azureazure-bicepazure-appservice

Azure AppService limit public access with publicNetworkAccess, but which value to use in Bicep?

enter image description here

According to this official documentation the value of publicNetworkAccess can only be enabled or disabled. It reflects the value of the radiobutton in the portal which is the screenshot above. I am aiming for the middle option but have no clue what value to use in my Bicep.

resource appServiceApp 'Microsoft.Web/sites@2023-12-01' = {
  name: 'the name'
  location: location
  kind: 'app'
  properties: {
    serverFarmId: appServicePlan.id
    httpsOnly: false
    publicNetworkAccess: '' // <-- this can be either 'Enabled' or 'Disabled' according to docs
// etc.

I have some ipSecurityRestrictions futher down in the Bicep to whitelist ip's and I have ipSecurityRestrictionsDefaultAction: 'Deny' in the Bicep too.

az bicep version = Bicep CLI version 0.29.47 (132ade51bc)

Solution

  • Azure AppService limit public access with publicNetworkAccess, but which value to use in Bicep?

    To enable the public network address with only selected networks and ip address option, you need to first set publicNetworkAccess: 'Enabled' and then include the ipSecurityRestrictions [] block in the code as shown below to restrict the network access for specific Ip's.

    param location string = resourceGroup().location
param sku string = 'F1'
param linuxFxVersion string = 'node|14-lts'
resource appplan 'Microsoft.Web/serverfarms@2020-06-01' = {
  name: 'ipplan'
  location: location
  properties: {
    reserved: true
  }
  sku: {
    name: sku
  }
  kind: 'linux'
}
resource appser 'Microsoft.Web/sites@2023-12-01' = {
  name: 'ipapprest'
  location: resourceGroup().location
  properties: {
    serverFarmId: appplan.id
    siteConfig: {
      linuxFxVersion: linuxFxVersion
      vnetRouteAllEnabled: true
      publicNetworkAccess: 'Enabled'
      ipSecurityRestrictions: [
        {
          ipAddress: '10.0.0.0/32'
          action: 'Allow'
          priority: 300
          name: 'myip'
          description: 'xxx'
        }
        {
          ipAddress: 'Any'
          action: 'Deny'
          name: 'Denyip'
          description: 'xxx'
          priority: 214748364
        }
      ]
      ipSecurityRestrictionsDefaultAction:'Deny'
    }
  }

}

    Deployment succeeded:

    enter image description here

    enter image description here

    enter image description here