Enable Virtual Network Flow Logs

Browse code

Azure Public Test Date Azure Public Test Result

Azure US Gov Last Test Date Azure US Gov Last Test Result

Best Practice Check Cred Scan Check

Bicep Version

Deploy To Azure Deploy To Azure US Gov Visualize

This template deploys a virtual network flow log resource inside the Network Watcher resource group.

Sample overview and deployed resources

This template creates a virtual network flow log for an existing virtual network. The flow log is deployed to the resource group that contains the Network Watcher instance for the virtual network's region.

The following resources are deployed as part of the solution.

Microsoft.Network

  • Network Watcher: Uses the regional Network Watcher instance that owns the flow log resource.
  • Virtual network flow log: Records IP traffic for the existing virtual network and sends the data to the deployed storage account.

Microsoft.Storage

  • Storage account: Stores the virtual network flow log data.

Prerequisites

  • Network Watcher must be enabled in the region of the virtual network. Network Watcher is enabled by default unless you explicitly disable it.
  • The Microsoft.Insights resource provider must be registered in the subscription.
  • An existing virtual network is required. The virtual network must be in the same region as the Network Watcher instance.
  • The deployment must target the resource group that contains the regional Network Watcher instance. By default, Azure creates Network Watcher instances in NetworkWatcherRG, but the resource group and instance names can be customized.
  • The deploying account must have the permissions required to create a flow log and storage account in the Network Watcher resource group.

Deployment steps

Select Deploy to Azure or Deploy to Azure US Gov at the beginning of this document. In the Azure portal:

  1. Select the resource group that contains the Network Watcher instance for the virtual network's region.
  2. For Existing VNet, enter the full resource ID of the virtual network.
  3. Set Location to the virtual network's region.
  4. If your Network Watcher instance uses a custom name, update Network Watcher Name.
  5. Review the remaining flow log and storage account settings, and then deploy the template.

Tags: Network Watcher, virtual network flow logs, Microsoft.Storage/storageAccounts, Microsoft.Resources/deployments, Microsoft.Network/networkWatchers/flowLogs, JSON, Microsoft.Network/virtualNetworks