Provisioning a Network Security Group

1. Start Locally

Firstly, we need to launch Locally which we can do from a terminal by running:

Once Locally has started, the Locally Dashboard will open automatically:

2. Create a Resource Group

Next we can create the Resource Group:

There's two things to note here:

1. The Azure CLI supports Automatic Configuration, meaning that it can automatically be configured to work against Locally just by prefixing commands with locally run.
2. Locally intentionally uses a different set of locations to Azure as a safety precaution, so that you can be confident you're deploying against Locally rather than regular Azure. You can also configure Locally to use the Azure locations too, but you'll want to be extra sure that you're prefixing commands with locally run when you do.

3. Create the Network Security Group

With the Resource Group in place, we can create the Network Security Group itself. An NSG is just a container for rules, so creating one is straightforward:

{
  "name": "sample-nsg",
  "state": "Succeeded"
}

4. Add a security rule

The interesting part is the rules. Each rule needs a priority - lower numbers are evaluated first - along with a direction, an action and what traffic it matches. Here we'll allow inbound HTTPS:

{
  "access": "Allow",
  "direction": "Inbound",
  "name": "allow-https",
  "port": "443",
  "priority": 100
}

We can list the rules we've defined:

Name         Priority    Access    Port
-----------  ----------  --------  ------
allow-https  100         Allow     443

We can see the Network Security Group in the Locally Dashboard too:

5. Tidy up

Finally, we can tidy up. To remove the Resource Group and everything within it:

There's nothing billable to clean up, since everything ran on your machine, but it's still worth checking your teardown scripts work here before you run them against Azure.

Doing this with other tooling

Whilst this guide used the Azure CLI, Network Security Groups work the same way through any of the tooling that Locally supports - a Microsoft.Network/networkSecurityGroups resource in HashiCorp Terraform or OpenTofu, Pulumi, Bicep or an ARM Template all provision against Locally in the same way, with only the location changed.

Next steps

To attach the group to a subnet, see Virtual Network. For outbound traffic from that subnet, see NAT Gateway.

Should you encounter any issues, please take a look at the troubleshooting section.