Skip to content

Commit 5d92e90

Browse files
alexottalexott
authored
Updates to adb-exfiltration-protection module and example (#133)
Changes include: * removed `plsubnet` resource as it's not necessary here * removed PL-related network settings * we don't need `extended_infra_ip` anymore * added `tags` variable to the example
1 parent 32c373b commit 5d92e90

File tree

8 files changed

+28
-50
lines changed

8 files changed

+28
-50
lines changed

‎examples/adb-exfiltration-protection/README.md

+1-2
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@ No modules.
7777
| [azurerm_storage_account.allowedstorage](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/storage_account) | resource |
7878
| [azurerm_storage_account.deniedstorage](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/storage_account) | resource |
7979
| [azurerm_subnet.hubfw](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
80-
| [azurerm_subnet.plsubnet](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
8180
| [azurerm_subnet.private](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
8281
| [azurerm_subnet.public](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
8382
| [azurerm_subnet_network_security_group_association.private](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet_network_security_group_association) | resource |
@@ -119,4 +118,4 @@ No modules.
119118
| <a name="output_databricks_azure_workspace_resource_id"></a> [databricks\_azure\_workspace\_resource\_id](#output\_databricks\_azure\_workspace\_resource\_id) | n/a |
120119
| <a name="output_resource_group"></a> [resource\_group](#output\_resource\_group) | n/a |
121120
| <a name="output_workspace_url"></a> [workspace\_url](#output\_workspace\_url) | n/a |
122-
<!-- END_TF_DOCS -->
121+
<!-- END_TF_DOCS -->

‎examples/adb-exfiltration-protection/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ module "adb-exfiltration-protection" {
1919
metastore = var.metastore
2020
scc_relay = var.scc_relay
2121
webapp_ips = var.webapp_ips
22-
extended_infra_ip = var.extended_infra_ip
2322
dbfs_prefix = var.dbfs_prefix
2423
workspace_prefix = var.workspace_prefix
2524
firewallfqdn = var.firewallfqdn
2625
eventhubs = var.eventhubs
26+
tags = var.tags
2727
}

‎examples/adb-exfiltration-protection/terraform.tfvars

+19-7
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,11 @@ hubcidr = "10.178.0.0/20"
22
spokecidr = "10.179.0.0/20"
33
no_public_ip = true
44
rglocation = "westeurope"
5-
metastore = ["consolidated-westeurope-prod-metastore.mysql.database.azure.com",
5+
# We can pull this information automatically, i.e. from
6+
# https://github.com/microsoft/AzureTRE/blob/main/templates/workspace_services/databricks/terraform/databricks-udr.json
7+
# that is maintained by Microsoft team (although it may not be updated immediately).
8+
metastore = [
9+
"consolidated-westeurope-prod-metastore.mysql.database.azure.com",
610
"consolidated-westeurope-prod-metastore-addl-1.mysql.database.azure.com",
711
"consolidated-westeurope-prod-metastore-addl-2.mysql.database.azure.com",
812
"consolidated-westeurope-prod-metastore-addl-3.mysql.database.azure.com",
@@ -12,15 +16,23 @@ metastore = ["consolidated-westeurope-prod-metastore.mysql.database.azure.com",
1216
"consolidated-westeuropec2-prod-metastore-3.mysql.database.azure.com",
1317
]
1418
// get from https://learn.microsoft.com/en-us/azure/databricks/resources/supported-regions#--metastore-artifact-blob-storage-system-tables-blob-storage-log-blob-storage-and-event-hub-endpoint-ip-addresses
15-
scc_relay = ["tunnel.westeurope.azuredatabricks.net", "tunnel.westeuropec2.azuredatabricks.net"]
16-
webapp_ips = ["52.230.27.216/32", "40.74.30.80/32"]
17-
eventhubs = ["prod-westeurope-observabilityeventhubs.servicebus.windows.net",
19+
scc_relay = [
20+
"tunnel.westeurope.azuredatabricks.net",
21+
"tunnel.westeuropec2.azuredatabricks.net"
22+
]
23+
webapp_ips = [
24+
"52.232.19.246/32",
25+
"40.74.30.80/32",
26+
"20.103.219.240/28",
27+
"4.150.168.160/28",
28+
]
29+
eventhubs = [
30+
"prod-westeurope-observabilityeventhubs.servicebus.windows.net",
1831
"prod-westeuc2-observabilityeventhubs.servicebus.windows.net",
1932
]
20-
extended_infra_ip = "20.73.215.48/28"
2133
dbfs_prefix = "dbfs"
2234
workspace_prefix = "adb"
23-
firewallfqdn = [ // dbfs rule will be added - depends on dbfs storage name
35+
firewallfqdn = [ // dbfs rule will be added - depends on dbfs storage name
2436
"dbartifactsprodwesteu.blob.core.windows.net", //databricks artifacts
2537
"arprodwesteua1.blob.core.windows.net",
2638
"arprodwesteua2.blob.core.windows.net",
@@ -47,7 +59,7 @@ firewallfqdn = [ // dbfs rule will be added - de
4759
"arprodwesteua23.blob.core.windows.net",
4860
"arprodwesteua24.blob.core.windows.net",
4961
"dbartifactsprodnortheu.blob.core.windows.net", //databricks artifacts secondary
50-
"ucstprdwesteu.blob.core.windows.net", // system tables storage
62+
"ucstprdwesteu.dfs.core.windows.net", // system tables storage
5163
"dblogprodwesteurope.blob.core.windows.net", //log blob
5264
"cdnjs.com", //ganglia
5365
// Azure monitor

‎examples/adb-exfiltration-protection/variables.tf

+6-5
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,6 @@ variable "webapp_ips" {
3636
type = list(string)
3737
}
3838

39-
variable "extended_infra_ip" {
40-
description = "IP range for Azure Databricks extended infrastructure"
41-
type = string
42-
}
43-
4439
variable "eventhubs" {
4540
description = "List of FQDNs for Azure Databricks EventHubs traffic"
4641
type = list(string)
@@ -62,3 +57,9 @@ variable "firewallfqdn" {
6257
type = list(any)
6358
description = "List of domains names to put into application rules for handling of HTTPS traffic (Databricks storage accounts, etc.)"
6459
}
60+
61+
variable "tags" {
62+
description = "Additional tags to add to created resources"
63+
default = {}
64+
type = map(string)
65+
}

‎modules/adb-exfiltration-protection/README.md

-3
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ In `variables.tfvars`, set these variables (bigger regions have multiple instanc
4343
metastore = ["consolidated-westeurope-prod-metastore.mysql.database.azure.com"]
4444
scc_relay = ["tunnel.westeurope.azuredatabricks.net"]
4545
webapp_ips = ["52.230.27.216/32"] # given at UDR page
46-
extended_infra_ip = "20.73.215.48/28"
4746
eventhubs = ["prod-westeurope-observabilityeventhubs.servicebus.windows.net"]
4847
# find these for your region, follow Databricks blog tutorial.
4948
firewallfqdn = ["dbartifactsprodseap.blob.core.windows.net","dbartifactsprodeap.blob.core.windows.net","dblogprodseasia.blob.core.windows.net","cdnjs.com"]
@@ -85,7 +84,6 @@ No modules.
8584
| [azurerm_storage_account.allowedstorage](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/storage_account) | resource |
8685
| [azurerm_storage_account.deniedstorage](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/storage_account) | resource |
8786
| [azurerm_subnet.hubfw](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
88-
| [azurerm_subnet.plsubnet](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
8987
| [azurerm_subnet.private](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
9088
| [azurerm_subnet.public](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet) | resource |
9189
| [azurerm_subnet_network_security_group_association.private](https://registry.terraform.io/providers/hashicorp/azurerm/2.83.0/docs/resources/subnet_network_security_group_association) | resource |
@@ -106,7 +104,6 @@ No modules.
106104
| -------------------------------------------------------------------------------------------------------------- | ----------- | ----------- | ----------------- | :------: |
107105
| <a name="input_bypass_scc_relay"></a> [bypass\_scc\_relay](#input\_bypass\_scc\_relay) | n/a | `bool` | `true` | no |
108106
| <a name="input_dbfs_prefix"></a> [dbfs\_prefix](#input\_dbfs\_prefix) | n/a | `string` | `"dbfs"` | no |
109-
| <a name="input_extended_infra_ip"></a> [extended_infra_ip](#input\_extended_infra_ip) | n/a | `string` | n/a | yes |
110107
| <a name="input_eventhubs"></a> [eventhubs](#input\_eventhubs) | n/a | `list(string)` | n/a | yes |
111108
| <a name="input_firewallfqdn"></a> [firewallfqdn](#input\_firewallfqdn) | n/a | `list(string)` | n/a | yes |
112109
| <a name="input_hubcidr"></a> [hubcidr](#input\_hubcidr) | n/a | `string` | `"10.178.0.0/20"` | no |

‎modules/adb-exfiltration-protection/firewall.tf

+1-16
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ resource "azurerm_firewall_network_rule_collection" "adbfnetwork" {
5959
]
6060

6161
destination_ports = [
62-
"443", "8443", "8444",
62+
"443", "8443–8451",
6363
]
6464

6565
destination_addresses = var.webapp_ips
@@ -69,21 +69,6 @@ resource "azurerm_firewall_network_rule_collection" "adbfnetwork" {
6969
]
7070
}
7171

72-
rule {
73-
name = "databricks-extended_infra"
74-
75-
source_addresses = [
76-
join(", ", azurerm_subnet.public.address_prefixes),
77-
join(", ", azurerm_subnet.private.address_prefixes),
78-
]
79-
80-
destination_addresses = [var.extended_infra_ip]
81-
destination_ports = ["*"]
82-
protocols = [
83-
"TCP",
84-
]
85-
}
86-
8772
rule {
8873
name = "databricks-metastore"
8974

‎modules/adb-exfiltration-protection/variables.tf

-5
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,6 @@ variable "webapp_ips" {
3636
type = list(string)
3737
}
3838

39-
variable "extended_infra_ip" {
40-
description = "IP range for Azure Databricks extended infrastructure"
41-
type = string
42-
}
43-
4439
variable "eventhubs" {
4540
description = "List of FQDNs for Azure Databricks EventHubs traffic"
4641
type = list(string)

‎modules/adb-exfiltration-protection/vnet.tf

-11
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,6 @@ resource "azurerm_subnet" "private" {
4646
virtual_network_name = azurerm_virtual_network.this.name
4747
address_prefixes = [cidrsubnet(local.cidr, 3, 1)]
4848

49-
private_endpoint_network_policies_enabled = true
50-
private_link_service_network_policies_enabled = true
51-
5249
delegation {
5350
name = "databricks"
5451
service_delegation {
@@ -69,14 +66,6 @@ resource "azurerm_subnet_network_security_group_association" "private" {
6966
}
7067

7168

72-
resource "azurerm_subnet" "plsubnet" {
73-
name = "${local.prefix}-privatelink"
74-
resource_group_name = azurerm_resource_group.this.name
75-
virtual_network_name = azurerm_virtual_network.this.name
76-
address_prefixes = [cidrsubnet(local.cidr, 3, 2)]
77-
//private_endpoint_network_policies_enabled = true // set to true to disable subnet policy
78-
}
79-
8069
resource "azurerm_virtual_network" "hubvnet" {
8170
name = "${local.prefix}-hub-vnet"
8271
location = azurerm_resource_group.this.location

0 commit comments

Comments
 (0)