Criando as regras do Azure API Manager no Network Security Group com Powershell

Olá,

Recentemente precisei configurar um API Gateway no Azure e nesse deployment, o serviço era provisionado em uma Virtual Network. Para que os serviços comuniquem corretamente, há uma série de regras a serem configuradas no Network Security Group aplicado a subnet onde foi criado o serviço. Essas regras estão documentadas aqui, e precisariam ser criadas em cada Network Security Group de cada deployment feito. Resolvi então fazer um script para facilitar o processo.

Primeiro precisamos retornar o Network Security Group que vamos alterar:

$NetworkSecurityGroup = Get-AzureRmNetworkSecurityGroup -Name 'az-nsg-apimanagement' -ResourceGroupName 'az-rg-nsg'

Em seguida, vamos definir o CSV com a lista de regras que serão criadas:

$Rules = @"
"Name","Priority","Direction","Access","SourcePrefix","SourcePortRange","DestinationPrefix","DestinationPortRange","Protocol","Description"
"allow_inbound_internet_80_443_vnet","1000","Inbound","Allow","Internet","*","VirtualNetwork","80,443","Tcp","Client communication to API Management"
"allow_inbound_internet_3443_vnet","1010","Inbound","Allow","ApiManagement","*","VirtualNetwork","3443","Tcp","Management endpoint for Azure portal and Powershell"
"allow_outbound_vnet_80_443_storage","1000","Outbound","Allow","VirtualNetwork","*","Storage","80,443","Tcp","Dependency on Azure Storage"
"allow_outbound_vnet_80_443_azuread","1010","Outbound","Allow","VirtualNetwork","*","AzureActiveDirectory","80,443","Tcp","Azure Active Directory"
"allow_outbound_vnet_1433_azuresql","1020","Outbound","Allow","VirtualNetwork","*","SQL","1433","Tcp","Access to Azure SQL endpoints"
"allow_outbound_vnet_5672_eventhub","1030","Outbound","Allow","VirtualNetwork","*","EventHub","5672","Tcp","Dependency for Log to Event Hub policy and monitoring agent"
"allow_outbound_vnet_445_storage","1040","Outbound","Allow","VirtualNetwork","*","Storage","445","Tcp","Dependency on Azure File Share for GIT"
"allow_outbound_vnet_1886_internet","1050","Outbound","Allow","VirtualNetwork","*","Internet","1886","Tcp","Needed to publish Health status to Resource Health"
"allow_outbound_vnet_443_azuremonitor","1060","Outbound","Allow","VirtualNetwork","*","AzureMonitor","443","Tcp","Publish Diagnostics Logs and Metrics"
"allow_outbound_vnet_25_internet","1070","Outbound","Allow","VirtualNetwork","*","Internet","25","Tcp","Connect to SMTP Relay for sending e-mails"
"allow_outbound_vnet_587_internet","1080","Outbound","Allow","VirtualNetwork","*","Internet","587","Tcp","Connect to SMTP Relay for sending e-mails"
"allow_outbound_vnet_25028_internet","1090","Outbound","Allow","VirtualNetwork","*","Internet","25028","Tcp","Connect to SMTP Relay for sending e-mails"
"allow_outbound_vnet_6381-6383_vnet","1100","Outbound","Allow","VirtualNetwork","*","VirtualNetwork","6381-6383","Tcp","Access Azure Cache for Redis Instances between RoleInstances"
"allow_inbound_vnet_6381-6383_vnet","1020","Inbound","Allow","VirtualNetwork","*","VirtualNetwork","6381-6383","Tcp","Access Azure Cache for Redis Instances between RoleInstances"
"allow_inbound_azurelb_all_vnet","1030","Inbound","Allow","AzureLoadBalancer","*","VirtualNetwork","*","Tcp","Azure Infrastructure Load Balancer"
"@

Agora vamos converter o CSV em Objeto e com um laço foreach acrescentar as novas regras ao Network Security Group com o comando Add-AzureRmNetworkSecurityRuleConfig:

ConvertFrom-CSV -InputObject $Rules | ForEach-Object -Process {
    $AzureRmNetworkSecurityRuleConfig = @{
        NetworkSecurityGroup     = $NetworkSecurityGroup
        Name                     = $PSItem.Name
        Priority                 = $PSItem.Priority
        Access                   = $PSItem.Access
        Direction                = $PSItem.Direction
        SourceAddressPrefix      = $PSItem.SourcePrefix
        SourcePortRange          = $PSItem.SourcePortRange -Split ','
        DestinationAddressPrefix = $PSItem.DestinationPrefix
        DestinationPortRange     = $PSItem.DestinationPortRange -Split ','
        Protocol                 = $PSItem.Protocol
        Description              = $PSItem.Description
        Verbose                  = $true
    }
    Add-AzureRmNetworkSecurityRuleConfig @AzureRmNetworkSecurityRuleConfig
}

e por fim com o comando Set-AzureRmNetworkSecurityGroup vamos aplicar as mudanças ao objeto:

Set-AzureRmNetworkSecurityGroup -NetworkSecurityGroup $NetworkSecurityGroup

Juntando tudo temos o script completo assim:

$NetworkSecurityGroup = Get-AzureRmNetworkSecurityGroup -Name 'az-nsg-apimanagement' -ResourceGroupName 'az-rg-nsg'

$Rules = @"
"Name","Priority","Direction","Access","SourcePrefix","SourcePortRange","DestinationPrefix","DestinationPortRange","Protocol","Description"
"allow_inbound_internet_80_443_vnet","1000","Inbound","Allow","Internet","*","VirtualNetwork","80,443","Tcp","Client communication to API Management"
"allow_inbound_internet_3443_vnet","1010","Inbound","Allow","ApiManagement","*","VirtualNetwork","3443","Tcp","Management endpoint for Azure portal and Powershell"
"allow_outbound_vnet_80_443_storage","1000","Outbound","Allow","VirtualNetwork","*","Storage","80,443","Tcp","Dependency on Azure Storage"
"allow_outbound_vnet_80_443_azuread","1010","Outbound","Allow","VirtualNetwork","*","AzureActiveDirectory","80,443","Tcp","Azure Active Directory"
"allow_outbound_vnet_1433_azuresql","1020","Outbound","Allow","VirtualNetwork","*","SQL","1433","Tcp","Access to Azure SQL endpoints"
"allow_outbound_vnet_5672_eventhub","1030","Outbound","Allow","VirtualNetwork","*","EventHub","5672","Tcp","Dependency for Log to Event Hub policy and monitoring agent"
"allow_outbound_vnet_445_storage","1040","Outbound","Allow","VirtualNetwork","*","Storage","445","Tcp","Dependency on Azure File Share for GIT"
"allow_outbound_vnet_1886_internet","1050","Outbound","Allow","VirtualNetwork","*","Internet","1886","Tcp","Needed to publish Health status to Resource Health"
"allow_outbound_vnet_443_azuremonitor","1060","Outbound","Allow","VirtualNetwork","*","AzureMonitor","443","Tcp","Publish Diagnostics Logs and Metrics"
"allow_outbound_vnet_25_internet","1070","Outbound","Allow","VirtualNetwork","*","Internet","25","Tcp","Connect to SMTP Relay for sending e-mails"
"allow_outbound_vnet_587_internet","1080","Outbound","Allow","VirtualNetwork","*","Internet","587","Tcp","Connect to SMTP Relay for sending e-mails"
"allow_outbound_vnet_25028_internet","1090","Outbound","Allow","VirtualNetwork","*","Internet","25028","Tcp","Connect to SMTP Relay for sending e-mails"
"allow_outbound_vnet_6381-6383_vnet","1100","Outbound","Allow","VirtualNetwork","*","VirtualNetwork","6381-6383","Tcp","Access Azure Cache for Redis Instances between RoleInstances"
"allow_inbound_vnet_6381-6383_vnet","1020","Inbound","Allow","VirtualNetwork","*","VirtualNetwork","6381-6383","Tcp","Access Azure Cache for Redis Instances between RoleInstances"
"allow_inbound_azurelb_all_vnet","1030","Inbound","Allow","AzureLoadBalancer","*","VirtualNetwork","*","Tcp","Azure Infrastructure Load Balancer"
"@

ConvertFrom-CSV -InputObject $Rules | ForEach-Object -Process {
    $AzureRmNetworkSecurityRuleConfig = @{
        NetworkSecurityGroup     = $NetworkSecurityGroup
        Name                     = $PSItem.Name
        Priority                 = $PSItem.Priority
        Access                   = $PSItem.Access
        Direction                = $PSItem.Direction
        SourceAddressPrefix      = $PSItem.SourcePrefix
        SourcePortRange          = $PSItem.SourcePortRange -Split ','
        DestinationAddressPrefix = $PSItem.DestinationPrefix
        DestinationPortRange     = $PSItem.DestinationPortRange -Split ','
        Protocol                 = $PSItem.Protocol
        Description              = $PSItem.Description
        Verbose                  = $true
    }
    Add-AzureRmNetworkSecurityRuleConfig @AzureRmNetworkSecurityRuleConfig
}
Set-AzureRmNetworkSecurityGroup -NetworkSecurityGroup $NetworkSecurityGroup

Espero que tenha aprendido a não apenas acrescentar as regras do Azure API Gateway a um Network Security Group, mas tambem como fazer o processo em Lote para quaisquer regras que precise aplicar.

Dúvidas? Sugestões? Comente!

Até a próxima!