Merge pull request #1804 from jemrobinson/1781-bug-fix

Change AllowExternalAzureAutomationOperations to a network rule
alan-turing-institute · Apr 15, 2024 · 1788895 · 1788895
2 parents 64eea3d + ff3e07e
commit 1788895
Showing 1 changed file with 16 additions and 3 deletions.
diff --git a/data_safe_haven/infrastructure/stacks/shm/firewall.py b/data_safe_haven/infrastructure/stacks/shm/firewall.py
@@ -313,8 +313,10 @@ def __init__(
                             description="Allow external Azure Automation requests",
                             name="AllowExternalAzureAutomationOperations",
                             protocols=[
-                                network.AzureFirewallNetworkRuleProtocol.TCP,
-                                network.AzureFirewallNetworkRuleProtocol.UDP,
+                                network.AzureFirewallApplicationRuleProtocolArgs(
+                                    port=443,
+                                    protocol_type="Https",
+                                )
                             ],
                             source_addresses=["*"],
                             target_fqdns=[
@@ -484,8 +486,8 @@ def __init__(
                             destination_ports=["53"],
                             name="AllowExternalDnsResolver",
                             protocols=[
-                                network.AzureFirewallNetworkRuleProtocol.UDP,
                                 network.AzureFirewallNetworkRuleProtocol.TCP,
+                                network.AzureFirewallNetworkRuleProtocol.UDP,
                             ],
                             source_addresses=[props.subnet_identity_servers_iprange],
                         ),
@@ -496,6 +498,17 @@ def __init__(
                     name=f"{stack_name}-all",
                     priority=1010,
                     rules=[
+                        network.AzureFirewallNetworkRuleArgs(
+                            description="Allow external Azure Automation requests",
+                            destination_addresses=["GuestAndHybridManagement"],
+                            destination_ports=["*"],
+                            name="AllowExternalAzureAutomationOperations",
+                            protocols=[
+                                network.AzureFirewallNetworkRuleProtocol.TCP,
+                                network.AzureFirewallNetworkRuleProtocol.UDP,
+                            ],
+                            source_addresses=["*"],
+                        ),
                         network.AzureFirewallNetworkRuleArgs(
                             description="Allow external NTP requests",
                             destination_addresses=ntp_ip_addresses,