This scripted action adds private endpoints and service endpoints so that the Nerdio Manager app service can reach its SQL database, key vault, and automation accounts over a private network, with no traffic routed over the public internet. It then restricts public access to the database, the key vault, and the other components that it covers.
You can run the script again at any time to bring newly enabled components onto the same private network. The script never re-enables public access on anything that a previous run restricted.
The script covers the following components, if they are deployed in your environment:
-
Nerdio Manager: the key vault, SQL server, Nerdio Manager automation account, scripted actions automation account, app service, DPS storage account, and scripted actions storage account.
-
Cost Calculator: the key vault, storage account, and web app.
-
Intune Insights: the key vault, SQL server, and web app.
-
Real Time Insights: the key vault, SQL server, web app, and storage account.
If you enable a component after you run the script, run the script again to bring it onto the same private network. The script doesn't handle Azure Monitor, Log Analytics, or Application Insights. See What the script doesn't make private.
Important
With the default CssaStorageAccount value (Restricted), or with Private, the script restricts public access to the scripted actions storage account. If your Azure runbooks run in download mode, Azure Automation can no longer download the script for any scripted action after that, and every later scripted action silently does nothing. This includes a later run of this script. Switch the Azure Runbook Execution Mode to Inline Script before you run the script. See Scripted actions for Azure runbooks for details.
-
Link the virtual networks whose hosts need access to the scripted actions storage account, or to the Real Time Insights app service, to Nerdio Manager. The
Restrictedsettings allow access only from the subnets of linked networks. See Azure Environment: linked networks and resource groups. -
Make sure that the following PowerShell modules are available in the scripted actions automation account:
Az.Accounts,Az.Resources,Az.KeyVault,Az.Sql,Az.Storage,Az.Websites,Az.Network,Az.PrivateDns, andAz.Automation. If a module is missing, the script stops before it changes anything and names the module.
When you run the script, it does the following:
-
Creates the private endpoint VNet and its subnets, or uses the ones that already exist. The script looks for the VNet in the Nerdio Manager resource group first, and then in the rest of the subscription.
-
Creates private DNS zones and links them to the VNet, or uses your existing zones (see
ExistingDNSZonesRGandSkipDNS). The script searches the subscription for existing private endpoints. -
Creates the private endpoints, connects the app services to the app service subnet, and peers the VNets that you specify.
-
Runs a connectivity probe from inside the VNet-integrated app service worker to the key vault (port 443), the SQL server (port 1433), and the DPS storage account (blob, port 443). If any target fails, the script stops with an error and nothing is made private on that run.
-
Disables public network access on the components that it covers, subject to the parameters below. If any private endpoint or DNS zone group fails to be created, the script makes nothing private and lists the components that failed.
-
Sets the minimum TLS version to 1.2 on the storage accounts and SQL servers, and disallows anonymous public blob access on the storage accounts.
-
Warns about network security groups and route tables that are attached to the private endpoint subnet or the app service subnet. The script only reports them. It doesn't change them.
-
Restarts the Nerdio Manager app service.
If the same script ran in the previous 10 minutes, the script replays the output of that earlier run instead of running again.
To customize the names of the resources that the script creates, such as private endpoint names, clone the script and edit the variables at the top of the script.
The following parameters can be specified at runtime:
|
Parameter |
Default |
Description |
|---|---|---|
|
|
|
VNet for private endpoints. If the VNet does not exist, it is created. If you specify an existing VNet, the VNet or its resource group must be linked to Nerdio Manager in System > Settings > Azure. |
|
|
|
Address range for the private endpoint VNet. Ignored if the VNet already exists. |
|
|
|
Name of the private endpoint subnet. If the subnet does not exist, it is created. |
|
|
|
Address range for the private endpoint subnet. Ignored if the subnet already exists. |
|
|
|
Name of the app service subnet. If the subnet does not exist, it is created. |
|
|
|
Address range for the app service subnet. Ignored if the subnet already exists. To resize an existing subnet, see Resize the app service subnet. |
|
|
None |
If you have private DNS zones already configured for use with the new private endpoints, specify their resource group here. The script finds and uses the existing DNS zones. See Private DNS zones for the zone names. NoteThis resource group must be linked to Nerdio Manager in System > Settings > Azure, or Nerdio Manager must be granted the Private DNS Zone Contributor role on the zones. |
|
|
None |
The subscription ID of |
|
|
|
Controls network access to the scripted actions storage account. Valid values are:
The script doesn't enable service endpoints on subnets that it didn't create. It reports the subnets that don't have one, and skips them. If no linked network has a subnet with the service endpoint, A more restrictive setting is never relaxed on a later run. To allow public access again, change it in the Azure portal. NoteWith |
|
|
None |
Optional. Valid values are If |
|
|
|
Limits access to the Nerdio Manager app service and the Intune Insights web app. If you set it to WarningYou might no longer be able to access Nerdio Manager after you enable this option. Setting the parameter back to |
|
|
|
Controls network access to the Real Time Insights app service. Valid values are:
Warning
|
|
|
|
Skips all DNS zone creation, lookup, and linking, including the zone groups that write the A records for the private endpoints. Use it only if you manage DNS yourself. The script stops with an error if you set both WarningThe script can still disable public access on the key vault and SQL server in the same run. Until your DNS records resolve to the private endpoints, Nerdio Manager can't reach them. |
The following table shows how the script controls public access to each app service.
|
App service |
Controlled by |
Behavior |
|---|---|---|
|
Nerdio Manager app service |
|
If set to |
|
Intune Insights web app |
|
Follows the Nerdio Manager app service, because it is displayed inside Nerdio Manager. |
|
Cost Calculator web app |
Not configurable |
Always made private, regardless of |
|
Real Time Insights app service |
|
|
-
Azure Resource Manager control plane traffic (
management.azure.com, ormanagement.usgovcloudapi.netin US Government clouds). -
Azure Monitor, Log Analytics workspaces, and Application Insights. The script doesn't change them.
-
The queue and file sub-resources of storage accounts. The script creates a blob private endpoint for each storage account that it covers, and a table private endpoint for the Real Time Insights storage account, because nothing in Nerdio Manager uses the others.
The script creates the following private DNS zones, or finds them in ExistingDNSZonesRG:
|
Service |
Azure commercial |
Azure US Government |
|---|---|---|
|
Key vault |
|
|
|
SQL server |
|
|
|
Automation |
|
|
|
Blob storage |
|
|
|
Table storage |
|
|
|
App service |
|
|
The script only ever disables public network access. It never re-enables it. To allow public access to a resource again, change its networking settings in the Azure portal.
-
If you set
SkipDNStotrueand the DNS records for the private endpoints don't resolve to the private IP addresses, Nerdio Manager can't reach its key vault and SQL server, and the app fails to load with a 500.30 error. Create the DNS records, or allow public access to the key vault and SQL server in the Azure portal until they resolve. -
If you can't reach Nerdio Manager after you set
MakeAppServicePrivatetotrue, connect from a host on the private VNet or a peered VNet, or allow public access to the app service in the Azure portal. -
If scripted actions stop running after the scripted actions storage account was restricted, switch the Azure Runbook Execution Mode to Inline Script. See Scripted actions for Azure runbooks.
The script doesn't change the address range of an app service subnet that already exists. Azure requires a subnet of /28 or larger for App Service regional VNet integration, and a /26 is recommended for the up to four apps that integrate into the subnet: the Nerdio Manager app service, Intune Insights, Cost Calculator, and Real Time Insights. Previous versions of the script created a /28 subnet. The default is now a /26.
The script stops with an error if the existing subnet is smaller than a /28, and warns if it is a /27 or a /28. You can't widen the range of a subnet while apps are integrated with it.
To widen an existing app service subnet:
-
In the Azure portal, remove the VNet integration from each app that uses the subnet.
-
Change the address range of the subnet to a /26 or larger.
-
Run the script again. It integrates the apps with the subnet again.
Comments (0 comments)