Answers: <p>Found the answer, this has changed at some point.</p>
  <p>What's needed is a network_security_group_association which relates to a subnet_id and a network_security_group_id (the one that was in the network_security_group before)</p>
  <pre><code>resource &quot;azurerm_subnet&quot; &quot;subnet-internal-1&quot; {
    name                 = &quot;${var.prefix}-internal-1&quot;
    resource_group_name  = azurerm_resource_group.geofriends.name
    virtual_network_name = azurerm_virtual_network.vn.name
    address_prefixes     = [&quot;10.0.0.0/24&quot;]
  }
  
  resource &quot;azurerm_network_security_group&quot; &quot;allow-ssh&quot; {
     name                    = &quot;${var.prefix}-allow-ssh&quot;
     location                = var.location
     resource_group_name     = azurerm_resource_group.geofriends.name
  
     security_rule {
         name                    = &quot;SSH&quot;
         priority                = 1001
         direction               = &quot;Inbound&quot;
         access                  = &quot;Allow&quot;
         protocol                = &quot;Tcp&quot;
         source_port_range       = var.ssh-source-address
         destination_port_range       = var.ssh-destination-address
         source_address_prefix        = var.ssh-source-address
         destination_address_prefix   = var.ssh-destination-address
     }
  } 
  
  resource &quot;azurerm_subnet_network_security_group_association&quot; &quot;sec-group-association&quot; {
    subnet_id                 = azurerm_subnet.subnet-internal-1.id
    network_security_group_id = azurerm_network_security_group.allow-ssh.id
  }
  </code></pre>
  <p>Now the subnet subnet-internal-1 contains the allow ssh security_group</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-11-30T13:14:10.273Z
Answers: 2021-11-30T13:14:10.273Z
Answers: Serve Laurijssen
Body: <p>I'm following a lecture on terraform for azure. They add a property network_security_group_id to an azurerm_network_interface</p>
  <pre><code>resource &quot;azurerm_network_interface&quot; &quot;demo-instance&quot; {
      name                        = &quot;${var.prefix}-instance1&quot;
      location                    = var.location
      resource_group_name         = azurerm_resource_group.demo.name
      network_security_group_id   = azurerm_network_security_group.allow-ssh.id
  
      ip_configuration {
        .....
      }
  }
  </code></pre>
  <p>But 'terraform plan' spits out</p>
  <blockquote>
  <p>Error: Unsupported argument │ │   on instance.tf line 43, in resource
  &quot;azurerm_network_interface&quot; &quot;demo-instance&quot;: │   43:<br />
  network_security_group_id   =
  azurerm_network_security_group.allow-ssh.id │ │ An argument named
  &quot;network_security_group_id&quot; is not expected here.</p>
  </blockquote>
  <p>I'm guessing that this has moved somewhere else in some version, but I can't find the setting in the docs anywhere.</p>
  <p>Where does network_security_group_id belong?</p>
  <pre><code>resource &quot;azurerm_network_security_group&quot; &quot;allow-ssh&quot; {
      name                    = &quot;${var.prefix}-allow-ssh&quot;
      location                = var.location
      resource_group_name     = azurerm_resource_group.demo.name
  
      security_rule {
          name                    = &quot;SSH&quot;
          priority                = 1001
          direction               = &quot;Inbound&quot;
          access                  = &quot;Allow&quot;
          protocol                = &quot;Tcp&quot;
          source_port_range       = &quot;*&quot;
          destination_port_range  = var.ssh-source-address
          destination_address_prefix  = &quot;*&quot;
      }
  }
  </code></pre>
  <p>Just removing these resources and settings and it works anyway. The resources get created and I'm able to login with a key. So is this not needed anymore at all?</p>
  
Tags: <terraform><azure-devops><azure>
Title: network_security_group_id not expected in azurerm_network_interface
UserDisplayName: Serve Laurijssen
ThreadText: # network_security_group_id not expected in azurerm_network_interface
  
  (Asked by: username_0 on 2021-11-26)
  
  I'm following a lecture on terraform for azure. They add a property network\_security\_group\_id to an azurerm\_network\_interface
  
  ```
  resource "azurerm_network_interface" "demo-instance" {
      name                        = "${var.prefix}-instance1"
      location                    = var.location
      resource_group_name         = azurerm_resource_group.demo.name
      network_security_group_id   = azurerm_network_security_group.allow-ssh.id
  
      ip_configuration {
        .....
      }
  }
  
  ```
  
  But 'terraform plan' spits out
  
  > Error: Unsupported argument │ │ on instance.tf line 43, in resource
  > "azurerm\_network\_interface" "demo-instance": │ 43:  
  > network\_security\_group\_id =
  > azurerm\_network\_security\_group.allow-ssh.id │ │ An argument named
  > "network\_security\_group\_id" is not expected here.
  
  I'm guessing that this has moved somewhere else in some version, but I can't find the setting in the docs anywhere.
  
  Where does network\_security\_group\_id belong?
  
  ```
  resource "azurerm_network_security_group" "allow-ssh" {
      name                    = "${var.prefix}-allow-ssh"
      location                = var.location
      resource_group_name     = azurerm_resource_group.demo.name
  
      security_rule {
          name                    = "SSH"
          priority                = 1001
          direction               = "Inbound"
          access                  = "Allow"
          protocol                = "Tcp"
          source_port_range       = "*"
          destination_port_range  = var.ssh-source-address
          destination_address_prefix  = "*"
      }
  }
  
  ```
  
  Just removing these resources and settings and it works anyway. The resources get created and I'm able to login with a key. So is this not needed anymore at all?
  
  **Tags:** terraform, azure-devops, azure
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-11-30. Score: 0 | Accepted answer
  
  Found the answer, this has changed at some point.
  
  What's needed is a network\_security\_group\_association which relates to a subnet\_id and a network\_security\_group\_id (the one that was in the network\_security\_group before)
  
  ```
  resource "azurerm_subnet" "subnet-internal-1" {
    name                 = "${var.prefix}-internal-1"
    resource_group_name  = azurerm_resource_group.geofriends.name
    virtual_network_name = azurerm_virtual_network.vn.name
    address_prefixes     = ["10.0.0.0/24"]
  }
  
  resource "azurerm_network_security_group" "allow-ssh" {
     name                    = "${var.prefix}-allow-ssh"
     location                = var.location
     resource_group_name     = azurerm_resource_group.geofriends.name
  
     security_rule {
         name                    = "SSH"
         priority                = 1001
         direction               = "Inbound"
         access                  = "Allow"
         protocol                = "Tcp"
         source_port_range       = var.ssh-source-address
         destination_port_range       = var.ssh-destination-address
         source_address_prefix        = var.ssh-source-address
         destination_address_prefix   = var.ssh-destination-address
     }
  } 
  
  resource "azurerm_subnet_network_security_group_association" "sec-group-association" {
    subnet_id                 = azurerm_subnet.subnet-internal-1.id
    network_security_group_id = azurerm_network_security_group.allow-ssh.id
  }
  
  ```
  
  Now the subnet subnet-internal-1 contains the allow ssh security\_group
  
  
  ---
  
  