removing files from this branch
This commit is contained in:
Charles Shea
parent
ed29f3c468
commit
e46e9cec2c
@ -1,230 +0,0 @@
|
||||
# Deploy Azure Firewall and a Firewall Policy
|
||||
|
||||
This template deploys an Azure Firewall and a Firewall Policy. The Firewall Policy is associated to the Firewall.
|
||||
|
||||
## Resources
|
||||
|
||||
| Terraform Resource Type | Description |
|
||||
| - | - |
|
||||
| `azurerm_resource_group` | The resource group all the deployed resources.|
|
||||
| `azurerm_virtual_network` | The virtual network for the firewall. |
|
||||
| `azurerm_subnet` |The firewall subnet.|
|
||||
| `azurerm_public_ip` | The firewall public IP address. |
|
||||
| `azurerm_firewall` | The premium Azure Firewall. |
|
||||
| `azurerm_firewall_policy` | The policy associated to the Firewall |
|
||||
| `azurerm_firewall_policy_rule_collection_group` | the rules collection group for firewall policy |
|
||||
| `azurerm_ip_group` | The IP group for source addresses. |
|
||||
|
||||
## Variables
|
||||
|
||||
| Name | Description |
|
||||
|-|-|
|
||||
| `location` | location for your resources |
|
||||
| `tags` | tags to organize your resources |
|
||||
| `fw_sku` | Sku size for your Firewall and Firewall Policy |
|
||||
|
||||
## Example
|
||||
|
||||
```powershell
|
||||
terraform plan -out main.tfplan
|
||||
|
||||
# azurerm_firewall.fw will be created
|
||||
+ resource "azurerm_firewall" "fw" {
|
||||
+ firewall_policy_id = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "azfw"
|
||||
+ resource_group_name = "azfw-rg"
|
||||
+ sku_name = "AZFW_VNet"
|
||||
+ sku_tier = "Premium"
|
||||
+ threat_intel_mode = (known after apply)
|
||||
|
||||
+ ip_configuration {
|
||||
+ name = "azfw-ipconfig"
|
||||
+ private_ip_address = (known after apply)
|
||||
+ public_ip_address_id = (known after apply)
|
||||
+ subnet_id = (known after apply)
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_firewall_policy.azfw_policy will be created
|
||||
+ resource "azurerm_firewall_policy" "azfw_policy" {
|
||||
+ child_policies = (known after apply)
|
||||
+ firewalls = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "azfw-policy"
|
||||
+ resource_group_name = "azfw-rg"
|
||||
+ rule_collection_groups = (known after apply)
|
||||
+ sku = "Premium"
|
||||
+ threat_intelligence_mode = "Alert"
|
||||
}
|
||||
|
||||
# azurerm_firewall_policy_rule_collection_group.app_policy_rule_collection_group will be created
|
||||
+ resource "azurerm_firewall_policy_rule_collection_group" "app_policy_rule_collection_group" {
|
||||
+ firewall_policy_id = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ name = "DefaulApplicationtRuleCollectionGroup"
|
||||
+ priority = 300
|
||||
|
||||
+ application_rule_collection {
|
||||
+ action = "Allow"
|
||||
+ name = "DefaultApplicationRuleCollection"
|
||||
+ priority = 500
|
||||
|
||||
+ rule {
|
||||
+ description = "Allow Windows Update"
|
||||
+ destination_fqdn_tags = [
|
||||
+ "WindowsUpdate",
|
||||
]
|
||||
+ name = "AllowWindowsUpdate"
|
||||
+ source_ip_groups = (known after apply)
|
||||
|
||||
+ protocols {
|
||||
+ port = 80
|
||||
+ type = "Http"
|
||||
}
|
||||
+ protocols {
|
||||
+ port = 443
|
||||
+ type = "Https"
|
||||
}
|
||||
}
|
||||
+ rule {
|
||||
+ description = "Allow access to Microsoft.com"
|
||||
+ destination_fqdns = [
|
||||
+ "*.microsoft.com",
|
||||
]
|
||||
+ name = "Global Rule"
|
||||
+ source_ip_groups = (known after apply)
|
||||
+ terminate_tls = false
|
||||
|
||||
+ protocols {
|
||||
+ port = 443
|
||||
+ type = "Https"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_firewall_policy_rule_collection_group.net_policy_rule_collection_group will be created
|
||||
+ resource "azurerm_firewall_policy_rule_collection_group" "net_policy_rule_collection_group" {
|
||||
+ firewall_policy_id = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ name = "DefaultNetworkRuleCollectionGroup"
|
||||
+ priority = 200
|
||||
|
||||
+ network_rule_collection {
|
||||
+ action = "Allow"
|
||||
+ name = "DefaultNetworkRuleCollection"
|
||||
+ priority = 200
|
||||
|
||||
+ rule {
|
||||
+ destination_addresses = [
|
||||
+ "132.86.101.172",
|
||||
]
|
||||
+ destination_ports = [
|
||||
+ "123",
|
||||
]
|
||||
+ name = "time-windows"
|
||||
+ protocols = [
|
||||
+ "UDP",
|
||||
]
|
||||
+ source_ip_groups = (known after apply)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_ip_group.infra_ip_group will be created
|
||||
+ resource "azurerm_ip_group" "infra_ip_group" {
|
||||
+ cidrs = [
|
||||
+ "10.40.0.0/24",
|
||||
+ "10.50.0.0/24",
|
||||
]
|
||||
+ firewall_ids = (known after apply)
|
||||
+ firewall_policy_ids = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "infra-ip-group"
|
||||
+ resource_group_name = "azfw-rg"
|
||||
}
|
||||
|
||||
# azurerm_ip_group.workload_ip_group will be created
|
||||
+ resource "azurerm_ip_group" "workload_ip_group" {
|
||||
+ cidrs = [
|
||||
+ "10.20.0.0/24",
|
||||
+ "10.30.0.0/24",
|
||||
]
|
||||
+ firewall_ids = (known after apply)
|
||||
+ firewall_policy_ids = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "workload-ip-group"
|
||||
+ resource_group_name = "azfw-rg"
|
||||
}
|
||||
|
||||
# azurerm_public_ip.pip_azfw will be created
|
||||
+ resource "azurerm_public_ip" "pip_azfw" {
|
||||
+ allocation_method = "Static"
|
||||
+ ddos_protection_mode = "VirtualNetworkInherited"
|
||||
+ fqdn = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ idle_timeout_in_minutes = 4
|
||||
+ ip_address = (known after apply)
|
||||
+ ip_version = "IPv4"
|
||||
+ location = "eastus"
|
||||
+ name = "pip-azfw"
|
||||
+ resource_group_name = "azfw-rg"
|
||||
+ sku = "Standard"
|
||||
+ sku_tier = "Regional"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_resource_group.azfw_rg will be created
|
||||
+ resource "azurerm_resource_group" "azfw_rg" {
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "azfw-rg"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_subnet.azfw_subnet will be created
|
||||
+ resource "azurerm_subnet" "azfw_subnet" {
|
||||
+ address_prefixes = [
|
||||
+ "10.10.0.0/26",
|
||||
]
|
||||
+ enforce_private_link_endpoint_network_policies = (known after apply)
|
||||
+ enforce_private_link_service_network_policies = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ name = "AzureFirewallSubnet"
|
||||
+ private_endpoint_network_policies_enabled = (known after apply)
|
||||
+ private_link_service_network_policies_enabled = (known after apply)
|
||||
+ resource_group_name = "azfw-rg"
|
||||
+ virtual_network_name = "azfw-vnet"
|
||||
}
|
||||
|
||||
# azurerm_virtual_network.azfw_vnet will be created
|
||||
+ resource "azurerm_virtual_network" "azfw_vnet" {
|
||||
+ address_space = [
|
||||
+ "10.10.0.0/24",
|
||||
]
|
||||
+ dns_servers = (known after apply)
|
||||
+ guid = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "azfw-vnet"
|
||||
+ resource_group_name = "azfw-rg"
|
||||
+ subnet = (known after apply)
|
||||
}
|
||||
|
||||
Plan: 10 to add, 0 to change, 0 to destroy.
|
||||
``````
|
||||
@ -1,153 +0,0 @@
|
||||
|
||||
// Create a Resource Group
|
||||
resource "azurerm_resource_group" "azfw_rg" {
|
||||
name = "azfw-rg"
|
||||
location = var.location
|
||||
tags = var.tags
|
||||
}
|
||||
// Create a Virtual Network
|
||||
resource "azurerm_virtual_network" "azfw_vnet" {
|
||||
name = "azfw-vnet"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
address_space = ["10.10.0.0/24"]
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create IP Groups
|
||||
resource "azurerm_ip_group" "workload_ip_group" {
|
||||
name = "workload-ip-group"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
cidrs = ["10.20.0.0/24", "10.30.0.0/24"]
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg,
|
||||
azurerm_virtual_network.azfw_vnet
|
||||
]
|
||||
}
|
||||
resource "azurerm_ip_group" "infra_ip_group" {
|
||||
name = "infra-ip-group"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
cidrs = ["10.40.0.0/24", "10.50.0.0/24"]
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg,
|
||||
azurerm_virtual_network.azfw_vnet
|
||||
]
|
||||
}
|
||||
|
||||
// Create the Azure Firewall Subnet
|
||||
resource "azurerm_subnet" "azfw_subnet" {
|
||||
name = "AzureFirewallSubnet"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
virtual_network_name = azurerm_virtual_network.azfw_vnet.name
|
||||
address_prefixes = ["10.10.0.0/26"]
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg,
|
||||
azurerm_virtual_network.azfw_vnet
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Public IP Address for Azure Firewall
|
||||
resource "azurerm_public_ip" "pip_azfw" {
|
||||
name = "pip-azfw"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
allocation_method = "Static"
|
||||
sku = "Standard"
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Azure Firewall Policy
|
||||
resource "azurerm_firewall_policy" "azfw_policy" {
|
||||
name = "azfw-policy"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
sku = var.fw_sku
|
||||
threat_intelligence_mode = "Alert"
|
||||
}
|
||||
|
||||
// Create a Network Rule Collection Group
|
||||
// Create a Network Rule Collection
|
||||
// Create rules for NTP
|
||||
resource "azurerm_firewall_policy_rule_collection_group" "net_policy_rule_collection_group" {
|
||||
name = "DefaultNetworkRuleCollectionGroup"
|
||||
firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
|
||||
priority = 200
|
||||
network_rule_collection {
|
||||
name = "DefaultNetworkRuleCollection"
|
||||
action = "Allow"
|
||||
priority = 200
|
||||
rule {
|
||||
name = "time-windows"
|
||||
protocols = ["UDP"]
|
||||
source_ip_groups = [azurerm_ip_group.workload_ip_group.id, azurerm_ip_group.infra_ip_group.id]
|
||||
destination_ports = ["123"]
|
||||
destination_addresses = ["132.86.101.172"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Create a Azure Firewall Policy Rule Collection Group
|
||||
// Create a Application Rule Collection
|
||||
// Create rules for Windows Update
|
||||
// Create rules for Microsoft.com
|
||||
resource "azurerm_firewall_policy_rule_collection_group" "app_policy_rule_collection_group" {
|
||||
name = "DefaulApplicationtRuleCollectionGroup"
|
||||
firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
|
||||
priority = 300
|
||||
application_rule_collection {
|
||||
name = "DefaultApplicationRuleCollection"
|
||||
action = "Allow"
|
||||
priority = 500
|
||||
rule {
|
||||
name = "AllowWindowsUpdate"
|
||||
|
||||
description = "Allow Windows Update"
|
||||
protocols {
|
||||
type = "Http"
|
||||
port = 80
|
||||
}
|
||||
protocols {
|
||||
type = "Https"
|
||||
port = 443
|
||||
}
|
||||
source_ip_groups = [azurerm_ip_group.workload_ip_group.id, azurerm_ip_group.infra_ip_group.id]
|
||||
destination_fqdn_tags = ["WindowsUpdate"]
|
||||
}
|
||||
rule {
|
||||
name = "Global Rule"
|
||||
description = "Allow access to Microsoft.com"
|
||||
protocols {
|
||||
type = "Https"
|
||||
port = 443
|
||||
}
|
||||
destination_fqdns = ["*.microsoft.com"]
|
||||
terminate_tls = false
|
||||
source_ip_groups = [azurerm_ip_group.workload_ip_group.id, azurerm_ip_group.infra_ip_group.id]
|
||||
}
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_firewall_policy.azfw_policy
|
||||
]
|
||||
}
|
||||
|
||||
// Create the Azure Firewall
|
||||
resource "azurerm_firewall" "fw" {
|
||||
name = "azfw"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
sku_name = "AZFW_VNet"
|
||||
sku_tier = var.fw_sku
|
||||
ip_configuration {
|
||||
name = "azfw-ipconfig"
|
||||
subnet_id = azurerm_subnet.azfw_subnet.id
|
||||
public_ip_address_id = azurerm_public_ip.pip_azfw.id
|
||||
}
|
||||
firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
|
||||
}
|
||||
@ -1,3 +0,0 @@
|
||||
output "rg_name" {
|
||||
value = azurerm_resource_group.azfw_rg.name
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
azurerm = {
|
||||
source = "hashicorp/azurerm"
|
||||
version = "3.69.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "azurerm" {
|
||||
features {
|
||||
resource_group {
|
||||
prevent_deletion_if_contains_resources = false // Set to True for Production
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,18 +0,0 @@
|
||||
// Create Variables for Location and Tags
|
||||
variable "location" {
|
||||
default = "eastus"
|
||||
}
|
||||
variable "tags" {
|
||||
default = {
|
||||
environment = "dev"
|
||||
costcenter = "1234556677"
|
||||
owner = "cloud team"
|
||||
workload = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
// Create Firewall Variables
|
||||
variable "fw_sku" {
|
||||
default = "Premium" # Valid values are Standard and Premium
|
||||
}
|
||||
|
||||
@ -1,543 +0,0 @@
|
||||
# Deploy Azure Firewall and a Firewall Policy
|
||||
|
||||
This template deploys an Azure Firewall and a Firewall Policy to a Secure Hub. The Firewall Policy is associated with the Firewall policy.
|
||||
|
||||
## Resources
|
||||
|
||||
| Terraform Resource Type | Description |
|
||||
| - | - |
|
||||
| `azurerm_resource_group` | The resource group all the deployed resources.|
|
||||
| `azurerm_virtual_wan` | The virtual wan for the virtual hub |
|
||||
| `azurerm_virtual_hub` | The virtual hub for the firewall |
|
||||
| `azurerm_virtual_hub_route_table` | The route table for the virtual hub |
|
||||
| `azurerm_virtual_hub_connection` | The connection between the virtual hub and the virtual network spoke |
|
||||
| `azurerm_public_ip` | The firewall public IP address and public access to the jump vm. |
|
||||
| `azurerm_firewall_policy` | The policy associated to the Firewall |
|
||||
| `azurerm_firewall_policy_rule_collection_group` | the rules collection group to add network and application rule collections for firewall policy |
|
||||
| `azurerm_firewall` | The premium Azure Firewall. |
|
||||
| `azurerm_virtual_network` | The virtual network for the firewall. |
|
||||
| `azurerm_subnet` | The subnets for jump and workload vms. |
|
||||
| `azurerm_network_interface` | The nics for the jump and workload vms |
|
||||
| `azurerm_network_security_group` | The nsg for the jump and workload vms |
|
||||
| `azurerm_network_interface_security_group_association` | The association between the nics and the nsgs |
|
||||
| `azurerm_virtual_machine` | The jump and workload vms for testing |
|
||||
| `azurerm_route_table` | The route table for the jump vms |
|
||||
| `azurerm_subnet_route_table_association` | The association between the subnets and the route tables |
|
||||
| `azurerm_virtual_hub_route_table` | The route table for the virtual hub |
|
||||
|
||||
## Variables
|
||||
|
||||
| Name | Description |
|
||||
|-|-|
|
||||
| `location` | location for your resources |
|
||||
| `tags` | tags to organize your resources |
|
||||
| `fw_sku` | Sku size for your Firewall and Firewall Policy |
|
||||
| `vm_size` | Sku size for your jump and workload vms |
|
||||
| `admin_username` | admin username for the jump and workload vms |
|
||||
| `admin_password` | admin password for the jump and workload vms |
|
||||
|
||||
## Example
|
||||
|
||||
```powershell
|
||||
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
|
||||
+ create
|
||||
|
||||
Terraform will perform the following actions:
|
||||
|
||||
# azurerm_firewall.fw will be created
|
||||
+ resource "azurerm_firewall" "fw" {
|
||||
+ firewall_policy_id = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "fw-azfw-securehub-eus"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ sku_name = "AZFW_Hub"
|
||||
+ sku_tier = "Premium"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
+ threat_intel_mode = (known after apply)
|
||||
|
||||
+ virtual_hub {
|
||||
+ private_ip_address = (known after apply)
|
||||
+ public_ip_addresses = (known after apply)
|
||||
+ public_ip_count = 1
|
||||
+ virtual_hub_id = (known after apply)
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_firewall_policy.azfw_policy will be created
|
||||
+ resource "azurerm_firewall_policy" "azfw_policy" {
|
||||
+ child_policies = (known after apply)
|
||||
+ firewalls = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "policy-azfw-securehub-eus"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ rule_collection_groups = (known after apply)
|
||||
+ sku = "Premium"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
+ threat_intelligence_mode = "Alert"
|
||||
}
|
||||
|
||||
# azurerm_firewall_policy_rule_collection_group.app_policy_rule_collection_group will be created
|
||||
+ resource "azurerm_firewall_policy_rule_collection_group" "app_policy_rule_collection_group" {
|
||||
+ firewall_policy_id = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ name = "DefaulApplicationtRuleCollectionGroup"
|
||||
+ priority = 300
|
||||
|
||||
+ application_rule_collection {
|
||||
+ action = "Allow"
|
||||
+ name = "DefaultApplicationRuleCollection"
|
||||
+ priority = 100
|
||||
|
||||
+ rule {
|
||||
+ description = "Allow access to Microsoft.com"
|
||||
+ destination_fqdns = [
|
||||
+ "*.microsoft.com",
|
||||
]
|
||||
+ name = "Allow-MSFT"
|
||||
+ source_addresses = [
|
||||
+ "*",
|
||||
]
|
||||
+ terminate_tls = false
|
||||
|
||||
+ protocols {
|
||||
+ port = 443
|
||||
+ type = "Https"
|
||||
}
|
||||
+ protocols {
|
||||
+ port = 80
|
||||
+ type = "Http"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_network_interface.vm_jump_nic will be created
|
||||
+ resource "azurerm_network_interface" "vm_jump_nic" {
|
||||
+ applied_dns_servers = (known after apply)
|
||||
+ dns_servers = (known after apply)
|
||||
+ enable_accelerated_networking = false
|
||||
+ enable_ip_forwarding = false
|
||||
+ id = (known after apply)
|
||||
+ internal_dns_name_label = (known after apply)
|
||||
+ internal_domain_name_suffix = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ mac_address = (known after apply)
|
||||
+ name = "nic-jump"
|
||||
+ private_ip_address = (known after apply)
|
||||
+ private_ip_addresses = (known after apply)
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ virtual_machine_id = (known after apply)
|
||||
|
||||
+ ip_configuration {
|
||||
+ gateway_load_balancer_frontend_ip_configuration_id = (known after apply)
|
||||
+ name = "ipconfig-jump"
|
||||
+ primary = (known after apply)
|
||||
+ private_ip_address = (known after apply)
|
||||
+ private_ip_address_allocation = "Dynamic"
|
||||
+ private_ip_address_version = "IPv4"
|
||||
+ public_ip_address_id = (known after apply)
|
||||
+ subnet_id = (known after apply)
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_network_interface.vm_workload_nic will be created
|
||||
+ resource "azurerm_network_interface" "vm_workload_nic" {
|
||||
+ applied_dns_servers = (known after apply)
|
||||
+ dns_servers = (known after apply)
|
||||
+ enable_accelerated_networking = false
|
||||
+ enable_ip_forwarding = false
|
||||
+ id = (known after apply)
|
||||
+ internal_dns_name_label = (known after apply)
|
||||
+ internal_domain_name_suffix = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ mac_address = (known after apply)
|
||||
+ name = "nic-workload"
|
||||
+ private_ip_address = (known after apply)
|
||||
+ private_ip_addresses = (known after apply)
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ virtual_machine_id = (known after apply)
|
||||
|
||||
+ ip_configuration {
|
||||
+ gateway_load_balancer_frontend_ip_configuration_id = (known after apply)
|
||||
+ name = "ipconfig-workload"
|
||||
+ primary = (known after apply)
|
||||
+ private_ip_address = (known after apply)
|
||||
+ private_ip_address_allocation = "Dynamic"
|
||||
+ private_ip_address_version = "IPv4"
|
||||
+ subnet_id = (known after apply)
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_network_interface_security_group_association.vm_jump_nsg_association will be created
|
||||
+ resource "azurerm_network_interface_security_group_association" "vm_jump_nsg_association" {
|
||||
+ id = (known after apply)
|
||||
+ network_interface_id = (known after apply)
|
||||
+ network_security_group_id = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_network_interface_security_group_association.vm_workload_nsg_association will be created
|
||||
+ resource "azurerm_network_interface_security_group_association" "vm_workload_nsg_association" {
|
||||
+ id = (known after apply)
|
||||
+ network_interface_id = (known after apply)
|
||||
+ network_security_group_id = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_network_security_group.vm_jump_nsg will be created
|
||||
+ resource "azurerm_network_security_group" "vm_jump_nsg" {
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "nsg-jump"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ security_rule = [
|
||||
+ {
|
||||
+ access = "Allow"
|
||||
+ description = ""
|
||||
+ destination_address_prefix = "*"
|
||||
+ destination_address_prefixes = []
|
||||
+ destination_application_security_group_ids = []
|
||||
+ destination_port_range = "3389"
|
||||
+ destination_port_ranges = []
|
||||
+ direction = "Inbound"
|
||||
+ name = "Allow-RDP"
|
||||
+ priority = 300
|
||||
+ protocol = "Tcp"
|
||||
+ source_address_prefix = "*"
|
||||
+ source_address_prefixes = []
|
||||
+ source_application_security_group_ids = []
|
||||
+ source_port_range = "*"
|
||||
+ source_port_ranges = []
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
# azurerm_network_security_group.vm_workload_nsg will be created
|
||||
+ resource "azurerm_network_security_group" "vm_workload_nsg" {
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "nsg-workload"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ security_rule = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_public_ip.pip_azfw will be created
|
||||
+ resource "azurerm_public_ip" "pip_azfw" {
|
||||
+ allocation_method = "Static"
|
||||
+ ddos_protection_mode = "VirtualNetworkInherited"
|
||||
+ fqdn = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ idle_timeout_in_minutes = 4
|
||||
+ ip_address = (known after apply)
|
||||
+ ip_version = "IPv4"
|
||||
+ location = "eastus"
|
||||
+ name = "pip-azfw-securehub-eus"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ sku = "Standard"
|
||||
+ sku_tier = "Regional"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_public_ip.vm_jump_pip will be created
|
||||
+ resource "azurerm_public_ip" "vm_jump_pip" {
|
||||
+ allocation_method = "Static"
|
||||
+ ddos_protection_mode = "VirtualNetworkInherited"
|
||||
+ fqdn = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ idle_timeout_in_minutes = 4
|
||||
+ ip_address = (known after apply)
|
||||
+ ip_version = "IPv4"
|
||||
+ location = "eastus"
|
||||
+ name = "pip-jump"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ sku = "Standard"
|
||||
+ sku_tier = "Regional"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_resource_group.azfw_rg will be created
|
||||
+ resource "azurerm_resource_group" "azfw_rg" {
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "rg-azfw-securehub-eus"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_route_table.rt will be created
|
||||
+ resource "azurerm_route_table" "rt" {
|
||||
+ disable_bgp_route_propagation = false
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "rt-azfw-securehub-eus"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ route = [
|
||||
+ {
|
||||
+ address_prefix = "0.0.0.0/0"
|
||||
+ name = "jump-to-internet"
|
||||
+ next_hop_in_ip_address = ""
|
||||
+ next_hop_type = "Internet"
|
||||
},
|
||||
]
|
||||
+ subnets = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_subnet.jump_subnet will be created
|
||||
+ resource "azurerm_subnet" "jump_subnet" {
|
||||
+ address_prefixes = [
|
||||
+ "10.10.2.0/24",
|
||||
]
|
||||
+ enforce_private_link_endpoint_network_policies = (known after apply)
|
||||
+ enforce_private_link_service_network_policies = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ name = "subnet-jump"
|
||||
+ private_endpoint_network_policies_enabled = (known after apply)
|
||||
+ private_link_service_network_policies_enabled = (known after apply)
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ virtual_network_name = "vnet-azfw-securehub-eus"
|
||||
}
|
||||
|
||||
# azurerm_subnet.workload_subnet will be created
|
||||
+ resource "azurerm_subnet" "workload_subnet" {
|
||||
+ address_prefixes = [
|
||||
+ "10.10.1.0/24",
|
||||
]
|
||||
+ enforce_private_link_endpoint_network_policies = (known after apply)
|
||||
+ enforce_private_link_service_network_policies = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ name = "subnet-workload"
|
||||
+ private_endpoint_network_policies_enabled = (known after apply)
|
||||
+ private_link_service_network_policies_enabled = (known after apply)
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ virtual_network_name = "vnet-azfw-securehub-eus"
|
||||
}
|
||||
|
||||
# azurerm_subnet_route_table_association.jump_subnet_rt_association will be created
|
||||
+ resource "azurerm_subnet_route_table_association" "jump_subnet_rt_association" {
|
||||
+ id = (known after apply)
|
||||
+ route_table_id = (known after apply)
|
||||
+ subnet_id = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_virtual_hub.azfw_vwan_hub will be created
|
||||
+ resource "azurerm_virtual_hub" "azfw_vwan_hub" {
|
||||
+ address_prefix = "10.20.0.0/23"
|
||||
+ default_route_table_id = (known after apply)
|
||||
+ hub_routing_preference = "ExpressRoute"
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "hub-azfw-securehub-eus"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
+ virtual_router_asn = (known after apply)
|
||||
+ virtual_router_auto_scale_min_capacity = 2
|
||||
+ virtual_router_ips = (known after apply)
|
||||
+ virtual_wan_id = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_virtual_hub_connection.azfw_vwan_hub_connection will be created
|
||||
+ resource "azurerm_virtual_hub_connection" "azfw_vwan_hub_connection" {
|
||||
+ id = (known after apply)
|
||||
+ internet_security_enabled = true
|
||||
+ name = "hub-to-spoke"
|
||||
+ remote_virtual_network_id = (known after apply)
|
||||
+ virtual_hub_id = (known after apply)
|
||||
|
||||
+ routing {
|
||||
+ associated_route_table_id = (known after apply)
|
||||
|
||||
+ propagated_route_table {
|
||||
+ labels = [
|
||||
+ "VNet",
|
||||
]
|
||||
+ route_table_ids = (known after apply)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_virtual_hub_route_table.vhub_rt will be created
|
||||
+ resource "azurerm_virtual_hub_route_table" "vhub_rt" {
|
||||
+ id = (known after apply)
|
||||
+ labels = [
|
||||
+ "VNet",
|
||||
]
|
||||
+ name = "vhub-rt-azfw-securehub-eus"
|
||||
+ virtual_hub_id = (known after apply)
|
||||
|
||||
+ route {
|
||||
+ destinations = [
|
||||
+ "0.0.0.0/0",
|
||||
]
|
||||
+ destinations_type = "CIDR"
|
||||
+ name = "InternetToFirewall"
|
||||
+ next_hop = (known after apply)
|
||||
+ next_hop_type = "ResourceId"
|
||||
}
|
||||
+ route {
|
||||
+ destinations = [
|
||||
+ "10.10.1.0/24",
|
||||
]
|
||||
+ destinations_type = "CIDR"
|
||||
+ name = "workload-SNToFirewall"
|
||||
+ next_hop = (known after apply)
|
||||
+ next_hop_type = "ResourceId"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_virtual_network.azfw_vnet will be created
|
||||
+ resource "azurerm_virtual_network" "azfw_vnet" {
|
||||
+ address_space = [
|
||||
+ "10.10.0.0/16",
|
||||
]
|
||||
+ dns_servers = (known after apply)
|
||||
+ guid = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "vnet-azfw-securehub-eus"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ subnet = (known after apply)
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_virtual_wan.azfw_vwan will be created
|
||||
+ resource "azurerm_virtual_wan" "azfw_vwan" {
|
||||
+ allow_branch_to_branch_traffic = true
|
||||
+ disable_vpn_encryption = false
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ name = "vwan-azfw-securehub-eus"
|
||||
+ office365_local_breakout_category = "None"
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ tags = {
|
||||
+ "costcenter" = "1234556677"
|
||||
+ "environment" = "dev"
|
||||
+ "owner" = "cloud team"
|
||||
+ "workload" = "azure firewall"
|
||||
}
|
||||
+ type = "Standard"
|
||||
}
|
||||
|
||||
# azurerm_windows_virtual_machine.vm_jump will be created
|
||||
+ resource "azurerm_windows_virtual_machine" "vm_jump" {
|
||||
+ admin_password = (sensitive value)
|
||||
+ admin_username = "azureuser"
|
||||
+ allow_extension_operations = true
|
||||
+ bypass_platform_safety_checks_on_user_schedule_enabled = false
|
||||
+ computer_name = (known after apply)
|
||||
+ enable_automatic_updates = true
|
||||
+ extensions_time_budget = "PT1H30M"
|
||||
+ hotpatching_enabled = false
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ max_bid_price = -1
|
||||
+ name = "jump-vm"
|
||||
+ network_interface_ids = (known after apply)
|
||||
+ patch_assessment_mode = "ImageDefault"
|
||||
+ patch_mode = "AutomaticByOS"
|
||||
+ platform_fault_domain = -1
|
||||
+ priority = "Regular"
|
||||
+ private_ip_address = (known after apply)
|
||||
+ private_ip_addresses = (known after apply)
|
||||
+ provision_vm_agent = true
|
||||
+ public_ip_address = (known after apply)
|
||||
+ public_ip_addresses = (known after apply)
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ size = "Standard_D2_v3"
|
||||
+ virtual_machine_id = (known after apply)
|
||||
|
||||
+ os_disk {
|
||||
+ caching = "ReadWrite"
|
||||
+ disk_size_gb = (known after apply)
|
||||
+ name = (known after apply)
|
||||
+ storage_account_type = "Standard_LRS"
|
||||
+ write_accelerator_enabled = false
|
||||
}
|
||||
|
||||
+ source_image_reference {
|
||||
+ offer = "WindowsServer"
|
||||
+ publisher = "MicrosoftWindowsServer"
|
||||
+ sku = "2019-Datacenter"
|
||||
+ version = "latest"
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_windows_virtual_machine.vm_workload will be created
|
||||
+ resource "azurerm_windows_virtual_machine" "vm_workload" {
|
||||
+ admin_password = (sensitive value)
|
||||
+ admin_username = "azureuser"
|
||||
+ allow_extension_operations = true
|
||||
+ bypass_platform_safety_checks_on_user_schedule_enabled = false
|
||||
+ computer_name = (known after apply)
|
||||
+ enable_automatic_updates = true
|
||||
+ extensions_time_budget = "PT1H30M"
|
||||
+ hotpatching_enabled = false
|
||||
+ id = (known after apply)
|
||||
+ location = "eastus"
|
||||
+ max_bid_price = -1
|
||||
+ name = "workload-vm"
|
||||
+ network_interface_ids = (known after apply)
|
||||
+ patch_assessment_mode = "ImageDefault"
|
||||
+ patch_mode = "AutomaticByOS"
|
||||
+ platform_fault_domain = -1
|
||||
+ priority = "Regular"
|
||||
+ private_ip_address = (known after apply)
|
||||
+ private_ip_addresses = (known after apply)
|
||||
+ provision_vm_agent = true
|
||||
+ public_ip_address = (known after apply)
|
||||
+ public_ip_addresses = (known after apply)
|
||||
+ resource_group_name = "rg-azfw-securehub-eus"
|
||||
+ size = "Standard_D2_v3"
|
||||
+ virtual_machine_id = (known after apply)
|
||||
|
||||
+ os_disk {
|
||||
+ caching = "ReadWrite"
|
||||
+ disk_size_gb = (known after apply)
|
||||
+ name = (known after apply)
|
||||
+ storage_account_type = "Standard_LRS"
|
||||
+ write_accelerator_enabled = false
|
||||
}
|
||||
|
||||
+ source_image_reference {
|
||||
+ offer = "WindowsServer"
|
||||
+ publisher = "MicrosoftWindowsServer"
|
||||
+ sku = "2019-Datacenter"
|
||||
+ version = "latest"
|
||||
}
|
||||
}
|
||||
|
||||
Plan: 23 to add, 0 to change, 0 to destroy.
|
||||
``````
|
||||
@ -1,370 +0,0 @@
|
||||
|
||||
// Create a Resource Group
|
||||
resource "azurerm_resource_group" "azfw_rg" {
|
||||
name = "rg-azfw-securehub-eus"
|
||||
location = var.location
|
||||
tags = var.tags
|
||||
}
|
||||
|
||||
// Create resources for Azure Virtual WAN
|
||||
// Create a Azure Vwan
|
||||
resource "azurerm_virtual_wan" "azfw_vwan" {
|
||||
name = "vwan-azfw-securehub-eus"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
allow_branch_to_branch_traffic = true
|
||||
disable_vpn_encryption = false
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Azure Vwan Hub
|
||||
resource "azurerm_virtual_hub" "azfw_vwan_hub" {
|
||||
name = "hub-azfw-securehub-eus"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
virtual_wan_id = azurerm_virtual_wan.azfw_vwan.id
|
||||
address_prefix = "10.20.0.0/23"
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
depends_on = [
|
||||
azurerm_virtual_wan.azfw_vwan
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Azure VWan Hub Connection
|
||||
resource "azurerm_virtual_hub_connection" "azfw_vwan_hub_connection" {
|
||||
name = "hub-to-spoke"
|
||||
virtual_hub_id = azurerm_virtual_hub.azfw_vwan_hub.id
|
||||
remote_virtual_network_id = azurerm_virtual_network.azfw_vnet.id
|
||||
internet_security_enabled = true
|
||||
routing {
|
||||
associated_route_table_id = azurerm_virtual_hub_route_table.vhub_rt.id
|
||||
propagated_route_table {
|
||||
route_table_ids = [azurerm_virtual_hub_route_table.vhub_rt.id]
|
||||
labels = ["VNet"]
|
||||
}
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_virtual_hub.azfw_vwan_hub,
|
||||
azurerm_virtual_network.azfw_vnet
|
||||
]
|
||||
}
|
||||
|
||||
// Create resources for Azure Firewall
|
||||
// Create a Public IP Address for Azure Firewall
|
||||
resource "azurerm_public_ip" "pip_azfw" {
|
||||
name = "pip-azfw-securehub-eus"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
allocation_method = "Static"
|
||||
sku = "Standard"
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Azure Firewall Policy
|
||||
resource "azurerm_firewall_policy" "azfw_policy" {
|
||||
name = "policy-azfw-securehub-eus"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
sku = "Premium"
|
||||
threat_intelligence_mode = "Alert"
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Azure Firewall Policy Rule Collection Group
|
||||
// Create a Application Rule Collection
|
||||
// Create rules for Windows Update
|
||||
// Create rules for Microsoft.com
|
||||
resource "azurerm_firewall_policy_rule_collection_group" "app_policy_rule_collection_group" {
|
||||
name = "DefaulApplicationtRuleCollectionGroup"
|
||||
firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
|
||||
priority = 300
|
||||
application_rule_collection {
|
||||
name = "DefaultApplicationRuleCollection"
|
||||
action = "Allow"
|
||||
priority = 100
|
||||
rule {
|
||||
name = "Allow-MSFT"
|
||||
description = "Allow access to Microsoft.com"
|
||||
protocols {
|
||||
type = "Https"
|
||||
port = 443
|
||||
}
|
||||
protocols {
|
||||
type = "Http"
|
||||
port = 80
|
||||
}
|
||||
destination_fqdns = ["*.microsoft.com"]
|
||||
terminate_tls = false
|
||||
source_addresses = ["*"]
|
||||
}
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_firewall_policy.azfw_policy
|
||||
]
|
||||
}
|
||||
|
||||
// Create the Azure Firewall
|
||||
resource "azurerm_firewall" "fw" {
|
||||
name = "fw-azfw-securehub-eus"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
sku_name = "AZFW_Hub"
|
||||
sku_tier = var.fw_sku
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
virtual_hub {
|
||||
virtual_hub_id = azurerm_virtual_hub.azfw_vwan_hub.id
|
||||
public_ip_count = 1
|
||||
}
|
||||
firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
|
||||
depends_on = [
|
||||
azurerm_firewall_policy.azfw_policy,
|
||||
azurerm_virtual_hub.azfw_vwan_hub
|
||||
]
|
||||
}
|
||||
|
||||
// Create Virtual Network, Subnets, PIP, NICs, NSGs, and NIC-NSG associations
|
||||
// Create a Virtual Network
|
||||
resource "azurerm_virtual_network" "azfw_vnet" {
|
||||
name = "vnet-azfw-securehub-eus"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
address_space = ["10.10.0.0/16"]
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Subnet for Workload VMs
|
||||
resource "azurerm_subnet" "workload_subnet" {
|
||||
name = "subnet-workload"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
virtual_network_name = azurerm_virtual_network.azfw_vnet.name
|
||||
address_prefixes = ["10.10.1.0/24"]
|
||||
depends_on = [
|
||||
azurerm_virtual_network.azfw_vnet
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Subnet for Jump VM
|
||||
resource "azurerm_subnet" "jump_subnet" {
|
||||
name = "subnet-jump"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
virtual_network_name = azurerm_virtual_network.azfw_vnet.name
|
||||
address_prefixes = ["10.10.2.0/24"]
|
||||
|
||||
depends_on = [
|
||||
azurerm_virtual_network.azfw_vnet,
|
||||
azurerm_route_table.rt
|
||||
]
|
||||
}
|
||||
|
||||
// Create a NIC for Workload VM
|
||||
resource "azurerm_network_interface" "vm_workload_nic" {
|
||||
name = "nic-workload"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
|
||||
ip_configuration {
|
||||
name = "ipconfig-workload"
|
||||
subnet_id = azurerm_subnet.workload_subnet.id
|
||||
private_ip_address_allocation = "Dynamic"
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_subnet.workload_subnet
|
||||
]
|
||||
}
|
||||
|
||||
// Create a PIP for Jump VM
|
||||
resource "azurerm_public_ip" "vm_jump_pip" {
|
||||
name = "pip-jump"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
allocation_method = "Static"
|
||||
sku = "Standard"
|
||||
tags = azurerm_resource_group.azfw_rg.tags
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create a NIC for Jump VM
|
||||
resource "azurerm_network_interface" "vm_jump_nic" {
|
||||
name = "nic-jump"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
|
||||
ip_configuration {
|
||||
name = "ipconfig-jump"
|
||||
subnet_id = azurerm_subnet.jump_subnet.id
|
||||
private_ip_address_allocation = "Dynamic"
|
||||
public_ip_address_id = azurerm_public_ip.vm_jump_pip.id
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_subnet.jump_subnet,
|
||||
azurerm_public_ip.vm_jump_pip
|
||||
]
|
||||
}
|
||||
|
||||
// Create a NSG for Workload VM
|
||||
resource "azurerm_network_security_group" "vm_workload_nsg" {
|
||||
name = "nsg-workload"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Create a NSG for Jump VM
|
||||
resource "azurerm_network_security_group" "vm_jump_nsg" {
|
||||
name = "nsg-jump"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
security_rule {
|
||||
name = "Allow-RDP"
|
||||
priority = 300
|
||||
direction = "Inbound"
|
||||
access = "Allow"
|
||||
protocol = "Tcp"
|
||||
source_port_range = "*"
|
||||
destination_port_range = "3389"
|
||||
source_address_prefix = "*"
|
||||
destination_address_prefix = "*"
|
||||
}
|
||||
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Associate NSG for Workload VM NIC
|
||||
resource "azurerm_network_interface_security_group_association" "vm_workload_nsg_association" {
|
||||
network_interface_id = azurerm_network_interface.vm_workload_nic.id
|
||||
network_security_group_id = azurerm_network_security_group.vm_workload_nsg.id
|
||||
depends_on = [
|
||||
azurerm_network_interface.vm_workload_nic,
|
||||
azurerm_network_security_group.vm_workload_nsg
|
||||
]
|
||||
}
|
||||
|
||||
// Associate NSG for Jump VM NIC
|
||||
resource "azurerm_network_interface_security_group_association" "vm_jump_nsg_association" {
|
||||
network_interface_id = azurerm_network_interface.vm_jump_nic.id
|
||||
network_security_group_id = azurerm_network_security_group.vm_jump_nsg.id
|
||||
depends_on = [
|
||||
azurerm_network_interface.vm_jump_nic,
|
||||
azurerm_network_security_group.vm_jump_nsg
|
||||
]
|
||||
}
|
||||
|
||||
// Create Virtual Machines for testing
|
||||
// Create a Workload Virtual Machine
|
||||
resource "azurerm_windows_virtual_machine" "vm_workload" {
|
||||
name = "workload-vm"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
size = var.vm_size
|
||||
admin_username = var.admin_username
|
||||
admin_password = var.admin_password
|
||||
network_interface_ids = [azurerm_network_interface.vm_workload_nic.id]
|
||||
os_disk {
|
||||
caching = "ReadWrite"
|
||||
storage_account_type = "Standard_LRS"
|
||||
}
|
||||
source_image_reference {
|
||||
publisher = "MicrosoftWindowsServer"
|
||||
offer = "WindowsServer"
|
||||
sku = "2019-Datacenter"
|
||||
version = "latest"
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_network_interface.vm_workload_nic
|
||||
]
|
||||
}
|
||||
|
||||
// Create a Jump Virtual Machine
|
||||
resource "azurerm_windows_virtual_machine" "vm_jump" {
|
||||
name = "jump-vm"
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
size = var.vm_size
|
||||
admin_username = var.admin_username
|
||||
admin_password = var.admin_password
|
||||
network_interface_ids = [azurerm_network_interface.vm_jump_nic.id]
|
||||
os_disk {
|
||||
caching = "ReadWrite"
|
||||
storage_account_type = "Standard_LRS"
|
||||
}
|
||||
source_image_reference {
|
||||
publisher = "MicrosoftWindowsServer"
|
||||
offer = "WindowsServer"
|
||||
sku = "2019-Datacenter"
|
||||
version = "latest"
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_network_interface.vm_jump_nic
|
||||
]
|
||||
}
|
||||
|
||||
// Create Routing for testing
|
||||
// Create a Route Table
|
||||
resource "azurerm_route_table" "rt" {
|
||||
name = "rt-azfw-securehub-eus"
|
||||
location = azurerm_resource_group.azfw_rg.location
|
||||
resource_group_name = azurerm_resource_group.azfw_rg.name
|
||||
disable_bgp_route_propagation = false
|
||||
route {
|
||||
name = "jump-to-internet"
|
||||
address_prefix = "0.0.0.0/0"
|
||||
next_hop_type = "Internet"
|
||||
}
|
||||
depends_on = [
|
||||
azurerm_resource_group.azfw_rg
|
||||
]
|
||||
}
|
||||
|
||||
// Associate Route Table to Jump VM Subnet
|
||||
resource "azurerm_subnet_route_table_association" "jump_subnet_rt_association" {
|
||||
subnet_id = azurerm_subnet.jump_subnet.id
|
||||
route_table_id = azurerm_route_table.rt.id
|
||||
depends_on = [
|
||||
azurerm_subnet.jump_subnet,
|
||||
azurerm_route_table.rt
|
||||
]
|
||||
}
|
||||
|
||||
// Creat a Virtual Hub Route Table
|
||||
resource "azurerm_virtual_hub_route_table" "vhub_rt" {
|
||||
name = "vhub-rt-azfw-securehub-eus"
|
||||
virtual_hub_id = azurerm_virtual_hub.azfw_vwan_hub.id
|
||||
route {
|
||||
name = "workload-SNToFirewall"
|
||||
destinations_type = "CIDR"
|
||||
destinations = ["10.10.1.0/24"]
|
||||
next_hop_type = "ResourceId"
|
||||
next_hop = azurerm_firewall.fw.id
|
||||
}
|
||||
route {
|
||||
name = "InternetToFirewall"
|
||||
destinations_type = "CIDR"
|
||||
destinations = ["0.0.0.0/0"]
|
||||
next_hop_type = "ResourceId"
|
||||
next_hop = azurerm_firewall.fw.id
|
||||
}
|
||||
labels = ["VNet"]
|
||||
depends_on = [
|
||||
azurerm_virtual_hub.azfw_vwan_hub,
|
||||
azurerm_firewall.fw
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,3 +0,0 @@
|
||||
output "rg_name" {
|
||||
value = azurerm_resource_group.azfw_rg.name
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
terraform {
|
||||
required_providers {
|
||||
azurerm = {
|
||||
source = "hashicorp/azurerm"
|
||||
version = "3.69.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "azurerm" {
|
||||
features {
|
||||
resource_group {
|
||||
prevent_deletion_if_contains_resources = false // Set to True for Production
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,30 +0,0 @@
|
||||
// Create Variables for Location and Tags
|
||||
variable "location" {
|
||||
default = "eastus"
|
||||
}
|
||||
variable "tags" {
|
||||
default = {
|
||||
environment = "dev"
|
||||
costcenter = "1234556677"
|
||||
owner = "cloud team"
|
||||
workload = "azure firewall"
|
||||
}
|
||||
}
|
||||
|
||||
// Create Firewall Variables
|
||||
variable "fw_sku" {
|
||||
default = "Premium" # Valid values are Standard and Premium
|
||||
}
|
||||
|
||||
// Create Virtual Machine Sku Size Variables
|
||||
variable "vm_size" {
|
||||
default = "Standard_D2_v3"
|
||||
}
|
||||
|
||||
// Create Admin Username and Password
|
||||
variable "admin_username" {
|
||||
default = "azureuser"
|
||||
}
|
||||
variable "admin_password" {
|
||||
default = "P@ssw0rd1234!"
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user