Azure Network Connection Monitor
This page shows how to write Terraform and Azure Resource Manager for Network Connection Monitor and write them securely.
azurerm_network_connection_monitor (Terraform)
The Connection Monitor in Network can be configured in Terraform with the resource name azurerm_network_connection_monitor
. The following sections describe 2 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_network_connection_monitor" "this" {
auto_start = var.auto_start
interval_in_seconds = var.interval_in_seconds
location = var.location
name = var.name
network_watcher_name = var.network_watcher_name
resource "azurerm_network_connection_monitor" "this" {
auto_start = var.auto_start
interval_in_seconds = var.interval_in_seconds
location = var.location
name = var.name
network_watcher_name = var.network_watcher_name
Parameters
-
auto_start
optional computed - bool -
id
optional computed - string -
interval_in_seconds
optional computed - number -
location
required - string -
name
required - string -
network_watcher_id
required - string -
notes
optional - string -
output_workspace_resource_ids
optional computed - set of string -
tags
optional - map from string to string -
destination
list block-
address
optional computed - string -
port
optional computed - number -
virtual_machine_id
optional computed - string
-
-
endpoint
set block -
source
list block-
port
optional computed - number -
virtual_machine_id
optional computed - string
-
-
test_configuration
set block-
name
required - string -
preferred_ip_version
optional - string -
protocol
required - string -
test_frequency_in_seconds
optional - number -
http_configuration
list block-
method
optional - string -
path
optional - string -
port
optional - number -
prefer_https
optional - bool -
valid_status_code_ranges
optional - set of string -
request_header
set block
-
-
icmp_configuration
list block-
trace_route_enabled
optional - bool
-
-
success_threshold
list block-
checks_failed_percent
optional - number -
round_trip_time_ms
optional - number
-
-
tcp_configuration
list block-
port
required - number -
trace_route_enabled
optional - bool
-
-
-
test_group
set block-
destination_endpoints
required - set of string -
enabled
optional - bool -
name
required - string -
source_endpoints
required - set of string -
test_configuration_names
required - set of string
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a Network Connection Monitor.
NOTE: Any Network Connection Monitor resource created with API versions 2019-06-01 or earlier (v1) are now incompatible with Terraform, which now only supports v2.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/networkWatchers/connectionMonitors (Azure Resource Manager)
The networkWatchers/connectionMonitors in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/networkWatchers/connectionMonitors
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
optional - stringConnection monitor location.
tags
optional - stringConnection monitor tags.
properties
requiredsource
optionalresourceId
required - stringThe ID of the resource used as the source by connection monitor.
port
optional - integerThe source port used by connection monitor.
destination
optionalresourceId
optional - stringThe ID of the resource used as the destination by connection monitor.
address
optional - stringAddress of the connection monitor destination (IP or domain name).
port
optional - integerThe destination port used by connection monitor.
autoStart
optional - booleanDetermines if the connection monitor will start automatically once created.
monitoringIntervalInSeconds
optional - integerMonitoring interval in seconds.
endpoints
optional arrayname
required - stringThe name of the connection monitor endpoint.
type
optional - stringThe endpoint type.
resourceId
optional - stringResource ID of the connection monitor endpoint.
address
optional - stringAddress of the connection monitor endpoint (IP or domain name).
filter
optionaltype
optional - stringThe behavior of the endpoint filter. Currently only 'Include' is supported.
items
optional arraytype
optional - stringThe type of item included in the filter. Currently only 'AgentAddress' is supported.
address
optional - stringThe address of the filter item.
scope
optionalinclude
optional arrayaddress
optional - stringThe address of the endpoint item. Supported types are IPv4/IPv6 subnet mask or IPv4/IPv6 IP address.
exclude
optional arrayaddress
optional - stringThe address of the endpoint item. Supported types are IPv4/IPv6 subnet mask or IPv4/IPv6 IP address.
coverageLevel
optional - stringTest coverage for the endpoint.
testConfigurations
optional arrayname
required - stringThe name of the connection monitor test configuration.
testFrequencySec
optional - integerThe frequency of test evaluation, in seconds.
protocol
required - stringThe protocol to use in test evaluation.
preferredIPVersion
optional - stringThe preferred IP version to use in test evaluation. The connection monitor may choose to use a different version depending on other parameters.
httpConfiguration
optionalport
optional - integerThe port to connect to.
method
optional - stringThe HTTP method to use.
path
optional - stringThe path component of the URI. For instance, "/dir1/dir2".
requestHeaders
optional arrayname
optional - stringThe name in HTTP header.
value
optional - stringThe value in HTTP header.
validStatusCodeRanges
optional - arrayHTTP status codes to consider successful. For instance, "2xx,301-304,418".
preferHTTPS
optional - booleanValue indicating whether HTTPS is preferred over HTTP in cases where the choice is not explicit.
tcpConfiguration
optionalport
optional - integerThe port to connect to.
disableTraceRoute
optional - booleanValue indicating whether path evaluation with trace route should be disabled.
destinationPortBehavior
optional - stringDestination port behavior.
icmpConfiguration
optionaldisableTraceRoute
optional - booleanValue indicating whether path evaluation with trace route should be disabled.
successThreshold
optionalchecksFailedPercent
optional - integerThe maximum percentage of failed checks permitted for a test to evaluate as successful.
roundTripTimeMs
optional - numberThe maximum round-trip time in milliseconds permitted for a test to evaluate as successful.
testGroups
optional arrayname
required - stringThe name of the connection monitor test group.
disable
optional - booleanValue indicating whether test group is disabled.
testConfigurations
required - arrayList of test configuration names.
sources
required - arrayList of source endpoint names.
destinations
required - arrayList of destination endpoint names.
outputs
optional arraytype
optional - stringConnection monitor output destination type. Currently, only "Workspace" is supported.
workspaceSettings
optionalworkspaceResourceId
optional - stringLog analytics workspace resource ID.
notes
optional - stringOptional notes to be associated with the connection monitor.
Frequently asked questions
What is Azure Network Connection Monitor?
Azure Network Connection Monitor is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Connection Monitor?
For Terraform, the kevinhead/azurerm and niveklabs/azurerm source code examples are useful. See the Terraform Example section for further details.