Skip to content
This repository was archived by the owner on Jan 30, 2025. It is now read-only.

Commit 6a90a2f

Browse files
SenthuranSivananthanSenthuranSivananthan
authored
Separate Azure Firewall Policy deployment switch & unique telemetry tracking for policy assignments (Azure#289)
1 parent c413307 commit 6a90a2f

20 files changed

+89
-27
lines changed

‎.github/workflows/0-everything.yml

+12-2
Original file line numberDiff line numberDiff line change
@@ -159,11 +159,21 @@ jobs:
159159
Install-Module Az -Force
160160
Install-Module powershell-yaml -Force
161161
162+
- name: Deploy Azure Firewall Policy
163+
if: github.event.inputs.hubNetworkType == 'HubNetworkWithAzureFirewall'
164+
run: |
165+
./RunWorkflows.ps1 `
166+
-DeployAzureFirewallPolicy `
167+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
168+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
169+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
170+
-GitHubRef ${env:GITHUB_REF}
171+
162172
- name: Deploy Hub Network with Azure Firewall
163173
if: github.event.inputs.hubNetworkType == 'HubNetworkWithAzureFirewall'
164174
run: |
165175
./RunWorkflows.ps1 `
166-
-Deploy${{github.event.inputs.hubNetworkType}} `
176+
-DeployHubNetworkWithAzureFirewall `
167177
-EnvironmentName '${{github.event.inputs.environmentName}}' `
168178
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
169179
-GitHubRepo ${env:GITHUB_REPOSITORY} `
@@ -173,7 +183,7 @@ jobs:
173183
if: github.event.inputs.hubNetworkType == 'HubNetworkWithNVA'
174184
run: |
175185
./RunWorkflows.ps1 `
176-
-Deploy${{github.event.inputs.hubNetworkType}} `
186+
-DeployHubNetworkWithNVA `
177187
-EnvironmentName '${{github.event.inputs.environmentName}}' `
178188
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
179189
-GitHubRepo ${env:GITHUB_REPOSITORY} `

‎.github/workflows/5-azure-firewall-policy.yml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# ----------------------------------------------------------------------------------
2+
# Copyright (c) Microsoft Corporation.
3+
# Licensed under the MIT license.
4+
#
5+
# THIS CODE AND INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
6+
# EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES
7+
# OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
8+
# ----------------------------------------------------------------------------------
9+
# Test
10+
name: 5 - Azure Firewall Policy
11+
12+
on:
13+
workflow_dispatch:
14+
inputs:
15+
environmentName:
16+
type: string
17+
description: Environment name (optional), e.g. CanadaESLZ-main
18+
required: false
19+
20+
defaults:
21+
run:
22+
shell: pwsh
23+
working-directory: scripts/deployments
24+
25+
jobs:
26+
azure-firewall-policy:
27+
name: Azure Firewall Policy
28+
runs-on: ubuntu-latest
29+
steps:
30+
31+
- name: Checkout
32+
uses: actions/checkout@v3
33+
34+
- name: Configure PowerShell modules
35+
run: |
36+
Install-Module Az -Force
37+
Install-Module powershell-yaml -Force
38+
39+
- name: Deploy Azure Firewall Policy
40+
run: |
41+
./RunWorkflows.ps1 `
42+
-DeployAzureFirewallPolicy `
43+
-EnvironmentName '${{github.event.inputs.environmentName}}' `
44+
-LoginServicePrincipalJson (ConvertTo-SecureString -String '${{secrets.ALZ_CREDENTIALS}}' -AsPlainText -Force) `
45+
-GitHubRepo ${env:GITHUB_REPOSITORY} `
46+
-GitHubRef ${env:GITHUB_REF}

‎.github/workflows/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ The following workflows are present in the `.github/workflows` repository folder
1818
| 1 | Management Groups | `1-management-groups.yml`
1919
| 2 | Roles | `2-roles.yml`
2020
| 3 | Logging | `3-logging.yml`
21-
| 4 | Policy | `policy.yml`
21+
| 4 | Policy | `4-policy.yml`
22+
| 5 | Azure Firewall Policy (required for Hub Networking with Azure Firewall) | `5-azure-firewall-policy.yml`
2223
| 5 | Hub Networking with Azure Firewall | `5-hub-network-with-azure-firewall.yml`
2324
| 5 | Hub Networking with NVA | `5-hub-network-with-nva.yml`
2425
| 6 | Subscriptions | `6-subscriptions.yml`

‎policy/builtin/assignments/asb.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ var policyScopedId = resourceId('Microsoft.Authorization/policySetDefinitions',
3232
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3333
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3434
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
35-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
35+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-asb'
3636
}
3737

3838
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/builtin/assignments/cis-msft-130.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ var policyScopedId = resourceId('Microsoft.Authorization/policySetDefinitions',
4444
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
4545
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
4646
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
47-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
47+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-cis-msft-130'
4848
}
4949

5050
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/builtin/assignments/fedramp-moderate.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ var policyScopedId = resourceId('Microsoft.Authorization/policySetDefinitions',
3535
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3636
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3737
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
38-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
38+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-fedramp-m'
3939
}
4040

4141
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/builtin/assignments/hitrust-hipaa.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ var policyScopedId = resourceId('Microsoft.Authorization/policySetDefinitions',
4747
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
4848
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
4949
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
50-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
50+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-hitrust-hipaa'
5151
}
5252

5353
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/builtin/assignments/location.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ var scope = tenantResourceId('Microsoft.Management/managementGroups', policyAssi
3131
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3232
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3333
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
34-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
34+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-location'
3535
}
3636

3737
resource rgLocationAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/builtin/assignments/nist80053r4.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ var policyScopedId = resourceId('Microsoft.Authorization/policySetDefinitions',
4141
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
4242
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
4343
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
44-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
44+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-nist-80053-r4'
4545
}
4646

4747
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/builtin/assignments/nist80053r5.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ var policyScopedId = resourceId('Microsoft.Authorization/policySetDefinitions',
3535
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3636
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3737
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
38-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
38+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-nist-80053-r5'
3939
}
4040

4141
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/builtin/assignments/pbmm.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ var policyScopedId = resourceId('Microsoft.Authorization/policySetDefinitions',
4141
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
4242
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
4343
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
44-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
44+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-pbmm'
4545
}
4646

4747
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/custom/assignments/AKS.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ var policyScopedId = '/providers/Microsoft.Management/managementGroups/${policyD
3535
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3636
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3737
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
38-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
38+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-aks'
3939
}
4040

4141
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/custom/assignments/DDoS.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ var policyScopedId = '/providers/Microsoft.Management/managementGroups/${policyD
3838
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3939
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
4040
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
41-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
41+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-ddos'
4242
}
4343

4444
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/custom/assignments/DNSPrivateEndpoints.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ var policyScopedId = '/providers/Microsoft.Management/managementGroups/${policyD
4141
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
4242
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
4343
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
44-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
44+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-dns-pe'
4545
}
4646

4747
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/custom/assignments/DefenderForCloud.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ var policyScopedId = '/providers/Microsoft.Management/managementGroups/${policyD
3535
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3636
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3737
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
38-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
38+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-mdfc'
3939
}
4040

4141
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/custom/assignments/LogAnalytics.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ var policyScopedId = '/providers/Microsoft.Management/managementGroups/${policyD
4141
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
4242
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
4343
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
44-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
44+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-logging'
4545
}
4646

4747
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/custom/assignments/Network.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ var policyScopedId = '/providers/Microsoft.Management/managementGroups/${policyD
3535
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3636
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3737
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
38-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
38+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-network'
3939
}
4040

4141
resource policySetAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = {

‎policy/custom/assignments/Tags.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ var scope = tenantResourceId('Microsoft.Management/managementGroups', policyAssi
3131
// Reference: https://docs.microsoft.com/azure/marketplace/azure-partner-customer-usage-attribution
3232
var telemetry = json(loadTextContent('../../../config/telemetry.json'))
3333
module telemetryCustomerUsageAttribution '../../../azresources/telemetry/customer-usage-attribution-management-group.bicep' = if (telemetry.customerUsageAttribution.enabled) {
34-
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}'
34+
name: 'pid-${telemetry.customerUsageAttribution.modules.policy}-tags'
3535
}
3636

3737
// Tags Inherited from Subscription to Resource Groups

‎scripts/deployments/Functions/HubNetworkWithAzureFirewall.ps1

+2-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ function Set-AzureFirewallPolicy {
5959
-Name "main-$Region" `
6060
-Location $Region `
6161
-TemplateFile "$($Context.WorkingDirectory)/landingzones/lz-platform-connectivity-hub-azfw/main-azfw-policy.bicep" `
62-
-TemplateParameterFile $ConfigurationFilePath
62+
-TemplateParameterFile $ConfigurationFilePath `
63+
-Verbose
6364
}
6465

6566
function Set-HubNetwork-With-AzureFirewall {

‎scripts/deployments/RunWorkflows.ps1

+12-8
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
7272
Deploy management groups interactively.
7373
7474
.EXAMPLE
75-
PS> .\RunWorkflows.ps1 -EnvironmentName CanadaESLZ-main -LoginInteractiveTenantId '8188040d-6c67-4c5c-b112-36a304b66dad' -DeployManagementGroups -DeployRoles -DeployLogging -DeployCustomPolicy -DeployBuiltInPolicy -DeployHubNetworkWithAzureFirewall
75+
PS> .\RunWorkflows.ps1 -EnvironmentName CanadaESLZ-main -LoginInteractiveTenantId '8188040d-6c67-4c5c-b112-36a304b66dad' -DeployManagementGroups -DeployRoles -DeployLogging -DeployCustomPolicy -DeployBuiltInPolicy -DeployAzureFirewallPolicy -DeployHubNetworkWithAzureFirewall
7676
7777
Deploy all platform components interactively, with Azure Firewall.
7878
@@ -105,6 +105,7 @@ Param(
105105
[switch]$DeployLogging,
106106
[switch]$DeployCustomPolicy,
107107
[switch]$DeployBuiltinPolicy,
108+
[switch]$DeployAzureFirewallPolicy,
108109
[switch]$DeployHubNetworkWithNVA,
109110
[switch]$DeployHubNetworkWithAzureFirewall,
110111
[string[]]$DeploySubscriptionIds=@(),
@@ -271,20 +272,23 @@ if ($DeployHubNetworkWithNVA) {
271272
-NvaPassword $NvaPassword
272273
}
273274

275+
# Azure Firewall Policy
276+
if ($DeployAzureFirewallPolicy) {
277+
# Create Azure Firewall Policy
278+
Set-AzureFirewallPolicy `
279+
-Context $Context `
280+
-Region $Context.Variables['var-hubnetwork-region'] `
281+
-SubscriptionId $Context.Variables['var-hubnetwork-subscriptionId'] `
282+
-ConfigurationFilePath "$($Context.NetworkingDirectory)/$($Context.Variables['var-hubnetwork-azfwPolicy-configurationFileName'])"
283+
}
284+
274285
# Hub Networking with Azure Firewall
275286
if ($DeployHubNetworkWithAzureFirewall) {
276287
Write-Host "Deploying Hub Networking with Azure Firewall..."
277288
# Get Logging information using logging config file
278289
$LoggingConfiguration = Get-LoggingConfiguration `
279290
-ConfigurationFilePath "$($Context.LoggingDirectory)/$($Context.Variables['var-logging-configurationFileName'])" `
280291
-SubscriptionId $Context.Variables['var-logging-subscriptionId']
281-
282-
# Create Azure Firewall Policy
283-
Set-AzureFirewallPolicy `
284-
-Context $Context `
285-
-Region $Context.Variables['var-hubnetwork-region'] `
286-
-SubscriptionId $Context.Variables['var-hubnetwork-subscriptionId'] `
287-
-ConfigurationFilePath "$($Context.NetworkingDirectory)/$($Context.Variables['var-hubnetwork-azfwPolicy-configurationFileName'])"
288292

289293
# Retrieve Azure Firewall Policy
290294
$AzureFirewallPolicyConfiguration = Get-AzureFirewallPolicy `

0 commit comments

Comments
 (0)