Network security group support for private endpoints subnet (Azure#333)

cds-snc · Aug 17, 2022 · 2a6042d · 2a6042d
1 parent e069a4b
commit 2a6042d
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 2 deletions.
diff --git a/landingzones/lz-healthcare/networking.bicep b/landingzones/lz-healthcare/networking.bicep
@@ -209,6 +209,14 @@ resource nsg 'Microsoft.Network/networkSecurityGroups@2021-02-01' = [for subnet
   }
 }]
 
+module nsgPrivateEndpoints '../../azresources/network/nsg/nsg-empty.bicep' = {
+  name: 'deploy-nsg-private-endpoints'
+  params: {
+    name: '${network.subnets.privateEndpoints.name}Nsg'
+    location: location
+  }
+}
+
 module nsgDatabricks '../../azresources/network/nsg/nsg-databricks.bicep' = {
   name: 'deploy-nsg-databricks'
   params: {
@@ -273,7 +281,10 @@ var requiredSubnets = [
     name: network.subnets.privateEndpoints.name
     properties: {
       addressPrefix: network.subnets.privateEndpoints.addressPrefix
-      privateEndpointNetworkPolicies: 'Disabled'
+      privateEndpointNetworkPolicies: 'Enabled'
+      networkSecurityGroup: {
+        id: nsgPrivateEndpoints.outputs.nsgId
+      }
       serviceEndpoints: [
         {
           service: 'Microsoft.Storage'

diff --git a/landingzones/lz-machinelearning/networking.bicep b/landingzones/lz-machinelearning/networking.bicep
@@ -230,6 +230,14 @@ resource nsg 'Microsoft.Network/networkSecurityGroups@2021-02-01' = [for subnet
   }
 }]
 
+module nsgPrivateEndpoints '../../azresources/network/nsg/nsg-empty.bicep' = {
+  name: 'deploy-nsg-private-endpoints'
+  params: {
+    name: '${network.subnets.privateEndpoints.name}Nsg'
+    location: location
+  }
+}
+
 module nsgDatabricks '../../azresources/network/nsg/nsg-databricks.bicep' = {
   name: 'deploy-nsg-databricks'
   params: {
@@ -310,7 +318,10 @@ var requiredSubnets = [
     name: network.subnets.privateEndpoints.name
     properties: {
       addressPrefix: network.subnets.privateEndpoints.addressPrefix
-      privateEndpointNetworkPolicies: 'Disabled'
+      privateEndpointNetworkPolicies: 'Enabled'
+      networkSecurityGroup: {
+        id: nsgPrivateEndpoints.outputs.nsgId
+      }
     }
   }
   {