vnet-nsg-reslock.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "virtualNetworkName": {
      "type": "string",
      "defaultValue": "Demo_ARM_VNet",
      "metadata": {
        "description": "This is your Virtual Network"
      }
    },
    "addressPrefix": {
      "type": "string",
      "defaultValue": "10.7.0.0/16",
      "metadata": {
        "description": "The CIDR address space for your Virtual Network in Azure"
      }
    },
    "FESubnetPrefix": {
      "type": "string",
      "defaultValue": "10.7.1.0/24",
      "metadata": {
        "description": "This is CIDR prefix for the FrontEnd Subnet"
      }
    },
    "AppSubnetPrefix": {
      "type": "string",
      "defaultValue": "10.7.2.0/24",
      "metadata": {
        "description": "This is CIDR prefix for the Application Subnet"
      }
    },
    "BESubnetPrefix": {
      "type": "string",
      "defaultValue": "10.7.3.0/24",
      "metadata": {
        "description": "This is CIDR prefix for the Database Subnet"
      }
    },
    "FENSGName": {
      "type": "string",
      "defaultValue": "FE_NSG",
      "metadata": {
        "description": "This is name of the networkSecurityGroup that will be assigned to FrontEnd Subnet"
      }
    },
    "AppNSGName": {
      "type": "string",
      "defaultValue": "App_NSG",
      "metadata": {
        "description": "This is name of the networkSecurityGroup that will be assigned to Application Subnet"
      }
    },
    "BENSGName": {
      "type": "string",
      "defaultValue": "BE_NSG",
      "metadata": {
        "description": "This is name of the networkSecurityGroup that will be assigned to Database Subnet"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources."
      }
    }
  },
  "resources": [
    {
      "apiVersion": "2015-05-01-preview",
      "type": "Microsoft.Network/networkSecurityGroups",
      "name": "[parameters('FENSGName')]",
      "location": "[parameters('location')]",
      "properties": {
        "securityRules": [
          {
            "name": "rdp_rule",
            "properties": {
              "description": "Allow RDP",
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "3389",
              "sourceAddressPrefix": "Internet",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 100,
              "direction": "Inbound"
            }
          },
          {
            "name": "web_rule",
            "properties": {
              "description": "Allow WEB",
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "80",
              "sourceAddressPrefix": "Internet",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 101,
              "direction": "Inbound"
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2015-05-01-preview",
      "type": "Microsoft.Network/networkSecurityGroups",
      "name": "[parameters('AppNSGName')]",
      "location": "[parameters('location')]",
      "properties": {
        "securityRules": [
          {
            "name": "Allow_FE",
            "properties": {
              "description": "Allow FE Subnet",
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "443",
              "sourceAddressPrefix": "[parameters('FESubnetPrefix')]",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 100,
              "direction": "Inbound"
            }
          },
          {
            "name": "Block_RDP_Internet",
            "properties": {
              "description": "Block RDP",
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "3389",
              "sourceAddressPrefix": "Internet",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 101,
              "direction": "Inbound"
            }
          },
          {
            "name": "Block_Internet_Outbound",
            "properties": {
              "description": "Block Internet",
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "Internet",
              "access": "Deny",
              "priority": 200,
              "direction": "Outbound"
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2015-05-01-preview",
      "type": "Microsoft.Network/networkSecurityGroups",
      "name": "[parameters('BENSGName')]",
      "location": "[parameters('location')]",
      "properties": {
        "securityRules": [
          {
            "name": "Allow_App",
            "properties": {
              "description": "Allow APP Subnet",
              "protocol": "Tcp",
              "sourcePortRange": "*",
              "destinationPortRange": "1433",
              "sourceAddressPrefix": "[parameters('AppSubnetPrefix')]",
              "destinationAddressPrefix": "*",
              "access": "Allow",
              "priority": 100,
              "direction": "Inbound"
            }
          },
          {
            "name": "Block_FE",
            "properties": {
              "description": "Block FE Subnet",
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "[parameters('FESubnetPrefix')]",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 101,
              "direction": "Inbound"
            }
          },
          {
            "name": "Block_App",
            "properties": {
              "description": "Block App Subnet",
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "[parameters('AppSubnetPrefix')]",
              "destinationAddressPrefix": "*",
              "access": "Deny",
              "priority": 102,
              "direction": "Inbound"
            }
          },
          {
            "name": "Block_Internet",
            "properties": {
              "description": "Block Internet",
              "protocol": "*",
              "sourcePortRange": "*",
              "destinationPortRange": "*",
              "sourceAddressPrefix": "*",
              "destinationAddressPrefix": "Internet",
              "access": "Deny",
              "priority": 200,
              "direction": "Outbound"
            }
          }
        ]
      }
    },
    {
      "apiVersion": "2015-05-01-preview",
      "type": "Microsoft.Network/virtualNetworks",
      "name": "[parameters('virtualNetworkName')]",
      "location": "[parameters('location')]",
      "dependsOn": [
        "[concat('Microsoft.Network/networkSecurityGroups/', parameters('FENSGName'))]",
        "[concat('Microsoft.Network/networkSecurityGroups/', parameters('AppNSGName'))]",
        "[concat('Microsoft.Network/networkSecurityGroups/', parameters('BENSGName'))]"
      ],
      "properties": {
        "addressSpace": {
          "addressPrefixes": [
            "[parameters('addressPrefix')]"
          ]
        },
        "subnets": [
          {
            "name": "FESubnet",
            "properties": {
              "addressPrefix": "[parameters('FESubnetPrefix')]",
              "networkSecurityGroup": {
                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('FENSGName'))]"
              }
            }
          },
          {
            "name": "AppSubnet",
            "properties": {
              "addressPrefix": "[parameters('AppSubnetPrefix')]",
              "networkSecurityGroup": {
                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('AppNSGName'))]"
              }
            }
          },
          {
            "name": "BESubnet",
            "properties": {
              "addressPrefix": "[parameters('BESubnetPrefix')]",
              "networkSecurityGroup": {
                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('BENSGName'))]"
              }
            }
          }
        ]
      }
    },
    {
            "type": "Microsoft.Authorization/locks",
            "apiVersion": "2015-01-01",
            "name": "MyResGrpLock",
            "properties":
            {
                "level": "CanNotDelete",
                "notes": "Lock to prevent resource group deletion"
            }
        }
  ]
}