matthew-dupre/azure-arm-nsg-via-csv

Manage Azure NSG Rules via CSVs

azure-arm-nsg-via-csv

Manage Azure NSG Rules via CSVs

A variation on managing Azure NSGs in CSV files while continuing to use Azure Resource Manager (ARM) Templates as the IaC language.

Files

• nsg\template.json - The ARM template that deploys the NSGs.
• nsg\params\params-*.json - Parameters files for each NSG (subnet in this case). Folder and filenames would be reflect the complexity of your environment and mirror the naming scheme. (For example a params file per subnet NSG, naming that reflects subscription and region, and folders that group by department).
• nsg\csv*.csv - CSV files for each NSG (subnet in this case). This matches the params folder structure.

Workflow (End State)

1. Modify CSV files with an editor of choice: Notepad, Excel, VS Code, etc.
2. On commit a GitHub Action is triggered.
3. The action executes the NsgCsvToJson.ps1 script.
4. The script updates the csv, converts it to NSG Json format, and updates the corresponding params file. This params file, in combination with the ARM Template, can then be run in your environment.
5. The same flow applies to the template.csv file except this file updates the set of baseline rules contained in the template.json file.

Constraints

1. There is a set of Baseline rules that get included in EVERY NSG. For example rules that allow connections to DNS, AD, Patching, etc. These rules are captured in the ARM Template template.json
2. Application Security Groups are a convenient tool to reduce the number of IP addresses directly included in NSGs. They are limited to resources in the current VNET. In this example, ASGs are maintained in the NSG Template where they are used. The VNET Name is supplied to standardize naming but is not created for the purposes of this example.

azure-arm-nsg-via-csv's Issues

Template.json link in README isn't valid markdown relative path as it results in a 404 when navigating to it via GitHub

Template.json link in README apparently isn't valid markdown relative path as it results in a 404 when navigating to it via GitHub interface.

YML Pipeline...

Am pretty new to terraform, but would like to see capabilities, like using a CSV to drive NSG-Rules, or AzureFirewallPolicy-Rules.

Would just like to avoid giving staff an instruction like 'modify the csv, and 'run this powershell file with these arguments'.. It's just asking for human error.
Did you ever build a YML pipeline to run the Convert-ToCsvToJson.ps1, and or Convert-NsgJsonToCsv.ps1, for the given uploaded CSV file(s)?

Having a Validate-CSV task would also be good... too. Don't overwrite a valid json with an invalid one, just because of a new poor-quality CSV input file.