Skip to content

feat (iac): [secure-hybrid-network] replace individual VMs with VMSS #262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ferantivero wants to merge 7 commits into
base: main
Choose a base branch
from
Open

feat (iac): [secure-hybrid-network] replace individual VMs with VMSS #262

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3bd0f4b
remove individual VMs and NICs from azure-network template
ferantivero May 11, 2026
4add7b7
add VMSS resource to replace individual VMs
ferantivero May 13, 2026
962aa1d
update diagram to display vmss
ferantivero May 11, 2026
9a4e227
rename windowsVMCount to webServerInstanceCount
ferantivero May 13, 2026
3efedb7
add hub-to-spoke VNet peering with gateway transit
ferantivero May 13, 2026
ddf5d74
fix Bicep compiler warnings (BCP318, BCP035)
ferantivero May 15, 2026
aa40f98
upgrade VPN gateway to zone-redundant AZ SKU
ferantivero May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified solutions/secure-hybrid-network/images/dmz-private.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
224 changes: 127 additions & 97 deletions solutions/secure-hybrid-network/nestedtemplates/azure-network-azuredeploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ param adminUserName string = 'azureadmin'
param adminPassword string

@description('The count of Windows virtual machines to create.')
param windowsVMCount int = 2
param webServerInstanceCount int = 2
param vmSize string = 'Standard_A4_v2'
param configureSitetosite bool = true
param hubNetwork object = {
Expand Down Expand Up @@ -54,8 +54,7 @@ param internalLoadBalancer object = {
param location string = resourceGroup().location

var logAnalyticsWorkspaceName = 'la-${uniqueString(subscription().subscriptionId, resourceGroup().id)}'
var nicNameWebName = 'nic-web-server'
var vmNameWebName = 'vm-web-server'
var vmssName = 'vmss-web-server'
var windowsOSVersion = '2016-Datacenter'

resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2025-02-01' = {
Expand Down Expand Up @@ -318,6 +317,35 @@ resource spokeNetworkResource 'Microsoft.Network/virtualNetworks@2024-05-01' = {
}
}

resource hubToSpokePeering 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings@2024-05-01' = {
parent: hubNetworkResource
name: 'hub-to-spoke'
properties: {
remoteVirtualNetwork: {
id: spokeNetworkResource.id
}
allowForwardedTraffic: true
allowGatewayTransit: true
allowVirtualNetworkAccess: true
}
}

resource spokeToHubPeering 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings@2024-05-01' = {
parent: spokeNetworkResource
name: 'spoke-to-hub'
dependsOn: [
vpnGatewayResource
]
properties: {
remoteVirtualNetwork: {
id: hubNetworkResource.id
}
allowForwardedTraffic: true
useRemoteGateways: configureSitetosite
allowVirtualNetworkAccess: true
}
}

resource bastionHost_nsgName_Microsoft_Insights_default_logAnalyticsWorkspace 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
scope: bastionHost_nsg
name: logAnalyticsWorkspaceName
Expand Down Expand Up @@ -394,6 +422,7 @@ resource vpnGateway_publicIPAddress 'Microsoft.Network/publicIPAddresses@2024-05
name: 'Standard'
tier: 'Regional'
}
zones: pickZones('Microsoft.Network', 'publicIPAddresses', location, 3)
properties: {
publicIPAllocationMethod: 'Static'
}
Expand All @@ -418,8 +447,8 @@ resource vpnGatewayResource 'Microsoft.Network/virtualNetworkGateways@2024-05-01
}
]
sku: {
name: 'VpnGw2'
tier: 'VpnGw2'
name: 'VpnGw2AZ'
tier: 'VpnGw2AZ'
}
gatewayType: 'Vpn'
vpnType: 'RouteBased'
Expand Down Expand Up @@ -667,111 +696,112 @@ resource spokeRoutes_tableName_spokeRoutes_routeNameFirewall 'Microsoft.Network/
}
}

resource nicNameWeb 'Microsoft.Network/networkInterfaces@2024-05-01' = [for i in range(0, windowsVMCount): {
name: '${nicNameWebName}${i}'
location: location
properties: {
ipConfigurations: [
{
name: 'ipconfig'
properties: {
privateIPAllocationMethod: 'Dynamic'
subnet: {
id: resourceId('Microsoft.Network/virtualNetworks/subnets', spokeNetworkResource.name, spokeNetwork.subnetName)
}
loadBalancerBackendAddressPools: [
{
id: resourceId('Microsoft.Network/loadBalancers/backendAddressPools', internalLoadBalancer.name, internalLoadBalancer.backendName)
}
]
}
}
]
}
dependsOn:[
internalLoadBalancerResource]
}]

resource vmNameWeb 'Microsoft.Compute/virtualMachines@2024-11-01' = [for i in range(0, windowsVMCount): {
name: '${vmNameWebName}${i}'
resource vmssWeb 'Microsoft.Compute/virtualMachineScaleSets@2024-11-01' = {
name: vmssName
location: location
identity: {
// It is required by the Guest Configuration extension.
// Required by the Guest Configuration extension.
type: 'SystemAssigned'
}
sku: {
name: vmSize
tier: 'Standard'
capacity: webServerInstanceCount
}
properties: {
hardwareProfile: {
vmSize: vmSize
orchestrationMode: 'Uniform'
overprovision: false
// Manual upgrade policy keeps instance upgrades explicit. Use 'Rolling' with a
// health probe for automated rollouts in production workloads.
upgradePolicy: {
mode: 'Manual'
}
osProfile: {
computerName: '${vmNameWebName}${i}'
adminUsername: adminUserName
adminPassword: adminPassword
windowsConfiguration: {
enableAutomaticUpdates: true
patchSettings: {
//Machines should be configured to periodically check for missing system updates
assessmentMode: 'AutomaticByPlatform'
patchMode: 'AutomaticByPlatform'
virtualMachineProfile: {
osProfile: {
computerNamePrefix: 'websvr'
adminUsername: adminUserName
adminPassword: adminPassword
windowsConfiguration: {
enableAutomaticUpdates: true
}
}
}
storageProfile: {
imageReference: {
publisher: 'MicrosoftWindowsServer'
offer: 'WindowsServer'
sku: windowsOSVersion
version: 'latest'
storageProfile: {
imageReference: {
publisher: 'MicrosoftWindowsServer'
offer: 'WindowsServer'
sku: windowsOSVersion
version: 'latest'
}
osDisk: {
createOption: 'FromImage'
}
}
osDisk: {
createOption: 'FromImage'
networkProfile: {
networkInterfaceConfigurations: [
{
name: '${vmssName}-nic'
properties: {
primary: true
ipConfigurations: [
{
name: 'ipconfig'
properties: {
primary: true
subnet: {
id: resourceId('Microsoft.Network/virtualNetworks/subnets', spokeNetworkResource.name, spokeNetwork.subnetName)
}
loadBalancerBackendAddressPools: [
{
id: resourceId('Microsoft.Network/loadBalancers/backendAddressPools', internalLoadBalancer.name, internalLoadBalancer.backendName)
}
]
}
}
]
}
}
]
}
securityProfile: {
// We recommend enabling encryption at host for virtual machines and virtual machine scale sets to harden security.
encryptionAtHost: false
}
extensionProfile: {
extensions: [
{
name: 'installIIS'
properties: {
publisher: 'Microsoft.Compute'
type: 'CustomScriptExtension'
typeHandlerVersion: '1.7'
autoUpgradeMinorVersion: true
settings: {
commandToExecute: 'powershell.exe Install-WindowsFeature -name Web-Server -IncludeManagementTools'
}
}
}
{
name: 'AzurePolicyforWindows'
properties: {
publisher: 'Microsoft.GuestConfiguration'
type: 'ConfigurationforWindows'
typeHandlerVersion: '1.0'
autoUpgradeMinorVersion: true
enableAutomaticUpgrade: true
settings: {}
protectedSettings: {}
}
}
]
}
}
networkProfile: {
networkInterfaces: [
{
id: nicNameWeb[i].id
}
]
}
securityProfile: {
// We recommend enabling encryption at host for virtual machines and virtual machine scale sets to harden security.
encryptionAtHost: false
}
}}]

resource vmNameWeb_installIIS 'Microsoft.Compute/virtualMachines/extensions@2024-11-01' = [for i in range(0, windowsVMCount): {
parent: vmNameWeb [i]
name: 'installIIS'
location: location
properties: {
publisher: 'Microsoft.Compute'
type: 'CustomScriptExtension'
typeHandlerVersion: '1.7'
autoUpgradeMinorVersion: true
settings: {
commandToExecute: 'powershell.exe Install-WindowsFeature -name Web-Server -IncludeManagementTools'
}
}
}]

resource guestConfigExtensionWindows 'Microsoft.Compute/virtualMachines/extensions@2024-11-01' = [for i in range(0, windowsVMCount): {
parent: vmNameWeb[i]
name: 'AzurePolicyforWindows${vmNameWeb[i].name}'
location: location
properties: {
publisher: 'Microsoft.GuestConfiguration'
type: 'ConfigurationforWindows'
typeHandlerVersion: '1.0'
autoUpgradeMinorVersion: true
enableAutomaticUpgrade: true
settings: {}
protectedSettings: {}
}
}
]
dependsOn: [
internalLoadBalancerResource
]
}

output vpnIp string = vpnGatewayResource.properties.bgpSettings.bgpPeeringAddresses[0].tunnelIpAddresses[0]
output vpnIp string = vpnGatewayResource!.properties.bgpSettings.bgpPeeringAddresses[0].tunnelIpAddresses[0]
output mocOnpremNetwork string = hubNetwork.addressPrefix
output spokeNetworkAddressPrefix string = spokeNetwork.addressPrefix
output azureGatewayName string = vpnGateway.name
Expand Down
Loading
Loading