在ARM模板IP限制中包含前门ID前门、模板、ARM、ID

2023-09-03 13:49:13 作者:中了鹿晗の毒

在Azure门户中,当设置对Azure Web应用程序的访问限制时,现在可以使用服务标签并包括某些必须存在才能允许访问的标头。我们已将以下设置配置为仅从我们的特定前门实例访问Web应用程序:

然而,当尝试在ARM中反映相同的配置时,我无法使其正常工作。似乎明显缺乏这方面的例子或文档,并且在Azure门户中导出模板不包括前门ID标题检查。以下是我想出来的,但在成功部署之后,访问限制在那里,但没有设置前门ID。

{
            "type": "Microsoft.Web/sites/config",
            "apiVersion": "2020-12-01",
            "name": "[concat(variables('myApp'), '/web')]",
            "location": "[parameters('location')]",
            "dependsOn": [
                "[resourceId('Microsoft.Web/sites', variables('myApp'))]"
            ],
            "properties": {
                "ipSecurityRestrictions": [
                    {
                        "ipAddress": "AzureFrontDoor.Backend",
                        "action": "Allow",
                        "tag": "ServiceTag",
                        "priority": 300,
                        "name": "Restrict-FrontDoor",
                        "headers": {"X-Azure-FDID": "[parameters('frontDoorID')]"}
                    }
                ]
            }
        }

推荐答案

近乎摊牌,但安谋中国之争远未结束

每个标头都接受一个对象数组,例如应该为您工作的对象:

{
  "type": "Microsoft.Web/sites/config",
  "apiVersion": "2020-12-01",
  "name": "[concat(variables('myApp'), '/web')]",
  "location": "[parameters('location')]",
  "dependsOn": [
    "[resourceId('Microsoft.Web/sites', variables('myApp'))]"
  ],
  "properties": {
    "ipSecurityRestrictions": [
      {
        "ipAddress": "AzureFrontDoor.Backend",
        "action": "Allow",
        "tag": "ServiceTag",
        "priority": 300,
        "name": "Restrict-FrontDoor",
        "headers": {
          "x-azure-fdid": [
            "[parameters('frontDoorID')]"
          ]
        }
      }
    ]
  }
}