Azure Network Watcher
This page shows how to write Terraform and Azure Resource Manager for Network Watcher and write them securely.
azurerm_network_watcher (Terraform)
The Watcher in Network can be configured in Terraform with the resource name azurerm_network_watcher
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_network_watcher" "connectivity_westeurope" {
provider = azurerm.Connectivity
name = "westeurope"
location = "westeurope"
resource_group_name = azurerm_resource_group.connectivity_networkwatcher.name
}
resource "azurerm_network_watcher" "watcher" {
name = format("%s-watcher", local.full_env_code)
location = var.location
resource_group_name = module.rg-network.name
}
resource "azurerm_network_watcher" "nw" {
name = var.res_network_watcher_name
location = var.res_location
resource_group_name = var.res_rg_name
resource "azurerm_network_watcher" "example" {
name = "production-nwwatcher"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
resource "azurerm_network_watcher" "watcher" {
name = format("%s-watcher", local.full_env_code)
location = var.location
resource_group_name = module.rg-network.name
}
resource "azurerm_network_watcher" "netwatcher" {
name = azurecaf_name.netwatcher.result
location = var.location
resource_group_name = var.resource_group_name
tags = local.tags
}
resource "azurerm_network_watcher" "net_watch" {
name = var.name
location = var.location
resource_group_name = var.rg_name
tags = var.tags
resource "azurerm_network_watcher" "netwatcher" {
name = azurecaf_name.netwatcher.result
location = var.location
resource_group_name = var.resource_group_name
tags = local.tags
}
resource "azurerm_network_watcher" "netwatcher" {
name = var.settings.name
location = var.location
resource_group_name = var.resource_group_name
tags = local.tags
}
resource "azurerm_network_watcher" "net_watcher" {
name = local.net_watcher_name
location = local.location
resource_group_name = local.resource_group_name
}
Parameters
-
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
timeouts
single block
Explanation in Terraform Registry
Manages a Network Watcher.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/networkWatchers (Azure Resource Manager)
The networkWatchers in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/networkWatchers
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/networkWatchers"
},
{
"etag": "W/\"1999291d-91bc-41e2-9705-74be3187e118\"",
"id": "/subscriptions/510f92e0-3fcf-4b8f-8a23-095d37e6a299/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus",
"location": "eastus",
"type": "Microsoft.Network/networkWatchers"
},
{
"etag": "W/\"1999291d-91bc-41e2-9705-74be3187e118\"",
"id": "/subscriptions/510f92e0-3fcf-4b8f-8a23-095d37e6a299/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus",
"location": "eastus",
"type": "Microsoft.Network/networkWatchers",
"resourceGroupName": "networkWatcherRG",
"existenceCondition": {
"field": "location",
"equals": "[field('location')]"
},
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"input": {
"Type": "Microsoft.Network/networkWatchers",
"ResourceType": "Microsoft.Network/networkWatchers",
"ExtensionResourceType": null,
"Sku": null,
"Tags": null,
"SubscriptionId": "76c9af94-ff5d-4bbe-8e7b-228db3bd1804",
"Type": "Microsoft.Network/networkWatchers",
"ResourceType": "Microsoft.Network/networkWatchers",
"ExtensionResourceType": null,
"Sku": null,
"Tags": null,
"SubscriptionId": "d6cf79f8-681b-4d3e-82d3-dd5cc7c83604",
"Type": "Microsoft.Network/networkWatchers",
"ResourceType": "Microsoft.Network/networkWatchers",
"ExtensionResourceType": null,
"Sku": null,
"Tags": null,
"SubscriptionId": "67f16219-3421-4cef-89b9-c06cf90d7bea",
"Type": "Microsoft.Network/networkWatchers",
"ResourceType": "Microsoft.Network/networkWatchers",
"ExtensionResourceType": null,
"Sku": null,
"Tags": null,
"SubscriptionId": "d6cf79f8-681b-4d3e-82d3-dd5cc7c83604",
"type": "Microsoft.Network/networkWatchers",
"resourceGroupName": "networkWatcherRG",
"existenceCondition": {
"field": "location",
"equals": "[field('location')]"
},
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"input": {
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
required
Frequently asked questions
What is Azure Network Watcher?
Azure Network Watcher is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Watcher?
For Terraform, the liamfoneill/NotQuiteEnterpriseScale, tmeadon/clippings and avishekansible/AzureLandingZone source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the kbroughton/azure_cis_scanner, kbroughton/azure_cis_scanner and manoj-murali/ARMTemplates source code examples are useful. See the Azure Resource Manager Example section for further details.