feat: update network security group handling and assertions in tests

Signed-off-by: Andre Licht <al@cloudeteer.de>

Author: lixhunter

README.md

@@ -137,7 +137,6 @@ The following resources are used by this module:
 - [azurerm_managed_disk.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk) (resource)
 - [azurerm_network_interface.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface) (resource)
 - [azurerm_network_interface_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface_security_group_association) (resource)
-- [azurerm_network_security_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) (resource)
 - [azurerm_public_ip.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) (resource)
 - [azurerm_role_assignment.entra_id_login_admin](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_role_assignment.entra_id_login_user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
@@ -380,14 +379,6 @@ Type: `bool`
 
 Default: `true`
 
-### <a name="input_create_network_security_group"></a> [create\_network\_security\_group](#input\_create\_network\_security\_group)
-
-Description: Create (`true`) and associate a default Network Security Group for the module-created network interface when `network_security_group_id` is omitted. If disabled (`false`) and `network_security_group_id` is omitted, no Network Security Group is associated with the module-created network interface.
-
-Type: `bool`
-
-Default: `true`
-
 ### <a name="input_create_public_ip_address"></a> [create\_public\_ip\_address](#input\_create\_public\_ip\_address)
 
 Description: If set to `true` a Azure public IP address will be created and assigned to the default network interface.
@@ -675,7 +666,7 @@ Default: `null`
 Description: The resource ID of an existing Azure Network Security Group to associate with the network interface created by this module.
 
 - Applies only when `create_network_interface` is `true`.
-- If omitted and both `create_network_interface` and `create_network_security_group` are `true`, this module creates and associates a default Network Security Group.
+- If omitted, no Network Security Group is associated with the module-created network interface.
 
 Type: `string`
 

r-network.tf

@@ -3,22 +3,8 @@ locals {
     azurerm_network_interface.this[*].id,
     (var.network_interface_ids != null ? var.network_interface_ids : [])
   )
-  network_security_group_id = (
-    var.network_security_group_id != null ?
-    var.network_security_group_id :
-    try(one(azurerm_network_security_group.this[*].id), null)
-  )
-
-}
-
-resource "azurerm_network_security_group" "this" {
+  network_security_group_id = var.network_security_group_id
 
-  count = var.create_network_interface && var.create_network_security_group && var.network_security_group_id == null ? 1 : 0
-
-  name                = "nsg-${trimprefix(var.name, "vm-")}"
-  location            = var.location
-  resource_group_name = var.resource_group_name
-  tags                = var.tags
 }
 
 resource "azurerm_network_interface" "this" {
@@ -45,7 +31,7 @@ resource "azurerm_network_interface" "this" {
 }
 
 resource "azurerm_network_interface_security_group_association" "this" {
-  count = var.create_network_interface && (var.create_network_security_group || var.network_security_group_id != null) ? 1 : 0
+  count = var.create_network_interface && var.network_security_group_id != null ? 1 : 0
 
   network_interface_id      = azurerm_network_interface.this[0].id
   network_security_group_id = local.network_security_group_id

tests/local/input_network.tftest.hcl

@@ -21,13 +21,8 @@ run "should_use_subnet_id" {
   }
 
   assert {
-    condition     = length(azurerm_network_security_group.this) == 1
-    error_message = "Expected the module to create a default network security group when no network_security_group_id is provided."
-  }
-
-  assert {
-    condition     = length(azurerm_network_interface_security_group_association.this) == 1
-    error_message = "Expected the created network interface to have a network security group association."
+    condition     = length(azurerm_network_interface_security_group_association.this) == 0
+    error_message = "Expected no network security group association when network_security_group_id is not provided."
   }
 }
 
@@ -70,53 +65,36 @@ run "should_use_existing_network_security_group_for_created_network_interface" {
     subnet_id                 = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
   }
 
-  assert {
-    condition     = length(azurerm_network_security_group.this) == 0
-    error_message = "Expected no network security group to be created when network_security_group_id is provided."
-  }
-
   assert {
     condition     = length(azurerm_network_interface_security_group_association.this) == 1
     error_message = "Expected the created network interface to have a network security group association when network_security_group_id is provided."
   }
 }
 
-run "should_not_create_or_associate_network_security_group_when_disabled" {
+run "should_not_associate_network_security_group_when_not_provided" {
   command = plan
 
   variables {
-    create_network_security_group = false
-    subnet_id                     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
-  }
-
-  assert {
-    condition     = length(azurerm_network_security_group.this) == 0
-    error_message = "Expected no network security group to be created when create_network_security_group is disabled."
+    subnet_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
   }
 
   assert {
     condition     = length(azurerm_network_interface_security_group_association.this) == 0
-    error_message = "Expected no network security group association when create_network_security_group is disabled and no network_security_group_id is provided."
+    error_message = "Expected no network security group association when no network_security_group_id is provided."
   }
 }
 
-run "should_associate_existing_network_security_group_when_default_creation_disabled" {
+run "should_associate_existing_network_security_group_when_provided" {
   command = plan
 
   variables {
-    create_network_security_group = false
-    network_security_group_id     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg-existing"
-    subnet_id                     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
-  }
-
-  assert {
-    condition     = length(azurerm_network_security_group.this) == 0
-    error_message = "Expected no network security group to be created when create_network_security_group is disabled."
+    network_security_group_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg-existing"
+    subnet_id                 = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
   }
 
   assert {
     condition     = length(azurerm_network_interface_security_group_association.this) == 1
-    error_message = "Expected the provided network_security_group_id to still be associated when default network security group creation is disabled."
+    error_message = "Expected the provided network_security_group_id to be associated with the created network interface."
   }
 }
 

variables.tf

@@ -194,12 +194,6 @@ variable "create_network_interface" {
   default     = true
 }
 
-variable "create_network_security_group" {
-  description = "Create (`true`) and associate a default Network Security Group for the module-created network interface when `network_security_group_id` is omitted. If disabled (`false`) and `network_security_group_id` is omitted, no Network Security Group is associated with the module-created network interface."
-  type        = bool
-  default     = true
-}
-
 variable "create_public_ip_address" {
   description = "If set to `true` a Azure public IP address will be created and assigned to the default network interface."
   default     = false
@@ -550,7 +544,7 @@ variable "network_security_group_id" {
   The resource ID of an existing Azure Network Security Group to associate with the network interface created by this module.
 
   - Applies only when `create_network_interface` is `true`.
-  - If omitted and both `create_network_interface` and `create_network_security_group` are `true`, this module creates and associates a default Network Security Group.
+  - If omitted, no Network Security Group is associated with the module-created network interface.
   EOT
 
   default = null