如何在Azure中用Python通过Subnet ID创建Network Security Group及子网对应键

Hey there! Let's break down exactly how to create a Network Security Group (NSG) in Azure using Python and link it to a subnet via its ID, plus clarify the subnet configuration keys you’ll need for this process.

First, make sure you have the necessary tools and permissions in place:

• Install the required Azure SDK packages for Python:

  pip install azure-mgmt-network azure-identity
  

• Ensure your Azure identity (whether it's a service principal, managed identity, or your user account) has the Network Contributor role (or equivalent) on the target resource group and subnet. This lets you create NSGs and modify subnet configurations.

Here’s a complete, working example that creates an NSG and links it to your target subnet using its ID:

from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

# Initialize authentication and network client
credential = DefaultAzureCredential()
subscription_id = "your-subscription-id"  # Replace with your subscription ID
network_client = NetworkManagementClient(credential, subscription_id)

# Define your resource details
resource_group_name = "your-resource-group-name"
nsg_name = "my-new-nsg"
subnet_id = "/subscriptions/your-sub-id/resourceGroups/your-rg/providers/Microsoft.Network/virtualNetworks/your-vnet-name/subnets/your-subnet-name"
vnet_name = "your-vnet-name"  # Required for subnet update operation
subnet_name = "your-subnet-name"  # Required for subnet update operation

# Step 1: Create the Network Security Group
nsg_config = {
    "location": "eastus"  # Must match your subnet's region!
}

# Execute NSG creation
created_nsg = network_client.network_security_groups.begin_create_or_update(
    resource_group_name=resource_group_name,
    network_security_group_name=nsg_name,
    parameters=nsg_config
).result()

print(f"NSG '{created_nsg.name}' created successfully. ID: {created_nsg.id}")

# Step 2: Associate the NSG with the subnet
subnet_update_config = {
    "network_security_group": {
        "id": created_nsg.id  # Link the new NSG using its resource ID
    }
}

# Update the subnet to attach the NSG
updated_subnet = network_client.subnets.begin_create_or_update(
    resource_group_name=resource_group_name,
    virtual_network_name=vnet_name,
    subnet_name=subnet_name,
    parameters=subnet_update_config
).result()

print(f"NSG '{nsg_name}' is now linked to subnet '{updated_subnet.name}'")

When configuring the subnet to link with an NSG, these are the critical keys you need to know:

• network_security_group: This is the top-level dictionary key in your subnet parameters that defines the NSG association. It requires one nested key:
  • id: The full Azure resource ID of the NSG you want to attach. This is the only mandatory property here—Azure uses this ID to locate and link the NSG to the subnet.

Important Notes: #

• You don’t need to specify all subnet properties when updating the NSG association. Just including the network_security_group dictionary will overwrite the existing NSG link (or set it if none existed before).
• The NSG and subnet must be in the same Azure region—cross-region associations aren’t allowed.
• A subnet can only be linked to one NSG at a time. If you attach a new NSG, it replaces any existing NSG association.

内容的提问来源于stack exchange，提问作者Hushen