Enterprise-Scale icon indicating copy to clipboard operation
Enterprise-Scale copied to clipboard
verified publisher icon Azure

Bug Report - Deploy-Private-DNS-Zones does not deploy DNS records for `database.windows.net`

Open andrewdmay opened this issue 2 years ago • 6 comments

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform: 1.6.1

azure provider: 3.81.0

module: 5.0.2

Description

Describe the bug

Similar to Azure/Enterprise-Scale#1479 and Azure/Enterprise-Scale#1502, the Deploy-Private-DNS-Zones policy initiative does not include a policy for Azure SQL private endpoints. I'm not sure if this is because there is no predefined policy for this as far as I can tell (based upon https://learn.microsoft.com/en-us/azure/networking/policy-reference).

Steps to Reproduce

  1. Deploy CAF module, with Corp Archetype
  2. Create Azure SQL database to subscription under Corp Management group. Add Private Endpoint.
  3. No record created in the privatelink.database.windows.net private DNS Zone in the connectivity subscription

andrewdmay avatar Nov 21 '23 20:11 andrewdmay

Hi!

This is a policy issue so moving upstream

matt-FFFFFF avatar Nov 22 '23 15:11 matt-FFFFFF

Investigating the issue, may need to rely on some additional work we have in the backlog. Will keep you posted.

Springstone avatar Nov 23 '23 15:11 Springstone

@rozkurt please investigate.

Springstone avatar Dec 18 '23 14:12 Springstone

Hi, this is the same issue as issue 1408 It would be really great to add this resource and/or add documentation how to manage private DNS zones for resources where the policies are missing!

steph409 avatar Feb 26 '24 08:02 steph409

Waiting on this PR to be merged to enable custom assignment of Private DNS Zones: https://github.com/Azure/Enterprise-Scale/pull/1618

Springstone avatar Apr 29 '24 07:04 Springstone

We're live with a lot of changes and enhancements. You should be able to create an assignment using our new generic Private DNS Zone policy if we're not doing it by default : https://www.azadvertizer.net/azpolicyadvertizer/Deploy-Private-DNS-Generic.html

Springstone avatar Jun 06 '24 15:06 Springstone

We've published an updated version of generic Private DNS Zones policy linked above. Assuming this addresses your requirement. Closing the issue as the generic policy should address the need. Feel free to open again if needed.

Springstone avatar Oct 11 '24 07:10 Springstone