Connection Monitor should be actively monitoring

Medium Azure General connectionmonitors-connection-monitor-actively-mon

Applies to

Microsoft.Network/networkWatchers/connectionMonitors

What CGPulse checks

A resource passes this rule when monitoringStatus must equal Running. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable the connection monitor to detect network connectivity issues and outages. In Azure Portal: Network Watcher > Connection monitor > verify status is Running. See: https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview

CLI

az network watcher connection-monitor start --ids "{id}"

Bicep

// Connection Monitor is a child resource of Network Watcher
resource connectionMonitor 'Microsoft.Network/networkWatchers/connectionMonitors@2024-01-01' = {{
  name: '<network-watcher-name>/{name}'
  location: resourceGroup().location
  properties: {{
    endpoints: [
      {{
        name: 'source'
        resourceId: '<source-vm-id>'
        type: 'AzureVM'
      }}
      {{
        name: 'destination'
        address: '<destination-address>'
        type: 'ExternalAddress'
      }}
    ]
    testConfigurations: [
      {{
        name: 'tcp-test'
        testFrequencySec: 30
        protocol: 'Tcp'
        tcpConfiguration: {{ port: 443 }}
      }}
    ]
    testGroups: [
      {{
        name: 'test-group'
        sources: ['source']
        destinations: ['destination']
        testConfigurations: ['tcp-test']
      }}
    ]
  }}
}}

Terraform

resource "azurerm_network_connection_monitor" "{name}" {
  name               = "{name}"
  network_watcher_id = "<network-watcher-id>"
  location           = var.location
  endpoint {
    name               = "source"
    target_resource_id = "<source-vm-id>"
  }
  endpoint {
    name    = "destination"
    address = "<destination-address>"
  }
  test_configuration {
    name                      = "tcp-test"
    protocol                  = "Tcp"
    test_frequency_in_seconds = 30
    tcp_configuration {
      port = 443
    }
  }
  test_group {
    name                  = "test-group"
    source_endpoints      = ["source"]
    destination_endpoints = ["destination"]
    test_configuration_names = ["tcp-test"]
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan