371 lines
12 KiB
HCL
371 lines
12 KiB
HCL
|
|
// Create a Resource Group
|
|
resource "azurerm_resource_group" "azfw_rg" {
|
|
name = "rg-azfw-securehub-eus"
|
|
location = var.location
|
|
tags = var.tags
|
|
}
|
|
|
|
// Create resources for Azure Virtual WAN
|
|
// Create a Azure Vwan
|
|
resource "azurerm_virtual_wan" "azfw_vwan" {
|
|
name = "vwan-azfw-securehub-eus"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
tags = azurerm_resource_group.azfw_rg.tags
|
|
allow_branch_to_branch_traffic = true
|
|
disable_vpn_encryption = false
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Create a Azure Vwan Hub
|
|
resource "azurerm_virtual_hub" "azfw_vwan_hub" {
|
|
name = "hub-azfw-securehub-eus"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
virtual_wan_id = azurerm_virtual_wan.azfw_vwan.id
|
|
address_prefix = "10.20.0.0/23"
|
|
tags = azurerm_resource_group.azfw_rg.tags
|
|
depends_on = [
|
|
azurerm_virtual_wan.azfw_vwan
|
|
]
|
|
}
|
|
|
|
// Create a Azure VWan Hub Connection
|
|
resource "azurerm_virtual_hub_connection" "azfw_vwan_hub_connection" {
|
|
name = "hub-to-spoke"
|
|
virtual_hub_id = azurerm_virtual_hub.azfw_vwan_hub.id
|
|
remote_virtual_network_id = azurerm_virtual_network.azfw_vnet.id
|
|
internet_security_enabled = true
|
|
routing {
|
|
associated_route_table_id = azurerm_virtual_hub_route_table.vhub_rt.id
|
|
propagated_route_table {
|
|
route_table_ids = [azurerm_virtual_hub_route_table.vhub_rt.id]
|
|
labels = ["VNet"]
|
|
}
|
|
}
|
|
depends_on = [
|
|
azurerm_virtual_hub.azfw_vwan_hub,
|
|
azurerm_virtual_network.azfw_vnet
|
|
]
|
|
}
|
|
|
|
// Create resources for Azure Firewall
|
|
// Create a Public IP Address for Azure Firewall
|
|
resource "azurerm_public_ip" "pip_azfw" {
|
|
name = "pip-azfw-securehub-eus"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
allocation_method = "Static"
|
|
sku = "Standard"
|
|
tags = azurerm_resource_group.azfw_rg.tags
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Create a Azure Firewall Policy
|
|
resource "azurerm_firewall_policy" "azfw_policy" {
|
|
name = "policy-azfw-securehub-eus"
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
sku = "Premium"
|
|
threat_intelligence_mode = "Alert"
|
|
tags = azurerm_resource_group.azfw_rg.tags
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Create a Azure Firewall Policy Rule Collection Group
|
|
// Create a Application Rule Collection
|
|
// Create rules for Windows Update
|
|
// Create rules for Microsoft.com
|
|
resource "azurerm_firewall_policy_rule_collection_group" "app_policy_rule_collection_group" {
|
|
name = "DefaulApplicationtRuleCollectionGroup"
|
|
firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
|
|
priority = 300
|
|
application_rule_collection {
|
|
name = "DefaultApplicationRuleCollection"
|
|
action = "Allow"
|
|
priority = 100
|
|
rule {
|
|
name = "Allow-MSFT"
|
|
description = "Allow access to Microsoft.com"
|
|
protocols {
|
|
type = "Https"
|
|
port = 443
|
|
}
|
|
protocols {
|
|
type = "Http"
|
|
port = 80
|
|
}
|
|
destination_fqdns = ["*.microsoft.com"]
|
|
terminate_tls = false
|
|
source_addresses = ["*"]
|
|
}
|
|
}
|
|
depends_on = [
|
|
azurerm_firewall_policy.azfw_policy
|
|
]
|
|
}
|
|
|
|
// Create the Azure Firewall
|
|
resource "azurerm_firewall" "fw" {
|
|
name = "fw-azfw-securehub-eus"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
sku_name = "AZFW_Hub"
|
|
sku_tier = var.fw_sku
|
|
tags = azurerm_resource_group.azfw_rg.tags
|
|
virtual_hub {
|
|
virtual_hub_id = azurerm_virtual_hub.azfw_vwan_hub.id
|
|
public_ip_count = 1
|
|
}
|
|
firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
|
|
depends_on = [
|
|
azurerm_firewall_policy.azfw_policy,
|
|
azurerm_virtual_hub.azfw_vwan_hub
|
|
]
|
|
}
|
|
|
|
// Create Virtual Network, Subnets, PIP, NICs, NSGs, and NIC-NSG associations
|
|
// Create a Virtual Network
|
|
resource "azurerm_virtual_network" "azfw_vnet" {
|
|
name = "vnet-azfw-securehub-eus"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
address_space = ["10.10.0.0/16"]
|
|
tags = azurerm_resource_group.azfw_rg.tags
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Create a Subnet for Workload VMs
|
|
resource "azurerm_subnet" "workload_subnet" {
|
|
name = "subnet-workload"
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
virtual_network_name = azurerm_virtual_network.azfw_vnet.name
|
|
address_prefixes = ["10.10.1.0/24"]
|
|
depends_on = [
|
|
azurerm_virtual_network.azfw_vnet
|
|
]
|
|
}
|
|
|
|
// Create a Subnet for Jump VM
|
|
resource "azurerm_subnet" "jump_subnet" {
|
|
name = "subnet-jump"
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
virtual_network_name = azurerm_virtual_network.azfw_vnet.name
|
|
address_prefixes = ["10.10.2.0/24"]
|
|
|
|
depends_on = [
|
|
azurerm_virtual_network.azfw_vnet,
|
|
azurerm_route_table.rt
|
|
]
|
|
}
|
|
|
|
// Create a NIC for Workload VM
|
|
resource "azurerm_network_interface" "vm_workload_nic" {
|
|
name = "nic-workload"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
|
|
ip_configuration {
|
|
name = "ipconfig-workload"
|
|
subnet_id = azurerm_subnet.workload_subnet.id
|
|
private_ip_address_allocation = "Dynamic"
|
|
}
|
|
depends_on = [
|
|
azurerm_subnet.workload_subnet
|
|
]
|
|
}
|
|
|
|
// Create a PIP for Jump VM
|
|
resource "azurerm_public_ip" "vm_jump_pip" {
|
|
name = "pip-jump"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
allocation_method = "Static"
|
|
sku = "Standard"
|
|
tags = azurerm_resource_group.azfw_rg.tags
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Create a NIC for Jump VM
|
|
resource "azurerm_network_interface" "vm_jump_nic" {
|
|
name = "nic-jump"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
|
|
ip_configuration {
|
|
name = "ipconfig-jump"
|
|
subnet_id = azurerm_subnet.jump_subnet.id
|
|
private_ip_address_allocation = "Dynamic"
|
|
public_ip_address_id = azurerm_public_ip.vm_jump_pip.id
|
|
}
|
|
depends_on = [
|
|
azurerm_subnet.jump_subnet,
|
|
azurerm_public_ip.vm_jump_pip
|
|
]
|
|
}
|
|
|
|
// Create a NSG for Workload VM
|
|
resource "azurerm_network_security_group" "vm_workload_nsg" {
|
|
name = "nsg-workload"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Create a NSG for Jump VM
|
|
resource "azurerm_network_security_group" "vm_jump_nsg" {
|
|
name = "nsg-jump"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
security_rule {
|
|
name = "Allow-RDP"
|
|
priority = 300
|
|
direction = "Inbound"
|
|
access = "Allow"
|
|
protocol = "Tcp"
|
|
source_port_range = "*"
|
|
destination_port_range = "3389"
|
|
source_address_prefix = "*"
|
|
destination_address_prefix = "*"
|
|
}
|
|
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Associate NSG for Workload VM NIC
|
|
resource "azurerm_network_interface_security_group_association" "vm_workload_nsg_association" {
|
|
network_interface_id = azurerm_network_interface.vm_workload_nic.id
|
|
network_security_group_id = azurerm_network_security_group.vm_workload_nsg.id
|
|
depends_on = [
|
|
azurerm_network_interface.vm_workload_nic,
|
|
azurerm_network_security_group.vm_workload_nsg
|
|
]
|
|
}
|
|
|
|
// Associate NSG for Jump VM NIC
|
|
resource "azurerm_network_interface_security_group_association" "vm_jump_nsg_association" {
|
|
network_interface_id = azurerm_network_interface.vm_jump_nic.id
|
|
network_security_group_id = azurerm_network_security_group.vm_jump_nsg.id
|
|
depends_on = [
|
|
azurerm_network_interface.vm_jump_nic,
|
|
azurerm_network_security_group.vm_jump_nsg
|
|
]
|
|
}
|
|
|
|
// Create Virtual Machines for testing
|
|
// Create a Workload Virtual Machine
|
|
resource "azurerm_windows_virtual_machine" "vm_workload" {
|
|
name = "workload-vm"
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
size = var.vm_size
|
|
admin_username = var.admin_username
|
|
admin_password = var.admin_password
|
|
network_interface_ids = [azurerm_network_interface.vm_workload_nic.id]
|
|
os_disk {
|
|
caching = "ReadWrite"
|
|
storage_account_type = "Standard_LRS"
|
|
}
|
|
source_image_reference {
|
|
publisher = "MicrosoftWindowsServer"
|
|
offer = "WindowsServer"
|
|
sku = "2019-Datacenter"
|
|
version = "latest"
|
|
}
|
|
depends_on = [
|
|
azurerm_network_interface.vm_workload_nic
|
|
]
|
|
}
|
|
|
|
// Create a Jump Virtual Machine
|
|
resource "azurerm_windows_virtual_machine" "vm_jump" {
|
|
name = "jump-vm"
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
size = var.vm_size
|
|
admin_username = var.admin_username
|
|
admin_password = var.admin_password
|
|
network_interface_ids = [azurerm_network_interface.vm_jump_nic.id]
|
|
os_disk {
|
|
caching = "ReadWrite"
|
|
storage_account_type = "Standard_LRS"
|
|
}
|
|
source_image_reference {
|
|
publisher = "MicrosoftWindowsServer"
|
|
offer = "WindowsServer"
|
|
sku = "2019-Datacenter"
|
|
version = "latest"
|
|
}
|
|
depends_on = [
|
|
azurerm_network_interface.vm_jump_nic
|
|
]
|
|
}
|
|
|
|
// Create Routing for testing
|
|
// Create a Route Table
|
|
resource "azurerm_route_table" "rt" {
|
|
name = "rt-azfw-securehub-eus"
|
|
location = azurerm_resource_group.azfw_rg.location
|
|
resource_group_name = azurerm_resource_group.azfw_rg.name
|
|
disable_bgp_route_propagation = false
|
|
route {
|
|
name = "jump-to-internet"
|
|
address_prefix = "0.0.0.0/0"
|
|
next_hop_type = "Internet"
|
|
}
|
|
depends_on = [
|
|
azurerm_resource_group.azfw_rg
|
|
]
|
|
}
|
|
|
|
// Associate Route Table to Jump VM Subnet
|
|
resource "azurerm_subnet_route_table_association" "jump_subnet_rt_association" {
|
|
subnet_id = azurerm_subnet.jump_subnet.id
|
|
route_table_id = azurerm_route_table.rt.id
|
|
depends_on = [
|
|
azurerm_subnet.jump_subnet,
|
|
azurerm_route_table.rt
|
|
]
|
|
}
|
|
|
|
// Creat a Virtual Hub Route Table
|
|
resource "azurerm_virtual_hub_route_table" "vhub_rt" {
|
|
name = "vhub-rt-azfw-securehub-eus"
|
|
virtual_hub_id = azurerm_virtual_hub.azfw_vwan_hub.id
|
|
route {
|
|
name = "workload-SNToFirewall"
|
|
destinations_type = "CIDR"
|
|
destinations = ["10.10.1.0/24"]
|
|
next_hop_type = "ResourceId"
|
|
next_hop = azurerm_firewall.fw.id
|
|
}
|
|
route {
|
|
name = "InternetToFirewall"
|
|
destinations_type = "CIDR"
|
|
destinations = ["0.0.0.0/0"]
|
|
next_hop_type = "ResourceId"
|
|
next_hop = azurerm_firewall.fw.id
|
|
}
|
|
labels = ["VNet"]
|
|
depends_on = [
|
|
azurerm_virtual_hub.azfw_vwan_hub,
|
|
azurerm_firewall.fw
|
|
]
|
|
}
|
|
|