Skip to content

Commit 55008d9

Browse files
yupwei68yupwei68
authored
New fields source_address_prefixes and destination_address_prefixes (#61)
* update * update
1 parent 7fd739c commit 55008d9

File tree

4 files changed

+122
-29
lines changed

4 files changed

+122
-29
lines changed

‎README.md‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ This module includes a a set of pre-defined rules for commonly used protocols (f
1515

1616
The following example demonstrate how to use the network-security-group module with a combination of predefined and custom rules.
1717

18+
~> **NOTE:** `source_address_prefix` is defined differently in `predefined_rules` and `custom_rules`.
19+
`predefined_rules` uses `var.source_address_prefix` defined in the module.`var.source_address_prefix` is of type list(string), but allowed only one element (CIDR, `*`, source IP range or Tags). For more source_address_prefixes, please use `var.source_address_prefixes`. The same for `var.destination_address_prefix` in `predefined_rules`.
20+
`custom_rules` uses `source_address_prefix` defined in the block `custom_rules`. `source_address_prefix` is of type string (CIDR, `*`, source IP range or Tags). For more source_address_prefixes, please use `source_address_prefixes` in block `custom_rules`. The same for `destination_address_prefix` in `custom_rules`.
21+
1822
```hcl
1923
provider "azurerm" {
2024
features {}
@@ -44,14 +48,27 @@ module "network-security-group" {
4448
4549
custom_rules = [
4650
{
47-
name = "myhttp"
48-
priority = "200"
51+
name = "myssh"
52+
priority = 201
4953
direction = "Inbound"
5054
access = "Allow"
5155
protocol = "tcp"
52-
destination_port_range = "8080"
53-
description = "description-myhttp"
54-
}
56+
source_port_range = "*"
57+
destination_port_range = "22"
58+
source_address_prefix = "10.151.0.0/24"
59+
description = "description-myssh"
60+
},
61+
{
62+
name = "myhttp"
63+
priority = 200
64+
direction = "Inbound"
65+
access = "Allow"
66+
protocol = "tcp"
67+
source_port_range = "*"
68+
destination_port_range = "8080"
69+
source_address_prefixes = ["10.151.0.0/24", "10.151.1.0/24"]
70+
description = "description-http"
71+
},
5572
]
5673
5774
tags = {

‎main.tf‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,14 @@ resource "azurerm_network_security_rule" "predefined_rules" {
2323
source_port_ranges = split(",", replace(lookup(var.predefined_rules[count.index], "source_port_range", "*"), "*", "0-65535"))
2424
destination_port_range = element(var.rules[lookup(var.predefined_rules[count.index], "name")], 4)
2525
description = element(var.rules[lookup(var.predefined_rules[count.index], "name")], 5)
26-
source_address_prefix = length(lookup(var.predefined_rules[count.index], "source_application_security_group_ids", [])) == 0 ? join(",", var.source_address_prefix) : ""
27-
destination_address_prefix = length(lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", [])) == 0 ? join(",", var.destination_address_prefix) : ""
26+
source_address_prefix = lookup(var.predefined_rules[count.index], "source_application_security_group_ids", null) == null && var.source_address_prefixes == null ? join(",", var.source_address_prefix) : null
27+
source_address_prefixes = lookup(var.predefined_rules[count.index], "source_application_security_group_ids", null) == null ? var.source_address_prefixes : null
28+
destination_address_prefix = lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", null) == null && var.destination_address_prefixes == null ? join(",", var.destination_address_prefix) : null
29+
destination_address_prefixes = lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", null) == null ? var.destination_address_prefixes : null
2830
resource_group_name = data.azurerm_resource_group.nsg.name
2931
network_security_group_name = azurerm_network_security_group.nsg.name
30-
source_application_security_group_ids = lookup(var.predefined_rules[count.index], "source_application_security_group_ids", [])
31-
destination_application_security_group_ids = lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", [])
32+
source_application_security_group_ids = lookup(var.predefined_rules[count.index], "source_application_security_group_ids", null)
33+
destination_application_security_group_ids = lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", null)
3234
}
3335

3436
#############################
@@ -44,11 +46,13 @@ resource "azurerm_network_security_rule" "custom_rules" {
4446
protocol = lookup(var.custom_rules[count.index], "protocol", "*")
4547
source_port_ranges = split(",", replace(lookup(var.custom_rules[count.index], "source_port_range", "*"), "*", "0-65535"))
4648
destination_port_ranges = split(",", replace(lookup(var.custom_rules[count.index], "destination_port_range", "*"), "*", "0-65535"))
47-
source_address_prefix = length(lookup(var.custom_rules[count.index], "source_application_security_group_ids", [])) == 0 ? lookup(var.custom_rules[count.index], "source_address_prefix", "*") : ""
48-
destination_address_prefix = length(lookup(var.custom_rules[count.index], "destination_application_security_group_ids", [])) == 0 ? lookup(var.custom_rules[count.index], "destination_address_prefix", "*") : ""
49+
source_address_prefix = lookup(var.custom_rules[count.index], "source_application_security_group_ids", null) == null && lookup(var.custom_rules[count.index], "source_address_prefixes", null) == null ? lookup(var.custom_rules[count.index], "source_address_prefix", "*") : null
50+
source_address_prefixes = lookup(var.custom_rules[count.index], "source_application_security_group_ids", null) == null ? lookup(var.custom_rules[count.index], "source_address_prefixes", null) : null
51+
destination_address_prefix = lookup(var.custom_rules[count.index], "destination_application_security_group_ids", null) == null && lookup(var.custom_rules[count.index], "destination_address_prefixes", null) == null ? lookup(var.custom_rules[count.index], "destination_address_prefix", "*") : null
52+
destination_address_prefixes = length(lookup(var.custom_rules[count.index], "destination_application_security_group_ids", [])) == 0 ? lookup(var.custom_rules[count.index], "destination_address_prefixes", null) : null
4953
description = lookup(var.custom_rules[count.index], "description", "Security rule for ${lookup(var.custom_rules[count.index], "name", "default_rule_name")}")
5054
resource_group_name = data.azurerm_resource_group.nsg.name
5155
network_security_group_name = azurerm_network_security_group.nsg.name
52-
source_application_security_group_ids = lookup(var.custom_rules[count.index], "source_application_security_group_ids", [])
53-
destination_application_security_group_ids = lookup(var.custom_rules[count.index], "destination_application_security_group_ids", [])
56+
source_application_security_group_ids = lookup(var.custom_rules[count.index], "source_application_security_group_ids", null)
57+
destination_application_security_group_ids = lookup(var.custom_rules[count.index], "destination_application_security_group_ids", null)
5458
}

‎test/fixture/main.tf‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,42 @@ module "testPredefinedRuleWithCustom" {
6060
depends_on = [azurerm_resource_group.test]
6161
}
6262

63+
module "testPredefinedRuleWithPrefix" {
64+
source = "../../"
65+
resource_group_name = azurerm_resource_group.test.name
66+
security_group_name = "nsg_${random_id.randomize.hex}testPredefinedWithPrefix"
67+
source_address_prefix = ["VirtualNetwork"]
68+
predefined_rules = [
69+
{
70+
name = "HTTP"
71+
},
72+
{
73+
name = "HTTPS"
74+
priority = 510
75+
},
76+
]
77+
78+
depends_on = [azurerm_resource_group.test]
79+
}
80+
81+
module "testPredefinedRuleWithPrefixes" {
82+
source = "../../"
83+
resource_group_name = azurerm_resource_group.test.name
84+
security_group_name = "nsg_${random_id.randomize.hex}testPredefinedWithPrefixes"
85+
source_address_prefixes = ["10.151.0.0/24", "10.151.1.0/24"]
86+
predefined_rules = [
87+
{
88+
name = "HTTP"
89+
},
90+
{
91+
name = "HTTPS"
92+
priority = 510
93+
},
94+
]
95+
96+
depends_on = [azurerm_resource_group.test]
97+
}
98+
6399

64100

65101
module "testCustom" {
@@ -93,3 +129,37 @@ module "testCustom" {
93129

94130
depends_on = [azurerm_resource_group.test]
95131
}
132+
133+
module "testCustomPrefix" {
134+
source = "../../"
135+
resource_group_name = azurerm_resource_group.test.name
136+
security_group_name = "nsg_${random_id.randomize.hex}testCustomPrefix"
137+
custom_rules = [
138+
{
139+
name = "myssh"
140+
priority = 201
141+
direction = "Inbound"
142+
access = "Allow"
143+
protocol = "tcp"
144+
source_port_range = "*"
145+
destination_port_range = "22"
146+
source_address_prefix = "10.151.0.0/24"
147+
description = "description-myssh"
148+
},
149+
{
150+
name = "myhttp"
151+
priority = 200
152+
direction = "Inbound"
153+
access = "Allow"
154+
protocol = "tcp"
155+
source_port_range = "*"
156+
destination_port_range = "8080"
157+
source_address_prefixes = ["10.151.0.0/24", "10.151.1.0/24"]
158+
description = "description-http"
159+
destination_application_security_group_ids = [azurerm_application_security_group.second.id]
160+
},
161+
]
162+
163+
depends_on = [azurerm_resource_group.test]
164+
}
165+

‎variables.tf‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -40,30 +40,32 @@ variable "custom_rules" {
4040
default = []
4141
}
4242

43-
# source address prefix to be applied to all rules
43+
# source address prefix to be applied to all predefined rules
44+
# list(string) only allowed one element (CIDR, `*`, source IP range or Tags)
45+
# Example ["10.0.3.0/24"] or ["VirtualNetwork"]
4446
variable "source_address_prefix" {
4547
type = list(string)
4648
default = ["*"]
49+
}
4750

48-
# Example ["10.0.3.0/24"] or ["VirtualNetwork"]
51+
# Destination address prefix to be applied to all predefined rules
52+
# Example ["10.0.3.0/32","10.0.3.128/32"]
53+
variable "source_address_prefixes" {
54+
type = list(string)
55+
default = null
4956
}
5057

51-
# Destination address prefix to be applied to all rules
58+
# Destination address prefix to be applied to all predefined rules
59+
# list(string) only allowed one element (CIDR, `*`, source IP range or Tags)
60+
# Example ["10.0.3.0/24"] or ["VirtualNetwork"]
5261
variable "destination_address_prefix" {
5362
type = list(string)
5463
default = ["*"]
55-
56-
# Example ["10.0.3.0/32","10.0.3.128/32"] or ["VirtualNetwork"]
5764
}
5865

59-
variable "source_application_security_group_ids" {
60-
description = "(Optional) A List of source Application Security Group IDs. Conflicted with `source_address_prefix`. Once assigned with `source_address_prefix`, it'll have a higher priority."
61-
type = set(string)
62-
default = []
63-
}
64-
65-
variable "destination_application_security_group_ids" {
66-
description = "(Optional) A List of destination Application Security Group IDs. Conflicted with `destination_address_prefix`. Once assigned with `destination_address_prefix`, it'll have a higher priority."
67-
type = set(string)
68-
default = []
69-
}
66+
# Destination address prefix to be applied to all predefined rules
67+
# Example ["10.0.3.0/32","10.0.3.128/32"]
68+
variable "destination_address_prefixes" {
69+
type = list(string)
70+
default = null
71+
}

0 commit comments

Comments
 (0)