Code Monkey home page Code Monkey logo

azuresandbox's Introduction

#AzureSandbox

Contents

Architecture

diagram

Overview

This repository contains a collection of inter-dependent cloud computing configurations for implementing common Microsoft Azure services on a single subscription. Collectively these configurations provide a flexible and cost effective sandbox environment useful for experimenting with various Azure services and capabilities. Depending upon your Azure offer type and region, a fully provisioned #AzureSandbox environment costs approximately $50 USD / day. These costs can be further reduced by stopping / deallocating virtual machines when not in use, or by skipping optional configurations that you do not plan to use (Step-By-Step Video).

Disclaimer: #AzureSandbox is not intended for production use. While some best practices are used, others are intentionally not used in favor of simplicity and cost. See Known issues for more information.

#AzureSandbox is implemented using popular open source tools that are supported on Windows, macOS and Linux including:

This repo was created by Roger Doherty.

Sandbox index

#AzureSandbox features a modular design and can be deployed as a whole or incrementally depending upon your requirements.

Prerequisites

The following prerequisites are required in order to get started. Note that once these prerequisite are in place, a Contributor Azure RBAC role assignment is sufficient to use the configurations.

  • Identify the Microsoft Entra ID tenant to be used for identity and access management, or create a new tenant using Quickstart: Set up a tenant.

  • Identify a single Azure subscription or create a new Azure subscription. See Azure Offer Details and Associate or add an Azure subscription to your Microsoft Entra tenant for more information.

  • Identify the owner of the Azure subscription to be used for #AzureSandbox. This user should have an Owner Azure RBAC role assignment on the subscription. See Steps to assign an Azure role for more information.

  • Ask the subscription owner to create a Contributor Azure RBAC role assignment for each sandbox user. See Steps to assign an Azure role for more information.

  • Verify the subscription owner has privileges to create a Service principal name on the Microsoft Entra tenant. See Permissions required for registering an app for more information.

  • Ask the subscription owner to Create an Azure service principal with Azure CLI (SPN) for sandbox users by running the following Azure CLI command in Azure Cloud Shell.

    # Replace 00000000-0000-0000-0000-000000000000 with the subscription id
az ad sp create-for-rbac -n AzureSandboxSPN --role Contributor --scopes /subscriptions/00000000-0000-0000-0000-000000000000

    Securely share the output with sandbox users, including appId and password:

    {
  "appId": "00000000-0000-0000-0000-000000000000",
  "displayName": "AzureSandboxSPN",
  "password": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "tenant": "00000000-0000-0000-0000-000000000000"
}

  • Some organizations may institute Azure policy which may cause some sandbox deployments to fail. This can be addressed by using custom settings which pass the policy checks, or by disabling the policies on the Azure subscription being used for the configurations.

  • Some Azure subscriptions may have low quota limits for specific Azure resources which may cause sandbox deployments to fail. See Resolve errors for resource quotas for more information. Consult the following table to determine if quota increases are required to deploy the configurations using default settings:

Resource Quota required per deployment Command
Public IP Addresses ~2 az network list-usages
Standard BS Family vCPUs ~5 az vm list-usage
Standard Sku Public IP Addresses ~2 az network list-usages
Static Public IP Addresses ~2 az network list-usages

Note: This list is not comprehensive. Quotas vary by Azure subscription offer type and environment. More than one quota may need to be increased for a single resource type, such as public ip addresses.

Getting started

Before you begin, familiarity with the following topics will be helpful when working with #AzureSandbox:

Configure client environment

#AzureSandbox automation scripts are written in Linux Bash and Linux PowerShell. In order to deploy #AzureSandbox you will need to configure a Linux client environment to execute these scripts. Detailed guidance is provided for users who are unfamiliar with Linux. Three different client environment options are described in this section, including:

Windows Subsystem for Linux

Windows users can use WSL which supports a variety of Linux distributions. The current default distribution Ubuntu 22.04 LTS (Jammy Jellyfish) is recommended. Please note these instructions may vary for different Linux releases and/or distributions.

Azure Cloud Shell

Azure Cloud Shell is a free pre-configured cloud hosted container with a full complement of tools needed to use #AzureSandbox. This option will be preferred for users who do not wish to install any software and don't mind a web based command line user experience. Review the following content to get started:

Warning: Cloud shell containers are ephemeral. Anything not saved in ~/clouddrive will not be retained when your cloud shell session ends. Also, cloud shell sessions expire. This can interrupt a long running process.

Linux / macOS

Linux and macOS users can deploy the configurations natively by installing the following tools:

Note the Bash scripts used in the configurations were developed and tested using GNU bash, version 5.0.17(1)-release (x86_64-pc-linux-gnu) and have not been tested on other popular shells like zsh.

Next steps

Now that the client environment has been configured, here's how to clone a copy of this repo and start working with the latest release of code (Step-By-Step Video).

# Run this command on cloudshell clients only
cd clouddrive

# Run these commands on all clients, including cloudshell 
git clone https://github.com/Azure-Samples/azuresandbox
cd azuresandbox
latestTag=$(git describe --tags $(git rev-list --tags --max-count=1))
git checkout $latestTag

Perform default sandbox deployment

For the first deployment, the author recommends using defaults, which is ideal for speed, learning and testing. IP address ranges are expressed using CIDR notation.

Default IP address ranges

The configurations use default IP address ranges for networking components. These ranges are artificially large and contiguous for simplicity, and customized IP address ranges can be much smaller. A suggested minimum is provided to assist in making the conversion. It's a good idea to start small. Additional IP address ranges can be added to the networking configuration in the future if you need them, but you can't modify an existing IP address range to make it smaller.

Address range CIDR First Last IP address count Suggested minimum range
Reserved for private network 10.0.0.0/16 10.0.0.0 10.0.255.255 65,536 N/A
Default sandbox aggregate 10.1.0.0/13 10.1.0.0 10.7.255.255 524,288 /22 (1024 IP addresses)
Shared services virtual network 10.1.0.0/16 10.1.0.0 10.1.255.255 65,536 /24 (256 IP addresses)
Application virtual network 10.2.0.0/16 10.2.0.0 10.2.255.255 65,536 /24 (256 IP addresses)
Virtual wan hub 10.3.0.0/16 10.3.0.0 10.3.255.255 65,536 /24 (256 IP addresses)
P2S client VPN connections 10.4.0.0/16 10.4.0.0 10.4.255.255 65,536 /24 (256 IP addresses)
Reserved for future use 10.5.0.0/16 10.5.0.0 10.5.255.255 65,536 N/A
Reserved for future use 10.6.0.0/15 10.6.0.0 10.7.255.255 131,072 N/A
Default subnet IP address prefixes

This section documents the default subnet IP address prefixes used in the configurations. Subnets enable you to segment the virtual network into one or more sub-networks and allocate a portion of the virtual network's address space to each subnet. You can then connect network resources to a specific subnet, and control ingress and egress using network security groups.

Virtual network Subnet IP address prefix First Last IP address count
Shared services AzureBastionSubnet 10.1.0.0/27 10.1.0.0 10.1.0.31 32
Shared services Reserved for future use 10.1.0.32/27 10.1.0.32 10.1.0.63 32
Shared services Reserved for future use 10.1.0.64/26 10.1.0.64 10.1.0.127 64
Shared services Reserved for future use 10.1.0.128/25 10.1.0.128 10.1.0.255 128
Shared services snet-adds-01 10.1.1.0/24 10.1.1.0 10.1.1.255 256
Shared services snet-misc-01 10.1.2.0/24 10.1.2.0 10.1.2.255 256
Shared services snet-misc-02 10.1.3.0/24 10.1.3.0 10.1.3.255 256
Shared services Reserved for future use 10.1.4.0/22 10.1.4.0 10.1.7.255 1,024
Shared services Reserved for future use 10.1.8.0/21 10.1.8.0 10.1.15.255 2,048
Shared services Reserved for future use 10.1.16.0/20 10.1.16.0 10.1.31.255 4,096
Shared services Reserved for future use 10.1.32.0/19 10.1.32.0 10.1.63.255 8,192
Shared services Reserved for future use 10.1.64.0/18 10.1.64.0 10.1.127.255 16,384
Shared services Reserved for future use 10.1.128.0/17 10.1.128.0 10.1.255.255 32,768
Application snet-app-01 10.2.0.0/24 10.2.0.0 10.2.0.255 256
Application snet-db-01 10.2.1.0/24 10.2.1.0 10.2.1.255 256
Application snet-privatelink-01 10.2.2.0/24 10.2.2.0 10.2.2.255 256
Application snet-misc-03 10.2.3.0/24 10.2.3.0 10.2.3.255 256
Application Reserved for future use 10.2.4.0/22 10.2.4.0 10.2.7.255 1,024
Application Reserved for future use 10.2.8.0/21 10.2.8.0 10.2.15.255 2,048
Application Reserved for future use 10.2.16.0/20 10.2.16.0 10.2.31.255 4,096
Application Reserved for future use 10.2.32.0/19 10.2.32.0 10.2.63.255 8,192
Application Reserved for future use 10.2.64.0/18 10.2.64.0 10.2.127.255 16,384
Application Reserved for future use 10.2.128.0/17 10.2.128.0 10.2.255.255 32,768

Apply sandbox configurations

Apply the configurations in the following order:

  1. terraform-azurerm-vnet-shared implements a virtual network with shared services used by all the configurations.
  2. terraform-azurerm-vnet-app implements an application virtual network with pre-configured Windows Server and Linux jumpboxes.
  3. terraform-azurerm-vm-mssql (optional) implements an IaaS database server virtual machine based on the SQL Server virtual machines in Azure offering.
  4. terraform-azurerm-mssql (optional) implements a PaaS database hosted in Azure SQL Database with a private endpoint implemented using PrivateLink.
  5. terraform-azurerm-mysql (optional) implements a PaaS database hosted in Azure Database for MySQL - Flexible Server with a private endpoint implemented using subnet delegation.
  6. terraform-azurerm-vwan (optional) connects the shared services virtual network and the application virtual network to remote users or a private network.

Destroy sandbox configurations

While a default sandbox deployment is fine for testing, it may not work with an organization's private network. The default deployment should be destroyed first before doing a custom deployment. This is accomplished by running terraform destroy on each configuration in the reverse order in which it was deployed:

  1. terraform-azurerm-vwan
  2. terraform-azurerm-mysql
  3. terraform-azurerm-mssql
  4. terraform-azurerm-vm-mssql
  5. terraform-azurerm-vnet-app
  6. terraform-azurerm-vnet-shared. Note: Resources provisioned by bootstrap.sh must be deleted manually.

Alternatively, for speed, simply delete rg-sandbox-01`. You can run cleanterraformtemp.sh to clean up temporary files and directories.

# Warning: This command will delete an entire resource group and should be used with great caution.
az group delete -g rg-sandbox-01

Perform custom sandbox deployment

A custom deployment will likely be required to connect the configurations to an organization's private network. This section provides guidance on how to customize the configurations.

Document private network IP address ranges (sample)

Use this section to document one or more private network IP address ranges by consulting a network professional. This is required if you want to establish a hybrid connection between an organization's private network and the configurations. The sandbox includes two IP address ranges used in a private network. The CIDR to IPv4 Conversion tool may be useful for completing this section.

IP address range CIDR First Last IP address count
Primary range 10.0.0.0/8 10.0.0.0 10.255.255.255 16,777,216
Secondary range 162.44.0.0/16 162.44.0.0 162.44.255.255 65,536

A blank table is provided here for convenience. Make a copy of this table and change the TBD values to your custom values.

IP address range CIDR First Last IP address count
Primary range TBD TBD TBD TBD
Secondary range TBD TBD TBD TBD

Customize IP address ranges (sandbox)

Use this section to customize the default IP address ranges used by the configurations to support routing on an organization's private network. The aggregate range should be determined by consulting a network professional, and will likely be allocated using a range that falls within the private network IP address ranges discussed previously, and the rest of the IP address ranges must be contained within it. The CIDR to IPv4 Conversion tool may be useful for completing this section. Note this sandbox uses the suggested minimum address ranges from the default IP address ranges described previously.

IP address range CIDR First Last IP address count
Aggregate range 10.73.8.0/22 10.73.8.0 10.73.11.255 1,024
Shared services virtual network 10.73.8.0/24 10.73.8.0 10.73.8.255 256
Application virtual network 10.73.9.0/24 10.73.9.0 10.73.9.255 256
Virtual wan hub 10.73.10.0/24 10.73.10.0 10.73.10.255 256
P2S client VPN connections 10.73.11.0/24 10.73.11.0 10.73.11.255 256

A blank table is provided here for convenience. Make a copy of this table and change the TBD values to your custom values.

IP address range CIDR First Last IP address count
Aggregate range TBD TBD TBD TBD
Shared services virtual network TBD TBD TBD TBD
Application virtual network TBD TBD TBD TBD
Virtual wan hub TBD TBD TBD TBD
P2S client VPN connections TBD TBD TBD TBD
Customize subnet IP address prefixes (sandbox)

Use this section to customize the default subnet IP address prefixes used by the configurations to support routing on an organization's private network. Make a copy of this table and change these sandbox values to custom values. Each address prefix must fall within the virtual network IP address ranges discussed previously. The CIDR to IPv4 Conversion tool may be useful for completing this section.

Virtual network Subnet IP address prefix First Last IP address count
Shared services AzureBastionSubnet 10.73.8.0/27 10.73.8.0 10.73.8.31 32
Shared services snet-adds-01 10.73.8.32/27 10.73.8.32 10.73.8.63 32
Shared services snet-misc-01 10.73.8.64/27 10.73.8.64 10.73.8.95 32
Shared services snet-misc-02 10.73.8.96/27 10.73.8.96 10.73.8.127 32
Shared services Reserved for future use 10.73.8.128/25 10.73.8.128 10.73.8.255 128
Application snet-app-01 10.73.9.0/27 10.73.9.0 10.73.9.31 32
Application snet-db-01 10.73.9.32/27 10.73.9.32 10.73.9.63 32
Application snet-privatelink-01 10.73.9.64/27 10.73.9.64 10.73.9.95 32
Application snet-misc-03 10.73.9.96/27 10.73.9.96 10.73.9.127 32
Application Reserved for future use 10.73.9.128/25 10.73.9.128 10.73.9.255 128

It is recommended to reserve space for future subnets. A blank table is provided here for convenience. Make a copy of this table and change the TBD values to your custom values.

Virtual network Subnet IP address prefix First Last IP address count
Shared services snet-default-01 TBD TBD TBD TBD
Shared services AzureBastionSubnet TBD TBD TBD TBD
Shared services snet-storage-private-endpoints-01 TBD TBD TBD TBD
Application snet-default-02 TBD TBD TBD TBD
Application AzureBastionSubnet TBD TBD TBD TBD
Application snet-app-01 TBD TBD TBD TBD
Application snet-db-01 TBD TBD TBD TBD
Application snet-privatelink-01 TBD TBD TBD TBD
Application snet-mysql-01 TBD TBD TBD TBD

Videos

Video Section
Overview Overview
Configure Client Environment (Part 1) Getting started | Configure client environment | Windows Subsystem for Linux | Windows prerequisites
Configure Client Environment (Part 2) Getting started | Configure client environment | Windows Subsystem for Linux | Linux prerequisites
Next Steps Next steps

Known issues

This section documents known issues with these configurations that should be addressed prior to real world usage.

  • Client environment
  • Configuration management
    • Terraform
      • For simplicity, these configurations store State in a local file named terraform.tfstate. For production use, state should be managed in a secure, encrypted Backend such as azurerm.
      • There is a known issue that causes Terraform plan or apply operations to fail after provisioning an Azure Files share behind a private endpoint. If this is causing plan or apply operations to fail you can either whitelist the IP address of the client environment on the storage account firewall or use Target Resources to work around it.
    • Windows Server: This configuration uses Azure Automation State Configuration (DSC) for configuring the Windows Server virtual machines, which will be replaced by Azure Automanage Machine Configuration. This configuration will be updated to the new implementation in a future release.
      • configure-automation.ps1: The performance of this script could be improved by using multi-threading to run Azure Automation operations in parallel.
  • Identity, Access Management and Authentication.
    • Authentication: These configurations use a service principal to authenticate with Azure which requires a client secret to be shared. This is due to the requirement that sandbox users be limited to a Contributor Azure RBAC role assignment which is not authorized to do Azure RBAC role assignments. Production environments should consider using managed identities instead of service principals which eliminates the need to share secrets.
      • SQL Server Authentication: By default this configuration uses mixed mode authentication. Production deployments should use Windows integrated authentication as per best practices.
      • Point-to-site VPN gateway authentication: This configuration uses self-signed certificates for simplicity. Production environments should use certificates generated from a root certificate authority.
    • Credentials: For simplicity, these configurations use a single set of user defined credentials when an administrator account is required to provision or configure resources. In production environments these credentials would be different and follow the principal of least privilege for better security. Some user defined credentials may cause failures due to differences in how various resources implement restricted administrator user names and password complexity requirements. Note that the default password expiration policy for Active Directory is 42 days which will require the password for [email protected] to be changed. It is recommended that you update the related adminpassword secret in key vault when changing the password as this does not happen automatically.
    • Active Directory Domain Services: A pre-configured AD domain controller azurerm_windows_virtual_machine.vm_adds is provisioned.
      • High availability: The current design uses a single VM for AD DS which is counter to best practices as described in Deploy AD DS in an Azure virtual network which recommends a pair of VMs in an Availability Set.
      • Data integrity: The current design hosts the AD DS domain forest data on the OS Drive which is counter to best practices as described in Deploy AD DS in an Azure virtual network which recommends hosting them on a separate data dr*ive with different cache settings.
    • Role-Based Access Control (RBAC)
      • Least privilege: The current design uses a single Azure RBAC role assignment to grant the Contributor role to the currently logged in Azure CLI user and the service principal used by Terraform. Production environments should consider leveraging best practices as described in Azure role-based access control (Azure RBAC) best practices which recommends using multiple role assignments to grant the least privilege required to perform a task.
      • ARM provider registration: As described in issue #4440, some controlled environments may not permit automatic registration of ARM resource providers by Terraform. In these cases some ARM providers may need to be registered manually. See Azure resource providers and types and the azurerm provider skip_provider_registration optional argument for more information.
  • Storage
    • Azure Storage: For simplicity, this configuration uses the Authorize with Shared Key approach for Authorizing access to data in Azure Storage. For production environments, consider using shared access signatures instead.
      • There is a known issue when attempting to apply Terraform plans against Azure Storage containers that sit behind a firewall such as a private endpoint. This may prevent the ability to apply changes to configurations that contain this type of dependency, such as terraform-azurerm-vnet-app. To work around this you use Resource Targeting to avoid issues with storage containers.
    • Standard SSD vs. Premium SSD: By default, this configuration uses Standard SSD for SQL Server data and log disks instead of Premium SSD for reduced cost. Production deployments should use Premium SSD as per best practices.
  • Networking
    • azurerm_subnet.vnet_shared_01_subnets["snet-adds-01"]: This subnet is protected by an NSG as per best practices described in described in Deploy AD DS in an Azure virtual network, however the network security rules permit ingress and egress from the Virtual Network on all ports to allow for flexibility in the configurations. Production implementations of this subnet should follow the guidance in How to configure a firewall for Active Directory domains and trusts.
    • azurerm_private_dns_zone_virtual_network_link.private_dns_zone_virtual_network_links_vnet_app_01[] and azurerm_private_dns_zone_virtual_network_link.private_dns_zone_virtual_network_links_vnet_shared_01[]: Ideally private dns zones should only need to be linked to the shared services virtual network, however some provisioning processes (e.g. Azure Database for MySQL), require them to be linked to the same virtual network where the service is being provisioned. For this reason all private DNS zones are linked to all virtual networks.
    • azurerm_point_to_site_vpn_gateway.point_to_site_vpn_gateway_01: Connection attempts using the Azure VPN client may fail with the message Server did not respond correctly to VPN control packets. Session state: Reset sent. Synchronizing the time on the VPN client should resolve the issue. For Windows 11 clients go to Settings > Time & Language > Date & Time > Additional settings > Sync now.

azuresandbox's People

Contributors

doherty100 avatar microsoft-github-operations[bot] avatar microsoftopensource avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

nongaut robbyraeltest tarak-chandra-sarkar iamswetha7 uol-library guden boutie1 theaveragesysadmin oolakitan fullstackinfo cloud365admin maniveer2017 uros-babic senthilrepo20 nonsoudechukwu skaschimer radul85 sameepsb gcampos98 garimaagrawalaccenture zochory ningq-du nandakishoremutyala myereddy 4esolutions natyou345 sdeloison bigm00se

azuresandbox's Issues

Eliminate duplicate install of Edge on jumpwin1

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision terraform-azurerm-vnet-app

Any log messages given by the failure

N/A

Expected/desired behavior

Remove duplicate installation of Edge in JumpBoxConfig.ps1

OS and Version?

Windows Server 2022

Versions

#AzureSandbox v2.10.1

Mention any other details that might be useful

Edge is pre-installed on Windows Server 2002, there is no need to install it again.

Jumpwin1 Custom Script Extension stores secrets in clear text

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy #AzureSandbox v2.9.2
Enable Defender for Cloud CSPM agentless scanning

Any log messages given by the failure

Contains Verified Secret risk factor related to file C:\Packages\Plugins\Microsoft.compute.CustomScriptExtension\1.10.15\RuntimeSettings\0.settings finding on jumpwin1

Expected/desired behavior

Eliminate the local storage of secrets altogether or at a minimum do not store them in clear text

OS and Version?

Windows Server 2022

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Secrets are passed as clear text parameters to script configure-vm-jumpbox-win.ps1 using custom script extension.

Thanks! We'll be in touch soon.

Resource provider check

"Terraform Apply" step failed due to missing resource providers. Request to add checks for these....

microsoft.network
microsoft.automation
microsoft.operationalinsights

Use managed identity for secrets when domain joining Azure Files

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

The current bootstrapping process passes secrets to a virtual machine extension in order to domain join Azure Files. This results in secrets being stored locally on jumpwin1.

Any log messages given by the failure

N/A

Expected/desired behavior

Use of managed identities to retrieve secrets at runtime would avoid storing secrets locally on jumpwin1.

OS and Version?

Windows Server 2022

Versions

#AzureSandbox v2.10.0

Mention any other details that might be useful

Thanks! We'll be in touch soon.

mssqlwin1 connection denied from jumpwin1

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision #AzureSandbox
Complete smoke testing for terraform-azurerm-vm-mssql

Any log messages given by the failure

SQL Server Connection denied from SSMS on jumpwin1.

Expected/desired behavior

Connection should succeed

OS and Version?

Windows Server 2022 / SQL Server 2022

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Use approved version of TLS for Azure Storage

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision #AzureSandbox

Any log messages given by the failure

N/A

Expected/desired behavior

Remdiate reccomendation

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2
Minimum TLS version for Azure Storage should be set to 1.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

private_endpoint_network_policies_enabled will be removed in favour of the property private_endpoint_network_policies in version 4.0 of the AzureRM Provider

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy #AzureSandbox
Observe warning when provisioning terraform-azurerm-vnet-shared configuration

Any log messages given by the failure

Warning: Argument is deprecated
private_endpoint_network_policies_enabled will be removed in favour of the property private_endpoint_network_policies in version 4.0 of the AzureRM Provider

Expected/desired behavior

No warning should be displayed when applying plan.

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

disable password expiration for domain admin account

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ x ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

If you run the sandbox for an extended period of time the domain admin password will expire.

Any log messages given by the failure

User will be prompted to change password when logging into jumpwin1

Expected/desired behavior

Domain admin password should not expire.

OS and Version?

Windows Server 2022

Versions

Windows Server 2022

Mention any other details that might be useful

Thanks! We'll be in touch soon.

ResourceNotProvisioned failure in vnet-app config

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy terraform-azurerm-vnet-app

Any log messages given by the failure

Cannot proceed with operation because resource /subscriptions/xxx/resourceGroups/rg-sandbox-01/providers/Microsoft.Network/virtualNetworks/vnet-app-01 used by resource /subscriptions/xxx/resourceGroups/rg-sandbox-01/providers/Microsoft.Network/virtualNetworks/vnet-app-01/virtualNetworkPeerings/vnet_app_01_to_vnet_shared_01_peering is not in Succeeded state. Resource is in Updating state and the last operation that updated/is updating the resource is PutSubnetOperation.

Expected/desired behavior

Config should apply with no errors.

OS and Version?

N/A

Versions

AzureSandbox v2.8.12 with upgraded azurerm provider v3.95.0.

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Azure Files share creation fails with 403 error

Please provide us with the following information:

This issue is for a: (mark with an x)

- [  X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Install sandbox v2.9.0
Update azurerm to v3.98.0
Apply vnet-app configuration

Any log messages given by the failure

Error: checking for existing File Share "myfileshare" (Account "Account \"staymunn1rch5rh\" (IsEdgeZone false / ZoneName \"\" / Subdomain Type \"file\" / DomainSuffix \"core.windows.net\")"): executing request: unexpected status 403 (403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.) with response: <?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

Expected/desired behavior

Configuration should provision successfully

OS and Version?

N/A

Versions

AzureSandbox v2.9.0 + azurerm v3.98.0

Mention any other details that might be useful

Thanks! We'll be in touch soon.

jumplinux1 ssh fails with 'Permission denied (publickey)' error

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Install azuresandbx release v2.8.5
Complete smoke testing in terraform-azruerrm-vnet-shared, ssh to jumplinux1 fails with error Permission denied (publickey)

Any log messages given by the failure

N/A

Expected/desired behavior

SSH to jumplinux1 should succeed

OS and Version?

jumplinux1: Ubuntu 22.04 LTS

Versions

v2.8.5

Mention any other details that might be useful

This is a breaking change, tested v2.8.4 to rule out regression, issue reproduced on that build.
Thanks! We'll be in touch soon.

jumpwin1 vm extension fails when calling Azure PowerShell module

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Apply configuratino for terraform-azurerm-vnet-app. Note error when attempting to provision vm extension for jumpwin1.

Any log messages given by the failure

Terraform reports a non-zero exit code for vm extension.

Expected/desired behavior

there should be no errors

OS and Version?

N/A

Versions

v2.8.11

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Check that resource providers are registered in advance

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Create a brand new subscirption and provison terraform-azurerm-vnet-shared. Run bootstrap.sh. Errors may be encountered when the storage account is being provisioned if resource providers are not properly registered.

Any log messages given by the failure

(SubscriptionNotFound) Subscription xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx was not found.

Expected/desired behavior

Script should execute without errors.

OS and Version?

N/A

Versions

Azure Sandbox v2.8.9

Mention any other details that might be useful

Thanks! We'll be in touch soon.

One time Linux didn't add to Active Directory

Please provide us with the following information:

This issue is for a: (mark with an x)

- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Run terraform-azurerm-vnet-app

Any log messages given by the failure

Created symlink /etc/systemd/system/multi-user.target.wants/smbd.service → /lib/systemd/system/smbd.service.
samba-ad-dc.service is a disabled or a static unit, not starting it.
Processing triggers for ufw (0.36.1-4ubuntu0.1) ...
Processing triggers for man-db (2.10.2-1) ...
Processing triggers for dbus (1.12.20-2ubuntu4.1) ...
Processing triggers for libc-bin (2.35-0ubuntu3.1) ...
NEEDRESTART-VER: 3.5
NEEDRESTART-KCUR: 5.15.0-1041-azure
NEEDRESTART-KEXP: 5.15.0-1041-azure
NEEDRESTART-KSTA: 1
NEEDRESTART-SVC: packagekit.service
NEEDRESTART-SVC: unattended-upgrades.service
Cloud-init v. 23.2.2-0ubuntu0~22.04.1 running 'modules:final' at Tue, 22 Aug 2023 00:35:27 +0000. Up 428.54 seconds.
20230822T0035297908Z : NuGet Powershell Package Provider version 3.0.0.1 is already installed...
20230822T0035309337Z : Setting PSGallery installation policy to 'Trusted'...
20230822T0035322430Z : Installing PowerShell Az module...
20230822T0036109823Z : PowerShell Az.Automation version 1.9.1 is installed...
/var/lib/cloud/instance/scripts/configure-vm-jumpbox-linux.sh: line 30: $log_fileprintdiv: ambiguous redirect
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed

tkey query failed: GSSAPI error: Major = No credentials were supplied, or the credentials were unavailable or inaccessible, Minor = SPNEGO cannot find mechanisms to negotiate.
id: ‘[email protected]’: no such user
Cloud-init v. 23.2.2-0ubuntu022.04.1 finished at Tue, 22 Aug 2023 00:36:15 +0000. Datasource DataSourceAzure [seed=/dev/sr0]. Up 476.86 seconds
Cloud-init v. 23.2.2-0ubuntu022.04.1 running 'init-local' at Tue, 22 Aug 2023 01:35:07 +0000. Up 7.05 seconds.
Cloud-init v. 23.2.2-0ubuntu0~22.04.1 running 'init' at Tue, 22 Aug 2023 01:35:09 +0000. Up 9.74 seconds.
ci-info: ++++++++++++++++++++++++++++++++++++++Net device info+++++++++++++++++++++++++++++++++++++++
ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
ci-info: | Device | Up | Address | Mask | Scope | Hw-Address |
ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+
ci-info: | eth0 | True | 10.2.0.4 | 255.255.255.0 | global | 00:0d:3a:8d:34:c6 |
ci-info: | eth0 | True | fe80::20d:3aff:fe8d:34c6/64 | . | link | 00:0d:3a:8d:34:c6 |
ci-info: | lo | True | 127.0.0.1 | 255.0.0.0 | host | . |
ci-info: | lo | True | ::1/128 | . | host | . |
ci-info: +--------+------+-----------------------------+---------------+--------+-------------------+

Expected/desired behavior

to see jumplinux1 in the computers container in the mysandbox.local active directory.

OS and Version?

Linux Ubuntu 22.04

Versions

Mention any other details that might be useful

I destroyed the environment and re-deployed and it worked. Just wanted to report the issue.

AD password failures on jumplinux1

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

  • Deploy terraform-azurerm-vnet-shared
  • Deploy terraform-azurerm-vnet-app
  • Perform smoke testing on terraform-azurerm-vnet-app
  • Password fails during steps described in steps From jumpwin1, configure [Visual Studio Code](https://aka.ms/vscode) to do remote development on jumplinux1 . Password may also fail after initially working.

Any log messages given by the failure

Bad password.

Expected/desired behavior

Password should work.

OS and Version?

Ubuntu 22.04

Versions

AzureSandbox v2.6.6.

Mention any other details that might be useful

Transient failure, resoloves after redeploy.

Storage account exposed to the internet

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy #AzureSandbox v2.9.2
Enable Defender for Cloud CSPM

Any log messages given by the failure

Observe storage account risk factor Exposure to the internet

Expected/desired behavior

Storage account should not be exposed to the internet. Configure storage firewall to enable network access from selected virtual networks and IP addresses.

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Azure Automation provisioner error related to PSDscResources module

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Apply terraform-azurerm-vnet-shared configuration.

Any log messages given by the failure

<m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"> <m:code /> <m:message xml:lang="en-US">An error has occurred.</m:message> </m:error>
Skipping module 'PSDscResources' because it cannot be found in PowerShell Gallery...

Expected/desired behavior

This is an unexpected error related to breaking changes in Azure Automation.

OS and Version?

N/A

Versions

Azure Sandbox v2.8.6

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Automount Azure Files share on jumplinux1

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [  x ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

N/A

Any log messages given by the failure

N/S

Expected/desired behavior

jumplinux1 should automount the Azure Files share provisioned in terraform-azurerm-vnet-app.

OS and Version?

Ubuntu 22.04

Versions

Ubuntu 22.04

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Enable encrypted connections for SQL Server instance on mssqlwin1

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision terraform-azurerm-vm-mssql
Complete smoke testing, note that connection security encryption must be changed from 'MandatorytoOptional`

Any log messages given by the failure

N/A

Expected/desired behavior

Default option of connection security encryption 'Mandatory' should work.

OS and Version?

Windows Server 2022
SQL Server 2022

Versions

#AzureSandbox v2.10.1

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Key vault secrets should have an expiration date

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision #AzureSandbox
Enable Defender for Cloud CSPM

Any log messages given by the failure

Key vault secrets should have an expiration date

Expected/desired behavior

Remediate vulnerability.

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Secrets are mainly used during bootstrapping, so an expiration date should not impact use.
The one exception is the adminpassword secret which is used to log into VMs using Bastion.
A default secret expiration policy of 365 days should be a good compromise, most sandboxes will not live this long.

Enable ADE or EncryptionAtHost for VMs

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy #AzureSandbox
Enable Defender for Cloud CSPM

Any log messages given by the failure

Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost.

Expected/desired behavior

Remediate this reccomendation.

OS and Version?

Windows Server 2022 and Ubundu 22.04

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

vnet-shared / bootstrap.sh azure cli errors

Please provide us with the following information:

This issue is for a: (mark with an x)

- [  X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Start a fresh sandbox deployment by running bootstrap.sh in terraform-azurerm-vnet-shared.

Any log messages given by the failure

Bash errors relating to problems with key vault and storage account will show up in terminal output.

Expected/desired behavior

No errors should be reported.

OS and Version?

N/A

Versions

AzureSandbox v2.7.0

Mention any other details that might be useful

Azure CLI issue 27686

VA1143 dbo user should not be used for normal service operation (Azure SQL Database)

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision #AzureSandbox
Enable Defender for Cloud CSPM

Any log messages given by the failure

SQL databases should have vulnerability findings resolved
VA1143 dbo user should not be used for normal service operation (testdb)

Expected/desired behavior

Remediate recommendation

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Add Azure Monitor support for VMs

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

N/A

Any log messages given by the failure

N/A

Expected/desired behavior

Provision Azure Monitor Agent (AMA) on VMs using Azure Policy and connect to log analytics using data collection rule (DCR)

OS and Version?

Windows Server 2022 and Ubuntu 22.04 (jammy)

Versions

Windows Server 2022 and Ubuntu 22.04 (jammy)

Mention any other details that might be useful

Thanks! We'll be in touch soon.

jumplinux1: File System Check on first reboot after mounting CIFS file system

Please provide us with the following information:

This issue is for a: (mark with an x)

- [  x ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy terraform-azurerm-vnet-app, complete smoke testing, then shut down jumplinux1. When jumplinux1 is restarted it will not boot correctly and Azure VM agent status is unkown. .

Any log messages given by the failure

Serial console reports Stopped File System Check ...

Expected/desired behavior

VM should reboot normally and mount CIFS file system.

OS and Version?

Ubuntu 22.04.04 LTS (Linux jumplinux1 6.2.0-1018-azure #18~22.04.1-Ubuntu SMP Tue Nov 21 19:25:02 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux)

Versions

#AzureSandbox v2.8.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

VA2061 Auditing should be enabled at the server level (Azure SQL Database)

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision #AzureSandbox
Enable Defender for Cloud CSPM

Any log messages given by the failure

SQL databases should have vulnerability findings resolved
VA2061 Auditing should be enabled at the server level (Azure SQL Database)

Expected/desired behavior

Remediate reccomendation

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Failure when creating NSG for AzureBastionSubnet

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Apply terraform-azurerm-vnet-shared configuratino

Any log messages given by the failure

Network security group nsg-vnet-shared-01.AzureBastionSubnet does not have necessary rules for Azure Bastion Subnet AzureBastionSubnet."

Expected/desired behavior

No error expected.

OS and Version?

N/S

Versions

AzureSandbox v2.8.6

Mention any other details that might be useful

Thanks! We'll be in touch soon.

configure-storage-kerberos.ps1 hangs when installing Azure PowerShell Module

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Apply terraform-azurerm-vnet -hared
Apply terraform-azurerm-vnet-app

Any log messages given by the failure

`Extension Name: "vmext-jumpwin1-postdeploy-script"): polling after CreateOrUpdate: context deadline exceeded

Expected/desired behavior

Configuration should apply without errors.

OS and Version?

Windows Server 2022

Versions

#AzureSandbox v2.10.0

Mention any other details that might be useful

May be a transient issue. Logs indicate that configure-storage-kerberos.ps1 hung when installing Azure PowerShell module.
Thanks! We'll be in touch soon.

RetryableError when provisioning vnet-app

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision vnet-app with azurerm v3.95.0.

Any log messages given by the failure

Virtual Machine Name: "jumpwin1"): Code="RetryableError" Message="A retryable error occurred."

Expected/desired behavior

No errors should occur.

OS and Version?

Versions

AzureSandbox v2.8.12 with upgraded azurerm provider v3.95.0.

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Bootstrap renewal of kerberos keys for Azure Storage should be optional

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Run terraform-azurerm-vnet-shared\bootstrap.sh

Any log messages given by the failure

Creating kerberos key for storage account 'STORAGE-ACCOUNT-NAME'...

Expected/desired behavior

Bootstrap should make renewal of kerberos key optional

OS and Version?

N/A

Versions

#AzureSandbox v2.10.1

Mention any other details that might be useful

Bootstrap.sh should be idempotent. This change will enable idepotency.

Storage accounts should prevent shared key access

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provision #AzureSandbox
Enable Defender for Cloud CSPM

Any log messages given by the failure

Storage accounts should prevent shared key access

Expected/desired behavior

Remediate reccomendation.

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Use managed identities for custom script extensions instead of shared keys

Chocolatey fails to install on jumpwin1

This issue is for a: (mark with an x)

- [ x ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

  • Provision terraform-azurerm-vnet-shared
  • Provision terraform-azurerm-vnet-app

Any log messages given by the failure

Error: Code="VMExtensionProvisioningError" Message="VM has reported a failure when processing extension 'vmext-jumpwin1-postdeploy-script' (publisher 'Microsoft.Compute' and type 'CustomScriptExtension'). Error message: \"Command execution finished, but failed because it returned a non-zero exit code of: '1'\". More information on troubleshooting is available at https://aka.ms/VMExtensionCSEWindowsTroubleshoot. " 

with azurerm_virtual_machine_extension.vm_jumpbox_win_postdeploy_script,
on 030-vm-jumpbox-win.tf line 77, in resource "azurerm_virtual_machine_extension" "vm_jumpbox_win_postdeploy_script":
77: resource "azurerm_virtual_machine_extension" "vm_jumpbox_win_postdeploy_script" {

Expected/desired behavior

terraform-azurerm-vnet-app should provision successfully.

OS and Version?

  • Windows Server 2022

Versions

  • AzureSandbox v2.6.6

Mention any other details that might be useful

See cChoco issue 179.

Diagnostic logs in Key Vault should be enabled

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy #Azure Sandbox
Enable Defender for CSPM

Any log messages given by the failure

Diagnostic logs in Key Vault should be enabled

Expected/desired behavior

Remediate reccomendation.

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Add support for MySQL PrivateLink

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [  x ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

N/A

Any log messages given by the failure

N/A

Expected/desired behavior

Update terraform-azurerm-mysql config to use PrivateLink instead of delegated subnets.

OS and Version?

N/A

Versions

N/A

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Automation account variables should be encrypted

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ X ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Provsion #AzureSandbox
Enabled Defender For Cloud

Any log messages given by the failure

Automation account variables should be encrypted

Expected/desired behavior

Remediate recomendation

OS and Version?

N/A

Versions

#AzureSandbox v2.9.2

Mention any other details that might be useful

Thanks! We'll be in touch soon.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.