通过Azure Bicep修改现有Azure防火墙的关联策略

场景说明 #

已部署的Azure防火墙（关联原有Firewall Policy）需修改配置，关联新的Firewall Policy。由于现有环境配置复杂无法删除重建防火墙，且Firewall Policy API不支持添加父防火墙属性，需通过在线更新防火墙配置实现。

现有防火墙Bicep配置 #

resource resAzureFirewall 'Microsoft.Network/azureFirewalls@2021-02-01' = if (parVirtualHubEnabled && parAzFirewallEnabled) {
  name: parAzFirewallName
  location: parLocation
  tags: parTags
  zones: (!empty(parAzFirewallAvailabilityZones) ? parAzFirewallAvailabilityZones : json('null'))
  properties: {
    hubIPAddresses: {
      publicIPs: {
        count: 1
      }
    }
    sku: {
      name: 'AZFW_Hub'
      tier: parAzFirewallTier
    }
    virtualHub: {
      id: parVirtualHubEnabled ? resVhub.id : ''
    }
    additionalProperties: {
      'Network.DNS.EnableProxy': '${parAzFirewallDnsProxyEnabled}'
    }
    firewallPolicy: {
      id: (parVirtualHubEnabled && parAzFirewallEnabled) ? resFirewallPolicies.id : ''
    }
  }
}

目标Firewall Policy Bicep配置 #

resource workloadFWPolicy 'Microsoft.Network/firewallPolicies@2022-07-01' = {
  name: workloadFwPolicyName
  location:parLocation
  properties: {
    sku: {
      tier: 'Premium'
    }
    threatIntelMode: 'Alert'
    basePolicy: {
      id: platformFwPolicy.id
    }
    intrusionDetection: {
      mode: 'Off'
    }
  }
}

解决方案 #

直接更新现有Azure防火墙资源的firewallPolicy.id字段，替换为新策略的ID，无需删除重建防火墙。需注意以下要点：

• 确保新策略的SKU Tier（Premium）与防火墙的parAzFirewallTier参数值一致，否则会出现兼容性错误
• Azure支持在线更新防火墙的策略关联，操作不会导致防火墙服务中断

修改后的防火墙Bicep配置 #

resource resAzureFirewall 'Microsoft.Network/azureFirewalls@2021-02-01' = if (parVirtualHubEnabled && parAzFirewallEnabled) {
  name: parAzFirewallName
  location: parLocation
  tags: parTags
  zones: (!empty(parAzFirewallAvailabilityZones) ? parAzFirewallAvailabilityZones : json('null'))
  properties: {
    hubIPAddresses: {
      publicIPs: {
        count: 1
      }
    }
    sku: {
      name: 'AZFW_Hub'
      tier: parAzFirewallTier
    }
    virtualHub: {
      id: parVirtualHubEnabled ? resVhub.id : ''
    }
    additionalProperties: {
      'Network.DNS.EnableProxy': '${parAzFirewallDnsProxyEnabled}'
    }
    firewallPolicy: {
      // 替换为新的workloadFWPolicy的ID
      id: (parVirtualHubEnabled && parAzFirewallEnabled) ? workloadFWPolicy.id : ''
    }
  }
}

部署修改后的Bicep模板即可完成防火墙与新策略的关联更新。

内容的提问来源于stack exchange，提问作者Ram