From 9999372a13353ac5b649233fa4aff7cbb65cc1b4 Mon Sep 17 00:00:00 2001 From: Thomas Flenstad Date: Fri, 24 Feb 2023 10:56:20 +0100 Subject: [PATCH 1/2] Added restrictOutboundNetworkAccess parameter --- modules/Microsoft.Sql/servers/deploy.bicep | 9 +++++++++ modules/Microsoft.Sql/servers/readme.md | 1 + 2 files changed, 10 insertions(+) diff --git a/modules/Microsoft.Sql/servers/deploy.bicep b/modules/Microsoft.Sql/servers/deploy.bicep index 7d981250e1..7c41df4718 100644 --- a/modules/Microsoft.Sql/servers/deploy.bicep +++ b/modules/Microsoft.Sql/servers/deploy.bicep @@ -77,6 +77,14 @@ param privateEndpoints array = [] ]) param publicNetworkAccess string = '' +@description('Optional. Whether or not to restrict outbound network access for this server.') +@allowed([ + '' + 'Enabled' + 'Disabled' +]) +param restrictOutboundNetworkAccess string = '' + var identityType = systemAssignedIdentity ? (!empty(userAssignedIdentities) ? 'SystemAssigned,UserAssigned' : 'SystemAssigned') : (!empty(userAssignedIdentities) ? 'UserAssigned' : 'None') var identity = identityType != 'None' ? { @@ -121,6 +129,7 @@ resource server 'Microsoft.Sql/servers@2022-05-01-preview' = { minimalTlsVersion: minimalTlsVersion primaryUserAssignedIdentityId: !empty(primaryUserAssignedIdentityId) ? primaryUserAssignedIdentityId : null publicNetworkAccess: !empty(publicNetworkAccess) ? any(publicNetworkAccess) : (!empty(privateEndpoints) && empty(firewallRules) && empty(virtualNetworkRules) ? 'Disabled' : null) + restrictOutboundNetworkAccess: !empty(restrictOutboundNetworkAccess) ? restrictOutboundNetworkAccess : null } } diff --git a/modules/Microsoft.Sql/servers/readme.md b/modules/Microsoft.Sql/servers/readme.md index 754456be30..e97a15adeb 100644 --- a/modules/Microsoft.Sql/servers/readme.md +++ b/modules/Microsoft.Sql/servers/readme.md @@ -61,6 +61,7 @@ This module deploys a SQL server. | `minimalTlsVersion` | string | `'1.2'` | `[1.0, 1.1, 1.2]` | Minimal TLS version allowed. | | `privateEndpoints` | array | `[]` | | Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. | | `publicNetworkAccess` | string | `''` | `['', Disabled, Enabled]` | Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and neither firewall rules nor virtual network rules are set. | +| `restrictOutboundNetworkAccess` | string | `''` | `['', Disabled, Enabled]` | Whether or not to restrict outbound network access for this server. | | `roleAssignments` | array | `[]` | | Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. | | `securityAlertPolicies` | _[securityAlertPolicies](securityAlertPolicies/readme.md)_ array | `[]` | | The security alert policies to create in the server. | | `systemAssignedIdentity` | bool | `False` | | Enables system assigned managed identity on the resource. | From 3b6bd213cbbcfaf128af1ea8b8ffaf0d8d6999b1 Mon Sep 17 00:00:00 2001 From: thofle Date: Sun, 26 Feb 2023 14:06:56 +0100 Subject: [PATCH 2/2] Added restrictOutboundNetworkAccess param to test --- modules/Microsoft.Sql/servers/.test/common/deploy.test.bicep | 1 + modules/Microsoft.Sql/servers/readme.md | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/modules/Microsoft.Sql/servers/.test/common/deploy.test.bicep b/modules/Microsoft.Sql/servers/.test/common/deploy.test.bicep index e10b15264b..b1e58dbfc1 100644 --- a/modules/Microsoft.Sql/servers/.test/common/deploy.test.bicep +++ b/modules/Microsoft.Sql/servers/.test/common/deploy.test.bicep @@ -167,5 +167,6 @@ module testDeployment '../../deploy.bicep' = { virtualNetworkSubnetId: nestedDependencies.outputs.serviceEndpointSubnetResourceId } ] + restrictOutboundNetworkAccess: 'Disabled' } } diff --git a/modules/Microsoft.Sql/servers/readme.md b/modules/Microsoft.Sql/servers/readme.md index e97a15adeb..2cec828333 100644 --- a/modules/Microsoft.Sql/servers/readme.md +++ b/modules/Microsoft.Sql/servers/readme.md @@ -504,6 +504,7 @@ module servers './Microsoft.Sql/servers/deploy.bicep' = { subnetResourceId: '' } ] + restrictOutboundNetworkAccess: 'Disabled' roleAssignments: [ { principalIds: [ @@ -645,6 +646,9 @@ module servers './Microsoft.Sql/servers/deploy.bicep' = { } ] }, + "restrictOutboundNetworkAccess": { + "value": "Disabled" + }, "roleAssignments": { "value": [ {