{"id":18578927,"url":"https://github.com/libre-devops/terraform-azurerm-nsg","last_synced_at":"2026-05-03T12:38:44.751Z","repository":{"id":118714537,"uuid":"482636211","full_name":"libre-devops/terraform-azurerm-nsg","owner":"libre-devops","description":"A module used to generate a sensible default NSG and attach it to an Azure subnet.  Note, this NSG is deployed with some default rules including an explicit deny :bomb:","archived":false,"fork":false,"pushed_at":"2025-04-23T23:42:37.000Z","size":66,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-01T16:47:57.893Z","etag":null,"topics":["azure","azurerm","azurerm-terraform-provider","module","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/libre-devops.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-04-17T21:22:43.000Z","updated_at":"2025-04-23T23:38:11.000Z","dependencies_parsed_at":null,"dependency_job_id":"1b698232-fde0-4778-9b42-2c7eeec5fac8","html_url":"https://github.com/libre-devops/terraform-azurerm-nsg","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/libre-devops/terraform-azurerm-nsg","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-nsg","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-nsg/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-nsg/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-nsg/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/libre-devops","download_url":"https://codeload.github.com/libre-devops/terraform-azurerm-nsg/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-nsg/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32569714,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-03T06:36:36.687Z","status":"ssl_error","status_checked_at":"2026-05-03T06:36:09.306Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","azurerm","azurerm-terraform-provider","module","terraform","terraform-module"],"created_at":"2024-11-06T23:38:18.931Z","updated_at":"2026-05-03T12:38:44.711Z","avatar_url":"https://github.com/libre-devops.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"```hcl\nresource \"azurerm_network_security_group\" \"nsg\" {\n  name                = var.nsg_name\n  location            = var.location\n  resource_group_name = var.rg_name\n  tags                = var.tags\n\n  timeouts {\n    create = \"5m\"\n    delete = \"10m\"\n  }\n}\n\nresource \"azurerm_network_interface_security_group_association\" \"this\" {\n  count                     = var.associate_with_nic \u0026\u0026 var.nic_id != null ? 1 : 0\n  network_interface_id      = var.nic_id\n  network_security_group_id = azurerm_network_security_group.nsg.id\n\n  timeouts {\n    create = \"5m\"\n    delete = \"10m\"\n  }\n}\n\nresource \"azurerm_subnet_network_security_group_association\" \"this\" {\n  for_each                  = var.associate_with_subnet \u0026\u0026 var.subnet_ids != null ? var.subnet_ids : {}\n  subnet_id                 = each.value\n  network_security_group_id = azurerm_network_security_group.nsg.id\n\n  timeouts {\n    create = \"5m\"\n    delete = \"10m\"\n  }\n}\nresource \"azurerm_network_security_rule\" \"rules\" {\n  for_each = var.apply_standard_rules == true ? local.final_nsg_rules : tomap({})\n\n  name      = each.key\n  priority  = each.value.priority\n  direction = each.value.direction\n  access    = each.value.access\n  protocol  = each.value.protocol\n\n  source_port_range                          = try(each.value.source_port_range, null)\n  source_port_ranges                         = try(each.value.source_port_ranges, null)\n  destination_port_range                     = try(each.value.destination_port_range, null)\n  destination_port_ranges                    = try(each.value.destination_port_ranges, null)\n  source_address_prefix                      = try(each.value.source_address_prefix, null)\n  source_address_prefixes                    = try(each.value.source_address_prefixes, null)\n  destination_address_prefix                 = try(each.value.destination_address_prefix, null)\n  destination_address_prefixes               = try(each.value.destination_address_prefixes, null)\n  source_application_security_group_ids      = try(each.value.source_application_security_group_ids, null)\n  destination_application_security_group_ids = try(each.value.destination_application_security_group_ids, null)\n  description                                = try(each.value.description, null)\n\n  resource_group_name         = azurerm_network_security_group.nsg.resource_group_name\n  network_security_group_name = azurerm_network_security_group.nsg.name\n}\n\nresource \"azurerm_network_security_rule\" \"rules_custom\" {\n  for_each = var.custom_nsg_rules != null \u0026\u0026 var.apply_standard_rules == false ? var.custom_nsg_rules : tomap({})\n\n  name      = each.key\n  priority  = each.value.priority\n  direction = each.value.direction\n  access    = each.value.access\n  protocol  = each.value.protocol\n\n  source_port_range                          = try(each.value.source_port_range, null)\n  source_port_ranges                         = try(each.value.source_port_ranges, null)\n  destination_port_range                     = try(each.value.destination_port_range, null)\n  destination_port_ranges                    = try(each.value.destination_port_ranges, null)\n  source_address_prefix                      = try(each.value.source_address_prefix, null)\n  source_address_prefixes                    = try(each.value.source_address_prefixes, null)\n  destination_address_prefix                 = try(each.value.destination_address_prefix, null)\n  destination_address_prefixes               = try(each.value.destination_address_prefixes, null)\n  source_application_security_group_ids      = try(each.value.source_application_security_group_ids, null)\n  destination_application_security_group_ids = try(each.value.destination_application_security_group_ids, null)\n  description                                = try(each.value.description, null)\n\n  resource_group_name         = azurerm_network_security_group.nsg.resource_group_name\n  network_security_group_name = azurerm_network_security_group.nsg.name\n}\n```\n## Requirements\n\nNo requirements.\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_azurerm\"\u003e\u003c/a\u003e [azurerm](#provider\\_azurerm) | n/a |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [azurerm_network_interface_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface_security_group_association) | resource |\n| [azurerm_network_security_group.nsg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |\n| [azurerm_network_security_rule.rules](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |\n| [azurerm_network_security_rule.rules_custom](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |\n| [azurerm_subnet_network_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_network_security_group_association) | resource |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_apply_standard_rules\"\u003e\u003c/a\u003e [apply\\_standard\\_rules](#input\\_apply\\_standard\\_rules) | Whether to apply the standard NSG rules or not. | `bool` | `true` | no |\n| \u003ca name=\"input_associate_with_nic\"\u003e\u003c/a\u003e [associate\\_with\\_nic](#input\\_associate\\_with\\_nic) | Whether the NSG should be associated with a nic | `bool` | `false` | no |\n| \u003ca name=\"input_associate_with_subnet\"\u003e\u003c/a\u003e [associate\\_with\\_subnet](#input\\_associate\\_with\\_subnet) | Whether the NSG should be associated with a subnet | `bool` | `false` | no |\n| \u003ca name=\"input_custom_nsg_rules\"\u003e\u003c/a\u003e [custom\\_nsg\\_rules](#input\\_custom\\_nsg\\_rules) | Custom NSG rules to apply if apply\\_standard\\_rules is set to false. | \u003cpre\u003emap(object({\u003cbr/\u003e    name                                       = optional(string)\u003cbr/\u003e    priority                                   = optional(number)\u003cbr/\u003e    direction                                  = optional(string)\u003cbr/\u003e    access                                     = optional(string)\u003cbr/\u003e    protocol                                   = optional(string)\u003cbr/\u003e    source_port_range                          = optional(string)\u003cbr/\u003e    sources_port_ranges                        = optional(list(string))\u003cbr/\u003e    destination_port_range                     = optional(string)\u003cbr/\u003e    destination_port_ranges                    = optional(list(string))\u003cbr/\u003e    source_address_prefix                      = optional(string)\u003cbr/\u003e    source_address_prefixes                    = optional(list(string))\u003cbr/\u003e    destination_address_prefix                 = optional(string)\u003cbr/\u003e    destination_address_prefixes               = optional(list(string))\u003cbr/\u003e    source_application_security_group_ids      = optional(list(string))\u003cbr/\u003e    destination_application_security_group_ids = optional(list(string))\u003cbr/\u003e    description                                = optional(string)\u003cbr/\u003e    resource_group_name                        = optional(string)\u003cbr/\u003e    network_security_group_name                = optional(string)\u003cbr/\u003e  }))\u003c/pre\u003e | `{}` | no |\n| \u003ca name=\"input_location\"\u003e\u003c/a\u003e [location](#input\\_location) | The location for this resource to be put in | `string` | n/a | yes |\n| \u003ca name=\"input_nic_id\"\u003e\u003c/a\u003e [nic\\_id](#input\\_nic\\_id) | The ID of a NIC if the association is triggered | `string` | `null` | no |\n| \u003ca name=\"input_nsg_name\"\u003e\u003c/a\u003e [nsg\\_name](#input\\_nsg\\_name) | The name of the resource to be created | `string` | n/a | yes |\n| \u003ca name=\"input_rg_name\"\u003e\u003c/a\u003e [rg\\_name](#input\\_rg\\_name) | The name of the resource group, this module does not create a resource group, it is expecting the value of a resource group already exists | `string` | n/a | yes |\n| \u003ca name=\"input_standard_nsg_rules\"\u003e\u003c/a\u003e [standard\\_nsg\\_rules](#input\\_standard\\_nsg\\_rules) | Standard NSG rules supplied by the module, these are applied by default | \u003cpre\u003emap(object({\u003cbr/\u003e    name                                       = optional(string)\u003cbr/\u003e    priority                                   = optional(number)\u003cbr/\u003e    direction                                  = optional(string)\u003cbr/\u003e    access                                     = optional(string)\u003cbr/\u003e    protocol                                   = optional(string)\u003cbr/\u003e    source_port_range                          = optional(string)\u003cbr/\u003e    sources_port_ranges                        = optional(list(string))\u003cbr/\u003e    destination_port_range                     = optional(string)\u003cbr/\u003e    destination_port_ranges                    = optional(list(string))\u003cbr/\u003e    source_address_prefix                      = optional(string)\u003cbr/\u003e    source_address_prefixes                    = optional(list(string))\u003cbr/\u003e    destination_address_prefix                 = optional(string)\u003cbr/\u003e    destination_address_prefixes               = optional(list(string))\u003cbr/\u003e    source_application_security_group_ids      = optional(list(string))\u003cbr/\u003e    destination_application_security_group_ids = optional(list(string))\u003cbr/\u003e    description                                = optional(string)\u003cbr/\u003e    resource_group_name                        = optional(string)\u003cbr/\u003e    network_security_group_name                = optional(string)\u003cbr/\u003e  }))\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"AllowAzureActiveDirectoryOutbound\": {\u003cbr/\u003e    \"access\": \"Allow\",\u003cbr/\u003e    \"destination_address_prefix\": \"AzureActiveDirectory\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Outbound\",\u003cbr/\u003e    \"priority\": 4050,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  },\u003cbr/\u003e  \"AllowAzureBackupOutbound\": {\u003cbr/\u003e    \"access\": \"Allow\",\u003cbr/\u003e    \"destination_address_prefix\": \"AzureBackup\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Outbound\",\u003cbr/\u003e    \"priority\": 4045,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  },\u003cbr/\u003e  \"AllowAzureCloudOutbound\": {\u003cbr/\u003e    \"access\": \"Allow\",\u003cbr/\u003e    \"destination_address_prefix\": \"AzureCloud\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Outbound\",\u003cbr/\u003e    \"priority\": 4040,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  },\u003cbr/\u003e  \"AllowAzureKeyVaultOutbound\": {\u003cbr/\u003e    \"access\": \"Allow\",\u003cbr/\u003e    \"destination_address_prefix\": \"AzureKeyVault\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Outbound\",\u003cbr/\u003e    \"priority\": 4035,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  },\u003cbr/\u003e  \"AllowAzureLoadBalancerOutbound\": {\u003cbr/\u003e    \"access\": \"Allow\",\u003cbr/\u003e    \"destination_address_prefix\": \"AzureLoadBalancer\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Outbound\",\u003cbr/\u003e    \"priority\": 4030,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  },\u003cbr/\u003e  \"AllowAzureMonitorOutbound\": {\u003cbr/\u003e    \"access\": \"Allow\",\u003cbr/\u003e    \"destination_address_prefix\": \"AzureMonitor\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Outbound\",\u003cbr/\u003e    \"priority\": 4025,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  },\u003cbr/\u003e  \"AllowAzureStorageOutbound\": {\u003cbr/\u003e    \"access\": \"Allow\",\u003cbr/\u003e    \"destination_address_prefix\": \"Storage\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Outbound\",\u003cbr/\u003e    \"priority\": 4020,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  },\u003cbr/\u003e  \"DenyAllInbound\": {\u003cbr/\u003e    \"access\": \"Deny\",\u003cbr/\u003e    \"destination_address_prefix\": \"*\",\u003cbr/\u003e    \"destination_port_range\": \"*\",\u003cbr/\u003e    \"direction\": \"Inbound\",\u003cbr/\u003e    \"priority\": 4096,\u003cbr/\u003e    \"protocol\": \"*\",\u003cbr/\u003e    \"source_address_prefix\": \"*\",\u003cbr/\u003e    \"source_port_range\": \"*\"\u003cbr/\u003e  }\u003cbr/\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_subnet_ids\"\u003e\u003c/a\u003e [subnet\\_ids](#input\\_subnet\\_ids) | A map of subnet ids to pass | `map(string)` | `{}` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | The tags assigned to the resource | `map(string)` | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_final_nsg_rules\"\u003e\u003c/a\u003e [final\\_nsg\\_rules](#output\\_final\\_nsg\\_rules) | The NSG rules list assigned as a variable |\n| \u003ca name=\"output_nsg_id\"\u003e\u003c/a\u003e [nsg\\_id](#output\\_nsg\\_id) | The ID of the NSG |\n| \u003ca name=\"output_nsg_name\"\u003e\u003c/a\u003e [nsg\\_name](#output\\_nsg\\_name) | The name of the NSG |\n| \u003ca name=\"output_nsg_network_interface_security_group_association_ids\"\u003e\u003c/a\u003e [nsg\\_network\\_interface\\_security\\_group\\_association\\_ids](#output\\_nsg\\_network\\_interface\\_security\\_group\\_association\\_ids) | The IDs of the Network Interface Security Group Associations |\n| \u003ca name=\"output_nsg_rg_name\"\u003e\u003c/a\u003e [nsg\\_rg\\_name](#output\\_nsg\\_rg\\_name) | The name of the resource group the NSG is in |\n| \u003ca name=\"output_nsg_subnet_association_ids\"\u003e\u003c/a\u003e [nsg\\_subnet\\_association\\_ids](#output\\_nsg\\_subnet\\_association\\_ids) | The IDs of the Subnet Network Security Group Associations |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flibre-devops%2Fterraform-azurerm-nsg","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flibre-devops%2Fterraform-azurerm-nsg","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flibre-devops%2Fterraform-azurerm-nsg/lists"}