110 lines
2.4 KiB
HCL
110 lines
2.4 KiB
HCL
terraform {
|
|
|
|
required_version = ">=0.12"
|
|
|
|
required_providers {
|
|
azurerm = {
|
|
source = "hashicorp/azurerm"
|
|
version = ">=2.46.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "azurerm" {
|
|
features {}
|
|
}
|
|
|
|
resource "azurerm_resource_group" "rg" {
|
|
name = "test-resources"
|
|
location = var.resource_group_location
|
|
}
|
|
|
|
resource "azurerm_virtual_network" "vnet" {
|
|
name = "testvnet"
|
|
address_space = ["10.0.0.0/16"]
|
|
location = azurerm_resource_group.rg.location
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
}
|
|
|
|
resource "azurerm_subnet" "subnet" {
|
|
name = "AzureFirewallSubnet"
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
virtual_network_name = azurerm_virtual_network.vnet.name
|
|
address_prefixes = ["10.0.1.0/24"]
|
|
}
|
|
|
|
resource "azurerm_public_ip" "pip" {
|
|
name = "testpip"
|
|
location = azurerm_resource_group.rg.location
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
allocation_method = "Static"
|
|
sku = "Standard"
|
|
}
|
|
|
|
resource "azurerm_firewall" "fw" {
|
|
name = "testfirewall"
|
|
location = azurerm_resource_group.rg.location
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
|
|
ip_configuration {
|
|
name = "configuration"
|
|
subnet_id = azurerm_subnet.subnet.id
|
|
public_ip_address_id = azurerm_public_ip.pip.id
|
|
}
|
|
}
|
|
|
|
resource "azurerm_firewall_application_rule_collection" "app-rc" {
|
|
name = "apptestcollection"
|
|
azure_firewall_name = azurerm_firewall.fw.name
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
priority = 100
|
|
action = "Allow"
|
|
|
|
rule {
|
|
name = "testrule"
|
|
|
|
source_addresses = [
|
|
"10.0.0.0/16",
|
|
]
|
|
|
|
target_fqdns = [
|
|
"*.google.com",
|
|
]
|
|
|
|
protocol {
|
|
port = "443"
|
|
type = "Https"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "azurerm_firewall_network_rule_collection" "net-rc" {
|
|
name = "nettestcollection"
|
|
azure_firewall_name = azurerm_firewall.fw.name
|
|
resource_group_name = azurerm_resource_group.rg.name
|
|
priority = 100
|
|
action = "Allow"
|
|
|
|
rule {
|
|
name = "dnsrule"
|
|
|
|
source_addresses = [
|
|
"10.0.0.0/16",
|
|
]
|
|
|
|
destination_ports = [
|
|
"53",
|
|
]
|
|
|
|
destination_addresses = [
|
|
"8.8.8.8",
|
|
"8.8.4.4",
|
|
]
|
|
|
|
protocols = [
|
|
"TCP",
|
|
"UDP",
|
|
]
|
|
}
|
|
}
|