Skip to content

Commit 85c14ba

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #314487 from asudbring/us568274-nat-terraform
Add Terraform tab to manage NAT gateway V2 article
2 parents dec9718 + 05e92a5 commit 85c14ba

1 file changed

Lines changed: 205 additions & 3 deletions

File tree

‎articles/nat-gateway/manage-nat-gateway-v2.md‎

Lines changed: 205 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ author: asudbring
66
ms.author: allensu
77
ms.service: azure-nat-gateway
88
ms.topic: how-to
9-
ms.date: 03/06/2026
10-
ms.custom: template-how-to, devx-track-azurecli, devx-track-azurepowershell, devx-track-bicep
9+
ms.date: 04/08/2026
10+
ms.custom: template-how-to, devx-track-azurecli, devx-track-azurepowershell, devx-track-bicep, devx-track-terraform
1111
#Customer intent: As a network administrator, I want to learn how to create and remove a NAT gateway resource from a virtual network subnet. I also want to learn how to add and remove public IP addresses and prefixes used for outbound connectivity.
1212
---
1313

@@ -91,11 +91,25 @@ To use Azure CLI for this article, you need:
9191

9292
- The example NAT gateway is named **nat-gateway**.
9393

94+
# [**Terraform**](#tab/manage-nat-terraform)
95+
96+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).
97+
98+
- An existing Azure Virtual Network and subnet. For more information, see [Quickstart: Create a virtual network using the Azure portal](../virtual-network/quick-create-portal.md).
99+
100+
- The example virtual network that is used in this article is named **vnet-1**.
101+
102+
- The example subnet is named **subnet-1**.
103+
104+
- The example NAT gateway is named **nat-gateway**.
105+
106+
- [Installation and configuration of Terraform](/azure/developer/terraform/quickstart-configure).
107+
94108
---
95109

96110
## Create a NAT gateway and associate it with an existing subnet
97111

98-
You can create a NAT gateway resource and add it to an existing subnet by using the Azure portal, Azure PowerShell, Azure CLI, or Bicep.
112+
You can create a NAT gateway resource and add it to an existing subnet by using the Azure portal, Azure PowerShell, Azure CLI, Bicep, or Terraform.
99113

100114
# [**Azure portal**](#tab/manage-nat-portal)
101115

@@ -421,6 +435,100 @@ resource updatedSubnet 'Microsoft.Network/virtualNetworks/subnets@2024-05-01' =
421435
}
422436
```
423437

438+
# [**Terraform**](#tab/manage-nat-terraform)
439+
440+
### Public IP address
441+
442+
To create a NAT gateway with a public IP address, create a file named *main.tf* with the following Terraform configuration. The configuration creates a StandardV2 public IP address, a StandardV2 NAT gateway, and associates the NAT gateway with an existing subnet.
443+
444+
> [!NOTE]
445+
> The `zones` argument must be omitted when `sku_name` is set to `StandardV2`. StandardV2 NAT gateways are zone-redundant by default.
446+
447+
```hcl
448+
resource "azurerm_public_ip" "nat" {
449+
name = "public-ip-nat"
450+
location = "eastus2"
451+
resource_group_name = "test-rg"
452+
allocation_method = "Static"
453+
sku = "StandardV2"
454+
sku_tier = "Regional"
455+
ip_version = "IPv4"
456+
zones = ["1", "2", "3"]
457+
}
458+
459+
resource "azurerm_nat_gateway" "nat" {
460+
name = "nat-gateway"
461+
location = "eastus2"
462+
resource_group_name = "test-rg"
463+
sku_name = "StandardV2"
464+
idle_timeout_in_minutes = 4
465+
}
466+
467+
resource "azurerm_nat_gateway_public_ip_association" "nat" {
468+
nat_gateway_id = azurerm_nat_gateway.nat.id
469+
public_ip_address_id = azurerm_public_ip.nat.id
470+
}
471+
472+
data "azurerm_subnet" "subnet" {
473+
name = "subnet-1"
474+
virtual_network_name = "vnet-1"
475+
resource_group_name = "test-rg"
476+
}
477+
478+
resource "azurerm_subnet_nat_gateway_association" "subnet" {
479+
subnet_id = data.azurerm_subnet.subnet.id
480+
nat_gateway_id = azurerm_nat_gateway.nat.id
481+
}
482+
```
483+
484+
### Public IP prefix
485+
486+
To create a NAT gateway with a public IP prefix, create a file named *main.tf* with the following Terraform configuration.
487+
488+
```hcl
489+
resource "azurerm_public_ip_prefix" "nat" {
490+
name = "public-ip-prefix-nat"
491+
location = "eastus2"
492+
resource_group_name = "test-rg"
493+
prefix_length = 31
494+
sku = "StandardV2"
495+
ip_version = "IPv4"
496+
zones = ["1", "2", "3"]
497+
}
498+
499+
resource "azurerm_nat_gateway" "nat" {
500+
name = "nat-gateway"
501+
location = "eastus2"
502+
resource_group_name = "test-rg"
503+
sku_name = "StandardV2"
504+
idle_timeout_in_minutes = 4
505+
}
506+
507+
resource "azurerm_nat_gateway_public_ip_prefix_association" "nat" {
508+
nat_gateway_id = azurerm_nat_gateway.nat.id
509+
public_ip_prefix_id = azurerm_public_ip_prefix.nat.id
510+
}
511+
512+
data "azurerm_subnet" "subnet" {
513+
name = "subnet-1"
514+
virtual_network_name = "vnet-1"
515+
resource_group_name = "test-rg"
516+
}
517+
518+
resource "azurerm_subnet_nat_gateway_association" "subnet" {
519+
subnet_id = data.azurerm_subnet.subnet.id
520+
nat_gateway_id = azurerm_nat_gateway.nat.id
521+
}
522+
```
523+
524+
Run the following commands to deploy the configuration:
525+
526+
```terraform
527+
terraform init
528+
terraform plan
529+
terraform apply
530+
```
531+
424532
---
425533

426534
## Remove a NAT gateway from an existing subnet and delete the resource
@@ -547,6 +655,27 @@ resource updatedSubnet 'Microsoft.Network/virtualNetworks/subnets@2024-05-01' =
547655
}
548656
```
549657

658+
# [**Terraform**](#tab/manage-nat-terraform)
659+
660+
To remove a NAT gateway from a subnet and delete the resource, remove the `azurerm_subnet_nat_gateway_association`, `azurerm_nat_gateway`, and any associated public IP resources from your Terraform configuration, then apply the changes.
661+
662+
If you only want to remove the NAT gateway association from the subnet, remove the `azurerm_subnet_nat_gateway_association` resource from your configuration:
663+
664+
```hcl
665+
# Remove this resource block from your configuration to disassociate the NAT gateway from the subnet
666+
# resource "azurerm_subnet_nat_gateway_association" "subnet" {
667+
# subnet_id = data.azurerm_subnet.subnet.id
668+
# nat_gateway_id = azurerm_nat_gateway.nat.id
669+
# }
670+
```
671+
672+
To delete the NAT gateway and all its associations, remove the NAT gateway and all association resource blocks from your configuration. Run the following commands to apply the changes:
673+
674+
```terraform
675+
terraform plan
676+
terraform apply
677+
```
678+
550679
---
551680

552681
> [!NOTE]
@@ -736,6 +865,43 @@ az network nat gateway update \
736865

737866
Use the Azure portal, Azure PowerShell, or Azure CLI to add or remove a public IP address from a NAT gateway.
738867

868+
# [**Terraform**](#tab/manage-nat-terraform)
869+
870+
### Add public IP address
871+
872+
To add a public IP address to the NAT gateway, add a new `azurerm_public_ip` resource and a new `azurerm_nat_gateway_public_ip_association` resource to your Terraform configuration.
873+
874+
In this example, the existing public IP address associated with the NAT gateway is named **public-ip-nat**.
875+
876+
```hcl
877+
resource "azurerm_public_ip" "nat2" {
878+
name = "public-ip-nat2"
879+
location = "eastus2"
880+
resource_group_name = "test-rg"
881+
allocation_method = "Static"
882+
sku = "StandardV2"
883+
sku_tier = "Regional"
884+
ip_version = "IPv4"
885+
zones = ["1", "2", "3"]
886+
}
887+
888+
resource "azurerm_nat_gateway_public_ip_association" "nat2" {
889+
nat_gateway_id = azurerm_nat_gateway.nat.id
890+
public_ip_address_id = azurerm_public_ip.nat2.id
891+
}
892+
```
893+
894+
### Remove public IP address
895+
896+
To remove a public IP address from the NAT gateway, remove the corresponding `azurerm_nat_gateway_public_ip_association` resource block from your configuration. You can also remove the `azurerm_public_ip` resource if it's no longer needed.
897+
898+
Run the following commands to apply the changes:
899+
900+
```terraform
901+
terraform plan
902+
terraform apply
903+
```
904+
739905
---
740906

741907
## Add or remove a public IP prefix
@@ -922,6 +1088,42 @@ az network nat gateway update \
9221088

9231089
Use the Azure portal, Azure PowerShell, or Azure CLI to add or remove a public IP prefix from a NAT gateway.
9241090

1091+
# [**Terraform**](#tab/manage-nat-terraform)
1092+
1093+
### Add public IP prefix
1094+
1095+
To add a public IP prefix to the NAT gateway, add a new `azurerm_public_ip_prefix` resource and a new `azurerm_nat_gateway_public_ip_prefix_association` resource to your Terraform configuration.
1096+
1097+
In this example, the existing public IP prefix associated with the NAT gateway is named **public-ip-prefix-nat**.
1098+
1099+
```hcl
1100+
resource "azurerm_public_ip_prefix" "nat2" {
1101+
name = "public-ip-prefix-nat2"
1102+
location = "eastus2"
1103+
resource_group_name = "test-rg"
1104+
prefix_length = 31
1105+
sku = "StandardV2"
1106+
ip_version = "IPv4"
1107+
zones = ["1", "2", "3"]
1108+
}
1109+
1110+
resource "azurerm_nat_gateway_public_ip_prefix_association" "nat2" {
1111+
nat_gateway_id = azurerm_nat_gateway.nat.id
1112+
public_ip_prefix_id = azurerm_public_ip_prefix.nat2.id
1113+
}
1114+
```
1115+
1116+
### Remove public IP prefix
1117+
1118+
To remove a public IP prefix from the NAT gateway, remove the corresponding `azurerm_nat_gateway_public_ip_prefix_association` resource block from your configuration. You can also remove the `azurerm_public_ip_prefix` resource if it's no longer needed.
1119+
1120+
Run the following commands to apply the changes:
1121+
1122+
```terraform
1123+
terraform plan
1124+
terraform apply
1125+
```
1126+
9251127
---
9261128

9271129
## Next steps

0 commit comments

Comments
 (0)