How can I create an Azure Network Security Group / NSG flow log within a Bicep template?

Question

I want to create a NSG flow log for a network security group and storage account I created with Bicep.

I am deploying a NSG like

resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = {
  name: networkSecurityGroupName
  location: location
  properties: {
    securityRules: [
...

and a storage account like

resource stg 'Microsoft.Storage/storageAccounts@2021-01-01' = {
  name: storageName
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}

but when adding and deploying a NSG flow with

resource nsgFlowLogs 'Microsoft.Network/networkWatchers/flowLogs@2020-08-01' = {
  name: 'NetworkWatcher_${location}/${nsgFlowName}'
  location: location
  properties: {
    targetResourceId: nsg.Id
    storageId: stg.Id
    enabled: true
    retentionPolicy: {
      days: 2
      enabled: true
    }
    format: {
      type: 'JSON'
      version: 2
    }
  }
}

I get an error

     | 19:02:20 - Error: Code=ResourceCountExceedsLimitDueToTemplate; Message=Subscription
     | 853049fd-4889-45b6-aad9-f3f54421399c has a quota of 1 for resources of type NetworkWatcher with sku SkuNotSpecified.
     | Subscription currently has 1 resources and the template contains 1 new resources of the this type which exceeds the
     | quota. Please contact support to increase the quota for resource type NetworkWatcher

Answer 1

I turns out that the Network Watcher resource and the corresponding flow log needs to be created in a predefined resource group NetworkWatcherRG .

Hence I extracted a module nsgflowlog.bicep

param name string
param location string = resourceGroup().location
param nsgId string
param storageId string

resource nsgFlowLogs 'Microsoft.Network/networkWatchers/flowLogs@2020-08-01' = {
  name: 'NetworkWatcher_${location}/${name}'
  location: location
  properties: {
    targetResourceId: nsgId
    storageId: storageId
    enabled: true
    retentionPolicy: {
      days: 2
      enabled: true
    }
    format: {
      type: 'JSON'
      version: 2
    }
  }
}

and with that am able to switch the resource group during deployment:

module nsgFlow './nsgflowlog.bicep' = {
  name: '${resourcePrefix}-nsgFlow'
  scope: resourceGroup('NetworkWatcherRG')
  params: {
    name: nsgFlowName
    nsgId: nsg.id
    storageId: stg.id
  }
}