CODEWITHSUNDEEP
azureazure-rm-template
MMAdams
MMAdams

Reputation: 1498

Configure FirewallRules for all PossibleOutboundIpAddresses in ARM Template

I would like to create firewall rules so that only my Azure Web App can connect to my database. If possible, I'd like to do this in my ARM template. Here's what I have tried so far:

{
  "variables": {
    "defaultResourceName": "[resourceGroup().name]",
  },
  "resources": [
    {
      "type": "Microsoft.Web/sites/firewallRules",
      "name": "[concat('AllowAzureIpAddress', copyIndex()",
      "apiVersion": "2015-05-01-preview",
      "properties": {
        "startIpAddress": "[reference('Microsoft.Web/sites', variables('defaultResourceName')).possibleOutboundIpAddresses[copyIndex()]]",
        "endIpAddress": "[reference('Microsoft.Web/sites', variables('defaultResourceName')).possibleOutboundIpAddresses[copyIndex()]]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Sql/servers/', toLower(variables('defaultResourceName')))]"
      ],
      "copy": {
        "name": "firewallRuleCopy",
        "count": "[length(reference('Microsoft.Web/sites', variables('defaultResourceName')).possibleOutboundIpAddresses)]"
      }
    },
  ]
}

The main problem is getting the PossibleOutboundIpAddresses. I'm not sure if they're available to me here, and I'm getting an error when I try to validate my ARM Template that says The template function 'reference' is not expected at this location. Please see https://aka.ms/arm-template-expressions for usage details..

Has anyone done this that has any advice for how to go about getting those OutboundIpAddresses (preferably in a list so that copy can use them)?

Upvotes: 2

Views: 824

Answers (1)

4c74356b41
4c74356b41

Reputation: 72151

your problem comes not from using reference function in a wrong fashion, but from the fact that you cant use reference function in copy property (copy is evaluated at "compile time" whereas reference at runtime, so it cannot evaluate length of the copy). your possible work around is: nested deployment. here's what I've been using:

{
    "name": "firewallRules",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2015-01-01",
    "properties": {
        "mode": "Incremental",
        "templateLink": {
            "uri": "https://paste.ee/d/Hkebg/0",
            "contentVersion": "1.0.0.0"
        },
        "parameters": {
            "prefix": {
                "value": "[variables('prefix')]"
            },
            "iterator": {
                "value": "[split(reference(concat(parameters('prefix'), '-', parameters('webAppNames').name), '2016-03-01', 'Full').properties.possibleOutboundIpAddresses, ',')]"
            }
        }
    }
},

Upvotes: 2

Related Questions