Azure Network Policy Rule Collection Group
This page shows how to write Terraform and Azure Resource Manager for Network Policy Rule Collection Group and write them securely.
azurerm_firewall_policy_rule_collection_group (Terraform)
The Policy Rule Collection Group in Network can be configured in Terraform with the resource name azurerm_firewall_policy_rule_collection_group
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_firewall_policy_rule_collection_group" "example" {
name = "example-fwpolicy-rcg"
firewall_policy_id = azurerm_firewall_policy.example.id
priority = 500
application_rule_collection {
resource "azurerm_firewall_policy_rule_collection_group" "rule_collection_group" {
name = var.name
firewall_policy_id = var.firewall_policy_id
priority = var.priority
dynamic "network_rule_collection" {
resource "azurerm_firewall_policy_rule_collection_group" "AKS" {
name = "aks-rcg"
firewall_policy_id = azurerm_firewall_policy.aks.id
priority = 200
application_rule_collection {
name = "aks_app_rules"
resource "azurerm_firewall_policy_rule_collection_group" "AKS" {
name = "aks-rcg"
firewall_policy_id = azurerm_firewall_policy.aks.id
priority = 200
application_rule_collection {
name = "aks_app_rules"
resource "azurerm_firewall_policy_rule_collection_group" "AKS" {
name = "aks-rcg"
firewall_policy_id = azurerm_firewall_policy.aks.id
priority = 200
application_rule_collection {
name = "aks_app_rules"
resource "azurerm_firewall_policy_rule_collection_group" "AKS" {
name = "aks-rcg"
firewall_policy_id = azurerm_firewall_policy.aks.id
priority = 200
application_rule_collection {
name = "aks_app_rules"
resource "azurerm_firewall_policy_rule_collection_group" "nat_rule_group" {
name = "nat-rule-group"
firewall_policy_id = azurerm_firewall_policy.example.id
priority = 1000
nat_rule_collection {
resource "azurerm_firewall_policy_rule_collection_group" "AKS" {
name = "aks-rcg"
firewall_policy_id = azurerm_firewall_policy.aks.id
priority = 200
application_rule_collection {
name = "aks_app_rules"
resource "azurerm_firewall_policy_rule_collection_group" "AKS" {
name = "aks-rcg"
firewall_policy_id = azurerm_firewall_policy.aks.id
priority = 200
application_rule_collection {
name = "aks_app_rules"
resource "azurerm_firewall_policy_rule_collection_group" "AKS" {
name = "aks-rcg"
firewall_policy_id = azurerm_firewall_policy.aks.id
priority = 200
application_rule_collection {
name = "aks_app_rules"
Parameters
-
firewall_policy_id
required - string -
id
optional computed - string -
name
required - string -
priority
required - number -
application_rule_collection
set block-
action
required - string -
name
required - string -
priority
required - number -
rule
set block-
destination_fqdn_tags
optional - set of string -
destination_fqdns
optional - set of string -
name
required - string -
source_addresses
optional - set of string -
source_ip_groups
optional - set of string -
protocols
set block
-
-
-
nat_rule_collection
set block-
action
required - string -
name
required - string -
priority
required - number -
rule
set block-
destination_address
optional - string -
destination_ports
optional - set of string -
name
required - string -
protocols
required - set of string -
source_addresses
optional - set of string -
source_ip_groups
optional - set of string -
translated_address
required - string -
translated_port
required - number
-
-
-
network_rule_collection
set block-
action
required - string -
name
required - string -
priority
required - number -
rule
set block-
destination_addresses
optional - set of string -
destination_fqdns
optional - set of string -
destination_ip_groups
optional - set of string -
destination_ports
required - set of string -
name
required - string -
protocols
required - set of string -
source_addresses
optional - set of string -
source_ip_groups
optional - set of string
-
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a Firewall Policy Rule Collection Group.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/firewallPolicies/ruleCollectionGroups (Azure Resource Manager)
The firewallPolicies/ruleCollectionGroups in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/firewallPolicies/ruleCollectionGroups
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
name
required - stringtype
required - stringapiVersion
required - stringproperties
requiredpriority
optional - integerPriority of the Firewall Policy Rule Collection Group resource.
ruleCollections
optional arrayname
optional - stringThe name of the rule collection.
priority
optional - integerPriority of the Firewall Policy Rule Collection resource.
ruleCollectionType
required - string
Frequently asked questions
What is Azure Network Policy Rule Collection Group?
Azure Network Policy Rule Collection Group is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Policy Rule Collection Group?
For Terraform, the timwebster9/azure-policy, vmisson/terraform-azure-firewall and techbunny/cs-AKS source code examples are useful. See the Terraform Example section for further details.