Azure Network NAT Gateway

azurerm_nat_gateway (Terraform)

The NAT Gateway in Network can be configured in Terraform with the resource name azurerm_nat_gateway. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

gilyas/infracost

resource "azurerm_nat_gateway" "my_gateway" {
  name                    = "nat-Gateway"
  location                = azurerm_resource_group.example.location
  resource_group_name     = azurerm_resource_group.example.name
  public_ip_address_ids   = [azurerm_public_ip.example.id]
  public_ip_prefix_ids    = [azurerm_public_ip_prefix.example.id]

akapernaros/iac_azure_aks

resource "azurerm_nat_gateway" "ngw" {
  depends_on = [azurerm_kubernetes_cluster.k8s, azurerm_kubernetes_cluster_node_pool.user]
  name                    = local.nat-name
  location                = var.region_name
  resource_group_name     = azurerm_resource_group.resourcegroup.name
  public_ip_prefix_ids    = [ azurerm_public_ip_prefix.ngw.id ]

YipCyrus/terraform

resource "azurerm_nat_gateway" "natgw" {
  name                = var.name
  location            = var.location
  resource_group_name = var.resource_group_name
  sku_name            = "Standard"

huangyingting/terraform

resource "azurerm_nat_gateway" "natgw" {
  name                    = "NATGW"
  location                = azurerm_resource_group.plspenat.location
  resource_group_name     = azurerm_resource_group.plspenat.name
  sku_name                = "Standard"
  idle_timeout_in_minutes = 10

chad-neal/avdtf-with-modules

resource "azurerm_nat_gateway" "natgw" {
  name                    = var.natgw_name
  location                = module.rg.rg_location
  resource_group_name     = module.rg.rg_name
  sku_name                = "Standard"
  idle_timeout_in_minutes = 10

AnikG-Org/devops-practice

resource "azurerm_nat_gateway" "nat_gateway" {
  name                = var.name
  location            = var.location
  resource_group_name = var.resource_group_name
}

sdcscripts/terraform-az-public-lb-with-nat-gateway

resource "azurerm_nat_gateway" "natgw" {
  name                    = "nat-Gateway"
  location                = data.azurerm_resource_group.natgw.location
  resource_group_name     = data.azurerm_resource_group.natgw.name
  public_ip_address_ids   = [azurerm_public_ip.natgw.id]
  sku_name                = "Standard"

ramiroduarteavalos/terraform

resource "azurerm_nat_gateway" "nat-gw" {
  name                    = "trake-nat-gateway"
  location                = azurerm_resource_group.rg.location
  resource_group_name     = azurerm_resource_group.rg.name
  public_ip_address_ids   = [azurerm_public_ip.p-ip.id]
  public_ip_prefix_ids    = [azurerm_public_ip_prefix.p-ip-px.id]

ThorstenHans/terraform-vmss-law-vminsights

resource "azurerm_nat_gateway" "nat_vmms_outbound" {
  resource_group_name = var.rg_name
  location            = var.location
  name                = "nat-vmss-outbound"

  idle_timeout_in_minutes = 15

AvocadoDevOps/azure-marketplace-prod-terraform

resource "azurerm_nat_gateway" "natgateway-marketplace-financial-prod" {
  name                    = "natgateway-marketplace-financial-prod"
  location                = var.BRS
  resource_group_name     = azurerm_resource_group.Marketplace-financeiro-prod.name
  public_ip_address_ids   = [azurerm_public_ip.IP-Public-Marketplace-Financial-prod4.id]
  sku_name                = "Standard"

Parameters

• id optional computed - string
• idle_timeout_in_minutes optional - number
• location required - string
• name required - string
• public_ip_address_ids optional computed - set of string
• public_ip_prefix_ids optional - set of string
• resource_group_name required - string
• resource_guid optional computed - string
• sku_name optional - string
• tags optional - map from string to string
• zones optional - list of string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages a Azure NAT Gateway.

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.