Quickstart: Create a mesh network topology with Azure Virtual Network Manager using Terraform
Article
Get started with Azure Virtual Network Manager by using Terraform to provision connectivity for all your virtual networks.
In this quickstart, you deploy three virtual networks and use Azure Virtual Network Manager to create a mesh network topology. Then, you verify that the connectivity configuration was applied. You can choose from a deployment with a Subscription scope or a management group scope. Learn more about network manager scopes.
Terraform enables the definition, preview, and deployment of cloud infrastructure. Using Terraform, you create configuration files using HCL syntax. The HCL syntax allows you to specify the cloud provider - such as Azure - and the elements that make up your cloud infrastructure. After you create your configuration files, you create an execution plan that allows you to preview your infrastructure changes before they're deployed. Once you verify the changes, you apply the execution plan to deploy the infrastructure.
In this article, you learn how to:
Create a random value for the Azure resource group name using random_pet.
Create a file named variables.tf and insert the following code:
variable "resource_group_location" {
type = string
default = "eastus"
description = "Location of the resource group."
}
variable "resource_group_name_prefix" {
type = string
description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
default = "rg"
}
Create a file named outputs.tf and insert the following code:
output "resource_group_name" {
value = azurerm_resource_group.rg.name
}
output "virtual_network_names" {
value = azurerm_virtual_network.vnet[*].name
}
Implement the Terraform code
This code sample will implement Azure Virtual Network Manager at the management group scope.
Create a file named variables.tf and insert the following code:
variable "resource_group_location" {
type = string
default = "eastus"
description = "Location of the resource group."
}
variable "resource_group_name_prefix" {
type = string
description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
default = "rg"
}
variable "msi_id" {
type = string
description = "(Optional) Manage identity id that be used as authentication method. Defaults to `null`."
default = null
}
Create a file named outputs.tf and insert the following code:
output "resource_group_name" {
value = azurerm_resource_group.rg.name
}
output "virtual_network_names" {
value = azurerm_virtual_network.vnet[*].name
}
Initialize Terraform
Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.
terraform init -upgrade
Key points:
The -upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.
The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.
Apply a Terraform execution plan
Run terraform apply to apply the execution plan to your cloud infrastructure.
terraform apply main.tfplan
Key points:
The example terraform apply command assumes you previously ran terraform plan -out main.tfplan.
If you specified a different filename for the -out parameter, use that same filename in the call to terraform apply.
If you didn't use the -out parameter, call terraform apply without any parameters.
For each virtual network name printed in the previous step, run az network manager list-effective-connectivity-config to print the effective (applied) configurations. Replace the <virtual_network_name> placeholder with the vnet name.
az network manager list-effective-connectivity-config \
--resource-group $resource_group_name \
--vnet-name <virtual_network_name>
For each virtual network name printed in the previous step, run Get-AzNetworkManagerEffectiveConnectivityConfiguration to print the effective (applied) configurations. Replace the <virtual_network_name> placeholder with the vnet name.
The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.
In this tutorial, you learn how to create a hub and spoke network topology for your virtual networks using Azure Virtual Network Manager. Then you secure your network by blocking outbound traffic on ports 80 and 443.