Virtual Network Architecture

Hub VNet:           10.0.0.0/16    (Central services)
  GatewaySubnet:      10.0.0.0/27    (VPN/ExpressRoute Gateway - required name)
  AzureFirewallSubnet:10.0.1.0/26    (Azure Firewall - minimum /26)
  AzureBastionSubnet: 10.0.2.0/26    (Azure Bastion - minimum /26)
  ManagementSubnet:   10.0.10.0/24   (Jump boxes, management tools)
  DNSResolverInbound: 10.0.11.0/28   (Private DNS Resolver inbound)
  DNSResolverOutbound:10.0.11.16/28  (Private DNS Resolver outbound)

Production VNet:    10.1.0.0/16    (Production workloads)
  AppGatewaySubnet:   10.1.0.0/24    (Application Gateway)
  WebTier:            10.1.1.0/24    (Frontend VMs/App Services)
  AppTier:            10.1.2.0/24    (API/Backend services)
  DataTier:           10.1.3.0/24    (Databases, caches)
  PrivateEndpoints:   10.1.4.0/24    (Private endpoints for PaaS)
  AKSNodes:           10.1.16.0/20   (AKS nodes - needs large range)
  AKSPods:            10.1.32.0/20   (AKS pod CIDR if using overlay)

Staging VNet:       10.2.0.0/16    (Staging environment)
  (similar subnet structure as production)

Development VNet:   10.3.0.0/16    (Development environment)
  (similar subnet structure, smaller subnets)

Reserved:           10.4.0.0/14    (Future environments/regions)
                    10.8.0.0/13    (Secondary region allocation)

param location string = resourceGroup().location

// Hub VNet with shared services subnets
resource hubVnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: 'hub-vnet'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: ['10.0.0.0/16']
    }
    subnets: [
      {
        name: 'GatewaySubnet'
        properties: {
          addressPrefix: '10.0.0.0/27'
        }
      }
      {
        name: 'AzureFirewallSubnet'
        properties: {
          addressPrefix: '10.0.1.0/26'
        }
      }
      {
        name: 'AzureBastionSubnet'
        properties: {
          addressPrefix: '10.0.2.0/26'
        }
      }
      {
        name: 'ManagementSubnet'
        properties: {
          addressPrefix: '10.0.10.0/24'
          networkSecurityGroup: {
            id: managementNsg.id
          }
        }
      }
    ]
  }
}

// Production Spoke VNet
resource prodSpokeVnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: 'prod-spoke-vnet'
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: ['10.1.0.0/16']
    }
    subnets: [
      {
        name: 'web-tier'
        properties: {
          addressPrefix: '10.1.1.0/24'
          networkSecurityGroup: { id: webTierNsg.id }
        }
      }
      {
        name: 'app-tier'
        properties: {
          addressPrefix: '10.1.2.0/24'
          networkSecurityGroup: { id: appTierNsg.id }
        }
      }
      {
        name: 'data-tier'
        properties: {
          addressPrefix: '10.1.3.0/24'
          networkSecurityGroup: { id: dataTierNsg.id }
        }
      }
      {
        name: 'private-endpoints'
        properties: {
          addressPrefix: '10.1.4.0/24'
        }
      }
    ]
  }
}

// Hub to Spoke peering (enable gateway transit)
resource hubToSpokePeering 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings@2023-05-01' = {
  parent: hubVnet
  name: 'hub-to-prod'
  properties: {
    remoteVirtualNetwork: { id: prodSpokeVnet.id }
    allowForwardedTraffic: true
    allowGatewayTransit: true
    allowVirtualNetworkAccess: true
  }
}

// Spoke to Hub peering (use remote gateways)
resource spokeToHubPeering 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings@2023-05-01' = {
  parent: prodSpokeVnet
  name: 'prod-to-hub'
  properties: {
    remoteVirtualNetwork: { id: hubVnet.id }
    allowForwardedTraffic: true
    useRemoteGateways: true
    allowVirtualNetworkAccess: true
  }
}

# Create Application Security Groups for each tier
az network asg create -g myRG -n web-servers --location eastus2
az network asg create -g myRG -n app-servers --location eastus2
az network asg create -g myRG -n db-servers --location eastus2

# Create NSG with tiered rules
az network nsg create -g myRG -n three-tier-nsg --location eastus2

# Rule 100: Allow HTTPS from internet to web tier
az network nsg rule create -g myRG --nsg-name three-tier-nsg \
  -n AllowHttpsInbound --priority 100 \
  --source-address-prefixes Internet \
  --destination-asgs web-servers \
  --destination-port-ranges 443 --protocol Tcp --access Allow \
  --direction Inbound

# Rule 200: Allow web tier to app tier on port 8080
az network nsg rule create -g myRG --nsg-name three-tier-nsg \
  -n AllowWebToApp --priority 200 \
  --source-asgs web-servers \
  --destination-asgs app-servers \
  --destination-port-ranges 8080 --protocol Tcp --access Allow \
  --direction Inbound

# Rule 300: Allow app tier to database on port 1433
az network nsg rule create -g myRG --nsg-name three-tier-nsg \
  -n AllowAppToDb --priority 300 \
  --source-asgs app-servers \
  --destination-asgs db-servers \
  --destination-port-ranges 1433 --protocol Tcp --access Allow \
  --direction Inbound

# Rule 400: Allow app tier to Redis cache on port 6380
az network nsg rule create -g myRG --nsg-name three-tier-nsg \
  -n AllowAppToRedis --priority 400 \
  --source-asgs app-servers \
  --destination-asgs db-servers \
  --destination-port-ranges 6380 --protocol Tcp --access Allow \
  --direction Inbound

# Rule 4096: Deny all other inbound (explicit)
az network nsg rule create -g myRG --nsg-name three-tier-nsg \
  -n DenyAllInbound --priority 4096 \
  --source-address-prefixes '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges '*' --protocol '*' --access Deny \
  --direction Inbound

param location string = resourceGroup().location

resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: 'mystorageacct'
  location: location
  sku: { name: 'Standard_ZRS' }
  kind: 'StorageV2'
  properties: {
    publicNetworkAccess: 'Disabled'
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
  }
}

resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-05-01' = {
  name: 'storage-pe'
  location: location
  properties: {
    subnet: {
      id: resourceId('Microsoft.Network/virtualNetworks/subnets', 'prod-spoke-vnet', 'private-endpoints')
    }
    privateLinkServiceConnections: [
      {
        name: 'storage-connection'
        properties: {
          privateLinkServiceId: storageAccount.id
          groupIds: ['blob']
        }
      }
    ]
  }
}

resource privateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
  name: 'privatelink.blob.core.windows.net'
  location: 'global'
}

resource dnsZoneLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = {
  parent: privateDnsZone
  name: 'hub-link'
  location: 'global'
  properties: {
    virtualNetwork: {
      id: resourceId('Microsoft.Network/virtualNetworks', 'hub-vnet')
    }
    registrationEnabled: false
  }
}

resource dnsZoneGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2023-05-01' = {
  parent: privateEndpoint
  name: 'default'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: 'config'
        properties: {
          privateDnsZoneId: privateDnsZone.id
        }
      }
    ]
  }
}

# Create a route table for spoke subnets
az network route-table create \
  --name spoke-to-firewall-rt \
  --resource-group myRG \
  --location eastus2 \
  --disable-bgp-route-propagation true

# Default route: all internet traffic goes to Azure Firewall
az network route-table route create \
  --name to-internet \
  --route-table-name spoke-to-firewall-rt \
  --resource-group myRG \
  --address-prefix 0.0.0.0/0 \
  --next-hop-type VirtualAppliance \
  --next-hop-ip-address 10.0.1.4

# Spoke-to-spoke traffic also goes through the firewall
az network route-table route create \
  --name to-staging-spoke \
  --route-table-name spoke-to-firewall-rt \
  --resource-group myRG \
  --address-prefix 10.2.0.0/16 \
  --next-hop-type VirtualAppliance \
  --next-hop-ip-address 10.0.1.4

# On-premises traffic goes through the firewall
az network route-table route create \
  --name to-onprem \
  --route-table-name spoke-to-firewall-rt \
  --resource-group myRG \
  --address-prefix 192.168.0.0/16 \
  --next-hop-type VirtualAppliance \
  --next-hop-ip-address 10.0.1.4

# Associate the route table with spoke subnets
az network vnet subnet update \
  --name web-tier \
  --vnet-name prod-spoke-vnet \
  --resource-group myRG \
  --route-table spoke-to-firewall-rt

az network vnet subnet update \
  --name app-tier \
  --vnet-name prod-spoke-vnet \
  --resource-group myRG \
  --route-table spoke-to-firewall-rt

# Create Azure Bastion (Standard SKU for native client support)
az network bastion create \
  --name hub-bastion \
  --resource-group myRG \
  --vnet-name hub-vnet \
  --sku Standard \
  --location eastus2

# Connect via native SSH client through Bastion tunnel
az network bastion ssh \
  --name hub-bastion \
  --resource-group myRG \
  --target-resource-id /subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Compute/virtualMachines/myVM \
  --auth-type ssh-key \
  --username azureuser \
  --ssh-key ~/.ssh/id_rsa

# Connect via native RDP client through Bastion tunnel
az network bastion rdp \
  --name hub-bastion \
  --resource-group myRG \
  --target-resource-id /subscriptions/<sub-id>/resourceGroups/myRG/providers/Microsoft.Compute/virtualMachines/myWindowsVM

resource denyPublicIPPolicy 'Microsoft.Authorization/policyDefinitions@2021-06-01' = {
  name: 'deny-public-ip'
  properties: {
    displayName: 'Deny Public IP Addresses'
    description: 'Prevents creation of public IP address resources to enforce private-only networking'
    policyType: 'Custom'
    mode: 'All'
    metadata: {
      category: 'Network'
    }
    policyRule: {
      if: {
        field: 'type'
        equals: 'Microsoft.Network/publicIPAddresses'
      }
      then: {
        effect: 'deny'
      }
    }
  }
}