Deploy NSG flow logs through Bicep

Murali R 245 Reputation points
2023-07-03T16:56:03.6933333+00:00

Hi Team,

Is there a way to deploy multiple NSG flow logs at the same time using Bicep. Also i need to use NetworkWatcherRG to a different RG but same subscription, is that possible?

Azure Network Watcher
Azure Network Watcher
An Azure service that is used to monitor, diagnose, and gain insights into network performance and health.
161 questions
Accepted answer
  1. KapilAnanth-MSFT 39,461 Reputation points Microsoft Employee
    2023-07-07T12:30:42.46+00:00

    @Murali R

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    Important thing to note : Flow logs aren't created for a for a RG, we can only create flow logs for an NSG

    Here is the reference for Bicep Template for enabling NSG Flow logs: https://video2.skills-academy.com/en-us/azure/templates/microsoft.network/networkwatchers/flowlogs?pivots=deployment-language-bicep

    • Now, a subscription will have only one Network Watcher for a specific region.
    • And this resource will only belong to NetworkWatcherRG
    • This is by design and we cannot change neither of them
    • And you can only use this Network Watcher to enable flow logs (for that region).

    Wrt, "And one more question is there any possible way to create multiple flow logs for the same RG with different Subnet address prefix"

    • As I said, a flow log can be enabled for an NSG only
    • flow logs for "the same RG with different Subnet address prefix" doesn't really make any sense
    • If your intention is to create flow logs for the NSGs associated to various subnets in a RG, yes it can be done
    • Please note, this will be created as different flow logs
    • A single flow log will only log packet details from a single NSG

    To provide more context,

    • A flow log of a NSG is a sub resource of a Networker Watcher of that region.
    • This means, you can have multiple NSG Flow logs in a single Network Watcher (of same region)
    • RG doesn't add any value or restriction here.
    • As in your case,
      • If you have multiple NSGs in your RG and want to create NSG Flow logs for them, you can very much do so
        • If all those NSGs are in same region, their corresponding flow logs will belong to the Network Watcher of that Region
          • If those NSGs are in different region(s), their corresponding flow logs will belong to the particular Network Watcher of that particular Region

    Thanks,

    Kapil

    Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. AirGordon 7,030 Reputation points
    2023-07-03T18:40:10.57+00:00
    1. I've found that you need to sequence the deployment. Most Azure resource providers can handle queuing of requests without conflict, but some do need to make use of sequencing through the dependsOn.
    2. You can indeed have multiple NetworkWatcherRG's in the same subscription.

    For a Bicep example of NSG + Flow log creation, see https://github.com/Azure/AKS-Construction/blob/33a8a6d276897279f64bd9795f96ea5a1a8d6f63/bicep/network.bicep#L416