在 DevOps 中删除 Azure Analysis Services 防火墙规则

Question

During a deployment, Azure DevOps creates a firewall rule when deploying to Azure Analysis Services (AAS), like so:

There is an option in the 'Azure Analysis Service Deployment' task to not delete the firewall once deployed:

I uncheck this as it allows me to run Powershell against the AAS database after the deployment task (to amend the AD groups inside roles per environment, for example). DevOps has a whole host of dynamic IPs that change weekly and don't appear to match IP lists they send out in the weekly file either (that I've seen, plus amending firewall ranges weekly really is overly cumbersome), so I let the rule sit there whilst I complete my subsequent Powershell scripts.

There is a Powershell cmdlet to create a rule in the AAS firewall called 'New-AzAnalysisServicesFirewallRule'.

However, true to their remarkably consistent form for in only giving us the tools we really need, there does not appear to be a 'Remove' equivalent which obviously I would like to run to clean it up at the end. I can't see anything in the Azure REST APIs for it either. Consequently, I am manually deleting the rule in the admin portal post-deployment.

There must be some functionality to do it, hence there is a checkbox for me to re-enable should I so choose. I wonder if anyone has uncovered the secret to programatically removing an AAS firewall rule (specifically of the vsts-release-aas-rule variety) that they could share?

Answer 1

Looking at the code in the task . The strategy used is:

• Retrieve the Analysis Services server object, then the firewall config property using the Get-AzureRmAnalysisServicesServer cmdlet.
• get the firewall rules from the retrieved Firewall config
• remove the firewall rule named vsts-release-aas-rule from the firewall rules
• create a new firewall config using the new New-AzureRmAnalysisServicesFirewallConfig with the new updated Firewall rules (minus the vsts-release-aas-rule Firewall rule)
• update the Analysis server with the Set-AzureRmAnalysisServicesServer using the new firewall config