Configure Azure Hybrid Network Configuration Groups

The azure-native:hybridnetwork:ConfigurationGroupValue resource, part of the Pulumi Azure Native provider, stores configuration data for Azure Hybrid Network deployments by binding JSON values to validation schemas. This guide focuses on two capabilities: open configuration values and secret configuration handling.

Configuration group values reference existing configuration group schemas that define validation rules and structure. The examples are intentionally small. Combine them with your own schemas and network function definitions.

Provide configuration values for network function deployment

Hybrid network deployments require configuration values that define how network functions connect and operate, validated against a schema.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const configurationGroupValue = new azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue", {
    configurationGroupValueName: "testConfigurationGroupValue",
    location: "eastus",
    properties: {
        configurationGroupSchemaResourceReference: {
            id: "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
            idType: "Open",
        },
        configurationType: "Open",
        configurationValue: "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
    },
    resourceGroupName: "rg1",
});

import pulumi
import pulumi_azure_native as azure_native

configuration_group_value = azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue",
    configuration_group_value_name="testConfigurationGroupValue",
    location="eastus",
    properties={
        "configuration_group_schema_resource_reference": {
            "id": "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
            "id_type": "Open",
        },
        "configuration_type": "Open",
        "configuration_value": "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
    },
    resource_group_name="rg1")

package main

import (
	hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := hybridnetwork.NewConfigurationGroupValue(ctx, "configurationGroupValue", &hybridnetwork.ConfigurationGroupValueArgs{
			ConfigurationGroupValueName: pulumi.String("testConfigurationGroupValue"),
			Location:                    pulumi.String("eastus"),
			Properties: &hybridnetwork.ConfigurationValueWithoutSecretsArgs{
				ConfigurationGroupSchemaResourceReference: hybridnetwork.OpenDeploymentResourceReference{
					Id:     "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
					IdType: "Open",
				},
				ConfigurationType:  pulumi.String("Open"),
				ConfigurationValue: pulumi.String("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}"),
			},
			ResourceGroupName: pulumi.String("rg1"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var configurationGroupValue = new AzureNative.HybridNetwork.ConfigurationGroupValue("configurationGroupValue", new()
    {
        ConfigurationGroupValueName = "testConfigurationGroupValue",
        Location = "eastus",
        Properties = new AzureNative.HybridNetwork.Inputs.ConfigurationValueWithoutSecretsArgs
        {
            ConfigurationGroupSchemaResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
            {
                Id = "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
                IdType = "Open",
            },
            ConfigurationType = "Open",
            ConfigurationValue = "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
        },
        ResourceGroupName = "rg1",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValue;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValueArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var configurationGroupValue = new ConfigurationGroupValue("configurationGroupValue", ConfigurationGroupValueArgs.builder()
            .configurationGroupValueName("testConfigurationGroupValue")
            .location("eastus")
            .properties(ConfigurationValueWithoutSecretsArgs.builder()
                .configurationGroupSchemaResourceReference(OpenDeploymentResourceReferenceArgs.builder()
                    .id("/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName")
                    .idType("Open")
                    .build())
                .configurationType("Open")
                .configurationValue("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}")
                .build())
            .resourceGroupName("rg1")
            .build());

    }
}

resources:
  configurationGroupValue:
    type: azure-native:hybridnetwork:ConfigurationGroupValue
    properties:
      configurationGroupValueName: testConfigurationGroupValue
      location: eastus
      properties:
        configurationGroupSchemaResourceReference:
          id: /subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName
          idType: Open
        configurationType: Open
        configurationValue: '{"interconnect-groups":{"stripe-one":{"name":"Stripe one","international-interconnects":["france","germany"],"domestic-interconnects":["birmingham","edinburgh"]},"stripe-two":{"name":"Stripe two","international-interconnects":["germany","italy"],"domestic-interconnects":["edinburgh","london"]}},"interconnect-group-assignments":{"ssc-one":{"ssc":"SSC 1","interconnects":"stripe-one"},"ssc-two":{"ssc":"SSC 2","interconnects":"stripe-two"}}}'
      resourceGroupName: rg1

The configurationGroupSchemaResourceReference points to a schema that validates the JSON structure. The configurationType property set to “Open” means the configuration data is not encrypted and will be visible in API responses. The configurationValue contains JSON-formatted settings that match the schema’s expected structure. In this example, the JSON defines interconnect groups and their assignments for network routing.

Store sensitive configuration using secret values

When configuration includes credentials or sensitive parameters, the secret configuration type prevents exposure in logs or API responses.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const configurationGroupValue = new azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue", {
    configurationGroupValueName: "testConfigurationGroupValue",
    location: "eastus",
    properties: {
        configurationGroupSchemaResourceReference: {
            id: "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
            idType: "Open",
        },
        configurationType: "Secret",
        secretConfigurationValue: "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
    },
    resourceGroupName: "rg1",
});

import pulumi
import pulumi_azure_native as azure_native

configuration_group_value = azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue",
    configuration_group_value_name="testConfigurationGroupValue",
    location="eastus",
    properties={
        "configuration_group_schema_resource_reference": {
            "id": "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
            "id_type": "Open",
        },
        "configuration_type": "Secret",
        "secret_configuration_value": "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
    },
    resource_group_name="rg1")

package main

import (
	hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := hybridnetwork.NewConfigurationGroupValue(ctx, "configurationGroupValue", &hybridnetwork.ConfigurationGroupValueArgs{
			ConfigurationGroupValueName: pulumi.String("testConfigurationGroupValue"),
			Location:                    pulumi.String("eastus"),
			Properties: &hybridnetwork.ConfigurationValueWithSecretsArgs{
				ConfigurationGroupSchemaResourceReference: hybridnetwork.OpenDeploymentResourceReference{
					Id:     "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
					IdType: "Open",
				},
				ConfigurationType:        pulumi.String("Secret"),
				SecretConfigurationValue: pulumi.String("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}"),
			},
			ResourceGroupName: pulumi.String("rg1"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var configurationGroupValue = new AzureNative.HybridNetwork.ConfigurationGroupValue("configurationGroupValue", new()
    {
        ConfigurationGroupValueName = "testConfigurationGroupValue",
        Location = "eastus",
        Properties = new AzureNative.HybridNetwork.Inputs.ConfigurationValueWithSecretsArgs
        {
            ConfigurationGroupSchemaResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
            {
                Id = "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
                IdType = "Open",
            },
            ConfigurationType = "Secret",
            SecretConfigurationValue = "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
        },
        ResourceGroupName = "rg1",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValue;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValueArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var configurationGroupValue = new ConfigurationGroupValue("configurationGroupValue", ConfigurationGroupValueArgs.builder()
            .configurationGroupValueName("testConfigurationGroupValue")
            .location("eastus")
            .properties(ConfigurationValueWithSecretsArgs.builder()
                .configurationGroupSchemaResourceReference(OpenDeploymentResourceReferenceArgs.builder()
                    .id("/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName")
                    .idType("Open")
                    .build())
                .configurationType("Secret")
                .secretConfigurationValue("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}")
                .build())
            .resourceGroupName("rg1")
            .build());

    }
}

resources:
  configurationGroupValue:
    type: azure-native:hybridnetwork:ConfigurationGroupValue
    properties:
      configurationGroupValueName: testConfigurationGroupValue
      location: eastus
      properties:
        configurationGroupSchemaResourceReference:
          id: /subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName
          idType: Open
        configurationType: Secret
        secretConfigurationValue: '{"interconnect-groups":{"stripe-one":{"name":"Stripe one","international-interconnects":["france","germany"],"domestic-interconnects":["birmingham","edinburgh"]},"stripe-two":{"name":"Stripe two","international-interconnects":["germany","italy"],"domestic-interconnects":["edinburgh","london"]}},"interconnect-group-assignments":{"ssc-one":{"ssc":"SSC 1","interconnects":"stripe-one"},"ssc-two":{"ssc":"SSC 2","interconnects":"stripe-two"}}}'
      resourceGroupName: rg1

Setting configurationType to “Secret” changes how Azure stores and returns the configuration. The secretConfigurationValue property holds the sensitive JSON data, which Azure encrypts and never returns in API responses. The configuration structure remains identical to open configurations, but the data is protected from exposure.

Beyond these examples

These snippets focus on specific configuration group value features: open and secret configuration types, and schema-validated JSON configuration. They’re intentionally minimal rather than full network function deployments.

The examples reference pre-existing infrastructure such as configuration group schemas and resource groups. They focus on storing configuration data rather than provisioning the schemas or network functions that consume the values.

To keep things focused, common configuration patterns are omitted, including:

  • Resource tagging (tags property)
  • Schema reference type variations (Open vs Secret idType)
  • Configuration value structure and validation rules

These omissions are intentional: the goal is to illustrate how configuration group values are wired, not provide drop-in network function modules. See the ConfigurationGroupValue resource reference for all available configuration options.

Let's configure Azure Hybrid Network Configuration Groups

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Configuration Types & Schema References
What's the difference between configurationType 'Open' and 'Secret'?
When configurationType is "Open", provide configuration data in the configurationValue property. When it’s "Secret", use secretConfigurationValue instead. Both accept JSON strings with your configuration data.
What's the difference between idType 'Open' and 'Secret' in the schema reference?
The configurationGroupSchemaResourceReference can use OpenDeploymentResourceReference (with idType: "Open") or SecretDeploymentResourceReference (with idType: "Secret"). This choice is independent from configurationType, as shown in the third example where idType: "Secret" is used with configurationType: "Open".
Immutability & Resource Lifecycle
Which properties can't be changed after creating the resource?
The location, configurationGroupValueName, and resourceGroupName properties are immutable and cannot be modified after resource creation.
API Versions & Compatibility
How do I use an older API version like 2023-09-01?
Generate a local SDK package using the Pulumi CLI command pulumi package add azure-native hybridnetwork [ApiVersion], replacing [ApiVersion] with your desired version like 2023-09-01.

Using a different cloud?

Explore networking guides for other cloud providers:

AWS Guides GCP Guides