We recommend using Azure Native.
azure.domainservices.ReplicaSet
Explore with Pulumi AI
Manages a Replica Set for an Active Directory Domain Service.
Example Usage
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
using AzureAD = Pulumi.AzureAD;
return await Deployment.RunAsync(() =>
{
var primaryResourceGroup = new Azure.Core.ResourceGroup("primaryResourceGroup", new()
{
Location = "West Europe",
});
var primaryVirtualNetwork = new Azure.Network.VirtualNetwork("primaryVirtualNetwork", new()
{
Location = primaryResourceGroup.Location,
ResourceGroupName = primaryResourceGroup.Name,
AddressSpaces = new[]
{
"10.0.1.0/16",
},
});
var primarySubnet = new Azure.Network.Subnet("primarySubnet", new()
{
ResourceGroupName = primaryResourceGroup.Name,
VirtualNetworkName = primaryVirtualNetwork.Name,
AddressPrefixes = new[]
{
"10.0.1.0/24",
},
});
var primaryNetworkSecurityGroup = new Azure.Network.NetworkSecurityGroup("primaryNetworkSecurityGroup", new()
{
Location = primaryResourceGroup.Location,
ResourceGroupName = primaryResourceGroup.Name,
SecurityRules = new[]
{
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowSyncWithAzureAD",
Priority = 101,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "443",
SourceAddressPrefix = "AzureActiveDirectoryDomainServices",
DestinationAddressPrefix = "*",
},
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowRD",
Priority = 201,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "3389",
SourceAddressPrefix = "CorpNetSaw",
DestinationAddressPrefix = "*",
},
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowPSRemoting",
Priority = 301,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "5986",
SourceAddressPrefix = "AzureActiveDirectoryDomainServices",
DestinationAddressPrefix = "*",
},
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowLDAPS",
Priority = 401,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "636",
SourceAddressPrefix = "*",
DestinationAddressPrefix = "*",
},
},
});
var primarySubnetNetworkSecurityGroupAssociation = new Azure.Network.SubnetNetworkSecurityGroupAssociation("primarySubnetNetworkSecurityGroupAssociation", new()
{
SubnetId = primarySubnet.Id,
NetworkSecurityGroupId = primaryNetworkSecurityGroup.Id,
});
var dcAdmins = new AzureAD.Group("dcAdmins", new()
{
DisplayName = "aad-dc-administrators",
SecurityEnabled = true,
});
var adminUser = new AzureAD.User("adminUser", new()
{
UserPrincipalName = "dc-admin@hashicorp-example.net",
DisplayName = "DC Administrator",
Password = "Pa55w0Rd!!1",
});
var adminGroupMember = new AzureAD.GroupMember("adminGroupMember", new()
{
GroupObjectId = dcAdmins.ObjectId,
MemberObjectId = adminUser.ObjectId,
});
var exampleServicePrincipal = new AzureAD.ServicePrincipal("exampleServicePrincipal", new()
{
ApplicationId = "2565bd9d-da50-47d4-8b85-4c97f669dc36",
});
// published app for domain services
var aadds = new Azure.Core.ResourceGroup("aadds", new()
{
Location = "westeurope",
});
var exampleService = new Azure.DomainServices.Service("exampleService", new()
{
Location = aadds.Location,
ResourceGroupName = aadds.Name,
DomainName = "widgetslogin.net",
Sku = "Enterprise",
FilteredSyncEnabled = false,
InitialReplicaSet = new Azure.DomainServices.Inputs.ServiceInitialReplicaSetArgs
{
Location = primaryVirtualNetwork.Location,
SubnetId = primarySubnet.Id,
},
Notifications = new Azure.DomainServices.Inputs.ServiceNotificationsArgs
{
AdditionalRecipients = new[]
{
"notifyA@example.net",
"notifyB@example.org",
},
NotifyDcAdmins = true,
NotifyGlobalAdmins = true,
},
Security = new Azure.DomainServices.Inputs.ServiceSecurityArgs
{
SyncKerberosPasswords = true,
SyncNtlmPasswords = true,
SyncOnPremPasswords = true,
},
Tags =
{
{ "Environment", "prod" },
},
}, new CustomResourceOptions
{
DependsOn = new[]
{
exampleServicePrincipal,
primarySubnetNetworkSecurityGroupAssociation,
},
});
var replicaResourceGroup = new Azure.Core.ResourceGroup("replicaResourceGroup", new()
{
Location = "North Europe",
});
var replicaVirtualNetwork = new Azure.Network.VirtualNetwork("replicaVirtualNetwork", new()
{
Location = replicaResourceGroup.Location,
ResourceGroupName = replicaResourceGroup.Name,
AddressSpaces = new[]
{
"10.20.0.0/16",
},
});
var aaddsReplicaSubnet = new Azure.Network.Subnet("aaddsReplicaSubnet", new()
{
ResourceGroupName = replicaResourceGroup.Name,
VirtualNetworkName = replicaVirtualNetwork.Name,
AddressPrefixes = new[]
{
"10.20.0.0/24",
},
});
var aaddsReplicaNetworkSecurityGroup = new Azure.Network.NetworkSecurityGroup("aaddsReplicaNetworkSecurityGroup", new()
{
Location = replicaResourceGroup.Location,
ResourceGroupName = replicaResourceGroup.Name,
SecurityRules = new[]
{
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowSyncWithAzureAD",
Priority = 101,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "443",
SourceAddressPrefix = "AzureActiveDirectoryDomainServices",
DestinationAddressPrefix = "*",
},
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowRD",
Priority = 201,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "3389",
SourceAddressPrefix = "CorpNetSaw",
DestinationAddressPrefix = "*",
},
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowPSRemoting",
Priority = 301,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "5986",
SourceAddressPrefix = "AzureActiveDirectoryDomainServices",
DestinationAddressPrefix = "*",
},
new Azure.Network.Inputs.NetworkSecurityGroupSecurityRuleArgs
{
Name = "AllowLDAPS",
Priority = 401,
Direction = "Inbound",
Access = "Allow",
Protocol = "Tcp",
SourcePortRange = "*",
DestinationPortRange = "636",
SourceAddressPrefix = "*",
DestinationAddressPrefix = "*",
},
},
});
var replicaSubnetNetworkSecurityGroupAssociation = new Azure.Network.SubnetNetworkSecurityGroupAssociation("replicaSubnetNetworkSecurityGroupAssociation", new()
{
SubnetId = aaddsReplicaSubnet.Id,
NetworkSecurityGroupId = aaddsReplicaNetworkSecurityGroup.Id,
});
var primaryReplica = new Azure.Network.VirtualNetworkPeering("primaryReplica", new()
{
ResourceGroupName = primaryVirtualNetwork.ResourceGroupName,
VirtualNetworkName = primaryVirtualNetwork.Name,
RemoteVirtualNetworkId = replicaVirtualNetwork.Id,
AllowForwardedTraffic = true,
AllowGatewayTransit = false,
AllowVirtualNetworkAccess = true,
UseRemoteGateways = false,
});
var replicaPrimary = new Azure.Network.VirtualNetworkPeering("replicaPrimary", new()
{
ResourceGroupName = replicaVirtualNetwork.ResourceGroupName,
VirtualNetworkName = replicaVirtualNetwork.Name,
RemoteVirtualNetworkId = primaryVirtualNetwork.Id,
AllowForwardedTraffic = true,
AllowGatewayTransit = false,
AllowVirtualNetworkAccess = true,
UseRemoteGateways = false,
});
var replicaVirtualNetworkDnsServers = new Azure.Network.VirtualNetworkDnsServers("replicaVirtualNetworkDnsServers", new()
{
VirtualNetworkId = replicaVirtualNetwork.Id,
DnsServers = exampleService.InitialReplicaSet.Apply(initialReplicaSet => initialReplicaSet.DomainControllerIpAddresses),
});
var replicaReplicaSet = new Azure.DomainServices.ReplicaSet("replicaReplicaSet", new()
{
DomainServiceId = exampleService.Id,
Location = replicaResourceGroup.Location,
SubnetId = aaddsReplicaSubnet.Id,
}, new CustomResourceOptions
{
DependsOn = new[]
{
replicaSubnetNetworkSecurityGroupAssociation,
primaryReplica,
replicaPrimary,
},
});
});
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/domainservices"
"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/network"
"github.com/pulumi/pulumi-azuread/sdk/v5/go/azuread"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
primaryResourceGroup, err := core.NewResourceGroup(ctx, "primaryResourceGroup", &core.ResourceGroupArgs{
Location: pulumi.String("West Europe"),
})
if err != nil {
return err
}
primaryVirtualNetwork, err := network.NewVirtualNetwork(ctx, "primaryVirtualNetwork", &network.VirtualNetworkArgs{
Location: primaryResourceGroup.Location,
ResourceGroupName: primaryResourceGroup.Name,
AddressSpaces: pulumi.StringArray{
pulumi.String("10.0.1.0/16"),
},
})
if err != nil {
return err
}
primarySubnet, err := network.NewSubnet(ctx, "primarySubnet", &network.SubnetArgs{
ResourceGroupName: primaryResourceGroup.Name,
VirtualNetworkName: primaryVirtualNetwork.Name,
AddressPrefixes: pulumi.StringArray{
pulumi.String("10.0.1.0/24"),
},
})
if err != nil {
return err
}
primaryNetworkSecurityGroup, err := network.NewNetworkSecurityGroup(ctx, "primaryNetworkSecurityGroup", &network.NetworkSecurityGroupArgs{
Location: primaryResourceGroup.Location,
ResourceGroupName: primaryResourceGroup.Name,
SecurityRules: network.NetworkSecurityGroupSecurityRuleArray{
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowSyncWithAzureAD"),
Priority: pulumi.Int(101),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("443"),
SourceAddressPrefix: pulumi.String("AzureActiveDirectoryDomainServices"),
DestinationAddressPrefix: pulumi.String("*"),
},
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowRD"),
Priority: pulumi.Int(201),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("3389"),
SourceAddressPrefix: pulumi.String("CorpNetSaw"),
DestinationAddressPrefix: pulumi.String("*"),
},
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowPSRemoting"),
Priority: pulumi.Int(301),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("5986"),
SourceAddressPrefix: pulumi.String("AzureActiveDirectoryDomainServices"),
DestinationAddressPrefix: pulumi.String("*"),
},
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowLDAPS"),
Priority: pulumi.Int(401),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("636"),
SourceAddressPrefix: pulumi.String("*"),
DestinationAddressPrefix: pulumi.String("*"),
},
},
})
if err != nil {
return err
}
primarySubnetNetworkSecurityGroupAssociation, err := network.NewSubnetNetworkSecurityGroupAssociation(ctx, "primarySubnetNetworkSecurityGroupAssociation", &network.SubnetNetworkSecurityGroupAssociationArgs{
SubnetId: primarySubnet.ID(),
NetworkSecurityGroupId: primaryNetworkSecurityGroup.ID(),
})
if err != nil {
return err
}
dcAdmins, err := azuread.NewGroup(ctx, "dcAdmins", &azuread.GroupArgs{
DisplayName: pulumi.String("aad-dc-administrators"),
SecurityEnabled: pulumi.Bool(true),
})
if err != nil {
return err
}
adminUser, err := azuread.NewUser(ctx, "adminUser", &azuread.UserArgs{
UserPrincipalName: pulumi.String("dc-admin@hashicorp-example.net"),
DisplayName: pulumi.String("DC Administrator"),
Password: pulumi.String("Pa55w0Rd!!1"),
})
if err != nil {
return err
}
_, err = azuread.NewGroupMember(ctx, "adminGroupMember", &azuread.GroupMemberArgs{
GroupObjectId: dcAdmins.ObjectId,
MemberObjectId: adminUser.ObjectId,
})
if err != nil {
return err
}
exampleServicePrincipal, err := azuread.NewServicePrincipal(ctx, "exampleServicePrincipal", &azuread.ServicePrincipalArgs{
ApplicationId: pulumi.String("2565bd9d-da50-47d4-8b85-4c97f669dc36"),
})
if err != nil {
return err
}
aadds, err := core.NewResourceGroup(ctx, "aadds", &core.ResourceGroupArgs{
Location: pulumi.String("westeurope"),
})
if err != nil {
return err
}
exampleService, err := domainservices.NewService(ctx, "exampleService", &domainservices.ServiceArgs{
Location: aadds.Location,
ResourceGroupName: aadds.Name,
DomainName: pulumi.String("widgetslogin.net"),
Sku: pulumi.String("Enterprise"),
FilteredSyncEnabled: pulumi.Bool(false),
InitialReplicaSet: &domainservices.ServiceInitialReplicaSetArgs{
Location: primaryVirtualNetwork.Location,
SubnetId: primarySubnet.ID(),
},
Notifications: &domainservices.ServiceNotificationsArgs{
AdditionalRecipients: pulumi.StringArray{
pulumi.String("notifyA@example.net"),
pulumi.String("notifyB@example.org"),
},
NotifyDcAdmins: pulumi.Bool(true),
NotifyGlobalAdmins: pulumi.Bool(true),
},
Security: &domainservices.ServiceSecurityArgs{
SyncKerberosPasswords: pulumi.Bool(true),
SyncNtlmPasswords: pulumi.Bool(true),
SyncOnPremPasswords: pulumi.Bool(true),
},
Tags: pulumi.StringMap{
"Environment": pulumi.String("prod"),
},
}, pulumi.DependsOn([]pulumi.Resource{
exampleServicePrincipal,
primarySubnetNetworkSecurityGroupAssociation,
}))
if err != nil {
return err
}
replicaResourceGroup, err := core.NewResourceGroup(ctx, "replicaResourceGroup", &core.ResourceGroupArgs{
Location: pulumi.String("North Europe"),
})
if err != nil {
return err
}
replicaVirtualNetwork, err := network.NewVirtualNetwork(ctx, "replicaVirtualNetwork", &network.VirtualNetworkArgs{
Location: replicaResourceGroup.Location,
ResourceGroupName: replicaResourceGroup.Name,
AddressSpaces: pulumi.StringArray{
pulumi.String("10.20.0.0/16"),
},
})
if err != nil {
return err
}
aaddsReplicaSubnet, err := network.NewSubnet(ctx, "aaddsReplicaSubnet", &network.SubnetArgs{
ResourceGroupName: replicaResourceGroup.Name,
VirtualNetworkName: replicaVirtualNetwork.Name,
AddressPrefixes: pulumi.StringArray{
pulumi.String("10.20.0.0/24"),
},
})
if err != nil {
return err
}
aaddsReplicaNetworkSecurityGroup, err := network.NewNetworkSecurityGroup(ctx, "aaddsReplicaNetworkSecurityGroup", &network.NetworkSecurityGroupArgs{
Location: replicaResourceGroup.Location,
ResourceGroupName: replicaResourceGroup.Name,
SecurityRules: network.NetworkSecurityGroupSecurityRuleArray{
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowSyncWithAzureAD"),
Priority: pulumi.Int(101),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("443"),
SourceAddressPrefix: pulumi.String("AzureActiveDirectoryDomainServices"),
DestinationAddressPrefix: pulumi.String("*"),
},
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowRD"),
Priority: pulumi.Int(201),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("3389"),
SourceAddressPrefix: pulumi.String("CorpNetSaw"),
DestinationAddressPrefix: pulumi.String("*"),
},
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowPSRemoting"),
Priority: pulumi.Int(301),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("5986"),
SourceAddressPrefix: pulumi.String("AzureActiveDirectoryDomainServices"),
DestinationAddressPrefix: pulumi.String("*"),
},
&network.NetworkSecurityGroupSecurityRuleArgs{
Name: pulumi.String("AllowLDAPS"),
Priority: pulumi.Int(401),
Direction: pulumi.String("Inbound"),
Access: pulumi.String("Allow"),
Protocol: pulumi.String("Tcp"),
SourcePortRange: pulumi.String("*"),
DestinationPortRange: pulumi.String("636"),
SourceAddressPrefix: pulumi.String("*"),
DestinationAddressPrefix: pulumi.String("*"),
},
},
})
if err != nil {
return err
}
replicaSubnetNetworkSecurityGroupAssociation, err := network.NewSubnetNetworkSecurityGroupAssociation(ctx, "replicaSubnetNetworkSecurityGroupAssociation", &network.SubnetNetworkSecurityGroupAssociationArgs{
SubnetId: aaddsReplicaSubnet.ID(),
NetworkSecurityGroupId: aaddsReplicaNetworkSecurityGroup.ID(),
})
if err != nil {
return err
}
primaryReplica, err := network.NewVirtualNetworkPeering(ctx, "primaryReplica", &network.VirtualNetworkPeeringArgs{
ResourceGroupName: primaryVirtualNetwork.ResourceGroupName,
VirtualNetworkName: primaryVirtualNetwork.Name,
RemoteVirtualNetworkId: replicaVirtualNetwork.ID(),
AllowForwardedTraffic: pulumi.Bool(true),
AllowGatewayTransit: pulumi.Bool(false),
AllowVirtualNetworkAccess: pulumi.Bool(true),
UseRemoteGateways: pulumi.Bool(false),
})
if err != nil {
return err
}
replicaPrimary, err := network.NewVirtualNetworkPeering(ctx, "replicaPrimary", &network.VirtualNetworkPeeringArgs{
ResourceGroupName: replicaVirtualNetwork.ResourceGroupName,
VirtualNetworkName: replicaVirtualNetwork.Name,
RemoteVirtualNetworkId: primaryVirtualNetwork.ID(),
AllowForwardedTraffic: pulumi.Bool(true),
AllowGatewayTransit: pulumi.Bool(false),
AllowVirtualNetworkAccess: pulumi.Bool(true),
UseRemoteGateways: pulumi.Bool(false),
})
if err != nil {
return err
}
_, err = network.NewVirtualNetworkDnsServers(ctx, "replicaVirtualNetworkDnsServers", &network.VirtualNetworkDnsServersArgs{
VirtualNetworkId: replicaVirtualNetwork.ID(),
DnsServers: exampleService.InitialReplicaSet.ApplyT(func(initialReplicaSet domainservices.ServiceInitialReplicaSet) (interface{}, error) {
return initialReplicaSet.DomainControllerIpAddresses, nil
}).(pulumi.Interface{}Output),
})
if err != nil {
return err
}
_, err = domainservices.NewReplicaSet(ctx, "replicaReplicaSet", &domainservices.ReplicaSetArgs{
DomainServiceId: exampleService.ID(),
Location: replicaResourceGroup.Location,
SubnetId: aaddsReplicaSubnet.ID(),
}, pulumi.DependsOn([]pulumi.Resource{
replicaSubnetNetworkSecurityGroupAssociation,
primaryReplica,
replicaPrimary,
}))
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.network.VirtualNetwork;
import com.pulumi.azure.network.VirtualNetworkArgs;
import com.pulumi.azure.network.Subnet;
import com.pulumi.azure.network.SubnetArgs;
import com.pulumi.azure.network.NetworkSecurityGroup;
import com.pulumi.azure.network.NetworkSecurityGroupArgs;
import com.pulumi.azure.network.inputs.NetworkSecurityGroupSecurityRuleArgs;
import com.pulumi.azure.network.SubnetNetworkSecurityGroupAssociation;
import com.pulumi.azure.network.SubnetNetworkSecurityGroupAssociationArgs;
import com.pulumi.azuread.Group;
import com.pulumi.azuread.GroupArgs;
import com.pulumi.azuread.User;
import com.pulumi.azuread.UserArgs;
import com.pulumi.azuread.GroupMember;
import com.pulumi.azuread.GroupMemberArgs;
import com.pulumi.azuread.ServicePrincipal;
import com.pulumi.azuread.ServicePrincipalArgs;
import com.pulumi.azure.domainservices.Service;
import com.pulumi.azure.domainservices.ServiceArgs;
import com.pulumi.azure.domainservices.inputs.ServiceInitialReplicaSetArgs;
import com.pulumi.azure.domainservices.inputs.ServiceNotificationsArgs;
import com.pulumi.azure.domainservices.inputs.ServiceSecurityArgs;
import com.pulumi.azure.network.VirtualNetworkPeering;
import com.pulumi.azure.network.VirtualNetworkPeeringArgs;
import com.pulumi.azure.network.VirtualNetworkDnsServers;
import com.pulumi.azure.network.VirtualNetworkDnsServersArgs;
import com.pulumi.azure.domainservices.ReplicaSet;
import com.pulumi.azure.domainservices.ReplicaSetArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var primaryResourceGroup = new ResourceGroup("primaryResourceGroup", ResourceGroupArgs.builder()
.location("West Europe")
.build());
var primaryVirtualNetwork = new VirtualNetwork("primaryVirtualNetwork", VirtualNetworkArgs.builder()
.location(primaryResourceGroup.location())
.resourceGroupName(primaryResourceGroup.name())
.addressSpaces("10.0.1.0/16")
.build());
var primarySubnet = new Subnet("primarySubnet", SubnetArgs.builder()
.resourceGroupName(primaryResourceGroup.name())
.virtualNetworkName(primaryVirtualNetwork.name())
.addressPrefixes("10.0.1.0/24")
.build());
var primaryNetworkSecurityGroup = new NetworkSecurityGroup("primaryNetworkSecurityGroup", NetworkSecurityGroupArgs.builder()
.location(primaryResourceGroup.location())
.resourceGroupName(primaryResourceGroup.name())
.securityRules(
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowSyncWithAzureAD")
.priority(101)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("443")
.sourceAddressPrefix("AzureActiveDirectoryDomainServices")
.destinationAddressPrefix("*")
.build(),
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowRD")
.priority(201)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("3389")
.sourceAddressPrefix("CorpNetSaw")
.destinationAddressPrefix("*")
.build(),
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowPSRemoting")
.priority(301)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("5986")
.sourceAddressPrefix("AzureActiveDirectoryDomainServices")
.destinationAddressPrefix("*")
.build(),
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowLDAPS")
.priority(401)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("636")
.sourceAddressPrefix("*")
.destinationAddressPrefix("*")
.build())
.build());
var primarySubnetNetworkSecurityGroupAssociation = new SubnetNetworkSecurityGroupAssociation("primarySubnetNetworkSecurityGroupAssociation", SubnetNetworkSecurityGroupAssociationArgs.builder()
.subnetId(primarySubnet.id())
.networkSecurityGroupId(primaryNetworkSecurityGroup.id())
.build());
var dcAdmins = new Group("dcAdmins", GroupArgs.builder()
.displayName("aad-dc-administrators")
.securityEnabled(true)
.build());
var adminUser = new User("adminUser", UserArgs.builder()
.userPrincipalName("dc-admin@hashicorp-example.net")
.displayName("DC Administrator")
.password("Pa55w0Rd!!1")
.build());
var adminGroupMember = new GroupMember("adminGroupMember", GroupMemberArgs.builder()
.groupObjectId(dcAdmins.objectId())
.memberObjectId(adminUser.objectId())
.build());
var exampleServicePrincipal = new ServicePrincipal("exampleServicePrincipal", ServicePrincipalArgs.builder()
.applicationId("2565bd9d-da50-47d4-8b85-4c97f669dc36")
.build());
var aadds = new ResourceGroup("aadds", ResourceGroupArgs.builder()
.location("westeurope")
.build());
var exampleService = new Service("exampleService", ServiceArgs.builder()
.location(aadds.location())
.resourceGroupName(aadds.name())
.domainName("widgetslogin.net")
.sku("Enterprise")
.filteredSyncEnabled(false)
.initialReplicaSet(ServiceInitialReplicaSetArgs.builder()
.location(primaryVirtualNetwork.location())
.subnetId(primarySubnet.id())
.build())
.notifications(ServiceNotificationsArgs.builder()
.additionalRecipients(
"notifyA@example.net",
"notifyB@example.org")
.notifyDcAdmins(true)
.notifyGlobalAdmins(true)
.build())
.security(ServiceSecurityArgs.builder()
.syncKerberosPasswords(true)
.syncNtlmPasswords(true)
.syncOnPremPasswords(true)
.build())
.tags(Map.of("Environment", "prod"))
.build(), CustomResourceOptions.builder()
.dependsOn(
exampleServicePrincipal,
primarySubnetNetworkSecurityGroupAssociation)
.build());
var replicaResourceGroup = new ResourceGroup("replicaResourceGroup", ResourceGroupArgs.builder()
.location("North Europe")
.build());
var replicaVirtualNetwork = new VirtualNetwork("replicaVirtualNetwork", VirtualNetworkArgs.builder()
.location(replicaResourceGroup.location())
.resourceGroupName(replicaResourceGroup.name())
.addressSpaces("10.20.0.0/16")
.build());
var aaddsReplicaSubnet = new Subnet("aaddsReplicaSubnet", SubnetArgs.builder()
.resourceGroupName(replicaResourceGroup.name())
.virtualNetworkName(replicaVirtualNetwork.name())
.addressPrefixes("10.20.0.0/24")
.build());
var aaddsReplicaNetworkSecurityGroup = new NetworkSecurityGroup("aaddsReplicaNetworkSecurityGroup", NetworkSecurityGroupArgs.builder()
.location(replicaResourceGroup.location())
.resourceGroupName(replicaResourceGroup.name())
.securityRules(
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowSyncWithAzureAD")
.priority(101)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("443")
.sourceAddressPrefix("AzureActiveDirectoryDomainServices")
.destinationAddressPrefix("*")
.build(),
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowRD")
.priority(201)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("3389")
.sourceAddressPrefix("CorpNetSaw")
.destinationAddressPrefix("*")
.build(),
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowPSRemoting")
.priority(301)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("5986")
.sourceAddressPrefix("AzureActiveDirectoryDomainServices")
.destinationAddressPrefix("*")
.build(),
NetworkSecurityGroupSecurityRuleArgs.builder()
.name("AllowLDAPS")
.priority(401)
.direction("Inbound")
.access("Allow")
.protocol("Tcp")
.sourcePortRange("*")
.destinationPortRange("636")
.sourceAddressPrefix("*")
.destinationAddressPrefix("*")
.build())
.build());
var replicaSubnetNetworkSecurityGroupAssociation = new SubnetNetworkSecurityGroupAssociation("replicaSubnetNetworkSecurityGroupAssociation", SubnetNetworkSecurityGroupAssociationArgs.builder()
.subnetId(aaddsReplicaSubnet.id())
.networkSecurityGroupId(aaddsReplicaNetworkSecurityGroup.id())
.build());
var primaryReplica = new VirtualNetworkPeering("primaryReplica", VirtualNetworkPeeringArgs.builder()
.resourceGroupName(primaryVirtualNetwork.resourceGroupName())
.virtualNetworkName(primaryVirtualNetwork.name())
.remoteVirtualNetworkId(replicaVirtualNetwork.id())
.allowForwardedTraffic(true)
.allowGatewayTransit(false)
.allowVirtualNetworkAccess(true)
.useRemoteGateways(false)
.build());
var replicaPrimary = new VirtualNetworkPeering("replicaPrimary", VirtualNetworkPeeringArgs.builder()
.resourceGroupName(replicaVirtualNetwork.resourceGroupName())
.virtualNetworkName(replicaVirtualNetwork.name())
.remoteVirtualNetworkId(primaryVirtualNetwork.id())
.allowForwardedTraffic(true)
.allowGatewayTransit(false)
.allowVirtualNetworkAccess(true)
.useRemoteGateways(false)
.build());
var replicaVirtualNetworkDnsServers = new VirtualNetworkDnsServers("replicaVirtualNetworkDnsServers", VirtualNetworkDnsServersArgs.builder()
.virtualNetworkId(replicaVirtualNetwork.id())
.dnsServers(exampleService.initialReplicaSet().applyValue(initialReplicaSet -> initialReplicaSet.domainControllerIpAddresses()))
.build());
var replicaReplicaSet = new ReplicaSet("replicaReplicaSet", ReplicaSetArgs.builder()
.domainServiceId(exampleService.id())
.location(replicaResourceGroup.location())
.subnetId(aaddsReplicaSubnet.id())
.build(), CustomResourceOptions.builder()
.dependsOn(
replicaSubnetNetworkSecurityGroupAssociation,
primaryReplica,
replicaPrimary)
.build());
}
}
import pulumi
import pulumi_azure as azure
import pulumi_azuread as azuread
primary_resource_group = azure.core.ResourceGroup("primaryResourceGroup", location="West Europe")
primary_virtual_network = azure.network.VirtualNetwork("primaryVirtualNetwork",
location=primary_resource_group.location,
resource_group_name=primary_resource_group.name,
address_spaces=["10.0.1.0/16"])
primary_subnet = azure.network.Subnet("primarySubnet",
resource_group_name=primary_resource_group.name,
virtual_network_name=primary_virtual_network.name,
address_prefixes=["10.0.1.0/24"])
primary_network_security_group = azure.network.NetworkSecurityGroup("primaryNetworkSecurityGroup",
location=primary_resource_group.location,
resource_group_name=primary_resource_group.name,
security_rules=[
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowSyncWithAzureAD",
priority=101,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="443",
source_address_prefix="AzureActiveDirectoryDomainServices",
destination_address_prefix="*",
),
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowRD",
priority=201,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="3389",
source_address_prefix="CorpNetSaw",
destination_address_prefix="*",
),
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowPSRemoting",
priority=301,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="5986",
source_address_prefix="AzureActiveDirectoryDomainServices",
destination_address_prefix="*",
),
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowLDAPS",
priority=401,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="636",
source_address_prefix="*",
destination_address_prefix="*",
),
])
primary_subnet_network_security_group_association = azure.network.SubnetNetworkSecurityGroupAssociation("primarySubnetNetworkSecurityGroupAssociation",
subnet_id=primary_subnet.id,
network_security_group_id=primary_network_security_group.id)
dc_admins = azuread.Group("dcAdmins",
display_name="aad-dc-administrators",
security_enabled=True)
admin_user = azuread.User("adminUser",
user_principal_name="dc-admin@hashicorp-example.net",
display_name="DC Administrator",
password="Pa55w0Rd!!1")
admin_group_member = azuread.GroupMember("adminGroupMember",
group_object_id=dc_admins.object_id,
member_object_id=admin_user.object_id)
example_service_principal = azuread.ServicePrincipal("exampleServicePrincipal", application_id="2565bd9d-da50-47d4-8b85-4c97f669dc36")
# published app for domain services
aadds = azure.core.ResourceGroup("aadds", location="westeurope")
example_service = azure.domainservices.Service("exampleService",
location=aadds.location,
resource_group_name=aadds.name,
domain_name="widgetslogin.net",
sku="Enterprise",
filtered_sync_enabled=False,
initial_replica_set=azure.domainservices.ServiceInitialReplicaSetArgs(
location=primary_virtual_network.location,
subnet_id=primary_subnet.id,
),
notifications=azure.domainservices.ServiceNotificationsArgs(
additional_recipients=[
"notifyA@example.net",
"notifyB@example.org",
],
notify_dc_admins=True,
notify_global_admins=True,
),
security=azure.domainservices.ServiceSecurityArgs(
sync_kerberos_passwords=True,
sync_ntlm_passwords=True,
sync_on_prem_passwords=True,
),
tags={
"Environment": "prod",
},
opts=pulumi.ResourceOptions(depends_on=[
example_service_principal,
primary_subnet_network_security_group_association,
]))
replica_resource_group = azure.core.ResourceGroup("replicaResourceGroup", location="North Europe")
replica_virtual_network = azure.network.VirtualNetwork("replicaVirtualNetwork",
location=replica_resource_group.location,
resource_group_name=replica_resource_group.name,
address_spaces=["10.20.0.0/16"])
aadds_replica_subnet = azure.network.Subnet("aaddsReplicaSubnet",
resource_group_name=replica_resource_group.name,
virtual_network_name=replica_virtual_network.name,
address_prefixes=["10.20.0.0/24"])
aadds_replica_network_security_group = azure.network.NetworkSecurityGroup("aaddsReplicaNetworkSecurityGroup",
location=replica_resource_group.location,
resource_group_name=replica_resource_group.name,
security_rules=[
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowSyncWithAzureAD",
priority=101,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="443",
source_address_prefix="AzureActiveDirectoryDomainServices",
destination_address_prefix="*",
),
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowRD",
priority=201,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="3389",
source_address_prefix="CorpNetSaw",
destination_address_prefix="*",
),
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowPSRemoting",
priority=301,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="5986",
source_address_prefix="AzureActiveDirectoryDomainServices",
destination_address_prefix="*",
),
azure.network.NetworkSecurityGroupSecurityRuleArgs(
name="AllowLDAPS",
priority=401,
direction="Inbound",
access="Allow",
protocol="Tcp",
source_port_range="*",
destination_port_range="636",
source_address_prefix="*",
destination_address_prefix="*",
),
])
replica_subnet_network_security_group_association = azure.network.SubnetNetworkSecurityGroupAssociation("replicaSubnetNetworkSecurityGroupAssociation",
subnet_id=aadds_replica_subnet.id,
network_security_group_id=aadds_replica_network_security_group.id)
primary_replica = azure.network.VirtualNetworkPeering("primaryReplica",
resource_group_name=primary_virtual_network.resource_group_name,
virtual_network_name=primary_virtual_network.name,
remote_virtual_network_id=replica_virtual_network.id,
allow_forwarded_traffic=True,
allow_gateway_transit=False,
allow_virtual_network_access=True,
use_remote_gateways=False)
replica_primary = azure.network.VirtualNetworkPeering("replicaPrimary",
resource_group_name=replica_virtual_network.resource_group_name,
virtual_network_name=replica_virtual_network.name,
remote_virtual_network_id=primary_virtual_network.id,
allow_forwarded_traffic=True,
allow_gateway_transit=False,
allow_virtual_network_access=True,
use_remote_gateways=False)
replica_virtual_network_dns_servers = azure.network.VirtualNetworkDnsServers("replicaVirtualNetworkDnsServers",
virtual_network_id=replica_virtual_network.id,
dns_servers=example_service.initial_replica_set.domain_controller_ip_addresses)
replica_replica_set = azure.domainservices.ReplicaSet("replicaReplicaSet",
domain_service_id=example_service.id,
location=replica_resource_group.location,
subnet_id=aadds_replica_subnet.id,
opts=pulumi.ResourceOptions(depends_on=[
replica_subnet_network_security_group_association,
primary_replica,
replica_primary,
]))
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
import * as azuread from "@pulumi/azuread";
const primaryResourceGroup = new azure.core.ResourceGroup("primaryResourceGroup", {location: "West Europe"});
const primaryVirtualNetwork = new azure.network.VirtualNetwork("primaryVirtualNetwork", {
location: primaryResourceGroup.location,
resourceGroupName: primaryResourceGroup.name,
addressSpaces: ["10.0.1.0/16"],
});
const primarySubnet = new azure.network.Subnet("primarySubnet", {
resourceGroupName: primaryResourceGroup.name,
virtualNetworkName: primaryVirtualNetwork.name,
addressPrefixes: ["10.0.1.0/24"],
});
const primaryNetworkSecurityGroup = new azure.network.NetworkSecurityGroup("primaryNetworkSecurityGroup", {
location: primaryResourceGroup.location,
resourceGroupName: primaryResourceGroup.name,
securityRules: [
{
name: "AllowSyncWithAzureAD",
priority: 101,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "443",
sourceAddressPrefix: "AzureActiveDirectoryDomainServices",
destinationAddressPrefix: "*",
},
{
name: "AllowRD",
priority: 201,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "3389",
sourceAddressPrefix: "CorpNetSaw",
destinationAddressPrefix: "*",
},
{
name: "AllowPSRemoting",
priority: 301,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "5986",
sourceAddressPrefix: "AzureActiveDirectoryDomainServices",
destinationAddressPrefix: "*",
},
{
name: "AllowLDAPS",
priority: 401,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "636",
sourceAddressPrefix: "*",
destinationAddressPrefix: "*",
},
],
});
const primarySubnetNetworkSecurityGroupAssociation = new azure.network.SubnetNetworkSecurityGroupAssociation("primarySubnetNetworkSecurityGroupAssociation", {
subnetId: primarySubnet.id,
networkSecurityGroupId: primaryNetworkSecurityGroup.id,
});
const dcAdmins = new azuread.Group("dcAdmins", {
displayName: "aad-dc-administrators",
securityEnabled: true,
});
const adminUser = new azuread.User("adminUser", {
userPrincipalName: "dc-admin@hashicorp-example.net",
displayName: "DC Administrator",
password: "Pa55w0Rd!!1",
});
const adminGroupMember = new azuread.GroupMember("adminGroupMember", {
groupObjectId: dcAdmins.objectId,
memberObjectId: adminUser.objectId,
});
const exampleServicePrincipal = new azuread.ServicePrincipal("exampleServicePrincipal", {applicationId: "2565bd9d-da50-47d4-8b85-4c97f669dc36"});
// published app for domain services
const aadds = new azure.core.ResourceGroup("aadds", {location: "westeurope"});
const exampleService = new azure.domainservices.Service("exampleService", {
location: aadds.location,
resourceGroupName: aadds.name,
domainName: "widgetslogin.net",
sku: "Enterprise",
filteredSyncEnabled: false,
initialReplicaSet: {
location: primaryVirtualNetwork.location,
subnetId: primarySubnet.id,
},
notifications: {
additionalRecipients: [
"notifyA@example.net",
"notifyB@example.org",
],
notifyDcAdmins: true,
notifyGlobalAdmins: true,
},
security: {
syncKerberosPasswords: true,
syncNtlmPasswords: true,
syncOnPremPasswords: true,
},
tags: {
Environment: "prod",
},
}, {
dependsOn: [
exampleServicePrincipal,
primarySubnetNetworkSecurityGroupAssociation,
],
});
const replicaResourceGroup = new azure.core.ResourceGroup("replicaResourceGroup", {location: "North Europe"});
const replicaVirtualNetwork = new azure.network.VirtualNetwork("replicaVirtualNetwork", {
location: replicaResourceGroup.location,
resourceGroupName: replicaResourceGroup.name,
addressSpaces: ["10.20.0.0/16"],
});
const aaddsReplicaSubnet = new azure.network.Subnet("aaddsReplicaSubnet", {
resourceGroupName: replicaResourceGroup.name,
virtualNetworkName: replicaVirtualNetwork.name,
addressPrefixes: ["10.20.0.0/24"],
});
const aaddsReplicaNetworkSecurityGroup = new azure.network.NetworkSecurityGroup("aaddsReplicaNetworkSecurityGroup", {
location: replicaResourceGroup.location,
resourceGroupName: replicaResourceGroup.name,
securityRules: [
{
name: "AllowSyncWithAzureAD",
priority: 101,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "443",
sourceAddressPrefix: "AzureActiveDirectoryDomainServices",
destinationAddressPrefix: "*",
},
{
name: "AllowRD",
priority: 201,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "3389",
sourceAddressPrefix: "CorpNetSaw",
destinationAddressPrefix: "*",
},
{
name: "AllowPSRemoting",
priority: 301,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "5986",
sourceAddressPrefix: "AzureActiveDirectoryDomainServices",
destinationAddressPrefix: "*",
},
{
name: "AllowLDAPS",
priority: 401,
direction: "Inbound",
access: "Allow",
protocol: "Tcp",
sourcePortRange: "*",
destinationPortRange: "636",
sourceAddressPrefix: "*",
destinationAddressPrefix: "*",
},
],
});
const replicaSubnetNetworkSecurityGroupAssociation = new azure.network.SubnetNetworkSecurityGroupAssociation("replicaSubnetNetworkSecurityGroupAssociation", {
subnetId: aaddsReplicaSubnet.id,
networkSecurityGroupId: aaddsReplicaNetworkSecurityGroup.id,
});
const primaryReplica = new azure.network.VirtualNetworkPeering("primaryReplica", {
resourceGroupName: primaryVirtualNetwork.resourceGroupName,
virtualNetworkName: primaryVirtualNetwork.name,
remoteVirtualNetworkId: replicaVirtualNetwork.id,
allowForwardedTraffic: true,
allowGatewayTransit: false,
allowVirtualNetworkAccess: true,
useRemoteGateways: false,
});
const replicaPrimary = new azure.network.VirtualNetworkPeering("replicaPrimary", {
resourceGroupName: replicaVirtualNetwork.resourceGroupName,
virtualNetworkName: replicaVirtualNetwork.name,
remoteVirtualNetworkId: primaryVirtualNetwork.id,
allowForwardedTraffic: true,
allowGatewayTransit: false,
allowVirtualNetworkAccess: true,
useRemoteGateways: false,
});
const replicaVirtualNetworkDnsServers = new azure.network.VirtualNetworkDnsServers("replicaVirtualNetworkDnsServers", {
virtualNetworkId: replicaVirtualNetwork.id,
dnsServers: exampleService.initialReplicaSet.apply(initialReplicaSet => initialReplicaSet.domainControllerIpAddresses),
});
const replicaReplicaSet = new azure.domainservices.ReplicaSet("replicaReplicaSet", {
domainServiceId: exampleService.id,
location: replicaResourceGroup.location,
subnetId: aaddsReplicaSubnet.id,
}, {
dependsOn: [
replicaSubnetNetworkSecurityGroupAssociation,
primaryReplica,
replicaPrimary,
],
});
resources:
primaryResourceGroup:
type: azure:core:ResourceGroup
properties:
location: West Europe
primaryVirtualNetwork:
type: azure:network:VirtualNetwork
properties:
location: ${primaryResourceGroup.location}
resourceGroupName: ${primaryResourceGroup.name}
addressSpaces:
- 10.0.1.0/16
primarySubnet:
type: azure:network:Subnet
properties:
resourceGroupName: ${primaryResourceGroup.name}
virtualNetworkName: ${primaryVirtualNetwork.name}
addressPrefixes:
- 10.0.1.0/24
primaryNetworkSecurityGroup:
type: azure:network:NetworkSecurityGroup
properties:
location: ${primaryResourceGroup.location}
resourceGroupName: ${primaryResourceGroup.name}
securityRules:
- name: AllowSyncWithAzureAD
priority: 101
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '443'
sourceAddressPrefix: AzureActiveDirectoryDomainServices
destinationAddressPrefix: '*'
- name: AllowRD
priority: 201
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '3389'
sourceAddressPrefix: CorpNetSaw
destinationAddressPrefix: '*'
- name: AllowPSRemoting
priority: 301
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '5986'
sourceAddressPrefix: AzureActiveDirectoryDomainServices
destinationAddressPrefix: '*'
- name: AllowLDAPS
priority: 401
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '636'
sourceAddressPrefix: '*'
destinationAddressPrefix: '*'
primarySubnetNetworkSecurityGroupAssociation:
type: azure:network:SubnetNetworkSecurityGroupAssociation
properties:
subnetId: ${primarySubnet.id}
networkSecurityGroupId: ${primaryNetworkSecurityGroup.id}
dcAdmins:
type: azuread:Group
properties:
displayName: aad-dc-administrators
securityEnabled: true
adminUser:
type: azuread:User
properties:
userPrincipalName: dc-admin@hashicorp-example.net
displayName: DC Administrator
password: Pa55w0Rd!!1
adminGroupMember:
type: azuread:GroupMember
properties:
groupObjectId: ${dcAdmins.objectId}
memberObjectId: ${adminUser.objectId}
exampleServicePrincipal:
type: azuread:ServicePrincipal
properties:
applicationId: 2565bd9d-da50-47d4-8b85-4c97f669dc36
aadds:
type: azure:core:ResourceGroup
properties:
location: westeurope
exampleService:
type: azure:domainservices:Service
properties:
location: ${aadds.location}
resourceGroupName: ${aadds.name}
domainName: widgetslogin.net
sku: Enterprise
filteredSyncEnabled: false
initialReplicaSet:
location: ${primaryVirtualNetwork.location}
subnetId: ${primarySubnet.id}
notifications:
additionalRecipients:
- notifyA@example.net
- notifyB@example.org
notifyDcAdmins: true
notifyGlobalAdmins: true
security:
syncKerberosPasswords: true
syncNtlmPasswords: true
syncOnPremPasswords: true
tags:
Environment: prod
options:
dependson:
- ${exampleServicePrincipal}
- ${primarySubnetNetworkSecurityGroupAssociation}
replicaResourceGroup:
type: azure:core:ResourceGroup
properties:
location: North Europe
replicaVirtualNetwork:
type: azure:network:VirtualNetwork
properties:
location: ${replicaResourceGroup.location}
resourceGroupName: ${replicaResourceGroup.name}
addressSpaces:
- 10.20.0.0/16
aaddsReplicaSubnet:
type: azure:network:Subnet
properties:
resourceGroupName: ${replicaResourceGroup.name}
virtualNetworkName: ${replicaVirtualNetwork.name}
addressPrefixes:
- 10.20.0.0/24
aaddsReplicaNetworkSecurityGroup:
type: azure:network:NetworkSecurityGroup
properties:
location: ${replicaResourceGroup.location}
resourceGroupName: ${replicaResourceGroup.name}
securityRules:
- name: AllowSyncWithAzureAD
priority: 101
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '443'
sourceAddressPrefix: AzureActiveDirectoryDomainServices
destinationAddressPrefix: '*'
- name: AllowRD
priority: 201
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '3389'
sourceAddressPrefix: CorpNetSaw
destinationAddressPrefix: '*'
- name: AllowPSRemoting
priority: 301
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '5986'
sourceAddressPrefix: AzureActiveDirectoryDomainServices
destinationAddressPrefix: '*'
- name: AllowLDAPS
priority: 401
direction: Inbound
access: Allow
protocol: Tcp
sourcePortRange: '*'
destinationPortRange: '636'
sourceAddressPrefix: '*'
destinationAddressPrefix: '*'
replicaSubnetNetworkSecurityGroupAssociation:
type: azure:network:SubnetNetworkSecurityGroupAssociation
properties:
subnetId: ${aaddsReplicaSubnet.id}
networkSecurityGroupId: ${aaddsReplicaNetworkSecurityGroup.id}
primaryReplica:
type: azure:network:VirtualNetworkPeering
properties:
resourceGroupName: ${primaryVirtualNetwork.resourceGroupName}
virtualNetworkName: ${primaryVirtualNetwork.name}
remoteVirtualNetworkId: ${replicaVirtualNetwork.id}
allowForwardedTraffic: true
allowGatewayTransit: false
allowVirtualNetworkAccess: true
useRemoteGateways: false
replicaPrimary:
type: azure:network:VirtualNetworkPeering
properties:
resourceGroupName: ${replicaVirtualNetwork.resourceGroupName}
virtualNetworkName: ${replicaVirtualNetwork.name}
remoteVirtualNetworkId: ${primaryVirtualNetwork.id}
allowForwardedTraffic: true
allowGatewayTransit: false
allowVirtualNetworkAccess: true
useRemoteGateways: false
replicaVirtualNetworkDnsServers:
type: azure:network:VirtualNetworkDnsServers
properties:
virtualNetworkId: ${replicaVirtualNetwork.id}
dnsServers: ${exampleService.initialReplicaSet.domainControllerIpAddresses}
replicaReplicaSet:
type: azure:domainservices:ReplicaSet
properties:
domainServiceId: ${exampleService.id}
location: ${replicaResourceGroup.location}
subnetId: ${aaddsReplicaSubnet.id}
options:
dependson:
- ${replicaSubnetNetworkSecurityGroupAssociation}
- ${primaryReplica}
- ${replicaPrimary}
Create ReplicaSet Resource
new ReplicaSet(name: string, args: ReplicaSetArgs, opts?: CustomResourceOptions);
@overload
def ReplicaSet(resource_name: str,
opts: Optional[ResourceOptions] = None,
domain_service_id: Optional[str] = None,
location: Optional[str] = None,
subnet_id: Optional[str] = None)
@overload
def ReplicaSet(resource_name: str,
args: ReplicaSetArgs,
opts: Optional[ResourceOptions] = None)
func NewReplicaSet(ctx *Context, name string, args ReplicaSetArgs, opts ...ResourceOption) (*ReplicaSet, error)
public ReplicaSet(string name, ReplicaSetArgs args, CustomResourceOptions? opts = null)
public ReplicaSet(String name, ReplicaSetArgs args)
public ReplicaSet(String name, ReplicaSetArgs args, CustomResourceOptions options)
type: azure:domainservices:ReplicaSet
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ReplicaSetArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ReplicaSetArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ReplicaSetArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ReplicaSetArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ReplicaSetArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
ReplicaSet Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The ReplicaSet resource accepts the following input properties:
- Domain
Service stringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- Subnet
Id string The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- Location string
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- Domain
Service stringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- Subnet
Id string The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- Location string
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- domain
Service StringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- subnet
Id String The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- location String
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- domain
Service stringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- subnet
Id string The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- location string
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- domain_
service_ strid The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- subnet_
id str The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- location str
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- domain
Service StringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- subnet
Id String The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- location String
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
Outputs
All input properties are implicitly available as output properties. Additionally, the ReplicaSet resource produces the following output properties:
- Domain
Controller List<string>Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- External
Access stringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- Id string
The provider-assigned unique ID for this managed resource.
- Service
Status string The current service status for the replica set.
- Domain
Controller []stringIp Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- External
Access stringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- Id string
The provider-assigned unique ID for this managed resource.
- Service
Status string The current service status for the replica set.
- domain
Controller List<String>Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- external
Access StringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- id String
The provider-assigned unique ID for this managed resource.
- service
Status String The current service status for the replica set.
- domain
Controller string[]Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- external
Access stringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- id string
The provider-assigned unique ID for this managed resource.
- service
Status string The current service status for the replica set.
- domain_
controller_ Sequence[str]ip_ addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- external_
access_ strip_ address The publicly routable IP address for the domain controllers in this Replica Set.
- id str
The provider-assigned unique ID for this managed resource.
- service_
status str The current service status for the replica set.
- domain
Controller List<String>Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- external
Access StringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- id String
The provider-assigned unique ID for this managed resource.
- service
Status String The current service status for the replica set.
Look up Existing ReplicaSet Resource
Get an existing ReplicaSet resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ReplicaSetState, opts?: CustomResourceOptions): ReplicaSet
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
domain_controller_ip_addresses: Optional[Sequence[str]] = None,
domain_service_id: Optional[str] = None,
external_access_ip_address: Optional[str] = None,
location: Optional[str] = None,
service_status: Optional[str] = None,
subnet_id: Optional[str] = None) -> ReplicaSet
func GetReplicaSet(ctx *Context, name string, id IDInput, state *ReplicaSetState, opts ...ResourceOption) (*ReplicaSet, error)
public static ReplicaSet Get(string name, Input<string> id, ReplicaSetState? state, CustomResourceOptions? opts = null)
public static ReplicaSet get(String name, Output<String> id, ReplicaSetState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Domain
Controller List<string>Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- Domain
Service stringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- External
Access stringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- Location string
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- Service
Status string The current service status for the replica set.
- Subnet
Id string The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- Domain
Controller []stringIp Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- Domain
Service stringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- External
Access stringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- Location string
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- Service
Status string The current service status for the replica set.
- Subnet
Id string The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- domain
Controller List<String>Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- domain
Service StringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- external
Access StringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- location String
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- service
Status String The current service status for the replica set.
- subnet
Id String The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- domain
Controller string[]Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- domain
Service stringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- external
Access stringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- location string
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- service
Status string The current service status for the replica set.
- subnet
Id string The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- domain_
controller_ Sequence[str]ip_ addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- domain_
service_ strid The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- external_
access_ strip_ address The publicly routable IP address for the domain controllers in this Replica Set.
- location str
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- service_
status str The current service status for the replica set.
- subnet_
id str The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
- domain
Controller List<String>Ip Addresses A list of subnet IP addresses for the domain controllers in this Replica Set, typically two.
- domain
Service StringId The ID of the Domain Service for which to create this Replica Set. Changing this forces a new resource to be created.
- external
Access StringIp Address The publicly routable IP address for the domain controllers in this Replica Set.
- location String
The Azure location where this Replica Set should exist. Changing this forces a new resource to be created.
- service
Status String The current service status for the replica set.
- subnet
Id String The ID of the subnet in which to place this Replica Set. Changing this forces a new resource to be created.
Import
Domain Service Replica Sets can be imported using the resource ID of the parent Domain Service and the Replica Set ID, e.g.
$ pulumi import azure:domainservices/replicaSet:ReplicaSet example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.AAD/domainServices/instance1/replicaSets/00000000-0000-0000-0000-000000000000
Package Details
- Repository
- Azure Classic pulumi/pulumi-azure
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
azurerm
Terraform Provider.