All VNet subnets should have NSG associated

High Azure General vnet-vnet-subnets-nsg-associated

Applies to

Microsoft.Network/virtualNetworks

What CGPulse checks

A resource passes this rule when subnets.withoutNsg must equal 0. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Associate a Network Security Group with each subnet to control traffic flow. In Azure Portal: Virtual Network > Subnets > select subnet > associate NSG. See: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

CLI

az network vnet subnet list --vnet-name "{name}" -g "{rg}" --query "[?networkSecurityGroup==null].name" -o tsv

Bicep

// TODO: Specify the NSG name to associate with each subnet

param nsgName string
param subnetName string

resource vnet 'Microsoft.Network/virtualNetworks@2023-11-01' existing = {{
  name: '{name}'
}}

resource nsg 'Microsoft.Network/networkSecurityGroups@2023-11-01' existing = {{
  name: nsgName
}}

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2023-11-01' = {{
  parent: vnet
  name: subnetName
  properties: {{
    networkSecurityGroup: {{
      id: nsg.id
    }}
    // TODO: Preserve existing subnet properties (addressPrefix, delegations, etc.)
  }}
}}

Terraform

resource "azurerm_subnet_network_security_group_association" "{name}" {
  subnet_id                 = var.subnet_id
  network_security_group_id = "{id}"
}

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan