Skip to content

topic (iac): [secure-hybrid-network] tighten firewall application rules#266

Closed
ferantivero wants to merge 0 commit into
patch/421252_fix-subnet-sizingfrom
topic/421252_tighten-fw-rules
Closed

topic (iac): [secure-hybrid-network] tighten firewall application rules#266
ferantivero wants to merge 0 commit into
patch/421252_fix-subnet-sizingfrom
topic/421252_tighten-fw-rules

Conversation

@ferantivero
Copy link
Copy Markdown
Contributor

Why

The firewall allows all outbound HTTP/HTTPS to any FQDN from any source — a reference implementation should demonstrate least-privilege.

What

  • Replace all-internet rule (HTTP/HTTPS to * from *) with windows-update rule
  • Restrict to *.update.microsoft.com, *.windowsupdate.com, *.download.windowsupdate.com
  • Limit source to spoke address prefix only

Test

  • Bicep compiles without errors

@ferantivero ferantivero force-pushed the patch/421252_fix-subnet-sizing branch from 5e601c1 to 9a2173d Compare May 26, 2026 18:12
@ferantivero ferantivero force-pushed the topic/421252_tighten-fw-rules branch from a6a4e98 to 2574078 Compare May 26, 2026 18:12
@ferantivero ferantivero force-pushed the patch/421252_fix-subnet-sizing branch from 9a2173d to f232f74 Compare May 27, 2026 17:21
@ferantivero ferantivero force-pushed the topic/421252_tighten-fw-rules branch from 2574078 to f232f74 Compare May 27, 2026 17:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant