Azure Network Connection
This page shows how to write Terraform and Azure Resource Manager for Network Connection and write them securely.
azurerm_express_route_connection (Terraform)
The Connection in Network can be configured in Terraform with the resource name azurerm_express_route_connection
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
The following arguments are supported:
name
- (Required) The name which should be used for this Express Route Connection. Changing this forces a new resource to be created.express_route_circuit_peering_id
- (Required) The ID of the Express Route Circuit Peering that this Express Route Connection connects with. Changing this forces a new resource to be created.express_route_gateway_id
- (Required) The ID of the Express Route Gateway that this Express Route Connection connects with. Changing this forces a new resource to be created.authorization_key
- (Optional) The authorization key to establish the Express Route Connection.enable_internet_security
- (Optional) Is Internet security enabled for this Express Route Connection?routing
- (Optional) Arouting
block as defined below.routing_weight
- (Optional) The routing weight associated to the Express Route Connection. Possible value is between0
and32000
. Defaults to0
.
A routing
block supports the following:
associated_route_table_id
- (Optional) The ID of the Virtual Hub Route Table associated with this Express Route Connection.propagated_route_table
- (Optional) Apropagated_route_table
block as defined below.
A propagated_route_table
block supports the following:
labels
- (Optional) The list of labels to logically group route tables.route_table_ids
- (Optional) A list of IDs of the Virtual Hub Route Table to propagate routes from Express Route Connection to the route table.
The following attributes are exported:
id
- The ID of the Express Route Connection.
Explanation in Terraform Registry
Manages an Express Route Connection.
NOTE: The provider status of the Express Route Circuit must be set as provisioned while creating the Express Route Connection. See more details here.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/expressRouteGateways/expressRouteConnections (Azure Resource Manager)
The expressRouteGateways/expressRouteConnections in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/expressRouteGateways/expressRouteConnections
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
name
required - stringtype
required - stringapiVersion
required - stringproperties
requiredexpressRouteCircuitPeering
requiredid
required - stringResource ID.
authorizationKey
optional - stringAuthorization key to establish the connection.
routingWeight
optional - integerThe routing weight associated to the connection.
enableInternetSecurity
optional - booleanEnable internet security.
expressRouteGatewayBypass
optional - booleanEnable FastPath to vWan Firewall hub.
routingConfiguration
optionalassociatedRouteTable
optionalid
required - stringResource ID.
propagatedRouteTables
optionallabels
optional - arrayThe list of labels.
ids
optional arrayid
required - stringResource ID.
vnetRoutes
optionalstaticRoutes
optional arrayname
optional - stringThe name of the StaticRoute that is unique within a VnetRoute.
addressPrefixes
optional - arrayList of all address prefixes.
nextHopIpAddress
optional - stringThe ip address of the next hop.