From b71115c2d46c3e01241a62e0d0ebb40632b546bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Gr=C3=A4f?= <sebastian@graef.io>
Date: Thu, 11 Apr 2024 18:47:04 +1000
Subject: [PATCH] feat: module `avm/res/network/network-watcher` (#1478)

## Description

Closes https://github.com/Azure/Azure-Verified-Modules/issues/581

## Pipeline Reference

<!-- Insert your Pipeline Status Badge below -->

| Pipeline |
| -------- |
|
[![avm.res.network.network-watcher](https://github.com/segraef/bicep-registry-modules/actions/workflows/avm.res.network.network-watcher.yml/badge.svg?branch=nw)](https://github.com/segraef/bicep-registry-modules/actions/workflows/avm.res.network.network-watcher.yml)
|

## Type of Change

<!-- Use the check-boxes [x] on the options that are relevant. -->

- [ ] Update to CI Environment or utlities (Non-module effecting
changes)
- [x] Azure Verified Module updates:
- [ ] Bugfix containing backwards compatible bug fixes, and I have NOT
bumped the MAJOR or MINOR version in `version.json`:
- [ ] Someone has opened a bug report issue, and I have included "Closes
#{bug_report_issue_number}" in the PR description.
- [ ] The bug was found by the module author, and no one has opened an
issue to report it yet.
- [ ] Feature update backwards compatible feature updates, and I have
bumped the MINOR version in `version.json`.
- [ ] Breaking changes and I have bumped the MAJOR version in
`version.json`.
  - [x] Update to documentation

## Checklist

- [x] I'm sure there are no other open Pull Requests for the same
update/change
- [x] I have run `Set-AVMModule` locally to generate the supporting
module files.
- [x] My corresponding pipelines / checks run clean and green without
any errors or warnings

<!-- Please keep up to day with the contribution guide at
https://aka.ms/avm/contribute/bicep -->

---------

Co-authored-by: Alexander Sehr <ASehr@hotmail.de>
Co-authored-by: ChrisSidebotham-MSFT <48600046+ChrisSidebotham@users.noreply.github.com>
Co-authored-by: Erika Gressi <56914614+eriqua@users.noreply.github.com>
---
 .github/CODEOWNERS                            |   2 +-
 .github/ISSUE_TEMPLATE/avm_module_issue.yml   |   2 +-
 .../avm.res.network.network-watcher.yml       |  87 +++
 avm/res/network/network-watcher/README.md     | 712 ++++++++++++++++++
 .../connection-monitor/README.md              | 117 +++
 .../connection-monitor/main.bicep             |  66 ++
 .../connection-monitor/main.json              | 126 ++++
 .../network-watcher/flow-log/README.md        | 158 ++++
 .../network-watcher/flow-log/main.bicep       |  97 +++
 .../network-watcher/flow-log/main.json        | 167 ++++
 avm/res/network/network-watcher/main.bicep    | 188 +++++
 avm/res/network/network-watcher/main.json     | 633 ++++++++++++++++
 .../tests/e2e/defaults/main.test.bicep        |  51 ++
 .../tests/e2e/max/dependencies.bicep          | 144 ++++
 .../tests/e2e/max/main.test.bicep             | 172 +++++
 .../tests/e2e/waf-aligned/dependencies.bicep  | 144 ++++
 .../tests/e2e/waf-aligned/main.test.bicep     | 156 ++++
 avm/res/network/network-watcher/version.json  |   7 +
 18 files changed, 3027 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/avm.res.network.network-watcher.yml
 create mode 100644 avm/res/network/network-watcher/README.md
 create mode 100644 avm/res/network/network-watcher/connection-monitor/README.md
 create mode 100644 avm/res/network/network-watcher/connection-monitor/main.bicep
 create mode 100644 avm/res/network/network-watcher/connection-monitor/main.json
 create mode 100644 avm/res/network/network-watcher/flow-log/README.md
 create mode 100644 avm/res/network/network-watcher/flow-log/main.bicep
 create mode 100644 avm/res/network/network-watcher/flow-log/main.json
 create mode 100644 avm/res/network/network-watcher/main.bicep
 create mode 100644 avm/res/network/network-watcher/main.json
 create mode 100644 avm/res/network/network-watcher/tests/e2e/defaults/main.test.bicep
 create mode 100644 avm/res/network/network-watcher/tests/e2e/max/dependencies.bicep
 create mode 100644 avm/res/network/network-watcher/tests/e2e/max/main.test.bicep
 create mode 100644 avm/res/network/network-watcher/tests/e2e/waf-aligned/dependencies.bicep
 create mode 100644 avm/res/network/network-watcher/tests/e2e/waf-aligned/main.test.bicep
 create mode 100644 avm/res/network/network-watcher/version.json

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index aeceb727dd..dd7d4654fc 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -98,7 +98,7 @@
 /avm/res/network/network-interface/ @Azure/avm-res-network-networkinterface-module-owners-bicep @Azure/avm-core-team-technical-bicep
 /avm/res/network/network-manager/ @Azure/avm-res-network-networkmanager-module-owners-bicep @Azure/avm-core-team-technical-bicep
 /avm/res/network/network-security-group/ @Azure/avm-res-network-networksecuritygroup-module-owners-bicep @Azure/avm-core-team-technical-bicep
-#/avm/res/network/network-watcher/ @Azure/avm-res-network-networkwatcher-module-owners-bicep @Azure/avm-core-team-technical-bicep
+/avm/res/network/network-watcher/ @Azure/avm-res-network-networkwatcher-module-owners-bicep @Azure/avm-core-team-technical-bicep
 /avm/res/network/private-dns-zone/ @Azure/avm-res-network-privatednszone-module-owners-bicep @Azure/avm-core-team-technical-bicep
 /avm/res/network/private-endpoint/ @Azure/avm-res-network-privateendpoint-module-owners-bicep @Azure/avm-core-team-technical-bicep
 /avm/res/network/private-link-service/ @Azure/avm-res-network-privatelinkservice-module-owners-bicep @Azure/avm-core-team-technical-bicep
diff --git a/.github/ISSUE_TEMPLATE/avm_module_issue.yml b/.github/ISSUE_TEMPLATE/avm_module_issue.yml
index a1f30bffbc..9fea2a0a2e 100644
--- a/.github/ISSUE_TEMPLATE/avm_module_issue.yml
+++ b/.github/ISSUE_TEMPLATE/avm_module_issue.yml
@@ -131,7 +131,7 @@ body:
         - "avm/res/network/network-interface"
         - "avm/res/network/network-manager"
         - "avm/res/network/network-security-group"
-        # - "avm/res/network/network-watcher"
+        - "avm/res/network/network-watcher"
         - "avm/res/network/private-dns-zone"
         - "avm/res/network/private-endpoint"
         - "avm/res/network/private-link-service"
diff --git a/.github/workflows/avm.res.network.network-watcher.yml b/.github/workflows/avm.res.network.network-watcher.yml
new file mode 100644
index 0000000000..823b4baf3e
--- /dev/null
+++ b/.github/workflows/avm.res.network.network-watcher.yml
@@ -0,0 +1,87 @@
+name: "avm.res.network.network-watcher"
+
+on:
+  schedule:
+    - cron: "0 12 1/15 * *" # Bi-Weekly Test (on 1st & 15th of month)
+  workflow_dispatch:
+    inputs:
+      staticValidation:
+        type: boolean
+        description: "Execute static validation"
+        required: false
+        default: true
+      deploymentValidation:
+        type: boolean
+        description: "Execute deployment validation"
+        required: false
+        default: true
+      removeDeployment:
+        type: boolean
+        description: "Remove deployed module"
+        required: false
+        default: true
+
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/actions/templates/avm-**"
+      - ".github/workflows/avm.template.module.yml"
+      - ".github/workflows/avm.res.network.network-watcher.yml"
+      - "avm/res/network/network-watcher/**"
+      - "avm/utilities/pipelines/**"
+      - "!avm/utilities/pipelines/platform/**"
+      - "!*/**/README.md"
+
+env:
+  modulePath: "avm/res/network/network-watcher"
+  workflowPath: ".github/workflows/avm.res.network.network-watcher.yml"
+
+concurrency:
+  group: ${{ github.workflow }}
+
+jobs:
+  ###########################
+  #   Initialize pipeline   #
+  ###########################
+  job_initialize_pipeline:
+    runs-on: ubuntu-latest
+    name: "Initialize pipeline"
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: "Set input parameters to output variables"
+        id: get-workflow-param
+        uses: ./.github/actions/templates/avm-getWorkflowInput
+        with:
+          workflowPath: "${{ env.workflowPath}}"
+      - name: "Get module test file paths"
+        id: get-module-test-file-paths
+        uses: ./.github/actions/templates/avm-getModuleTestFiles
+        with:
+          modulePath: "${{ env.modulePath }}"
+    outputs:
+      workflowInput: ${{ steps.get-workflow-param.outputs.workflowInput }}
+      moduleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.moduleTestFilePaths }}
+      psRuleModuleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.psRuleModuleTestFilePaths }}
+      modulePath: "${{ env.modulePath }}"
+
+  ##############################
+  #   Call reusable workflow   #
+  ##############################
+  call-workflow-passing-data:
+    name: "Run"
+    permissions:
+      id-token: write # For OIDC
+      contents: write # For release tags
+    needs:
+      - job_initialize_pipeline
+    uses: ./.github/workflows/avm.template.module.yml
+    with:
+      workflowInput: "${{ needs.job_initialize_pipeline.outputs.workflowInput }}"
+      moduleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.moduleTestFilePaths }}"
+      psRuleModuleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.psRuleModuleTestFilePaths }}"
+      modulePath: "${{ needs.job_initialize_pipeline.outputs.modulePath}}"
+    secrets: inherit
diff --git a/avm/res/network/network-watcher/README.md b/avm/res/network/network-watcher/README.md
new file mode 100644
index 0000000000..b415feec56
--- /dev/null
+++ b/avm/res/network/network-watcher/README.md
@@ -0,0 +1,712 @@
+# Network Watchers `[Microsoft.Network/networkWatchers]`
+
+This module deploys a Network Watcher.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Usage examples](#Usage-examples)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+- [Cross-referenced modules](#Cross-referenced-modules)
+- [Data Collection](#Data-Collection)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Authorization/locks` | [2020-05-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2020-05-01/locks) |
+| `Microsoft.Authorization/roleAssignments` | [2022-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Authorization/2022-04-01/roleAssignments) |
+| `Microsoft.Network/networkWatchers` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkWatchers) |
+| `Microsoft.Network/networkWatchers/connectionMonitors` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkWatchers/connectionMonitors) |
+| `Microsoft.Network/networkWatchers/flowLogs` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkWatchers/flowLogs) |
+
+## Usage examples
+
+The following section provides usage examples for the module, which were used to validate and deploy the module successfully. For a full reference, please review the module's test folder in its repository.
+
+>**Note**: Each example lists all the required parameters first, followed by the rest - each in alphabetical order.
+
+>**Note**: To reference the module, please use the following syntax `br/public:avm/res/network/network-watcher:<version>`.
+
+- [Using only defaults](#example-1-using-only-defaults)
+- [Using large parameter set](#example-2-using-large-parameter-set)
+- [WAF-aligned](#example-3-waf-aligned)
+
+### Example 1: _Using only defaults_
+
+This instance deploys the module with the minimum set of required parameters.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module networkWatcher 'br/public:avm/res/network/network-watcher:<version>' = {
+  name: 'networkWatcherDeployment'
+  params: {
+    location: '<location>'
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "location": {
+      "value": "<location>"
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 2: _Using large parameter set_
+
+This instance deploys the module with most of its features enabled.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module networkWatcher 'br/public:avm/res/network/network-watcher:<version>' = {
+  name: 'networkWatcherDeployment'
+  params: {
+    connectionMonitors: [
+      {
+        endpoints: [
+          {
+            name: '<name>'
+            resourceId: '<resourceId>'
+            type: 'AzureVM'
+          }
+          {
+            address: 'www.bing.com'
+            name: 'Bing'
+            type: 'ExternalAddress'
+          }
+        ]
+        name: 'nnwmax-cm-001'
+        testConfigurations: [
+          {
+            httpConfiguration: {
+              method: 'Get'
+              port: 80
+              preferHTTPS: false
+              requestHeaders: []
+              validStatusCodeRanges: [
+                '200'
+              ]
+            }
+            name: 'HTTP Bing Test'
+            protocol: 'Http'
+            successThreshold: {
+              checksFailedPercent: 5
+              roundTripTimeMs: 100
+            }
+            testFrequencySec: 30
+          }
+        ]
+        testGroups: [
+          {
+            destinations: [
+              'Bing'
+            ]
+            disable: false
+            name: 'test-http-Bing'
+            sources: [
+              'subnet-001(${resourceGroup.name})'
+            ]
+            testConfigurations: [
+              'HTTP Bing Test'
+            ]
+          }
+        ]
+        workspaceResourceId: '<workspaceResourceId>'
+      }
+    ]
+    flowLogs: [
+      {
+        enabled: false
+        storageId: '<storageId>'
+        targetResourceId: '<targetResourceId>'
+      }
+      {
+        formatVersion: 1
+        name: 'nnwmax-fl-001'
+        retentionInDays: 8
+        storageId: '<storageId>'
+        targetResourceId: '<targetResourceId>'
+        trafficAnalyticsInterval: 10
+        workspaceResourceId: '<workspaceResourceId>'
+      }
+    ]
+    location: '<location>'
+    name: '<name>'
+    roleAssignments: [
+      {
+        principalId: '<principalId>'
+        principalType: 'ServicePrincipal'
+        roleDefinitionIdOrName: 'Owner'
+      }
+      {
+        principalId: '<principalId>'
+        principalType: 'ServicePrincipal'
+        roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
+      }
+      {
+        principalId: '<principalId>'
+        principalType: 'ServicePrincipal'
+        roleDefinitionIdOrName: '<roleDefinitionIdOrName>'
+      }
+    ]
+    tags: {
+      Environment: 'Non-Prod'
+      'hidden-title': 'This is visible in the resource name'
+      Role: 'DeploymentValidation'
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "connectionMonitors": {
+      "value": [
+        {
+          "endpoints": [
+            {
+              "name": "<name>",
+              "resourceId": "<resourceId>",
+              "type": "AzureVM"
+            },
+            {
+              "address": "www.bing.com",
+              "name": "Bing",
+              "type": "ExternalAddress"
+            }
+          ],
+          "name": "nnwmax-cm-001",
+          "testConfigurations": [
+            {
+              "httpConfiguration": {
+                "method": "Get",
+                "port": 80,
+                "preferHTTPS": false,
+                "requestHeaders": [],
+                "validStatusCodeRanges": [
+                  "200"
+                ]
+              },
+              "name": "HTTP Bing Test",
+              "protocol": "Http",
+              "successThreshold": {
+                "checksFailedPercent": 5,
+                "roundTripTimeMs": 100
+              },
+              "testFrequencySec": 30
+            }
+          ],
+          "testGroups": [
+            {
+              "destinations": [
+                "Bing"
+              ],
+              "disable": false,
+              "name": "test-http-Bing",
+              "sources": [
+                "subnet-001(${resourceGroup.name})"
+              ],
+              "testConfigurations": [
+                "HTTP Bing Test"
+              ]
+            }
+          ],
+          "workspaceResourceId": "<workspaceResourceId>"
+        }
+      ]
+    },
+    "flowLogs": {
+      "value": [
+        {
+          "enabled": false,
+          "storageId": "<storageId>",
+          "targetResourceId": "<targetResourceId>"
+        },
+        {
+          "formatVersion": 1,
+          "name": "nnwmax-fl-001",
+          "retentionInDays": 8,
+          "storageId": "<storageId>",
+          "targetResourceId": "<targetResourceId>",
+          "trafficAnalyticsInterval": 10,
+          "workspaceResourceId": "<workspaceResourceId>"
+        }
+      ]
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "name": {
+      "value": "<name>"
+    },
+    "roleAssignments": {
+      "value": [
+        {
+          "principalId": "<principalId>",
+          "principalType": "ServicePrincipal",
+          "roleDefinitionIdOrName": "Owner"
+        },
+        {
+          "principalId": "<principalId>",
+          "principalType": "ServicePrincipal",
+          "roleDefinitionIdOrName": "b24988ac-6180-42a0-ab88-20f7382dd24c"
+        },
+        {
+          "principalId": "<principalId>",
+          "principalType": "ServicePrincipal",
+          "roleDefinitionIdOrName": "<roleDefinitionIdOrName>"
+        }
+      ]
+    },
+    "tags": {
+      "value": {
+        "Environment": "Non-Prod",
+        "hidden-title": "This is visible in the resource name",
+        "Role": "DeploymentValidation"
+      }
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+### Example 3: _WAF-aligned_
+
+This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.
+
+
+<details>
+
+<summary>via Bicep module</summary>
+
+```bicep
+module networkWatcher 'br/public:avm/res/network/network-watcher:<version>' = {
+  name: 'networkWatcherDeployment'
+  params: {
+    connectionMonitors: [
+      {
+        endpoints: [
+          {
+            name: '<name>'
+            resourceId: '<resourceId>'
+            type: 'AzureVM'
+          }
+          {
+            address: 'www.bing.com'
+            name: 'Bing'
+            type: 'ExternalAddress'
+          }
+        ]
+        name: 'nnwwaf-cm-001'
+        testConfigurations: [
+          {
+            httpConfiguration: {
+              method: 'Get'
+              port: 80
+              preferHTTPS: false
+              requestHeaders: []
+              validStatusCodeRanges: [
+                '200'
+              ]
+            }
+            name: 'HTTP Bing Test'
+            protocol: 'Http'
+            successThreshold: {
+              checksFailedPercent: 5
+              roundTripTimeMs: 100
+            }
+            testFrequencySec: 30
+          }
+        ]
+        testGroups: [
+          {
+            destinations: [
+              'Bing'
+            ]
+            disable: false
+            name: 'test-http-Bing'
+            sources: [
+              'subnet-001(${resourceGroup.name})'
+            ]
+            testConfigurations: [
+              'HTTP Bing Test'
+            ]
+          }
+        ]
+        workspaceResourceId: '<workspaceResourceId>'
+      }
+    ]
+    flowLogs: [
+      {
+        enabled: false
+        storageId: '<storageId>'
+        targetResourceId: '<targetResourceId>'
+      }
+      {
+        formatVersion: 1
+        name: 'nnwwaf-fl-001'
+        retentionInDays: 8
+        storageId: '<storageId>'
+        targetResourceId: '<targetResourceId>'
+        trafficAnalyticsInterval: 10
+        workspaceResourceId: '<workspaceResourceId>'
+      }
+    ]
+    location: '<location>'
+    name: '<name>'
+    tags: {
+      Environment: 'Non-Prod'
+      'hidden-title': 'This is visible in the resource name'
+      Role: 'DeploymentValidation'
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+<details>
+
+<summary>via JSON Parameter file</summary>
+
+```json
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "connectionMonitors": {
+      "value": [
+        {
+          "endpoints": [
+            {
+              "name": "<name>",
+              "resourceId": "<resourceId>",
+              "type": "AzureVM"
+            },
+            {
+              "address": "www.bing.com",
+              "name": "Bing",
+              "type": "ExternalAddress"
+            }
+          ],
+          "name": "nnwwaf-cm-001",
+          "testConfigurations": [
+            {
+              "httpConfiguration": {
+                "method": "Get",
+                "port": 80,
+                "preferHTTPS": false,
+                "requestHeaders": [],
+                "validStatusCodeRanges": [
+                  "200"
+                ]
+              },
+              "name": "HTTP Bing Test",
+              "protocol": "Http",
+              "successThreshold": {
+                "checksFailedPercent": 5,
+                "roundTripTimeMs": 100
+              },
+              "testFrequencySec": 30
+            }
+          ],
+          "testGroups": [
+            {
+              "destinations": [
+                "Bing"
+              ],
+              "disable": false,
+              "name": "test-http-Bing",
+              "sources": [
+                "subnet-001(${resourceGroup.name})"
+              ],
+              "testConfigurations": [
+                "HTTP Bing Test"
+              ]
+            }
+          ],
+          "workspaceResourceId": "<workspaceResourceId>"
+        }
+      ]
+    },
+    "flowLogs": {
+      "value": [
+        {
+          "enabled": false,
+          "storageId": "<storageId>",
+          "targetResourceId": "<targetResourceId>"
+        },
+        {
+          "formatVersion": 1,
+          "name": "nnwwaf-fl-001",
+          "retentionInDays": 8,
+          "storageId": "<storageId>",
+          "targetResourceId": "<targetResourceId>",
+          "trafficAnalyticsInterval": 10,
+          "workspaceResourceId": "<workspaceResourceId>"
+        }
+      ]
+    },
+    "location": {
+      "value": "<location>"
+    },
+    "name": {
+      "value": "<name>"
+    },
+    "tags": {
+      "value": {
+        "Environment": "Non-Prod",
+        "hidden-title": "This is visible in the resource name",
+        "Role": "DeploymentValidation"
+      }
+    }
+  }
+}
+```
+
+</details>
+<p>
+
+
+## Parameters
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`connectionMonitors`](#parameter-connectionmonitors) | array | Array that contains the Connection Monitors. |
+| [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. |
+| [`flowLogs`](#parameter-flowlogs) | array | Array that contains the Flow Logs. |
+| [`location`](#parameter-location) | string | Location for all resources. |
+| [`lock`](#parameter-lock) | object | The lock settings of the service. |
+| [`name`](#parameter-name) | string | Name of the Network Watcher resource (hidden). |
+| [`roleAssignments`](#parameter-roleassignments) | array | Array of role assignments to create. |
+| [`tags`](#parameter-tags) | object | Tags of the resource. |
+
+### Parameter: `connectionMonitors`
+
+Array that contains the Connection Monitors.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `enableTelemetry`
+
+Enable/Disable usage telemetry for module.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
+### Parameter: `flowLogs`
+
+Array that contains the Flow Logs.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `location`
+
+Location for all resources.
+
+- Required: No
+- Type: string
+- Default: `[resourceGroup().location]`
+
+### Parameter: `lock`
+
+The lock settings of the service.
+
+- Required: No
+- Type: object
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`kind`](#parameter-lockkind) | string | Specify the type of lock. |
+| [`name`](#parameter-lockname) | string | Specify the name of lock. |
+
+### Parameter: `lock.kind`
+
+Specify the type of lock.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'CanNotDelete'
+    'None'
+    'ReadOnly'
+  ]
+  ```
+
+### Parameter: `lock.name`
+
+Specify the name of lock.
+
+- Required: No
+- Type: string
+
+### Parameter: `name`
+
+Name of the Network Watcher resource (hidden).
+
+- Required: No
+- Type: string
+- Default: `[format('NetworkWatcher_{0}', parameters('location'))]`
+
+### Parameter: `roleAssignments`
+
+Array of role assignments to create.
+
+- Required: No
+- Type: array
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`principalId`](#parameter-roleassignmentsprincipalid) | string | The principal ID of the principal (user/group/identity) to assign the role to. |
+| [`roleDefinitionIdOrName`](#parameter-roleassignmentsroledefinitionidorname) | string | The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`condition`](#parameter-roleassignmentscondition) | string | The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container". |
+| [`conditionVersion`](#parameter-roleassignmentsconditionversion) | string | Version of the condition. |
+| [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
+| [`description`](#parameter-roleassignmentsdescription) | string | The description of the role assignment. |
+| [`principalType`](#parameter-roleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
+
+### Parameter: `roleAssignments.principalId`
+
+The principal ID of the principal (user/group/identity) to assign the role to.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `roleAssignments.roleDefinitionIdOrName`
+
+The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `roleAssignments.condition`
+
+The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".
+
+- Required: No
+- Type: string
+
+### Parameter: `roleAssignments.conditionVersion`
+
+Version of the condition.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    '2.0'
+  ]
+  ```
+
+### Parameter: `roleAssignments.delegatedManagedIdentityResourceId`
+
+The Resource Id of the delegated managed identity resource.
+
+- Required: No
+- Type: string
+
+### Parameter: `roleAssignments.description`
+
+The description of the role assignment.
+
+- Required: No
+- Type: string
+
+### Parameter: `roleAssignments.principalType`
+
+The principal type of the assigned principal ID.
+
+- Required: No
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Device'
+    'ForeignGroup'
+    'Group'
+    'ServicePrincipal'
+    'User'
+  ]
+  ```
+
+### Parameter: `tags`
+
+Tags of the resource.
+
+- Required: No
+- Type: object
+
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `location` | string | The location the resource was deployed into. |
+| `name` | string | The name of the deployed network watcher. |
+| `resourceGroupName` | string | The resource group the network watcher was deployed into. |
+| `resourceId` | string | The resource ID of the deployed network watcher. |
+
+## Cross-referenced modules
+
+_None_
+
+## Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the [repository](https://aka.ms/avm/telemetry). There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
diff --git a/avm/res/network/network-watcher/connection-monitor/README.md b/avm/res/network/network-watcher/connection-monitor/README.md
new file mode 100644
index 0000000000..8ca9cfd750
--- /dev/null
+++ b/avm/res/network/network-watcher/connection-monitor/README.md
@@ -0,0 +1,117 @@
+# Network Watchers Connection Monitors `[Microsoft.Network/networkWatchers/connectionMonitors]`
+
+This module deploys a Network Watcher Connection Monitor.
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+- [Cross-referenced modules](#Cross-referenced-modules)
+- [Data Collection](#Data-Collection)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Network/networkWatchers/connectionMonitors` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkWatchers/connectionMonitors) |
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`name`](#parameter-name) | string | Name of the resource. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`endpoints`](#parameter-endpoints) | array | List of connection monitor endpoints. |
+| [`location`](#parameter-location) | string | Location for all resources. |
+| [`networkWatcherName`](#parameter-networkwatchername) | string | Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG. |
+| [`tags`](#parameter-tags) | object | Tags of the resource. |
+| [`testConfigurations`](#parameter-testconfigurations) | array | List of connection monitor test configurations. |
+| [`testGroups`](#parameter-testgroups) | array | List of connection monitor test groups. |
+| [`workspaceResourceId`](#parameter-workspaceresourceid) | string | Specify the Log Analytics Workspace Resource ID. |
+
+### Parameter: `name`
+
+Name of the resource.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `endpoints`
+
+List of connection monitor endpoints.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `location`
+
+Location for all resources.
+
+- Required: No
+- Type: string
+- Default: `[resourceGroup().location]`
+
+### Parameter: `networkWatcherName`
+
+Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG.
+
+- Required: No
+- Type: string
+- Default: `[format('NetworkWatcher_{0}', resourceGroup().location)]`
+
+### Parameter: `tags`
+
+Tags of the resource.
+
+- Required: No
+- Type: object
+
+### Parameter: `testConfigurations`
+
+List of connection monitor test configurations.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `testGroups`
+
+List of connection monitor test groups.
+
+- Required: No
+- Type: array
+- Default: `[]`
+
+### Parameter: `workspaceResourceId`
+
+Specify the Log Analytics Workspace Resource ID.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `location` | string | The location the resource was deployed into. |
+| `name` | string | The name of the deployed connection monitor. |
+| `resourceGroupName` | string | The resource group the connection monitor was deployed into. |
+| `resourceId` | string | The resource ID of the deployed connection monitor. |
+
+## Cross-referenced modules
+
+_None_
+
+## Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the [repository](https://aka.ms/avm/telemetry). There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
diff --git a/avm/res/network/network-watcher/connection-monitor/main.bicep b/avm/res/network/network-watcher/connection-monitor/main.bicep
new file mode 100644
index 0000000000..0823dabe66
--- /dev/null
+++ b/avm/res/network/network-watcher/connection-monitor/main.bicep
@@ -0,0 +1,66 @@
+metadata name = 'Network Watchers Connection Monitors'
+metadata description = 'This module deploys a Network Watcher Connection Monitor.'
+metadata owner = 'Azure/module-maintainers'
+
+@description('Optional. Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG.')
+param networkWatcherName string = 'NetworkWatcher_${resourceGroup().location}'
+
+@description('Required. Name of the resource.')
+param name string
+
+@description('Optional. Tags of the resource.')
+param tags object?
+
+@description('Optional. Location for all resources.')
+param location string = resourceGroup().location
+
+@description('Optional. List of connection monitor endpoints.')
+param endpoints array = []
+
+@description('Optional. List of connection monitor test configurations.')
+param testConfigurations array = []
+
+@description('Optional. List of connection monitor test groups.')
+param testGroups array = []
+
+@description('Optional. Specify the Log Analytics Workspace Resource ID.')
+param workspaceResourceId string = ''
+
+
+resource networkWatcher 'Microsoft.Network/networkWatchers@2023-04-01' existing = {
+  name: networkWatcherName
+}
+
+resource connectionMonitor 'Microsoft.Network/networkWatchers/connectionMonitors@2023-04-01' = {
+  name: name
+  parent: networkWatcher
+  tags: tags
+  location: location
+  properties: {
+    endpoints: endpoints
+    testConfigurations: testConfigurations
+    testGroups: testGroups
+    outputs: !empty(workspaceResourceId)
+      ? [
+          {
+            type: 'Workspace'
+            workspaceSettings: {
+              workspaceResourceId: workspaceResourceId
+            }
+          }
+        ]
+      : null
+  }
+}
+
+@description('The name of the deployed connection monitor.')
+output name string = connectionMonitor.name
+
+@description('The resource ID of the deployed connection monitor.')
+output resourceId string = connectionMonitor.id
+
+@description('The resource group the connection monitor was deployed into.')
+output resourceGroupName string = resourceGroup().name
+
+@description('The location the resource was deployed into.')
+output location string = connectionMonitor.location
diff --git a/avm/res/network/network-watcher/connection-monitor/main.json b/avm/res/network/network-watcher/connection-monitor/main.json
new file mode 100644
index 0000000000..6c3fd5c843
--- /dev/null
+++ b/avm/res/network/network-watcher/connection-monitor/main.json
@@ -0,0 +1,126 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.26.54.24096",
+      "templateHash": "13403868700445795620"
+    },
+    "name": "Network Watchers Connection Monitors",
+    "description": "This module deploys a Network Watcher Connection Monitor.",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "networkWatcherName": {
+      "type": "string",
+      "defaultValue": "[format('NetworkWatcher_{0}', resourceGroup().location)]",
+      "metadata": {
+        "description": "Optional. Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG."
+      }
+    },
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Name of the resource."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Tags of the resource."
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Optional. Location for all resources."
+      }
+    },
+    "endpoints": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Optional. List of connection monitor endpoints."
+      }
+    },
+    "testConfigurations": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Optional. List of connection monitor test configurations."
+      }
+    },
+    "testGroups": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Optional. List of connection monitor test groups."
+      }
+    },
+    "workspaceResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Specify the Log Analytics Workspace Resource ID."
+      }
+    }
+  },
+  "resources": {
+    "networkWatcher": {
+      "existing": true,
+      "type": "Microsoft.Network/networkWatchers",
+      "apiVersion": "2023-04-01",
+      "name": "[parameters('networkWatcherName')]"
+    },
+    "connectionMonitor": {
+      "type": "Microsoft.Network/networkWatchers/connectionMonitors",
+      "apiVersion": "2023-04-01",
+      "name": "[format('{0}/{1}', parameters('networkWatcherName'), parameters('name'))]",
+      "tags": "[parameters('tags')]",
+      "location": "[parameters('location')]",
+      "properties": {
+        "endpoints": "[parameters('endpoints')]",
+        "testConfigurations": "[parameters('testConfigurations')]",
+        "testGroups": "[parameters('testGroups')]",
+        "outputs": "[if(not(empty(parameters('workspaceResourceId'))), createArray(createObject('type', 'Workspace', 'workspaceSettings', createObject('workspaceResourceId', parameters('workspaceResourceId')))), null())]"
+      },
+      "dependsOn": [
+        "networkWatcher"
+      ]
+    }
+  },
+  "outputs": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the deployed connection monitor."
+      },
+      "value": "[parameters('name')]"
+    },
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the deployed connection monitor."
+      },
+      "value": "[resourceId('Microsoft.Network/networkWatchers/connectionMonitors', parameters('networkWatcherName'), parameters('name'))]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group the connection monitor was deployed into."
+      },
+      "value": "[resourceGroup().name]"
+    },
+    "location": {
+      "type": "string",
+      "metadata": {
+        "description": "The location the resource was deployed into."
+      },
+      "value": "[reference('connectionMonitor', '2023-04-01', 'full').location]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/network/network-watcher/flow-log/README.md b/avm/res/network/network-watcher/flow-log/README.md
new file mode 100644
index 0000000000..93c1ac0144
--- /dev/null
+++ b/avm/res/network/network-watcher/flow-log/README.md
@@ -0,0 +1,158 @@
+# NSG Flow Logs `[Microsoft.Network/networkWatchers/flowLogs]`
+
+This module controls the Network Security Group Flow Logs and analytics settings.
+**Note: this module must be run on the Resource Group where Network Watcher is deployed**
+
+## Navigation
+
+- [Resource Types](#Resource-Types)
+- [Parameters](#Parameters)
+- [Outputs](#Outputs)
+- [Cross-referenced modules](#Cross-referenced-modules)
+- [Data Collection](#Data-Collection)
+
+## Resource Types
+
+| Resource Type | API Version |
+| :-- | :-- |
+| `Microsoft.Network/networkWatchers/flowLogs` | [2023-04-01](https://learn.microsoft.com/en-us/azure/templates/Microsoft.Network/2023-04-01/networkWatchers/flowLogs) |
+
+## Parameters
+
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`storageId`](#parameter-storageid) | string | Resource ID of the diagnostic storage account. |
+| [`targetResourceId`](#parameter-targetresourceid) | string | Resource ID of the NSG that must be enabled for Flow Logs. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`enabled`](#parameter-enabled) | bool | If the flow log should be enabled. |
+| [`formatVersion`](#parameter-formatversion) | int | The flow log format version. |
+| [`location`](#parameter-location) | string | Location for all resources. |
+| [`name`](#parameter-name) | string | Name of the resource. |
+| [`networkWatcherName`](#parameter-networkwatchername) | string | Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG. |
+| [`retentionInDays`](#parameter-retentionindays) | int | Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely. |
+| [`tags`](#parameter-tags) | object | Tags of the resource. |
+| [`trafficAnalyticsInterval`](#parameter-trafficanalyticsinterval) | int | The interval in minutes which would decide how frequently TA service should do flow analytics. |
+| [`workspaceResourceId`](#parameter-workspaceresourceid) | string | Specify the Log Analytics Workspace Resource ID. |
+
+### Parameter: `storageId`
+
+Resource ID of the diagnostic storage account.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `targetResourceId`
+
+Resource ID of the NSG that must be enabled for Flow Logs.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `enabled`
+
+If the flow log should be enabled.
+
+- Required: No
+- Type: bool
+- Default: `True`
+
+### Parameter: `formatVersion`
+
+The flow log format version.
+
+- Required: No
+- Type: int
+- Default: `2`
+- Allowed:
+  ```Bicep
+  [
+    1
+    2
+  ]
+  ```
+
+### Parameter: `location`
+
+Location for all resources.
+
+- Required: No
+- Type: string
+- Default: `[resourceGroup().location]`
+
+### Parameter: `name`
+
+Name of the resource.
+
+- Required: No
+- Type: string
+- Default: `[format('{0}-{1}-flowlog', last(split(parameters('targetResourceId'), '/')), split(parameters('targetResourceId'), '/')[4])]`
+
+### Parameter: `networkWatcherName`
+
+Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG.
+
+- Required: No
+- Type: string
+- Default: `[format('NetworkWatcher_{0}', resourceGroup().location)]`
+
+### Parameter: `retentionInDays`
+
+Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.
+
+- Required: No
+- Type: int
+- Default: `365`
+
+### Parameter: `tags`
+
+Tags of the resource.
+
+- Required: No
+- Type: object
+
+### Parameter: `trafficAnalyticsInterval`
+
+The interval in minutes which would decide how frequently TA service should do flow analytics.
+
+- Required: No
+- Type: int
+- Default: `60`
+- Allowed:
+  ```Bicep
+  [
+    10
+    60
+  ]
+  ```
+
+### Parameter: `workspaceResourceId`
+
+Specify the Log Analytics Workspace Resource ID.
+
+- Required: No
+- Type: string
+- Default: `''`
+
+
+## Outputs
+
+| Output | Type | Description |
+| :-- | :-- | :-- |
+| `location` | string | The location the resource was deployed into. |
+| `name` | string | The name of the flow log. |
+| `resourceGroupName` | string | The resource group the flow log was deployed into. |
+| `resourceId` | string | The resource ID of the flow log. |
+
+## Cross-referenced modules
+
+_None_
+
+## Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the [repository](https://aka.ms/avm/telemetry). There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
diff --git a/avm/res/network/network-watcher/flow-log/main.bicep b/avm/res/network/network-watcher/flow-log/main.bicep
new file mode 100644
index 0000000000..89a14ccc38
--- /dev/null
+++ b/avm/res/network/network-watcher/flow-log/main.bicep
@@ -0,0 +1,97 @@
+metadata name = 'NSG Flow Logs'
+metadata description = '''This module controls the Network Security Group Flow Logs and analytics settings.
+**Note: this module must be run on the Resource Group where Network Watcher is deployed**'''
+metadata owner = 'Azure/module-maintainers'
+
+@description('Optional. Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG.')
+param networkWatcherName string = 'NetworkWatcher_${resourceGroup().location}'
+
+@description('Optional. Name of the resource.')
+param name string = '${last(split(targetResourceId, '/'))}-${split(targetResourceId, '/')[4]}-flowlog'
+
+@description('Optional. Tags of the resource.')
+param tags object?
+
+@description('Optional. Location for all resources.')
+param location string = resourceGroup().location
+
+@description('Required. Resource ID of the NSG that must be enabled for Flow Logs.')
+param targetResourceId string
+
+@description('Required. Resource ID of the diagnostic storage account.')
+param storageId string
+
+@description('Optional. If the flow log should be enabled.')
+param enabled bool = true
+
+@description('Optional. The flow log format version.')
+@allowed([
+  1
+  2
+])
+param formatVersion int = 2
+
+@description('Optional. Specify the Log Analytics Workspace Resource ID.')
+param workspaceResourceId string = ''
+
+@description('Optional. The interval in minutes which would decide how frequently TA service should do flow analytics.')
+@allowed([
+  10
+  60
+])
+param trafficAnalyticsInterval int = 60
+
+@description('Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.')
+@minValue(0)
+@maxValue(365)
+param retentionInDays int = 365
+
+var flowAnalyticsConfiguration = !empty(workspaceResourceId) && enabled == true
+  ? {
+      networkWatcherFlowAnalyticsConfiguration: {
+        enabled: true
+        workspaceResourceId: workspaceResourceId
+        trafficAnalyticsInterval: trafficAnalyticsInterval
+      }
+    }
+  : {
+      networkWatcherFlowAnalyticsConfiguration: {
+        enabled: false
+      }
+    }
+
+resource networkWatcher 'Microsoft.Network/networkWatchers@2023-04-01' existing = {
+  name: networkWatcherName
+}
+
+resource flowLog 'Microsoft.Network/networkWatchers/flowLogs@2023-04-01' = {
+  name: name
+  parent: networkWatcher
+  tags: tags
+  location: location
+  properties: {
+    targetResourceId: targetResourceId
+    storageId: storageId
+    enabled: enabled
+    retentionPolicy: {
+      days: retentionInDays
+      enabled: retentionInDays == 0 ? false : true
+    }
+    format: {
+      type: 'JSON'
+      version: formatVersion
+    }
+    flowAnalyticsConfiguration: flowAnalyticsConfiguration
+  }
+}
+@description('The name of the flow log.')
+output name string = flowLog.name
+
+@description('The resource ID of the flow log.')
+output resourceId string = flowLog.id
+
+@description('The resource group the flow log was deployed into.')
+output resourceGroupName string = resourceGroup().name
+
+@description('The location the resource was deployed into.')
+output location string = flowLog.location
diff --git a/avm/res/network/network-watcher/flow-log/main.json b/avm/res/network/network-watcher/flow-log/main.json
new file mode 100644
index 0000000000..1338480468
--- /dev/null
+++ b/avm/res/network/network-watcher/flow-log/main.json
@@ -0,0 +1,167 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.26.54.24096",
+      "templateHash": "7721211688474892554"
+    },
+    "name": "NSG Flow Logs",
+    "description": "This module controls the Network Security Group Flow Logs and analytics settings.\n**Note: this module must be run on the Resource Group where Network Watcher is deployed**",
+    "owner": "Azure/module-maintainers"
+  },
+  "parameters": {
+    "networkWatcherName": {
+      "type": "string",
+      "defaultValue": "[format('NetworkWatcher_{0}', resourceGroup().location)]",
+      "metadata": {
+        "description": "Optional. Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG."
+      }
+    },
+    "name": {
+      "type": "string",
+      "defaultValue": "[format('{0}-{1}-flowlog', last(split(parameters('targetResourceId'), '/')), split(parameters('targetResourceId'), '/')[4])]",
+      "metadata": {
+        "description": "Optional. Name of the resource."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Tags of the resource."
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Optional. Location for all resources."
+      }
+    },
+    "targetResourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Resource ID of the NSG that must be enabled for Flow Logs."
+      }
+    },
+    "storageId": {
+      "type": "string",
+      "metadata": {
+        "description": "Required. Resource ID of the diagnostic storage account."
+      }
+    },
+    "enabled": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. If the flow log should be enabled."
+      }
+    },
+    "formatVersion": {
+      "type": "int",
+      "defaultValue": 2,
+      "allowedValues": [
+        1,
+        2
+      ],
+      "metadata": {
+        "description": "Optional. The flow log format version."
+      }
+    },
+    "workspaceResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Specify the Log Analytics Workspace Resource ID."
+      }
+    },
+    "trafficAnalyticsInterval": {
+      "type": "int",
+      "defaultValue": 60,
+      "allowedValues": [
+        10,
+        60
+      ],
+      "metadata": {
+        "description": "Optional. The interval in minutes which would decide how frequently TA service should do flow analytics."
+      }
+    },
+    "retentionInDays": {
+      "type": "int",
+      "defaultValue": 365,
+      "minValue": 0,
+      "maxValue": 365,
+      "metadata": {
+        "description": "Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely."
+      }
+    }
+  },
+  "variables": {
+    "flowAnalyticsConfiguration": "[if(and(not(empty(parameters('workspaceResourceId'))), equals(parameters('enabled'), true())), createObject('networkWatcherFlowAnalyticsConfiguration', createObject('enabled', true(), 'workspaceResourceId', parameters('workspaceResourceId'), 'trafficAnalyticsInterval', parameters('trafficAnalyticsInterval'))), createObject('networkWatcherFlowAnalyticsConfiguration', createObject('enabled', false())))]"
+  },
+  "resources": {
+    "networkWatcher": {
+      "existing": true,
+      "type": "Microsoft.Network/networkWatchers",
+      "apiVersion": "2023-04-01",
+      "name": "[parameters('networkWatcherName')]"
+    },
+    "flowLog": {
+      "type": "Microsoft.Network/networkWatchers/flowLogs",
+      "apiVersion": "2023-04-01",
+      "name": "[format('{0}/{1}', parameters('networkWatcherName'), parameters('name'))]",
+      "tags": "[parameters('tags')]",
+      "location": "[parameters('location')]",
+      "properties": {
+        "targetResourceId": "[parameters('targetResourceId')]",
+        "storageId": "[parameters('storageId')]",
+        "enabled": "[parameters('enabled')]",
+        "retentionPolicy": {
+          "days": "[parameters('retentionInDays')]",
+          "enabled": "[if(equals(parameters('retentionInDays'), 0), false(), true())]"
+        },
+        "format": {
+          "type": "JSON",
+          "version": "[parameters('formatVersion')]"
+        },
+        "flowAnalyticsConfiguration": "[variables('flowAnalyticsConfiguration')]"
+      },
+      "dependsOn": [
+        "networkWatcher"
+      ]
+    }
+  },
+  "outputs": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the flow log."
+      },
+      "value": "[parameters('name')]"
+    },
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the flow log."
+      },
+      "value": "[resourceId('Microsoft.Network/networkWatchers/flowLogs', parameters('networkWatcherName'), parameters('name'))]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group the flow log was deployed into."
+      },
+      "value": "[resourceGroup().name]"
+    },
+    "location": {
+      "type": "string",
+      "metadata": {
+        "description": "The location the resource was deployed into."
+      },
+      "value": "[reference('flowLog', '2023-04-01', 'full').location]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/network/network-watcher/main.bicep b/avm/res/network/network-watcher/main.bicep
new file mode 100644
index 0000000000..71f388d98f
--- /dev/null
+++ b/avm/res/network/network-watcher/main.bicep
@@ -0,0 +1,188 @@
+metadata name = 'Network Watchers'
+metadata description = 'This module deploys a Network Watcher.'
+metadata owner = 'Azure/module-maintainers'
+
+@description('Optional. Name of the Network Watcher resource (hidden).')
+@minLength(1)
+param name string = 'NetworkWatcher_${location}'
+
+@description('Optional. Location for all resources.')
+param location string = resourceGroup().location
+
+@description('Optional. Array that contains the Connection Monitors.')
+param connectionMonitors array = []
+
+@description('Optional. Array that contains the Flow Logs.')
+param flowLogs array = []
+
+@description('Optional. The lock settings of the service.')
+param lock lockType
+
+@description('Optional. Array of role assignments to create.')
+param roleAssignments roleAssignmentType
+
+@description('Optional. Tags of the resource.')
+param tags object?
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+var builtInRoleNames = {
+  Contributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
+  'Network Contributor': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    '4d97b98b-1d4f-4787-a291-c67834d212e7'
+  )
+  Owner: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')
+  Reader: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')
+  'Role Based Access Control Administrator (Preview)': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    'f58310d9-a9f6-439a-9e8d-f62e7b41a168'
+  )
+  'User Access Administrator': subscriptionResourceId(
+    'Microsoft.Authorization/roleDefinitions',
+    '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9'
+  )
+}
+
+resource avmTelemetry 'Microsoft.Resources/deployments@2023-07-01' =
+  if (enableTelemetry) {
+    name: '46d3xbcp.res.network-networkwatcher.${replace('-..--..-', '.', '-')}.${substring(uniqueString(deployment().name, location), 0, 4)}'
+    properties: {
+      mode: 'Incremental'
+      template: {
+        '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
+        contentVersion: '1.0.0.0'
+        resources: []
+        outputs: {
+          telemetry: {
+            type: 'String'
+            value: 'For more information, see https://aka.ms/avm/TelemetryInfo'
+          }
+        }
+      }
+    }
+  }
+
+resource networkWatcher 'Microsoft.Network/networkWatchers@2023-04-01' = {
+  name: name
+  location: location
+  tags: tags
+  properties: {}
+}
+
+resource networkWatcher_lock 'Microsoft.Authorization/locks@2020-05-01' =
+  if (!empty(lock ?? {}) && lock.?kind != 'None') {
+    name: lock.?name ?? 'lock-${name}'
+    properties: {
+      level: lock.?kind ?? ''
+      notes: lock.?kind == 'CanNotDelete'
+        ? 'Cannot delete resource or child resources.'
+        : 'Cannot delete or modify the resource or child resources.'
+    }
+    scope: networkWatcher
+  }
+
+resource networkWatcher_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
+  for (roleAssignment, index) in (roleAssignments ?? []): {
+    name: guid(networkWatcher.id, roleAssignment.principalId, roleAssignment.roleDefinitionIdOrName)
+    properties: {
+      roleDefinitionId: contains(builtInRoleNames, roleAssignment.roleDefinitionIdOrName)
+        ? builtInRoleNames[roleAssignment.roleDefinitionIdOrName]
+        : contains(roleAssignment.roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/')
+            ? roleAssignment.roleDefinitionIdOrName
+            : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName)
+      principalId: roleAssignment.principalId
+      description: roleAssignment.?description
+      principalType: roleAssignment.?principalType
+      condition: roleAssignment.?condition
+      conditionVersion: !empty(roleAssignment.?condition) ? (roleAssignment.?conditionVersion ?? '2.0') : null // Must only be set if condtion is set
+      delegatedManagedIdentityResourceId: roleAssignment.?delegatedManagedIdentityResourceId
+    }
+    scope: networkWatcher
+  }
+]
+
+module networkWatcher_connectionMonitors 'connection-monitor/main.bicep' = [
+  for (connectionMonitor, index) in connectionMonitors: {
+    name: '${uniqueString(deployment().name, location)}-NW-ConnectionMonitor-${index}'
+    params: {
+      endpoints: contains(connectionMonitor, 'endpoints') ? connectionMonitor.endpoints : []
+      name: connectionMonitor.name
+      location: location
+      networkWatcherName: networkWatcher.name
+      testConfigurations: contains(connectionMonitor, 'testConfigurations') ? connectionMonitor.testConfigurations : []
+      testGroups: contains(connectionMonitor, 'testGroups') ? connectionMonitor.testGroups : []
+      workspaceResourceId: contains(connectionMonitor, 'workspaceResourceId')
+        ? connectionMonitor.workspaceResourceId
+        : ''
+    }
+  }
+]
+
+module networkWatcher_flowLogs 'flow-log/main.bicep' = [
+  for (flowLog, index) in flowLogs: {
+    name: '${uniqueString(deployment().name, location)}-NW-FlowLog-${index}'
+    params: {
+      enabled: contains(flowLog, 'enabled') ? flowLog.enabled : true
+      formatVersion: contains(flowLog, 'formatVersion') ? flowLog.formatVersion : 2
+      location: contains(flowLog, 'location') ? flowLog.location : location
+      name: contains(flowLog, 'name')
+        ? flowLog.name
+        : '${last(split(flowLog.targetResourceId, '/'))}-${split(flowLog.targetResourceId, '/')[4]}-flowlog'
+      networkWatcherName: networkWatcher.name
+      retentionInDays: contains(flowLog, 'retentionInDays') ? flowLog.retentionInDays : 365
+      storageId: flowLog.storageId
+      targetResourceId: flowLog.targetResourceId
+      trafficAnalyticsInterval: contains(flowLog, 'trafficAnalyticsInterval') ? flowLog.trafficAnalyticsInterval : 60
+      workspaceResourceId: contains(flowLog, 'workspaceResourceId') ? flowLog.workspaceResourceId : ''
+    }
+  }
+]
+
+@description('The name of the deployed network watcher.')
+output name string = networkWatcher.name
+
+@description('The resource ID of the deployed network watcher.')
+output resourceId string = networkWatcher.id
+
+@description('The resource group the network watcher was deployed into.')
+output resourceGroupName string = resourceGroup().name
+
+@description('The location the resource was deployed into.')
+output location string = networkWatcher.location
+
+// =============== //
+//   Definitions   //
+// =============== //
+
+type lockType = {
+  @description('Optional. Specify the name of lock.')
+  name: string?
+
+  @description('Optional. Specify the type of lock.')
+  kind: ('CanNotDelete' | 'ReadOnly' | 'None')?
+}?
+
+type roleAssignmentType = {
+  @description('Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
+  roleDefinitionIdOrName: string
+
+  @description('Required. The principal ID of the principal (user/group/identity) to assign the role to.')
+  principalId: string
+
+  @description('Optional. The principal type of the assigned principal ID.')
+  principalType: ('ServicePrincipal' | 'Group' | 'User' | 'ForeignGroup' | 'Device')?
+
+  @description('Optional. The description of the role assignment.')
+  description: string?
+
+  @description('Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".')
+  condition: string?
+
+  @description('Optional. Version of the condition.')
+  conditionVersion: '2.0'?
+
+  @description('Optional. The Resource Id of the delegated managed identity resource.')
+  delegatedManagedIdentityResourceId: string?
+}[]?
diff --git a/avm/res/network/network-watcher/main.json b/avm/res/network/network-watcher/main.json
new file mode 100644
index 0000000000..1a74c3d9f4
--- /dev/null
+++ b/avm/res/network/network-watcher/main.json
@@ -0,0 +1,633 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.26.54.24096",
+      "templateHash": "4063023963915633324"
+    },
+    "name": "Network Watchers",
+    "description": "This module deploys a Network Watcher.",
+    "owner": "Azure/module-maintainers"
+  },
+  "definitions": {
+    "lockType": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specify the name of lock."
+          }
+        },
+        "kind": {
+          "type": "string",
+          "allowedValues": [
+            "CanNotDelete",
+            "None",
+            "ReadOnly"
+          ],
+          "nullable": true,
+          "metadata": {
+            "description": "Optional. Specify the type of lock."
+          }
+        }
+      },
+      "nullable": true
+    },
+    "roleAssignmentType": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "roleDefinitionIdOrName": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+            }
+          },
+          "principalId": {
+            "type": "string",
+            "metadata": {
+              "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+            }
+          },
+          "principalType": {
+            "type": "string",
+            "allowedValues": [
+              "Device",
+              "ForeignGroup",
+              "Group",
+              "ServicePrincipal",
+              "User"
+            ],
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The principal type of the assigned principal ID."
+            }
+          },
+          "description": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The description of the role assignment."
+            }
+          },
+          "condition": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+            }
+          },
+          "conditionVersion": {
+            "type": "string",
+            "allowedValues": [
+              "2.0"
+            ],
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. Version of the condition."
+            }
+          },
+          "delegatedManagedIdentityResourceId": {
+            "type": "string",
+            "nullable": true,
+            "metadata": {
+              "description": "Optional. The Resource Id of the delegated managed identity resource."
+            }
+          }
+        }
+      },
+      "nullable": true
+    }
+  },
+  "parameters": {
+    "name": {
+      "type": "string",
+      "defaultValue": "[format('NetworkWatcher_{0}', parameters('location'))]",
+      "minLength": 1,
+      "metadata": {
+        "description": "Optional. Name of the Network Watcher resource (hidden)."
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "Optional. Location for all resources."
+      }
+    },
+    "connectionMonitors": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Optional. Array that contains the Connection Monitors."
+      }
+    },
+    "flowLogs": {
+      "type": "array",
+      "defaultValue": [],
+      "metadata": {
+        "description": "Optional. Array that contains the Flow Logs."
+      }
+    },
+    "lock": {
+      "$ref": "#/definitions/lockType",
+      "metadata": {
+        "description": "Optional. The lock settings of the service."
+      }
+    },
+    "roleAssignments": {
+      "$ref": "#/definitions/roleAssignmentType",
+      "metadata": {
+        "description": "Optional. Array of role assignments to create."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. Tags of the resource."
+      }
+    },
+    "enableTelemetry": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Enable/Disable usage telemetry for module."
+      }
+    }
+  },
+  "variables": {
+    "builtInRoleNames": {
+      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+      "Role Based Access Control Administrator (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+    }
+  },
+  "resources": {
+    "avmTelemetry": {
+      "condition": "[parameters('enableTelemetry')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2023-07-01",
+      "name": "[format('46d3xbcp.res.network-networkwatcher.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+      "properties": {
+        "mode": "Incremental",
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "resources": [],
+          "outputs": {
+            "telemetry": {
+              "type": "String",
+              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+            }
+          }
+        }
+      }
+    },
+    "networkWatcher": {
+      "type": "Microsoft.Network/networkWatchers",
+      "apiVersion": "2023-04-01",
+      "name": "[parameters('name')]",
+      "location": "[parameters('location')]",
+      "tags": "[parameters('tags')]",
+      "properties": {}
+    },
+    "networkWatcher_lock": {
+      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+      "type": "Microsoft.Authorization/locks",
+      "apiVersion": "2020-05-01",
+      "scope": "[format('Microsoft.Network/networkWatchers/{0}', parameters('name'))]",
+      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+      "properties": {
+        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+      },
+      "dependsOn": [
+        "networkWatcher"
+      ]
+    },
+    "networkWatcher_roleAssignments": {
+      "copy": {
+        "name": "networkWatcher_roleAssignments",
+        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]"
+      },
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "scope": "[format('Microsoft.Network/networkWatchers/{0}', parameters('name'))]",
+      "name": "[guid(resourceId('Microsoft.Network/networkWatchers', parameters('name')), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId, coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)]",
+      "properties": {
+        "roleDefinitionId": "[if(contains(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName), variables('builtInRoleNames')[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName], if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex()].roleDefinitionIdOrName)))]",
+        "principalId": "[coalesce(parameters('roleAssignments'), createArray())[copyIndex()].principalId]",
+        "description": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'description')]",
+        "principalType": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'principalType')]",
+        "condition": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition')]",
+        "conditionVersion": "[if(not(empty(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(parameters('roleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+      },
+      "dependsOn": [
+        "networkWatcher"
+      ]
+    },
+    "networkWatcher_connectionMonitors": {
+      "copy": {
+        "name": "networkWatcher_connectionMonitors",
+        "count": "[length(parameters('connectionMonitors'))]"
+      },
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-NW-ConnectionMonitor-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "endpoints": "[if(contains(parameters('connectionMonitors')[copyIndex()], 'endpoints'), createObject('value', parameters('connectionMonitors')[copyIndex()].endpoints), createObject('value', createArray()))]",
+          "name": {
+            "value": "[parameters('connectionMonitors')[copyIndex()].name]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "networkWatcherName": {
+            "value": "[parameters('name')]"
+          },
+          "testConfigurations": "[if(contains(parameters('connectionMonitors')[copyIndex()], 'testConfigurations'), createObject('value', parameters('connectionMonitors')[copyIndex()].testConfigurations), createObject('value', createArray()))]",
+          "testGroups": "[if(contains(parameters('connectionMonitors')[copyIndex()], 'testGroups'), createObject('value', parameters('connectionMonitors')[copyIndex()].testGroups), createObject('value', createArray()))]",
+          "workspaceResourceId": "[if(contains(parameters('connectionMonitors')[copyIndex()], 'workspaceResourceId'), createObject('value', parameters('connectionMonitors')[copyIndex()].workspaceResourceId), createObject('value', ''))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.26.54.24096",
+              "templateHash": "13403868700445795620"
+            },
+            "name": "Network Watchers Connection Monitors",
+            "description": "This module deploys a Network Watcher Connection Monitor.",
+            "owner": "Azure/module-maintainers"
+          },
+          "parameters": {
+            "networkWatcherName": {
+              "type": "string",
+              "defaultValue": "[format('NetworkWatcher_{0}', resourceGroup().location)]",
+              "metadata": {
+                "description": "Optional. Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG."
+              }
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "endpoints": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. List of connection monitor endpoints."
+              }
+            },
+            "testConfigurations": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. List of connection monitor test configurations."
+              }
+            },
+            "testGroups": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. List of connection monitor test groups."
+              }
+            },
+            "workspaceResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specify the Log Analytics Workspace Resource ID."
+              }
+            }
+          },
+          "resources": {
+            "networkWatcher": {
+              "existing": true,
+              "type": "Microsoft.Network/networkWatchers",
+              "apiVersion": "2023-04-01",
+              "name": "[parameters('networkWatcherName')]"
+            },
+            "connectionMonitor": {
+              "type": "Microsoft.Network/networkWatchers/connectionMonitors",
+              "apiVersion": "2023-04-01",
+              "name": "[format('{0}/{1}', parameters('networkWatcherName'), parameters('name'))]",
+              "tags": "[parameters('tags')]",
+              "location": "[parameters('location')]",
+              "properties": {
+                "endpoints": "[parameters('endpoints')]",
+                "testConfigurations": "[parameters('testConfigurations')]",
+                "testGroups": "[parameters('testGroups')]",
+                "outputs": "[if(not(empty(parameters('workspaceResourceId'))), createArray(createObject('type', 'Workspace', 'workspaceSettings', createObject('workspaceResourceId', parameters('workspaceResourceId')))), null())]"
+              },
+              "dependsOn": [
+                "networkWatcher"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the deployed connection monitor."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the deployed connection monitor."
+              },
+              "value": "[resourceId('Microsoft.Network/networkWatchers/connectionMonitors', parameters('networkWatcherName'), parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the connection monitor was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('connectionMonitor', '2023-04-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "networkWatcher"
+      ]
+    },
+    "networkWatcher_flowLogs": {
+      "copy": {
+        "name": "networkWatcher_flowLogs",
+        "count": "[length(parameters('flowLogs'))]"
+      },
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2022-09-01",
+      "name": "[format('{0}-NW-FlowLog-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "enabled": "[if(contains(parameters('flowLogs')[copyIndex()], 'enabled'), createObject('value', parameters('flowLogs')[copyIndex()].enabled), createObject('value', true()))]",
+          "formatVersion": "[if(contains(parameters('flowLogs')[copyIndex()], 'formatVersion'), createObject('value', parameters('flowLogs')[copyIndex()].formatVersion), createObject('value', 2))]",
+          "location": "[if(contains(parameters('flowLogs')[copyIndex()], 'location'), createObject('value', parameters('flowLogs')[copyIndex()].location), createObject('value', parameters('location')))]",
+          "name": "[if(contains(parameters('flowLogs')[copyIndex()], 'name'), createObject('value', parameters('flowLogs')[copyIndex()].name), createObject('value', format('{0}-{1}-flowlog', last(split(parameters('flowLogs')[copyIndex()].targetResourceId, '/')), split(parameters('flowLogs')[copyIndex()].targetResourceId, '/')[4])))]",
+          "networkWatcherName": {
+            "value": "[parameters('name')]"
+          },
+          "retentionInDays": "[if(contains(parameters('flowLogs')[copyIndex()], 'retentionInDays'), createObject('value', parameters('flowLogs')[copyIndex()].retentionInDays), createObject('value', 365))]",
+          "storageId": {
+            "value": "[parameters('flowLogs')[copyIndex()].storageId]"
+          },
+          "targetResourceId": {
+            "value": "[parameters('flowLogs')[copyIndex()].targetResourceId]"
+          },
+          "trafficAnalyticsInterval": "[if(contains(parameters('flowLogs')[copyIndex()], 'trafficAnalyticsInterval'), createObject('value', parameters('flowLogs')[copyIndex()].trafficAnalyticsInterval), createObject('value', 60))]",
+          "workspaceResourceId": "[if(contains(parameters('flowLogs')[copyIndex()], 'workspaceResourceId'), createObject('value', parameters('flowLogs')[copyIndex()].workspaceResourceId), createObject('value', ''))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.26.54.24096",
+              "templateHash": "7721211688474892554"
+            },
+            "name": "NSG Flow Logs",
+            "description": "This module controls the Network Security Group Flow Logs and analytics settings.\n**Note: this module must be run on the Resource Group where Network Watcher is deployed**",
+            "owner": "Azure/module-maintainers"
+          },
+          "parameters": {
+            "networkWatcherName": {
+              "type": "string",
+              "defaultValue": "[format('NetworkWatcher_{0}', resourceGroup().location)]",
+              "metadata": {
+                "description": "Optional. Name of the network watcher resource. Must be in the resource group where the Flow log will be created and same region as the NSG."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('{0}-{1}-flowlog', last(split(parameters('targetResourceId'), '/')), split(parameters('targetResourceId'), '/')[4])]",
+              "metadata": {
+                "description": "Optional. Name of the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Tags of the resource."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional. Location for all resources."
+              }
+            },
+            "targetResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Resource ID of the NSG that must be enabled for Flow Logs."
+              }
+            },
+            "storageId": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Resource ID of the diagnostic storage account."
+              }
+            },
+            "enabled": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. If the flow log should be enabled."
+              }
+            },
+            "formatVersion": {
+              "type": "int",
+              "defaultValue": 2,
+              "allowedValues": [
+                1,
+                2
+              ],
+              "metadata": {
+                "description": "Optional. The flow log format version."
+              }
+            },
+            "workspaceResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Specify the Log Analytics Workspace Resource ID."
+              }
+            },
+            "trafficAnalyticsInterval": {
+              "type": "int",
+              "defaultValue": 60,
+              "allowedValues": [
+                10,
+                60
+              ],
+              "metadata": {
+                "description": "Optional. The interval in minutes which would decide how frequently TA service should do flow analytics."
+              }
+            },
+            "retentionInDays": {
+              "type": "int",
+              "defaultValue": 365,
+              "minValue": 0,
+              "maxValue": 365,
+              "metadata": {
+                "description": "Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely."
+              }
+            }
+          },
+          "variables": {
+            "flowAnalyticsConfiguration": "[if(and(not(empty(parameters('workspaceResourceId'))), equals(parameters('enabled'), true())), createObject('networkWatcherFlowAnalyticsConfiguration', createObject('enabled', true(), 'workspaceResourceId', parameters('workspaceResourceId'), 'trafficAnalyticsInterval', parameters('trafficAnalyticsInterval'))), createObject('networkWatcherFlowAnalyticsConfiguration', createObject('enabled', false())))]"
+          },
+          "resources": {
+            "networkWatcher": {
+              "existing": true,
+              "type": "Microsoft.Network/networkWatchers",
+              "apiVersion": "2023-04-01",
+              "name": "[parameters('networkWatcherName')]"
+            },
+            "flowLog": {
+              "type": "Microsoft.Network/networkWatchers/flowLogs",
+              "apiVersion": "2023-04-01",
+              "name": "[format('{0}/{1}', parameters('networkWatcherName'), parameters('name'))]",
+              "tags": "[parameters('tags')]",
+              "location": "[parameters('location')]",
+              "properties": {
+                "targetResourceId": "[parameters('targetResourceId')]",
+                "storageId": "[parameters('storageId')]",
+                "enabled": "[parameters('enabled')]",
+                "retentionPolicy": {
+                  "days": "[parameters('retentionInDays')]",
+                  "enabled": "[if(equals(parameters('retentionInDays'), 0), false(), true())]"
+                },
+                "format": {
+                  "type": "JSON",
+                  "version": "[parameters('formatVersion')]"
+                },
+                "flowAnalyticsConfiguration": "[variables('flowAnalyticsConfiguration')]"
+              },
+              "dependsOn": [
+                "networkWatcher"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the flow log."
+              },
+              "value": "[parameters('name')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the flow log."
+              },
+              "value": "[resourceId('Microsoft.Network/networkWatchers/flowLogs', parameters('networkWatcherName'), parameters('name'))]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource group the flow log was deployed into."
+              },
+              "value": "[resourceGroup().name]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "The location the resource was deployed into."
+              },
+              "value": "[reference('flowLog', '2023-04-01', 'full').location]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "networkWatcher"
+      ]
+    }
+  },
+  "outputs": {
+    "name": {
+      "type": "string",
+      "metadata": {
+        "description": "The name of the deployed network watcher."
+      },
+      "value": "[parameters('name')]"
+    },
+    "resourceId": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource ID of the deployed network watcher."
+      },
+      "value": "[resourceId('Microsoft.Network/networkWatchers', parameters('name'))]"
+    },
+    "resourceGroupName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group the network watcher was deployed into."
+      },
+      "value": "[resourceGroup().name]"
+    },
+    "location": {
+      "type": "string",
+      "metadata": {
+        "description": "The location the resource was deployed into."
+      },
+      "value": "[reference('networkWatcher', '2023-04-01', 'full').location]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/avm/res/network/network-watcher/tests/e2e/defaults/main.test.bicep b/avm/res/network/network-watcher/tests/e2e/defaults/main.test.bicep
new file mode 100644
index 0000000000..9fcca025ef
--- /dev/null
+++ b/avm/res/network/network-watcher/tests/e2e/defaults/main.test.bicep
@@ -0,0 +1,51 @@
+targetScope = 'subscription'
+
+metadata name = 'Using only defaults'
+metadata description = 'This instance deploys the module with the minimum set of required parameters.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'NetworkWatcherRG' // Note, this is the default NetworkWatcher resource group. Do not change.
+
+@description('Optional. The location to deploy resources to.')
+#disable-next-line no-unused-params // A rotation location cannot be used for this test as NetworkWatcher Resource Groups are created for any test location automatically
+param resourceLocation string = deployment().location
+
+@description('Optional. The static location of the resource group & resources.') // Note, we set the location of the NetworkWatcherRG to avoid conflicts with the already existing NetworkWatcherRG
+param tempLocation string = 'uksouth'
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'nnwmin'
+
+#disable-next-line no-unused-params
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: tempLocation
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, tempLocation)}-test-${serviceShort}-${iteration}'
+  params: {
+    // Note: This value is not required and only set to enable testing
+    location: tempLocation
+  }
+}]
diff --git a/avm/res/network/network-watcher/tests/e2e/max/dependencies.bicep b/avm/res/network/network-watcher/tests/e2e/max/dependencies.bicep
new file mode 100644
index 0000000000..c20f841f30
--- /dev/null
+++ b/avm/res/network/network-watcher/tests/e2e/max/dependencies.bicep
@@ -0,0 +1,144 @@
+@description('Optional. The location to deploy to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Virtual Network to create.')
+param virtualNetworkName string
+
+@description('Required. The name of the Managed Identity to create.')
+param managedIdentityName string
+
+@description('Required. The name of the first Network Security Group to create.')
+param firstNetworkSecurityGroupName string
+
+@description('Required. The name of the second Network Security Group to create.')
+param secondNetworkSecurityGroupName string
+
+@description('Required. The name of the Virtual Machine to create.')
+param virtualMachineName string
+
+@description('Optional. The password to leverage for the VM login.')
+@secure()
+param password string = newGuid()
+
+var addressPrefix = '10.0.0.0/16'
+
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        addressPrefix
+      ]
+    }
+    subnets: [
+      {
+        name: 'defaultSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 16, 0)
+        }
+      }
+    ]
+  }
+}
+
+resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
+  name: managedIdentityName
+  location: location
+}
+
+resource firstNetworkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2023-04-01' = {
+  name: firstNetworkSecurityGroupName
+  location: location
+}
+
+resource secondNetworkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2023-04-01' = {
+  name: secondNetworkSecurityGroupName
+  location: location
+}
+
+resource networkInterface 'Microsoft.Network/networkInterfaces@2023-04-01' = {
+  name: '${virtualMachineName}-nic'
+  location: location
+  properties: {
+    ipConfigurations: [
+      {
+        name: 'ipconfig01'
+        properties: {
+          subnet: {
+            id: virtualNetwork.properties.subnets[0].id
+          }
+        }
+      }
+    ]
+  }
+}
+
+resource virtualMachine 'Microsoft.Compute/virtualMachines@2022-08-01' = {
+  name: virtualMachineName
+  location: location
+  properties: {
+    networkProfile: {
+      networkInterfaces: [
+        {
+          id: networkInterface.id
+          properties: {
+            deleteOption: 'Delete'
+            primary: true
+          }
+        }
+      ]
+    }
+    storageProfile: {
+      imageReference: {
+        publisher: 'Canonical'
+        offer: '0001-com-ubuntu-server-jammy'
+        sku: '22_04-lts-gen2'
+        version: 'latest'
+      }
+      osDisk: {
+        deleteOption: 'Delete'
+        createOption: 'FromImage'
+      }
+    }
+    hardwareProfile: {
+      vmSize: 'Standard_B1ms'
+    }
+    osProfile: {
+      adminUsername: '${virtualMachineName}cake'
+      adminPassword: password
+      computerName: virtualMachineName
+      linuxConfiguration: {
+        disablePasswordAuthentication: false
+      }
+    }
+  }
+}
+
+resource extension 'Microsoft.Compute/virtualMachines/extensions@2021-07-01' = {
+  name: 'NetworkWatcherAgent'
+  parent: virtualMachine
+  location: location
+  properties: {
+    publisher: 'Microsoft.Azure.NetworkWatcher'
+    type: 'NetworkWatcherAgentLinux'
+    typeHandlerVersion: '1.4'
+    autoUpgradeMinorVersion: true
+    enableAutomaticUpgrade: false
+    settings: {}
+    protectedSettings: {}
+    suppressFailures: false
+  }
+}
+
+@description('The principal ID of the created Managed Identity.')
+output managedIdentityPrincipalId string = managedIdentity.properties.principalId
+
+@description('The resource ID of the created Virtual Machine.')
+output virtualMachineResourceId string = virtualMachine.id
+
+@description('The resource ID of the first created Network Security Group.')
+output firstNetworkSecurityGroupResourceId string = firstNetworkSecurityGroup.id
+
+@description('The resource ID of the second created Network Security Group.')
+output secondNetworkSecurityGroupResourceId string = secondNetworkSecurityGroup.id
diff --git a/avm/res/network/network-watcher/tests/e2e/max/main.test.bicep b/avm/res/network/network-watcher/tests/e2e/max/main.test.bicep
new file mode 100644
index 0000000000..4386fe3d6e
--- /dev/null
+++ b/avm/res/network/network-watcher/tests/e2e/max/main.test.bicep
@@ -0,0 +1,172 @@
+targetScope = 'subscription'
+
+metadata name = 'Using large parameter set'
+metadata description = 'This instance deploys the module with most of its features enabled.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'NetworkWatcherRG' // Note, this is the default NetworkWatcher resource group. Do not change.
+
+@description('Optional. The location to deploy resources to.')
+#disable-next-line no-unused-params // A rotation location cannot be used for this test as NetworkWatcher Resource Groups are created for any test location automatically
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'nnwmax'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+@description('Optional. The static location of the resource group & resources.') // Note, we set the location of the NetworkWatcherRG to avoid conflicts with the already existing NetworkWatcherRG
+param tempLocation string = 'uksouth'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: tempLocation
+}
+
+resource resourceGroupDependencies 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: 'dep-${namePrefix}-network.networkwatcher-${serviceShort}-rg'
+  location: tempLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroupDependencies
+  name: '${uniqueString(deployment().name, tempLocation)}-nestedDependencies'
+  params: {
+    managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
+    firstNetworkSecurityGroupName: 'dep-${namePrefix}-nsg-1-${serviceShort}'
+    secondNetworkSecurityGroupName: 'dep-${namePrefix}-nsg-2-${serviceShort}'
+    virtualMachineName: 'dep-${namePrefix}-vm-${serviceShort}'
+    virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+    location: tempLocation
+  }
+}
+
+// Diagnostics
+// ===========
+module diagnosticDependencies '../../../../../../utilities/e2e-template-assets/templates/diagnostic.dependencies.bicep' = {
+  scope: resourceGroupDependencies
+  name: '${uniqueString(deployment().name, tempLocation)}-diagnosticDependencies'
+  params: {
+    storageAccountName: 'dep${namePrefix}diasa${serviceShort}01'
+    logAnalyticsWorkspaceName: 'dep-${namePrefix}-law-${serviceShort}'
+    eventHubNamespaceEventHubName: 'dep-${namePrefix}-evh-${serviceShort}'
+    eventHubNamespaceName: 'dep-${namePrefix}-evhns-${serviceShort}'
+    location: tempLocation
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, tempLocation)}-test-${serviceShort}-${iteration}'
+  params: {
+    name: 'NetworkWatcher_${tempLocation}'
+    location: tempLocation
+    connectionMonitors: [
+      {
+        name: '${namePrefix}-${serviceShort}-cm-001'
+        endpoints: [
+          {
+            name: '${namePrefix}-subnet-001(${resourceGroup.name})'
+            resourceId: nestedDependencies.outputs.virtualMachineResourceId
+            type: 'AzureVM'
+          }
+          {
+            address: 'www.bing.com'
+            name: 'Bing'
+            type: 'ExternalAddress'
+          }
+        ]
+        testConfigurations: [
+          {
+            httpConfiguration: {
+              method: 'Get'
+              port: 80
+              preferHTTPS: false
+              requestHeaders: []
+              validStatusCodeRanges: [
+                '200'
+              ]
+            }
+            name: 'HTTP Bing Test'
+            protocol: 'Http'
+            successThreshold: {
+              checksFailedPercent: 5
+              roundTripTimeMs: 100
+            }
+            testFrequencySec: 30
+          }
+        ]
+        testGroups: [
+          {
+            destinations: [
+              'Bing'
+            ]
+            disable: false
+            name: 'test-http-Bing'
+            sources: [
+              '${namePrefix}-subnet-001(${resourceGroup.name})'
+            ]
+            testConfigurations: [
+              'HTTP Bing Test'
+            ]
+          }
+        ]
+        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+      }
+    ]
+    flowLogs: [
+      {
+        enabled: false
+        storageId: diagnosticDependencies.outputs.storageAccountResourceId
+        targetResourceId: nestedDependencies.outputs.firstNetworkSecurityGroupResourceId
+      }
+      {
+        formatVersion: 1
+        name: '${namePrefix}-${serviceShort}-fl-001'
+        retentionInDays: 8
+        storageId: diagnosticDependencies.outputs.storageAccountResourceId
+        targetResourceId: nestedDependencies.outputs.secondNetworkSecurityGroupResourceId
+        trafficAnalyticsInterval: 10
+        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+      }
+    ]
+    roleAssignments: [
+      {
+        roleDefinitionIdOrName: 'Owner'
+        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+        principalType: 'ServicePrincipal'
+      }
+      {
+        roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
+        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+        principalType: 'ServicePrincipal'
+      }
+      {
+        roleDefinitionIdOrName: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')
+        principalId: nestedDependencies.outputs.managedIdentityPrincipalId
+        principalType: 'ServicePrincipal'
+      }
+    ]
+    tags: {
+      'hidden-title': 'This is visible in the resource name'
+      Environment: 'Non-Prod'
+      Role: 'DeploymentValidation'
+    }
+  }
+}]
diff --git a/avm/res/network/network-watcher/tests/e2e/waf-aligned/dependencies.bicep b/avm/res/network/network-watcher/tests/e2e/waf-aligned/dependencies.bicep
new file mode 100644
index 0000000000..c20f841f30
--- /dev/null
+++ b/avm/res/network/network-watcher/tests/e2e/waf-aligned/dependencies.bicep
@@ -0,0 +1,144 @@
+@description('Optional. The location to deploy to.')
+param location string = resourceGroup().location
+
+@description('Required. The name of the Virtual Network to create.')
+param virtualNetworkName string
+
+@description('Required. The name of the Managed Identity to create.')
+param managedIdentityName string
+
+@description('Required. The name of the first Network Security Group to create.')
+param firstNetworkSecurityGroupName string
+
+@description('Required. The name of the second Network Security Group to create.')
+param secondNetworkSecurityGroupName string
+
+@description('Required. The name of the Virtual Machine to create.')
+param virtualMachineName string
+
+@description('Optional. The password to leverage for the VM login.')
+@secure()
+param password string = newGuid()
+
+var addressPrefix = '10.0.0.0/16'
+
+resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
+  name: virtualNetworkName
+  location: location
+  properties: {
+    addressSpace: {
+      addressPrefixes: [
+        addressPrefix
+      ]
+    }
+    subnets: [
+      {
+        name: 'defaultSubnet'
+        properties: {
+          addressPrefix: cidrSubnet(addressPrefix, 16, 0)
+        }
+      }
+    ]
+  }
+}
+
+resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
+  name: managedIdentityName
+  location: location
+}
+
+resource firstNetworkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2023-04-01' = {
+  name: firstNetworkSecurityGroupName
+  location: location
+}
+
+resource secondNetworkSecurityGroup 'Microsoft.Network/networkSecurityGroups@2023-04-01' = {
+  name: secondNetworkSecurityGroupName
+  location: location
+}
+
+resource networkInterface 'Microsoft.Network/networkInterfaces@2023-04-01' = {
+  name: '${virtualMachineName}-nic'
+  location: location
+  properties: {
+    ipConfigurations: [
+      {
+        name: 'ipconfig01'
+        properties: {
+          subnet: {
+            id: virtualNetwork.properties.subnets[0].id
+          }
+        }
+      }
+    ]
+  }
+}
+
+resource virtualMachine 'Microsoft.Compute/virtualMachines@2022-08-01' = {
+  name: virtualMachineName
+  location: location
+  properties: {
+    networkProfile: {
+      networkInterfaces: [
+        {
+          id: networkInterface.id
+          properties: {
+            deleteOption: 'Delete'
+            primary: true
+          }
+        }
+      ]
+    }
+    storageProfile: {
+      imageReference: {
+        publisher: 'Canonical'
+        offer: '0001-com-ubuntu-server-jammy'
+        sku: '22_04-lts-gen2'
+        version: 'latest'
+      }
+      osDisk: {
+        deleteOption: 'Delete'
+        createOption: 'FromImage'
+      }
+    }
+    hardwareProfile: {
+      vmSize: 'Standard_B1ms'
+    }
+    osProfile: {
+      adminUsername: '${virtualMachineName}cake'
+      adminPassword: password
+      computerName: virtualMachineName
+      linuxConfiguration: {
+        disablePasswordAuthentication: false
+      }
+    }
+  }
+}
+
+resource extension 'Microsoft.Compute/virtualMachines/extensions@2021-07-01' = {
+  name: 'NetworkWatcherAgent'
+  parent: virtualMachine
+  location: location
+  properties: {
+    publisher: 'Microsoft.Azure.NetworkWatcher'
+    type: 'NetworkWatcherAgentLinux'
+    typeHandlerVersion: '1.4'
+    autoUpgradeMinorVersion: true
+    enableAutomaticUpgrade: false
+    settings: {}
+    protectedSettings: {}
+    suppressFailures: false
+  }
+}
+
+@description('The principal ID of the created Managed Identity.')
+output managedIdentityPrincipalId string = managedIdentity.properties.principalId
+
+@description('The resource ID of the created Virtual Machine.')
+output virtualMachineResourceId string = virtualMachine.id
+
+@description('The resource ID of the first created Network Security Group.')
+output firstNetworkSecurityGroupResourceId string = firstNetworkSecurityGroup.id
+
+@description('The resource ID of the second created Network Security Group.')
+output secondNetworkSecurityGroupResourceId string = secondNetworkSecurityGroup.id
diff --git a/avm/res/network/network-watcher/tests/e2e/waf-aligned/main.test.bicep b/avm/res/network/network-watcher/tests/e2e/waf-aligned/main.test.bicep
new file mode 100644
index 0000000000..32fc738840
--- /dev/null
+++ b/avm/res/network/network-watcher/tests/e2e/waf-aligned/main.test.bicep
@@ -0,0 +1,156 @@
+targetScope = 'subscription'
+
+metadata name = 'WAF-aligned'
+metadata description = 'This instance deploys the module in alignment with the best-practices of the Azure Well-Architected Framework.'
+
+// ========== //
+// Parameters //
+// ========== //
+
+@description('Optional. The name of the resource group to deploy for testing purposes.')
+@maxLength(90)
+param resourceGroupName string = 'NetworkWatcherRG' // Note, this is the default NetworkWatcher resource group. Do not change.
+
+@description('Optional. The location to deploy resources to.')
+#disable-next-line no-unused-params // A rotation location cannot be used for this test as NetworkWatcher Resource Groups are created for any test location automatically
+param resourceLocation string = deployment().location
+
+@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
+param serviceShort string = 'nnwwaf'
+
+@description('Optional. A token to inject into the name of each resource.')
+param namePrefix string = '#_namePrefix_#'
+
+@description('Optional. The static location of the resource group & resources.') // Note, we set the location of the NetworkWatcherRG to avoid conflicts with the already existing NetworkWatcherRG
+param tempLocation string = 'uksouth'
+
+// ============ //
+// Dependencies //
+// ============ //
+
+// General resources
+// =================
+resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: resourceGroupName
+  location: tempLocation
+}
+
+resource resourceGroupDependencies 'Microsoft.Resources/resourceGroups@2021-04-01' = {
+  name: 'dep-${namePrefix}-network.networkwatcher-${serviceShort}-rg'
+  location: tempLocation
+}
+
+module nestedDependencies 'dependencies.bicep' = {
+  scope: resourceGroupDependencies
+  name: '${uniqueString(deployment().name, tempLocation)}-nestedDependencies'
+  params: {
+    managedIdentityName: 'dep-${namePrefix}-msi-${serviceShort}'
+    firstNetworkSecurityGroupName: 'dep-${namePrefix}-nsg-1-${serviceShort}'
+    secondNetworkSecurityGroupName: 'dep-${namePrefix}-nsg-2-${serviceShort}'
+    virtualMachineName: 'dep-${namePrefix}-vm-${serviceShort}'
+    virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
+    location: tempLocation
+  }
+}
+
+// Diagnostics
+// ===========
+module diagnosticDependencies '../../../../../../utilities/e2e-template-assets/templates/diagnostic.dependencies.bicep' = {
+  scope: resourceGroupDependencies
+  name: '${uniqueString(deployment().name, tempLocation)}-diagnosticDependencies'
+  params: {
+    storageAccountName: 'dep${namePrefix}diasa${serviceShort}01'
+    logAnalyticsWorkspaceName: 'dep-${namePrefix}-law-${serviceShort}'
+    eventHubNamespaceEventHubName: 'dep-${namePrefix}-evh-${serviceShort}'
+    eventHubNamespaceName: 'dep-${namePrefix}-evhns-${serviceShort}'
+    location: tempLocation
+  }
+}
+
+// ============== //
+// Test Execution //
+// ============== //
+
+@batchSize(1)
+module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem' ]: {
+  scope: resourceGroup
+  name: '${uniqueString(deployment().name, tempLocation)}-test-${serviceShort}-${iteration}'
+  params: {
+    name: 'NetworkWatcher_${tempLocation}'
+    location: tempLocation
+    connectionMonitors: [
+      {
+        name: '${namePrefix}-${serviceShort}-cm-001'
+        endpoints: [
+          {
+            name: '${namePrefix}-subnet-001(${resourceGroup.name})'
+            resourceId: nestedDependencies.outputs.virtualMachineResourceId
+            type: 'AzureVM'
+          }
+          {
+            address: 'www.bing.com'
+            name: 'Bing'
+            type: 'ExternalAddress'
+          }
+        ]
+        testConfigurations: [
+          {
+            httpConfiguration: {
+              method: 'Get'
+              port: 80
+              preferHTTPS: false
+              requestHeaders: []
+              validStatusCodeRanges: [
+                '200'
+              ]
+            }
+            name: 'HTTP Bing Test'
+            protocol: 'Http'
+            successThreshold: {
+              checksFailedPercent: 5
+              roundTripTimeMs: 100
+            }
+            testFrequencySec: 30
+          }
+        ]
+        testGroups: [
+          {
+            destinations: [
+              'Bing'
+            ]
+            disable: false
+            name: 'test-http-Bing'
+            sources: [
+              '${namePrefix}-subnet-001(${resourceGroup.name})'
+            ]
+            testConfigurations: [
+              'HTTP Bing Test'
+            ]
+          }
+        ]
+        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+      }
+    ]
+    flowLogs: [
+      {
+        enabled: false
+        storageId: diagnosticDependencies.outputs.storageAccountResourceId
+        targetResourceId: nestedDependencies.outputs.firstNetworkSecurityGroupResourceId
+      }
+      {
+        formatVersion: 1
+        name: '${namePrefix}-${serviceShort}-fl-001'
+        retentionInDays: 8
+        storageId: diagnosticDependencies.outputs.storageAccountResourceId
+        targetResourceId: nestedDependencies.outputs.secondNetworkSecurityGroupResourceId
+        trafficAnalyticsInterval: 10
+        workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
+      }
+    ]
+    tags: {
+      'hidden-title': 'This is visible in the resource name'
+      Environment: 'Non-Prod'
+      Role: 'DeploymentValidation'
+    }
+  }
+}]
diff --git a/avm/res/network/network-watcher/version.json b/avm/res/network/network-watcher/version.json
new file mode 100644
index 0000000000..7fa401bdf7
--- /dev/null
+++ b/avm/res/network/network-watcher/version.json
@@ -0,0 +1,7 @@
+{
+    "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
+    "version": "0.1",
+    "pathFilters": [
+        "./main.json"
+    ]
+}