
15389+
"[format('la-{0}-destination', if(variables('useExistingLogAnalytics'), variables('existingLawName'), reference('logAnalyticsWorkspace').outputs.name.value))]"
1539015390
],
1539115391
"transformKql": "source",
1539215392
"outputStream": "Microsoft-Event"
@@ -32039,8 +32039,8 @@
3203932039
"dependsOn": [
3204032040
"aiServices",
3204132041
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
32042-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
3204332042
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
32043+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
3204432044
"virtualNetwork"
3204532045
]
3204632046
},
@@ -47998,6 +47998,9 @@
4799847998
"ingressExternal": {
4799947999
"value": true
4800048000
},
48001+
"ingressAllowInsecure": {
48002+
"value": false
48003+
},
4800148004
"scaleSettings": {
4800248005
"value": {
4800348006
"maxReplicas": 1,
@@ -49572,6 +49575,9 @@
4957249575
"ingressExternal": {
4957349576
"value": true
4957449577
},
49578+
"ingressAllowInsecure": {
49579+
"value": false
49580+
},
4957549581
"scaleSettings": {
4957649582
"value": {
4957749583
"maxReplicas": "[if(parameters('enableScalability'), 3, 1)]",

‎infra/main_custom.bicep‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -426,6 +426,7 @@ var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}'
426426
var dataCollectionRulesLocation = useExistingLogAnalytics
427427
? existingLogAnalyticsWorkspace!.location
428428
: logAnalyticsWorkspace!.outputs.location
429+
var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceName}-destination'
429430
module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-rule:0.11.0' = if (enablePrivateNetworking && enableMonitoring) {
430431
name: take('avm.res.insights.data-collection-rule.${dataCollectionRulesResourceName}', 64)
431432
params: {
@@ -509,7 +510,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
509510
logAnalytics: [
510511
{
511512
workspaceResourceId: logAnalyticsWorkspaceResourceId
512-
name: 'la-${dataCollectionRulesResourceName}'
513+
name: dcrLogAnalyticsDestinationName
513514
}
514515
]
515516
}
@@ -519,7 +520,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
519520
'Microsoft-Perf'
520521
]
521522
destinations: [
522-
'la-${dataCollectionRulesResourceName}'
523+
dcrLogAnalyticsDestinationName
523524
]
524525
transformKql: 'source'
525526
outputStream: 'Microsoft-Perf'
@@ -529,7 +530,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection-
529530
'Microsoft-Event'
530531
]
531532
destinations: [
532-
'la-${dataCollectionRulesResourceName}'
533+
dcrLogAnalyticsDestinationName
533534
]
534535
transformKql: 'source'
535536
outputStream: 'Microsoft-Event'
@@ -1032,6 +1033,7 @@ module containerAppBackend 'br/public:avm/res/app/container-app:0.22.0' = {
10321033
]
10331034
ingressTargetPort: 8000
10341035
ingressExternal: true
1036+
ingressAllowInsecure: false
10351037
scaleSettings: {
10361038
// maxReplicas: enableScalability ? 3 : 1
10371039
maxReplicas: 1 // maxReplicas set to 1 (not 3) due to multiple agents created per type during WAF deployment
@@ -1095,6 +1097,7 @@ module containerAppFrontend 'br/public:avm/res/app/container-app:0.22.0' = {
10951097
]
10961098
ingressTargetPort: 3000
10971099
ingressExternal: true
1100+
ingressAllowInsecure: false
10981101
scaleSettings: {
10991102
maxReplicas: enableScalability ? 3 : 1
11001103
minReplicas: 1

0 commit comments

Comments
 (0)