Example of using the Subnet Association resources with Azure Policy

[tombuildsstuff]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Larger organizations utilize Azure Policies to ensure that a Subnets contain a Network Security Group/Route Table ID at creation time, which is incompatible with the azurerm_subnet_network_security_group_association and azurerm_subnet_route_table_association resources - which are required to be able to workaround issues in the Azure API during terraform destroy.

Unfortunately these issues are unavoidable due to the design of the Azure API - and whilst we could seek to reintroduce these two fields - ultimately this'd reintroduce the issue and so isn't a viable solution.

These "association" resources create an empty Subnet and then subsequently patch them to add the network_security_group_id and the route_table_id fields - but crucially by having these split out allow operations to be ordered such that these destroy operations aren't possible.

One option to work around this is to use the azurerm_virtual_network resource to define the subnets with these fields inline - however this only works when these subnets are defined centrally and so doesn't work for all users/scenarios.

As such this issue covers adding an example Azure Policy to achieve this scenario, namely:

• Allowing the creation of a Subnet (with no Network Security Group ID / Route Table ID when there's no Network Interfaces [IP Configurations] present)
• When attempting to create a Network Interface [IP Configuration] within the Subnet, require that a Network Security Group ID/Route Table ID exists

This Policy should allow organizations to comply with Policy requirements (requiring that all Subnets have a Network Security Group/Route Table ID) whilst working around the issues in the Azure API.

New or Affected Resource(s)

• azurerm_policy_definition
• azurerm_subnet
• azurerm_subnet_network_security_group_association
• azurerm_subnet_route_table_association

References

• r/virtual_network: support for route_table_id within the subnets block #7196
• Subnet cannot be created with route table (unlike with the Azure API) #7586
• Add possibility to specify Network/Application Security Group when creating network interface #7987
• Azure Policy is interfering with network security group association #8261

[XavierGeerinck]

I am also having this issue.... it's quite blocking as well here.

I now create a VNET through this code:

resource "azurerm_virtual_network" "vnet_hub" {
  name                = "vnet-hub"
  location            = azurerm_resource_group.rg_connectivity_hub.location
  resource_group_name = azurerm_resource_group.rg_connectivity_hub.name
  address_space       = ["10.0.0.0/16"]

  tags = {
    environment = "global"
  }

  subnet {
    name           = "GatewaySubnet" # Required name, do not change
    address_prefix = "10.0.255.224/27"
    security_group = azurerm_network_security_group.nsg_hub_gateway.id
  }

  subnet {
    name           = "s-hub-mgmt"
    address_prefix = "10.0.0.64/27"
    security_group = azurerm_network_security_group.nsg_hub_mgmt.id
  }

  subnet {
    name           = "s-hub-dmz"
    address_prefix = "10.0.0.32/27"
    security_group = azurerm_network_security_group.nsg_hub_dmz.id
  }
}

However the main issue is that while I expect this to create the subnets, I am not able to fetch the IDs of the subnet (even though they should get exported as stated by #1913). Checking into the code https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/azurerm/internal/services/network/virtual_network_resource.go#L423 provides that I should be able to set subnet_id = values(azurerm_virtual_network.vnet_hub.subnet)[0].id to then initialize the gateway. This however is not working either and returns that the Set is empty.

[XavierGeerinck]

Update: Fixed I can deploy now with the policy, below the config I used:

# Network Security Groups (NSGs)
resource "azurerm_network_security_group" "nsg_hub_mgmt" {
  name                = "nsg-hub-mgmt"
  location            = azurerm_resource_group.rg_connectivity_hub.location
  resource_group_name = azurerm_resource_group.rg_connectivity_hub.name
}

resource "azurerm_network_security_group" "nsg_hub_dmz" {
  name                = "nsg-hub-dmz"
  location            = azurerm_resource_group.rg_connectivity_hub.location
  resource_group_name = azurerm_resource_group.rg_connectivity_hub.name
}

# Virtual Network (vNET)
resource "azurerm_virtual_network" "vnet_hub" {
  name                = "vnet-hub"
  location            = azurerm_resource_group.rg_connectivity_hub.location
  resource_group_name = azurerm_resource_group.rg_connectivity_hub.name
  address_space       = ["10.0.0.0/16"]

  tags = {
    environment = "global"
  }

  # Our Gateway Subnet, it cannot have a NSG!
  subnet {
    name           = "GatewaySubnet" # Required name, do not change
    address_prefix = "10.0.255.224/27"
  }

  subnet {
    name           = "s-hub-mgmt"
    address_prefix = "10.0.0.64/27"
    security_group = azurerm_network_security_group.nsg_hub_mgmt.id
  }

  subnet {
    name           = "s-hub-dmz"
    address_prefix = "10.0.0.32/27"
    security_group = azurerm_network_security_group.nsg_hub_dmz.id
  }
}

[Asos-RiverPhillips]

this only works when these subnets are defined centrally and so doesn't work for all users/scenarios

Do you have an example of how this can be achieved if the subnets aren't defined centrally? This is a real blocker for us.

[dhensby]

You have to change the azure policy if you aren't defining the vnets and subnets all at once.

[courageDeveloper]

@tombuildsstuff when you talk about "When attempting to create a Network Interface [IP Configuration] within the Subnet, require that a Network Security Group ID/Route Table ID exists" are you referring to the NSG created at the Network Interface or at the Subnet?