https://github.com/groovy-sky/nlap
CLI tool for configuring network access of Azure PaaS
https://github.com/groovy-sky/nlap
azure golang microsoft
Last synced: about 2 months ago
JSON representation
CLI tool for configuring network access of Azure PaaS
- Host: GitHub
- URL: https://github.com/groovy-sky/nlap
- Owner: groovy-sky
- License: bsd-2-clause
- Created: 2023-04-06T08:09:06.000Z (about 3 years ago)
- Default Branch: main
- Last Pushed: 2023-05-31T09:26:49.000Z (about 3 years ago)
- Last Synced: 2025-12-27T04:27:34.245Z (6 months ago)
- Topics: azure, golang, microsoft
- Language: Go
- Homepage:
- Size: 64.5 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Network Limiter for Azure PaaS
## Overview
Network Limiter for Azure PaaS (aka nlap) is CLI tool, written on Golang, that limits network access to Azure PaaS (Platform-as-a-Service) instances. Under the hood it uses [Azure Go SDK](https://github.com/Azure/azure-sdk-for-go).
## Quick start
### Installation
To build from scratch you'll need Go >= 1.19. Open the terminal and execute the following command:
```
export GOPATH="$HOME/go"
PATH="$GOPATH/bin:$PATH"
go install github.com/groovy-sky/nlap/v2@latest
```
Another way how you can get this tool - check the latest version under [releases section](/releases)
### Examples
To check available commands run the tool with -h flag:
```
./nlap -h
```
By default, CLI does not overwrite existing rules (if there are any), but append them. As a source, for whitelisting, could be used list of IPs (separated by semicolon) from CLI or/and external URLs with allowed IPs(supports 'https' only).
Add to allowed IPs a list stored in URL (appends only):
```
./nlap set -u "https://raw.githubusercontent.com/groovy-sky/azure-ip-ranges/main/ip/ApiManagement.WestEurope.txt" -s "/subscriptions//resourceGroups//Microsoft.Storage/storageAccounts/"
```
Allow to access storage accounts from certain IPs only (existing rules will be removed):
```
./nlap set -i "1.1.1.1;2.2.2.2" -s "/subscriptions//resourceGroups//Microsoft.Storage/storageAccounts/;/subscriptions//resourceGroups//Microsoft.Storage/storageAccounts/" -f
```
Append access with current environment public IP (using external service for showing IP) and enable enhanced security (setup Minimum TLS version to 1.2, no anonymous access to blob containers will be allowed, HTTPS access accepted only):
```
./nlap set -u "https://api.ipify.org" -s "/subscriptions//resourceGroups//Microsoft.Storage/storageAccounts/" -e
```
Fully disable access (if you planning to use Private Endpoints only):
```
./nlap set -s "/subscriptions//resourceGroups//Microsoft.Storage/storageAccounts/" -f
```
## ToDo
- [x] Check how it works for V1 Storage
- [x] Add the possibility to get inputs from the web
- [] Develop Azure Function, which would trigger by timer and blob modification
- [x] Implement goroutine for parallel exec
- [x] Implement force
- [x] Implement secure mode - force use https only, denies public access etc.
- [x] Change CLI lib
- [] Add Windows OS for build
- [] Add disable public access option with existing rules cleanup
- [] Add another PaaS service support
- [] Add get command
## Related materials
https://github.com/Azure/azure-sdk-for-go/tree/main/sdk/azidentity
https://learn.microsoft.com/en-us/rest/api/
https://github.com/Azure/azure-sdk-for-go/blob/main/sdk/storage/azblob/examples_test.go
https://github.com/Azure-Samples/azure-sdk-for-go-samples/blob/main/sdk/resourcemanager/resource/resources/main.go
https://learn.microsoft.com/en-us/rest/api/storagerp/storage-accounts/get-properties?tabs=Go#storageaccountgetproperties
https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage#section-readme
https://learn.microsoft.com/en-us/rest/api/resources/tenants/list?tabs=HTTP
https://google.github.io/styleguide/go/