Edit

Create a virtual network flow log by using Bicep

In this article, you use Bicep to create a virtual network flow log for an existing virtual network. The Bicep file also creates an Azure storage account for the flow log data. For more information, see Virtual network flow logs overview and What is Bicep?

Bicep is a domain-specific language that uses declarative syntax to deploy Azure resources.

Prerequisites

Review the Bicep file

This article uses the Create virtual network flow logs Bicep file from the Azure Quickstart Templates. For more information, see Enable Virtual Network Flow Logs.

@description('Name of the Network Watcher attached to your subscription. Format: NetworkWatcher_<region_name>')
param networkWatcherName string = 'NetworkWatcher_${location}'

@description('Name of your flow log resource')
param flowLogName string = 'VNetFlowLog1'

@description('Region where your resources are located')
param location string = resourceGroup().location

@description('Resource ID of the target virtual network')
param existingVNet string

@description('Retention period in days. Default is zero which stands for permanent retention. Can be any Integer from 0 to 365')
@minValue(0)
@maxValue(365)
param retentionDays int = 0

@description('FlowLogs Version. Correct values are 1 or 2 (default)')
@allowed([
  1
  2
])
param flowLogsVersion int = 2

@description('Storage Account type')
@allowed([
  'Standard_LRS'
  'Standard_GRS'
  'Standard_ZRS'
])
param storageAccountType string = 'Standard_LRS'

var storageAccountName = 'flowlogs${uniqueString(resourceGroup().id)}'

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: storageAccountType
  }
  kind: 'StorageV2'
  properties: {}
}

resource networkWatcher 'Microsoft.Network/networkWatchers@2024-10-01' = {
  name: networkWatcherName
  location: location
  properties: {}
}

resource flowLog 'Microsoft.Network/networkWatchers/flowLogs@2024-10-01' = {
  parent: networkWatcher
  name: flowLogName
  location: location
  properties: {
    targetResourceId: existingVNet
    storageId: storageAccount.id
    enabled: true
    retentionPolicy: {
      days: retentionDays
      enabled: true
    }
    format: {
      type: 'JSON'
      version: flowLogsVersion
    }
  }
}

output flowLogName string = flowLog.name
output storageAccountName string = storageAccount.name

The Bicep file defines the following resources:

The highlighted code defines a virtual network flow log whose targetResourceId is the resource ID of an existing virtual network.

Deploy the Bicep file

You must deploy the flow log to the resource group that contains the Network Watcher instance for the virtual network's region.

  1. Save the Bicep file as main.bicep on your local computer.

  2. Set the virtual network and Network Watcher variables. Replace the placeholder values with your values.

    $vnet = Get-AzVirtualNetwork -Name '<virtual-network-name>' -ResourceGroupName '<virtual-network-resource-group>'
$networkWatcher = Get-AzNetworkWatcher -Location $vnet.Location

  3. Deploy the Bicep file.

    $deployment = New-AzResourceGroupDeployment `
    -Name 'createVNetFlowLog' `
    -ResourceGroupName $networkWatcher.ResourceGroupName `
    -TemplateFile ./main.bicep `
    -location $vnet.Location `
    -existingVNet $vnet.Id

When the deployment finishes, the output shows that the provisioning state is Succeeded.

Validate the deployment

Use Get-AzNetworkWatcherFlowLog to verify the flow log:

Get-AzNetworkWatcherFlowLog `
    -NetworkWatcherName $networkWatcher.Name `
    -ResourceGroupName $networkWatcher.ResourceGroupName `
    -Name $deployment.Outputs.flowLogName.Value

You can also go to Network Watcher > Flow logs in the Azure portal to confirm the flow log settings.

If you encounter deployment issues, see Troubleshoot common Azure deployment errors.

Clean up resources

When you no longer need the flow log and storage account, delete them.

Remove-AzNetworkWatcherFlowLog `
    -Name $deployment.Outputs.flowLogName.Value `
    -Location $vnet.Location

Remove-AzStorageAccount `
    -ResourceGroupName $networkWatcher.ResourceGroupName `
    -Name $deployment.Outputs.storageAccountName.Value

Related content

  • Last updated on