Azure Network Interface Application Security Group Association
This page shows how to write Terraform and Azure Resource Manager for Network Interface Application Security Group Association and write them securely.
azurerm_network_interface_application_security_group_association (Terraform)
The Interface Application Security Group Association in Network can be configured in Terraform with the resource name azurerm_network_interface_application_security_group_association
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_network_interface_application_security_group_association" "bastions" {
count = var.bastions_amount
network_interface_id = azurerm_network_interface.bastions.*.id[count.index]
ip_configuration_name = azurerm_network_interface.bastions.*.ip_configuration.0.name[count.index]
application_security_group_id = azurerm_application_security_group.bastions.id
}
resource "azurerm_network_interface_application_security_group_association" "ask_issue_asg" {
network_interface_id = azurerm_network_interface.issuer.id
application_security_group_id = data.terraform_remote_state.networks.outputs.asg_ask_issue_id
}
resource "azurerm_network_interface_application_security_group_association" "behind_proxy_asg" {
resource "azurerm_network_interface_application_security_group_association" "ask_issue_asg" {
network_interface_id = azurerm_network_interface.issuer.id
application_security_group_id = data.terraform_remote_state.networks.outputs.asg_ask_issue_id
}
resource "azurerm_network_interface_application_security_group_association" "web_proxy_asg" {
resource "azurerm_network_interface_application_security_group_association" "multiasgassociation" {
for_each = var.multiasgassociation_settings
network_interface_id = each.value.network_interface_id
application_security_group_id = each.value.resource_group_name
resource "azurerm_network_interface_application_security_group_association" "pks-nic-asg-assoc" {
count = var.master_asg == "" ? 0 : length(var.master_nics)
network_interface_id = data.azurerm_network_interface.pks-master-nics[count.index].id
application_security_group_id = data.azurerm_application_security_group.pks-master-asg[0].id
}
resource "azurerm_network_interface_application_security_group_association" "asg" {
application_security_group_id = var.application_security_group_id
network_interface_id = var.network_interface_id
}
resource "azurerm_network_interface_application_security_group_association" "nic_asg_assoc" {
count = var.asg_associate ? 1 : 0
application_security_group_id = azurerm_application_security_group.asg.id
network_interface_id = var.network_interface_id
resource "azurerm_network_interface_application_security_group_association" "asg" {
application_security_group_id = var.application_security_group_id
network_interface_id = var.network_interface_id
}
resource "azurerm_network_interface_application_security_group_association" "issuer_asg" {
network_interface_id = azurerm_network_interface.ca_issuer.id
application_security_group_id = data.terraform_remote_state.networks.outputs.asg_issuer_id
}
resource "azurerm_network_interface_application_security_group_association" "assoc" {
for_each = local.nic_asg
network_interface_id = azurerm_network_interface.nic[each.value.nic_key].id
application_security_group_id = each.value.asg_id
}
Parameters
-
application_security_group_id
required - string -
id
optional computed - string -
network_interface_id
required - string -
timeouts
single block
Explanation in Terraform Registry
Manages the association between a Network Interface and a Application Security Group.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/applicationSecurityGroups (Azure Resource Manager)
The applicationSecurityGroups in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/applicationSecurityGroups
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/applicationSecurityGroups"
},
{
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationSecurityGroups/asg2",
"location": "westus",
"name": "asg2",
"type": "Microsoft.Network/applicationSecurityGroups",
"name": "[parameters('applicationSecurityGroupName')]",
"location": "[variables('locationName')]"
},
{
"apiVersion": "2019-02-01",
"type": "Microsoft.Network/applicationSecurityGroups",
"condition": "[greater(length(parameters('dbSecurityGroupName')), 0)]",
"apiVersion": "2019-02-01",
"location": "[parameters('location')]",
"properties": {}
},
"type": "Microsoft.Network/applicationSecurityGroups"
},
{
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationSecurityGroups/asg2",
"location": "westus",
"name": "asg2",
"type": "Microsoft.Network/applicationSecurityGroups",
"apiVersion": "2017-10-01",
"location": "[resourceGroup().location]",
"properties": {},
"tags": {
"displayName": "AsgProdWeb"
"type": "Microsoft.Network/applicationSecurityGroups",
"apiVersion": "2017-10-01",
"location": "[resourceGroup().location]",
"properties": {},
"tags": {
"displayName": "AsgProdWeb"
"type": "Microsoft.Network/applicationSecurityGroups",
"location": "westus",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "00000000-0000-0000-0000-000000000000"
}
"type": "Microsoft.Network/applicationSecurityGroups",
"name": "[parameters('applicationSecurityGroupName')]",
"location": "[variables('locationName')]"
},
{
"apiVersion": "2019-02-01",
"type": "Microsoft.Network/applicationSecurityGroups"
},
{
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationSecurityGroups/asg2",
"location": "westus",
"name": "asg2",
"type": "Microsoft.Network/applicationSecurityGroups"
},
{
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/applicationSecurityGroups/asg2",
"location": "westus",
"name": "asg2",
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
required
Frequently asked questions
What is Azure Network Interface Application Security Group Association?
Azure Network Interface Application Security Group Association is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Interface Application Security Group Association?
For Terraform, the ksandermann/formkube, nlevee/ca-stack and nlevee/ca-stack source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the Pudding124/SwaggerStructure, prasroy/hanaonazurearm and maciejng/azure-linked-templates source code examples are useful. See the Azure Resource Manager Example section for further details.