Azure Network IP Group
This page shows how to write Terraform and Azure Resource Manager for Network IP Group and write them securely.
azurerm_ip_group (Terraform)
The IP Group in Network can be configured in Terraform with the resource name azurerm_ip_group
. The following sections describe 8 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_ip_group" "aadds" {
name = "ipg-aadds"
resource_group_name = azurerm_resource_group.network.name
location = azurerm_resource_group.network.location
cidrs = var.ipgroup_aadds
tags = var.tags
resource "azurerm_ip_group" "HomeBase" {
name = "HomeBase"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
cidrs = var.homebaseIPs
resource "azurerm_ip_group" "ip_group" {
for_each = var.ip_groups
name = each.key
location = var.location
resource_group_name = var.rg_name
cidrs = each.value
resource "azurerm_ip_group" "ip_group" {
name = azurecaf_name.ip_group.result
location = var.resource_group.location
resource_group_name = var.resource_group.name
tags = local.tags
resource "azurerm_ip_group" "ip_group" {
name = azurecaf_name.ip_group.result
location = var.resource_group.location
resource_group_name = var.resource_group.name
tags = local.tags
resource "azurerm_ip_group" "ip_group" {
name = azurecaf_name.ip_group.result
location = var.resource_group.location
resource_group_name = var.resource_group.name
tags = local.tags
resource "azurerm_ip_group" "ip_group" {
name = azurecaf_name.ip_group.result
location = var.resource_group.location
resource_group_name = var.resource_group.name
tags = local.tags
resource "azurerm_ip_group" "ip_group" {
name = azurecaf_name.ip_group.result
location = var.resource_group.location
resource_group_name = var.resource_group.name
tags = local.tags
Parameters
-
cidrs
optional - set of string -
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
timeouts
single block
Explanation in Terraform Registry
Manages an IP group that contains a list of CIDRs and/or IP addresses.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/ipGroups (Azure Resource Manager)
The ipGroups in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/ipGroups
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/ipGroups",
"apiVersion": "2019-12-01",
"name": "Spoke-IP-Group",
"location": "[parameters('location')]",
"properties": {
"ipAddresses": [
"type": "Microsoft.Network/ipGroups",
"apiVersion": "2020-05-01",
"name": "customer-spoke-ipg",
"location": "[parameters('location')]",
"tags": {
"Owner": "Block Solutions",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
"type": "Microsoft.Network/ipGroups",
"location": "westcentralus",
"properties": {
"provisioningState": "Succeeded",
"ipAddresses": [
"13.64.39.16/32",
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredipAddresses
optional - arrayIpAddresses/IpAddressPrefixes in the IpGroups resource.
Frequently asked questions
What is Azure Network IP Group?
Azure Network IP Group is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network IP Group?
For Terraform, the pauldotyu/azure-network-terraform, Oddjob62/AzureFirewall and mgsj2006/azurerm-module-ip-group source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the bjowett-block/Lab-WVD, bjowett-block/Lab-WVD and debhol/azuredocs source code examples are useful. See the Azure Resource Manager Example section for further details.