Azure / Azure/Azure-Landing-Zones

Unable to associate NSG's with Subnets

Open
#489 0 comments 6 reactions 0 assignees View on GitHub
Transfer From: caf-enterprise-scale :arrow_right:
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Versions

**terraform**: v1.8.4

**azure provider**: azurerm v3.107.0

**module**: Azure/caf-enterprise-scale/azurerm

### Description

'network_security_group_id' appears to be present to associate an existing nsg with a subnet, but it doesn't appear to work.
I've searched through the module for 'azurerm_subnet_network_security_group_association' or 'network_security_group_id' to see where this setting is used, and don't see anything.

What am I missing here?

```
configure_connectivity_resources = {
settings = {
hub_networks = [
{
enabled = true
config = {
address_space = ["10.10.0.0/20"]
location = "northeurope"
subnets = [
{
name = "snet-nteu-hub-gw"
address_prefixes = ["10.10.0.0/24"]
network_security_group_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/abc-connectivity-northeurope-dev-nsg/providers/Microsoft.Network/networkSecurityGroups/nsg-snet-nteu-hub-gw"
route_table_id = ""
}
]
}
}
]
}
}
```

Contributor guide

Open the contributing guide

Research direction

Start by tracing the module's handling of `network_security_group_id` and searching for `azurerm_subnet_network_security_group_association`, as the issue does. Compare that behavior with the supplied `configure_connectivity_resources` configuration and its Terraform plan. Done means establishing whether subnet NSG association is supported and what the reported configuration is missing or failing to do.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, terraform
Domain
cloud, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.