NAT Gateway should have public IP addresses assigned

High Azure General natgateways-nat-gateway-public-addresses

Applies to

Microsoft.Network/natGateways

What CGPulse checks

A resource passes this rule when publicIpAddressesCount must be greater than 0. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Assign at least one public IP address for outbound connectivity. In Azure Portal: NAT Gateway > Outbound IP > add public IP address. See: https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview

CLI

az network nat gateway update --ids "{id}" --public-ip-addresses "<public-ip-id>"

Bicep

resource publicIp 'Microsoft.Network/publicIPAddresses@2024-01-01' = {{
  name: '{name}-pip'
  location: resourceGroup().location
  sku: {{ name: 'Standard' }}
  properties: {{ publicIPAllocationMethod: 'Static' }}
}}

resource natGateway 'Microsoft.Network/natGateways@2024-01-01' = {{
  name: '{name}'
  location: resourceGroup().location
  sku: {{ name: 'Standard' }}
  properties: {{
    publicIpAddresses: [
      {{ id: publicIp.id }}
    ]
  }}
}}

Terraform

resource "azurerm_public_ip" "nat" {
  name                = "{name}-pip"
  resource_group_name = "{rg}"
  location            = var.location
  allocation_method   = "Static"
  sku                 = "Standard"
}
resource "azurerm_nat_gateway" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  sku_name            = "Standard"
}
resource "azurerm_nat_gateway_public_ip_association" "{name}" {
  nat_gateway_id       = azurerm_nat_gateway.{name}.id
  public_ip_address_id = azurerm_public_ip.nat.id
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan