Support azkms.core.windows.net and IPs in firewall allow list (#329)

Azure · Aug 8, 2022 · c2afa0d · c2afa0d
1 parent a7f521d
commit c2afa0d
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/landingzones/lz-platform-connectivity-hub-azfw/azfw-policy/azure-firewall-policy.bicep b/landingzones/lz-platform-connectivity-hub-azfw/azfw-policy/azure-firewall-policy.bicep
@@ -563,6 +563,8 @@ resource policy 'Microsoft.Network/firewallPolicies@2021-02-01' = {
               name: 'Azure Global - IP'
               destinationAddresses: [
                 '23.102.135.246'
+                '20.118.99.224' // see: https://azure.microsoft.com/en-us/updates/new-kms-dns-in-azure-global-cloud/
+                '40.83.235.53' // see: https://azure.microsoft.com/en-us/updates/new-kms-dns-in-azure-global-cloud/
               ]
               destinationPorts: [
                 '1688'
@@ -579,6 +581,7 @@ resource policy 'Microsoft.Network/firewallPolicies@2021-02-01' = {
               name: 'Azure Global - FQDN'
               destinationFqdns: [
                 'kms.core.windows.net'
+                'azkms.core.windows.net' // see: https://azure.microsoft.com/en-us/updates/new-kms-dns-in-azure-global-cloud/
               ]
               destinationPorts: [
                 '1688'