-
Notifications
You must be signed in to change notification settings - Fork 11
/
vNet.bicep
131 lines (124 loc) · 4.12 KB
/
vNet.bicep
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
// ------------------------------------------------------------
// VNet - Build a vnet w/ subnets
//
// Vnet Object
//
// Use this table for sub-object creation
// NSG RouteTable ServEndPt
// GatewaySubnet X
// AzureBastionSubnet ?
// AzureFirewallSubnet
// <AllOthers> X X X
// ------------------------------------------------------------
//Special vNet/Subnet objects
param vNetArray array
param subnetArray array
//Vnet build out
resource vnet 'Microsoft.Network/virtualNetworks@2020-06-01' = [for (vnet, i) in vNetArray: {
name: '${vnet.vnetName}'
location: resourceGroup().location
properties: {
addressSpace: {
addressPrefixes: [
vnet.vNetAddressSpace
]
}
enableDdosProtection: false
//This is a minimal subnet loop - this keeps the subnets from dropping
//but temporarily removes the RT/NSG/ServiceEndpoints
//Note it will probably break subnet delegation
subnets: [for subnet in vnet.subnets: {
name: subnet.SubnetName
properties: {
addressPrefix: subnet.SubnetAddressSpace
}
}]
}
}]
//Special Subnets
var subnetRTOnly = [
'GatewaySubnet'
]
var subnetNone = [
'AzureBastionSubnet'
'AzureFirewallSubnet'
]
var specialSubnet = [
'GatewaySubnet'
'AzureBastionSubnet'
'AzureFirewallSubnet'
]
//Now create the other subnet information
//GatewaySubnet needs a Route Table
@batchSize(1)
module GWRouteTable 'modules/routetable.bicep' = [for (subnet, i) in subnetArray: if (contains(subnetRTOnly, subnet.subnetName)) {
name: 'GWRouteTable-${subnet.vNetName}-${subnet.subnetName}-rt-${i}'
scope: resourceGroup()
params: {
rtName: '${subnet.vNetName}-${subnet.subnetName}-rt'
disableBGPProp: true
routes: subnet.routes
}
}]
module GWsubnet 'modules/subnet-rt.bicep' = [for (subnet, i) in subnetArray: if (contains(subnetRTOnly, subnet.subnetName)) {
name: 'GWsubnet-${subnet.vNetName}-${subnet.subnetName}-${i}'
params: {
rgVnet: resourceGroup().name
vNetName: subnet.vNetName
subnetName: subnet.subnetName
subnetAddressPrefix: subnet.SubnetAddressSpace
serviceEndPoints: subnet.serviceEndPoints
}
dependsOn: [
GWRouteTable
]
}]
//Bastion & Firewall - this assumes no NSG for bastion
@batchSize(1)
module BstFwSubnets 'modules/subnet-none.bicep' = [for (subnet, i) in subnetArray: if (contains(subnetNone, subnet.subnetName)) {
name: 'BstFwSubnets-${subnet.vNetName}-${subnet.subnetName}-${i}'
params: {
rgVnet: resourceGroup().name
vNetName: subnet.vNetName
subnetName: subnet.subnetName
subnetAddressPrefix: subnet.SubnetAddressSpace
serviceEndPoints: subnet.serviceEndPoints
}
dependsOn: [
GWsubnet
]
}]
//All others are both RT and NSG. Note has to be serialized because of vNet update locks
module OtherRouteTable 'modules/routetable.bicep' = [for (subnet, i) in subnetArray: if (!contains(specialSubnet, subnet.subnetName)) {
name: 'OtherRouteTable-${subnet.vNetName}-${subnet.subnetName}-rt-${i}'
scope: resourceGroup()
params: {
rtName: '${subnet.vNetName}-${subnet.subnetName}-rt'
disableBGPProp: true
routes: subnet.routes
}
}]
module OtherNSGTable 'modules/networksecuritygroup.bicep' = [for (subnet, i) in subnetArray: if (!contains(specialSubnet, subnet.subnetName)) {
name: 'OtherNSGTable-${subnet.vNetName}-${subnet.subnetName}-nsg-${i}'
scope: resourceGroup()
params: {
nsgName: '${subnet.vNetName}-${subnet.subnetName}-nsg'
secRules: subnet.securityRules
}
}]
@batchSize(1)
module OtherSubnets 'modules/subnet-both.bicep' = [for (subnet, i) in subnetArray: if (!contains(specialSubnet, subnet.subnetName)) {
name: 'OtherSubnets-${subnet.vNetName}-${subnet.subnetName}-${i}'
params: {
rgVnet: resourceGroup().name
vNetName: subnet.vNetName
subnetName: subnet.subnetName
subnetAddressPrefix: subnet.SubnetAddressSpace
serviceEndPoints: subnet.serviceEndPoints
}
dependsOn: [
BstFwSubnets
OtherRouteTable
OtherNSGTable
]
}]