Add clarity around usage of DDoS Standard plan in ESLZ

[jtracey93]

In ESLZ a DDoS Standard plan is shown in the diagrams to be deployed in the connectivity subscriptions.

However, in the Virtual WAN & Hub and Spoke documentation there is no reference to the DDoS Standard plan.

As discussed with @victorar, this issue will track the updating of the documentation to detail the usage and limitations of the DDoS standard plan in the above docs.

[jtracey93]

PR created to update CAF documentation.

[pazdedav]

Considering that DDoS Standard has a flat fee of $2944 / month, I was wondering, why is the related policy enabled by default and not exposed as a configuration option in the UI experience (like Enable Azure Defender or similar).
Any insights @victorar or @jtracey93 ?

[krnese]

Can you elaborate? In AdventureWorks, we allow you to select DDoS for connectivity subscription and we are leading with the recommendation (default set to enable, but you can disable). If enabled, we also provide the option to enforce DDoS on vnets created in the landing zones (also an option)

[victorar]

That is correct, the recommendation is to deploy a DDoS Std plan to protect landing zones VNets with public IPs against DDoS attacks. By default, the UI recommends to deploy this, but it allows to opt-out, if organizations decide not to enable DDoS Std in their environments.

[pazdedav]

Sure. I have been mainly working with Contoso, where this selection is not available in the UX (and I believe the same applies to WingTip). I see the policyDef in policies.json but I can't find any related assignment in nested deployments.

Perhaps it is only a matter of consistency across reference implementations?

[jtracey93]

Thanks for reporting this @pazdedav.

I went through all the reference implementations this morning and confirmed that only Adventure Works has the options for DDoS Std enablement.

We will review as a team and update.

[jtracey93]

Just to provide an update here. We have discussed as a team and will be adding the DDoS Std to Contoso & WingTip in the future (being tracked separately already).

Also the CAF documentation PR has been merged so the docs now provide considerations and recommendations for DDoS Std for ESLZ.

With this I will close this issue 👍