{"id":29416003,"url":"https://github.com/humanascode/terraform-azapi-nsgator","last_synced_at":"2025-07-11T18:33:31.884Z","repository":{"id":302806573,"uuid":"1012708028","full_name":"humanascode/terraform-azapi-nsgator","owner":"humanascode","description":null,"archived":false,"fork":false,"pushed_at":"2025-07-04T09:55:46.000Z","size":604,"stargazers_count":9,"open_issues_count":0,"forks_count":2,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-04T10:41:11.304Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/humanascode.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-02T18:51:17.000Z","updated_at":"2025-07-04T09:54:24.000Z","dependencies_parsed_at":"2025-07-04T10:51:57.961Z","dependency_job_id":null,"html_url":"https://github.com/humanascode/terraform-azapi-nsgator","commit_stats":null,"previous_names":["humanascode/terraform-azapi-nsgator"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/humanascode/terraform-azapi-nsgator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humanascode%2Fterraform-azapi-nsgator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humanascode%2Fterraform-azapi-nsgator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humanascode%2Fterraform-azapi-nsgator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humanascode%2Fterraform-azapi-nsgator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/humanascode","download_url":"https://codeload.github.com/humanascode/terraform-azapi-nsgator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/humanascode%2Fterraform-azapi-nsgator/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264869957,"owners_count":23676137,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-07-11T18:30:44.858Z","updated_at":"2025-07-11T18:33:31.872Z","avatar_url":"https://github.com/humanascode.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Azure Network Security Group Rules Management Module (NSGator)\n\nA Terraform module for managing Network Security Group (NSG) rules in Azure with intelligent priority assignment and duplicate detection.\n\n\u003cimg src=\"images/nsgator.png\" alt=\"NSGator Logo\" width=\"200\"/\u003e\n\n## What is NSGator?\n\nNSGator is a Terraform module that automates Azure NSG rule management by handling priority assignment, detecting duplicates, and ensuring consistent rule deployment across network security groups.\n\nIts input is a map of objcets, each object reprsents a connectivity path including source and destination IPs, ports, protocols, and a workload identifier. The module takes care of creating inbound and outbound rules as needed and manages priorities intelligently to avoid conflicts and ensure zero-downtime updates.\n\n## Who is it for?\n\nThis module simplifies managing multiple rules across Azure Network Security Groups (NSGs). It's especially useful for organizations using deny-by-default security policies that need to explicitly allow traffic for specific workloads while maintaining clear and consistent rule management.\n\n## Overview\n\nNSGator simplifies Azure NSG rule management by providing:\n- **Intelligent Priority Assignment**: Automatically assigns priorities to new rules within specified ranges\n- **Smart Duplicate Detection**: Identifies and preserves existing rules to prevent conflicts\n- **Bidirectional Rule Support**: Creates both inbound and outbound rules as needed\n- **Automated Tagging**: Tracks Terraform-managed priority ranges with NSG tags\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| terraform | \u003e= 1.0 |\n| azapi | \u003e= 2.0 |\n\n## Quick Start\n\nFor a complete working example, see the [basic example](examples/basic-example/main.tf) in the examples directory.\n\nJust:\n- Copy the main.tf file\n- Update your subscription ID under the `azurerm` provider block\n- Run `terraform init` to initialize the module\n- Run `terraform apply` to create the NSG rules\n\n\n## Rule Naming Convention\n\nThe module automatically prefixes rule names based on direction:\n- **Outbound rules** (source NSG): `outbound-${workload}-${protocol}` (e.g., `outbound-web-Tcp`)\n- **Inbound rules** (destination NSG): `inbound-${workload}-${protocol}` (e.g., `inbound-web-Tcp`)\n\nThis naming convention helps identify rule direction and purpose at a glance.\n\n## Priority Assignment Logic\n\n1. **Existing Rules**: If a rule with identical properties exists, the module preserves its current priority\n2. **New Rules**: Assigned sequential priorities starting from the highest existing priority + 1\n3. **Range Validation**: New rules are only created if they fall within the specified priority range\n4. **Error Handling**: Rules that would exceed the priority range are skipped with an error message\n\n\n## Configuration Reference\n### Input Variables\n\n| Name                  | Description                                                        | Type                                                                 | Default | Required |\n|-----------------------|--------------------------------------------------------------------|----------------------------------------------------------------------|---------|:--------:|\n| source_nsg_id         | The ID of the source NSG                                          | `string`                                                             | `null`  |  no\\*    |\n| destination_nsg_id    | The ID of the destination NSG                                     | `string`                                                             | `null`  |  no\\*    |\n| create_outbound_rules | Flag to create outbound rules                                      | `bool`                                                               | `true`  |   no     |\n| create_inbound_rules  | Flag to create inbound rules                                       | `bool`                                                               | `true`  |   no     |\n| rules                 | Map of rules to create                                             | \u003cpre\u003emap(object({\u003cbr\u003e  access            = optional(string, \"Allow\")\u003cbr\u003e  source_ips        = set(string)\u003cbr\u003e  destination_ips   = set(string)\u003cbr\u003e  ports             = set(string)\u003cbr\u003e  protocol          = string\u003cbr\u003e  workload          = string\u003cbr\u003e  source_port_range = optional(string, \"*\")\u003cbr\u003e}))\u003c/pre\u003e | n/a     |   yes    |\n| priority_range        | Priority ranges for source and destination NSGs                   | \u003cpre\u003eobject({\u003cbr\u003e  source_start      = optional(number, 0)\u003cbr\u003e  source_end        = optional(number, 0)\u003cbr\u003e  destination_start = optional(number, 0)\u003cbr\u003e  destination_end   = optional(number, 0)\u003cbr\u003e})\u003c/pre\u003e | n/a     |   yes    |\n\n\\*At least one of `source_nsg_id` or `destination_nsg_id` must be provided.\n\n### priority_range Object\n\n```hcl\npriority_range = {\n  source_start      = optional(number, 0)  # Start of priority range for source NSG (required if source_nsg_id is provided)\n  source_end        = optional(number, 0)  # End of priority range for source NSG (required if source_nsg_id is provided)\n  destination_start = optional(number, 0)  # Start of priority range for destination NSG (required if destination_nsg_id is provided)\n  destination_end   = optional(number, 0)  # End of priority range for destination NSG (required if destination_nsg_id is provided)\n}\n```\n\n### rules Object\n\n```hcl\nrules = {\n  \"rule-name\" = {\n    access            = \"Allow\"                       # Allow or Deny (optional, defaults to Allow)\n    source_ips        = [\"10.1.1.0/24\", \"10.1.2.10\"] # Set of source IP addresses/CIDR ranges\n    destination_ips   = [\"10.2.1.0/24\", \"10.2.2.20\"] # Set of destination IP addresses/CIDR ranges\n    ports             = [\"80\", \"443\"]                 # Set of destination ports\n    protocol          = \"Tcp\"                         # Protocol: Tcp, Udp, Icmp, Esp, Ah, or *\n    workload          = \"web\"                         # Workload identifier for rule naming\n    source_port_range = \"*\"                           # Source port range (optional, defaults to \"*\")\n  }\n}\n```\n\n## Outputs\n\nThis module does not expose outputs. Rule creation status can be monitored through Terraform plan/apply output.\n\n## Automatic Tagging\n\nNSGator automatically adds tags to managed NSGs for tracking and governance:\n- `managed_by_terraform_outbound_priority_range`: Priority range for outbound rules (e.g., \"1000-1100\")\n- `managed_by_terraform_inbound_priority_range`: Priority range for inbound rules (e.g., \"2000-2100\")\n\nThese tags help identify which priority ranges are managed by Terraform and prevent conflicts with manually created rules.\n\n## Limitations\n\n- **Multiple Ports**: Supports multiple destination ports per rule\n- **Priority Ranges**: Rules are skipped if they would exceed the configured priority range\n\n## Cross-Subscription deployment\n- NSGs can be deployed across different subscriptions, when calling the module, provide 2 providers in the module block:\n  - `source_nsg_id` for the source NSG\n  - `destination_nsg_id` for the destination NSG\nexample:\n```hcl\nproviders {\n  source = azapi.source\n  destination = azapi.destination\n}\n```\n\n\n## Examples\n\nFor complete examples, see the `examples/` directory:\n- `examples/basic-example/` - Simple single configuration example\n- `examples/hub-spoke-nsg-rules/` - Multi-tier architecture example\n\n## Contributing\n\n1. Feel free to open issues for bugs or feature requests\n2. Pull requests are welcome! Please ensure your changes include tests and documentation updates\n\n## License\n\nThis module is provided as-is. It is not intended for production use without thorough testing and validation in your specific environment.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhumanascode%2Fterraform-azapi-nsgator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhumanascode%2Fterraform-azapi-nsgator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhumanascode%2Fterraform-azapi-nsgator/lists"}