Azure Network Security Partner Provider
This page shows how to write Terraform and Azure Resource Manager for Network Security Partner Provider and write them securely.
azurerm_virtual_hub_security_partner_provider (Terraform)
The Security Partner Provider in Network can be configured in Terraform with the resource name azurerm_virtual_hub_security_partner_provider
. The following sections describe 3 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_virtual_hub_security_partner_provider" "spp" {
depends_on = [azurerm_vpn_gateway.s2s_gateway]
for_each = try(var.virtual_hub_config.security_partner_provider, {})
name = azurecaf_name.spp[each.key].result
resource_group_name = var.resource_group_name
resource "azurerm_virtual_hub_security_partner_provider" "spp" {
depends_on = [azurerm_vpn_gateway.s2s_gateway]
for_each = try(var.virtual_hub_config.security_partner_provider, {})
name = azurecaf_name.spp[each.key].result
resource_group_name = var.resource_group_name
resource "azurerm_virtual_hub_security_partner_provider" "spp" {
depends_on = [azurerm_vpn_gateway.s2s_gateway]
for_each = try(var.virtual_hub_config.security_partner_provider, {})
name = azurecaf_name.spp[each.key].result
resource_group_name = var.resource_group_name
Parameters
-
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
security_provider_name
required - string -
tags
optional - map from string to string -
virtual_hub_id
optional - string -
timeouts
single block
Explanation in Terraform Registry
Manages a Security Partner Provider which could be associated to virtual hub.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/virtualHubs (Azure Resource Manager)
The virtualHubs in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/virtualHubs
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2021-02-01",
"name": "[parameters('routeserverName')]",
"location": "[parameters('location')]",
"properties": {
"sku": "Standard",
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub_cfg').name]",
"location": "[parameters('location')]",
"properties": {
"addressPrefix": "[variables('virtual_hub_cfg').addressSpacePrefix]",
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-06-01",
"name": "[parameters('firstRouteServerName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]",
"type": "Microsoft.Network/virtualHubs",
"apiVersion": "2020-05-01",
"name": "[variables('virtual_hub1_cfg').name]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualWans', parameters('vWANname'))]"
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredvirtualWan
optionalid
required - stringResource ID.
vpnGateway
optionalid
required - stringResource ID.
p2SVpnGateway
optionalid
required - stringResource ID.
expressRouteGateway
optionalid
required - stringResource ID.
azureFirewall
optionalid
required - stringResource ID.
securityPartnerProvider
optionalid
required - stringResource ID.
addressPrefix
optional - stringAddress-prefix for this VirtualHub.
routeTable
optionalroutes
optional arrayaddressPrefixes
optional - arrayList of all addressPrefixes.
nextHopIpAddress
optional - stringNextHop ip address.
securityProviderName
optional - stringThe Security Provider name.
virtualHubRouteTableV2s
optional arrayproperties
optionalroutes
optional arraydestinationType
optional - stringThe type of destinations.
destinations
optional - arrayList of all destinations.
nextHopType
optional - stringThe type of next hops.
nextHops
optional - arrayNextHops ip address.
attachedConnections
optional - arrayList of all connections attached to this route table v2.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
sku
optional - stringThe sku of this VirtualHub.
routingState
optional - stringThe routing state.
virtualRouterAsn
optional - integerVirtualRouter ASN.
virtualRouterIps
optional - arrayVirtualRouter IPs.
allowBranchToBranchTraffic
optional - booleanFlag to control transit for VirtualRouter hub.
Frequently asked questions
What is Azure Network Security Partner Provider?
Azure Network Security Partner Provider is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Security Partner Provider?
For Terraform, the aztfmod/terraform-azurerm-caf, pkhuntia/aztfmod and anmoltoppo/Terraform source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the dmauser/azure-hub-spoke-base-lab, naveenpolla/ARM-Templates and s-KaiNet/monaco-csharp-poc source code examples are useful. See the Azure Resource Manager Example section for further details.