Add network rule to whitelist GitHub

Azure · Oct 4, 2023 · dbfe56e · dbfe56e
1 parent 0481461
commit dbfe56e
Show file tree

Hide file tree

Showing 2 changed files with 42 additions and 2 deletions.
diff --git a/workload/arm/deploy-baseline.json b/workload/arm/deploy-baseline.json
@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.21.1.54444",
-      "templateHash": "2710012389240087448"
+      "templateHash": "15466667802386589012"
     },
     "name": "AVD Accelerator - Baseline Deployment",
     "description": "AVD Accelerator - Deployment Baseline"
@@ -8399,7 +8399,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.21.1.54444",
-              "templateHash": "744206307789280632"
+              "templateHash": "11738074428347052620"
             }
           },
           "parameters": {
@@ -13757,6 +13757,26 @@
                             "destinationPorts": [
                               "443"
                             ]
+                          },
+                          {
+                            "ruleType": "NetworkRule",
+                            "name": "GitHub",
+                            "ipProtocols": [
+                              "TCP"
+                            ],
+                            "sourceAddresses": [
+                              "[parameters('vnetAvdSubnetAddressPrefix')]"
+                            ],
+                            "sourceIpGroups": [],
+                            "destinationAddresses": [],
+                            "destinationIpGroups": [],
+                            "destinationFqdns": [
+                              "github.com",
+                              "raw.githubusercontent.com"
+                            ],
+                            "destinationPorts": [
+                              "443"
+                            ]
                           }
                         ]
                       },

diff --git a/workload/bicep/modules/networking/deploy.bicep b/workload/bicep/modules/networking/deploy.bicep
@@ -725,6 +725,26 @@ module firewallPolicyOptionalRuleCollectionGroup '../../../../carml/1.3.0/Micros
                             '443'
                         ]
                     }
+                    {
+                        ruleType: 'NetworkRule'
+                        name: 'GitHub'
+                        ipProtocols: [
+                            'TCP'
+                        ]
+                        sourceAddresses: [
+                            vnetAvdSubnetAddressPrefix
+                        ]
+                        sourceIpGroups: []
+                        destinationAddresses: []
+                        destinationIpGroups: []
+                        destinationFqdns: [
+                            'github.com'
+                            'raw.githubusercontent.com'
+                        ]
+                        destinationPorts: [
+                            '443'
+                        ]
+                    }
                 ]
             }
             {