Azure Network Peering

azurerm_virtual_network_peering (Terraform)

The Peering in Network can be configured in Terraform with the resource name azurerm_virtual_network_peering. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

yz4898/att_mvm

resource "azurerm_virtual_network_peering" "server_to_transit" {
  name                        = "server_to_transit"
  resource_group_name         = var.rg.name
  virtual_network_name        = var.server_vnet.name
  remote_virtual_network_id   = var.transit_vnet.id
}

i0rek/aksfed

resource "azurerm_virtual_network_peering" "aks1_to_aks2" {
  name                      = "aks1_to_aks2"
  resource_group_name       = azurerm_resource_group.rg.name
  virtual_network_name      = azurerm_virtual_network.vnet1.name
  remote_virtual_network_id = azurerm_virtual_network.vnet2.id
  allow_virtual_network_access = true

Xergy/AzMIMDeploy

resource "azurerm_virtual_network_peering" "hub_ondo-p-use-app01-vnet" {
  name                      = "hub_ondo-p-use-app01-vnet"
  resource_group_name       = "ondo-p-use-hub-rg"
  virtual_network_name      = azurerm_virtual_network.ondo-p-use-hub-vnet.name
  remote_virtual_network_id = azurerm_virtual_network.ondo-p-use-app01-vnet.id
}

nbhardwaj1981/tfhubspoke

resource "azurerm_virtual_network_peering" "infra2hub-peer" {
  name                      = "infra2hub"
  resource_group_name       = azurerm_resource_group.spoke2-vnet-rg.name
  virtual_network_name      = azurerm_virtual_network.infra-vnet.name
  remote_virtual_network_id = azurerm_virtual_network.hub-vnet.id
}

vmisson/terraform-azure-firewall

resource "azurerm_virtual_network_peering" "hub-spoke1" {
  depends_on = [azurerm_virtual_network_gateway.network_gateway]

  name                      = "hub-to-spoke1"
  resource_group_name       = azurerm_resource_group.resource_group.name
  virtual_network_name      = azurerm_virtual_network.virtual_network_hub.name

richeney/seadrill

resource "azurerm_virtual_network_peering" "hub-spoke1" {
  name                      = "hub_to_spoke1"
  resource_group_name       = azurerm_resource_group.test.name
  virtual_network_name      = azurerm_virtual_network.hub.name
  remote_virtual_network_id = azurerm_virtual_network.spoke1.id

TomerMagera/bootcamp-tf-iac

resource "azurerm_virtual_network_peering" "ansible_staging_peering" {
  name                      = var.peering_name_staging
  resource_group_name       = azurerm_resource_group.rg.name
  virtual_network_name      = azurerm_virtual_network.vnet.name
  remote_virtual_network_id = data.azurerm_virtual_network.staging_vnet.id
}

mifurm/AZNetWorkshop

 resource "azurerm_virtual_network_peering" "vnet-hub-to-vnet-global-peering" {
   name                      = "vnet-hub-to-vnet-global-peering"
   resource_group_name       = azurerm_resource_group.hub-net-rg.name
   virtual_network_name      = azurerm_virtual_network.vnet-hub.name
   remote_virtual_network_id = azurerm_virtual_network.vnet-global.id
   allow_forwarded_traffic   = true

Sportspaul/devOps21-Green

resource "azurerm_virtual_network_peering" "example-1" {
  name                      = "peer1to2"
  resource_group_name       = azurerm_resource_group.example.name
  virtual_network_name      = azurerm_virtual_network.example1.name
  remote_virtual_network_id = azurerm_virtual_network.example2.id
}

Oddjob62/AzureFirewall

resource "azurerm_virtual_network_peering" "peerHUBtoWUS" {
  name                      = "peerHUBtoWUS"
  resource_group_name       = azurerm_resource_group.example.name
  virtual_network_name      = azurerm_virtual_network.WUS.name
  remote_virtual_network_id = azurerm_virtual_network.HUB.id
  allow_forwarded_traffic   = true

Parameters

• allow_forwarded_traffic optional computed - bool
• allow_gateway_transit optional computed - bool
• allow_virtual_network_access optional - bool
• id optional computed - string
• name required - string
• remote_virtual_network_id required - string
• resource_group_name required - string
• use_remote_gateways optional computed - bool
• virtual_network_name required - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages a virtual network peering which allows resources to access other resources in the linked virtual network.

Tips: Best Practices for The Other Azure Network Resources

In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_network_security_group

Ensure to disable RDP port from the Internet

It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.

azurerm_network_security_rule

Ensure to set a more restrictive CIDR range for ingress from the internet

It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.

azurerm_network_watcher_flow_log

Ensure to enable Retention policy for flow logs and set it to enough duration

It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.