<p>Found the answer, this has changed at some point.</p>
<p>What's needed is a network_security_group_association which relates to a subnet_id and a network_security_group_id (the one that was in the network_security_group before)</p>
<pre><code>resource &quot;azurerm_subnet&quot; &quot;subnet-internal-1&quot; {
  name                 = &quot;${var.prefix}-internal-1&quot;
  resource_group_name  = azurerm_resource_group.geofriends.name
  virtual_network_name = azurerm_virtual_network.vn.name
  address_prefixes     = [&quot;10.0.0.0/24&quot;]
}

resource &quot;azurerm_network_security_group&quot; &quot;allow-ssh&quot; {
   name                    = &quot;${var.prefix}-allow-ssh&quot;
   location                = var.location
   resource_group_name     = azurerm_resource_group.geofriends.name

   security_rule {
       name                    = &quot;SSH&quot;
       priority                = 1001
       direction               = &quot;Inbound&quot;
       access                  = &quot;Allow&quot;
       protocol                = &quot;Tcp&quot;
       source_port_range       = var.ssh-source-address
       destination_port_range       = var.ssh-destination-address
       source_address_prefix        = var.ssh-source-address
       destination_address_prefix   = var.ssh-destination-address
   }
} 

resource &quot;azurerm_subnet_network_security_group_association&quot; &quot;sec-group-association&quot; {
  subnet_id                 = azurerm_subnet.subnet-internal-1.id
  network_security_group_id = azurerm_network_security_group.allow-ssh.id
}
</code></pre>
<p>Now the subnet subnet-internal-1 contains the allow ssh security_group</p>

CC BY-SA 4.0
2021-11-30T13:14:10.273Z
2021-11-30T13:14:10.273Z
Serve Laurijssen
<p>I'm following a lecture on terraform for azure. They add a property network_security_group_id to an azurerm_network_interface</p>
<pre><code>resource &quot;azurerm_network_interface&quot; &quot;demo-instance&quot; {
    name                        = &quot;${var.prefix}-instance1&quot;
    location                    = var.location
    resource_group_name         = azurerm_resource_group.demo.name
    network_security_group_id   = azurerm_network_security_group.allow-ssh.id

    ip_configuration {
      .....
    }
}
</code></pre>
<p>But 'terraform plan' spits out</p>
<blockquote>
<p>Error: Unsupported argument │ │   on instance.tf line 43, in resource
&quot;azurerm_network_interface&quot; &quot;demo-instance&quot;: │   43:<br />
network_security_group_id   =
azurerm_network_security_group.allow-ssh.id │ │ An argument named
&quot;network_security_group_id&quot; is not expected here.</p>
</blockquote>
<p>I'm guessing that this has moved somewhere else in some version, but I can't find the setting in the docs anywhere.</p>
<p>Where does network_security_group_id belong?</p>
<pre><code>resource &quot;azurerm_network_security_group&quot; &quot;allow-ssh&quot; {
    name                    = &quot;${var.prefix}-allow-ssh&quot;
    location                = var.location
    resource_group_name     = azurerm_resource_group.demo.name

    security_rule {
        name                    = &quot;SSH&quot;
        priority                = 1001
        direction               = &quot;Inbound&quot;
        access                  = &quot;Allow&quot;
        protocol                = &quot;Tcp&quot;
        source_port_range       = &quot;*&quot;
        destination_port_range  = var.ssh-source-address
        destination_address_prefix  = &quot;*&quot;
    }
}
</code></pre>
<p>Just removing these resources and settings and it works anyway. The resources get created and I'm able to login with a key. So is this not needed anymore at all?</p>

<terraform><azure-devops><azure>
network_security_group_id not expected in azurerm_network_interface
Serve Laurijssen
# network_security_group_id not expected in azurerm_network_interface

(Asked by: username_0 on 2021-11-26)

I'm following a lecture on terraform for azure. They add a property network_security_group_id to an azurerm_network_interface
resource "azurerm_network_interface" "demo-instance" {
    name                        = "${var.prefix}-instance1"
    location                    = var.location
    resource_group_name         = azurerm_resource_group.demo.name
    network_security_group_id   = azurerm_network_security_group.allow-ssh.id

    ip_configuration {
      .....
    }
}

But 'terraform plan' spits out

Error: Unsupported argument │ │   on instance.tf line 43, in resource
"azurerm_network_interface" "demo-instance": │   43:
network_security_group_id   =
azurerm_network_security_group.allow-ssh.id │ │ An argument named
"network_security_group_id" is not expected here.

I'm guessing that this has moved somewhere else in some version, but I can't find the setting in the docs anywhere.
Where does network_security_group_id belong?
resource "azurerm_network_security_group" "allow-ssh" {
    name                    = "${var.prefix}-allow-ssh"
    location                = var.location
    resource_group_name     = azurerm_resource_group.demo.name

    security_rule {
        name                    = "SSH"
        priority                = 1001
        direction               = "Inbound"
        access                  = "Allow"
        protocol                = "Tcp"
        source_port_range       = "*"
        destination_port_range  = var.ssh-source-address
        destination_address_prefix  = "*"
    }
}

Just removing these resources and settings and it works anyway. The resources get created and I'm able to login with a key. So is this not needed anymore at all?

**Tags:** terraform, azure-devops, azure


---

## 1 answers

### Answer by username_0 on 2021-11-30. Score: 0 | Accepted answer

Found the answer, this has changed at some point.
What's needed is a network_security_group_association which relates to a subnet_id and a network_security_group_id (the one that was in the network_security_group before)
resource "azurerm_subnet" "subnet-internal-1" {
  name                 = "${var.prefix}-internal-1"
  resource_group_name  = azurerm_resource_group.geofriends.name
  virtual_network_name = azurerm_virtual_network.vn.name
  address_prefixes     = ["10.0.0.0/24"]
}

resource "azurerm_network_security_group" "allow-ssh" {
   name                    = "${var.prefix}-allow-ssh"
   location                = var.location
   resource_group_name     = azurerm_resource_group.geofriends.name

   security_rule {
       name                    = "SSH"
       priority                = 1001
       direction               = "Inbound"
       access                  = "Allow"
       protocol                = "Tcp"
       source_port_range       = var.ssh-source-address
       destination_port_range       = var.ssh-destination-address
       source_address_prefix        = var.ssh-source-address
       destination_address_prefix   = var.ssh-destination-address
   }
} 

resource "azurerm_subnet_network_security_group_association" "sec-group-association" {
  subnet_id                 = azurerm_subnet.subnet-internal-1.id
  network_security_group_id = azurerm_network_security_group.allow-ssh.id
}

Now the subnet subnet-internal-1 contains the allow ssh security_group


---

