diff --git a/.github/workflows/ms.network.networksecuritygroups.yml b/.github/workflows/ms.network.networksecuritygroups.yml index 9535e97e90..53175de1ad 100644 --- a/.github/workflows/ms.network.networksecuritygroups.yml +++ b/.github/workflows/ms.network.networksecuritygroups.yml @@ -106,8 +106,7 @@ jobs: - name: 'Using test file [${{ matrix.moduleTestFilePaths }}]' uses: ./.github/actions/templates/validateModuleDeployment with: - templateFilePath: '${{ env.modulePath }}/deploy.bicep' - parameterFilePath: '${{ env.modulePath }}/${{ matrix.moduleTestFilePaths }}' + templateFilePath: '${{ env.modulePath }}/${{ matrix.moduleTestFilePaths }}' location: '${{ env.location }}' resourceGroupName: '${{ env.resourceGroupName }}' subscriptionId: '${{ secrets.ARM_SUBSCRIPTION_ID }}' diff --git a/modules/Microsoft.Network/networkSecurityGroups/.test/common/dependencies.bicep b/modules/Microsoft.Network/networkSecurityGroups/.test/common/dependencies.bicep new file mode 100644 index 0000000000..a57e2a9868 --- /dev/null +++ b/modules/Microsoft.Network/networkSecurityGroups/.test/common/dependencies.bicep @@ -0,0 +1,24 @@ +@description('Optional. The location to deploy to.') +param location string = resourceGroup().location + +@description('Required. The name of the Managed Identity to create.') +param managedIdentityName string + +@description('Required. The name of the Application Security Group to create.') +param applicationSecurityGroupName string + +resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { + name: managedIdentityName + location: location +} + +resource applicationSecurityGroup 'Microsoft.Network/applicationSecurityGroups@2022-01-01' = { + name: applicationSecurityGroupName + location: location +} + +@description('The principal ID of the created Managed Identity.') +output managedIdentityPrincipalId string = managedIdentity.properties.principalId + +@description('The resource ID of the created Application Security Group.') +output applicationSecurityGroupResourceId string = applicationSecurityGroup.id diff --git a/modules/Microsoft.Network/networkSecurityGroups/.test/common/deploy.test.bicep b/modules/Microsoft.Network/networkSecurityGroups/.test/common/deploy.test.bicep new file mode 100644 index 0000000000..cdba107916 --- /dev/null +++ b/modules/Microsoft.Network/networkSecurityGroups/.test/common/deploy.test.bicep @@ -0,0 +1,138 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'ms.network.networksecuritygroups-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'nnsgcom' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: location +} + +module resourceGroupResources 'dependencies.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-paramNested' + params: { + managedIdentityName: 'dep-<>-msi-${serviceShort}' + applicationSecurityGroupName: 'dep-<>-asg-${serviceShort}' + } +} + +// Diagnostics +// =========== +module diagnosticDependencies '../../../../.shared/dependencyConstructs/diagnostic.dependencies.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name, location)}-diagnosticDependencies' + params: { + storageAccountName: 'dep<>diasa${serviceShort}01' + logAnalyticsWorkspaceName: 'dep-<>-law-${serviceShort}' + eventHubNamespaceEventHubName: 'dep-<>-evh-${serviceShort}' + eventHubNamespaceName: 'dep-<>-evhns-${serviceShort}' + location: location + } +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../deploy.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + diagnosticLogsRetentionInDays: 7 + diagnosticStorageAccountId: diagnosticDependencies.outputs.storageAccountResourceId + diagnosticWorkspaceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId + diagnosticEventHubAuthorizationRuleId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId + diagnosticEventHubName: diagnosticDependencies.outputs.eventHubNamespaceEventHubName + lock: 'CanNotDelete' + roleAssignments: [ + { + principalIds: [ + resourceGroupResources.outputs.managedIdentityPrincipalId + ] + roleDefinitionIdOrName: 'Reader' + } + ] + securityRules: [ + { + name: 'Specific' + properties: { + access: 'Allow' + description: 'Tests specific IPs and ports' + destinationAddressPrefix: '*' + destinationPortRange: '8080' + direction: 'Inbound' + priority: 100 + protocol: '*' + sourceAddressPrefix: '*' + sourcePortRange: '*' + } + } + { + name: 'Ranges' + properties: { + access: 'Allow' + description: 'Tests Ranges' + destinationAddressPrefixes: [ + '10.2.0.0/16' + '10.3.0.0/16' + ] + destinationPortRanges: [ + '90' + '91' + ] + direction: 'Inbound' + priority: 101 + protocol: '*' + sourceAddressPrefixes: [ + '10.0.0.0/16' + '10.1.0.0/16' + ] + sourcePortRanges: [ + '80' + '81' + ] + } + } + { + name: 'Port_8082' + properties: { + access: 'Allow' + description: 'Allow inbound access on TCP 8082' + destinationApplicationSecurityGroups: [ + { + id: resourceGroupResources.outputs.applicationSecurityGroupResourceId + } + ] + destinationPortRange: '8082' + direction: 'Inbound' + priority: 102 + protocol: '*' + sourceApplicationSecurityGroups: [ + { + id: resourceGroupResources.outputs.applicationSecurityGroupResourceId + } + ] + sourcePortRange: '*' + } + } + ] + } +} diff --git a/modules/Microsoft.Network/networkSecurityGroups/.test/min.parameters.json b/modules/Microsoft.Network/networkSecurityGroups/.test/min.parameters.json deleted file mode 100644 index b07946467a..0000000000 --- a/modules/Microsoft.Network/networkSecurityGroups/.test/min.parameters.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-az-nsg-min-001" - } - } -} diff --git a/modules/Microsoft.Network/networkSecurityGroups/.test/min/deploy.test.bicep b/modules/Microsoft.Network/networkSecurityGroups/.test/min/deploy.test.bicep new file mode 100644 index 0000000000..2bee352bdd --- /dev/null +++ b/modules/Microsoft.Network/networkSecurityGroups/.test/min/deploy.test.bicep @@ -0,0 +1,37 @@ +targetScope = 'subscription' + +// ========== // +// Parameters // +// ========== // +@description('Optional. The name of the resource group to deploy for testing purposes.') +@maxLength(90) +param resourceGroupName string = 'ms.network.networksecuritygroups-${serviceShort}-rg' + +@description('Optional. The location to deploy resources to.') +param location string = deployment().location + +@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.') +param serviceShort string = 'nnsgmin' + +// =========== // +// Deployments // +// =========== // + +// General resources +// ================= +resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = { + name: resourceGroupName + location: location +} + +// ============== // +// Test Execution // +// ============== // + +module testDeployment '../../deploy.bicep' = { + scope: resourceGroup + name: '${uniqueString(deployment().name)}-test-${serviceShort}' + params: { + name: '<>${serviceShort}001' + } +} diff --git a/modules/Microsoft.Network/networkSecurityGroups/.test/parameters.json b/modules/Microsoft.Network/networkSecurityGroups/.test/parameters.json deleted file mode 100644 index 26cbb1eb56..0000000000 --- a/modules/Microsoft.Network/networkSecurityGroups/.test/parameters.json +++ /dev/null @@ -1,103 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-az-nsg-x-001" - }, - "lock": { - "value": "CanNotDelete" - }, - "securityRules": { - "value": [ - { - "name": "Specific", - "properties": { - "description": "Tests specific IPs and ports", - "protocol": "*", - "sourcePortRange": "*", - "destinationPortRange": "8080", - "sourceAddressPrefix": "*", - "destinationAddressPrefix": "*", - "access": "Allow", - "priority": 100, - "direction": "Inbound" - } - }, - { - "name": "Ranges", - "properties": { - "description": "Tests Ranges", - "protocol": "*", - "access": "Allow", - "priority": 101, - "direction": "Inbound", - "sourcePortRanges": [ - "80", - "81" - ], - "destinationPortRanges": [ - "90", - "91" - ], - "sourceAddressPrefixes": [ - "10.0.0.0/16", - "10.1.0.0/16" - ], - "destinationAddressPrefixes": [ - "10.2.0.0/16", - "10.3.0.0/16" - ] - } - }, - { - "name": "Port_8082", - "properties": { - "description": "Allow inbound access on TCP 8082", - "protocol": "*", - "sourcePortRange": "*", - "destinationPortRange": "8082", - "access": "Allow", - "priority": 102, - "direction": "Inbound", - "sourceApplicationSecurityGroups": [ - { - "id": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/applicationSecurityGroups/adp-<>-az-asg-x-001" - } - ], - "destinationApplicationSecurityGroups": [ - { - "id": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/applicationSecurityGroups/adp-<>-az-asg-x-001" - } - ] - } - } - ] - }, - "roleAssignments": { - "value": [ - { - "roleDefinitionIdOrName": "Reader", - "principalIds": [ - "<>" - ] - } - ] - }, - "diagnosticLogsRetentionInDays": { - "value": 7 - }, - "diagnosticStorageAccountId": { - "value": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Storage/storageAccounts/adp<>azsax001" - }, - "diagnosticWorkspaceId": { - "value": "/subscriptions/<>/resourcegroups/validation-rg/providers/microsoft.operationalinsights/workspaces/adp-<>-az-law-x-001" - }, - "diagnosticEventHubAuthorizationRuleId": { - "value": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.EventHub/namespaces/adp-<>-az-evhns-x-001/AuthorizationRules/RootManageSharedAccessKey" - }, - "diagnosticEventHubName": { - "value": "adp-<>-az-evh-x-001" - } - } -} diff --git a/modules/Microsoft.Network/networkSecurityGroups/readme.md b/modules/Microsoft.Network/networkSecurityGroups/readme.md index fd8c232d9a..9436f5a75d 100644 --- a/modules/Microsoft.Network/networkSecurityGroups/readme.md +++ b/modules/Microsoft.Network/networkSecurityGroups/readme.md @@ -165,7 +165,7 @@ The following module usage examples are retrieved from the content of the files >**Note**: Each example lists all the required parameters first, followed by the rest - each in alphabetical order. -

Example 1: Min

+

Example 1: Common

@@ -173,58 +173,21 @@ The following module usage examples are retrieved from the content of the files ```bicep module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-NetworkSecurityGroups' - params: { - name: '<>-az-nsg-min-001' - } -} -``` - -
-

- -

- -via JSON Parameter file - -```json -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "name": { - "value": "<>-az-nsg-min-001" - } - } -} -``` - -
-

- -

Example 2: Parameters

- -
- -via Bicep module - -```bicep -module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.bicep' = { - name: '${uniqueString(deployment().name)}-NetworkSecurityGroups' + name: '${uniqueString(deployment().name)}-test-nnsgcom' params: { // Required parameters - name: '<>-az-nsg-x-001' + name: '<>nnsgcom001' // Non-required parameters - diagnosticEventHubAuthorizationRuleId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.EventHub/namespaces/adp-<>-az-evhns-x-001/AuthorizationRules/RootManageSharedAccessKey' - diagnosticEventHubName: 'adp-<>-az-evh-x-001' + diagnosticEventHubAuthorizationRuleId: '' + diagnosticEventHubName: '' diagnosticLogsRetentionInDays: 7 - diagnosticStorageAccountId: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Storage/storageAccounts/adp<>azsax001' - diagnosticWorkspaceId: '/subscriptions/<>/resourcegroups/validation-rg/providers/microsoft.operationalinsights/workspaces/adp-<>-az-law-x-001' + diagnosticStorageAccountId: '' + diagnosticWorkspaceId: '' lock: 'CanNotDelete' roleAssignments: [ { principalIds: [ - '<>' + '' ] roleDefinitionIdOrName: 'Reader' } @@ -277,7 +240,7 @@ module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.b description: 'Allow inbound access on TCP 8082' destinationApplicationSecurityGroups: [ { - id: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/applicationSecurityGroups/adp-<>-az-asg-x-001' + id: '' } ] destinationPortRange: '8082' @@ -286,7 +249,7 @@ module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.b protocol: '*' sourceApplicationSecurityGroups: [ { - id: '/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/applicationSecurityGroups/adp-<>-az-asg-x-001' + id: '' } ] sourcePortRange: '*' @@ -311,23 +274,23 @@ module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.b "parameters": { // Required parameters "name": { - "value": "<>-az-nsg-x-001" + "value": "<>nnsgcom001" }, // Non-required parameters "diagnosticEventHubAuthorizationRuleId": { - "value": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.EventHub/namespaces/adp-<>-az-evhns-x-001/AuthorizationRules/RootManageSharedAccessKey" + "value": "" }, "diagnosticEventHubName": { - "value": "adp-<>-az-evh-x-001" + "value": "" }, "diagnosticLogsRetentionInDays": { "value": 7 }, "diagnosticStorageAccountId": { - "value": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Storage/storageAccounts/adp<>azsax001" + "value": "" }, "diagnosticWorkspaceId": { - "value": "/subscriptions/<>/resourcegroups/validation-rg/providers/microsoft.operationalinsights/workspaces/adp-<>-az-law-x-001" + "value": "" }, "lock": { "value": "CanNotDelete" @@ -336,7 +299,7 @@ module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.b "value": [ { "principalIds": [ - "<>" + "" ], "roleDefinitionIdOrName": "Reader" } @@ -391,7 +354,7 @@ module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.b "description": "Allow inbound access on TCP 8082", "destinationApplicationSecurityGroups": [ { - "id": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/applicationSecurityGroups/adp-<>-az-asg-x-001" + "id": "" } ], "destinationPortRange": "8082", @@ -400,7 +363,7 @@ module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.b "protocol": "*", "sourceApplicationSecurityGroups": [ { - "id": "/subscriptions/<>/resourceGroups/validation-rg/providers/Microsoft.Network/applicationSecurityGroups/adp-<>-az-asg-x-001" + "id": "" } ], "sourcePortRange": "*" @@ -414,3 +377,40 @@ module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.b

+ +

Example 2: Min

+ +
+ +via Bicep module + +```bicep +module networkSecurityGroups './Microsoft.Network/networkSecurityGroups/deploy.bicep' = { + name: '${uniqueString(deployment().name)}-test-nnsgmin' + params: { + name: '<>nnsgmin001' + } +} +``` + +
+

+ +

+ +via JSON Parameter file + +```json +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "name": { + "value": "<>nnsgmin001" + } + } +} +``` + +
+