Subnet

An Azure Subnet is a subdivision of an Azure Virtual Network (VNet) that enables users to segment and organize their resources within the VNet. Each subnet is associated with a specific IP address range and can contain resources such as virtual machines, application gateways, and network security groups. By dividing a VNet into subnets, users can apply different network security and routing policies to each subnet, based on their requirements. Users can also create multiple subnets within a VNet, allowing them to separate different tiers of resources or applications. For example, a user may create a VNet for their application and then divide it into separate subnets for web servers, application servers, and database servers. Each subnet can be assigned a different security group with unique inbound and outbound traffic rules, providing additional network security. Subnets also enable the use of Azure virtual network service endpoints, which allow resources to securely communicate with Azure services over a private endpoint within the VNet, rather than over the public internet.

Terraform Name

azurerm_subnet

Subnet

attributes:

The following arguments are supported:

name - (Required) The name of the subnet. Changing this forces a new resource to be created.
resource_group_name - (Required) The name of the resource group in which to create the subnet. Changing this forces a new resource to be created.
virtual_network_name - (Required) The name of the virtual network to which to attach the subnet. Changing this forces a new resource to be created.
address_prefixes - (Required) The address prefixes to use for the subnet.

NOTE:

Currently only a single address prefix can be set as the Multiple Subnet Address Prefixes Feature is not yet in public preview or general availability.

delegation - (Optional) One or more delegation blocks as defined below.
private_endpoint_network_policies_enabled - (Optional) Enable or Disable network policies for the private endpoint on the subnet. Setting this to true will Enable the policy and setting this to false will Disable the policy. Defaults to true.

NOTE:

Network policies, like network security groups (NSG), are not supported for Private Link Endpoints or Private Link Services. In order to deploy a Private Link Endpoint on a given subnet, you must set the private_endpoint_network_policies_enabled attribute to false. This setting is only applicable for the Private Link Endpoint, for all other resources in the subnet access is controlled based via the Network Security Group which can be configured using the azurerm_subnet_network_security_group_association resource.

private_link_service_network_policies_enabled - (Optional) Enable or Disable network policies for the private link service on the subnet. Setting this to true will Enable the policy and setting this to false will Disable the policy. Defaults to true.

NOTE:

In order to deploy a Private Link Service on a given subnet, you must set the private_link_service_network_policies_enabled attribute to false. This setting is only applicable for the Private Link Service, for all other resources in the subnet access is controlled based on the Network Security Group which can be configured using the azurerm_subnet_network_security_group_association resource.

service_endpoints - (Optional) The list of Service endpoints to associate with the subnet. Possible values include: Microsoft.AzureActiveDirectory, Microsoft.AzureCosmosDB, Microsoft.ContainerRegistry, Microsoft.EventHub, Microsoft.KeyVault, Microsoft.ServiceBus, Microsoft.Sql, Microsoft.Storage, Microsoft.Storage.Global and Microsoft.Web.

NOTE:

In order to use Microsoft.Storage.Global service endpoint (which allows access to virtual networks in other regions), you must enable the AllowGlobalTagsForStorage feature in your subscription. This is currently a preview feature, please see the official documentation for more information.

service_endpoint_policy_ids - (Optional) The list of IDs of Service Endpoint Policies to associate with the subnet.

A delegation block supports the following:

name - (Required) A name for this delegation.
service_delegation - (Required) A service_delegation block as defined below.

A service_delegation block supports the following:

NOTE:

Delegating to services may not be available in all regions. Check that the service you are delegating to is available in your region using the Azure CLI. Also, actions is specific to each service type. The exact list of actions needs to be retrieved using the aforementioned Azure CLI.

name - (Required) The name of service to delegate to.
Possible values are Microsoft.ApiManagement/service, Microsoft.AzureCosmosDB/clusters, Microsoft.BareMetal/AzureVMware, Microsoft.BareMetal/CrayServers, Microsoft.Batch/batchAccounts, Microsoft.ContainerInstance/containerGroups, Microsoft.ContainerService/managedClusters, Microsoft.Databricks/workspaces, Microsoft.DBforMySQL/flexibleServers, Microsoft.DBforMySQL/serversv2, Microsoft.DBforPostgreSQL/flexibleServers, Microsoft.DBforPostgreSQL/serversv2, Microsoft.DBforPostgreSQL/singleServers, Microsoft.HardwareSecurityModules/dedicatedHSMs, Microsoft.Kusto/clusters, Microsoft.Logic/integrationServiceEnvironments, Microsoft.LabServices/labplans, Microsoft.MachineLearningServices/workspaces, Microsoft.Netapp/volumes, Microsoft.Network/dnsResolvers, Microsoft.Network/managedResolvers, Microsoft.PowerPlatform/vnetaccesslinks, Microsoft.ServiceFabricMesh/networks, Microsoft.Sql/managedInstances, Microsoft.Sql/servers, Microsoft.StoragePool/diskPools, Microsoft.StreamAnalytics/streamingJobs, Microsoft.Synapse/workspaces, Microsoft.Web/hostingEnvironments, Microsoft.Web/serverFarms, Microsoft.Orbital/orbitalGateways, NGINX.NGINXPLUS/nginxDeployments, PaloAltoNetworks.Cloudngfw/firewalls, and Qumulo.Storage/fileSystems.
actions - (Optional) A list of Actions which should be delegated. This list is specific to the service to delegate to. Possible values are Microsoft.Network/networkinterfaces/*, Microsoft.Network/publicIPAddresses/join/action, Microsoft.Network/publicIPAddresses/read, Microsoft.Network/virtualNetworks/read, Microsoft.Network/virtualNetworks/subnets/action, Microsoft.Network/virtualNetworks/subnets/join/action, Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action, and Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action.

NOTE:

Azure may add default actions depending on the service delegation name and they can't be changed.

‍

Associating resources with a

Subnet

Resources do not "belong" to a

Subnet

Rather, one or more Security Groups are associated to a resource.

Create

Subnet

via Terraform:

The following HCL manages a subnet

Syntax:

resource "azurerm_resource_group" "example" {
name = "example-resources"
location = "West Europe"
}

resource "azurerm_virtual_network" "example" {
name = "example-vnet"
address_space = ["10.0.0.0/16"]
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "example" {
name = "example-subnet"
resource_group_name = azurerm_resource_group.example.name
virtual_network_name = azurerm_virtual_network.example.name
address_prefixes = ["10.0.1.0/24"]

delegation {
name = "delegation"

service_delegation {
name = "Microsoft.ContainerInstance/containerGroups"
actions = ["Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action"]
}
}
}

Create

Subnet

via CLI:

Parametres:

az network vnet subnet create --name
--resource-group
--vnet-name
[--address-prefixes]
[--delegations]
[--disable-private-endpoint-network-policies {0, 1, f, false, n, no, t, true, y, yes}]
[--disable-private-link-service-network-policies {0, 1, f, false, n, no, t, true, y, yes}]
[--nat-gateway]
[--network-security-group]
[--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
[--route-table]
[--service-endpoint-policy]
[--service-endpoints]

Example:

az network vnet subnet create -g MyResourceGroup --vnet-name MyVnet -n MySubnet --address-prefixes 10.0.0.0/24 --network-security-group MyNsg --route-table MyRouteTable

Subnet

Terraform Name

Costs

Indirect Cost