Azure Web App allows us to configure IP Restrictions (same goes for Azure Functions, API apps) . This allows us to define a priority ordered allow/deny list of IP addresses as access rules for our app. The allow list can include IPv4 and IPv6 addresses.
Developers often run into scenarios when they want to do programmatic manipulations in these restriction rules. Adding or removing IP restrictions from Portal is easy and documented here. We can also manipulate them with ARM templates, like following:
"ipSecurityRestrictions": [
{
"ipAddress": "131.107.159.0/24",
"action": "Allow",
"tag": "Default",
"priority": 100,
"name": "allowed access"
}
],
However, sometimes it’s handy to do this in Power Shell scripts – that can be executed as a Build/Release task in CI/CD pipeline or other environments – when we can add IP restrictions with some scripts and/or remove some restriction rules. Google finds quite some blog posts that show how to add IP restrictions, but not a lot for removing a restriction.
In this post, I will present a complete Power Shell script that will allows us do the following:
- Add an IP restriction
- View the IP restrictions
- Remove all IP Restrictions
Add-AzureRmWebAppIPRestrictions
function Add-AzureRmWebAppIPRestrictions {
Param(
$WebAppName,
$ResourceGroupName,
$IPAddress,
$Mask
)
$APIVersion = ((Get-AzureRmResourceProvider -ProviderNamespace Microsoft.Web).ResourceTypes | Where-Object ResourceTypeName -eq sites).ApiVersions[0]
$WebAppConfig = (Get-AzureRmResource -ResourceType Microsoft.Web/sites/config -ResourceName $WebAppName -ResourceGroupName $ResourceGroupName -ApiVersion $APIVersion)
$IpSecurityRestrictions = $WebAppNameConfig.Properties.ipsecurityrestrictions
if ($ipAddress -in $IpSecurityRestrictions.ipAddress) {
"$IPAddress is already restricted in $WebAppName."
}
else {
$webIP = [PSCustomObject]@{ipAddress = ''; subnetMask = ''; Priority = 300}
$webIP.ipAddress = $ipAddress
$webIP.subnetMask = $Mask
if($null -eq $IpSecurityRestrictions){
$IpSecurityRestrictions = @()
}
[System.Collections.ArrayList]$list = $IpSecurityRestrictions
$list.Add($webIP) | Out-Null
$WebAppConfig.properties.ipSecurityRestrictions = $list
$WebAppConfig | Set-AzureRmResource -ApiVersion $APIVersion -Force | Out-Null
Write-Output "New restricted IP address $IPAddress has been added to WebApp $WebAppName"
}
}
Get-AzureRmWebAppIPRestrictions
function Get-AzureRmWebAppIPRestrictions {
param
(
[string] $WebAppName,
[string] $ResourceGroupName
)
$APIVersion = ((Get-AzureRmResourceProvider -ProviderNamespace Microsoft.Web).ResourceTypes | Where-Object ResourceTypeName -eq sites).ApiVersions[0]
$WebAppConfig = (Get-AzureRmResource -ResourceType Microsoft.Web/sites/config -ResourceName $WebAppName -ResourceGroupName $ResourceGroupName -ApiVersion $APIVersion)
$IpSecurityRestrictions = $WebAppConfig.Properties.ipsecurityrestrictions
if ($null -eq $IpSecurityRestrictions) {
Write-Output "$WebAppName has no IP restrictions."
}
else {
Write-Output "$WebAppName IP Restrictions: "
$IpSecurityRestrictions
}
}
Remove-AzureRmWebAppIPRestrictions
function Remove-AzureRmWebAppIPRestrictions {
param (
[string]$WebAppName,
[string]$ResourceGroupName
)
$APIVersion = ((Get-AzureRmResourceProvider -ProviderNamespace Microsoft.Web).ResourceTypes | Where-Object ResourceTypeName -eq sites).ApiVersions[0]
$r = Get-AzureRmResource -ResourceGroupName $ResourceGroupName -ResourceType Microsoft.Web/sites/config -ResourceName "$WebAppName/web" -ApiVersion $APIVersion
$p = $r.Properties
$p.ipSecurityRestrictions = @()
Set-AzureRmResource -ResourceGroupName $ResourceGroupName -ResourceType Microsoft.Web/sites/config -ResourceName "$WebAppName/web" -ApiVersion $APIVersion -PropertyObject $p -Force
}
function Test-Everything {
if (!(Get-AzureRmContext)) {
Write-Output "Please login to your Azure account"
Login-AzureRmAccount
}
Get-AzureRmWebAppIPRestrictions -WebAppName "my-app" -ResourceGroupName "my-rg-name"
Remove-AzureRmWebAppIPRestrictions -WebAppName "my-app" -ResourceGroupName "my-rg-name"
Set-AzureRmWebAppIPRestrictions -WebAppName "my-app" -ResourceGroupName "my-rg-name" -IPAddress "192.51.100.0/24" -Mask ""
Get-AzureRmWebAppIPRestrictions -WebAppName "my-app" -ResourceGroupName "my-rg-name"
}
Test-Everything
Reverse Engineering 
Great work! This is the type of info that should be shared around the internet. Shame on Google for not positioning this post higher! Come on over and visit my web site . Thanks =)
LikeLike
http://mewkid.net/order-amoxicillin/ – Amoxicillin 500 Amoxicillin 500mg mwp.dagf.moimhossain.com.ipz.no http://mewkid.net/order-amoxicillin/
LikeLike