I have a couple of questions about firewall rules for Azure SQL Servers: 1. Per these docs: https://www.pulumi.com/registry/packages/azure-native/api-docs/sql/firewallrule/ - is setting the "ServerName" property on the args object sufficient to "connect" the firewall rule to the desired Azure SQL Server instance? 2. Using Pulumi, how do I accomplish the equivalent of checking the "Allow Azure services and resources..." checkbox as seen in this Azure portal screenshot:

Quick tip: When wondering how Azure does it go to export template on an already deployed resource. The settings will then be there in JSON. resourceGroup and sqlServer are variables, replace as needed with your code. ResourceGroupName = resourceGroup, FirewallRuleName = "AllowAllWindowsAzureIps", ServerName = sqlServer.Name, StartIpAddress = "0.0.0.0", EndIpAddress = "0.0.0.0"

Thanks, that's what I've been doing. That, or

pulumi import

to a dummy stack.

If you want to restrict to your specific web app then you need to VNET integrate your app service. Then use service endpoint on the SQL firewall rule. As it is now any web app in all Azure can reach your SQL database.

Right. That's what I understood to be the case. So I'd love to do it "right", but given my novice status with Azure networking let alone with Pulumi to configure that, I'd definitely need to see some examples to clarify how all that works. If I understand right, that would also set me on a path to use AAD for permissions to the db from the app service rather than a connection string. Thanks again.

I haven't figured out the configuring of the Azure AD contained database user with pulumi yet. I manually go in after deployment, add the Azure AD user, and configure the permissions. I need to find time to try the sql provider listed the other day in the channel.

@clean-truck-93285 Here is a snippet for how we configure security for sqlserver

new Sql.ServerArgs()

{Administrators = new Sql.Inputs.ServerExternalAdministratorArgs

{

AzureADOnlyAuthentication = false,

PrincipalType = "Group",

Sid = "SID of your AzureAD Group",

TenantId = "Azure AD TEnant ID",

Login = "Username in SQLServer",

}

}