如何在二头肌模板中创建 Azure 网络安全组/NSG 流日志？答案

【问题标题】：How can I create an Azure Network Security Group / NSG flow log within a Bicep template?如何在二头肌模板中创建 Azure 网络安全组/NSG 流日志？
【发布时间】：2021-04-28 17:29:04
【问题描述】：

我想为使用 Bicep 创建的网络安全组和存储帐户创建 NSG 流日志。

我正在部署类似的 NSG

resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = {
  name: networkSecurityGroupName
  location: location
  properties: {
    securityRules: [
...

还有一个类似的存储帐户

resource stg 'Microsoft.Storage/storageAccounts@2021-01-01' = {
  name: storageName
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}

但是当使用

添加和部署 NSG 流时

resource nsgFlowLogs 'Microsoft.Network/networkWatchers/flowLogs@2020-08-01' = {
  name: 'NetworkWatcher_${location}/${nsgFlowName}'
  location: location
  properties: {
    targetResourceId: nsg.Id
    storageId: stg.Id
    enabled: true
    retentionPolicy: {
      days: 2
      enabled: true
    }
    format: {
      type: 'JSON'
      version: 2
    }
  }
}

我收到一个错误

     | 19:02:20 - Error: Code=ResourceCountExceedsLimitDueToTemplate; Message=Subscription
     | 853049fd-4889-45b6-aad9-f3f54421399c has a quota of 1 for resources of type NetworkWatcher with sku SkuNotSpecified.
     | Subscription currently has 1 resources and the template contains 1 new resources of the this type which exceeds the
     | quota. Please contact support to increase the quota for resource type NetworkWatcher

【问题讨论】：

标签： azure azure-resource-manager azure-virtual-network azure-bicep

【解决方案1】：

我发现需要在预定义的资源组NetworkWatcherRG中创建Network Watcher资源和相应的流日志。

因此我提取了一个模块nsgflowlog.bicep

param name string
param location string = resourceGroup().location
param nsgId string
param storageId string

resource nsgFlowLogs 'Microsoft.Network/networkWatchers/flowLogs@2020-08-01' = {
  name: 'NetworkWatcher_${location}/${name}'
  location: location
  properties: {
    targetResourceId: nsgId
    storageId: storageId
    enabled: true
    retentionPolicy: {
      days: 2
      enabled: true
    }
    format: {
      type: 'JSON'
      version: 2
    }
  }
}

并且可以在部署期间切换资源组：

module nsgFlow './nsgflowlog.bicep' = {
  name: '${resourcePrefix}-nsgFlow'
  scope: resourceGroup('NetworkWatcherRG')
  params: {
    name: nsgFlowName
    nsgId: nsg.id
    storageId: stg.id
  }
}

【讨论】：