Azure Bicep - Additional IP Restrictions

Question

I'd like to use a shared bicep module to add several ip security restriction records to existing app services.

This is the module I've come up with:

param appSvcName string

resource appSvc 'Microsoft.Web/sites@2021-02-01' existing = {
  name: appSvcName
}

var proxyIpAddresses = ['xxx.xxx.xxx.250/32','xxx.xxx.xxx.245/32']

resource sitesConfig 'Microsoft.Web/sites/config@2021-02-01' =  {
  name: 'web'
  parent: appSvc
  properties: {
    ipSecurityRestrictions: [for (ip,i) in proxyIpAddresses: {
        ipAddress: ip
        action: 'Allow'
        tag: 'Default'
        priority: 900 + i
        name: 'ProxyIp_${i}'
        description: 'Allow request from proxy ${i}'
      }]
    }
  }

I call this from the main bicep as follows:

module ipRestrictions 'common.appSvc.ipSecurityRestrictions.bicep' = {
  scope: resourceGroup(utrnRg)
  name: 'ipRestrictionsDeploy'
  params: {
    appSvcName: functionAppName
  }
  dependsOn: [
    functionAppDeploy
  ]
}

Prior to this, there's a call to a specific Azure Function module the provisions the function app and ip restrictions that are specific to that function app (typically subnets that it should allow traffic from)

The behaviour I see is that the function app gets created with its specific ip restrictions, but these get deleted and replaced with the two rules from the shared module.

Is there a way I can make the module add to existing ip restrictions rather than replacing them?

userw6uh · Answer

In you module, you would need to have a new parameter for the existings ip restrictions then you can add the new restirctions to it:

// common.appSvc.ipSecurityRestrictions.bicep
param appSvcName string
param existingIpSecurityRestrictions array = []

resource appSvc 'Microsoft.Web/sites@2021-02-01' existing = {
  name: appSvcName
}

var proxyIpAddresses = ['xxx.xxx.xxx.250/32','xxx.xxx.xxx.245/32']

var additionalIpSecurityRestrictions = [for (ip,i) in proxyIpAddresses: {
  ipAddress: ip
  action: 'Allow'
  tag: 'Default'
  priority: 900 + i
  name: 'ProxyIp_${i}'
  description: 'Allow request from proxy ${i}'
}]

resource sitesConfig 'Microsoft.Web/sites/config@2021-02-01' = {
  name: 'web'
  parent: appSvc
  properties: {
    ipSecurityRestrictions: concat(existingIpSecurityRestrictions, additionalIpSecurityRestrictions)
  }
}

Then invoke the module with the existing restrictions:

// main.bicep

param functionAppName string

module ipRestrictions 'common.appSvc.ipSecurityRestrictions.bicep' = {
  scope: resourceGroup(utrnRg)
  name: 'ipRestrictionsDeploy'
  params: {
    appSvcName: functionAppName
    existingIpSecurityRestrictions: reference(resourceId('Microsoft.Web/sites/config', functionAppName, 'web'), '2021-02-01').ipSecurityRestrictions
  }
  dependsOn: [
    functionAppDeploy
  ]
}

Azure Bicep - Additional IP Restrictions

1 Answers