Azure Network Service Endpoint Storage Policy
This page shows how to write Terraform and Azure Resource Manager for Network Service Endpoint Storage Policy and write them securely.
azurerm_subnet_service_endpoint_storage_policy (Terraform)
The Service Endpoint Storage Policy in Network can be configured in Terraform with the resource name azurerm_subnet_service_endpoint_storage_policy. The following sections describe 2 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_subnet_service_endpoint_storage_policy" "storage" {
name = "storage-policy"
resource_group_name = azurerm_resource_group.rg.name
location = azurerm_resource_group.rg.location
definition {
name = "aksAccess"
resource "azurerm_subnet_service_endpoint_storage_policy" "storage" {
name = "storage-policy"
resource_group_name = azurerm_resource_group.rg.name
location = azurerm_resource_group.rg.location
definition {
name = "aksAccess"
Parameters
-
idoptional computed - string -
locationrequired - string -
namerequired - string -
resource_group_namerequired - string -
tagsoptional - map from string to string -
definitionlist block-
descriptionoptional - string -
namerequired - string -
service_resourcesrequired - set of string
-
-
timeoutssingle block
Explanation in Terraform Registry
Manages a Subnet Service Endpoint Storage Policy.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/serviceEndpointPolicies (Azure Resource Manager)
The serviceEndpointPolicies in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/serviceEndpointPolicies. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/serviceEndpointPolicies",
"apiVersion": "[variables('api_version')]",
"name": "[parameters('sep_name')]",
"location": "[parameters('location')]",
"properties": {
"serviceEndpointPolicyDefinitions": [
"type": "Microsoft.Network/serviceEndpointPolicies",
"name": "[parameters('serviceEndpointPolicyName')]",
"location": "[parameters('location')]",
"apiVersion": "2019-08-01",
"dependsOn": [],
"properties": {
"type": "Microsoft.Network/serviceEndpointPolicies",
"location": "westus",
"properties":
{
"serviceEndpointPolicyDefinitions": [
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"location": "westus",
"properties":
{
"serviceEndpointPolicyDefinitions": [
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"location": "westus",
"properties":
{
"serviceEndpointPolicyDefinitions": [
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"location": "westus",
"properties":
{
"serviceEndpointPolicyDefinitions": [
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"location": "westus",
"properties":
{
"serviceEndpointPolicyDefinitions": [
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"location": "westus",
"properties":
{
"serviceEndpointPolicyDefinitions": [
{
Parameters
namerequired - stringtyperequired - stringapiVersionrequired - stringlocationrequired - stringResource location.
tagsoptional - stringResource tags.
propertiesrequiredserviceEndpointPolicyDefinitionsoptional arraypropertiesoptionaldescriptionoptional - stringA description for this rule. Restricted to 140 chars.
serviceoptional - stringService endpoint name.
serviceResourcesoptional - arrayA list of service resources.
nameoptional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
Frequently asked questions
What is Azure Network Service Endpoint Storage Policy?
Azure Network Service Endpoint Storage Policy is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Service Endpoint Storage Policy?
For Terraform, the reload/dpl-platform-poc and reload/dpl-platform-poc source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the plzm/azure-deploy, Lauan/Azure and sanjaypavan/OldAzure-Rest-API source code examples are useful. See the Azure Resource Manager Example section for further details.
