Assing ASG to a private Endpoint

[L-u-k-e-GIT]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Use-cases

I search on different sites, but I do not find a way to associate an ASG (application security group) to a private endpoint.
Is there a way to do it with terraform as for the resource "azurerm_network_interface_application_security_group_association" is used to associate an ASG to a NIC?
Attempted Solutions

Tried "azurerm_network_interface_application_security_group_association", but does not work
Proposal

New or Affected Resource(s)/Data Source(s)

azurerm_private_endpoint_application_security_group_association

Potential Terraform Configuration

Develop azurerm_private_endpoint_application_security_group_association

resource "zurerm_private_endpoint_application_security_group_association" "asg-nic" {

private_endpoint_id = var.pe_id #
application_security_group_id = var.asg.id

}

References

No response

[Yakuza-UA]

I have a similar request. It would be nice if Private Endpoint can be assigned to ASG post-creation. Currently Terraform reports an error:

Error: updating Application Security Group Association for Network Interface: (Name "[MASKED]" / Resource Group "[MASKED]"): network.InterfacesClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="CannotModifyNicAttachedToPrivateEndpoint" Message="Network interface /subscriptions/[MASKED]/resourceGroups/[MASKED]/providers/Microsoft.Network/networkInterfaces/[MASKED] is linked to a private endpoint /subscriptions/[MASKED]/resourceGroups/[MASKED]/providers/Microsoft.Network/privateEndpoints/[MASKED]. It can not be modified by user." Details=[]

This can be done via portal, however, even after PE was created. Thanks!

[tombuildsstuff]

@liuwuliuyun we intentionally don't implement this within the azurerm_private_endpoint resource - this'll need to be a new virtual resource like the azurerm_private_endpoint_application_security_group_association resource requested above

[tombuildsstuff]

@L-u-k-e-GIT unfortunately @liuwuliuyun's comment was a little vague (it's available in the API/SDK but not in TF) - which is why that's been marked off-topic fwiw.

As mentioned in my other comment above, this'll need to be implemented as a new Virtual Resource - this isn't available at this point in time and this Feature Request is tracking adding support for it.

[L-u-k-e-GIT]

@tombuildsstuff thank for clarification.

[mpmatti]

The same issue applies to associating NSG to PE NIC.

Error: updating Security Group Association for Network Interface: (Name "pe-xxxx.nic..." / Resource Group "RGtest"): network.InterfacesClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="CannotModifyNicAttachedToPrivateEndpoint" Message="Network interface /subscriptions/xxx/resourceGroups/RGtest/providers/Microsoft.Network/networkInterfaces/pe-xxxx.nic... is linked to a private endpoint /subscriptions/xxx/resourceGroups/RGtest/providers/Microsoft.Network/privateEndpoints/pe-xxxx. It can not be modified by user." Details=[]

[MohamedAnouar]

I tried using azurerm_network_interface_application_security_group_association and got the same error as [mpmatti]. Do we have any date when this feature will be integrated ?

[Yakuza-UA]

Any update on this? Private Endpoints and Network Policies for Private Endpoints are now GA, aren't they?

[MohamedAnouar]

+1, any updates ?
@hc-github-team-tf-azure

[liuwuliuyun]

Hi all, I took the liberty of adding a new resource called azurerm_private_endpoint_application_security_group_association to solve the issue. Welcome to comment on my PR.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.