Tips-Of-Mine/terraform
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add FW rules, spoke DNS and UDRs to FW

Browse Source
This commit is contained in:
Dylan Reed
2021-10-07 13:26:44 -04:00
parent 32a9580ffb
commit e3d2f4db37
7 changed files with 447 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

390
quickstart/301-machine-learning-hub-spoke-secure/azure-firewall.tf
View File

@ -1,3 +1,25 @@
resource "azurerm_ip_group" "ip_group_hub" {
name = "hub-ipgroup"
location = azurerm_resource_group.hub_rg.location
resource_group_name = azurerm_resource_group.hub_rg.name
cidrs = var.vnet_hub_address_space
}
resource "azurerm_ip_group" "ip_group_spoke" {
name = "mlw-spoke-ipgroup"
location = azurerm_resource_group.hub_rg.location
resource_group_name = azurerm_resource_group.hub_rg.name
cidrs = var.vnet_address_space
}
resource "azurerm_ip_group" "ip_group_dsvm_subnet" {
name = "dsvm-subnet-ipgroup"
location = azurerm_resource_group.hub_rg.location
resource_group_name = azurerm_resource_group.hub_rg.name
cidrs = var.jumphost_subnet_address_space
}
resource "azurerm_public_ip" "azure_firewall" {
name = "pip-azfw"
location = azurerm_resource_group.default.location
@ -13,10 +35,7 @@ resource "azurerm_firewall_policy" "base_policy" {
dns {
proxy_enabled = true
}
depends_on = [
azurerm_virtual_network_peering.direction1,
azurerm_virtual_network_peering.direction2
]
}
resource "azurerm_firewall" "azure_firewall_instance" {
name = "afw-${var.name}-${var.environment}"
@ -34,12 +53,15 @@ resource "azurerm_firewall" "azure_firewall_instance" {
create = "60m"
delete = "2h"
}
depends_on = [ azurerm_public_ip.azure_firewall,
azurerm_firewall_policy.base_policy]
depends_on = [
azurerm_public_ip.azure_firewall,
azurerm_subnet.azure_firewall,
azurerm_firewall_policy_rule_collection_group.azure_firewall_rules_collection
]
}
resource "azurerm_monitor_diagnostic_setting" "azure_firewall_instance" {
name = "diagnostics"
name = "diagnostics-${var.name}-${var.environment}"
target_resource_id = azurerm_firewall.azure_firewall_instance.id
log_analytics_workspace_id = azurerm_log_analytics_workspace.default.id
@ -77,4 +99,358 @@ resource "azurerm_monitor_diagnostic_setting" "azure_firewall_instance" {
}
}
}
resource "azurerm_firewall_policy_rule_collection_group" "azure_firewall_rules_collection" {
name = "afwp-base-rule-collection-group"
firewall_policy_id = azurerm_firewall_policy.base_policy.id
priority = 100
application_rule_collection {
name = "afwp-base-app-rule-collection"
priority = 200
action = "Allow"
rule {
name = "dsvm-to-internet"
protocols {
type = "Https"
port = 443
}
protocols {
type = "Http"
port= 80
}
source_ip_groups = [azurerm_ip_group.ip_group_dsvm_subnet.id]
destination_fqdns = ["*"]
}
rule {
name = "aks-service-tag"
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdn_tags = ["AzureKubernetesService"]
}
rule {
name = "ubuntu-libraries"
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["api.snapcraft.io","motd.ubuntu.com",]
}
rule {
name = "microsoft-crls"
protocols {
type = "Http"
port = 80
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["crl.microsoft.com",
"mscrl.microsoft.com",
"crl3.digicert.com",
"ocsp.digicert.com"]
}
rule {
name = "github-rules"
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["github.com"]
}
rule {
name = "microsoft-metrics-rules"
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["*.prod.microsoftmetrics.com"]
}
rule {
name = "aks-acs-rules"
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["acs-mirror.azureedge.net",
"*.docker.io",
"production.cloudflare.docker.com",
"*.azurecr.io"]
}
rule {
name = "microsoft-login-rules"
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["login.microsoftonline.com"]
}
rule {
name = "graph.windows.net"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["graph.windows.net"]
}
rule {
name = "anaconda.com"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["anaconda.com", "*.anaconda.com"]
}
rule {
name = "anaconda.org"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["*.anaconda.org"]
}
rule {
name = "pypi.org"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["pypi.org"]
}
rule {
name = "cloud.r-project.org"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["cloud.r-project.org"]
}
rule {
name = "pytorch.org"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["*pytorch.org"]
}
rule {
name = "tensorflow.org"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["*.tensorflow.org"]
}
rule {
name = "update.code.visualstudio.com"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["update.code.visualstudio.com", "*.vo.msecnd.net"]
}
rule {
name = "dc.applicationinsights.azure.com"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["dc.applicationinsights.azure.com"]
}
rule {
name = "dc.applicationinsights.microsoft.com"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["dc.applicationinsights.microsoft.com"]
}
rule {
name = "dc.services.visualstudio.com"
protocols {
type = "Http"
port = 80
}
protocols {
type = "Https"
port = 443
}
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_fqdns = ["dc.services.visualstudio.com"]
}
}
network_rule_collection {
name = "afwp-base-network-rule-collection"
priority = 100
action = "Allow"
rule {
name = "hub-to-spoke-rule"
protocols = ["Any"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_ip_groups = [azurerm_ip_group.ip_group_hub.id]
destination_ports = ["*"]
}
rule {
name = "aks-global-network-rule"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["AzureCloud"]
destination_ports = ["443", "9000"]
}
rule {
name = "aks-ntp-network-rule"
protocols = ["UDP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["*"]
destination_ports = ["123"]
}
rule {
name = "Azure-Active-Directory"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["AzureActiveDirectory"]
destination_ports = ["*"]
}
rule {
name = "Azure-Machine-Learning"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["AzureMachineLearning"]
destination_ports = ["443"]
}
rule {
name = "Azure-Resource-Manager"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["AzureResourceManager"]
destination_ports = ["443"]
}
rule {
name = "Azure-Storage"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["Storage"]
destination_ports = ["443"]
}
rule {
name = "Azure-Front-Door-Frontend"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["AzureFrontDoor.Frontend"]
destination_ports = ["443"]
}
rule {
name = "Azure-Container-Registry"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["AzureContainerRegistry"]
destination_ports = ["443"]
}
rule {
name = "Azure-Key-Vault"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["AzureKeyVault"]
destination_ports = ["443"]
}
rule {
name = "Microsoft-Container-Registry"
protocols = ["TCP"]
source_ip_groups = [azurerm_ip_group.ip_group_spoke.id]
destination_addresses = ["MicrosoftContainerRegistry"]
destination_ports = ["443"]
}
}
depends_on = [
azurerm_ip_group.ip_group_hub,
azurerm_ip_group.ip_group_spoke
]
}