☁️ Azure Network Manager Network Group Terraform Module

The unit a security admin configuration targets — created here, and populated somewhere else entirely. Targets hashicorp/azurerm ~> 4.0.

• 🎯 Creates the network group that rule collections name in network_group_ids.
• 🔴 States, four ways, that this resource does not carry membership — the group is created empty.
• ⚠️ Names the silent failure: a rule set targeting an empty group is enforced on nothing, with no error.
• 🏷️ Emits the effective member type, and reports that Subnet needs Routing on the manager.
• 🔴 Names the forced destroy: deleting this group deletes no rule, and yet every rule stops reaching these networks.

💡 Why it matters: there is no members argument in the schema. A successful apply proves the group exists and proves nothing about what is in it — and where membership is policy-driven, it changes with no Terraform run at all. This module reports what it cannot see rather than letting an empty group look like coverage.

If this module saved you time:

• ⭐ Star the repository — it genuinely helps other people find it.
• 💼 Connect on LinkedIn — linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee — buymeacoffee.com/microsoftexpert

flowchart TB
    NM["azurerm_network_manager<br/>Routing scope access needed for a Subnet group"]
    GRP["azurerm_network_manager_network_group<br/>THIS MODULE"]
    MEMBERS["static members, or an Azure Policy rule<br/>NOT THIS RESOURCE"]
    CFG["azurerm_network_manager_security_admin_configuration"]
    COLL["azurerm_network_manager_admin_rule_collection<br/>names this group in network_group_ids"]
    RULE["azurerm_network_manager_admin_rule"]
    VNET["member virtual networks"]
    NSG["azurerm_network_security_group"]

    NM -->|"id to network_manager_id"| GRP
    NM -->|"id to network_manager_id"| CFG
    MEMBERS -.->|"populate the group outside Terraform"| GRP
    GRP -->|"id to network_group_ids on the COLLECTION"| COLL
    CFG -->|"id to security_admin_configuration_id"| COLL
    COLL -->|"id to admin_rule_collection_id"| RULE
    GRP -->|"decides which networks are reached"| VNET
    RULE -.->|"evaluated BEFORE and outranks"| NSG
    NSG --> VNET

    style GRP fill:#0078D4,stroke:#004578,color:#ffffff
    style NM fill:#004578,stroke:#004578,color:#ffffff
    style MEMBERS fill:#B71C1C,stroke:#7F0000,color:#ffffff
    style CFG fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style COLL fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style RULE fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style VNET fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style NSG fill:#F3F2F1,stroke:#8A8886,color:#201F1E

The red node is the one to notice: membership arrives from static members or an Azure Policy rule, along a dotted edge, because none of it passes through this resource. Everything below the group — the collection, the rules, the override of every network security group they reach — depends on a membership this module cannot see.

flowchart TB
    IN1["name<br/>REQUIRED, force-new"]
    IN2["network_manager_id<br/>REQUIRED, force-new"]
    IN3["member_type<br/>VirtualNetwork by default, Subnet needs Routing"]
    IN4["description<br/>optional, and NOT validated by the provider"]
    IN5["timeouts<br/>all four keys"]

    RES["azurerm_network_manager_network_group.this<br/>a real ARM record, no locks, import guard"]

    ABSENT["NO members argument exists<br/>the group is created EMPTY"]

    OUT1["id<br/>listed in a rule collection network_group_ids"]
    OUT2["this_resource_creates_the_group_but_not_its_membership<br/>constant true"]
    OUT3["an_empty_group_makes_every_rule_targeting_it_reach_nothing<br/>constant true"]
    OUT4["membership_can_change_with_no_terraform_run_at_all<br/>constant true"]
    OUT5["effective_member_type<br/>resolves the provider default"]
    OUT6["requires_routing_scope_access_on_the_manager<br/>true for Subnet"]
    OUT7["destroy_removes_the_reach_of_every_rule_that_targeted_this_group<br/>constant true"]

    IN1 --> RES
    IN2 --> RES
    IN3 --> RES
    IN4 --> RES
    IN5 --> RES

    RES -.-> ABSENT

    RES --> OUT1
    RES --> OUT2
    RES --> OUT3
    RES --> OUT4
    RES --> OUT5
    RES --> OUT6
    RES --> OUT7

    style RES fill:#0078D4,stroke:#004578,color:#ffffff
    style OUT1 fill:#004578,stroke:#004578,color:#ffffff
    style ABSENT fill:#B71C1C,stroke:#7F0000,color:#ffffff
    style OUT3 fill:#B71C1C,stroke:#7F0000,color:#ffffff
    style OUT7 fill:#B71C1C,stroke:#7F0000,color:#ffffff
    style IN1 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style IN2 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style IN3 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style IN4 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style IN5 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style OUT2 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style OUT4 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style OUT5 fill:#F3F2F1,stroke:#8A8886,color:#201F1E
    style OUT6 fill:#F3F2F1,stroke:#8A8886,color:#201F1E

Only name and network_manager_id are force-new. The member type updates in place.

• 🔴 There is NO members argument. The group is created empty and populated by static member records or by an Azure Policy rule, neither of which is part of this resource.
• 🔴 An empty group makes every rule targeting it reach nothing — no error, no warning, nothing in any plan to distinguish it from a working configuration.
• 🔴 The delete is FORCED and cannot be disabled. The provider hard-codes the service's force flag. Microsoft defines it as "Deletes the resource even if it is part of a deployed configuration. If the configuration has been deployed, the service will do a cleanup deployment in the background, prior to the delete." The Azure CLI defaults the same flag to false.
• 🟠 member_type = "Subnet" requires Routing among the manager's scope_accesses — documented by the provider, invisible from the manager's Resource ID, therefore not checkable here.
• 🟠 member_type is validated against a GENERATED list, not the documented pair, so the list may hold members the documentation does not name.
• 🟠 member_type defaults to VirtualNetwork, so null in configuration is never the value in force.
• 🟡 description carries NO provider validator at all — an empty string is accepted. Both siblings (the verifier workspace and the scope connection) do check this same argument for non-emptiness; this resource does not, so read the rule per resource. On create an empty value is omitted from the payload; on update it is sent as an explicit null, which clears a description set earlier.
• ✅ A real ARM record, not a composite. Zero locks; several groups write concurrently and safely.
• ✅ An import guard exists, and all four timeouts — there is a real update function.

🔒 The delete permission removes enforcement from live networks without deleting a rule. Because the provider sets the force flag, holding delete here means being able to destroy a group while a deployed configuration is targeting it. Azure performs a background cleanup deployment; the member networks fall back to their own network security groups. No rule changed, and nothing errored.

⚠️ Membership is a separate permission surface, and it is where the blast radius actually lives. Whoever can add a virtual network to this group — by writing a static member, or by writing the Azure Policy rule that populates it — decides which networks every rule targeting this group reaches. None of the permissions above covers that.

• The Microsoft.Network resource provider registered in the target subscription.
• A network manager, and the intended member virtual networks within its scope.
• 🔴 For member_type = "Subnet": Routing among the manager's scope_accesses.
• A means of populating the group — static member records, or an Azure Policy rule. Without one the group is real and empty.
• 🔴 A deployment of a configuration targeting this group, or nothing reaches its members.

terraform-azurerm-network-manager-network-group/
├── providers.tf    # required_version >= 1.12.0, azurerm ~> 4.0, no provider block
├── variables.tf    # 5 inputs, 5 validations -- the parent, the member type, the description
├── main.tf         # one keystone `this`; ID parsing from the END; the effective member type
├── outputs.tf      # 34 outputs -- id first, then the absent membership, then the destroy
├── README.md       # this file
├── SCOPE.md        # the cross-module contract
├── LICENSE         # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "production_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-network-group.git?ref=v1.0.0"

  name               = "ng-production"
  network_manager_id = module.network_manager.id

  description = "Production virtual networks, populated by an Azure Policy rule"
}

⚠️ This creates an empty group. Write the description as shown — saying how it is populated is the only record of that fact anywhere on the object.

module "production_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-network-group.git?ref=v1.0.0"

  name               = "ng-production"
  network_manager_id = var.network_manager_id
}

output "what_this_actually_made" {
  value = {
    exists     = module.production_group.id
    membership = module.production_group.this_resource_creates_the_group_but_not_its_membership
    reaches    = module.production_group.an_empty_group_makes_every_rule_targeting_it_reach_nothing
    countable  = module.production_group.the_module_cannot_report_how_many_members_the_group_has
  }
}

module "production_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-network-group.git?ref=v1.0.0"

  name               = "ng-production"
  network_manager_id = var.network_manager_id

  description = "Production virtual networks, enumerated explicitly as static members"
}

# Static members are their own resource, not an argument here.
resource "azurerm_network_manager_static_member" "production" {
  for_each = toset(var.production_virtual_network_ids)

  name                = "member-${substr(sha1(each.value), 0, 8)}"
  network_group_id    = module.production_group.id
  target_virtual_network_id = each.value
}

output "does_this_move_on_its_own" {
  value = module.production_group.membership_can_change_with_no_terraform_run_at_all
}

output "member_type" {
  value = {
    # Read THIS -- the provider defaults an omitted value to "VirtualNetwork".
    effective = module.production_group.effective_member_type
    chosen    = module.production_group.member_type_was_set_explicitly
  }
}

module "subnet_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-network-group.git?ref=v1.0.0"

  name               = "ng-routed-subnets"
  network_manager_id = var.network_manager_id

  member_type = "Subnet"
}

check "manager_supports_a_subnet_group" {
  assert {
    condition     = !module.subnet_group.requires_routing_scope_access_on_the_manager
    error_message = "A Subnet group needs Routing among the manager's scope_accesses; confirm before applying."
  }
}

# REFUSED at `terraform plan`, offline and without credentials -- certainly a mistake.
member_type = "virtualnetwork"
member_type = "subnet"
member_type = "VIRTUALNETWORK"

# ALLOWED THROUGH -- the provider judges it, not this module.
member_type = "ManagementGroup"

output "before_you_destroy_this" {
  value = {
    mechanism   = module.production_group.destroy_force_deletes_even_when_a_deployed_configuration_targets_this_group
    consequence = module.production_group.destroy_removes_the_reach_of_every_rule_that_targeted_this_group
    procedure   = module.production_group.destroy_bypasses_the_documented_teardown_order
  }
}

module "production_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-network-group.git?ref=v1.0.0"

  name               = "ng-production-v2" # was "ng-production" -- FORCE-NEW
  network_manager_id = var.network_manager_id
}

locals {
  groups = {
    production = "Production virtual networks, populated by an Azure Policy rule"
    sandbox    = "Sandbox virtual networks, static membership"
  }
}

module "network_groups" {
  for_each = local.groups

  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-network-group.git?ref=v1.0.0"

  name               = "ng-${each.key}"
  network_manager_id = var.network_manager_id

  description = each.value
}

# WRONG -- the group's own ID where the MANAGER belongs.
network_manager_id = var.network_group_id

# WRONG -- a security admin configuration, or a rule collection.
network_manager_id = var.security_admin_configuration_id

# WRONG -- a Resource ID pasted where a name belongs.
name = "/subscriptions/.../networkGroups/ng-production"

# WRONG -- an empty description is not the same as none.
description = ""

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-network-eastus"
  location = "eastus"

  tags = {
    environment = "production"
    workload    = "network-governance"
  }
}

module "network_manager" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager.git?ref=v1.0.0"

  name                = "nm-corp"
  resource_group_name = module.rg.name
  location            = module.rg.location

  scope = {
    subscription_ids = [var.managed_subscription_id]
  }

  scope_accesses = ["SecurityAdmin"]

  tags = module.rg.tags
}

module "production_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-network-group.git?ref=v1.0.0"

  name               = "ng-production"
  network_manager_id = module.network_manager.id

  description = "Production virtual networks, populated by an Azure Policy rule"
}

module "security_admin_config" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-security-admin-configuration.git?ref=v1.0.0"

  name               = "sac-baseline"
  network_manager_id = module.network_manager.id

  apply_on_network_intent_policy_based_services = ["AllowRulesOnly"]

  description = "Baseline security admin rules across production"
}

module "high_risk_ports" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule-collection.git?ref=v1.0.0"

  name                            = "rc-high-risk-ports"
  security_admin_configuration_id = module.security_admin_config.id
  network_group_ids               = [module.production_group.id]

  description = "Baseline restrictions on high-risk inbound ports"
}

module "deny_rdp" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-network-manager-admin-rule.git?ref=v1.0.0"

  name                     = "deny-rdp-inbound"
  admin_rule_collection_id = module.high_risk_ports.id

  action    = "Deny"
  direction = "Inbound"
  priority  = 100
  protocol  = "Tcp"

  destination_port_ranges = ["3389"]

  sources = [
    { address_prefix = "Internet", address_prefix_type = "ServiceTag" },
  ]

  description = "Block inbound RDP from the internet across production"
}

output "governance" {
  value = {
    group_id          = module.production_group.id
    member_type       = module.production_group.effective_member_type
    membership_absent = module.production_group.this_resource_creates_the_group_but_not_its_membership
    reaches_nothing   = module.production_group.an_empty_group_makes_every_rule_targeting_it_reach_nothing
    moves_on_its_own  = module.production_group.membership_can_change_with_no_terraform_run_at_all
    groups_valid      = module.high_risk_ports.all_groups_share_the_configurations_network_manager
    deny_gap          = module.security_admin_config.deny_rules_are_skipped_on_intent_policy_networks
    rule_outranks_nsg = module.deny_rdp.terminates_evaluation_before_network_security_groups
    needs_deployment  = module.security_admin_config.this_configuration_is_inert_until_deployed
  }
}

Required: name, network_manager_id Optional: member_type, description, timeouts

There is no tags variable — the resource exposes none. Tag the network manager. There is no members argument — the resource does not have one.

variable "name" {
  type = string
  # REQUIRED, FORCE-NEW. Non-empty is the provider's only check. This module
  # also refuses a value beginning with "/" -- always an ID pasted for a name.
}

variable "network_manager_id" {
  type = string
  # REQUIRED, FORCE-NEW. Anchored to .../networkManagers/<manager> at BOTH ends.
  # A group can only be targeted by configurations on THE SAME MANAGER.
}

variable "member_type" {
  type    = string
  default = null
  # The provider defaults an omitted value to "VirtualNetwork".
  # "Subnet" is ONLY VALID if the manager has Routing among its scope_accesses
  # -- documented by the provider, invisible from the manager's ID, REPORTED.
  #
  # The validation REJECTS THE NEAR MISS and ALLOWS THE UNKNOWN, because the
  # provider validates against a GENERATED list holding exactly these two today, and a
  # the documentation names.
}

variable "description" {
  type    = string
  default = null
  # Optional, and unvalidated: an empty string is accepted here (unlike
  # omission. The most useful field on this resource: a group shows neither its
  # members nor what targets it, so say HOW IT IS POPULATED here.
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
  # All four exist. THE DELETE TIMEOUT MATTERS: the forced delete triggers a
  # background cleanup deployment, and 30m is the provider's default for it.
}

The resource creates the group and not its membership, and that is the fact everything else follows from. There is no members argument in the schema. A group is populated by static member records or dynamically by an Azure Policy rule, both of which live outside this resource — so an apply that succeeds proves the group exists and proves nothing about what is in it.

The failure that produces is silent. A rule collection targeting an empty group applies a complete and correct set of security admin rules to precisely nothing: no error, no warning, and nothing in any plan to distinguish it from a working configuration. That is why the absence is emitted as four separate constants rather than one — that the resource does not carry membership, that an empty group reaches nothing, that membership can move without Terraform, and that no count can be derived are four distinct facts, and the second is the one that produces a security gap.

No membership count is emitted, deliberately. A figure would have to be invented, and an invented blast radius is exactly the number a reviewer would trust. The reason is attached to the output rather than left implicit.

The member type has an invisible default. The provider defaults an omitted value to VirtualNetwork, so effective_member_type is what a reader needs. And Subnet is not simply an alternative: the provider documents that it requires Routing among the manager's scope_accesses, which is not present in the manager's Resource ID and therefore cannot be checked here. It is reported, because refusing on half the operands would reject legal input.

The member type validation rejects the near miss and allows the unknown, because the provider validates against a generated list which currently equals the documented pair. virtualnetwork is certainly a mistake; ManagementGroup might be a value the documentation has not caught up with. Refusing it would risk making a legitimately-created group undestroyable through the module, since a validation {} failure blocks terraform destroy as well as apply.

The destroy is forced, and the consequence is not the mechanism. The provider hard-codes the service's force flag with no argument to disable it, and the Azure CLI defaults the same flag to false. Destroying this group deletes no rule at all — and yet every rule that reached its members stops reaching them. Microsoft's teardown checklist prescribes removing the associated configurations, rules and policy resources first; the forced delete performs a background cleanup deployment instead.

A rename does not carry the members. Both force-new fields produce a new Resource ID, so every rule collection referencing the old one must be updated, and a statically-populated group is empty until those records are recreated. lifecycle is not valid inside a module block, so a caller cannot add prevent_destroy; a CanNotDelete lock prevents deletion but not replacement.

🔒 There is no secure-by-default choice to make on this resource: it has no security-relevant setting. The risk here is entirely in what the group contains and what targets it, and this module can see neither — so it says so, loudly, rather than letting a clean apply read as coverage.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module by tag — ?ref=v1.0.0 — never a branch.

Plan-only: this repository performs no cloud apply. A human applies from CI — and for this resource, after confirming how the group will be populated.

What terraform validate covers, offline and without credentials:

• A non-empty name that is not a Resource ID.
• The anchored network_manager_id check, at both ends.
• The member_type casing near-miss — while allowing an unrecognised value through.
• The description non-empty rule, mirroring the provider.

What only terraform plan exercises (credentials required):

• That the manager exists, and the import guard if a group of this name is already on it.

What only terraform apply reveals:

• Whether the manager has Routing among its scope accesses, for a Subnet group.
• Whether an unrecognised member_type is in fact legal.

What nothing reveals at all:

• What the group contains, or how many members it has.
• Which configurations target it.
• Whether any of them is deployed.

ℹ️ terraform console fires root-module variable validations, unlike terraform validate on a calling configuration. It is the honest offline harness for the first list and for every derived flag — including both branches of holds_virtual_networks, holds_subnets, the Routing report and the explicit-versus-default distinction, plus a positive fixture proving an unknown member_type is accepted rather than refused.

Outputs:

id                            = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-network-eastus/providers/Microsoft.Network/networkManagers/nm-corp/networkGroups/ng-production"
name                          = "ng-production"
network_manager_name          = "nm-corp"
effective_member_type         = "VirtualNetwork"
member_type_was_set_explicitly = false
holds_virtual_networks        = true
requires_routing_scope_access_on_the_manager = false
this_resource_creates_the_group_but_not_its_membership = true
an_empty_group_makes_every_rule_targeting_it_reach_nothing = true
membership_can_change_with_no_terraform_run_at_all = true
destroy_removes_the_reach_of_every_rule_that_targeted_this_group = true
fields_azure_returns_on_read = [
  "name",
  "member_type",
  "description",
]

ℹ️ fields_azure_returns_on_read is worth reading for what is missing. Membership is not in the list, because membership is not on this resource — so drift in what the group contains is not detectable here at all, while drift in its member type or description is.

• azurerm_network_manager_network_group — provider reference
• Network groups in Azure Virtual Network Manager — static versus dynamic membership
• Security admin rules — what reaching a group's members actually means
• Remove and update components checklist — the teardown order the forced delete bypasses
• Sibling modules: terraform-azurerm-network-manager, terraform-azurerm-network-manager-security-admin-configuration, terraform-azurerm-network-manager-admin-rule-collection, terraform-azurerm-network-manager-admin-rule, terraform-azurerm-resource-group
• This module's SCOPE.md — the cross-module contract

💙 "Infrastructure as Code should be standardized, consistent, and secure."