terraform-azure-mcaf-network

Terraform module to generate virtual network, subnet, dns_zones.

Requirements

Name	Version
terraform	>= 1.8
azurerm	>= 4

Providers

Name	Version
azurerm	>= 4

Modules

No modules.

Resources

Name	Type
azurerm_nat_gateway.this	resource
azurerm_nat_gateway_public_ip_association.this	resource
azurerm_network_security_group.additional	resource
azurerm_network_security_group.azbastion	resource
azurerm_network_security_group.simple	resource
azurerm_network_security_group.this	resource
azurerm_network_security_rule.additional	resource
azurerm_network_security_rule.azbastion	resource
azurerm_network_security_rule.default	resource
azurerm_network_security_rule.simple	resource
azurerm_private_dns_zone.this	resource
azurerm_private_dns_zone_virtual_network_link.this	resource
azurerm_public_ip.this	resource
azurerm_resource_group.this	resource
azurerm_subnet.this	resource
azurerm_subnet_nat_gateway_association.this	resource
azurerm_subnet_network_security_group_association.additional	resource
azurerm_subnet_network_security_group_association.azbastion	resource
azurerm_subnet_network_security_group_association.simple	resource
azurerm_subnet_network_security_group_association.this	resource
azurerm_virtual_network.this	resource

Inputs

Name	Description	Type	Default	Required
vnet_name	The name of the virtual network.	string	n/a	yes
azure_bastion_security_rules	A map of security rules to be created in the AzureBastionSubnet Network Security Group. The key of the map is the name of the security rule. This Map contains the required rules for the Azure Bastion Subnet. These rules are required for the Azure Bastion service to work properly. This map is merged with the default rules and security rules to create the final set of rules for the Azure Bastion Subnet. hcl subnets = { "AzureBastionSubnet" = { address_prefixes = ["100.0.5.0/24"] } hcl	map(object({ name = string access = string direction = string priority = number protocol = string description = optional(string) destination_address_prefix = optional(string, null) destination_address_prefixes = optional(set(string), null) destination_application_security_group_ids = optional(set(string), null) destination_port_range = optional(string, null) destination_port_ranges = optional(set(string), null) source_address_prefix = optional(string, null) source_address_prefixes = optional(set(string), null) source_application_security_group_ids = optional(set(string), null) source_port_range = optional(string, null) source_port_ranges = optional(set(string), null) timeouts = optional(object({ create = optional(string, "30") delete = optional(string, "30") read = optional(string, "5") update = optional(string, "30") })) }))	{ "Allow-DataPlane-in-from-VirtualNetwork": { "access": "Allow", "description": "Allow DataPlane traffic from the VirtualNetwork", "destination_address_prefix": "VirtualNetwork", "destination_port_range": "8080", "direction": "Inbound", "name": "Allow-DataPlane-in-from-VirtualNetwork", "priority": 4042, "protocol": "Tcp", "source_address_prefix": "VirtualNetwork", "source_port_range": "" }, "Allow-DataPlane-in-from-VirtualNetwork-5701": { "access": "Allow", "description": "Allow DataPlane traffic from the VirtualNetwork on port 5701", "destination_address_prefix": "VirtualNetwork", "destination_port_range": "5701", "direction": "Inbound", "name": "Allow-DataPlane-in-from-VirtualNetwork-5701", "priority": 4043, "protocol": "Tcp", "source_address_prefix": "VirtualNetwork", "source_port_range": "" }, "Allow-DataPlane-out-to-VirtualNetwork-5701": { "access": "Allow", "description": "Allow DataPlane traffic to the VirtualNetwork on port 5701", "destination_address_prefix": "VirtualNetwork", "destination_port_range": "5701", "direction": "Outbound", "name": "Allow-DataPlane-out-to-VirtualNetwork-5701", "priority": 4043, "protocol": "Tcp", "source_address_prefix": "", "source_port_range": "" }, "Allow-DataPlane-out-to-VirtualNetwork-8080": { "access": "Allow", "description": "Allow DataPlane traffic to the VirtualNetwork on port 8080", "destination_address_prefix": "VirtualNetwork", "destination_port_range": "8080", "direction": "Outbound", "name": "Allow-DataPlane-out-to-VirtualNetwork-8080", "priority": 4042, "protocol": "Tcp", "source_address_prefix": "", "source_port_range": "" }, "Allow-Http-out-to-Internet": { "access": "Allow", "description": "Allow HTTP traffic to the Internet", "destination_address_prefix": "Internet", "destination_port_range": "80", "direction": "Outbound", "name": "Allow-Http-out-to-Internet", "priority": 4045, "protocol": "Tcp", "source_address_prefix": "", "source_port_range": "" }, "Allow-Https-in-from-AzureLoadBalancer": { "access": "Allow", "description": "Allow HTTPS traffic from the AzureLoadBalancer", "destination_address_prefix": "", "destination_port_range": "443", "direction": "Inbound", "name": "Allow-Https-in-from-AzureLoadBalancer", "priority": 4044, "protocol": "Tcp", "source_address_prefix": "AzureLoadBalancer", "source_port_range": "" }, "Allow-Https-in-from-GatewayManager": { "access": "Allow", "description": "Allow HTTPS traffic from the GatewayManager", "destination_address_prefix": "", "destination_port_range": "443", "direction": "Inbound", "name": "Allow-Https-in-from-GatewayManager", "priority": 4041, "protocol": "Tcp", "source_address_prefix": "GatewayManager", "source_port_range": "" }, "Allow-Https-in-from-Internet": { "access": "Allow", "description": "Allow HTTPS traffic from the Internet", "destination_address_prefix": "", "destination_port_range": "443", "direction": "Inbound", "name": "Allow-Https-in-from-Internet", "priority": 4040, "protocol": "Tcp", "source_address_prefix": null, "source_address_prefixes": null, "source_port_range": "" }, "Allow-Https-out-to-AzureCloud": { "access": "Allow", "description": "Allow HTTPS traffic to the AzureCloud", "destination_address_prefix": "AzureCloud", "destination_port_range": "443", "direction": "Outbound", "name": "Allow-Https-out-to-AzureCloud", "priority": 4044, "protocol": "Tcp", "source_address_prefix": "", "source_port_range": "" }, "Allow-Rdp-out-to-VirtualNetwork": { "access": "Allow", "description": "Allow RDP traffic to the VirtualNetwork", "destination_address_prefix": "VirtualNetwork", "destination_port_range": "3389", "direction": "Outbound", "name": "Allow-Rdp-out-to-VirtualNetwork", "priority": 4040, "protocol": "Tcp", "source_address_prefix": "", "source_port_range": "" }, "Allow-Ssh-out-to-VirtualNetwork": { "access": "Allow", "description": "Allow SSH traffic to the VirtualNetwork", "destination_address_prefix": "VirtualNetwork", "destination_port_range": "22", "direction": "Outbound", "name": "Allow-Ssh-out-to-VirtualNetwork", "priority": 4041, "protocol": "Tcp", "source_address_prefix": "", "source_port_range": "" } }	no
azure_bastion_source_ip_prefixes	The source IP prefixes that can access the Azure Bastion service, recommendation is not to use the default!	set(string)	[ "0.0.0.0/0" ]	no
default_rules	A map of default security rules to be created in every Network Security Group, except if you specificy "network_security_group_config -> Azure default" in the subnet configuration. but of course, you can override these defaults by specifying the same rule in a new default_rules map. This map is merged with the security rules map to create the final set of rules for the Network Security Group. hcl subnets = { "ToolingSubnet" = { address_prefixes = ["100.0.3.0/24"] default_outbound_access_enabled = false create_network_security_group = true network_security_group_config = { azure_default = true } } hcl	map(object({ name = string access = string direction = string priority = number protocol = string description = optional(string) destination_address_prefix = optional(string, null) destination_address_prefixes = optional(set(string), null) destination_application_security_group_ids = optional(set(string), null) destination_port_range = optional(string, null) destination_port_ranges = optional(set(string), null) source_address_prefix = optional(string, null) source_address_prefixes = optional(set(string), null) source_application_security_group_ids = optional(set(string), null) source_port_range = optional(string, null) source_port_ranges = optional(set(string), null) timeouts = optional(object({ create = optional(string, "30") delete = optional(string, "30") read = optional(string, "5") update = optional(string, "30") })) }))	{ "Allow-Http-out-to-vnets": { "access": "Allow", "description": "Allow HTTP(S) traffic to VNets", "destination_address_prefix": "VirtualNetwork", "destination_port_ranges": [ "80", "443" ], "direction": "Outbound", "name": "Allow-Http-out-to-vnets", "priority": 4095, "protocol": "Tcp", "source_address_prefix": "VirtualNetwork", "source_port_range": "" }, "Allow-Https-in-from-vnets": { "access": "Allow", "description": "Allow HTTPS traffic from VNets", "destination_address_prefix": "VirtualNetwork", "destination_port_range": "443", "direction": "Inbound", "name": "Allow-Https-in-from-vnets", "priority": 4095, "protocol": "Tcp", "source_address_prefix": "VirtualNetwork", "source_port_range": "" }, "Deny-Any-Any-Any-In": { "access": "Deny", "description": "Deny all inbound traffic", "destination_address_prefix": "", "destination_port_range": "", "direction": "Inbound", "name": "Deny-Any-Any-Any-In", "priority": 4096, "protocol": "", "source_address_prefix": "", "source_port_range": "" }, "Deny-Any-Any-Any-Out": { "access": "Deny", "description": "Deny all outbound traffic", "destination_address_prefix": "", "destination_port_range": "", "direction": "Outbound", "name": "Deny-Any-Any-Any-Out", "priority": 4096, "protocol": "", "source_address_prefix": "", "source_port_range": "" } }	no
natgateway	This object describes the public IP configuration when creating Nat Gateway's with a public IP. If creating more than one public IP, then these values will be used for all public IPs. - allocation_method = (Required) - Defines the allocation method for this IP address. Possible values are Static or Dynamic. - ddos_protection_mode = (Optional) - The DDoS protection mode of the public IP. Possible values are Disabled, Enabled, and VirtualNetworkInherited. Defaults to VirtualNetworkInherited. - ddos_protection_plan_id = (Optional) - The ID of DDoS protection plan associated with the public IP. ddos_protection_plan_id can only be set when ddos_protection_mode is Enabled - domain_name_label = (Optional) - Label for the Domain Name. Will be used to make up the FQDN. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system. - idle_timeout_in_minutes = (Optional) - Specifies the timeout for the TCP idle connection. The value can be set between 4 and 30 minutes. - inherit_tags = (Optional) - Defaults to false. Set this to false if only the tags defined on this resource should be applied. - Future functionality leaving in. - ip_version = (Optional) - The IP Version to use, IPv6 or IPv4. Changing this forces a new resource to be created. Only static IP address allocation is supported for IPv6. - lock_level = (Optional) - Set this value to override the resource level lock value. Possible values are None, CanNotDelete, and ReadOnly. - name = (Optional) - The name of the Nat gateway. Changing this forces a new resource to be created. - sku = (Optional) - The SKU of the Public IP. Accepted values are Basic and Standard. Defaults to Standard to support zones by default. Changing this forces a new resource to be created. When sku_tier is set to Global, sku must be set to Standard. - sku_tier = (Optional) - The SKU tier of the Public IP. Accepted values are Global and Regional. Defaults to Regional - zones = (Optional) - A list of zones where this public IP should be deployed. Defaults to no zone. if you prefer, you can set other values for the zones ["1","2","3"]. Changing this forces a new resource to be created. Example Inputs: hcl natgateway = { name = "my-nat-gw" } hcl	object({ name = optional(string, null) allocation_method = optional(string, "Static") ddos_protection_mode = optional(string, "VirtualNetworkInherited") ddos_protection_plan_id = optional(string, null) domain_name_label = optional(string, null) idle_timeout_in_minutes = optional(number, 4) inherit_tags = optional(bool, true) ip_version = optional(string, "IPv4") lock_level = optional(string, null) sku = optional(string, "Standard") sku_tier = optional(string, "Regional") zones = optional(list(string)) })	null	no
private_dns	This object describes the private DNS configuration for the virtual network. - zone_name = (Required) - The name of the private DNS zone. - zone_link_enabled = (Optional) - Whether to link the private DNS zone to the virtual network. Defaults to true. - zone_link_name = (Optional) - The name of the private DNS zone link. Changing this forces a new resource to be created. - resource_group_name = (Optional) - The name of the resource group to link the private DNS zone to. Changing this forces a new resource to be created. Example Inputs: hcl private_dns = { "keyvault" = { zone_name = "privatelink.vaultcore.azure.net" } "blob" = { zone_name = "privatelink.blob.core.windows.net" } "azurecr" = { zone_name = "privatelink.azurecr.io" } } hcl	map(object({ zone_name = string zone_link_enabled = optional(bool, true) zone_link_name = optional(string) resource_group_name = optional(string) }))	null	no
public_ip	This object describes the public IP configuration when creating a public IP. Its is preconfigured by the Nat Gateway. - allocation_method = (Optional) - Defines the allocation method for this IP address. Possible values are Static or Dynamic, default is Static. - ip_version = (Optional) - The IP Version to use, IPv6 or IPv4. Changing this forces a new resource to be created. Only static IP address allocation is supported for IPv6, Default is IPv4. - name = (Optional) - The name of the Public IP. Changing this forces a new resource to be created. - sku = (Optional) - The SKU of the Public IP. Accepted values are Basic and Standard. Defaults to Standard. Changing this forces a new resource to be created. - sku_tier = (Optional) - The SKU Tier that should be used for the Public IP. Possible values are Regional and Global. Defaults to Regional. Changing this forces a new resource to be created. - zones = (Optional) - A collection containing the availability zone to allocate the Public IP in. Changing this forces a new resource to be created, Availability Zones are only supported with a Standard SKU and in select regions at this time. Standard SKU Public IP Addresses that do not specify a zone are not zone-redundant by default. }	object({ name = optional(string, null) allocation_method = optional(string, "Static") ip_version = optional(string, "IPv4") sku = optional(string, "Standard") sku_tier = optional(string, "Regional") zones = optional(list(string)) })	{}	no
resource_group	The name of the resource group in which to create the resources.	object({ name = string location = string })	{ "location": null, "name": null }	no
security_rules	A map of security rules to be created in every Network Security Group. The key of the map is the name of the security rule. - access - (Required) Specifies whether network traffic is allowed or denied. Possible values are Allow and Deny. - name - (Required) Name of the network security rule to be created. - description - (Optional) A description for this rule. Restricted to 140 characters. - destination_address_prefix - (Optional) CIDR or destination IP range or * to match any IP. Tags such as VirtualNetwork, AzureLoadBalancer and Internet can also be used. Besides, it also supports all available Service Tags like ‘Sql.WestEurope‘, ‘Storage.EastUS‘, etc. You can list the available service tags with the CLI: shell az network list-service-tags --location westcentralus . For further information please see [Azure CLI - destination_address_prefixes - (Optional) List of destination address prefixes. Tags may not be used. This is required if destination_address_prefix is not specified. - destination_application_security_group_ids - (Optional) A List of destination Application Security Group IDs - destination_port_range - (Optional) Destination Port or Range. Integer or range between 0 and 65535 or * to match any. This is required if destination_port_ranges is not specified. - destination_port_ranges - (Optional) List of destination ports or port ranges. This is required if destination_port_range is not specified. - direction - (Required) The direction specifies if rule will be evaluated on incoming or outgoing traffic. Possible values are Inbound and Outbound. - name - (Required) The name of the security rule. This needs to be unique across all Rules in the Network Security Group. Changing this forces a new resource to be created. - priority - (Required) Specifies the priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule. - protocol - (Required) Network protocol this rule applies to. Possible values include Tcp, Udp, Icmp, Esp, Ah or * (which matches all). - resource_group_name - (Required) The name of the resource group in which to create the Network Security Rule. Changing this forces a new resource to be created. - source_address_prefix - (Optional) CIDR or source IP range or * to match any IP. Tags such as VirtualNetwork, AzureLoadBalancer and Internet can also be used. This is required if source_address_prefixes is not specified. - source_address_prefixes - (Optional) List of source address prefixes. Tags may not be used. This is required if source_address_prefix is not specified. - source_application_security_group_ids - (Optional) A List of source Application Security Group IDs - source_port_range - (Optional) Source Port or Range. Integer or range between 0 and 65535 or * to match any. This is required if source_port_ranges is not specified. - source_port_ranges - (Optional) List of source ports or port ranges. This is required if source_port_range is not specified. --- timeouts block supports the following: - create - (Defaults to 30 minutes) Used when creating the Network Security Rule. - delete - (Defaults to 30 minutes) Used when deleting the Network Security Rule. - read - (Defaults to 5 minutes) Used when retrieving the Network Security Rule. - update - (Defaults to 30 minutes) Used when updating the Network Security Rule. hcl security_rules = { "test" = { access = "Allow" name = "Allow-HTTPS-Internet" description = "Allow HTTPS traffic to the Internet" destination_address_prefix = "Internet" destination_port_range = "443" direction = "Outbound" priority = 555 protocol = "Tcp" source_address_prefix = "VirtualNetwork" source_port_range = "*" } } hcl	map(object({ name = string access = string description = optional(string) destination_address_prefix = optional(string) destination_address_prefixes = optional(set(string)) destination_application_security_group_ids = optional(set(string)) destination_port_range = optional(string) destination_port_ranges = optional(set(string)) direction = string priority = number protocol = string source_address_prefix = optional(string) source_address_prefixes = optional(set(string)) source_application_security_group_ids = optional(set(string)) source_port_range = optional(string) source_port_ranges = optional(set(string)) timeouts = optional(object({ create = optional(string) delete = optional(string) read = optional(string) update = optional(string) })) }))	{}	no
subnets	This object describes the subnets to create within the virtual network. - address_prefix = (Optional) - The address prefix to use for the subnet. Changing this forces a new resource to be created. - address_prefixes = (Optional) - The address prefixes to use for the subnet. Changing this forces a new resource to be created. - name = (Optional) - The name of the subnet. Changing this forces a new resource to be created. - create_network_security_group = (Optional) - Whether to create a specific Network Security Group for the subnet. Defaults to false. - network_security_group_config = (Optional) - The configuration for the Network Security Group. Changing this forces a new resource to be created. azure_default = (Optional) - Whether to use the Azure default Network Security Group rules. Defaults to false. - network_security_group_id = (Optional) - The ID of the Network Security Group to associate with the subnet. Changing this forces a new resource to be created. - no_nsg_association = (Optional) - Whether to associate a Network Security Group with the subnet. Defaults to false. - nat_gateway = (Optional) - The NAT Gateway to associate with the subnet. Changing this forces a new resource to be created. - network_security_group = (Optional) - The Network Security Group to associate with the subnet. Changing this forces a new resource to be created. - private_endpoint_network_policies = (Optional) - The network policies for private endpoints on the subnet. Possible values are Enabled and Disabled. Defaults to Enabled. - private_link_service_network_policies_enabled = (Optional) - Enable or disable network policies for private link service on the subnet. Defaults to true. - route_table = (Optional) - The Route Table to associate with the subnet. Changing this forces a new resource to be created. - service_endpoint_policies = (Optional) - The service endpoint policies to associate with the subnet. Changing this forces a new resource to be created. - service_endpoints = (Optional) - The service endpoints to associate with the subnet. Changing this forces a new resource to be created. - default_outbound_access_enabled = (Optional) - Whether to allow outbound traffic from the subnet. Defaults to false. - sharing_scope = (Optional) - The sharing scope of the subnet. Possible values are None, Shared, and Service. Defaults to None. - delegate_to = (Optional) - The service to delegate to. Changing this forces a new resource to be created. - timeouts = (Optional) - The timeouts for the subnet. - role_assignments = (Optional) - The role assignments for the subnet. Example Inputs: hcl subnets = { "CoreSubnet" = { address_prefixes = ["100.0.1.0/24"] default_outbound_access_enabled = false } "DevopsSubnet" = { address_prefixes = ["100.0.2.0/24"] default_outbound_access_enabled = false delegate_to = "Microsoft.ContainerInstance/containerGroups" create_network_security_group = true } "ToolingSubnet" = { address_prefixes = ["100.0.3.0/24"] default_outbound_access_enabled = false create_network_security_group = true network_security_group_config = { azure_default = true } } "OtherSubnet" = { address_prefixes = ["100.0.4.0/24"] default_outbound_access_enabled = false no_nsg_association = true } "AzureBastionSubnet" = { address_prefixes = ["100.0.5.0/24"] default_outbound_access_enabled = false } } hcl	map(object({ name = optional(string) address_prefix = optional(string) address_prefixes = optional(list(string)) default_outbound_access_enabled = optional(bool, false) delegate_to = optional(string, null) nat_gateway = optional(object({ id = string })) no_nsg_association = optional(bool, false) create_network_security_group = optional(bool, false) network_security_group_config = optional(object({ azure_default = optional(bool, false) }), null) network_security_group_id = optional(string, null) private_endpoint_network_policies = optional(string, "Enabled") private_link_service_network_policies_enabled = optional(bool, true) role_assignments = optional(map(object({ role_definition_id_or_name = string principal_id = string description = optional(string, null) skip_service_principal_aad_check = optional(bool, false) condition = optional(string, null) condition_version = optional(string, null) delegated_managed_identity_resource_id = optional(string, null) principal_type = optional(string, null) }))) route_table = optional(object({ id = string })) service_endpoint_policies = optional(map(object({ id = string }))) service_endpoints = optional(set(string)) sharing_scope = optional(string, null) timeouts = optional(object({ create = optional(string) delete = optional(string) read = optional(string) update = optional(string) })) }))	{}	no
tags	A map of tags to assign to the resource.	map(string)	{}	no
vnet_address_space	The address space that is used by the virtual network.	list(string)	[ "10.0.0.0/16" ]	no
vnet_dns_servers	The DNS servers to be used by the virtual network.	list(string)	[]	no

Outputs

Name	Description
all_network_security_groups	A map of all network security groups created keyed by subnet
all_subnets	A list of all subnets created
id	The ID of the virtual network
name	The name of the virtual network
private_dns_zone_list	A map of private DNS zone names to their corresponding names and IDs
resource_group	The resource group in which the virtual network is created
subnets	A map of subnet names to their corresponding names and IDs
subnets_with_default_nsg	n/a
subnets_with_nsg	n/a
subnets_with_nsg_azure_default	n/a

License

Copyright: Schuberg Philis

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.