Deploy NSG flow logs through Bicep

Question

Hi Team,

Is there a way to deploy multiple NSG flow logs at the same time using Bicep. Also i need to use NetworkWatcherRG to a different RG but same subscription, is that possible?

Answer 1

@Murali R

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Important thing to note : Flow logs aren't created for a for a RG, we can only create flow logs for an NSG

Here is the reference for Bicep Template for enabling NSG Flow logs: https://learn.microsoft.com/en-us/azure/templates/microsoft.network/networkwatchers/flowlogs?pivots=deployment-language-bicep

• Now, a subscription will have only one Network Watcher for a specific region.
• And this resource will only belong to NetworkWatcherRG
• This is by design and we cannot change neither of them
• And you can only use this Network Watcher to enable flow logs (for that region).

Wrt, "And one more question is there any possible way to create multiple flow logs for the same RG with different Subnet address prefix"

• As I said, a flow log can be enabled for an NSG only
• flow logs for "the same RG with different Subnet address prefix" doesn't really make any sense
• If your intention is to create flow logs for the NSGs associated to various subnets in a RG, yes it can be done
• Please note, this will be created as different flow logs
• A single flow log will only log packet details from a single NSG

To provide more context,

• A flow log of a NSG is a sub resource of a Networker Watcher of that region.
• This means, you can have multiple NSG Flow logs in a single Network Watcher (of same region)
• RG doesn't add any value or restriction here.
• As in your case,
  • If you have multiple NSGs in your RG and want to create NSG Flow logs for them, you can very much do so
    • If all those NSGs are in same region, their corresponding flow logs will belong to the Network Watcher of that Region
      • If those NSGs are in different region(s), their corresponding flow logs will belong to the particular Network Watcher of that particular Region

Thanks,

Kapil

---

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

Answer 2

1. I've found that you need to sequence the deployment. Most Azure resource providers can handle queuing of requests without conflict, but some do need to make use of sequencing through the dependsOn.
2. You can indeed have multiple NetworkWatcherRG's in the same subscription.

For a Bicep example of NSG + Flow log creation, see https://github.com/Azure/AKS-Construction/blob/33a8a6d276897279f64bd9795f96ea5a1a8d6f63/bicep/network.bicep#L416