Azure Network DDOS Protection Plan
This page shows how to write Terraform and Azure Resource Manager for Network DDOS Protection Plan and write them securely.
azurerm_network_ddos_protection_plan (Terraform)
The DDOS Protection Plan in Network can be configured in Terraform with the resource name azurerm_network_ddos_protection_plan
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_network_ddos_protection_plan" "module" {
name = var.ddos_plan_name
location = var.ddos_plan_location
resource_group_name = var.rg_name
tags = var.ddos_plan_tags
resource "azurerm_network_ddos_protection_plan" "ddos_protection_geewa_a" {
name = var.ddos_protection_geewa_a
location = azurerm_resource_group.rg_geewa_name_a.location
resource_group_name = azurerm_resource_group.rg_geewa_name_a.name
depends_on = [azurerm_resource_group.rg_geewa_name_a]
}
resource "azurerm_network_ddos_protection_plan" "ddos" {
name = var.vpc_cnf["ddos_plan_name"]
location = var.location
resource_group_name = azurerm_resource_group.bozo.name
}
resource "azurerm_network_ddos_protection_plan" "ddos_plan" {
name = join( var.ddos_plan_name_separator, var.ddos_plan_name_strings)
location = var.ddos_plan_location
resource_group_name = var.resource_group_name
tags = var.ddos_plan_tags != "" ? var.ddos_plan_tags : null
resource "azurerm_network_ddos_protection_plan" "ddos_protection_plan" {
count = var.enable_ddos_standard ? 1 : 0
name = var.name
location = var.location
resource_group_name = var.rg
resource "azurerm_network_ddos_protection_plan" "example" {
name = "ddospplan1"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
}
resource "azurerm_network_ddos_protection_plan" "ddos" {
name = "ddospplan1"
location = var.location
resource_group_name = azurerm_resource_group.rg.name
}
resource "azurerm_network_ddos_protection_plan" "example" {
name = "ddospplan2"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
}
resource "azurerm_network_ddos_protection_plan" "ddos_protection_plan" {
count = var.enable_ddos_standard ? 1 : 0
name = var.name
location = var.location
resource_group_name = var.rg
resource "azurerm_network_ddos_protection_plan" "ddospplan" {
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
name = var.ddos_protection_plan_name
tags = merge(var.tags, var.custom_tags)
}
Parameters
-
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
virtual_network_ids
optional computed - list of string -
timeouts
single block
Explanation in Terraform Registry
Manages an AzureNetwork DDoS Protection Plan. -> NOTE Azure only allows
one
DDoS Protection Plan per region.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/ddosProtectionPlans (Azure Resource Manager)
The ddosProtectionPlans in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/ddosProtectionPlans
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/ddosProtectionPlans"
},
{
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/ddosProtectionPlans/plan2",
"location": "westus",
"name": "plan2",
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
"type": "Microsoft.Network/ddosProtectionPlans",
"deploymentScope": "Subscription",
"existenceScope": "ResourceGroup",
"resourceGroupName": "[parameters('rgName')]",
"name": "[parameters('ddosName')]",
"roleDefinitionIds": [
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
optional - stringResource location.
tags
optional - stringResource tags.
properties
required
Frequently asked questions
What is Azure Network DDOS Protection Plan?
Azure Network DDOS Protection Plan is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network DDOS Protection Plan?
For Terraform, the jessewilk/terraform, Ansermuhammad/geewa-terraform-azure-infrastructure and kernell128/terraform_cloud source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the Pudding124/SwaggerStructure, tschwarz01/tf-caf-data-management-zone and bayro1/Enterprise-Scale source code examples are useful. See the Azure Resource Manager Example section for further details.