Add Network Watcher resource to fix NSG flow logs deployment failures

[Copilot]

Deployments were failing when Azure Policy attempted to create NSG flow logs without the parent Network Watcher resource existing. The error manifested as ParentResourceNotFound for networkWatchers/flowLogs resources.

Changes

• New module: shared/bicep/modules/network-watcher/v1/network-watcher.bicep

  • Creates Network Watcher with standard Azure naming: NetworkWatcher_<location>

• Updated infrastructure files:

  • infrastructure/afd-apim-pe/main.bicep
  • infrastructure/appgw-apim-pe/main.bicep
  • infrastructure/appgw-apim/main.bicep

  Each now deploys Network Watcher before NSG resources with explicit dependency:

// 3. Network Watcher (required for NSG flow logs)
module networkWatcherModule '../../shared/bicep/modules/network-watcher/v1/network-watcher.bicep' = {
  name: 'networkWatcherModule'
  params: {
    location: location
  }
}

// 4. Virtual Network and Subnets
resource nsg 'Microsoft.Network/networkSecurityGroups@2025-01-01' = {
  name: 'nsg-default'
  location: location
  dependsOn: [
    networkWatcherModule
  ]
}

This ensures Network Watcher exists before any NSG flow log creation is attempted.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• aka.ms
  • Triggering command: /usr/local/bin/bicep bicep build main.bicep (dns block)
  • Triggering command: /usr/local/bin/bicep bicep build infrastructure/afd-apim-pe/main.bicep (dns block)
  • Triggering command: /usr/local/bin/bicep bicep build infrastructure/appgw-apim/main.bicep (dns block)
• eastus.data.mcr.microsoft.com
  • Triggering command: /usr/local/bin/bicep bicep build infrastructure/appgw-apim/main.bicep (dns block)
  • Triggering command: /usr/local/bin/bicep bicep build infrastructure/appgw-apim-pe/main.bicep (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

I am seeing deployment errors for the nsg flow logs. It looks like Network watcher is not yet in place.

{
"code": "DeploymentFailed",
"target": "/subscriptions/5fb73327-9152-4f64-bf8a-90dc0cc4ad8f/resourceGroups/apim-infra-afd-apim-pe-1/providers/Microsoft.Resources/deployments/nsgFlowLogsApimModule",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
"details": [
{
"code": "ParentResourceNotFound",
"message": "Failed to perform 'write' on resource(s) of type 'networkWatchers/flowLogs', because the parent resource '/subscriptions/5fb73327-9152-4f64-bf8a-90dc0cc4ad8f/resourceGroups/apim-infra-afd-apim-pe-1/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus2' could not be found."
}
]
}

{
"code": "DeploymentFailed",
"target": "/subscriptions/5fb73327-9152-4f64-bf8a-90dc0cc4ad8f/resourceGroups/apim-infra-afd-apim-pe-1/providers/Microsoft.Resources/deployments/nsgFlowLogsAcaModule",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
"details": [
{
"code": "ParentResourceNotFound",
"message": "Failed to perform 'write' on resource(s) of type 'networkWatchers/flowLogs', because the parent resource '/subscriptions/5fb73327-9152-4f64-bf8a-90dc0cc4ad8f/resourceGroups/apim-infra-afd-apim-pe-1/providers/Microsoft.Network/networkWatchers/NetworkWatcher_eastus2' could not be found."
}
]
}

The user has attached the following file paths as relevant context:

• .github\copilot-instructions.md

Created from VS Code.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.