https://github.com/libre-devops/terraform-azurerm-nsg

A module used to generate a sensible default NSG and attach it to an Azure subnet. Note, this NSG is deployed with some default rules including an explicit deny :bomb:
https://github.com/libre-devops/terraform-azurerm-nsg
azure azurerm azurerm-terraform-provider module terraform terraform-module
Last synced: 8 days ago
JSON representation
A module used to generate a sensible default NSG and attach it to an Azure subnet. Note, this NSG is deployed with some default rules including an explicit deny :bomb:
Host: GitHub
URL: https://github.com/libre-devops/terraform-azurerm-nsg
Owner: libre-devops
License: mit
Created: 2022-04-17T21:22:43.000Z (about 3 years ago)
Default Branch: main
Last Pushed: 2025-04-23T23:42:37.000Z (3 months ago)
Last Synced: 2025-05-16T02:12:37.818Z (2 months ago)
Topics: azure, azurerm, azurerm-terraform-provider, module, terraform, terraform-module
Language: PowerShell
Homepage:
Size: 64.5 KB
Stars: 0
Watchers: 0
Forks: 0
Open Issues: 0
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project

README

        ```hcl

resource "azurerm_network_security_group" "nsg" {

  name                = var.nsg_name

  location            = var.location

  resource_group_name = var.rg_name

  tags                = var.tags

  timeouts {

    create = "5m"

    delete = "10m"

  }

}

resource "azurerm_network_interface_security_group_association" "this" {

  count                     = var.associate_with_nic && var.nic_id != null ? 1 : 0

  network_interface_id      = var.nic_id

  network_security_group_id = azurerm_network_security_group.nsg.id

  timeouts {

    create = "5m"

    delete = "10m"

  }

}

resource "azurerm_subnet_network_security_group_association" "this" {

  for_each                  = var.associate_with_subnet && var.subnet_ids != null ? var.subnet_ids : {}

  subnet_id                 = each.value

  network_security_group_id = azurerm_network_security_group.nsg.id

  timeouts {

    create = "5m"

    delete = "10m"

  }

}

resource "azurerm_network_security_rule" "rules" {

  for_each = var.apply_standard_rules == true ? local.final_nsg_rules : tomap({})

  name      = each.key

  priority  = each.value.priority

  direction = each.value.direction

  access    = each.value.access

  protocol  = each.value.protocol

  source_port_range                          = try(each.value.source_port_range, null)

  source_port_ranges                         = try(each.value.source_port_ranges, null)

  destination_port_range                     = try(each.value.destination_port_range, null)

  destination_port_ranges                    = try(each.value.destination_port_ranges, null)

  source_address_prefix                      = try(each.value.source_address_prefix, null)

  source_address_prefixes                    = try(each.value.source_address_prefixes, null)

  destination_address_prefix                 = try(each.value.destination_address_prefix, null)

  destination_address_prefixes               = try(each.value.destination_address_prefixes, null)

  source_application_security_group_ids      = try(each.value.source_application_security_group_ids, null)

  destination_application_security_group_ids = try(each.value.destination_application_security_group_ids, null)

  description                                = try(each.value.description, null)

  resource_group_name         = azurerm_network_security_group.nsg.resource_group_name

  network_security_group_name = azurerm_network_security_group.nsg.name

}

resource "azurerm_network_security_rule" "rules_custom" {

  for_each = var.custom_nsg_rules != null && var.apply_standard_rules == false ? var.custom_nsg_rules : tomap({})

  name      = each.key

  priority  = each.value.priority

  direction = each.value.direction

  access    = each.value.access

  protocol  = each.value.protocol

  source_port_range                          = try(each.value.source_port_range, null)

  source_port_ranges                         = try(each.value.source_port_ranges, null)

  destination_port_range                     = try(each.value.destination_port_range, null)

  destination_port_ranges                    = try(each.value.destination_port_ranges, null)

  source_address_prefix                      = try(each.value.source_address_prefix, null)

  source_address_prefixes                    = try(each.value.source_address_prefixes, null)

  destination_address_prefix                 = try(each.value.destination_address_prefix, null)

  destination_address_prefixes               = try(each.value.destination_address_prefixes, null)

  source_application_security_group_ids      = try(each.value.source_application_security_group_ids, null)

  destination_application_security_group_ids = try(each.value.destination_application_security_group_ids, null)

  description                                = try(each.value.description, null)

  resource_group_name         = azurerm_network_security_group.nsg.resource_group_name

  network_security_group_name = azurerm_network_security_group.nsg.name

}

```

## Requirements

No requirements.

## Providers

| Name | Version |

|------|---------|

|  [azurerm](#provider\_azurerm) | n/a |

## Modules

No modules.

## Resources

| Name | Type |

|------|------|

| [azurerm_network_interface_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface_security_group_association) | resource |

| [azurerm_network_security_group.nsg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |

| [azurerm_network_security_rule.rules](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |

| [azurerm_network_security_rule.rules_custom](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |

| [azurerm_subnet_network_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_network_security_group_association) | resource |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [apply\_standard\_rules](#input\_apply\_standard\_rules) | Whether to apply the standard NSG rules or not. | `bool` | `true` | no |

|  [associate\_with\_nic](#input\_associate\_with\_nic) | Whether the NSG should be associated with a nic | `bool` | `false` | no |

|  [associate\_with\_subnet](#input\_associate\_with\_subnet) | Whether the NSG should be associated with a subnet | `bool` | `false` | no |

|  [custom\_nsg\_rules](#input\_custom\_nsg\_rules) | Custom NSG rules to apply if apply\_standard\_rules is set to false. | 
map(object({
    name                                       = optional(string)
    priority                                   = optional(number)
    direction                                  = optional(string)
    access                                     = optional(string)
    protocol                                   = optional(string)
    source_port_range                          = optional(string)
    sources_port_ranges                        = optional(list(string))
    destination_port_range                     = optional(string)
    destination_port_ranges                    = optional(list(string))
    source_address_prefix                      = optional(string)
    source_address_prefixes                    = optional(list(string))
    destination_address_prefix                 = optional(string)
    destination_address_prefixes               = optional(list(string))
    source_application_security_group_ids      = optional(list(string))
    destination_application_security_group_ids = optional(list(string))
    description                                = optional(string)
    resource_group_name                        = optional(string)
    network_security_group_name                = optional(string)
  })) | `{}` | no |

|  [location](#input\_location) | The location for this resource to be put in | `string` | n/a | yes |

|  [nic\_id](#input\_nic\_id) | The ID of a NIC if the association is triggered | `string` | `null` | no |

|  [nsg\_name](#input\_nsg\_name) | The name of the resource to be created | `string` | n/a | yes |

|  [rg\_name](#input\_rg\_name) | The name of the resource group, this module does not create a resource group, it is expecting the value of a resource group already exists | `string` | n/a | yes |

|  [standard\_nsg\_rules](#input\_standard\_nsg\_rules) | Standard NSG rules supplied by the module, these are applied by default | map(object({
    name                                       = optional(string)
    priority                                   = optional(number)
    direction                                  = optional(string)
    access                                     = optional(string)
    protocol                                   = optional(string)
    source_port_range                          = optional(string)
    sources_port_ranges                        = optional(list(string))
    destination_port_range                     = optional(string)
    destination_port_ranges                    = optional(list(string))
    source_address_prefix                      = optional(string)
    source_address_prefixes                    = optional(list(string))
    destination_address_prefix                 = optional(string)
    destination_address_prefixes               = optional(list(string))
    source_application_security_group_ids      = optional(list(string))
    destination_application_security_group_ids = optional(list(string))
    description                                = optional(string)
    resource_group_name                        = optional(string)
    network_security_group_name                = optional(string)
  }))
 | {
  "AllowAzureActiveDirectoryOutbound": {
    "access": "Allow",
    "destination_address_prefix": "AzureActiveDirectory",
    "destination_port_range": "*",
    "direction": "Outbound",
    "priority": 4050,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "AllowAzureBackupOutbound": {
    "access": "Allow",
    "destination_address_prefix": "AzureBackup",
    "destination_port_range": "*",
    "direction": "Outbound",
    "priority": 4045,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "AllowAzureCloudOutbound": {
    "access": "Allow",
    "destination_address_prefix": "AzureCloud",
    "destination_port_range": "*",
    "direction": "Outbound",
    "priority": 4040,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "AllowAzureKeyVaultOutbound": {
    "access": "Allow",
    "destination_address_prefix": "AzureKeyVault",
    "destination_port_range": "*",
    "direction": "Outbound",
    "priority": 4035,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "AllowAzureLoadBalancerOutbound": {
    "access": "Allow",
    "destination_address_prefix": "AzureLoadBalancer",
    "destination_port_range": "*",
    "direction": "Outbound",
    "priority": 4030,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "AllowAzureMonitorOutbound": {
    "access": "Allow",
    "destination_address_prefix": "AzureMonitor",
    "destination_port_range": "*",
    "direction": "Outbound",
    "priority": 4025,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "AllowAzureStorageOutbound": {
    "access": "Allow",
    "destination_address_prefix": "Storage",
    "destination_port_range": "*",
    "direction": "Outbound",
    "priority": 4020,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "DenyAllInbound": {
    "access": "Deny",
    "destination_address_prefix": "*",
    "destination_port_range": "*",
    "direction": "Inbound",
    "priority": 4096,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  }
} | no |

|  [subnet\_ids](#input\_subnet\_ids) | A map of subnet ids to pass | `map(string)` | `{}` | no |

|  [tags](#input\_tags) | The tags assigned to the resource | `map(string)` | n/a | yes |

## Outputs

| Name | Description |

|------|-------------|

|  [final\_nsg\_rules](#output\_final\_nsg\_rules) | The NSG rules list assigned as a variable |

|  [nsg\_id](#output\_nsg\_id) | The ID of the NSG |

|  [nsg\_name](#output\_nsg\_name) | The name of the NSG |

|  [nsg\_network\_interface\_security\_group\_association\_ids](#output\_nsg\_network\_interface\_security\_group\_association\_ids) | The IDs of the Network Interface Security Group Associations |

|  [nsg\_rg\_name](#output\_nsg\_rg\_name) | The name of the resource group the NSG is in |

|  [nsg\_subnet\_association\_ids](#output\_nsg\_subnet\_association\_ids) | The IDs of the Subnet Network Security Group Associations |
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/libre-devops/terraform-azurerm-nsg

Awesome Lists containing this project

README
