output/20260723_081532/govviz/ALZ_20260723_081601/Enterprise-Scale/eslzArm/subscriptionTemplates/hubspoke-connectivity.json
|
{ "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "topLevelManagementGroupPrefix": { "type": "string", "maxLength": 10, "metadata": { "description": "Provide a prefix (max 10 characters, unique at tenant-scope) for the Management Group hierarchy and other resources created as part of Enterprise-scale." } }, "addressPrefix": { "type": "string", "metadata": { "displayName": "addressPrefix", "description": "Address prefix of the HUB" } }, "location": { "type": "string", "metadata": { "displayName": "location", "description": "Location of the HUB" }, "defaultValue": "[deployment().location]" }, "enableHub": { "type": "string", "allowedValues": [ "vhub", "No" ], "defaultValue": "No", "metadata": { "description": "Select whether the virtual network hub should be deployed or not." } }, "enableAzFw": { "type": "string", "allowedValues": [ "Yes", "No" ], "defaultValue": "No", "metadata": { "description": "Select whether the Azure Firewall should be deployed or not." } }, "enableAzFwDnsProxy": { "type": "string", "allowedValues": [ "Yes", "No" ], "defaultValue": "No", "metadata": { "description": "Select whether the Azure Firewall should be used as DNS Proxy or not." } }, "enableVpnGw": { "type": "string", "allowedValues": [ "Yes", "No" ], "defaultValue": "No", "metadata": { "description": "Select whether the VPN Gateway should be deployed or not." } }, "enableErGw": { "type": "string", "allowedValues": [ "Yes", "No" ], "defaultValue": "No", "metadata": { "description": "Select whether the ExpressRoute Gateway should be deployed or not." } }, "enableDdoS": { "type": "string", "defaultValue": "No", "allowedValues": [ "Yes", "No" ], "metadata": { "description": "Select whether the DDoS Network Protection should be enabled or not." } }, "connectivitySubscriptionId": { "type": "string", "defaultValue": "", "metadata": { "description": "Provide the subscription id for the dedicated connectivity subscription." } }, "subnetMaskForAzFw": { "type": "string", "defaultValue": "", "metadata": { "description": "Provide subnet for Azure Firewall." } }, "subnetMaskForAzFwMgmt": { "type": "string", "defaultValue": "", "metadata": { "description": "Provide subnet for Azure Firewall Management." } }, "subnetMaskForGw": { "type": "string", "defaultValue": "", "metadata": { "description": "Provide subnet for VPN/ER." } }, "firewallSku": { "type": "string", "allowedValues": [ "Basic", "Standard", "Premium" ], "defaultValue": "Standard" }, "firewallZones": { "type": "array", "defaultValue": [] }, "gwRegionalOrAz": { "type": "string", "defaultValue": "" }, "enableVpnActiveActive": { "type": "string", "defaultValue": "" }, "gwAzSku": { "type": "string", "defaultValue": "" }, "gwRegionalSku": { "type": "string", "defaultValue": "" }, "erRegionalOrAz": { "type": "string", "defaultValue": "" }, "erAzSku": { "type": "string", "defaultValue": "" }, "erRegionalSku": { "type": "string", "defaultValue": "" }, "ddosPlanResourceId": { "type": "string", "defaultValue": "" }, "vpnGwName": { "type": "string", "defaultValue": "[concat('vpng-', parameters('topLevelManagementGroupPrefix'), '-prod-', parameters('location'))]", "metadata": { "description": "Name for the VPN Gateway" } }, "erGwName": { "type": "string", "defaultValue": "[concat('ergw-', parameters('topLevelManagementGroupPrefix'), '-prod-', parameters('location'))]", "metadata": { "description": "Name for the ExpressRoute Gateway" } }, "rgName": { "type": "string", "defaultValue": "[concat('rg-', 'vnet-hub-prod-', parameters('location'))]", "metadata": { "description": "Name for the hub resource group" } }, "azFwPolicyName": { "type": "string", "defaultValue": "[concat('afwp-', parameters('topLevelManagementGroupPrefix'), '-prod-', parameters('location'))]", "metadata": { "description": "Name for the Azure Firewall Policy" } }, "hubName": { "type": "string", "defaultValue": "[concat('vnet-hub-', parameters('topLevelManagementGroupPrefix'), '-prod-', parameters('location'))]", "metadata": { "description": "Name for the hub virtual network" } }, "azFwName": { "type": "string", "defaultValue": "[concat('afw-', parameters('topLevelManagementGroupPrefix'), '-prod-', parameters('location'))]", "metadata": { "description": "Name for the Azure Firewall" } } }, "variables": { "azVpnGwIpName": "[concat('pip-', parameters('vpnGwName'), '-001')]", "azVpnGwAAIpName": "[concat('pip-', parameters('vpnGwName'), '-002')]", "azVpnGwSubnetId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'),'/providers/Microsoft.Network/virtualNetworks/', parameters('hubName'), '/subnets/GatewaySubnet')]", "azErGwIpName": "[concat('pip-', parameters('erGwName'))]", "azVpnGwPipId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'), '/providers/Microsoft.Network/publicIPAddresses/', variables('azVpnGwIpName'))]", "azVpnGwAAPipId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'), '/providers/Microsoft.Network/publicIPAddresses/', variables('azVpnGwAAIpName'))]", "azVpnPIPZones": "[split('1,2,3', ',')]", "azFwIpName": "[concat('pip-', parameters('azFwName'))]", "azFwMgmtIpName": "[concat('pip-', parameters('azFwName'), '-mgmt')]", "azErGwSubnetId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'),'/providers/Microsoft.Network/virtualNetworks/', parameters('hubName'), '/subnets/GatewaySubnet')]", "azErGwPipId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'), '/providers/Microsoft.Network/publicIPAddresses/', variables('azErGwIpName'))]", "azFwSubnetId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'),'/providers/Microsoft.Network/virtualNetworks/', parameters('hubName'), '/subnets/AzureFirewallSubnet')]", "azFwPipId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'), '/providers/Microsoft.Network/publicIPAddresses/', variables('azFwIpName'))]", "azFwMgmtSubnetId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'),'/providers/Microsoft.Network/virtualNetworks/', parameters('hubName'), '/subnets/AzureFirewallManagementSubnet')]", "azFwMgmtPipId": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'), '/providers/Microsoft.Network/publicIPAddresses/', variables('azFwMgmtIpName'))]", "azFwMgmtIpConfig": { "name": "[variables('azFwMgmtIpName')]", "properties": { "subnet": { "id": "[variables('azFwMgmtSubnetId')]" }, "publicIPAddress": { "id": "[variables('azFwMgmtPipId')]" } } }, "resourceDeploymentName": "[take(concat(deployment().name, '-hubspoke', parameters('location')), 64)]", // Creating variable that later will be used in conjunction with the union() function to cater for conditional subnet creation while ensuring idempotency "gwSubnet": [ { "name": "GatewaySubnet", "properties": { "addressPrefix": "[parameters('subnetMaskForGw')]" } } ], "fwSubnet": [ { "name": "AzureFirewallSubnet", "properties": { "addressPrefix": "[parameters('subnetMaskForAzFw')]" } } ], "fwMgmtSubnet": [ { "name": "AzureFirewallManagementSubnet", "properties": { "addressPrefix": "[parameters('subnetMaskForAzFwMgmt')]" } } ], "ddosProtectionPlanId": { "id": "[parameters('ddosPlanResourceId')]" }, "azFirewallPolicyId": { "id": "[concat('/subscriptions/', parameters('connectivitySubscriptionId'), '/resourceGroups/', parameters('rgName'), '/providers/Microsoft.Network/firewallPolicies/', parameters('azFwPolicyName'))]" }, "azFirewallDnsSettings": { "enableProxy": true } }, "resources": [ { // Conditionally deploy virtual network hub "condition": "[and(equals(parameters('enableHub'), 'vhub'), not(empty(parameters('connectivitySubscriptionId'))))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", "location": "[parameters('location')]", "name": "[concat('alz-', parameters('location'), '-', substring(uniqueString(parameters('connectivitySubscriptionId')),0,6), '-connectivityHubSub')]", "subscriptionId": "[parameters('connectivitySubscriptionId')]", "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [ { "type": "Microsoft.Resources/resourceGroups", "apiVersion": "2019-10-01", "location": "[parameters('location')]", "name": "[parameters('rgName')]", "properties": {} }, { "type": "Microsoft.Resources/deployments", "apiVersion": "2019-10-01", "name": "[variables('resourceDeploymentName')]", "resourceGroup": "[parameters('rgName')]", "dependsOn": [ "[concat('Microsoft.Resources/resourceGroups/', parameters('rgName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": {}, "resources": [ { "name": "[parameters('hubName')]", "type": "Microsoft.Network/virtualNetworks", "apiVersion": "2020-04-01", "location": "[parameters('location')]", "properties": { "addressSpace": { "addressPrefixes": [ "[parameters('addressPrefix')]" ] }, "subnets": "[ union( if( not( empty(parameters('subnetMaskForGw'))), variables('gwSubnet'), json('[]')), if( not( empty(parameters('subnetMaskForAzFw'))), variables('fwSubnet'), json('[]')), if( not( empty(parameters('subnetMaskForAzFwMgmt'))), variables('fwMgmtSubnet'), json('[]')))]", "enableDdosProtection": "[if(equals(parameters('enableDdoS'), 'Yes'), 'true', 'false')]", "ddosProtectionPlan": "[if(equals(parameters('enableDdoS'), 'Yes'), variables('ddosProtectionPlanId'), json('null'))]" } }, { "condition": "[and(equals(parameters('enableVpnGw'), 'Yes'), not(empty(parameters('subnetMaskForGw'))))]", "apiVersion": "2023-11-01", "type": "Microsoft.Network/publicIpAddresses", "location": "[parameters('location')]", "name": "[variables('azVpnGwIpName')]", "zones": "[if(equals(parameters('gwRegionalOrAz'), 'Zone'), variables('azVpnPIPZones'), json('null'))]", "sku": { "name": "Standard" }, "properties": { "publicIPAllocationMethod": "Static" } }, { "condition": "[and(equals(parameters('enableVpnGw'), 'Yes'), equals(parameters('enableVpnActiveActive'),'Yes'), not(empty(parameters('subnetMaskForGw'))))]", "apiVersion": "2023-11-01", "type": "Microsoft.Network/publicIpAddresses", "location": "[parameters('location')]", "name": "[variables('azVpnGwAAIpName')]", "zones": "[if(equals(parameters('gwRegionalOrAz'), 'Zone'), variables('azVpnPIPZones'), json('null'))]", "sku": { "name": "Standard" }, "properties": { "publicIPAllocationMethod": "Static" } }, { "condition": "[and(equals(parameters('enableVpnGw'), 'Yes'), equals(parameters('enableVpnActiveActive'),'No'), not(empty(parameters('subnetMaskForGw'))))]", "apiVersion": "2023-11-01", "name": "[parameters('vpnGwName')]", "type": "Microsoft.Network/virtualNetworkGateways", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/publicIPAddresses/', variables('azVpnGwIpName'))]", "[concat('Microsoft.Network/virtualNetworks/', parameters('hubName'))]" ], "properties": { "activeActive": false, "gatewayType": "Vpn", "vpnGatewayGeneration": "Generation2", "vpnType": "RouteBased", "ipConfigurations": [ { "name": "default", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('azVpnGwSubnetId')]" }, "publicIpAddress": { "id": "[variables('azVpnGwPipId')]" } } } ], "sku": { "name": "[if( and( or( empty(parameters('gwRegionalSku')), empty(parameters('gwAzSku'))), not( empty(parameters('gwRegionalSku')))), parameters('gwRegionalSku'), parameters('gwAzSku'))]", "tier": "[if( and( or( empty(parameters('gwRegionalSku')), empty(parameters('gwAzSku'))), not( empty(parameters('gwRegionalSku')))), parameters('gwRegionalSku'), parameters('gwAzSku'))]" } } }, { "condition": "[and(equals(parameters('enableVpnGw'), 'Yes'), equals(parameters('enableVpnActiveActive'),'Yes'), not(empty(parameters('subnetMaskForGw'))))]", "apiVersion": "2020-05-01", "name": "[parameters('vpnGwName')]", "type": "Microsoft.Network/virtualNetworkGateways", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/publicIPAddresses/', variables('azVpnGwIpName'))]", "[concat('Microsoft.Network/publicIPAddresses/', variables('azVpnGwAAIpName'))]", "[concat('Microsoft.Network/virtualNetworks/', parameters('hubName'))]" ], "properties": { "activeActive": true, "gatewayType": "Vpn", "vpnGatewayGeneration": "Generation2", "vpnType": "RouteBased", "ipConfigurations": [ { "name": "default", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('azVpnGwSubnetId')]" }, "publicIpAddress": { "id": "[variables('azVpnGwPipId')]" } } }, { "name": "activeactive", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('azVpnGwSubnetId')]" }, "publicIpAddress": { "id": "[variables('azVpnGwAAPipId')]" } } } ], "sku": { "name": "[if( and( or( empty(parameters('gwRegionalSku')), empty(parameters('gwAzSku'))), not( empty(parameters('gwRegionalSku')))), parameters('gwRegionalSku'), parameters('gwAzSku'))]", "tier": "[if( and( or( empty(parameters('gwRegionalSku')), empty(parameters('gwAzSku'))), not( empty(parameters('gwRegionalSku')))), parameters('gwRegionalSku'), parameters('gwAzSku'))]" } } }, { "condition": "[and(equals(parameters('enableErGw'), 'Yes'), not(empty(parameters('subnetMaskForGw'))))]", "apiVersion": "2020-05-01", "type": "Microsoft.Network/publicIpAddresses", "location": "[parameters('location')]", "name": "[variables('azErGwIpName')]", "sku": { "name": "Standard" }, "properties": { "publicIPAllocationMethod": "Static" } }, { "condition": "[and(equals(parameters('enableErGw'), 'Yes'), not(empty(parameters('subnetMaskForGw'))))]", "apiVersion": "2020-05-01", "name": "[parameters('erGwName')]", "type": "Microsoft.Network/virtualNetworkGateways", "location": "[parameters('location')]", "dependsOn": [ "[concat('Microsoft.Network/publicIPAddresses/', variables('azErGwIpName'))]", "[concat('Microsoft.Network/virtualNetworkGateways/', parameters('vpnGwName'))]", "[concat('Microsoft.Network/virtualNetworks/', parameters('hubName'))]" ], "properties": { "gatewayType": "ExpressRoute", "ipConfigurations": [ { "name": "default", "properties": { "privateIPAllocationMethod": "Dynamic", "subnet": { "id": "[variables('azErGwSubnetId')]" }, "publicIpAddress": { "id": "[variables('azErGwPipId')]" } } } ], "sku": { "name": "[if( and( or( empty(parameters('erRegionalSku')), empty(parameters('erAzSku'))), not( empty(parameters('erRegionalSku')))), parameters('erRegionalSku'), parameters('erAzSku'))]", "tier": "[if( and( or( empty(parameters('erRegionalSku')), empty(parameters('erAzSku'))), not( empty(parameters('erRegionalSku')))), parameters('erRegionalSku'), parameters('erAzSku'))]" } } }, { "condition": "[and(equals(parameters('enableAzFw'), 'Yes'), not(empty(parameters('subnetMaskForAzFw'))))]", "apiVersion": "2020-05-01", "type": "Microsoft.Network/publicIpAddresses", "name": "[variables('azFwIpName')]", "location": "[parameters('location')]", "sku": { "name": "Standard" }, "properties": { "publicIPAllocationMethod": "Static" } }, { "condition": "[and(equals(parameters('enableAzFw'), 'Yes'), not(empty(parameters('subnetMaskForAzFwMgmt'))))]", "apiVersion": "2020-05-01", "type": "Microsoft.Network/publicIpAddresses", "name": "[variables('azFwMgmtIpName')]", "location": "[parameters('location')]", "sku": { "name": "Standard" }, "properties": { "publicIPAllocationMethod": "Static" } }, { "condition": "[and(equals(parameters('enableAzFw'), 'Yes'), not(empty(parameters('subnetMaskForAzFw'))))]", "type": "Microsoft.Network/firewallPolicies", "apiVersion": "2020-11-01", "name": "[parameters('azFwPolicyName')]", "location": "[parameters('location')]", "properties": { "dnsSettings": "[if(equals(parameters('enableAzFwDnsProxy'), 'Yes'), variables('azFirewallDnsSettings'), json('null'))]", "sku": { "tier": "[parameters('firewallSku')]" } } }, { "condition": "[and(equals(parameters('enableAzFw'), 'Yes'), not(empty(parameters('subnetMaskForAzFw'))))]", "apiVersion": "2020-05-01", "type": "Microsoft.Network/azureFirewalls", "name": "[parameters('azfwname')]", "location": "[parameters('location')]", "zones": "[if(not(empty(parameters('firewallZones'))), parameters('firewallZones'), json('null'))]", "dependsOn": [ "[concat('Microsoft.Network/firewallPolicies/', parameters('azFwPolicyName'))]", "[concat('Microsoft.Network/publicIpAddresses/', variables('azFwIpName'))]", "[concat('Microsoft.Network/virtualNetworks/', parameters('hubName'))]", "[concat('Microsoft.Network/virtualNetworkGateways/', parameters('vpnGwName'))]", "[concat('Microsoft.Network/virtualNetworkGateways/', parameters('erGwName'))]" ], "properties": { "sku": { "name": "AZFW_VNet", "tier": "[parameters('firewallSku')]" }, "ipConfigurations": [ { "name": "[variables('azFwIpName')]", "properties": { "subnet": { "id": "[variables('azFwSubnetId')]" }, "publicIPAddress": { "id": "[variables('azFwPipId')]" } } } ], "managementIpConfiguration": "[variables('azFwMgmtIpConfig')]", "firewallPolicy": "[variables('azFirewallPolicyId')]" } } ] } } } ] } } } ], "outputs": {} } |