具有策略规则收集循环的 Azure 防火墙

Question

我正在尝试部署启用了策略的 Azure 防火墙高级版，并且需要添加网络规则集合负载。

我在参数文件中有规则集合，需要循环遍历每个规则集合并将其添加到策略中。

"FirewallSettings": {
            "value": {
                "firewallPrefix": "efw",
                "numberOfPublicIPAddresses": 2,
                "threatIntelMode": "Deny",
                "networkRuleCollections": [
                    {
                        "name": "allowPing",
                        "priority": 200,
                        "type": "Allow",
                        "rules": [
                            {
                                "name": "Ping",
                                "protocols": [
                                    "ICMP"
                                ],
                                "sourceAddresses": [
                                    "*"
                                ],
                                "destinationAddresses": [
                                    "*"
                                ],
                                "sourceIpGroups": [],
                                "destinationIpGroups": [],
                                "destinationFqdns": [],
                                "destinationPorts": [
                                    "*"
                                ]
                            }
                        ]
                    },
                    {
                        "name": "allowEventHub",
                        "priority": 301,
                        "type": "Allow",
                        "rules": [
                            {
                                "name": "eventHubOut",
                                "protocols": [
                                    "TCP"
                                ],
                                "sourceAddresses": [
                                    "10.4.1.4"
                                ],
                                "destinationAddresses": [
                                    "*"
                                ],
                                "sourceIpGroups": [],
                                "destinationIpGroups": [],
                                "destinationFqdns": [],
                                "destinationPorts": [
                                    "*"
                                ]
                            }
                        ]
                    },
...

在我的模板中我正在尝试:

resource networkRules 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2021-08-01' = {
  name: 'firewallNetworkPolicies'
  parent: azureFirewallPolicy
  properties: {
    priority: 100
    ruleCollections: [for i in range(0, length(firewallSettings.networkRuleCollections)): {
      
        name: '${firewallSettings.networkRuleCollections[i].name}'
        priority: '${firewallSettings.networkRuleCollections[i].priority}'
        ruleCollectionType: 'NetworkRule'
        destinationAddresses: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationAddresses}'
        ]
        destinationFqdns: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationFqdns}'
        ]
        destinationIpGroups: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationIpGroups}'
        ]
        destinationPorts: [
          '${firewallSettings.networkRuleCollections[i].rules.destinationPorts}'
        ]
        ipProtocols: [
          '${firewallSettings.networkRuleCollections[i].rules.protocols}'
        ]
        sourceAddresses: [
          '${firewallSettings.networkRuleCollections[i].rules.sourceAddresses}'
        ]
        sourceIpGroups: [
          '${firewallSettings.networkRuleCollections[i].rules.sourceIpGroups}'
        ]
      }]
  }
}

但它抛出一个错误

语言表达式属性“destinationAddresses”具有无效的数组索引，我认为这是因为它需要一个 destinationAddresses 数组，但我无法计算出语法指定数组？

有什么想法吗？

Answer 1

这里有一些事情:

• networkRuleCollections 内的 rules 属性定义为数组。因此，您需要这样查询:${firewallSettings.networkRuleCollections[i].rules[0](假设只有一个规则)。

• 参数文件中定义的规则属性已经是数组(即:协议(protocol)、sourceAddresses ...)，因此您可以直接分配属性:destinationAddresses:firewallSettings.networkRuleCollections[i].rules[0].destinationAddresses。

基于您的参数文件的完整示例:

resource networkRules 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2021-08-01' = {
  name: 'firewallNetworkPolicies'
  parent: azureFirewallPolicy
  properties: {
    priority: 100
    ruleCollections: [for i in range(0, length(firewallSettings.networkRuleCollections)): {
      name: '${firewallSettings.networkRuleCollections[i].name}'
      priority: '${firewallSettings.networkRuleCollections[i].priority}'
      ruleCollectionType: 'NetworkRule'
      destinationAddresses: firewallSettings.networkRuleCollections[i].rules[0].destinationAddresses
      destinationFqdns: firewallSettings.networkRuleCollections[i].rules[0].destinationFqdns
      destinationIpGroups: firewallSettings.networkRuleCollections[i].rules[0].destinationIpGroups
      destinationPorts: firewallSettings.networkRuleCollections[i].rules[0].destinationPorts
      ipProtocols: firewallSettings.networkRuleCollections[i].rules[0].protocols
      sourceAddresses: firewallSettings.networkRuleCollections[i].rules[0].sourceAddresses
      sourceIpGroups: firewallSettings.networkRuleCollections[i].rules[0].sourceIpGroups
    }]
  }
}