从 NSG 中删除子网

Question

I have a problem when I try to remove a subnet from a NSG, for an automatic process to destroy some components inside the resource group.

When I try to run this command, I don't have issues to remove the NSG association with one subnet.

- name: Dissociate NSG from subnet
  environment:
    AZURE_CONFIG_DIR: ./.azure
  shell: az network vnet subnet update -g Networks -n '{{ subnetName }}' --vnet-name '{{ vnetName }}' --network-security-group "" --subscription '{{ subscription }}'
  ignore_errors: yes

The problem is when I have 2 or more subnets (for different components) associate in a NSG.

And If I run the command in the bash on Azure, I get this error:

az network vnet subnet update: error: argument --network-security-group: expected one argument
   usage: az network vnet subnet update [-h] [--verbose] [--debug]
                 [--output {json,jsonc,table,tsv,yaml,none}]

I am trying to see how I can disassociate all the subnets it contains in the NSG, without having to make several blocks for each subnets.

Answer 1

you could do something like this:

az network nsg show -n nsg_name -g rg_name --query 'subnets[].id' -o tsv

to find out all the subnets that the NSG is attached to and then you can use those to remove NSG's from those subnets.

az network vnet subnet update --ids [] (resource IDs space-delimited) --network-security-group ""

or you could iterate them one by one:

az network nsg show -n nsg_name -g rg_name --query 'subnets[].id' -o tsv |
  xargs -L 1 az network vnet subnet update --network-security-group "" --ids