Platformní služby Azure typicky běží na public endpointech a zejména při komunikaci z on-premises se vám může hodit znát rozsahy veřejných IP adres, na kterých běží. Důvody mohou být pro implementaci klasického pohledu na bezpečnost, ale také důvody praktické. Jsou služby, které mohou znamena masivní přenosy dat (třeba storage account) a hnát je přes bezpečnostní prvky typu HTTP proxy nebo IPS/NGFW je zbytečné, dráhé a může dokonce věci rozbíjet. Tak například některé tyto systémy nejsou dělané přenos velkých balíčků dat jako je 100MB block v blob storage (protože se třeba snaží v nich dělat antivirovou kontrolu) a komunikaci zahazují. Zkrátka někdy dává smysl z on-premises tyto služby směrovat jinak ať už z pohledu nastavení routingu nebo bezpečnostních pravidel.
Pokud budu mít VM v IaaS (tedy uvnitř svého VNETu), nabízí se několik řešení, které mohou svázat síťová pravidla a při tom zachovat funkčnost prostředí:
Jak svázat síťová pravidla pro přístup na PaaS služby z on-premises?
Ale co když potřebujete filtrovat u sebe, ale FQDN vaše zažízení neumí? A nebo co když potřebujete ovlivnit směrování třeba přes Policy Based Routing a tyto technologie také neumí FQDN
Postupoval bych tímto pořadím:
Pokud jste na konci seznamu pravděpodobně to znamená, že identitní parametr vám nestačí, Express Route nemáte, Private Link ještě není k dispozici a vaše bezpečnostní prvky neumí FQDN, jen IP pravidla. V ten moment se hodí vědět, na jakých IP daná PaaS běží - nedostanete konkrétní IP právě vaší instance, ale rozsah PaaS služby v daném regionu, což je určitě přísnější omezení, než povolit komunikaci na celý Internet. Kdy něco takového použít?
Nicméně rozsahy IP adres se mohou průběžně měnit. Ne často, ale stává se to. Musíte tedy vymyslet proces, ideálně automatizovaný, jak ve vašich krabičkách pravidla nastavovat. Aby se to právě automatizovat dalo, přináší Azure nové API, které vám řekne, jaké jsou aktuální rozsahy služeb. Je to v zásadě externí přístup k vyčítání Service Tagů tak, abyste je mohli použít u sebe. Dřív to šlo jen pravidelným stahováním souboru s těmito informacemi z webu. API umožňuje lepší automatizaci procesu.
Pro zjednodušení použijeme Azure CLI. U příkazu dáváte location (-l), nicméně příkaz vrací rozsahy ze všech regionů. To vás může trochu mást, ale jde o to, že API běží ve všech regionech a přepínač -l říká, který region chcete v rámci API zavolat. Nicméně každé volání vrací rozsahy všechny.
Nejprve se podíváme jaké tagy, tedy PaaS služby jsou v reportu k dispozici.
az network list-service-tags -l westeurope --query values[].name -o table
Result
---------------------------------------------
ApiManagement
ApiManagement.AustraliaCentral
ApiManagement.AustraliaCentral2
ApiManagement.AustraliaEast
ApiManagement.AustraliaSoutheast
ApiManagement.BrazilSouth
ApiManagement.CanadaCentral
ApiManagement.CanadaEast
ApiManagement.CentralIndia
ApiManagement.CentralUS
ApiManagement.CentralUSEUAP
ApiManagement.EastAsia
ApiManagement.EastUS
ApiManagement.EastUS2
ApiManagement.EastUS2EUAP
ApiManagement.FranceCentral
ApiManagement.FranceSouth
ApiManagement.JapanEast
ApiManagement.JapanWest
ApiManagement.KoreaCentral
ApiManagement.KoreaSouth
ApiManagement.NorthCentralUS
ApiManagement.NorthEurope
ApiManagement.SouthAfricaNorth
ApiManagement.SouthAfricaWest
ApiManagement.SouthCentralUS
ApiManagement.SoutheastAsia
ApiManagement.SouthIndia
ApiManagement.UAECentral
ApiManagement.UAENorth
ApiManagement.UKNorth
ApiManagement.UKSouth
ApiManagement.UKSouth2
ApiManagement.UKWest
ApiManagement.WestCentralUS
ApiManagement.WestEurope
ApiManagement.WestIndia
ApiManagement.WestUS
ApiManagement.WestUS2
AppService
AppService.AustraliaCentral
AppService.AustraliaCentral2
AppService.AustraliaEast
AppService.AustraliaSoutheast
AppService.BrazilSouth
AppService.CanadaCentral
AppService.CanadaEast
AppService.CentralIndia
AppService.CentralUS
AppService.CentralUSEUAP
AppService.EastAsia
AppService.EastUS
AppService.EastUS2
AppService.EastUS2EUAP
AppService.FranceCentral
AppService.FranceSouth
AppService.JapanEast
AppService.JapanWest
AppService.KoreaCentral
AppService.KoreaSouth
AppService.NorthCentralUS
AppService.NorthEurope
AppService.SouthAfricaNorth
AppService.SouthAfricaWest
AppService.SouthCentralUS
AppService.SoutheastAsia
AppService.SouthIndia
AppService.UAECentral
AppService.UAENorth
AppService.UKSouth
AppService.UKWest
AppService.WestCentralUS
AppService.WestEurope
AppService.WestIndia
AppService.WestUS
AppService.WestUS2
AppServiceManagement
AppServiceManagement.AustraliaCentral
AppServiceManagement.AustraliaCentral2
AppServiceManagement.AustraliaEast
AppServiceManagement.AustraliaSoutheast
AppServiceManagement.BrazilSouth
AppServiceManagement.CanadaCentral
AppServiceManagement.CanadaEast
AppServiceManagement.CentralIndia
AppServiceManagement.CentralUS
AppServiceManagement.EastAsia
AppServiceManagement.EastUS
AppServiceManagement.EastUS2
AppServiceManagement.EastUS2EUAP
AppServiceManagement.FranceCentral
AppServiceManagement.FranceSouth
AppServiceManagement.JapanEast
AppServiceManagement.JapanWest
AppServiceManagement.KoreaCentral
AppServiceManagement.KoreaSouth
AppServiceManagement.NorthCentralUS
AppServiceManagement.NorthEurope
AppServiceManagement.SouthAfricaNorth
AppServiceManagement.SouthAfricaWest
AppServiceManagement.SouthCentralUS
AppServiceManagement.SoutheastAsia
AppServiceManagement.SouthIndia
AppServiceManagement.UAECentral
AppServiceManagement.UAENorth
AppServiceManagement.UKNorth
AppServiceManagement.UKSouth
AppServiceManagement.UKSouth2
AppServiceManagement.UKWest
AppServiceManagement.WestCentralUS
AppServiceManagement.WestEurope
AppServiceManagement.WestIndia
AppServiceManagement.WestUS
AppServiceManagement.WestUS2
AzureActiveDirectory
AzureActiveDirectoryDomainServices
AzureCloud
AzureCloud.australiacentral
AzureCloud.australiacentral2
AzureCloud.australiaeast
AzureCloud.australiasoutheast
AzureCloud.brazilne
AzureCloud.brazilse
AzureCloud.brazilsouth
AzureCloud.canadacentral
AzureCloud.canadaeast
AzureCloud.centralfrance
AzureCloud.centralindia
AzureCloud.centralus
AzureCloud.centraluseuap
AzureCloud.chilec
AzureCloud.eastasia
AzureCloud.easteurope
AzureCloud.eastus
AzureCloud.eastus2
AzureCloud.eastus2euap
AzureCloud.japaneast
AzureCloud.japanwest
AzureCloud.koreacentral
AzureCloud.koreas2
AzureCloud.koreasouth
AzureCloud.northcentralus
AzureCloud.northeurope
AzureCloud.northeurope2
AzureCloud.southafricanorth
AzureCloud.southafricawest
AzureCloud.southcentralus
AzureCloud.southeastasia
AzureCloud.southfrance
AzureCloud.southindia
AzureCloud.uaecentral
AzureCloud.uaenorth
AzureCloud.uknorth
AzureCloud.uksouth
AzureCloud.uksouth2
AzureCloud.ukwest
AzureCloud.westcentralus
AzureCloud.westeurope
AzureCloud.westindia
AzureCloud.westus
AzureCloud.westus2
AzureConnectors
AzureConnectors.AustraliaCentral
AzureConnectors.AustraliaCentral2
AzureConnectors.AustraliaEast
AzureConnectors.AustraliaSoutheast
AzureConnectors.BrazilSouth
AzureConnectors.CanadaCentral
AzureConnectors.CanadaEast
AzureConnectors.CentralIndia
AzureConnectors.CentralUS
AzureConnectors.CentralUSEUAP
AzureConnectors.EastAsia
AzureConnectors.EastUS
AzureConnectors.EastUS2
AzureConnectors.EastUS2EUAP
AzureConnectors.FranceCentral
AzureConnectors.FranceSouth
AzureConnectors.JapanEast
AzureConnectors.JapanWest
AzureConnectors.KoreaCentral
AzureConnectors.KoreaSouth
AzureConnectors.NorthCentralUS
AzureConnectors.NorthEurope
AzureConnectors.SouthAfricaNorth
AzureConnectors.SouthAfricaWest
AzureConnectors.SouthCentralUS
AzureConnectors.SoutheastAsia
AzureConnectors.SouthIndia
AzureConnectors.UAECentral
AzureConnectors.UAENorth
AzureConnectors.UKNorth
AzureConnectors.UKSouth
AzureConnectors.UKSouth2
AzureConnectors.UKWest
AzureConnectors.WestCentralUS
AzureConnectors.WestEurope
AzureConnectors.WestIndia
AzureConnectors.WestUS
AzureConnectors.WestUS2
AzureContainerRegistry
AzureContainerRegistry.AustraliaEast
AzureContainerRegistry.AustraliaSoutheast
AzureContainerRegistry.BrazilSouth
AzureContainerRegistry.CanadaCentral
AzureContainerRegistry.CanadaEast
AzureContainerRegistry.CentralIndia
AzureContainerRegistry.CentralUS
AzureContainerRegistry.CentralUSEUAP
AzureContainerRegistry.EastAsia
AzureContainerRegistry.EastUS
AzureContainerRegistry.EastUS2
AzureContainerRegistry.EastUS2EUAP
AzureContainerRegistry.FranceCentral
AzureContainerRegistry.FranceSouth
AzureContainerRegistry.JapanEast
AzureContainerRegistry.JapanWest
AzureContainerRegistry.KoreaCentral
AzureContainerRegistry.KoreaSouth
AzureContainerRegistry.NorthCentralUS
AzureContainerRegistry.NorthEurope
AzureContainerRegistry.SouthAfricaNorth
AzureContainerRegistry.SouthAfricaWest
AzureContainerRegistry.SouthCentralUS
AzureContainerRegistry.SoutheastAsia
AzureContainerRegistry.SouthIndia
AzureContainerRegistry.UAECentral
AzureContainerRegistry.UAENorth
AzureContainerRegistry.UKNorth
AzureContainerRegistry.UKSouth
AzureContainerRegistry.UKSouth2
AzureContainerRegistry.UKWest
AzureContainerRegistry.WestCentralUS
AzureContainerRegistry.WestEurope
AzureContainerRegistry.WestIndia
AzureContainerRegistry.WestUS
AzureContainerRegistry.WestUS2
AzureCosmosDB
AzureCosmosDB.AustraliaCentral
AzureCosmosDB.AustraliaCentral2
AzureCosmosDB.AustraliaEast
AzureCosmosDB.AustraliaSoutheast
AzureCosmosDB.BrazilSouth
AzureCosmosDB.CanadaCentral
AzureCosmosDB.CanadaEast
AzureCosmosDB.CentralIndia
AzureCosmosDB.CentralUS
AzureCosmosDB.CentralUSEUAP
AzureCosmosDB.EastAsia
AzureCosmosDB.EastUS
AzureCosmosDB.EastUS2
AzureCosmosDB.EastUS2EUAP
AzureCosmosDB.FranceCentral
AzureCosmosDB.FranceSouth
AzureCosmosDB.JapanEast
AzureCosmosDB.JapanWest
AzureCosmosDB.KoreaCentral
AzureCosmosDB.KoreaSouth
AzureCosmosDB.NorthCentralUS
AzureCosmosDB.NorthEurope
AzureCosmosDB.SouthAfricaNorth
AzureCosmosDB.SouthAfricaWest
AzureCosmosDB.SouthCentralUS
AzureCosmosDB.SoutheastAsia
AzureCosmosDB.SouthIndia
AzureCosmosDB.UAECentral
AzureCosmosDB.UAENorth
AzureCosmosDB.UKNorth
AzureCosmosDB.UKSouth
AzureCosmosDB.UKSouth2
AzureCosmosDB.UKWest
AzureCosmosDB.WestCentralUS
AzureCosmosDB.WestEurope
AzureCosmosDB.WestIndia
AzureCosmosDB.WestUS
AzureCosmosDB.WestUS2
AzureDataLake
AzureDataLake.AustraliaSoutheast
AzureDataLake.CentralUS
AzureDataLake.EastUS2
AzureDataLake.NorthEurope
AzureDataLake.SoutheastAsia
AzureDataLake.WestEurope
AzureFrontDoor.Backend
AzureFrontDoor.Frontend
AzureKeyVault
AzureKeyVault.AustraliaCentral
AzureKeyVault.AustraliaCentral2
AzureKeyVault.AustraliaEast
AzureKeyVault.AustraliaSoutheast
AzureKeyVault.BrazilSouth
AzureKeyVault.CanadaCentral
AzureKeyVault.CanadaEast
AzureKeyVault.CentralIndia
AzureKeyVault.CentralUS
AzureKeyVault.CentralUSEUAP
AzureKeyVault.EastAsia
AzureKeyVault.EastUS
AzureKeyVault.EastUS2
AzureKeyVault.EastUS2EUAP
AzureKeyVault.FranceCentral
AzureKeyVault.FranceSouth
AzureKeyVault.JapanEast
AzureKeyVault.JapanWest
AzureKeyVault.KoreaCentral
AzureKeyVault.KoreaSouth
AzureKeyVault.NorthCentralUS
AzureKeyVault.NorthEurope
AzureKeyVault.SouthAfricaNorth
AzureKeyVault.SouthAfricaWest
AzureKeyVault.SouthCentralUS
AzureKeyVault.SoutheastAsia
AzureKeyVault.SouthIndia
AzureKeyVault.UAECentral
AzureKeyVault.UAENorth
AzureKeyVault.UKNorth
AzureKeyVault.UKSouth
AzureKeyVault.UKSouth2
AzureKeyVault.UKWest
AzureKeyVault.WestCentralUS
AzureKeyVault.WestEurope
AzureKeyVault.WestIndia
AzureKeyVault.WestUS
AzureKeyVault.WestUS2
AzureMachineLearning
AzureMachineLearning.AustraliaCentral
AzureMachineLearning.AustraliaCentral2
AzureMachineLearning.AustraliaEast
AzureMachineLearning.AustraliaSoutheast
AzureMachineLearning.BrazilSouth
AzureMachineLearning.CanadaCentral
AzureMachineLearning.CanadaEast
AzureMachineLearning.CentralIndia
AzureMachineLearning.CentralUS
AzureMachineLearning.CentralUSEUAP
AzureMachineLearning.EastAsia
AzureMachineLearning.EastUS
AzureMachineLearning.EastUS2
AzureMachineLearning.EastUS2EUAP
AzureMachineLearning.FranceCentral
AzureMachineLearning.FranceSouth
AzureMachineLearning.JapanEast
AzureMachineLearning.JapanWest
AzureMachineLearning.KoreaCentral
AzureMachineLearning.KoreaSouth
AzureMachineLearning.NorthCentralUS
AzureMachineLearning.NorthEurope
AzureMachineLearning.SouthAfricaNorth
AzureMachineLearning.SouthAfricaWest
AzureMachineLearning.SouthCentralUS
AzureMachineLearning.SoutheastAsia
AzureMachineLearning.SouthIndia
AzureMachineLearning.UAECentral
AzureMachineLearning.UAENorth
AzureMachineLearning.UKNorth
AzureMachineLearning.UKSouth
AzureMachineLearning.UKSouth2
AzureMachineLearning.UKWest
AzureMachineLearning.WestCentralUS
AzureMachineLearning.WestEurope
AzureMachineLearning.WestIndia
AzureMachineLearning.WestUS
AzureMachineLearning.WestUS2
AzureMonitor
AzureMonitor.AustraliaCentral
AzureMonitor.AustraliaCentral2
AzureMonitor.AustraliaEast
AzureMonitor.AustraliaSoutheast
AzureMonitor.BrazilSouth
AzureMonitor.CanadaCentral
AzureMonitor.CanadaEast
AzureMonitor.CentralIndia
AzureMonitor.CentralUS
AzureMonitor.CentralUSEUAP
AzureMonitor.EastAsia
AzureMonitor.EastUS
AzureMonitor.EastUS2
AzureMonitor.EastUS2EUAP
AzureMonitor.FranceCentral
AzureMonitor.FranceSouth
AzureMonitor.JapanEast
AzureMonitor.JapanWest
AzureMonitor.KoreaCentral
AzureMonitor.KoreaSouth
AzureMonitor.NorthCentralUS
AzureMonitor.NorthEurope
AzureMonitor.SouthAfricaNorth
AzureMonitor.SouthAfricaWest
AzureMonitor.SouthCentralUS
AzureMonitor.SoutheastAsia
AzureMonitor.SouthIndia
AzureMonitor.UAECentral
AzureMonitor.UAENorth
AzureMonitor.UKNorth
AzureMonitor.UKSouth
AzureMonitor.UKSouth2
AzureMonitor.UKWest
AzureMonitor.WestCentralUS
AzureMonitor.WestEurope
AzureMonitor.WestIndia
AzureMonitor.WestUS
AzureMonitor.WestUS2
AzureTrafficManager
BatchNodeManagement
BatchNodeManagement.AustraliaCentral
BatchNodeManagement.AustraliaEast
BatchNodeManagement.AustraliaSoutheast
BatchNodeManagement.BrazilSouth
BatchNodeManagement.CanadaCentral
BatchNodeManagement.CanadaEast
BatchNodeManagement.CentralIndia
BatchNodeManagement.CentralUS
BatchNodeManagement.CentralUSEUAP
BatchNodeManagement.EastAsia
BatchNodeManagement.EastUS
BatchNodeManagement.EastUS2
BatchNodeManagement.EastUS2EUAP
BatchNodeManagement.FranceCentral
BatchNodeManagement.FranceSouth
BatchNodeManagement.JapanEast
BatchNodeManagement.JapanWest
BatchNodeManagement.KoreaCentral
BatchNodeManagement.KoreaSouth
BatchNodeManagement.NorthCentralUS
BatchNodeManagement.NorthEurope
BatchNodeManagement.SouthAfricaNorth
BatchNodeManagement.SouthAfricaWest
BatchNodeManagement.SouthCentralUS
BatchNodeManagement.SoutheastAsia
BatchNodeManagement.SouthIndia
BatchNodeManagement.UAECentral
BatchNodeManagement.UAENorth
BatchNodeManagement.UKNorth
BatchNodeManagement.UKSouth
BatchNodeManagement.UKSouth2
BatchNodeManagement.UKWest
BatchNodeManagement.WestCentralUS
BatchNodeManagement.WestEurope
BatchNodeManagement.WestIndia
BatchNodeManagement.WestUS
BatchNodeManagement.WestUS2
EventHub
EventHub.AustraliaCentral
EventHub.AustraliaCentral2
EventHub.AustraliaEast
EventHub.AustraliaSoutheast
EventHub.BrazilSouth
EventHub.CanadaCentral
EventHub.CanadaEast
EventHub.CentralIndia
EventHub.CentralUS
EventHub.CentralUSEUAP
EventHub.EastAsia
EventHub.EastUS
EventHub.EastUS2
EventHub.EastUS2EUAP
EventHub.FranceCentral
EventHub.FranceSouth
EventHub.JapanEast
EventHub.JapanWest
EventHub.KoreaCentral
EventHub.KoreaSouth
EventHub.NorthCentralUS
EventHub.NorthEurope
EventHub.SouthAfricaNorth
EventHub.SouthAfricaWest
EventHub.SouthCentralUS
EventHub.SoutheastAsia
EventHub.SouthIndia
EventHub.UAECentral
EventHub.UAENorth
EventHub.UKNorth
EventHub.UKSouth
EventHub.UKSouth2
EventHub.UKWest
EventHub.WestCentralUS
EventHub.WestEurope
EventHub.WestIndia
EventHub.WestUS
EventHub.WestUS2
GatewayManager
GatewayManager.AustraliaCentral
GatewayManager.AustraliaCentral2
GatewayManager.AustraliaEast
GatewayManager.AustraliaSoutheast
GatewayManager.BrazilSouth
GatewayManager.CanadaCentral
GatewayManager.CanadaEast
GatewayManager.CentralIndia
GatewayManager.CentralUS
GatewayManager.CentralUSEUAP
GatewayManager.EastAsia
GatewayManager.EastUS
GatewayManager.EastUS2
GatewayManager.EastUS2EUAP
GatewayManager.FranceCentral
GatewayManager.FranceSouth
GatewayManager.JapanEast
GatewayManager.JapanWest
GatewayManager.KoreaCentral
GatewayManager.KoreaSouth
GatewayManager.NorthCentralUS
GatewayManager.NorthEurope
GatewayManager.SouthAfricaNorth
GatewayManager.SouthAfricaWest
GatewayManager.SouthCentralUS
GatewayManager.SoutheastAsia
GatewayManager.SouthIndia
GatewayManager.UAECentral
GatewayManager.UAENorth
GatewayManager.UKNorth
GatewayManager.UKSouth
GatewayManager.UKSouth2
GatewayManager.UKWest
GatewayManager.WestCentralUS
GatewayManager.WestEurope
GatewayManager.WestIndia
GatewayManager.WestUS
GatewayManager.WestUS2
MicrosoftContainerRegistry
MicrosoftContainerRegistry.AustraliaEast
MicrosoftContainerRegistry.AustraliaSoutheast
MicrosoftContainerRegistry.BrazilSouth
MicrosoftContainerRegistry.CanadaCentral
MicrosoftContainerRegistry.CanadaEast
MicrosoftContainerRegistry.CentralIndia
MicrosoftContainerRegistry.CentralUS
MicrosoftContainerRegistry.CentralUSEUAP
MicrosoftContainerRegistry.EastAsia
MicrosoftContainerRegistry.EastUS
MicrosoftContainerRegistry.EastUS2
MicrosoftContainerRegistry.EastUS2EUAP
MicrosoftContainerRegistry.FranceCentral
MicrosoftContainerRegistry.FranceSouth
MicrosoftContainerRegistry.JapanEast
MicrosoftContainerRegistry.JapanWest
MicrosoftContainerRegistry.KoreaCentral
MicrosoftContainerRegistry.KoreaSouth
MicrosoftContainerRegistry.NorthCentralUS
MicrosoftContainerRegistry.NorthEurope
MicrosoftContainerRegistry.SouthAfricaNorth
MicrosoftContainerRegistry.SouthAfricaWest
MicrosoftContainerRegistry.SouthCentralUS
MicrosoftContainerRegistry.SoutheastAsia
MicrosoftContainerRegistry.SouthIndia
MicrosoftContainerRegistry.UAECentral
MicrosoftContainerRegistry.UAENorth
MicrosoftContainerRegistry.UKNorth
MicrosoftContainerRegistry.UKSouth
MicrosoftContainerRegistry.UKSouth2
MicrosoftContainerRegistry.UKWest
MicrosoftContainerRegistry.WestCentralUS
MicrosoftContainerRegistry.WestEurope
MicrosoftContainerRegistry.WestIndia
MicrosoftContainerRegistry.WestUS
MicrosoftContainerRegistry.WestUS2
ServiceBus
ServiceBus.AustraliaCentral
ServiceBus.AustraliaCentral2
ServiceBus.AustraliaEast
ServiceBus.AustraliaSoutheast
ServiceBus.BrazilSouth
ServiceBus.CanadaCentral
ServiceBus.CanadaEast
ServiceBus.CentralIndia
ServiceBus.CentralUS
ServiceBus.CentralUSEUAP
ServiceBus.EastAsia
ServiceBus.EastUS
ServiceBus.EastUS2
ServiceBus.EastUS2EUAP
ServiceBus.FranceCentral
ServiceBus.FranceSouth
ServiceBus.JapanEast
ServiceBus.JapanWest
ServiceBus.KoreaCentral
ServiceBus.KoreaSouth
ServiceBus.NorthCentralUS
ServiceBus.NorthEurope
ServiceBus.SouthAfricaNorth
ServiceBus.SouthAfricaWest
ServiceBus.SouthCentralUS
ServiceBus.SoutheastAsia
ServiceBus.SouthIndia
ServiceBus.UAECentral
ServiceBus.UAENorth
ServiceBus.UKNorth
ServiceBus.UKSouth
ServiceBus.UKSouth2
ServiceBus.UKWest
ServiceBus.WestCentralUS
ServiceBus.WestEurope
ServiceBus.WestIndia
ServiceBus.WestUS
ServiceBus.WestUS2
ServiceFabric
ServiceFabric.AustraliaCentral
ServiceFabric.AustraliaCentral2
ServiceFabric.AustraliaEast
ServiceFabric.AustraliaSoutheast
ServiceFabric.BrazilSouth
ServiceFabric.CanadaCentral
ServiceFabric.CanadaEast
ServiceFabric.CentralIndia
ServiceFabric.CentralUS
ServiceFabric.CentralUSEUAP
ServiceFabric.EastAsia
ServiceFabric.EastUS
ServiceFabric.EastUS2
ServiceFabric.EastUS2EUAP
ServiceFabric.FranceCentral
ServiceFabric.FranceSouth
ServiceFabric.JapanEast
ServiceFabric.JapanWest
ServiceFabric.KoreaCentral
ServiceFabric.KoreaSouth
ServiceFabric.NorthCentralUS
ServiceFabric.NorthEurope
ServiceFabric.SouthAfricaNorth
ServiceFabric.SouthAfricaWest
ServiceFabric.SouthCentralUS
ServiceFabric.SoutheastAsia
ServiceFabric.SouthIndia
ServiceFabric.UAECentral
ServiceFabric.UAENorth
ServiceFabric.UKNorth
ServiceFabric.UKSouth
ServiceFabric.UKSouth2
ServiceFabric.UKWest
ServiceFabric.WestCentralUS
ServiceFabric.WestEurope
ServiceFabric.WestIndia
ServiceFabric.WestUS
ServiceFabric.WestUS2
Sql
Sql.AustraliaCentral
Sql.AustraliaCentral2
Sql.AustraliaEast
Sql.AustraliaSoutheast
Sql.BrazilSouth
Sql.CanadaCentral
Sql.CanadaEast
Sql.CentralIndia
Sql.CentralUS
Sql.CentralUSEUAP
Sql.EastAsia
Sql.EastUS
Sql.EastUS2
Sql.EastUS2EUAP
Sql.EastUS2Stage
Sql.FranceCentral
Sql.FranceSouth
Sql.JapanEast
Sql.JapanWest
Sql.KoreaCentral
Sql.KoreaSouth
Sql.NorthCentralUS
Sql.NorthCentralUSStage
Sql.NorthEurope
Sql.SouthAfricaNorth
Sql.SouthAfricaWest
Sql.SouthCentralUS
Sql.SoutheastAsia
Sql.SouthIndia
Sql.UAECentral
Sql.UAENorth
Sql.UKNorth
Sql.UKSouth
Sql.UKSouth2
Sql.UKWest
Sql.WestCentralUS
Sql.WestEurope
Sql.WestIndia
Sql.WestUS
Sql.WestUS2
Storage
Storage.AustraliaCentral
Storage.AustraliaCentral2
Storage.AustraliaEast
Storage.AustraliaSoutheast
Storage.BrazilSouth
Storage.CanadaCentral
Storage.CanadaEast
Storage.CentralIndia
Storage.CentralUS
Storage.CentralUSEUAP
Storage.EastAsia
Storage.EastUS
Storage.EastUS2
Storage.EastUS2EUAP
Storage.EastUS2Stage
Storage.FranceCentral
Storage.FranceSouth
Storage.JapanEast
Storage.JapanWest
Storage.KoreaCentral
Storage.KoreaSouth
Storage.NorthCentralUS
Storage.NorthCentralUSStage
Storage.NorthEurope
Storage.SouthAfricaNorth
Storage.SouthAfricaWest
Storage.SouthCentralUS
Storage.SoutheastAsia
Storage.SouthIndia
Storage.UAECentral
Storage.UAENorth
Storage.UKNorth
Storage.UKSouth
Storage.UKSouth2
Storage.UKWest
Storage.WestCentralUS
Storage.WestEurope
Storage.WestIndia
Storage.WestUS
Storage.WestUS2
Podívejme se tedy na query, které nám vyfiltruje jen údaje o službě Event Hub v regionu West Europe.
az network list-service-tags -l westeurope --query "values[?name=='EventHub.WestEurope']"
[
{
"id": "EventHub.WestEurope",
"name": "EventHub.WestEurope",
"properties": {
"addressPrefixes": [
"13.69.64.0/26",
"13.69.106.0/26",
"23.97.226.21/32",
"23.100.14.185/32",
"40.68.35.230/32",
"40.68.39.15/32",
"40.68.93.145/32",
"40.68.205.113/32",
"40.68.217.242/32",
"51.144.238.23/32",
"52.174.243.57/32",
"52.178.78.61/32",
"52.232.27.189/32",
"52.233.190.35/32",
"52.233.192.247/32",
"52.236.186.0/26",
"65.52.129.16/32",
"104.40.150.139/32",
"104.40.179.185/32",
"104.40.216.174/32",
"104.46.32.56/32",
"104.46.32.58/32",
"191.233.73.228/32"
],
"changeNumber": "1",
"region": "westeurope",
"systemService": "AzureEventHub"
}
}
]
Dostáváme tedy prefixy všech IP, na kterých může potenciálně tato služba v tomto regionu běžet. Políčko changeNumber se bude inkrementovat vždy, když dojde ke změně (snadno tak ve vašem automatizačním skriptu poznáte, že je potřeba provést změnu). Funguje to tak, že informace o přidané IP se publikují nějakou dobu před tím, než se začne reálně používat (myslím asi týden), takže pokud budete skriptovat denně, nebudete mít problém.
Mimochodem řada firewallů či reverse proxy třetích stran podporuje vyčítání některých informací z Azure už dnes, zejména pro scénáře firewallu jako virtuální appliance v Azure (vyčítají si například tagy z VM a umožní vám automaticky vytvářet objekty podle těchto tagů). Je tak možné a řekl bych dokonce pravděpodobné, že tito výrobci později přidají i vyčítání těchto tagů, protože je to vlastně jen rozšíření něčeho, co už často dělají.
Jak říkám - soustředil bych se identitní perimetr a pokud to nestačí, používal další metody typu IP whitelisting, Service Endpoint, Express Route Microsoft peering a v budoucnu Private Link. Nicméně pokud potřebujete dostávat seznam IP rangů PaaS služeb automatizovaně přes API, je to možné. Zkuste si to.