feat: add support for conditional creation and association of network security groups (#100)

Signed-off-by: Andre Licht <al@cloudeteer.de>

Author: lixhunter

README.md

@@ -137,7 +137,6 @@ The following resources are used by this module:
 - [azurerm_managed_disk.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk) (resource)
 - [azurerm_network_interface.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface) (resource)
 - [azurerm_network_interface_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface_security_group_association) (resource)
-- [azurerm_network_security_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) (resource)
 - [azurerm_public_ip.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) (resource)
 - [azurerm_role_assignment.entra_id_login_admin](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_role_assignment.entra_id_login_user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
@@ -667,7 +666,7 @@ Default: `null`
 Description: The resource ID of an existing Azure Network Security Group to associate with the network interface created by this module.
 
 - Applies only when `create_network_interface` is `true`.
-- If omitted and `create_network_interface` is `true`, this module creates and associates a default Network Security Group.
+- If omitted, no Network Security Group is associated with the module-created network interface.
 
 Type: `string`
 

r-network.tf

@@ -3,24 +3,10 @@ locals {
     azurerm_network_interface.this[*].id,
     (var.network_interface_ids != null ? var.network_interface_ids : [])
   )
-  network_security_group_id = (
-    var.network_security_group_id != null ?
-    var.network_security_group_id :
-    try(one(azurerm_network_security_group.this[*].id), null)
-  )
+  network_security_group_id = var.network_security_group_id
 
 }
 
-resource "azurerm_network_security_group" "this" {
-
-  count = var.create_network_interface && var.network_security_group_id == null ? 1 : 0
-
-  name                = "nsg-${trimprefix(var.name, "vm-")}"
-  location            = var.location
-  resource_group_name = var.resource_group_name
-  tags                = var.tags
-}
-
 resource "azurerm_network_interface" "this" {
 
   count = var.create_network_interface ? 1 : 0
@@ -45,7 +31,7 @@ resource "azurerm_network_interface" "this" {
 }
 
 resource "azurerm_network_interface_security_group_association" "this" {
-  count = var.create_network_interface ? 1 : 0
+  count = var.create_network_interface && var.network_security_group_id != null ? 1 : 0
 
   network_interface_id      = azurerm_network_interface.this[0].id
   network_security_group_id = local.network_security_group_id

tests/local/input_network.tftest.hcl

@@ -21,13 +21,8 @@ run "should_use_subnet_id" {
   }
 
   assert {
-    condition     = length(azurerm_network_security_group.this) == 1
-    error_message = "Expected the module to create a default network security group when no network_security_group_id is provided."
-  }
-
-  assert {
-    condition     = length(azurerm_network_interface_security_group_association.this) == 1
-    error_message = "Expected the created network interface to have a network security group association."
+    condition     = length(azurerm_network_interface_security_group_association.this) == 0
+    error_message = "Expected no network security group association when network_security_group_id is not provided."
   }
 }
 
@@ -71,13 +66,35 @@ run "should_use_existing_network_security_group_for_created_network_interface" {
   }
 
   assert {
-    condition     = length(azurerm_network_security_group.this) == 0
-    error_message = "Expected no network security group to be created when network_security_group_id is provided."
+    condition     = length(azurerm_network_interface_security_group_association.this) == 1
+    error_message = "Expected the created network interface to have a network security group association when network_security_group_id is provided."
+  }
+}
+
+run "should_not_associate_network_security_group_when_not_provided" {
+  command = plan
+
+  variables {
+    subnet_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
+  }
+
+  assert {
+    condition     = length(azurerm_network_interface_security_group_association.this) == 0
+    error_message = "Expected no network security group association when no network_security_group_id is provided."
+  }
+}
+
+run "should_associate_existing_network_security_group_when_provided" {
+  command = plan
+
+  variables {
+    network_security_group_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg-existing"
+    subnet_id                 = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
   }
 
   assert {
     condition     = length(azurerm_network_interface_security_group_association.this) == 1
-    error_message = "Expected the created network interface to have a network security group association when network_security_group_id is provided."
+    error_message = "Expected the provided network_security_group_id to be associated with the created network interface."
   }
 }
 

variables.tf

@@ -544,7 +544,7 @@ variable "network_security_group_id" {
   The resource ID of an existing Azure Network Security Group to associate with the network interface created by this module.
 
   - Applies only when `create_network_interface` is `true`.
-  - If omitted and `create_network_interface` is `true`, this module creates and associates a default Network Security Group.
+  - If omitted, no Network Security Group is associated with the module-created network interface.
   EOT
 
   default = null