{"id":16367215,"url":"https://github.com/kumarvna/terraform-azurerm-firewall","last_synced_at":"2025-03-23T02:32:52.228Z","repository":{"id":47632920,"uuid":"396296538","full_name":"kumarvna/terraform-azurerm-firewall","owner":"kumarvna","description":"Terraform Module to create fully stateful Azure firewall as a service with built-in high availability.  ","archived":false,"fork":false,"pushed_at":"2022-10-29T09:10:04.000Z","size":1066,"stargazers_count":13,"open_issues_count":1,"forks_count":13,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-10-12T02:49:02.094Z","etag":null,"topics":["application-rules-collection","azure-firewall","azure-firewall-rules","firewall","firewall-configuration","firewall-rules","nat-rules-collection","network-rules-collection","terraform","terraform-modules"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kumarvna.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"github":"https://github.com/kumarvna"}},"created_at":"2021-08-15T09:32:41.000Z","updated_at":"2024-04-30T22:13:13.000Z","dependencies_parsed_at":"2023-01-20T08:28:48.078Z","dependency_job_id":null,"html_url":"https://github.com/kumarvna/terraform-azurerm-firewall","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumarvna%2Fterraform-azurerm-firewall","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumarvna%2Fterraform-azurerm-firewall/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumarvna%2Fterraform-azurerm-firewall/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumarvna%2Fterraform-azurerm-firewall/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kumarvna","download_url":"https://codeload.github.com/kumarvna/terraform-azurerm-firewall/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":221842746,"owners_count":16890196,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["application-rules-collection","azure-firewall","azure-firewall-rules","firewall","firewall-configuration","firewall-rules","nat-rules-collection","network-rules-collection","terraform","terraform-modules"],"created_at":"2024-10-11T02:49:00.750Z","updated_at":"2024-10-28T14:46:16.015Z","avatar_url":"https://github.com/kumarvna.png","language":"HCL","funding_links":["https://github.com/sponsors/https://github.com/kumarvna"],"categories":[],"sub_categories":[],"readme":"# Azure Firewall Terraform Module\n\nAzure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.\n\nThis Terraform module quickly creates managed, cloud-based network security service Azure Firewall with network, NAT, Application rule collections and other optional features.\n\n## Resources Supported\n\n- [Azure Firewall](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall)\n- [Azure Firewall Subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet)\n- [Firewall Forced Tunneling](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall#management_ip_configuration)\n- [Firewall Application Rule Collection](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall_application_rule_collection)\n- [Firewall NAT Rule Collection](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall_nat_rule_collection)\n- [Firewall Network Rule Collection](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall_network_rule_collection)\n- [Monitor Azure Firewall logs and metrics](https://docs.microsoft.com/en-us/azure/firewall/firewall-diagnostics)\n\n## Module Usage\n\n```terraform\n# Azurerm Provider configuration\nprovider \"azurerm\" {\n  features {}\n}\n\ndata \"azurerm_log_analytics_workspace\" \"example\" {\n  name                = \"loganalytics-we-sharedtest2\"\n  resource_group_name = \"rg-shared-westeurope-01\"\n}\n\nmodule \"firewall\" {\n  source  = \"kumarvna/firewall/azurerm\"\n  version = \"1.1.0\"\n\n  # By default, this module will not create a resource group. Location will be same as existing RG.\n  # proivde a name to use an existing resource group, specify the existing resource group name, \n  # set the argument to `create_resource_group = true` to create new resrouce group.\n  #   # The Subnet must have the name `AzureFirewallSubnet` and the subnet mask must be at least a /26\n  resource_group_name            = \"rg-shared-westeurope-01\"\n  location                       = \"westeurope\"\n  virtual_network_name           = \"vnet-shared-hub-westeurope-001\"\n  firewall_subnet_address_prefix = [\"10.1.5.0/26\"]\n\n  # Azure firewall general configuration \n  # If `virtual_hub` is specified, the threat_intel_mode has to be explicitly set as `\"\"`\n  firewall_config = {\n    name              = \"testfirewall1\"\n    sku_name          = \"AZFW_VNet\"\n    sku_tier          = \"Standard\"\n    private_ip_ranges = [\"IANAPrivateRanges\"]\n    threat_intel_mode = \"Alert\"\n  }\n\n  # Allow force-tunnelling of traffic to be performed by the firewall\n  # The Management Subnet used for the Firewall must have the name `AzureFirewallManagementSubnet` \n  # and the subnet mask must be at least a /26.\n  enable_forced_tunneling                   = true\n  firewall_management_subnet_address_prefix = [\"10.1.6.0/26\"]\n\n  # Optionally add more public IP's to firewall by specifing the list of names. Minimum one IP name required.\n  # Depends on firewall public IP prefix which can be adjusted by `public_ip_prefix_length` variable.\n  # IP prefix Default to 31 i.e. for 2 public IP addresses.   \n  public_ip_names = [\"fw-public\", \"fw-private\"]\n\n  # (Optional) specify the application rules for Azure Firewall\n  firewall_application_rules = [\n    {\n      name             = \"microsoft\"\n      action           = \"Allow\"\n      source_addresses = [\"10.0.0.0/8\"]\n      target_fqdns     = [\"*.microsoft.com\"]\n      protocol = {\n        type = \"Http\"\n        port = \"80\"\n      }\n    },\n  ]\n\n  # (Optional) specify the Network rules for Azure Firewall\n  firewall_network_rules = [\n    {\n      name                  = \"ntp\"\n      action                = \"Allow\"\n      source_addresses      = [\"10.0.0.0/8\"]\n      destination_ports     = [\"123\"]\n      destination_addresses = [\"*\"]\n      protocols             = [\"UDP\"]\n    },\n  ]\n\n  # (Optional) specify the NAT rules for Azure Firewall\n  # Destination address must be Firewall public IP\n  firewall_nat_rules = [\n    {\n      name                  = \"testrule\"\n      action                = \"Dnat\"\n      source_addresses      = [\"10.0.0.0/8\"]\n      destination_ports     = [\"53\", ]\n      destination_addresses = [\"fw-public\"]\n      translated_port       = 53\n      translated_address    = \"8.8.8.8\"\n      protocols             = [\"TCP\", \"UDP\", ]\n    },\n  ]\n\n  # (Optional) To enable Azure Monitoring and diagnostics to firewall and public ip's\n  # (Optional) Specify `storage_account_name` to save monitoring logs to storage.   \n  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id\n\n  # Adding TAG's to your Azure resources \n  tags = {\n    ProjectName  = \"demo-internal\"\n    Env          = \"dev\"\n    Owner        = \"user@example.com\"\n    BusinessUnit = \"CORP\"\n    ServiceClass = \"Gold\"\n  }\n}\n```\n\n### Resource Group\n\nBy default, this module will not create a resource group and the name of an existing resource group to be given in an argument `resource_group_name`. If you want to create a new resource group, set the argument `create_resource_group = true`.\n\n\u003e [!NOTE]\n\u003e *If you are using an existing resource group, then this module uses the same resource group location to create all resources in this module.*\n\n## **`firewall_config`** - Azure Firewall Configuration\n\nThis object to help set up the various settings for Azure Firewall service and supports following arguments.\n\n| Argument | Description |\n|--|--|\n`name`|Specifies the name of the Firewall\n`sku_name`|Sku name of the Firewall. Possible values are `AZFW_Hub` and `AZFW_VNet`.\n`sku_tier`|Sku tier of the Firewall. Possible values are `Premium` and `Standard`.\n`dns_servers`|A list of DNS servers that the Azure Firewall will direct DNS traffic to the for name resolution.\n`private_ip_ranges`| A list of SNAT private CIDR IP ranges, or the special string `IANAPrivateRanges`, which indicates Azure Firewall does not SNAT when the destination IP address is a private range per IANA RFC 1918.\n`threat_intel_mode`| The operation mode for threat intelligence-based filtering. Possible values are: `Off`, `Alert`, `Deny` and `\"\"`(empty string). Defaults to `Alert`. If `virtual_hub` configuration is specified in the module, the `threat_intel_mode` has to be explicitly set as `\"\"`\n`zones`|Specifies the availability zones in which the Azure Firewall should be created. Availability Zones can only be configured during deployment and can't modify an existing firewall to include Availability Zones.\n\n## Firewall Rules\n\nThis module centrally create allow or deny network filtering rules by source and destination IP address, port, and protocol. Azure Firewall is fully stateful, so it can distinguish legitimate packets for different types of connections. Rules are enforced and logged across multiple subscriptions and virtual networks.\n\nTo define the firewall rules, use the input variables `firewall_application_rules`, `firewall_network_rules` and `firewall_nat_rules`.\n\n``` hcl\nmodule \"firewall\" {\n  source  = \"kumarvna/firewall/azurerm\"\n  version = \"1.1.0\"\n\n# ....omitted\n\n  # (Optional) specify the application rules for Azure Firewall\n  firewall_application_rules = [\n    {\n      name             = \"microsoft\"\n      action           = \"Allow\"\n      source_addresses = [\"10.0.0.0/8\"]\n      target_fqdns     = [\"*.microsoft.com\"]\n      protocol = {\n        type = \"Http\"\n        port = \"80\"\n      }\n    },\n  ]\n\n  # (Optional) specify the Network rules for Azure Firewall\n  firewall_network_rules = [\n    {\n      name                  = \"ntp\"\n      action                = \"Allow\"\n      source_addresses      = [\"10.0.0.0/8\"]\n      destination_ports     = [\"123\"]\n      destination_addresses = [\"*\"]\n      protocols             = [\"UDP\"]\n    },\n  ]\n\n  # (Optional) specify the NAT rules for Azure Firewall\n  # Destination address must be Firewall public IP\n  firewall_nat_rules = [\n    {\n      name                  = \"testrule\"\n      action                = \"Dnat\"\n      source_addresses      = [\"10.0.0.0/8\"]\n      destination_ports     = [\"53\", ]\n      destination_addresses = [\"fw-public\"]\n      translated_port       = 53\n      translated_address    = \"8.8.8.8\"\n      protocols             = [\"TCP\", \"UDP\", ]\n    },\n  ]\n\n# ....omitted\n}\n```\n\n## Recommended naming and tagging conventions\n\nApplying tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For example, you can apply the name `Environment` and the value `Production` to all the resources in production.\nFor recommendations on how to implement a tagging strategy, see Resource naming and tagging decision guide.\n\n\u003e**Important** :\nTag names are case-insensitive for operations. A tag with a tag name, regardless of the casing, is updated or retrieved. However, the resource provider might keep the casing you provide for the tag name. You'll see that casing in cost reports. **Tag values are case-sensitive.**\n\nAn effective naming convention assembles resource names by using important resource information as parts of a resource's name. For example, using these [recommended naming conventions](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging#example-names), a public IP resource for a production SharePoint workload is named like this: `pip-sharepoint-prod-westus-001`.\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| terraform | \u003e= 1.1.9 |\n| azurerm | \u003e= 3.28.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| azurerm | \u003e= 3.28.0 |\n| random |\u003e= 3.1.0 |\n\n## Inputs\n\nName | Description | Type | Default\n---- | ----------- | ---- | -------\n`create_resource_group` | Whether to create resource group and use it for all networking resources | string | `\"false\"`\n`resource_group_name`|The name of an existing resource group.|string|`\"\"`\n`location`|The location for all resources while creating a new resource group.|string|`\"\"`\n`virtual_network_name`|The name of the virtual network|string|`\"\"`\n`firewall_subnet_address_prefix`|The address prefix to use for the Firewall subnet.The Subnet used for the Firewall must have the name `AzureFirewallSubnet` and the subnet mask must be at least a `/26`.|list|`[]`\n`firewall_management_subnet_address_prefix`|The address prefix to use for Firewall managemement subnet to enable forced tunnelling. The Management Subnet used for the Firewall must have the name `AzureFirewallManagementSubnet` and the subnet mask must be at least a `/26`.|list|`[]`\n`public_ip_prefix_length`|Specifies the number of bits of the prefix. The value can be set between `0` (4,294,967,296 addresses) and `31` (2 addresses).|number|`31`\n`public_ip_names`|Public ips is a list of ip names that are connected to the firewall. At least one is required|list|`[\"fw-public\"]`\n`firewall_service_endpoints`|Service endpoints to add to the firewall subnet|list|`[\"Microsoft.AzureActiveDirectory\", \"Microsoft.AzureCosmosDB\", \"Microsoft.EventHub\",  \"Microsoft.KeyVault\", \"Microsoft.ServiceBus\", \"Microsoft.Sql\", \"Microsoft.Storage\",]`\n`firewall_config`|Manages an Azure Firewall configuration|object|`{}`\n`enable_forced_tunneling`|Route all Internet-bound traffic to a designated next hop instead of going directly to the Internet|string|`false`\n`virtual_hub`|Microsoft-managed virtual network that enables connectivity from other resources.|object|`null`\n`firewall_application_rules`|Microsoft-managed virtual network that enables connectivity from other resources.|list(object)|`[]`\n`firewall_network_rules`|List of network rules to apply to firewall.|list(object)|`[]`\n`firewall_nat_rules`|List of nat rules to apply to firewall|list(object)|`[]`\n`storage_account_name`|The name of the storage account name|string|`null`\n`log_analytics_workspace_id`|The resource id of log analytics workspace|string|`null`\n`Tags`|A map of tags to add to all resources|map|`{}`\n\n## Outputs\n\nName | Description\n---- | -----------\n`resource_group_name`| The name of the resource group in which resources are created\n`resource_group_id`| The id of the resource group in which resources are created\n`resource_group_location`| The location of the resource group in which resources are created\n`firewall_id`|The Resource ID of the Azure Firewall\n`public_ip_prefix_id`|The id of the Public IP Prefix resource\n`firewall_public_ip`|The public IP of firewall\n`firewall_private_ip`|The private IP of firewall\n`firewall_name`|The name of the Azure Firewall\n`virtual_hub_private_ip_address`|The private IP address associated with the Firewall\n`virtual_hub_public_ip_addresses`|The private IP address associated with the Firewall\n\n## Resource Graph\n\n![graph](graph.png)\n\n## Authors\n\nOriginally created by [Kumaraswamy Vithanala](mailto:kumarvna@gmail.com)\n\n## Other resources\n\n- [Azure firewall](https://docs.microsoft.com/en-us/azure/firewall/)\n\n- [Terraform AzureRM Provider Documentation](https://www.terraform.io/docs/providers/azurerm/index.html)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkumarvna%2Fterraform-azurerm-firewall","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkumarvna%2Fterraform-azurerm-firewall","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkumarvna%2Fterraform-azurerm-firewall/lists"}