# Unable to create subnet due to policy deny subnet with NSG

**URL:** <https://discuss.hashicorp.com/t/unable-to-create-subnet-due-to-policy-deny-subnet-with-nsg/39419>\
**Category:** Azure\
**Created:** [May 12, 2022, 11:42am UTC](https://discuss.hashicorp.com/t/unable-to-create-subnet-due-to-policy-deny-subnet-with-nsg/39419 "2022-05-12T11:42:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RajN](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/rajn/32/15966_2.png) [@RajN](https://discuss.hashicorp.com/u/RajN)\
**Post date:** [May 12, 2022, 11:42am UTC](https://discuss.hashicorp.com/t/unable-to-create-subnet-due-to-policy-deny-subnet-with-nsg/39419/1 "2022-05-12T11:42:13Z")

</div>

I am using Terraform to deploy vnet and subnets.

Recently a new Azure security policy was applied “deny subnet with NSG”. This policy does not allow subnet to be created unless the NSG and Routes are linked to it. This is our security requirement to have NSG even during the Subnet is created for the first time.  
Due to this policy all of the current Terraform scripts are broken.

Is there any way or option whereby I can link NSG at the Subnet Creation level. I do not want to revert the code to ARM template which will fix it.

My sample code looks like as below which uses azurerm\_subnet\_network\_security\_group\_association:

resource “azurerm\_subnet” “test\_subnets” {  
count = length(var.totalsubnets)  
name = lookup((var.csubnets[count.index]), “name”)  
resource\_group\_name = azurerm\_resource\_group.our\_rg.name  
virtual\_network\_name = azurerm\_virtual\_network.our\_vnet.name  
address\_prefixes = [lookup((var.our\_subnets[count.index]), “address\_prefix”)]  
service\_endpoints = var.service\_endpoints  
}

resource “azurerm\_network\_security\_group” “nsgs” {  
count = length(var.our\_subnets)  
name = “{var.our\_vnet["name"]}-nsg-{lookup((var.our\_subnets[count.index]), “name”)}”  
location = azurerm\_resource\_group.our\_rg.location  
resource\_group\_name = azurerm\_resource\_group.our\_rg.name  
}

resource “azurerm\_subnet\_network\_security\_group\_association” “nsg\_associations” {  
count = length(var.our\_subnets)  
subnet\_id = azurerm\_subnet.our\_subnets[count.index].id  
network\_security\_group\_id = azurerm\_network\_security\_group.nsgs[count.index].id

depends\_on = [azurerm\_network\_security\_group.nsgs, azurerm\_subnet.our\_subnets]  
}

---

<div class="post-metadata">

**Author:** ![thesse1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/thesse1/32/37201_2.png) [@thesse1](https://discuss.hashicorp.com/u/thesse1)\
**Post date:** [August 4, 2023, 5:29am UTC](https://discuss.hashicorp.com/t/unable-to-create-subnet-due-to-policy-deny-subnet-with-nsg/39419/2 "2023-08-04T05:29:18Z")

</div>

Hi @RajN, I ran into the same issue. Did you find a workaround for this? Thanks!

---

<div class="post-metadata">

**Author:** ![saikat.das](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/saikat.das/32/44161_2.png) [@saikat.das](https://discuss.hashicorp.com/u/saikat.das)\
**Post date:** [February 12, 2025, 12:04pm UTC](https://discuss.hashicorp.com/t/unable-to-create-subnet-due-to-policy-deny-subnet-with-nsg/39419/3 "2025-02-12T12:04:36Z")

</div>

Hi ,Have you got any update on this ? If yes please help me

---

<div class="post-metadata">

**Author:** ![abhisarika.151](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/abhisarika.151/32/44500_2.png) [@abhisarika.151](https://discuss.hashicorp.com/u/abhisarika.151)\
**Post date:** [February 21, 2025, 2:32am UTC](https://discuss.hashicorp.com/t/unable-to-create-subnet-due-to-policy-deny-subnet-with-nsg/39419/4 "2025-02-21T02:32:59Z")

</div>

Hi All,

I facing the similar issue. Did any of you guys got any solution ?

Regards,  
Ak