Skip to content

Commit face4e2

Browse files
BernieWhiteBernieWhite
authored
Fixed documentation bugs for container apps Azure#2876 (Azure#2943)
1 parent 4f2e969 commit face4e2

5 files changed

+118
-43
lines changed

‎docs/CHANGELOG-v1.md

+2
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ What's changed since pre-release v1.38.0-B0011:
4343
[#2935](https://github.com/Azure/PSRule.Rules.Azure/issues/2935)
4444
- Fixed identification of `list*` function false positive with resource by @BernieWhite.
4545
[#2919](https://github.com/Azure/PSRule.Rules.Azure/issues/2919)
46+
- Fixed documentation bugs for container apps by @BernieWhite.
47+
[#2876](https://github.com/Azure/PSRule.Rules.Azure/issues/2876)
4648

4749
## v1.38.0-B0011 (pre-release)
4850

‎docs/en/rules/Azure.ContainerApp.PublicAccess.md

+44-16
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
---
2+
reviewed: 2024-06-18
23
severity: Important
34
pillar: Security
45
category: SE:06 Network controls
@@ -23,11 +24,15 @@ Disable public network access to improve security by exposing the Container Apps
2324

2425
This removes the need for a public IP address and prevents internet access to all Container Apps within the environment.
2526

26-
To provide secure access, instead consider using an Application Gateway or Azure Front Door premium in front of your Container Apps on your private VNET.
27+
To provide secure access externally, instead consider using:
28+
29+
- An Application Gateway in front of your Container Apps using your private VNET.
30+
- A Azure Front Door premium profile with private link to your Container Apps.
31+
This currently only applies to Container Apps using consumption without workload profiles.
2732

2833
## RECOMMENDATION
2934

30-
Consider disabling public network access.
35+
Consider disabling public network access by deploying an internal-only container apps to reduce the attack surface.
3136

3237
## EXAMPLES
3338

@@ -42,18 +47,28 @@ For example:
4247

4348
```json
4449
{
45-
"type": "Microsoft.App/containerApps",
46-
"apiVersion": "2022-10-01",
50+
"type": "Microsoft.App/managedEnvironments",
51+
"apiVersion": "2024-03-01",
4752
"name": "[parameters('envName')]",
4853
"location": "[parameters('location')]",
4954
"properties": {
55+
"appLogsConfiguration": {
56+
"destination": "log-analytics",
57+
"logAnalyticsConfiguration": {
58+
"customerId": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceId')), '2022-10-01').customerId]",
59+
"sharedKey": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceId')), '2022-10-01').primarySharedKey]"
60+
}
61+
},
62+
"zoneRedundant": true,
63+
"workloadProfiles": [
64+
{
65+
"name": "Consumption",
66+
"workloadProfileType": "Consumption"
67+
}
68+
],
5069
"vnetConfiguration": {
51-
"dockerBridgeCidr": "[parameters('dockerBridgeCidr')]",
52-
"infrastructureSubnetId": "[parameters('infrastructureSubnetId')]",
53-
"internal": true,
54-
"outboundSettings": {},
55-
"platformReservedCidr": "[parameters('platformReservedCidr')]",
56-
"platformReservedDnsIP": "[parameters('platformReservedDnsIP')]",
70+
"infrastructureSubnetId": "[parameters('subnetId')]",
71+
"internal": true
5772
}
5873
}
5974
}
@@ -69,24 +84,37 @@ To deploy Container Apps environments that pass this rule:
6984
For example:
7085

7186
```bicep
72-
resource containerAppEnv 'Microsoft.App/managedEnvironments@2022-10-01' = {
87+
resource containerEnv 'Microsoft.App/managedEnvironments@2024-03-01' = {
7388
name: envName
7489
location: location
7590
properties: {
91+
appLogsConfiguration: {
92+
destination: 'log-analytics'
93+
logAnalyticsConfiguration: {
94+
customerId: workspace.properties.customerId
95+
sharedKey: workspace.listKeys().primarySharedKey
96+
}
97+
}
98+
zoneRedundant: true
99+
workloadProfiles: [
100+
{
101+
name: 'Consumption'
102+
workloadProfileType: 'Consumption'
103+
}
104+
]
76105
vnetConfiguration: {
77-
dockerBridgeCidr: dockerBridgeCidr
78-
infrastructureSubnetId: infrastructureSubnetId
106+
infrastructureSubnetId: subnetId
79107
internal: true
80-
outboundSettings: {}
81-
platformReservedCidr: platformReservedCidr
82-
platformReservedDnsIP: platformReservedDnsIP
83108
}
84109
}
85110
}
86111
```
87112

113+
<!-- external:avm avm/res/app/managed-environment infrastructureSubnetId,internal -->
114+
88115
## LINKS
89116

90117
- [SE:06 Network controls](https://learn.microsoft.com/azure/well-architected/security/networking)
118+
- [NS-2: Secure cloud services with network controls](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-container-apps-security-baseline)
91119
- [Networking in Azure Container Apps environment](https://learn.microsoft.com/azure/container-apps/networking)
92120
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/managedenvironments#vnetconfiguration)

‎docs/en/rules/Azure.ContainerApp.RestrictIngress.md

+38-21
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
---
2+
reviewed: 2024-06-18
23
severity: Important
34
pillar: Security
45
category: SE:06 Network controls
@@ -44,39 +45,47 @@ For example:
4445
```json
4546
{
4647
"type": "Microsoft.App/containerApps",
47-
"apiVersion": "2022-11-01-preview",
48+
"apiVersion": "2024-03-01",
4849
"name": "[parameters('appName')]",
4950
"location": "[parameters('location')]",
5051
"identity": {
51-
"type": "SystemAssigned",
52-
"userAssignedIdentities": {}
52+
"type": "SystemAssigned"
5353
},
5454
"properties": {
55-
"environmentId": "[parameters('environmentId')]",
55+
"environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]",
5656
"template": {
57-
"revisionSuffix": "",
58-
"containers": "[variables('containers')]"
57+
"revisionSuffix": "[parameters('revision')]",
58+
"containers": "[variables('containers')]",
59+
"scale": {
60+
"minReplicas": 2
61+
}
5962
},
6063
"configuration": {
6164
"ingress": {
62-
"external": false,
65+
"allowInsecure": false,
6366
"ipSecurityRestrictions": [
6467
{
6568
"action": "Allow",
66-
"description": "ClientIPAddress_1",
69+
"description": "Allowed IP address range",
6770
"ipAddressRange": "10.1.1.1/32",
6871
"name": "ClientIPAddress_1"
6972
},
7073
{
7174
"action": "Allow",
72-
"description": "ClientIPAddress_2",
75+
"description": "Allowed IP address range",
7376
"ipAddressRange": "10.1.2.1/32",
7477
"name": "ClientIPAddress_2"
7578
}
76-
]
79+
],
80+
"stickySessions": {
81+
"affinity": "none"
82+
}
7783
}
7884
}
79-
}
85+
},
86+
"dependsOn": [
87+
"[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]"
88+
]
8089
}
8190
```
8291

@@ -90,53 +99,61 @@ To deploy Container Apps that pass this rule:
9099
For example:
91100

92101
```bicep
93-
resource containerApp 'Microsoft.App/containerApps@2022-11-01-preview' = {
102+
resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
94103
name: appName
95104
location: location
96105
identity: {
97106
type: 'SystemAssigned'
98-
userAssignedIdentities: {}
99107
}
100-
properties: {
101-
environmentId: environmentId
108+
properties: {
109+
environmentId: containerEnv.id
102110
template: {
103-
revisionSuffix: ''
111+
revisionSuffix: revision
104112
containers: containers
113+
scale: {
114+
minReplicas: 2
115+
}
105116
}
106117
configuration: {
107118
ingress: {
108-
external: false
119+
allowInsecure: false
109120
ipSecurityRestrictions: [
110121
{
111122
action: 'Allow'
112-
description: 'ClientIPAddress_1'
123+
description: 'Allowed IP address range'
113124
ipAddressRange: '10.1.1.1/32'
114125
name: 'ClientIPAddress_1'
115126
}
116127
{
117128
action: 'Allow'
118-
description: 'ClientIPAddress_2'
129+
description: 'Allowed IP address range'
119130
ipAddressRange: '10.1.2.1/32'
120131
name: 'ClientIPAddress_2'
121132
}
122133
]
134+
stickySessions: {
135+
affinity: 'none'
136+
}
123137
}
124138
}
125139
}
126140
}
127141
```
128142

143+
<!-- external:avm avm/res/app/container-app ipSecurityRestrictions -->
144+
129145
## NOTES
130146

131-
All rules must be the same type. It is not supported to combine allow rules and deny rules.
147+
All rules must be the same type.
148+
It is not supported to combine allow rules and deny rules.
132149
If no rules are defined at all, the rule will not pass as it expects at least one allow rule to be configured.
133150

134151
## LINKS
135152

136153
- [SE:06 Network controls](https://learn.microsoft.com/azure/well-architected/security/networking)
154+
- [NS-2: Secure cloud services with network controls](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-container-apps-security-baseline#ns-2-secure-cloud-services-with-network-controls)
137155
- [Networking in Azure Container Apps environment](https://learn.microsoft.com/azure/container-apps/networking)
138156
- [IP restrictions](https://learn.microsoft.com/azure/container-apps/ingress-overview#ip-restrictions)
139157
- [Set up IP ingress restrictions in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/ip-restrictions)
140158
- [Azure security baseline for Azure Container Apps](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-container-apps-security-baseline)
141-
- [NS-2: Secure cloud services with network controls](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-container-apps-security-baseline#ns-2-secure-cloud-services-with-network-controls)
142159
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/containerapps#ipsecurityrestrictionrule)

‎docs/examples-containerapp.bicep

+16-2
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ var containers = [
3939
]
4040

4141
// An example App Environment configured with a consumption workload profile.
42-
resource containerEnv 'Microsoft.App/managedEnvironments@2023-05-01' = {
42+
resource containerEnv 'Microsoft.App/managedEnvironments@2024-03-01' = {
4343
name: envName
4444
location: location
4545
properties: {
@@ -65,7 +65,7 @@ resource containerEnv 'Microsoft.App/managedEnvironments@2023-05-01' = {
6565
}
6666

6767
// An example Container App using a minimum of 2 replicas.
68-
resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
68+
resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
6969
name: appName
7070
location: location
7171
identity: {
@@ -83,6 +83,20 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
8383
configuration: {
8484
ingress: {
8585
allowInsecure: false
86+
ipSecurityRestrictions: [
87+
{
88+
action: 'Allow'
89+
description: 'Allowed IP address range'
90+
ipAddressRange: '10.1.1.1/32'
91+
name: 'ClientIPAddress_1'
92+
}
93+
{
94+
action: 'Allow'
95+
description: 'Allowed IP address range'
96+
ipAddressRange: '10.1.2.1/32'
97+
name: 'ClientIPAddress_2'
98+
}
99+
]
86100
stickySessions: {
87101
affinity: 'none'
88102
}

‎docs/examples-containerapp.json

+18-4
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
"metadata": {
55
"_generator": {
66
"name": "bicep",
7-
"version": "0.26.54.24096",
8-
"templateHash": "3735352956667233547"
7+
"version": "0.28.1.47646",
8+
"templateHash": "3152038712307898231"
99
}
1010
},
1111
"parameters": {
@@ -64,7 +64,7 @@
6464
"resources": [
6565
{
6666
"type": "Microsoft.App/managedEnvironments",
67-
"apiVersion": "2023-05-01",
67+
"apiVersion": "2024-03-01",
6868
"name": "[parameters('envName')]",
6969
"location": "[parameters('location')]",
7070
"properties": {
@@ -90,7 +90,7 @@
9090
},
9191
{
9292
"type": "Microsoft.App/containerApps",
93-
"apiVersion": "2023-05-01",
93+
"apiVersion": "2024-03-01",
9494
"name": "[parameters('appName')]",
9595
"location": "[parameters('location')]",
9696
"identity": {
@@ -108,6 +108,20 @@
108108
"configuration": {
109109
"ingress": {
110110
"allowInsecure": false,
111+
"ipSecurityRestrictions": [
112+
{
113+
"action": "Allow",
114+
"description": "Allowed IP address range",
115+
"ipAddressRange": "10.1.1.1/32",
116+
"name": "ClientIPAddress_1"
117+
},
118+
{
119+
"action": "Allow",
120+
"description": "Allowed IP address range",
121+
"ipAddressRange": "10.1.2.1/32",
122+
"name": "ClientIPAddress_2"
123+
}
124+
],
111125
"stickySessions": {
112126
"affinity": "none"
113127
}

0 commit comments

Comments
 (0)