search

Azure / ALZ-Bicep

This repository contains the Azure Landing Zones (ALZ) Bicep modules that help deliver and deploy the Azure Landing Zone conceptual architecture in a modular approach. https://aka.ms/alz/docs
MIT License
734 stars 490 forks source link

Regional Azure Firewall Policies #750

Closed DavidLHannah closed 1 week ago

DavidLHannah commented 3 months ago

Describe the feature end to end, including deployment scenario details under which the feature would occur.

When using the vwanConnectivity module to deploy multiple regional Virtual Hubs with Azure Firewall, only a single Azure Firewall Policy is deployed. This single policy is applied to all of the vHubs that are deployed. This means the firewall configurations will be the same in all regions.

In order to account for potential regional-specific configurations, support for multiple Azure Firewall Policies may be required.

Why is this feature important. Describe why this would be important for your organization and others. Would this impact similar orgs in the same way?

If we are properly designing for regional failover of resources with Private Endpoints, then we will also implement regional Azure Private DNS Resolvers. Refer here for further details: https://github.com/adstuart/azure-privatelink-multiregion

Considering this, the need will arise for providing unique DNS Proxy configurations on the Azure Firewall in each region where a Azure Private DNS Resolver is deployed.

Potentially related to #375 & #387

Feature Implementation

An Azure Firewall Policy resource should be created and applied to each Azure Firewall that is deployed in a region.

The parAzFirewallDnsServers parameter could be moved to part of the parVirtualWanHubs parameter, such that each hub may be associated with specific regional DNS resolvers.

Potentially deploy additional firewall policy that could act as the Parent Policy to all other policies deployed in the vWAN.

Check previous GitHub issues

Code of Conduct

oZakari commented 3 months ago

Hi @DavidLHannah, this a good call out! As you noted, this would be related to the multi-region issues you referenced. Although, multi-region is on our all-up ALZ backlog this is something that is still in the early phases of investigation.

Will add this to the ALZ-Backlog as a long-term goal.