Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(azure): enable public access for azure monitor #1496

Merged
merged 3 commits into from
Nov 19, 2024
Merged

fix(azure): enable public access for azure monitor #1496

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cb6d029
fix(azure): enable public access for azure monitor
arealmaas Nov 19, 2024
6004343
cleanup
arealmaas Nov 19, 2024
6d6ead6
remove private endpointt
arealmaas Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions .azure/infrastructure/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,8 +131,6 @@ module monitorWorkspace '../modules/monitor-workspace/main.bicep' = {
params: {
namePrefix: namePrefix
location: location
subnetId: vnet.outputs.monitorSubnetId
vnetId: vnet.outputs.virtualNetworkId
tags: tags
}
}
Expand Down
58 changes: 2 additions & 56 deletions .azure/modules/monitor-workspace/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,72 +4,18 @@ param namePrefix string
@description('The location where the resources will be deployed')
param location string

@description('The ID of the subnet for the Private Link')
param subnetId string

@description('Tags to apply to resources')
param tags object

@description('The ID of the virtual network for the private DNS zone')
param vnetId string

resource monitorWorkspace 'Microsoft.Monitor/accounts@2023-04-03' = {
name: '${namePrefix}-monitor'
location: location
properties: {
publicNetworkAccess: 'Disabled'
// todo: enable once we have ensured a connection to this monitor workspace https://github.com/digdir/dialogporten/issues/1462
publicNetworkAccess: 'Enabled'
Comment on lines +14 to +15
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Security Impact: Document timeline for reverting public access

While this change addresses the immediate connectivity issue, enabling public network access increases the security risk. Please ensure this temporary solution is properly tracked and time-bound.

Consider:

  1. Adding a target date for reverting this change in the TODO comment
  2. Creating a separate tracking issue for implementing the permanent solution
  3. Adding monitoring alerts for unauthorized access attempts

Would you like me to help create a tracking issue for this?

}
tags: tags
}

// private endpoint name max characters is 80
var monitorPrivateEndpointName = '${namePrefix}-monitor-pe'

resource monitorPrivateEndpoint 'Microsoft.Network/privateEndpoints@2024-03-01' = {
name: monitorPrivateEndpointName
location: location
properties: {
privateLinkServiceConnections: [
{
name: monitorPrivateEndpointName
properties: {
privateLinkServiceId: monitorWorkspace.id
groupIds: [
'prometheusMetrics'
]
}
}
]
customNetworkInterfaceName: '${namePrefix}-monitor-pe-nic'
subnet: {
id: subnetId
}
}
tags: tags
}

module privateDnsZone '../privateDnsZone/main.bicep' = {
name: '${namePrefix}-monitor-pdz'
params: {
namePrefix: namePrefix
defaultDomain: 'privatelink.${location}.prometheus.monitor.azure.com'
vnetId: vnetId
tags: tags
}
}

module privateDnsZoneGroup '../privateDnsZoneGroup/main.bicep' = {
name: '${namePrefix}-monitor-privateDnsZoneGroup'
dependsOn: [
privateDnsZone
]
params: {
name: 'default'
dnsZoneGroupName: 'privatelink-${location}-prometheus-monitor-azure-com'
dnsZoneId: privateDnsZone.outputs.id
privateEndpointName: monitorPrivateEndpoint.name
}
}

output monitorWorkspaceId string = monitorWorkspace.id
output monitorWorkspaceName string = monitorWorkspace.name
Loading