Azure Network IP
This page shows how to write Terraform and Azure Resource Manager for Network IP and write them securely.
azurerm_virtual_hub_ip (Terraform)
The IP in Network can be configured in Terraform with the resource name azurerm_virtual_hub_ip
. The following sections describe 4 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_virtual_hub_ip" "hub_ip" {
for_each = try(var.virtual_hub_config.hub_ip, {})
name = azurecaf_name.hub_ip[each.key].result
virtual_hub_id = azurerm_virtual_hub.vwan_hub.id
private_ip_address = each.value.private_ip_address
resource "azurerm_virtual_hub_ip" "hub_ip" {
for_each = try(var.virtual_hub_config.hub_ip, {})
name = azurecaf_name.hub_ip[each.key].result
virtual_hub_id = azurerm_virtual_hub.vwan_hub.id
private_ip_address = each.value.private_ip_address
resource "azurerm_virtual_hub_ip" "hub_ip" {
for_each = try(var.virtual_hub_config.hub_ip, {})
name = azurecaf_name.hub_ip[each.key].result
virtual_hub_id = azurerm_virtual_hub.vwan_hub.id
private_ip_address = each.value.private_ip_address
resource "azurerm_virtual_hub_ip" "hub_ip" {
for_each = try(var.virtual_hub_config.hub_ip, {})
name = azurecaf_name.hub_ip[each.key].result
virtual_hub_id = azurerm_virtual_hub.vwan_hub.id
private_ip_address = each.value.private_ip_address
Parameters
-
id
optional computed - string -
name
required - string -
private_ip_address
optional - string -
private_ip_allocation_method
optional - string -
public_ip_address_id
optional - string -
subnet_id
required - string -
virtual_hub_id
required - string -
timeouts
single block
Explanation in Terraform Registry
Manages a Virtual Hub IP.
NOTE Virtual Hub IP only supports Standard Virtual Hub without Virtual Wan.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/virtualHubs/ipConfigurations (Azure Resource Manager)
The virtualHubs/ipConfigurations in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/virtualHubs/ipConfigurations
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
name
required - stringtype
required - stringapiVersion
required - stringproperties
requiredprivateIPAddress
optional - stringThe private IP address of the IP configuration.
privateIPAllocationMethod
optional - stringThe private IP address allocation method.
subnet
optionalproperties
optionaladdressPrefix
required - stringThe address prefix for the subnet.
addressPrefixes
optional - arrayList of address prefixes for the subnet.
networkSecurityGroup
optionalid
required - stringResource ID.
routeTable
optionalid
required - stringResource ID.
natGateway
optionalid
required - stringResource ID.
serviceEndpoints
optional arrayservice
optional - stringThe type of the endpoint service.
locations
optional - arrayA list of locations.
serviceEndpointPolicies
optional arrayid
required - stringResource ID.
ipAllocations
optional arrayid
required - stringResource ID.
delegations
optional arrayproperties
optionalserviceName
optional - stringThe name of the service to whom the subnet should be delegated (e.g. Microsoft.Sql/servers).
name
required - stringThe name of the resource that is unique within a subnet. This name can be used to access the resource.
privateEndpointNetworkPolicies
optional - stringEnable or Disable apply network policies on private end point in the subnet.
privateLinkServiceNetworkPolicies
optional - stringEnable or Disable apply network policies on private link service in the subnet.
name
required - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
publicIPAddress
optionallocation
required - stringResource location.
tags
optional - stringResource tags.
extendedLocation
optionalname
required - stringThe name of the extended location.
type
required - stringThe type of the extended location.
sku
optionalname
optional - stringName of a public IP address SKU.
tier
optional - stringTier of a public IP address SKU.
properties
optionalpublicIPAllocationMethod
required - stringThe public IP address allocation method.
publicIPAddressVersion
optional - stringThe public IP address version.
dnsSettings
optionaldomainNameLabel
required - stringThe domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system.
fqdn
optional - stringThe Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone.
reverseFqdn
optional - stringThe reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN.
ddosSettings
optionalddosCustomPolicy
optionalid
required - stringResource ID.
protectionCoverage
optional - stringThe DDoS protection policy customizability of the public IP. Only standard coverage will have the ability to be customized.
protectedIP
optional - booleanEnables DDoS protection on the public IP.
ipTags
optional arrayipTagType
optional - stringThe IP tag type. Example: FirstPartyUsage.
tag
optional - stringThe value of the IP tag associated with the public IP. Example: SQL.
ipAddress
optional - stringThe IP address associated with the public IP address resource.
publicIPPrefix
optionalid
required - stringResource ID.
idleTimeoutInMinutes
optional - integerThe idle timeout of the public IP address.
zones
optional - arrayA list of availability zones denoting the IP allocated for the resource needs to come from.
Frequently asked questions
What is Azure Network IP?
Azure Network IP is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network IP?
For Terraform, the aztfmod/terraform-azurerm-caf, pkhuntia/aztfmod and anmoltoppo/Terraform source code examples are useful. See the Terraform Example section for further details.