import * as pulumi from "@pulumi/pulumi"; import * as inputs from "../types/input"; import * as outputs from "../types/output"; /** * Manages network rules inside of a Azure Storage Account. * * > **Note:** Network Rules can be defined either directly on the `azure.storage.Account` resource, or using the `azure.storage.AccountNetworkRules` resource - but the two cannot be used together. Spurious changes will occur if both are used against the same Storage Account. * * > **Note:** Only one `azure.storage.AccountNetworkRules` can be tied to an `azure.storage.Account`. Spurious changes will occur if more than `azure.storage.AccountNetworkRules` is tied to the same `azure.storage.Account`. * * > **Note:** Deleting this resource updates the storage account back to the default values it had when the storage account was created. * * ## Example Usage * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as azure from "@pulumi/azure"; * * const example = new azure.core.ResourceGroup("example", { * name: "example-resources", * location: "West Europe", * }); * const exampleVirtualNetwork = new azure.network.VirtualNetwork("example", { * name: "example-vnet", * addressSpaces: ["10.0.0.0/16"], * location: example.location, * resourceGroupName: example.name, * }); * const exampleSubnet = new azure.network.Subnet("example", { * name: "example-subnet", * resourceGroupName: example.name, * virtualNetworkName: exampleVirtualNetwork.name, * addressPrefixes: ["10.0.2.0/24"], * serviceEndpoints: ["Microsoft.Storage"], * }); * const exampleAccount = new azure.storage.Account("example", { * name: "storageaccountname", * resourceGroupName: example.name, * location: example.location, * accountTier: "Standard", * accountReplicationType: "GRS", * tags: { * environment: "staging", * }, * }); * const exampleAccountNetworkRules = new azure.storage.AccountNetworkRules("example", { * storageAccountId: exampleAccount.id, * defaultAction: "Allow", * ipRules: ["127.0.0.1"], * virtualNetworkSubnetIds: [exampleSubnet.id], * bypasses: ["Metrics"], * }); * ``` * * ## API Providers * * * This resource uses the following Azure API Providers: * * * `Microsoft.Storage` - 2025-06-01 * * ## Import * * Storage Account Network Rules can be imported using the `resource id`, e.g. * * ```sh * $ pulumi import azure:storage/accountNetworkRules:AccountNetworkRules storageAcc1 /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/myaccount * ``` */ export declare class AccountNetworkRules extends pulumi.CustomResource { /** * Get an existing AccountNetworkRules resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: AccountNetworkRulesState, opts?: pulumi.CustomResourceOptions): AccountNetworkRules; /** * Returns true if the given object is an instance of AccountNetworkRules. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is AccountNetworkRules; /** * Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Valid options are any combination of `Logging`, `Metrics`, `AzureServices`, or `None`. Defaults to `["AzureServices"]`. * * > **Note:** User has to explicitly set `bypass` to empty slice (`[]`) to remove it. */ readonly bypasses: pulumi.Output; /** * Specifies the default action of allow or deny when no other rules match. Valid options are `Deny` or `Allow`. */ readonly defaultAction: pulumi.Output; /** * List of public IP or IP ranges in CIDR Format. Only IPv4 addresses are allowed. Private IP address ranges (as defined in [RFC 1918](https://tools.ietf.org/html/rfc1918#section-3)) are not allowed. * * > **Note:** Small address ranges using "/31" or "/32" prefix sizes are not supported. These ranges should be configured using individual IP address rules without prefix specified. * * > **Note:** IP network rules have no effect on requests originating from the same Azure region as the storage account. Use Virtual network rules to allow same-region requests. Services deployed in the same region as the storage account use private Azure IP addresses for communication. Thus, you cannot restrict access to specific Azure services based on their public outbound IP address range. * * > **Note:** User has to explicitly set `ipRules` to empty slice (`[]`) to remove it. */ readonly ipRules: pulumi.Output; /** * One or more `privateLinkAccess` block as defined below. */ readonly privateLinkAccessRules: pulumi.Output; /** * Specifies the ID of the storage account. Changing this forces a new resource to be created. */ readonly storageAccountId: pulumi.Output; /** * A list of virtual network subnet ids to secure the storage account. * * > **Note:** User has to explicitly set `virtualNetworkSubnetIds` to empty slice (`[]`) to remove it. */ readonly virtualNetworkSubnetIds: pulumi.Output; /** * Create a AccountNetworkRules resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args: AccountNetworkRulesArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering AccountNetworkRules resources. */ export interface AccountNetworkRulesState { /** * Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Valid options are any combination of `Logging`, `Metrics`, `AzureServices`, or `None`. Defaults to `["AzureServices"]`. * * > **Note:** User has to explicitly set `bypass` to empty slice (`[]`) to remove it. */ bypasses?: pulumi.Input[]>; /** * Specifies the default action of allow or deny when no other rules match. Valid options are `Deny` or `Allow`. */ defaultAction?: pulumi.Input; /** * List of public IP or IP ranges in CIDR Format. Only IPv4 addresses are allowed. Private IP address ranges (as defined in [RFC 1918](https://tools.ietf.org/html/rfc1918#section-3)) are not allowed. * * > **Note:** Small address ranges using "/31" or "/32" prefix sizes are not supported. These ranges should be configured using individual IP address rules without prefix specified. * * > **Note:** IP network rules have no effect on requests originating from the same Azure region as the storage account. Use Virtual network rules to allow same-region requests. Services deployed in the same region as the storage account use private Azure IP addresses for communication. Thus, you cannot restrict access to specific Azure services based on their public outbound IP address range. * * > **Note:** User has to explicitly set `ipRules` to empty slice (`[]`) to remove it. */ ipRules?: pulumi.Input[]>; /** * One or more `privateLinkAccess` block as defined below. */ privateLinkAccessRules?: pulumi.Input[]>; /** * Specifies the ID of the storage account. Changing this forces a new resource to be created. */ storageAccountId?: pulumi.Input; /** * A list of virtual network subnet ids to secure the storage account. * * > **Note:** User has to explicitly set `virtualNetworkSubnetIds` to empty slice (`[]`) to remove it. */ virtualNetworkSubnetIds?: pulumi.Input[]>; } /** * The set of arguments for constructing a AccountNetworkRules resource. */ export interface AccountNetworkRulesArgs { /** * Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Valid options are any combination of `Logging`, `Metrics`, `AzureServices`, or `None`. Defaults to `["AzureServices"]`. * * > **Note:** User has to explicitly set `bypass` to empty slice (`[]`) to remove it. */ bypasses?: pulumi.Input[]>; /** * Specifies the default action of allow or deny when no other rules match. Valid options are `Deny` or `Allow`. */ defaultAction: pulumi.Input; /** * List of public IP or IP ranges in CIDR Format. Only IPv4 addresses are allowed. Private IP address ranges (as defined in [RFC 1918](https://tools.ietf.org/html/rfc1918#section-3)) are not allowed. * * > **Note:** Small address ranges using "/31" or "/32" prefix sizes are not supported. These ranges should be configured using individual IP address rules without prefix specified. * * > **Note:** IP network rules have no effect on requests originating from the same Azure region as the storage account. Use Virtual network rules to allow same-region requests. Services deployed in the same region as the storage account use private Azure IP addresses for communication. Thus, you cannot restrict access to specific Azure services based on their public outbound IP address range. * * > **Note:** User has to explicitly set `ipRules` to empty slice (`[]`) to remove it. */ ipRules?: pulumi.Input[]>; /** * One or more `privateLinkAccess` block as defined below. */ privateLinkAccessRules?: pulumi.Input[]>; /** * Specifies the ID of the storage account. Changing this forces a new resource to be created. */ storageAccountId: pulumi.Input; /** * A list of virtual network subnet ids to secure the storage account. * * > **Note:** User has to explicitly set `virtualNetworkSubnetIds` to empty slice (`[]`) to remove it. */ virtualNetworkSubnetIds?: pulumi.Input[]>; }