Skip to content

Instantly share code, notes, and snippets.

@haray-isao

haray-isao/Azure_IaaS_Security_Hands-on.json

Last active June 7, 2018 06:43
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save haray-isao/b270ee97f459e6a6b3f762b5f24b1446 to your computer and use it in GitHub Desktop.
Save haray-isao/b270ee97f459e6a6b3f762b5f24b1446 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Azure_IaaS_Security_Hands-on.json
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"adminUsername": {
"type": "string",
"metadata": {
"description": "Username for the Virtual Machine."
}
},
"adminPassword": {
"type": "securestring",
"metadata": {
"description": "Password for the Virtual Machine."
}
}
},
"variables": {
"storageAccountName": "[concat(uniquestring(resourceGroup().id), 'sawinvm')]",
"virtualNetworkName": "ho-vnet",
"addressPrefix": "192.168.0.0/16",
"subnetName1": "FrontendSubnet",
"subnetPrefix1": "192.168.1.0/24",
"subnetName2": "BackendSubnet",
"subnetPrefix2": "192.168.2.0/24",
"vmSize": "Standard_D2s_v3",
"vmName1": "HOVM-WEB01",
"vmName2": "HOVM-DB01",
"vm1PrivateIpAddress": "192.168.1.4",
"vm2PrivateIpAddress": "192.168.2.4",
"publicIPAddressNameLb": "web-lb-pip",
"availabilitySetName": "webserver-as",
"lbName": "web-lb",
"publicIPAddressLbID": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressNameLb'))]",
"lbID": "[resourceId('Microsoft.Network/loadBalancers',variables('lbName'))]",
"frontEndIPConfigID": "[concat(variables('lbID'),'/frontendIPConfigurations/LoadBalancerFrontEnd')]",
"lbPoolID": "[concat(variables('lbID'),'/backendAddressPools/BackendPool1')]",
"lbProbeID": "[concat(variables('lbID'),'/probes/tcpProbe')]",
"subnetRef1": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName1'))]",
"subnetRef2": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName2'))]"
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"name": "[variables('storageAccountName')]",
"apiVersion": "2017-06-01",
"location": "[resourceGroup().location]",
"sku": {
"name": "Standard_LRS"
},
"kind": "Storage",
"properties": {}
},
{
"type": "Microsoft.Compute/availabilitySets",
"name": "[variables('availabilitySetName')]",
"apiVersion": "2016-04-30-preview",
"location": "[resourceGroup().location]",
"properties": {
"platformFaultDomainCount": 2,
"platformUpdateDomainCount": 2,
"managed": true
}
},
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[concat(variables('vmName1'),'-pip')]",
"location": "[resourceGroup().location]",
"properties": {
"publicIPAllocationMethod": "Static"
}
},
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[concat(variables('vmName2'),'-pip')]",
"location": "[resourceGroup().location]",
"properties": {
"publicIPAllocationMethod": "Static"
}
},
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[variables('publicIPAddressNameLb')]",
"location": "[resourceGroup().location]",
"properties": {
"publicIPAllocationMethod": "Static"
}
},
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[variables('virtualNetworkName')]",
"location": "[resourceGroup().location]",
"dependsOn": [
"[concat('Microsoft.Network/networkSecurityGroups/', variables('subnetName1'),'-nsg')]",
"[concat('Microsoft.Network/networkSecurityGroups/', variables('subnetName2'),'-nsg')]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
"[variables('addressPrefix')]"
]
},
"subnets": [
{
"name": "[variables('subnetName1')]",
"properties": {
"addressPrefix": "[variables('subnetPrefix1')]",
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups',concat(variables('subnetName1'),'-nsg'))]"
}
}
},
{
"name": "[variables('subnetName2')]",
"properties": {
"addressPrefix": "[variables('subnetPrefix2')]",
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups',concat(variables('subnetName2'),'-nsg'))]"
}
}
}
]
}
},
{
"type": "Microsoft.Network/networkSecurityGroups",
"name": "[concat(variables('subnetName1'),'-nsg')]",
"apiVersion": "2017-06-01",
"location": "[resourceGroup().location]",
"properties": {
"securityRules": [
{
"name": "Allow-Inbound-ssh-Internet",
"properties": {
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "22",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 1000,
"direction": "Inbound"
}
}
]
}
},
{
"type": "Microsoft.Network/networkSecurityGroups",
"name": "[concat(variables('subnetName2'),'-nsg')]",
"apiVersion": "2017-06-01",
"location": "[resourceGroup().location]",
"properties": {
"securityRules": [
{
"name": "Allow-Inbound-ssh-Internet",
"properties": {
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "22",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 1000,
"direction": "Inbound"
}
}
]
}
},
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/networkInterfaces",
"name": "[concat(variables('vmName1'),'-nic')]",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses/', concat(variables('vmName1'),'-pip'))]",
"[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]",
"[concat('Microsoft.Network/loadBalancers/', variables('lbName'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAllocationMethod": "Static",
"privateIPAddress": "[variables('vm1PrivateIpAddress')]",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('vmName1'),'-pip'))]"
},
"subnet": {
"id": "[variables('subnetRef1')]"
},
"loadBalancerBackendAddressPools": [
{
"id": "[concat(variables('lbID'), '/backendAddressPools/BackendPool1')]"
}
],
"loadBalancerInboundNatRules": [
{
"id": "[concat(variables('lbID'),'/inboundNatRules/ssh-web')]"
}
]
}
}
]
}
},
{
"apiVersion": "2017-06-01",
"type": "Microsoft.Network/networkInterfaces",
"name": "[concat(variables('vmName2'),'-nic')]",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses/', concat(variables('vmName2'),'-pip'))]",
"[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]",
"[concat('Microsoft.Network/loadBalancers/', variables('lbName'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAllocationMethod": "Static",
"privateIPAddress": "[variables('vm2PrivateIpAddress')]",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(variables('vmName2'),'-pip'))]"
},
"subnet": {
"id": "[variables('subnetRef2')]"
}
}
}
]
}
},
{
"apiVersion": "2017-06-01",
"name": "[variables('lbName')]",
"type": "Microsoft.Network/loadBalancers",
"location": "[resourceGroup().location]",
"dependsOn": [
"[concat('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressNameLb'))]"
],
"properties": {
"frontendIPConfigurations": [
{
"name": "LoadBalancerFrontEnd",
"properties": {
"publicIPAddress": {
"id": "[variables('publicIPAddressLbID')]"
}
}
}
],
"backendAddressPools": [
{
"name": "BackendPool1"
}
],
"inboundNatRules": [
{
"name": "ssh-web",
"properties": {
"frontendIPConfiguration": {
"id": "[variables('frontEndIPConfigID')]"
},
"protocol": "tcp",
"frontendPort": 10022,
"backendPort": 22,
"enableFloatingIP": false
}
}
],
"loadBalancingRules": [
{
"name": "LBRule",
"properties": {
"frontendIPConfiguration": {
"id": "[variables('frontEndIPConfigID')]"
},
"backendAddressPool": {
"id": "[variables('lbPoolID')]"
},
"protocol": "tcp",
"frontendPort": 80,
"backendPort": 80,
"enableFloatingIP": false,
"idleTimeoutInMinutes": 5,
"probe": {
"id": "[variables('lbProbeID')]"
}
}
}
],
"probes": [
{
"name": "tcpProbe",
"properties": {
"protocol": "tcp",
"port": 22,
"intervalInSeconds": 5,
"numberOfProbes": 2
}
}
]
}
},
{
"apiVersion": "2017-03-30",
"type": "Microsoft.Compute/virtualMachines",
"name": "[variables('vmName1')]",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]",
"[resourceId('Microsoft.Network/networkInterfaces/', concat(variables('vmName1'),'-nic'))]"
],
"properties": {
"availabilitySet": {
"id": "[resourceId('Microsoft.Compute/availabilitySets',variables('availabilitySetName'))]"
},
"hardwareProfile": {
"vmSize": "[variables('vmSize')]"
},
"osProfile": {
"computerName": "[variables('vmName1')]",
"adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]"
},
"storageProfile": {
"imageReference": {
"publisher": "Canonical",
"offer": "UbuntuServer",
"sku": "16.04-LTS",
"version": "latest"
},
"osDisk": {
"createOption": "FromImage",
"managedDisk": {
"storageAccountType": "Premium_LRS"
}
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces', concat(variables('vmName1'),'-nic'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": true,
"storageUri": "[reference(resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))).primaryEndpoints.blob]"
}
}
},
"resources": []
},
{
"apiVersion": "2017-03-30",
"type": "Microsoft.Compute/virtualMachines",
"name": "[variables('vmName2')]",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]",
"[resourceId('Microsoft.Network/networkInterfaces/', concat(variables('vmName2'),'-nic'))]"
],
"properties": {
"hardwareProfile": {
"vmSize": "[variables('vmSize')]"
},
"osProfile": {
"computerName": "[variables('vmName2')]",
"adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]"
},
"storageProfile": {
"imageReference": {
"publisher": "Canonical",
"offer": "UbuntuServer",
"sku": "16.04-LTS",
"version": "latest"
},
"osDisk": {
"createOption": "FromImage",
"managedDisk": {
"storageAccountType": "Premium_LRS"
}
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces', concat(variables('vmName2'),'-nic'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": true,
"storageUri": "[reference(resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))).primaryEndpoints.blob]"
}
}
},
"resources": []
}
],
"outputs": {}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment