Skip to content

Commit fbe95e3

Browse files
ColinBeebyHEEColinBeebyHEE
committed
Corrected security rule definitions
1 parent be2116c commit fbe95e3

1 file changed

Lines changed: 101 additions & 135 deletions

File tree

  • LearningHub.Nhs.MessageQueueProcessor/Terraform

‎LearningHub.Nhs.MessageQueueProcessor/Terraform/main.tf‎

Lines changed: 101 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -74,160 +74,126 @@ resource "azurerm_network_security_group" "nsg" {
7474
priority = 101
7575
protocol = "*"
7676
destinationPortRange = "*"
77-
destinationPortRanges" = []
77+
destinationPortRanges = []
7878
destinationAddressPrefix = "10.0.1.0/24"
79-
destinationAddressPrefixes": []
79+
destinationAddressPrefixes = []
8080
sourceAddressPrefix = "*"
8181
sourceAddressPrefixes = []
8282
sourcePortRange = "*"
8383
sourcePortRanges = []
8484
}
8585
security_rule {
86-
access = "Allow",
87-
description = "Allow MI internal inbound traffic",
88-
destinationAddressPrefix = "10.0.1.0/24",
89-
destinationAddressPrefixes": [],
90-
destinationPortRange = "*",
91-
destinationPortRanges": [],
92-
direction = "Inbound",
93-
etag = "W/\"ced64a9b-9b81-4d82-8a67-5e98052479e8\"",
94-
id = "/subscriptions/66516f71-f3d4-4911-b900-c6e4690a5b15/resourceGroups/LearningHub-MessageQueueProcessor-Dev/providers/Microsoft.Network/networkSecurityGroups/ManagedInstanceNSG/securityRules/Microsoft.Sql-managedInstances_UseOnly_mi-internal-in-10-0-1-0-24-v11",
95-
name = "Microsoft.Sql-managedInstances_UseOnly_mi-internal-in-10-0-1-0-24-v11",
96-
priority": 101,
97-
protocol = "*",
98-
provisioningState = "Succeeded",
99-
resourceGroup = "LearningHub-MessageQueueProcessor-Dev",
100-
sourceAddressPrefix = "10.0.1.0/24",
101-
sourceAddressPrefixes": [],
102-
sourcePortRange = "*",
103-
sourcePortRanges": [],
104-
type = "Microsoft.Network/networkSecurityGroups/securityRules"
86+
name = "Microsoft.Sql-managedInstances_UseOnly_mi-internal-in-10-0-1-0-24-v11",
87+
description = "Allow MI internal inbound traffic",
88+
direction = "Inbound",
89+
access = "Allow",
90+
priority = 101,
91+
protocol = "*",
92+
destinationPortRange = "*",
93+
destinationPortRanges = [],
94+
destinationAddressPrefix = "10.0.1.0/24",
95+
destinationAddressPrefixes = [],
96+
sourceAddressPrefix = "10.0.1.0/24",
97+
sourceAddressPrefixes = [],
98+
sourcePortRange = "*",
99+
sourcePortRanges = []
105100
}
106101
security_rule {
107-
access = "Allow",
108-
description = "Allow communication with Azure Active Directory over https",
109-
destinationAddressPrefix = "AzureActiveDirectory",
110-
destinationAddressPrefixes": [],
111-
destinationPortRange = "443",
112-
destinationPortRanges": [],
113-
direction = "Outbound",
114-
etag = "W/\"ced64a9b-9b81-4d82-8a67-5e98052479e8\"",
115-
id = "/subscriptions/66516f71-f3d4-4911-b900-c6e4690a5b15/resourceGroups/LearningHub-MessageQueueProcessor-Dev/providers/Microsoft.Network/networkSecurityGroups/ManagedInstanceNSG/securityRules/Microsoft.Sql-managedInstances_UseOnly_mi-aad-out-10-0-1-0-24-v11",
116-
name = "Microsoft.Sql-managedInstances_UseOnly_mi-aad-out-10-0-1-0-24-v11",
117-
priority": 101,
118-
protocol = "Tcp",
119-
provisioningState = "Succeeded",
120-
resourceGroup = "LearningHub-MessageQueueProcessor-Dev",
121-
sourceAddressPrefix = "10.0.1.0/24",
122-
sourceAddressPrefixes": [],
123-
sourcePortRange = "*",
124-
sourcePortRanges": [],
125-
type = "Microsoft.Network/networkSecurityGroups/securityRules"
102+
name = "Microsoft.Sql-managedInstances_UseOnly_mi-aad-out-10-0-1-0-24-v11",
103+
description = "Allow communication with Azure Active Directory over https",
104+
direction = "Outbound",
105+
access = "Allow",
106+
priority = 101,
107+
protocol = "Tcp",
108+
destinationAddressPrefix = "AzureActiveDirectory",
109+
destinationAddressPrefixes = [],
110+
destinationPortRange = "443",
111+
destinationPortRanges = [],
112+
sourceAddressPrefix = "10.0.1.0/24",
113+
sourceAddressPrefixes = [],
114+
sourcePortRange = "*",
115+
sourcePortRanges = []
126116
}
127117
security_rule {
128-
access = "Allow",
129-
description = "Allow communication with the One DS Collector over https",
130-
destinationAddressPrefix = "OneDsCollector",
131-
destinationAddressPrefixes": [],
132-
destinationPortRange = "443",
133-
destinationPortRanges": [],
134-
direction = "Outbound",
135-
etag = "W/\"ced64a9b-9b81-4d82-8a67-5e98052479e8\"",
136-
id = "/subscriptions/66516f71-f3d4-4911-b900-c6e4690a5b15/resourceGroups/LearningHub-MessageQueueProcessor-Dev/providers/Microsoft.Network/networkSecurityGroups/ManagedInstanceNSG/securityRules/Microsoft.Sql-managedInstances_UseOnly_mi-onedsc-out-10-0-1-0-24-v11",
137-
name = "Microsoft.Sql-managedInstances_UseOnly_mi-onedsc-out-10-0-1-0-24-v11",
138-
priority": 102,
139-
protocol = "Tcp",
140-
provisioningState = "Succeeded",
141-
resourceGroup = "LearningHub-MessageQueueProcessor-Dev",
142-
sourceAddressPrefix = "10.0.1.0/24",
143-
sourceAddressPrefixes": [],
144-
sourcePortRange = "*",
145-
sourcePortRanges": [],
146-
type = "Microsoft.Network/networkSecurityGroups/securityRules"
118+
name = "Microsoft.Sql-managedInstances_UseOnly_mi-onedsc-out-10-0-1-0-24-v11",
119+
description = "Allow communication with the One DS Collector over https",
120+
access = "Allow",
121+
direction = "Outbound",
122+
priority = 102,
123+
protocol = "Tcp",
124+
destinationAddressPrefix = "OneDsCollector",
125+
destinationAddressPrefixes = [],
126+
destinationPortRange = "443",
127+
destinationPortRanges = [],
128+
sourceAddressPrefix = "10.0.1.0/24",
129+
sourceAddressPrefixes = [],
130+
sourcePortRange = "*",
131+
sourcePortRanges = []
147132
}
148133
security_rule {
149-
access = "Allow",
150-
description = "Allow MI internal outbound traffic",
151-
destinationAddressPrefix = "10.0.1.0/24",
152-
destinationAddressPrefixes": [],
153-
destinationPortRange = "*",
154-
destinationPortRanges": [],
155-
direction = "Outbound",
156-
etag = "W/\"ced64a9b-9b81-4d82-8a67-5e98052479e8\"",
157-
id = "/subscriptions/66516f71-f3d4-4911-b900-c6e4690a5b15/resourceGroups/LearningHub-MessageQueueProcessor-Dev/providers/Microsoft.Network/networkSecurityGroups/ManagedInstanceNSG/securityRules/Microsoft.Sql-managedInstances_UseOnly_mi-internal-out-10-0-1-0-24-v11",
158-
name = "Microsoft.Sql-managedInstances_UseOnly_mi-internal-out-10-0-1-0-24-v11",
159-
priority": 103,
160-
protocol = "*",
161-
provisioningState = "Succeeded",
162-
resourceGroup = "LearningHub-MessageQueueProcessor-Dev",
163-
sourceAddressPrefix = "10.0.1.0/24",
164-
sourceAddressPrefixes": [],
165-
sourcePortRange = "*",
166-
sourcePortRanges": [],
167-
type = "Microsoft.Network/networkSecurityGroups/securityRules"
134+
name = "Microsoft.Sql-managedInstances_UseOnly_mi-internal-out-10-0-1-0-24-v11",
135+
description = "Allow MI internal outbound traffic",
136+
access = "Allow",
137+
direction = "Outbound",
138+
priority = 103,
139+
protocol = "*",
140+
destinationAddressPrefix = "10.0.1.0/24",
141+
destinationAddressPrefixes = [],
142+
destinationPortRange = "*",
143+
destinationPortRanges = [],
144+
sourceAddressPrefix = "10.0.1.0/24",
145+
sourceAddressPrefixes = [],
146+
sourcePortRange = "*",
147+
sourcePortRanges = [],
168148
}
169149
security_rule {
170-
access = "Allow",
171-
description = "Allow outbound communication with storage over HTTPS",
172-
destinationAddressPrefix = "Storage.uksouth",
173-
destinationAddressPrefixes": [],
174-
destinationPortRange = "443",
175-
destinationPortRanges": [],
176-
direction = "Outbound",
177-
etag = "W/\"ced64a9b-9b81-4d82-8a67-5e98052479e8\"",
178-
id = "/subscriptions/66516f71-f3d4-4911-b900-c6e4690a5b15/resourceGroups/LearningHub-MessageQueueProcessor-Dev/providers/Microsoft.Network/networkSecurityGroups/ManagedInstanceNSG/securityRules/Microsoft.Sql-managedInstances_UseOnly_mi-strg-p-out-10-0-1-0-24-v11",
179-
name = "Microsoft.Sql-managedInstances_UseOnly_mi-strg-p-out-10-0-1-0-24-v11",
180-
priority": 104,
181-
protocol = "*",
182-
provisioningState = "Succeeded",
183-
resourceGroup = "LearningHub-MessageQueueProcessor-Dev",
184-
sourceAddressPrefix = "10.0.1.0/24",
185-
sourceAddressPrefixes": [],
186-
sourcePortRange = "*",
187-
sourcePortRanges": [],
188-
type = "Microsoft.Network/networkSecurityGroups/securityRules"
150+
name = "Microsoft.Sql-managedInstances_UseOnly_mi-strg-p-out-10-0-1-0-24-v11",
151+
description = "Allow outbound communication with storage over HTTPS",
152+
access = "Allow",
153+
direction = "Outbound",
154+
priority = 104,
155+
protocol = "*",
156+
destinationAddressPrefix = "Storage.uksouth",
157+
destinationAddressPrefixes = [],
158+
destinationPortRange = "443",
159+
destinationPortRanges = [],
160+
sourceAddressPrefix = "10.0.1.0/24",
161+
sourceAddressPrefixes = [],
162+
sourcePortRange = "*",
163+
sourcePortRanges = [],
189164
}
190165
security_rule {
191-
access = "Allow",
192-
description = "Allow outbound communication with storage over HTTPS",
193-
destinationAddressPrefix = "Storage.ukwest",
194-
destinationAddressPrefixes": [],
195-
destinationPortRange = "443",
196-
destinationPortRanges": [],
197-
direction = "Outbound",
198-
etag = "W/\"ced64a9b-9b81-4d82-8a67-5e98052479e8\"",
199-
id = "/subscriptions/66516f71-f3d4-4911-b900-c6e4690a5b15/resourceGroups/LearningHub-MessageQueueProcessor-Dev/providers/Microsoft.Network/networkSecurityGroups/ManagedInstanceNSG/securityRules/Microsoft.Sql-managedInstances_UseOnly_mi-strg-s-out-10-0-1-0-24-v11",
200-
name = "Microsoft.Sql-managedInstances_UseOnly_mi-strg-s-out-10-0-1-0-24-v11",
201-
priority": 105,
202-
protocol = "*",
203-
provisioningState = "Succeeded",
204-
resourceGroup = "LearningHub-MessageQueueProcessor-Dev",
205-
sourceAddressPrefix = "10.0.1.0/24",
206-
sourceAddressPrefixes": [],
207-
sourcePortRange = "*",
208-
sourcePortRanges": [],
209-
type = "Microsoft.Network/networkSecurityGroups/securityRules"
166+
name = "Microsoft.Sql-managedInstances_UseOnly_mi-strg-s-out-10-0-1-0-24-v11",
167+
description = "Allow outbound communication with storage over HTTPS",
168+
access = "Allow",
169+
direction = "Outbound",
170+
priority = 105,
171+
protocol = "*",
172+
provisioningState = "Succeeded",
173+
destinationAddressPrefix = "Storage.ukwest",
174+
destinationAddressPrefixes = [],
175+
destinationPortRange = "443",
176+
destinationPortRanges = [],
177+
sourceAddressPrefix = "10.0.1.0/24",
178+
sourceAddressPrefixes = [],
179+
sourcePortRange = "*",
180+
sourcePortRanges = []
210181
}
211182
security_rule {
212-
access = "Allow",
213-
description = "Allow AzureCloud outbound https traffic",
214-
destinationAddressPrefix = "AzureCloud",
215-
destinationAddressPrefixes": [],
216-
destinationPortRange = "443",
217-
destinationPortRanges": [],
218-
direction = "Outbound",
219-
etag = "W/\"ced64a9b-9b81-4d82-8a67-5e98052479e8\"",
220-
id = "/subscriptions/66516f71-f3d4-4911-b900-c6e4690a5b15/resourceGroups/LearningHub-MessageQueueProcessor-Dev/providers/Microsoft.Network/networkSecurityGroups/ManagedInstanceNSG/securityRules/Microsoft.Sql-managedInstances_UseOnly_mi-optional-azure-out-10-0-1-0-24",
221-
name = "Microsoft.Sql-managedInstances_UseOnly_mi-optional-azure-out-10-0-1-0-24",
222-
priority": 100,
223-
protocol = "Tcp",
224-
provisioningState = "Succeeded",
225-
resourceGroup = "LearningHub-MessageQueueProcessor-Dev",
226-
sourceAddressPrefix = "10.0.1.0/24",
227-
sourceAddressPrefixes": [],
228-
sourcePortRange = "*",
229-
sourcePortRanges": [],
230-
type = "Microsoft.Network/networkSecurityGroups/securityRules"
183+
name = "Microsoft.Sql-managedInstances_UseOnly_mi-optional-azure-out-10-0-1-0-24",
184+
description = "Allow AzureCloud outbound https traffic",
185+
access = "Allow",
186+
direction = "Outbound",
187+
priority = 100,
188+
protocol = "Tcp",
189+
destinationAddressPrefix = "AzureCloud",
190+
destinationAddressPrefixes = [],
191+
destinationPortRange = "443",
192+
destinationPortRanges = [],
193+
sourceAddressPrefix = "10.0.1.0/24",
194+
sourceAddressPrefixes = [],
195+
sourcePortRange = "*",
196+
sourcePortRanges = []
231197
}
232198
}
233199

0 commit comments

Comments
 (0)