Configure an Azure Network Watcher Connection using Terraform

Terraform enables the definition, preview, and deployment of cloud infrastructure. Using Terraform, you create configuration files using HCL syntax. The HCL syntax allows you to specify the cloud provider - such as Azure - and the elements that make up your cloud infrastructure. After you create your configuration files, you create an execution plan that allows you to preview your infrastructure changes before they're deployed. Once you verify the changes, you apply the execution plan to deploy the infrastructure.

This article shows example Terraform code for setting up Network Watcher on Azure to monitor the network health for a Network Security Group.

In this article, you learn how to:

• Configure an Azure Network Watcher and flow logs

1. Configure your environment

• Azure subscription: If you don't have an Azure subscription, create a free account before you begin.

• Configure Terraform: If you haven't already done so, configure Terraform using one of the following options:

  • Configure Terraform in Azure Cloud Shell with Bash
  • Configure Terraform in Azure Cloud Shell with PowerShell
  • Configure Terraform in Windows with Bash
  • Configure Terraform in Windows with PowerShell

2. Configure an Azure Network Watcher and flow logs

1. Create a directory in which to test the sample Terraform code and make it the current directory.

2. Create a file named main.tf and insert the following code:

   provider azurerm {
     version = "~>2.0"
   
     features {}
   }
   
   resource "azurerm_resource_group" "application1" {
     name                        = "app1_rg"
     location                    = "northcentralus"
   }
   
   # Networking components to be monitored
   resource "azurerm_network_security_group" "application1" {
     name                = "application1"
     location            = azurerm_resource_group.application1.location
     resource_group_name = azurerm_resource_group.application1.name
   
     security_rule {
       name                       = "test123"
       priority                   = 110
       direction                  = "Inbound"
       access                     = "Deny"
       protocol                   = "Tcp"
       source_port_range          = "*"
       destination_port_range     = "22"
       source_address_prefix      = "*"
       destination_address_prefix = "*"
     }
   }
   
   # Log collection components
   resource "azurerm_storage_account" "network_log_data" {
     name                      = "app1logdata"
     resource_group_name       = azurerm_resource_group.application1.name
     location                  = azurerm_resource_group.application1.location
   
     account_tier              = "Standard"
     account_replication_type  = "GRS"
     min_tls_version           = "TLS1_2"
   }
   
   resource "azurerm_log_analytics_workspace" "traffic_analytics" {
     name                = "app007-traffic-analytics"
     location            = azurerm_resource_group.application1.location
     resource_group_name = azurerm_resource_group.application1.name
     retention_in_days   = 90
     daily_quota_gb      = 10
   }
   
   # The Network Watcher Instance & network log flow
   # There can only be one Network Watcher per subscription and region
   
   resource "azurerm_network_watcher" "app1_traffic" {
     name                = "NetworkWatcher_northcentralus"
     location            = azurerm_resource_group.application1.location
     resource_group_name = azurerm_resource_group.application1.name
   }
   
   resource "azurerm_network_watcher_flow_log" "app1_network_logs" {
     network_watcher_name = azurerm_network_watcher.app1_traffic.name
     resource_group_name  = azurerm_network_watcher.app1_traffic.resource_group_name
   
     network_security_group_id = azurerm_network_security_group.application1.id
     storage_account_id        = azurerm_storage_account.network_log_data.id
     enabled                   = true
   
     retention_policy {
       enabled = true
       days    = 90
     }
   
     traffic_analytics {
       enabled               = true
       workspace_id          = azurerm_log_analytics_workspace.traffic_analytics.workspace_id
       workspace_region      = azurerm_log_analytics_workspace.traffic_analytics.location
       workspace_resource_id = azurerm_log_analytics_workspace.traffic_analytics.id
       interval_in_minutes   = 10
     }
   }
   

3. Initialize Terraform

Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.

terraform init -upgrade

Key points:

• The -upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.

4. Create a Terraform execution plan

Run terraform plan to create an execution plan.

terraform plan -out main.tfplan

Key points:

• The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
• The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

5. Apply a Terraform execution plan

Run terraform apply to apply the execution plan to your cloud infrastructure.

terraform apply main.tfplan

Key points:

• The example terraform apply command assumes you previously ran terraform plan -out main.tfplan.
• If you specified a different filename for the -out parameter, use that same filename in the call to terraform apply.
• If you didn't use the -out parameter, call terraform apply without any parameters.

Troubleshoot Terraform on Azure

Troubleshoot common problems when using Terraform on Azure

Next steps

Network security group flow logging