🛡️ Azure Subscription Network Watcher is not enabled in every region in use🟢⚪
- Contextual name: 🛡️ Network Watcher is not enabled in every region in use🟢⚪
- ID:
/ce/ca/azure/subscription/network-watcher-in-every-available-region - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY,RELIABILITY
Stats
not available
Similar Policies
- Cloud Conformity: Enable Azure Network Watcher
- Internal:
dec-x-629108da
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-x-629108da | 1 |
Description
Description
Enable Network Watcher for physical regions in Azure subscriptions where network resources are in use.
Rationale
Network diagnostic and visualization tools available with Network Watcher help users understand, diagnose, and gain insights to the network in Azure.
Impact
There are additional costs per transaction to run and store network data. For high-volume networks these charges will add up quickly.
Audit
Review the Network Watcher service and confirm that a Network Watcher exists with
provisioningStateset toSucceededfor each Azure region in use by the subscription.Default Value
Network Watcher is automatically enabled. When you create or update a virtual network in your subscription, Network Watcher will be enabled automatically in your Virtual Network's region. There is no impact to your resources or associated charge for automatically enabling Network Watcher.
References
- https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
- https://learn.microsoft.com/en-us/cli/azure/network/watcher?view=azure-cli-latest
... see more
Remediation
Remediation
Opting out of Network Watcher automatic enablement is a permanent change. Once you opt-out you cannot opt-in without contacting support. To manually enable Network Watcher in each region where you want to use Network Watcher capabilities, follow the steps below.
From Azure Portal
- Go to
Network Watcher.- Click
Create.- Select a
Regionfrom the drop-down menu.- Click
Add.From Azure CLI
az network watcher configure \
--locations {{region}} \
--enabled true \
--resource-group {{resource-group-name}}