Azure Web应用程序安全组访问

Question

我有一个 Azure Web 应用程序，我想限制对其 URL 的访问，并允许通过我的应用程序网关进行专门访问。其中一个选项是使用“访问限制”，但我想使用安全组来实现这一点，因为我有很多应用程序服务，这会给我更多的自由和自定义能力。

使用 terraform，我配置了应用程序网关、应用程序网关子网和应用程序服务网关，如下所示

resource "azurerm_virtual_network" "VNET" {
  address_space       = ["VNET-CIDR"]
  location            = var.location
  name                = "hri-prd-VNET"
  resource_group_name = azurerm_resource_group.rg-hri-prd-eur-app-gate.name
}

resource "azurerm_subnet" "app-gate" {
  name                 = "app-gateway-subnet"
  resource_group_name  = azurerm_resource_group.app-gate.name
  virtual_network_name = azurerm_virtual_network.VNET.name
  address_prefixes     = ["SUBNET-CIDR"]
}

resource "azurerm_subnet" "app-service" {
  name                 = "app-service-subnet"
  resource_group_name  = azurerm_resource_group.app-gate.name
  virtual_network_name = azurerm_virtual_network.hri-prd-VNET.name
  address_prefixes     = ["APP_CIDR"]
  delegation {
    name = "app-service-delegation"
    service_delegation {
      name    = "Microsoft.Web/serverFarms"
      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
    }
  }
}

在我的安全组中，我配置了映射，如下所示:

resource "azurerm_network_security_group" "app-service-sg" {
  location            = var.app-service-loc
  name                = "app-service-sg"
  resource_group_name = azurerm_resource_group.app-service.name
  security_rule {
    access = "Allow"
    direction = "Inbound"
    name = "application_gateway_access"
    priority = 100
    protocol = "Tcp"
    destination_port_range = "80"
    source_port_range = "*"
    source_address_prefixes = ["app-gate-CIDR"]
    destination_address_prefixes = ["app-service-CIDR"]

  }

}


resource "azurerm_subnet_network_security_group_association" "app-service-assoc" {
  network_security_group_id = azurerm_network_security_group.app-service-sg.id
  subnet_id                 = azurerm_subnet.app-service.id
}

配置在 terraform 上运行没有任何问题，但是当我直接点击 Web 应用程序 URL 时，我可以访问它。

现阶段我做错了什么？因为我希望只能通过我的应用程序网关访问 Web 应用程序 URL。

非常感谢大家的帮助

Answer 1

您刚刚创建了网络和安全组。您需要使用应用程序网关与服务端点集成

此外，您还需要进行进一步的配置。这是您的解决方案的外观图。

https://learn.microsoft.com/en-us/azure/app-service/networking/app-gateway-with-service-endpoints

使用 Terraform 代码创建应用服务并添加 IP 限制。 https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#ip_restriction

resource "azurerm_app_service_plan" "example" {
  name                = "example-app-service-plan"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku {
    tier = "Standard"
    size = "S1"
  }
}

resource "azurerm_app_service" "example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id
site_config {
    ip_restriction {
      ip_address  = "0.0.0.0"
    }
}

将应用服务链接到您的网络

resource "azurerm_app_service_virtual_network_swift_connection" "example" {
  app_service_id = azurerm_app_service.example.id
  subnet_id      = azurerm_subnet.app-service.id
}

使用服务端点创建访问限制。 https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#set-a-service-endpoint-based-rule