Skip to content

[Modules] Added restrictOutboundNetworkAccess to Microsoft.Sql/servers #2836

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahmadabdalla merged 2 commits into from
Feb 28, 2023
Merged

[Modules] Added restrictOutboundNetworkAccess to Microsoft.Sql/servers #2836

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9999372
Added restrictOutboundNetworkAccess parameter
Feb 24, 2023
3b6bd21
Added restrictOutboundNetworkAccess param to test
Feb 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions modules/Microsoft.Sql/servers/.test/common/deploy.test.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,5 +167,6 @@ module testDeployment '../../deploy.bicep' = {
virtualNetworkSubnetId: nestedDependencies.outputs.serviceEndpointSubnetResourceId
}
]
restrictOutboundNetworkAccess: 'Disabled'
}
}
9 changes: 9 additions & 0 deletions modules/Microsoft.Sql/servers/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,14 @@ param privateEndpoints array = []
])
param publicNetworkAccess string = ''

@description('Optional. Whether or not to restrict outbound network access for this server.')
@allowed([
''
'Enabled'
'Disabled'
])
param restrictOutboundNetworkAccess string = ''
Comment thread
thofle marked this conversation as resolved.

var identityType = systemAssignedIdentity ? (!empty(userAssignedIdentities) ? 'SystemAssigned,UserAssigned' : 'SystemAssigned') : (!empty(userAssignedIdentities) ? 'UserAssigned' : 'None')

var identity = identityType != 'None' ? {
Expand Down Expand Up @@ -121,6 +129,7 @@ resource server 'Microsoft.Sql/servers@2022-05-01-preview' = {
minimalTlsVersion: minimalTlsVersion
primaryUserAssignedIdentityId: !empty(primaryUserAssignedIdentityId) ? primaryUserAssignedIdentityId : null
publicNetworkAccess: !empty(publicNetworkAccess) ? any(publicNetworkAccess) : (!empty(privateEndpoints) && empty(firewallRules) && empty(virtualNetworkRules) ? 'Disabled' : null)
restrictOutboundNetworkAccess: !empty(restrictOutboundNetworkAccess) ? restrictOutboundNetworkAccess : null
}
}

Expand Down
5 changes: 5 additions & 0 deletions modules/Microsoft.Sql/servers/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ This module deploys a SQL server.
| `minimalTlsVersion` | string | `'1.2'` | `[1.0, 1.1, 1.2]` | Minimal TLS version allowed. |
| `privateEndpoints` | array | `[]` | | Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. |
| `publicNetworkAccess` | string | `''` | `['', Disabled, Enabled]` | Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and neither firewall rules nor virtual network rules are set. |
| `restrictOutboundNetworkAccess` | string | `''` | `['', Disabled, Enabled]` | Whether or not to restrict outbound network access for this server. |
| `roleAssignments` | array | `[]` | | Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
| `securityAlertPolicies` | _[securityAlertPolicies](securityAlertPolicies/readme.md)_ array | `[]` | | The security alert policies to create in the server. |
| `systemAssignedIdentity` | bool | `False` | | Enables system assigned managed identity on the resource. |
Expand Down Expand Up @@ -503,6 +504,7 @@ module servers './Microsoft.Sql/servers/deploy.bicep' = {
subnetResourceId: '<subnetResourceId>'
}
]
restrictOutboundNetworkAccess: 'Disabled'
roleAssignments: [
{
principalIds: [
Expand Down Expand Up @@ -644,6 +646,9 @@ module servers './Microsoft.Sql/servers/deploy.bicep' = {
}
]
},
"restrictOutboundNetworkAccess": {
"value": "Disabled"
},
"roleAssignments": {
"value": [
{
Expand Down