How to fix Error: Error deleting Network Security Group: InUseNetworkSecurityGroupCannotBeDeleted in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 30, 2025· 107 views

This error occurs when Terraform attempts to delete an Azure Network Security Group (NSG) that is still associated with network interfaces or subnets. The deletion fails because Azure prevents removal of in-use resources, requiring dependent resources to be removed first.

Quick fix

Fixes InUseNetworkSecurityGroupCannotBeDeleted

az network nsg show --name my-nsg --resource-group my-rg
  1. Check current NSG associations in Azure Portal
  2. Remove NSG-subnet associations via Terraform
  3. Remove NSG-network interface associations
  4. Delete associated network interfaces first
terraform — error
az network nsg show --name my-nsg --resource-group my-rg
Error: Error deleting Network Security Group: InUseNetworkSecurityGroupCannotBeDeleted

What this error means

Azure Network Security Groups (NSGs) manage inbound and outbound traffic rules for network interfaces and subnets. When you attempt to delete an NSG using Terraform, Azure checks if the resource is currently in use. If the NSG is still associated with active network interfaces, subnets, or other resources, the Azure API rejects the deletion with the InUseNetworkSecurityGroupCannotBeDeleted error. This is a safety mechanism to prevent accidental removal of security configurations that are actively protecting network resources.

Typical symptoms

  • terraform destroy fails with 'InUseNetworkSecurityGroupCannotBeDeleted' error
  • NSG deletion hangs or times out during Terraform apply
  • Error message shows NSG is still associated with network interfaces
  • Partial infrastructure deletion with NSG remaining
  • Subsequent destroy runs fail at the same NSG

Common causes

  1. Network interfaces are not deleted before the NSG deletion attempt
  2. Subnets still have active associations with the NSG
  3. Resource deletion order is incorrect in Terraform configuration
  4. In-line security rules conflict with standalone association resources
  5. Azure API is still processing deletions of dependent resources (asynchronous operations not yet complete)
  6. Manual associations in Azure Portal not reflected in Terraform state

How to fix "Error: Error deleting Network Security Group: InUseNetworkSecurityGroupCannotBeDeleted"

1Check current NSG associations in Azure Portal

Navigate to the Network Security Group in Azure Portal and verify which network interfaces and subnets are associated with it. Note the resource names and groups.

bash
az network nsg show --name my-nsg --resource-group my-rg
2Remove NSG-subnet associations via Terraform

If you have azurerm_subnet_network_security_group_association resources, remove them from your Terraform configuration first:

hcl
# Remove or comment out:
resource "azurerm_subnet_network_security_group_association" "example" {
  subnet_id                 = azurerm_subnet.example.id
  network_security_group_id = azurerm_network_security_group.example.id
}

Then run:

bash
terraform apply
3Remove NSG-network interface associations

Remove or comment out azurerm_network_interface_security_group_association resources:

hcl
# Remove or comment out:
resource "azurerm_network_interface_security_group_association" "example" {
  network_interface_id      = azurerm_network_interface.example.id
  network_security_group_id = azurerm_network_security_group.example.id
}

Apply the changes:

bash
terraform apply
4Delete associated network interfaces first

If using inline NIC references, target the deletion of network interfaces before the NSG:

bash
terraform destroy -target=azurerm_network_interface.example
terraform destroy

Or use targeted destruction in your configuration with depends_on:

hcl
resource "azurerm_network_security_group" "example" {
  # ... config ...
}

resource "azurerm_network_interface" "example" {
  # ... config ...
  depends_on = [azurerm_network_security_group.example]
}
5Verify no conflicting security rule definitions

Check that you're not mixing inline security rules with separate azurerm_network_security_rule resources:

hcl
# DON'T DO THIS - will cause conflicts:
resource "azurerm_network_security_group" "example" {
  security_rule {
    name = "AllowHTTP"
    # ...
  }
}

resource "azurerm_network_security_rule" "example" {
  name = "AllowHTTPS"
  # ...
}

Choose one approach: either define all rules inline OR use separate azurerm_network_security_rule resources, but not both.

6Run terraform destroy again after cleanup

With associations removed and dependencies properly ordered, retry the destroy operation:

bash
terraform destroy

If you still encounter the error, refresh the Terraform state:

bash
terraform refresh
terraform destroy

Advanced notes

Azure resource deletion is asynchronous. Even though Terraform reports a resource as deleted, the Azure backend may still be processing the deletion. If multiple destroy runs are needed, this is expected behavior. For complex environments with many dependent resources, consider using terraform import to synchronize state with actual Azure resources, then carefully destroy with proper depends_on ordering. Resource locks (applied via Azure RBAC or Resource Manager locks) can also cause this error; check the resource's 'Locks' section in Azure Portal. In CI/CD pipelines, add retry logic: terraform destroy may succeed on the second or third attempt as Azure completes asynchronous cleanup operations.

Frequently asked questions

What does "InUseNetworkSecurityGroupCannotBeDeleted" mean?
Azure Network Security Groups (NSGs) manage inbound and outbound traffic rules for network interfaces and subnets. When you attempt to delete an NSG using Terraform, Azure checks if the resource is currently in use. If the NSG is still associated with active network interfaces, subnets, or other resources, the Azure API rejects the deletion with the InUseNetworkSecurityGroupCannotBeDeleted error.
How do I fix "InUseNetworkSecurityGroupCannotBeDeleted"?
This error occurs when Terraform attempts to delete an Azure Network Security Group (NSG) that is still associated with network interfaces or subnets. The deletion fails because Azure prevents removal of in-use resources, requiring dependent resources to be removed first.
What causes "InUseNetworkSecurityGroupCannotBeDeleted"?
Network interfaces are not deleted before the NSG deletion attempt Subnets still have active associations with the NSG Resource deletion order is incorrect in Terraform configuration
Is the "InUseNetworkSecurityGroupCannotBeDeleted" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading