Azure Network Security Group Auto Updates / Resets

Question

I have a AKS three node cluster and in its network security group, I added (which i have done a number of times now) i list of IPs allowed to access the service.

However, Azure keeps resetting these for no reason what so ever. I have not updated / moved or changed this resource in any way, I have been building other resources, e.g. VMs to host other content. But this service has never been changed or edited by me, with either terrafrom, the CLI or the portal.

This was not set inside my terrafrom, but from the portal - mostly due to not knowing all the IPs I needed to add. But this terrafrom build has never been re-run to reset this?

Newer builds have been run to create complete new resources / resource groups, to the same account but not to this resource / group?

So why is my allow source IP list resetting / changing all the time?

Should I added the allowed IPs in my terrafrom and apply the update? Would that set it correctly, e.g. no reset?

I also get no warming that its been done - so i don't know when my hosted services are public

Thanks,

Answer 1

@Glenn ,

I would suggest you to check your activity logs to verify if there is a log for this change. If you find one, check which user/service principle is making this change.

Also, if you have enabled something like JIT, it will modify the source IP in your NSG. Check if you have JIT enabled.

Let me know if you have any questions.

Regards,
Karthik Srinivas