Facing NetworkSecurityGroupNotFoundForFlowLog Error for Deploying Azure NSG Flow Log through Bicep

Murali R 205

Hi Team,

Iam facing some errors while Enabling NSG Flow Log through Bicep. I have Two NSGResourceGroups with two different regions (NorthCentralUs, EastUs) where it consists of multiple Nsg's in each NSGResourceGroups, One Network Watcher for each region in NetworkWatcherRG, One Vnet and One storage account for each region.

In Bicep template, to collect the value of ExistingNsgId, NsgNames and NsgRgNames, i am using powershell script. When i try to deploy i am receiving the following error.

I am receiving this error only for 2nd NSG RG, but the first NSGRg does not have any problem for creating NSG flow log

Network security group specified in flow log TargetResourceId /subscriptions/xxx/resourceGroups/VSS_EASTUS_NSG/providers/Microsoft.Network/networkSecurityGroups/xxx is not found. (Code: NetworkSecurityGroupNotFoundForFlowLog)

Network security group specified in flow log TargetResourceId /subscriptions/xxx/resourceGroups/VSS_EASTUS_NSG/providers/Microsoft.Network/networkSecurityGroups/xxx is not found. (Code: NetworkSecurityGroupNotFoundForFlowLog)

Network security group specified in flow log TargetResourceId /subscriptions/xxx/resourceGroups/VSS_EASTUS_NSG/providers/Microsoft.Network/networkSecurityGroups/xxx is not found. (Code: NetworkSecurityGroupNotFoundForFlowLog)

Network security group specified in flow log TargetResourceId /subscriptions/xxx/resourceGroups/VSS_EASTUS_NSG/providers/Microsoft.Network/networkSecurityGroups/xxx is not found. (Code: NetworkSecurityGroupNotFoundForFlowLog)

Network security group specified in flow log TargetResourceId /subscriptions/xxx/resourceGroups/VSS_EASTUS_NSG/providers/Microsoft.Network/networkSecurityGroups/xxx is not found. (Code: NetworkSecurityGroupNotFoundForFlowLog)

Kindly help help me on this error.

KapilAnanth-MSFT 35,246 Reputation points Microsoft Employee

2023-12-14T06:06:35.04+00:00
@Murali R

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Can you please provide more details on when you are getting this error?

Is it from the Azure Powershell to get the NSGs?

If so, can you share the command/script you are using

Or from the Bicep template.

Cheers,

Kapil

Murali R 205

Hi @KapilAnanth-MSFT Iam receiving this error when iam using ps script for deployment. However let me share both the ps script and BICEP template FYR

Powershell

$ResourceGroupName1 = "VSS_NORTHCENTRALUS_NSG"
$ResourceGroupName2 = "VSS_EASTUS_NSG"
$nsgs1 = Get-AzNetworkSecurityGroup -ResourceGroupName $ResourceGroupName1
$nsgs2 = Get-AzNetworkSecurityGroup -ResourceGroupName $ResourceGroupName2

$nsgIds1 = @()
$nsgIds2 = @()
$nsgNames1 = @()
$nsgNames2 = @()
$nsgRgNames1 = @()
$nsgRgNames2 = @()

foreach ($nsg in $nsgs1) {
  $nsgIds1 += $nsg.Id
  $nsgNames1 += $nsg.Name
  $nsgRgNames1 += $nsg.ResourceGroupName
}

foreach ($nsg in $nsgs2) {
  $nsgIds2 += $nsg.Id
  $nsgNames2 += $nsg.Name
  $nsgRgNames2 += $nsg.ResourceGroupName
}

$data = @{
  "value" = $nsgIds1
} | ConvertTo-Json -Depth 100 
$data | Out-File -FilePath "C:\nsgIds1.parameters.json"

$data = @{
  "value" = $nsgIds2
} | ConvertTo-Json -Depth 100 
$data | Out-File -FilePath "C:\nsgIds2.parameters.json"

$data = @{
  "value" = $nsgNames1
} | ConvertTo-Json -Depth 100 
$data | Out-File -FilePath "C:\nsgNames1.parameters.json"

$data = @{
  "value" = $nsgNames2
} | ConvertTo-Json -Depth 100 
$data | Out-File -FilePath "C:\nsgNames2.parameters.json"

$data = @{
  "value" = $nsgRgNames1
} | ConvertTo-Json -Depth 100 
$data | Out-File -FilePath "C:\nsgRgNames1.parameters.json"

$data = @{
  "value" = $nsgRgNames2
} | ConvertTo-Json -Depth 100 
$data | Out-File -FilePath "C:\nsgRgNames2.parameters.json"

$nsgRgNames1 = Get-Content -Path "C:\nsgRgNames1.parameters.json" -Raw | ConvertFrom-Json
$nsgRgNames2 = Get-Content -Path "C:\nsgRgNames2.parameters.json" -Raw | ConvertFrom-Json
$nsgIds1 = Get-Content -Path "C:\nsgIds1.parameters.json" -Raw | ConvertFrom-Json
$nsgIds2 = Get-Content -Path "C:\nsgIds2.parameters.json" -Raw | ConvertFrom-Json
$nsgNames1 = Get-Content -Path "C:\nsgNames1.parameters.json" -Raw | ConvertFrom-Json
$nsgNames2 = Get-Content -Path "C:\nsgNames2.parameters.json" -Raw | ConvertFrom-Json

Write-Host "##vso[task.setvariable variable=nsgRgNames1;]$($nsgRgNames1.value)"
Write-Host "##vso[task.setvariable variable=nsgRgNames2;]$($nsgRgNames2.value)"
Write-Host "##vso[task.setvariable variable=nsgIds1;]$($nsgIds1.value)"
Write-Host "##vso[task.setvariable variable=nsgIds2;]$($nsgIds2.value)"
Write-Host "##vso[task.setvariable variable=nsgNames1;]$($nsgNames1.value)"
Write-Host "##vso[task.setvariable variable=nsgNames2;]$($nsgNames2.value)"

New-AzResourceGroupDeployment -ResourceGroupName NetworkWatcherRG -TemplateFile C:\main.bicep -TemplateParameterFile C:\main.parameters-dev.json -nsgRgNames1 $nsgRgNames1.value -nsgIds1 $nsgIds1.value -nsgNames1 $nsgNames1.value -nsgRgNames2 $nsgRgNames2.value -nsgIds2 $nsgIds2.value -nsgNames2 $nsgNames2.value

BICEP template:

param nsgRgNames1 array = []
param nsgRgNames2 array = []
param nsgIds1 array = []
param nsgIds2 array = []
param nsgNames1 array = []
param nsgNames2 array = []
param networkWatcherNames1 string = 'xxx'
param networkWatcherNames2 string = 'xxx'
param location string = 'xxx'
param storageId1 string = ''
param storageId2 string = ''

@description('Log analytics workspace resource Guid')
param workspaceId string = 'xxx'

@description('Log analytics workspace region')
param workspaceRegion string = 'xxx'

@description('Log analytics workspace resource id')
param workspaceResourceId string = ''

resource flowLogs1 'Microsoft.Network/networkWatchers/flowLogs@2020-11-01' = [for i in range(0, length(nsgIds1)): {
  name: '${networkWatcherNames1}/Microsoft.Network${nsgRgNames1[i]}${nsgNames1[i]}'
  location: location
  properties: {
    targetResourceId: nsgIds1[i]
    storageId: storageId1
    enabled: true
    format: {
      type: 'JSON'
      version: 2
    }
    retentionPolicy: {
      days: 0
      enabled: true
    }
    flowAnalyticsConfiguration: {
      networkWatcherFlowAnalyticsConfiguration: {
        enabled: true
        workspaceId: workspaceId
        workspaceRegion: workspaceRegion
        workspaceResourceId: workspaceResourceId
      }
    }
  }
}]

resource flowLogs2 'Microsoft.Network/networkWatchers/flowLogs@2020-11-01' = [for i in range(0, length(nsgIds2)): {
  name: '${networkWatcherNames2}/Microsoft.Network${nsgRgNames2[i]}${nsgNames2[i]}'
  location: location
  properties: {
    targetResourceId: nsgIds2[i]
    storageId: storageId2
    enabled: true
    format: {
      type: 'JSON'
      version: 2
    }
    retentionPolicy: {
      days: 0
      enabled: true
    }
    flowAnalyticsConfiguration: {
      networkWatcherFlowAnalyticsConfiguration: {
        enabled: true
        workspaceId: workspaceId
        workspaceRegion: workspaceRegion
        workspaceResourceId: workspaceResourceId
      }
    }
  }
}]

KapilAnanth-MSFT 35,246 Reputation points Microsoft Employee

2023-12-14T12:52:26.31+00:00
@Murali R

From the script, I see

param location string = 'xxx'

In the case you are using 2 Regions, shouldn't the 2nd Flow Log use the same region as the NSGs of the 2nd Region.

Can you please use two parameters location1 and location2 (or variable using storageIdX.properties.location ) and give it a try?

Cheers,

Kapil

Murali R 205

Hi @KapilAnanth-MSFT Thank you very much, right now its working fine. But i have a doubt, I have Two NSGResourceGroups with two different regions (NorthCentralUs, EastUs) where it consists of multiple Nsg's in each NSGResourceGroups, One Network Watcher for each region in NetworkWatcherRG, One Vnet and One storage account for each region.

If in case i have three NSGResourceGroup and all the above, do i need to create resource flowLogs like the below
resource flowLogs1 'Microsoft.Network/networkWatchers/flowLogs@2020-11-01' = [for i in range(0, length(nsgIds1)): {
resource flowLogs2 'Microsoft.Network/networkWatchers/flowLogs@2020-11-01' = [for i in range(0, length(nsgIds1)): {
resource flowLogs3 'Microsoft.Network/networkWatchers/flowLogs@2020-11-01' = [for i in range(0, length(nsgIds1)): {

Or we can modify as per the below and change the ps script alone

param networkWatcherName1 string
param networkWatcherName2 string
param nsgRgNames array
param nsgIds array
param nsgNames array
param storageAccountIds array
param location string = resourceGroup().location

@description('Log analytics workspace resource Guid')
param workspaceId string

@description('Log analytics workspace region')
param workspaceRegion string

@description('Log analytics workspace resource id')
param workspaceResourceId string

resource flowLogs 'Microsoft.Network/networkWatchers/flowLogs@2022-01-01' = [for i in range(0, length(nsgIds)): {
  name: format('{0}/Microsoft.Network{1}{2}', i % 2 == 0 ? networkWatcherName1 : networkWatcherName2, nsgRgNames[i], nsgNames[i])
  location: location
  properties: {
    targetResourceId: nsgIds[i]
    storageId: storageAccountIds[i]
    enabled: true
    format: {
      type: 'JSON'
      version: 2
    }
    retentionPolicy: {
      days: 0
      enabled: false
    }
    flowAnalyticsConfiguration: {
      networkWatcherFlowAnalyticsConfiguration: {
        enabled: false
        workspaceId: workspaceId
        workspaceRegion: workspaceRegion
        workspaceResourceId: workspaceResourceId
      }
    }
  }
}]

KapilAnanth-MSFT 35,246 Reputation points Microsoft Employee

2023-12-14T13:24:44.8+00:00
@Murali R

Glad the issue has been resolved.

You can run a loop based on the count of NSGs , fetch the location of the NSG and use it to select the Network Watcher.

It's totally upto you.

However, from your conditional operator, the logic looks it would just alternate between region1 and region2 (based on even or odd i) without checking the region of the NSG at all.

I have summarized my comments and posted it as a new answer.

I would highly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil

Accepted answer

KapilAnanth-MSFT 35,246 Reputation points Microsoft Employee

2023-12-14T13:17:26.8+00:00

@Murali R

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

You are in the process of automating Flow logs creation using Bicep.

From your script, we found out that the location parameter was misconfigured.

Fixing this resolved the issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Facing NetworkSecurityGroupNotFoundForFlowLog Error for Deploying Azure NSG Flow Log through Bicep

0 additional answers