Azure Network Subnet

azurerm_subnet (Terraform)

The Subnet in Network can be configured in Terraform with the resource name azurerm_subnet. The following sections describe 8 examples of how to use the resource and its parameters.

Example Usage from GitHub

larryclaman/vpnscaffolds

resource "azurerm_subnet" "hubsub1" {
  name                 = "hubsub1"
  resource_group_name = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.hub.name
  address_prefixes     = ["10.1.10.0/24"]
}

llgjermeni/terraform-project

resource "azurerm_subnet" "web-api" {
  name                 = var.subnet_web_api
  virtual_network_name = azurerm_virtual_network.main.name
  resource_group_name  = azurerm_resource_group.main.name
  address_prefixes     = ["10.0.1.0/24"]
}

thomast1906/thomasthorntoncloud-examples

resource "azurerm_subnet" "subnet1" {
  name                 = "subnet1"
  resource_group_name  = azurerm_resource_group.tamops.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefix       = "192.168.1.0/24"
}

tkubica12/iac-gitops

resource "azurerm_subnet" "we-project1" {
  name                 = "project1"
  resource_group_name  = azurerm_resource_group.net.name
  virtual_network_name = azurerm_virtual_network.we.name
  address_prefixes     = ["10.0.1.0/24"]
}

WhiteHair-H/Eruza_terraform

resource "azurerm_subnet" "jinwoo-subnet-01" {
  name                 = "subnet01"
  resource_group_name  = azurerm_resource_group.jinwoo-rg.name
  virtual_network_name = azurerm_virtual_network.jinwoo-vnet.name
  address_prefixes     = ["10.0.1.0/24"]
}

haidersabeeh/ARM-DevOps

resource "azurerm_subnet" "subnet1" {
  name                 = "subnet1"
  resource_group_name  = azurerm_resource_group.tamops.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefix       = "192.168.1.0/24"
}

himank98/azure-stack

resource "azurerm_subnet" "web-subnet" {
  name                 = "web-subnet"
  virtual_network_name = azurerm_virtual_network.vnet01.name
  resource_group_name  = var.resource_group
  address_prefix       = var.websubnetcidr
}

philipatkinson86/azure-checkpoint-automation

resource "azurerm_subnet" "External_subnet"  {
    name           = "External"
    resource_group_name  = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.vnet.name
    address_prefix = "10.99.0.0/24"
  }

Parameters

• address_prefix optional computed - string
• address_prefixes optional computed - list of string
• enforce_private_link_endpoint_network_policies optional - bool
• enforce_private_link_service_network_policies optional - bool
• id optional computed - string
• name required - string
• resource_group_name required - string
• service_endpoint_policy_ids optional - set of string
• service_endpoints optional - list of string
• virtual_network_name required - string
• delegation list block
  • name required - string
  • service_delegation list block
    • actions optional - list of string
    • name required - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages a subnet. Subnets represent network segments within the IP space defined by the virtual network.

NOTE on Virtual Networks and Subnet's: Terraform currently provides both a standalone Subnet resource, and allows for Subnets to be defined in-line within the Virtual Network resource. At this time you cannot use a Virtual Network with in-line Subnets in conjunction with any Subnet resources. Doing so will cause a conflict of Subnet configurations and will overwrite Subnet's.

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.