Skip to content

Commit 39d3dcc

Browse files
ferantiverockittel
andauthored
topic (orchestrator): [fw] add production readiness note for fw rules (#52)
Co-authored-by: Chad Kittel <chad.kittel@gmail.com>
1 parent 1d2df0d commit 39d3dcc

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

infra-as-code/bicep/azure-firewall.bicep

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ resource azureFirewallPolicy 'Microsoft.Network/firewallPolicies@2024-05-01' = {
111111
name: 'allow-dependencies'
112112
ipProtocols: ['Any']
113113
sourceAddresses: ['${virtualNetwork::jumpBoxesSubnet.properties.addressPrefix}']
114-
destinationAddresses: ['*']
114+
destinationAddresses: ['*'] // Production readiness change: tighten destination address to ensure egress traffic is restricted to the minimal required spaces.
115115
destinationPorts: ['*']
116116
}
117117
]
@@ -120,7 +120,8 @@ resource azureFirewallPolicy 'Microsoft.Network/firewallPolicies@2024-05-01' = {
120120
}
121121
}
122122

123-
@description('Add rules for the Azure AI agent egress and jump boxes subnets. Extend to support other subnets as needed.')
123+
@descriptiou('Add rules for the Azure AI agent egress and jump boxes subnets. Extend to support other subnets as needed.')
124+
124125
resource applicationRules 'ruleCollectionGroups' = {
125126
name: 'DefaultApplicationRuleCollectionGroup'
126127
properties: {
@@ -145,7 +146,10 @@ resource azureFirewallPolicy 'Microsoft.Network/firewallPolicies@2024-05-01' = {
145146
]
146147
fqdnTags: []
147148
webCategories: []
148-
targetFqdns: ['*']
149+
targetFqdns: [
150+
'*'
151+
// 'api.bing.microsoft.com' // Production readiness change: refine your target FQDNs to restrict egress traffic exclusively to the external services and endpoints your agent depends on. For instance this fqnd scopes access specifically to Grounding with Bing.
152+
]
149153
targetUrls: []
150154
terminateTLS: false
151155
sourceAddresses: ['${virtualNetwork::agentsEgressSubnet.properties.addressPrefix}']
@@ -177,7 +181,7 @@ resource azureFirewallPolicy 'Microsoft.Network/firewallPolicies@2024-05-01' = {
177181
]
178182
fqdnTags: []
179183
webCategories: []
180-
targetFqdns: ['*']
184+
targetFqdns: ['*'] // Production readiness change: specify target FQDNs to ensure only approved resources can be accessed from your jumpbox.
181185
targetUrls: []
182186
terminateTLS: false
183187
sourceAddresses: ['${virtualNetwork::jumpBoxesSubnet.properties.addressPrefix}']
@@ -228,7 +232,6 @@ resource azureFirewall 'Microsoft.Network/azureFirewalls@2024-05-01' = {
228232
id: virtualNetwork::firewall.id
229233
}
230234
}
231-
232235
}
233236
]
234237
firewallPolicy: {

0 commit comments

Comments
 (0)