diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 85359bb..14ccccc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -79,4 +79,4 @@ updates: reviewers: - "approvers" # Allow up to 3 open pull requests for pip dependencies - open-pull-requests-limit: 3 \ No newline at end of file + open-pull-requests-limit: 3 diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 4b735f5..1ee6f78 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -10,4 +10,4 @@ jobs: uses: clouddrove/github-shared-workflows/.github/workflows/changelog.yml@master secrets: inherit with: - branch: 'master' \ No newline at end of file + branch: 'master' diff --git a/.github/workflows/readme.yml b/.github/workflows/readme.yml index 03b477f..a4b20c4 100644 --- a/.github/workflows/readme.yml +++ b/.github/workflows/readme.yml @@ -51,4 +51,4 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_TERRAFORM }} # required - if: always() \ No newline at end of file + if: always() diff --git a/.github/workflows/static-checks.yml b/.github/workflows/static-checks.yml index 7bf6ae8..f36c177 100644 --- a/.github/workflows/static-checks.yml +++ b/.github/workflows/static-checks.yml @@ -74,4 +74,4 @@ jobs: terraform_version: ${{ needs.versionExtract.outputs.maxVersion }} - name: Check Terraform format changes - run: terraform fmt --recursive -check=true \ No newline at end of file + run: terraform fmt --recursive -check=true diff --git a/.github/workflows/tfsec.yml b/.github/workflows/tfsec.yml index 9aaf588..c203751 100644 --- a/.github/workflows/tfsec.yml +++ b/.github/workflows/tfsec.yml @@ -8,4 +8,4 @@ jobs: uses: clouddrove/github-shared-workflows/.github/workflows/tfsec.yml@master secrets: inherit with: - working_directory: '.' \ No newline at end of file + working_directory: '.' diff --git a/.gitignore b/.gitignore index a1c4c48..8165665 100644 --- a/.gitignore +++ b/.gitignore @@ -206,4 +206,4 @@ terraform.tfstate *.tfstate *.tfstate.backup *.iml -*.terraform.lock.hcl \ No newline at end of file +*.terraform.lock.hcl diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 9e713a5..be0b877 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,14 +1,14 @@ repos: - repo: https://github.com/gruntwork-io/pre-commit - rev: v0.1.12 # Get the latest from: https://github.com/gruntwork-io/pre-commit/releases + rev: v0.1.23 # Get the latest from: https://github.com/gruntwork-io/pre-commit/releases hooks: - id: terraform-fmt - id: shellcheck - id: tflint - - repo: git://github.com/pre-commit/pre-commit-hooks - rev: v4.0.1 # Use the ref you want to point at + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 # Use the ref you want to point at hooks: - id: end-of-file-fixer - id: trailing-whitespace diff --git a/.releaserc.json b/.releaserc.json index 15f87c2..548e644 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -7,4 +7,4 @@ "@semantic-release/release-notes-generator", "@semantic-release/github" ] -} \ No newline at end of file +} diff --git a/CHANGELOG.md b/CHANGELOG.md index 9bc582f..b8efbbd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,4 +26,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 [1.0.1]: https://github.com/clouddrove/terraform-azure-firewall/compare/1.0.0...1.0.1 -[1.0.2]: https://github.com/clouddrove/terraform-azure-firewall/compare/1.0.1...1.0.2 \ No newline at end of file +[1.0.2]: https://github.com/clouddrove/terraform-azure-firewall/compare/1.0.1...1.0.2 diff --git a/Makefile b/Makefile index 18e2f51..073c5aa 100644 --- a/Makefile +++ b/Makefile @@ -1,2 +1,2 @@ export GENIE_PATH ?= $(shell 'pwd')/../../../genie -include $(GENIE_PATH)/Makefile \ No newline at end of file +include $(GENIE_PATH)/Makefile diff --git a/README.md b/README.md index 7b715a7..f34527f 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ Terraform AZURE FIREWALL -

+

Terraform module to create firewall resource on AZURE.

@@ -38,7 +38,7 @@
-We eat, drink, sleep and most importantly love **DevOps**. We are working towards strategies for standardizing architecture while ensuring security for the infrastructure. We are strong believer of the philosophy Bigger problems are always solved by breaking them into smaller manageable problems. Resonating with microservices architecture, it is considered best-practice to run database, cluster, storage in smaller connected yet manageable pieces within the infrastructure. +We eat, drink, sleep and most importantly love **DevOps**. We are working towards strategies for standardizing architecture while ensuring security for the infrastructure. We are strong believer of the philosophy Bigger problems are always solved by breaking them into smaller manageable problems. Resonating with microservices architecture, it is considered best-practice to run database, cluster, storage in smaller connected yet manageable pieces within the infrastructure. This module is basically combination of [Terraform open source](https://www.terraform.io/) and includes automatation tests and examples. It also helps to create and improve your infrastructure with minimalistic code instead of maintaining the whole infrastructure code yourself. @@ -49,7 +49,7 @@ We have [*fifty plus terraform modules*][terraform_modules]. A few of them are c ## Prerequisites -This module has a few dependencies: +This module has a few dependencies: @@ -420,7 +420,7 @@ module "firewall-rules" { ## Testing -In this module testing is performed with [terratest](https://github.com/gruntwork-io/terratest) and it creates a small piece of infrastructure, matches the output like ARN, ID and Tags name etc and destroy infrastructure in your AWS account. This testing is written in GO, so you need a [GO environment](https://golang.org/doc/install) in your system. +In this module testing is performed with [terratest](https://github.com/gruntwork-io/terratest) and it creates a small piece of infrastructure, matches the output like ARN, ID and Tags name etc and destroy infrastructure in your AWS account. This testing is written in GO, so you need a [GO environment](https://golang.org/doc/install) in your system. You need to run the following command in the testing folder: ```hcl @@ -429,7 +429,7 @@ You need to run the following command in the testing folder: -## Feedback +## Feedback If you come accross a bug or have any feedback, please log it in our [issue tracker](https://github.com/clouddrove/terraform-azure-firewall/issues), or feel free to drop us an email at [hello@clouddrove.com](mailto:hello@clouddrove.com). If you have found it worth your time, go ahead and give us a ★ on [our GitHub](https://github.com/clouddrove/terraform-azure-firewall)! diff --git a/_example/basic/example.tf b/_example/basic/example.tf index 26c2aa0..4bf5d64 100644 --- a/_example/basic/example.tf +++ b/_example/basic/example.tf @@ -1,5 +1,5 @@ -##----------------------------------------------------------------------------- -## Firewall module call. +##----------------------------------------------------------------------------- +## Firewall module call. ## All firewall related resources will be deployed from this module, i.e. including firewall and firewall rules. ##----------------------------------------------------------------------------- module "firewall" { diff --git a/_example/complete/example.tf b/_example/complete/example.tf index 8f18673..316528a 100644 --- a/_example/complete/example.tf +++ b/_example/complete/example.tf @@ -7,7 +7,7 @@ locals { environment = "test" } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Resource Group module call ## Resource group in which all resources will be deployed. ##----------------------------------------------------------------------------- @@ -20,9 +20,9 @@ module "resource_group" { location = "East US" } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Virtual Network module call. -## Virtual Network in firewall specific subnet will be created. +## Virtual Network in firewall specific subnet will be created. ##----------------------------------------------------------------------------- module "vnet" { depends_on = [module.resource_group] @@ -35,9 +35,9 @@ module "vnet" { address_space = "10.0.0.0/16" } -##----------------------------------------------------------------------------- -## Subnet module call. -## Name specific subnet for firewall will be created. +##----------------------------------------------------------------------------- +## Subnet module call. +## Name specific subnet for firewall will be created. ##----------------------------------------------------------------------------- module "name_specific_subnet" { depends_on = [module.vnet] @@ -62,9 +62,9 @@ module "name_specific_subnet" { ] } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Log Analytic Module Call. -## Log Analytic workspace for firerwall diagnostic setting. +## Log Analytic workspace for firerwall diagnostic setting. ##----------------------------------------------------------------------------- module "log-analytics" { source = "clouddrove/log-analytics/azure" @@ -78,8 +78,8 @@ module "log-analytics" { log_analytics_workspace_location = module.resource_group.resource_group_location } -##----------------------------------------------------------------------------- -## Firewall module call. +##----------------------------------------------------------------------------- +## Firewall module call. ## All firewall related resources will be deployed from this module, i.e. including firewall and firewall rules. ##----------------------------------------------------------------------------- module "firewall" { diff --git a/_example/firewall-with-isolated-rules/example.tf b/_example/firewall-with-isolated-rules/example.tf index dee445c..5a43a8b 100644 --- a/_example/firewall-with-isolated-rules/example.tf +++ b/_example/firewall-with-isolated-rules/example.tf @@ -7,7 +7,7 @@ locals { environment = "test" } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Resource Group module call ## Resource group in which all resources will be deployed. ##----------------------------------------------------------------------------- @@ -20,9 +20,9 @@ module "resource_group" { location = "East US" } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Virtual Network module call. -## Virtual Network in firewall specific subnet will be created. +## Virtual Network in firewall specific subnet will be created. ##----------------------------------------------------------------------------- module "vnet" { depends_on = [module.resource_group] @@ -35,9 +35,9 @@ module "vnet" { address_space = "10.0.0.0/16" } -##----------------------------------------------------------------------------- -## Subnet module call. -## Name specific subnet for firewall will be created. +##----------------------------------------------------------------------------- +## Subnet module call. +## Name specific subnet for firewall will be created. ##----------------------------------------------------------------------------- module "name_specific_subnet" { depends_on = [module.vnet] @@ -62,9 +62,9 @@ module "name_specific_subnet" { ] } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Log Analytic Module Call. -## Log Analytic workspace for firerwall diagnostic setting. +## Log Analytic workspace for firerwall diagnostic setting. ##----------------------------------------------------------------------------- module "log-analytics" { source = "clouddrove/log-analytics/azure" @@ -79,9 +79,9 @@ module "log-analytics" { } -##----------------------------------------------------------------------------- -## Firewall module call. -## From this module call firewall rules will not be deployed and thus no rule collection group will be created. +##----------------------------------------------------------------------------- +## Firewall module call. +## From this module call firewall rules will not be deployed and thus no rule collection group will be created. ##----------------------------------------------------------------------------- module "firewall" { depends_on = [module.name_specific_subnet] @@ -102,9 +102,9 @@ module "firewall" { } -##----------------------------------------------------------------------------- -## Firewall-Rules module call. -## This is same module as 'firewall module', but from this module only firewall rules and rule collection group will be deployed. +##----------------------------------------------------------------------------- +## Firewall-Rules module call. +## This is same module as 'firewall module', but from this module only firewall rules and rule collection group will be deployed. ##----------------------------------------------------------------------------- module "firewall-rules" { depends_on = [module.firewall] diff --git a/_example/firewall-with-public-ip-prefix/example.tf b/_example/firewall-with-public-ip-prefix/example.tf index c0971fa..c580fbf 100644 --- a/_example/firewall-with-public-ip-prefix/example.tf +++ b/_example/firewall-with-public-ip-prefix/example.tf @@ -7,7 +7,7 @@ locals { environment = "test" } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Resource Group module call ## Resource group in which all resources will be deployed. ##----------------------------------------------------------------------------- @@ -20,9 +20,9 @@ module "resource_group" { location = "East US" } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Virtual Network module call. -## Virtual Network in firewall specific subnet will be created. +## Virtual Network in firewall specific subnet will be created. ##----------------------------------------------------------------------------- module "vnet" { depends_on = [module.resource_group] @@ -35,9 +35,9 @@ module "vnet" { address_space = "10.0.0.0/16" } -##----------------------------------------------------------------------------- -## Subnet module call. -## Name specific subnet for firewall will be created. +##----------------------------------------------------------------------------- +## Subnet module call. +## Name specific subnet for firewall will be created. ##----------------------------------------------------------------------------- module "name_specific_subnet" { depends_on = [module.vnet] @@ -62,9 +62,9 @@ module "name_specific_subnet" { ] } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Log Analytic Module Call. -## Log Analytic workspace for firerwall diagnostic setting. +## Log Analytic workspace for firerwall diagnostic setting. ##----------------------------------------------------------------------------- module "log-analytics" { source = "clouddrove/log-analytics/azure" @@ -78,8 +78,8 @@ module "log-analytics" { log_analytics_workspace_location = module.resource_group.resource_group_location } -##----------------------------------------------------------------------------- -## Firewall module call. +##----------------------------------------------------------------------------- +## Firewall module call. ## All firewall related resources will be deployed from this module, i.e. including firewall and firewall rules. ##----------------------------------------------------------------------------- module "firewall" { diff --git a/_test/azure_firewall_test.go b/_test/azure_firewall_test.go index 3121d5f..af435b8 100644 --- a/_test/azure_firewall_test.go +++ b/_test/azure_firewall_test.go @@ -31,4 +31,4 @@ func Test(t *testing.T) { assert.Equal(t, "test-clouddrove-firewall", Tags["Name"]) assert.Contains(t, Id, "/subscriptions") } -} \ No newline at end of file +} diff --git a/main.tf b/main.tf index d122759..b6733cd 100644 --- a/main.tf +++ b/main.tf @@ -1,5 +1,5 @@ -##----------------------------------------------------------------------------- -## Labels module callled that will be used for naming and tags. +##----------------------------------------------------------------------------- +## Labels module callled that will be used for naming and tags. ##----------------------------------------------------------------------------- module "labels" { source = "clouddrove/labels/azure" @@ -10,10 +10,10 @@ module "labels" { repository = var.repository } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Below resource will create Public ip in your environment. -## These are individual public ips i.e. does not belong to prefix list. -## This public ip will be attached to firewall. +## These are individual public ips i.e. does not belong to prefix list. +## This public ip will be attached to firewall. ##----------------------------------------------------------------------------- resource "azurerm_public_ip" "public_ip" { count = var.enabled && var.firewall_enable ? length(var.public_ip_names) : 0 @@ -26,9 +26,9 @@ resource "azurerm_public_ip" "public_ip" { tags = module.labels.tags } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Below resource will create Public ip prefix list in your environment. -## Prefix Public ip will be allocated from this prefix list. +## Prefix Public ip will be allocated from this prefix list. ##----------------------------------------------------------------------------- resource "azurerm_public_ip_prefix" "pip-prefix" { count = var.enabled && var.firewall_enable && var.public_ip_prefix_enable ? 1 : 0 @@ -41,9 +41,9 @@ resource "azurerm_public_ip_prefix" "pip-prefix" { tags = module.labels.tags } -##----------------------------------------------------------------------------- +##----------------------------------------------------------------------------- ## Below resource will create Public ip in your environment. -## These public ip will be allocated from prefix list created above. +## These public ip will be allocated from prefix list created above. ##----------------------------------------------------------------------------- resource "azurerm_public_ip" "prefix_public_ip" { count = var.enabled && var.firewall_enable && var.public_ip_prefix_enable ? length(var.prefix_public_ip_names) : 0 @@ -58,9 +58,9 @@ resource "azurerm_public_ip" "prefix_public_ip" { } -##----------------------------------------------------------------------------- -## Below resource will deploy firewall in environment. -## If you don't have to deploy firewall and only deploy firewall rules than set 'var.firewall_enable' variable to false. +##----------------------------------------------------------------------------- +## Below resource will deploy firewall in environment. +## If you don't have to deploy firewall and only deploy firewall rules than set 'var.firewall_enable' variable to false. ##----------------------------------------------------------------------------- resource "azurerm_firewall" "firewall" { count = var.enabled && var.firewall_enable ? 1 : 0 @@ -92,7 +92,7 @@ resource "azurerm_firewall" "firewall" { content { name = format("%s-%s-pipconfig", module.labels.id, it.value) # var.enable_prefix_subnet will only be true when prefix public ips are to be deployed during initial apply and there are no individual public ips to be created. - # Individual public ips can be deployed after initial apply and var.enable_ip_subnet variable must be false. + # Individual public ips can be deployed after initial apply and var.enable_ip_subnet variable must be false. subnet_id = var.enable_prefix_subnet ? it.key == 0 ? var.subnet_id : null : null public_ip_address_id = azurerm_public_ip.prefix_public_ip.*.id[it.key] } @@ -115,9 +115,9 @@ resource "azurerm_firewall" "firewall" { } } -##----------------------------------------------------------------------------- -## Below resource will create firewall policy in your environment. -## Firewall policy can only be deployed along firewall. If only firewall rules are to be deployed than firewall policy must be present in azure environment in which rules are to be deployed. +##----------------------------------------------------------------------------- +## Below resource will create firewall policy in your environment. +## Firewall policy can only be deployed along firewall. If only firewall rules are to be deployed than firewall policy must be present in azure environment in which rules are to be deployed. ##----------------------------------------------------------------------------- resource "azurerm_firewall_policy" "policy" { count = var.enabled && var.firewall_enable ? 1 : 0 @@ -134,9 +134,9 @@ resource "azurerm_firewall_policy" "policy" { } } -##----------------------------------------------------------------------------- -## Below resource will deploy a user assigned identity. -## This identity will be attached to created firewall policy. So, can be created only when firewall policy is created using this module. +##----------------------------------------------------------------------------- +## Below resource will deploy a user assigned identity. +## This identity will be attached to created firewall policy. So, can be created only when firewall policy is created using this module. ##----------------------------------------------------------------------------- resource "azurerm_user_assigned_identity" "identity" { count = var.enabled && var.firewall_enable ? 1 : 0 @@ -145,9 +145,9 @@ resource "azurerm_user_assigned_identity" "identity" { resource_group_name = var.resource_group_name } -##----------------------------------------------------------------------------- -## Below resource will create firewall policy rule collection group. -## All application rules will be there in this group. +##----------------------------------------------------------------------------- +## Below resource will create firewall policy rule collection group. +## All application rules will be there in this group. ##----------------------------------------------------------------------------- resource "azurerm_firewall_policy_rule_collection_group" "app_policy_rule_collection_group" { count = var.enabled && var.policy_rule_enabled ? 1 : 0 @@ -183,9 +183,9 @@ resource "azurerm_firewall_policy_rule_collection_group" "app_policy_rule_collec } } -##----------------------------------------------------------------------------- -## Below resource will create firewall policy rule collection group. -## All network rules will be there in this group. +##----------------------------------------------------------------------------- +## Below resource will create firewall policy rule collection group. +## All network rules will be there in this group. ##----------------------------------------------------------------------------- resource "azurerm_firewall_policy_rule_collection_group" "network_policy_rule_collection_group" { count = var.enabled && var.policy_rule_enabled ? 1 : 0 @@ -218,9 +218,9 @@ resource "azurerm_firewall_policy_rule_collection_group" "network_policy_rule_co } } -##----------------------------------------------------------------------------- -## Below resource will create firewall policy rule collection group. -## All dnat rules will be there in this group. +##----------------------------------------------------------------------------- +## Below resource will create firewall policy rule collection group. +## All dnat rules will be there in this group. ##----------------------------------------------------------------------------- resource "azurerm_firewall_policy_rule_collection_group" "nat_policy_rule_collection_group" { count = var.enabled && var.dnat-destination_ip && var.policy_rule_enabled ? 1 : 0 @@ -251,8 +251,8 @@ resource "azurerm_firewall_policy_rule_collection_group" "nat_policy_rule_collec } } -##----------------------------------------------------------------------------- -## Below resource will create diagnostic setting for firewall. +##----------------------------------------------------------------------------- +## Below resource will create diagnostic setting for firewall. ##----------------------------------------------------------------------------- resource "azurerm_monitor_diagnostic_setting" "firewall_diagnostic-setting" { count = var.enabled && var.enable_diagnostic ? 1 : 0 diff --git a/outputs.tf b/outputs.tf index 4023992..b0bab85 100644 --- a/outputs.tf +++ b/outputs.tf @@ -37,4 +37,4 @@ output "prefix_public_ip_address" { output "public_ip_prefix_id" { value = join("", azurerm_public_ip_prefix.pip-prefix.*.id) -} \ No newline at end of file +} diff --git a/versions.tf b/versions.tf index 6ad51f9..3fe1f15 100644 --- a/versions.tf +++ b/versions.tf @@ -9,4 +9,4 @@ terraform { version = ">=2.90.0" } } -} \ No newline at end of file +}