https://github.com/libre-devops/terraform-azurerm-nsg
A module used to generate a sensible default NSG and attach it to an Azure subnet. Note, this NSG is deployed with some default rules including an explicit deny :bomb:
https://github.com/libre-devops/terraform-azurerm-nsg
azure azurerm azurerm-terraform-provider module terraform terraform-module
Last synced: 2 months ago
JSON representation
A module used to generate a sensible default NSG and attach it to an Azure subnet. Note, this NSG is deployed with some default rules including an explicit deny :bomb:
- Host: GitHub
- URL: https://github.com/libre-devops/terraform-azurerm-nsg
- Owner: libre-devops
- License: mit
- Created: 2022-04-17T21:22:43.000Z (about 3 years ago)
- Default Branch: main
- Last Pushed: 2024-03-09T23:30:40.000Z (about 1 year ago)
- Last Synced: 2024-12-26T16:11:57.980Z (4 months ago)
- Topics: azure, azurerm, azurerm-terraform-provider, module, terraform, terraform-module
- Language: PowerShell
- Homepage:
- Size: 40 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project
README
```hcl
resource "azurerm_network_security_group" "nsg" {
name = var.nsg_name
location = var.location
resource_group_name = var.rg_name
tags = var.tags
timeouts {
create = "5m"
delete = "10m"
}
}
resource "azurerm_network_interface_security_group_association" "this" {
count = var.associate_with_nic && var.nic_id != null ? 1 : 0
network_interface_id = var.nic_id
network_security_group_id = azurerm_network_security_group.nsg.id
timeouts {
create = "5m"
delete = "10m"
}
}
resource "azurerm_subnet_network_security_group_association" "this" {
count = var.associate_with_subnet == true ? 1 : 0
subnet_id = var.subnet_id
network_security_group_id = azurerm_network_security_group.nsg.id
timeouts {
create = "5m"
delete = "10m"
}
}
resource "azurerm_network_security_rule" "rules" {
for_each = local.final_nsg_rules
name = each.key
priority = each.value.priority
direction = each.value.direction
access = each.value.access
protocol = each.value.protocol
source_port_range = each.value.source_port_range
destination_port_range = each.value.destination_port_range
source_address_prefix = each.value.source_address_prefix
destination_address_prefix = each.value.destination_address_prefix
resource_group_name = azurerm_network_security_group.nsg.resource_group_name
network_security_group_name = azurerm_network_security_group.nsg.name
}
```
## Requirements
No requirements.
## Providers
| Name | Version |
|------|---------|
| [azurerm](#provider\_azurerm) | n/a |
## Modules
No modules.
## Resources
| Name | Type |
|------|------|
| [azurerm_network_interface_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface_security_group_association) | resource |
| [azurerm_network_security_group.nsg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) | resource |
| [azurerm_network_security_rule.rules](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_rule) | resource |
| [azurerm_subnet_network_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet_network_security_group_association) | resource |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [apply\_standard\_rules](#input\_apply\_standard\_rules) | Whether to apply the standard NSG rules or not. | `bool` | `true` | no |
| [associate\_with\_nic](#input\_associate\_with\_nic) | Whether the NSG should be associated with a nic | `bool` | `false` | no |
| [associate\_with\_subnet](#input\_associate\_with\_subnet) | Whether the NSG should be associated with a subnet | `bool` | `false` | no |
| [custom\_nsg\_rules](#input\_custom\_nsg\_rules) | Custom NSG rules to apply if apply\_standard\_rules is set to false. |
map(object({
priority = number
direction = string
access = string
protocol = string
source_port_range = string
destination_port_range = string
source_address_prefix = string
destination_address_prefix = string
})) | `{}` | no |
| [location](#input\_location) | The location for this resource to be put in | `string` | n/a | yes |
| [nic\_id](#input\_nic\_id) | The ID of a NIC if the association is triggered | `string` | `null` | no |
| [nsg\_name](#input\_nsg\_name) | The name of the resource to be created | `string` | n/a | yes |
| [rg\_name](#input\_rg\_name) | The name of the resource group, this module does not create a resource group, it is expecting the value of a resource group already exists | `string` | n/a | yes |
| [subnet\_id](#input\_subnet\_id) | The ID of the subnet for the NSG to be attached to | `string` | `null` | no |
| [tags](#input\_tags) | The tags assigned to the resource | `map(string)` | n/a | yes |
## Outputs
| Name | Description |
|------|-------------|
| [final\_nsg\_rules](#output\_final\_nsg\_rules) | The NSG rules list assigned as a variable |
| [nsg\_id](#output\_nsg\_id) | The ID of the NSG |
| [nsg\_name](#output\_nsg\_name) | The name of the NSG |
| [nsg\_network\_interface\_security\_group\_association\_ids](#output\_nsg\_network\_interface\_security\_group\_association\_ids) | The IDs of the Network Interface Security Group Associations |
| [nsg\_rg\_name](#output\_nsg\_rg\_name) | The name of the resource group the nsg is in |
| [nsg\_subnet\_association\_ids](#output\_nsg\_subnet\_association\_ids) | The IDs of the Subnet Network Security Group Associations |