add NSG flow logs and remove network watcher module (#93)

src/core/saca-hub/main.tf

@@ -66,15 +66,3 @@ module "saca-firewall" {
     DeploymentName = var.deploymentname
   }
 }
-
-module "saca-networkwatcher" {
-  count  = var.create_network_watcher == true ? 1 : 0
-  source = "../../modules/networkwatcher"
-
-  name_prefix = module.saca-hub-network.resource_group_name
-  location    = module.saca-hub-network.resource_group_location
-
-  tags = {
-    DeploymentName = var.deploymentname
-  }
-}

src/core/saca-hub/saca-hub.tfvars.sample

@@ -24,6 +24,4 @@ tier2_vnetname     = "{TIER2_VNETNAME}"
 firewall_address_space = "{SACA_FWSPACE}"
 saca_fwname          = "{SACA_FWNAME}"
 firewall_ipconfig_name = "{SACA_FWIPCONFIGNAME}"
-public_ip_name         = "{SACA_FWPIPNAME}"
-
-create_network_watcher = false
+public_ip_name         = "{SACA_FWPIPNAME}"

src/core/tier-0/main.tf

@@ -117,15 +117,3 @@ module "t0-outbound-peering" {
     DeploymentName = var.deploymentname
   }
 }
-
-module "t0-networkwatcher" {
-  count  = var.create_network_watcher == true ? 1 : 0
-  source = "../../modules/networkwatcher"
-
-  name_prefix = module.t0-network.resource_group_name
-  location    = module.t0-network.resource_group_location
-
-  tags = {
-    DeploymentName = var.deploymentname
-  }
-}

src/core/tier-0/tier-0.tfvars.sample

@@ -57,6 +57,4 @@ subnets = {
 
     routetable_name = "{TIER0_SUBNETVM_RTNAME}"
   }
-}
-
-create_network_watcher = false
+}

src/core/tier-1/main.tf

@@ -117,15 +117,3 @@ module "t1-outbound-peering" {
     DeploymentName = var.deploymentname
   }
 }
-
-module "t1-networkwatcher" {
-  count  = var.create_network_watcher == true ? 1 : 0
-  source = "../../modules/networkwatcher"
-
-  name_prefix = module.t1-network.resource_group_name
-  location    = module.t1-network.resource_group_location
-
-  tags = {
-    DeploymentName = var.deploymentname
-  }
-}

src/core/tier-1/tier-1.tfvars.sample

@@ -57,6 +57,4 @@ subnets = {
 
     routetable_name = "{TIER1_SUBNETVM_RTNAME}"
   }
-}
-
-create_network_watcher = false
+}

src/core/tier-2/main.tf

@@ -117,15 +117,3 @@ module "t2-outbound-peering" {
     DeploymentName = var.deploymentname
   }
 }
-
-module "t2-networkwatcher" {
-  count  = var.create_network_watcher == true ? 1 : 0
-  source = "../../modules/networkwatcher"
-
-  name_prefix = module.t2-network.resource_group_name
-  location    = module.t2-network.resource_group_location
-
-  tags = {
-    DeploymentName = var.deploymentname
-  }
-}

src/core/tier-2/tier-2.tfvars.sample

@@ -57,6 +57,4 @@ subnets = {
 
     routetable_name = "{TIER2_SUBNETVM_RTNAME}"
   }
-}
-
-create_network_watcher = false
+}

src/modules/subnet/main.tf

@@ -1,5 +1,6 @@
 # Copyright (c) Microsoft Corporation.
 # Licensed under the MIT License.
+
 resource "azurerm_subnet" "subnet" {
   name                 = var.name
   resource_group_name  = var.resource_group_name
@@ -84,3 +85,17 @@ resource "azurerm_monitor_diagnostic_setting" "nsg" {
     }
   }
 }
+
+resource "azurerm_network_watcher_flow_log" "nsgfl" {
+  network_watcher_name = "NetworkWatcher_${var.location}"
+  resource_group_name  = "NetworkWatcherRG"
+
+  network_security_group_id = azurerm_network_security_group.nsg.id
+  storage_account_id        = var.log_analytics_storage_id
+  enabled                   = true
+
+  retention_policy {
+    enabled = true
+    days    = var.flow_log_retention_in_days
+  }
+}

src/modules/subnet/variables.tf

@@ -70,3 +70,8 @@ variable "log_analytics_storage_id" {
 variable "log_analytics_workspace_id" {
   description = "The id of the log analytics workspace"
 }
+
+variable "flow_log_retention_in_days" {
+  description = "The number of days to retain flow log data"
+  default     = "7"
+}