XEIZE
/Vulnerability documentation/IaC/Ansible/Azure/Review subnet NSG associations

Review subnet NSG associations

Check that the subnet has appropriate NSG associations and effective security rules.

Description

A network security group (NSG) filters traffic when associated with a subnet or network interface. Where a subnet needs an NSG, associate the intended group and review its rules. Omitting the NSG property when updating an existing subnet can preserve its association, so check the actual state.

Potential impact

A missing required NSG can leave intended traffic restrictions unapplied. Conversely, associating an NSG with a dedicated service subnet that does not support it can disrupt the service.

Remediation

Check the subnet's purpose and actual associations, then specify the required NSG through security_group. Verify the NSG name or resource ID and rule priorities, and test that only necessary traffic is allowed. Do not associate NSGs with GatewaySubnet or AzureFirewallSubnet; follow their service-specific network requirements.

Examples

This example uses an existing virtual network and NSG for an ordinary application subnet.

Before

yaml
- name: Create a subnet
  azure_rm_subnet:
    resource_group: myResourceGroup
    virtual_network_name: myVirtualNetwork
    name: mySubnet
    address_prefix_cidr: "10.1.0.0/24"

The configuration does not assign an NSG to a new subnet.

After

yaml
- name: Create a subnet
  azure_rm_subnet:
    resource_group: myResourceGroup
    virtual_network_name: myVirtualNetwork
    name: mySubnet
    address_prefix_cidr: "10.1.0.0/24"
    security_group: mySecurityGroup

The subnet is associated with mySecurityGroup. Check that this NSG exists in the same resource group and that its rules meet the application's requirements.

References

XEIZE DocumentationTechnical support