Update azure-hub-spoke (#243)

* update rg name y moving to bicep * Azure DDoS Protection Standard should be enabled --------- Co-authored-by: Federico Arambarri <v-fearam> Co-authored-by: Jason Bouska <[email protected]>
mspnp · Nov 8, 2024 · 28e86c3 · 28e86c3
1 parent 03d1d62
commit 28e86c3
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 16 deletions.
diff --git a/solutions/azure-hub-spoke/README.md b/solutions/azure-hub-spoke/README.md
@@ -29,8 +29,13 @@ For detailed information, see the Azure Hub and Spoke reference architecture in
 
 Create a resource group for the deployment.
 
-```azurecli-interactive
-az group create --name hub-spoke --location eastus
+```bash
+LOCATION=eastus2
+RESOURCEGROUP_NAME=rg-hub-spoke-${LOCATION}
+
+az group create --name ${RESOURCEGROUP_NAME} --location ${LOCATION}
+
+curl -o main.bicep https://raw.githubusercontent.com/mspnp/samples/main/solutions/azure-hub-spoke/bicep/main.bicep
 ```
 
 > The location for the deployed resources defaults to the location used for the target resource group. This deployment uses availability zones for all resources that support it, as hub networks are usually business critical. This means  if the resource group's location does not support availability zones, you must provide an additional parameter to your chosen command below of `location=value` with a value supports availability zones. See [Azure regions with availability zones](https://learn.microsoft.com/azure/availability-zones/az-overview#azure-regions-with-availability-zones).
@@ -39,10 +44,10 @@ az group create --name hub-spoke --location eastus
 
 Run the following command to initiate the deployment. If you would like to also deploy this sample with virtual machines and / or an Azure VPN gateway, see the `az deployment group create` examples found later in this document.
 
-```azurecli-interactive
+```bash
 az deployment group create \
-    --resource-group hub-spoke \
-    --template-uri https://raw.githubusercontent.com/mspnp/samples/main/solutions/azure-hub-spoke/azuredeploy.json
+    --resource-group ${RESOURCEGROUP_NAME} \
+    --template-file main.bicep
 ```
 
 **Deploy with virtual machines**
@@ -52,21 +57,21 @@ Run the following command to initiate the deployment with a Linux VM deployed to
 | :warning: | This deploys these VMs with basic configuration, they are not Internet facing, but security should always be top of mind.  Please update the `adminUsername` and `adminPassword` to a value of your choosing. |
 |-----------|:--------------------------|
 
-```azurecli-interactive
+```bash
 az deployment group create \
-    --resource-group hub-spoke \
-    --template-uri https://raw.githubusercontent.com/mspnp/samples/main/solutions/azure-hub-spoke/azuredeploy.json \
+    --resource-group ${RESOURCEGROUP_NAME} \
+    --template-file main.bicep \
     --parameters deployVirtualMachines=true adminUsername=azureadmin adminPassword=Password2023!
 ```
 
 **Deploy with VPN gateway**
 
 Run the following command to initiate the deployment with a virtual network gateway deployed into the hub virtual network. Note, VPN gateways take a significant time to deploy.
 
-```azurecli-interactive
+```bash
 az deployment group create \
-    --resource-group hub-spoke \
-    --template-uri https://raw.githubusercontent.com/mspnp/samples/main/solutions/azure-hub-spoke/azuredeploy.json \
+    --resource-group ${RESOURCEGROUP_NAME} \
+    --template-file main.bicep \
     --parameters deployVpnGateway=true
 ```
 
@@ -77,10 +82,10 @@ Run the following command to initiate the deployment with a Linux VM deployed to
 | :warning: | This deploys these VMs with basic configuration, they are not Internet facing, but security should always be top of mind.  Please update the `adminUsername` and `adminPassword` to a value of your choosing. |
 |-----------|:--------------------------|
 
-```azurecli-interactive
+```bash
 az deployment group create \
-    --resource-group hub-spoke \
-    --template-uri https://raw.githubusercontent.com/mspnp/samples/main/solutions/azure-hub-spoke/azuredeploy.json \
+    --resource-group ${RESOURCEGROUP_NAME} \
+    --template-file main.bicep \
     --parameters deployVirtualMachines=true adminUsername=azureadmin adminPassword=Password2023! deployVpnGateway=true
 ```
 
@@ -106,9 +111,11 @@ The following resources are configured to send diagnostic logs to the included L
 
 Note, this deployment includes optional basic virtual machines. These are not configured with a Log Analytics workspace, however, can be with the Log Analytics virtual machine extension for [Windows](https://learn.microsoft.com/azure/virtual-machines/extensions/oms-windows) and [Linux](https://learn.microsoft.com/azure/virtual-machines/extensions/oms-linux).
 
-## Bicep implementation
+## Clean up
 
-The links above use JSON Azure Resource Manager (ARM) templates to support network referencing. The ARM templates were generated from the following [source bicep file](https://github.com/mspnp/samples/blob/main/solutions/azure-hub-spoke/bicep/main.bicep), which has additional comments and considerations.
+```bash
+az group delete --name ${RESOURCEGROUP_NAME} --yes
+```
 
 ## Microsoft Open Source Code of Conduct
 

diff --git a/solutions/azure-hub-spoke/bicep/main.bicep b/solutions/azure-hub-spoke/bicep/main.bicep
@@ -282,6 +282,12 @@ resource nsgBastionSubnet_diagnosticSettings 'Microsoft.Insights/diagnosticSetti
   }
 }
 
+// Azure DDoS Protection Standard should be enabled
+resource ddosProtectionPlan 'Microsoft.Network/ddosProtectionPlans@2021-05-01' = {
+  name: 'vnet-${location}-ddos'
+  location: location
+}
+
 @description('The regional hub network.')
 resource vnetHub 'Microsoft.Network/virtualNetworks@2023-04-01' = {
   name: 'vnet-${location}-hub'
@@ -315,6 +321,10 @@ resource vnetHub 'Microsoft.Network/virtualNetworks@2023-04-01' = {
         }
       }
     ]
+    enableDdosProtection: true
+    ddosProtectionPlan: {
+      id: ddosProtectionPlan.id
+    }
   }
 
   resource azureBastionSubnet 'subnets' existing = {
@@ -955,6 +965,10 @@ resource vnetSpokeOne 'Microsoft.Network/virtualNetworks@2023-04-01' = {
         }
       }
     ]
+    enableDdosProtection: true
+    ddosProtectionPlan: {
+      id: ddosProtectionPlan.id
+    }
   }
 
   resource snetResources 'subnets' existing = {
@@ -1127,6 +1141,10 @@ resource vnetSpokeTwo 'Microsoft.Network/virtualNetworks@2023-04-01' = {
         }
       }
     ]
+    enableDdosProtection: true
+    ddosProtectionPlan: {
+      id: ddosProtectionPlan.id
+    }
   }
 
   resource snetResources 'subnets' existing = {