Skip to content

Commit cfc67aa

Browse files
kharkevichkharkevich
committed
feat: update firewall defaults
BREAKING CHANGES: Changing firewall defaults in accordance to azurerm 3.49.0
1 parent 1df5ba5 commit cfc67aa

File tree

4 files changed

+76
-36
lines changed

4 files changed

+76
-36
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,14 @@ No modules.
4646
| <a name="input_enable_diagnostic_setting"></a> [enable\_diagnostic\_setting](#input\_enable\_diagnostic\_setting) | Enable diagnostic setting. var.analytics\_workspace\_id must be provided | `bool` | `false` | no |
4747
| <a name="input_env"></a> [env](#input\_env) | Environment | `string` | n/a | yes |
4848
| <a name="input_identity_ids"></a> [identity\_ids](#input\_identity\_ids) | List of user assigned identity IDs | `list(string)` | `null` | no |
49-
| <a name="input_ip_restriction"></a> [ip\_restriction](#input\_ip\_restriction) | Firewall settings for the web app | <pre>list(object({<br> name = string<br> ip_address = string<br> service_tag = string<br> virtual_network_subnet_id = string<br> priority = string<br> action = string<br> headers = list(object({<br> x_azure_fdid = list(string)<br> x_fd_health_probe = list(string)<br> x_forwarded_for = list(string)<br> x_forwarded_host = list(string)<br> }))<br> }))</pre> | <pre>[<br> {<br> "action": "Allow",<br> "headers": null,<br> "ip_address": null,<br> "name": "allow_azure",<br> "priority": "100",<br> "service_tag": "AzureCloud",<br> "virtual_network_subnet_id": null<br> }<br>]</pre> | no |
49+
| <a name="input_ip_restriction"></a> [ip\_restriction](#input\_ip\_restriction) | Firewall settings for the function app | <pre>list(object({<br> name = string<br> ip_address = optional(string, null)<br> service_tag = optional(string, null)<br> virtual_network_subnet_id = optional(string, null)<br> priority = optional(string, "100")<br> action = string<br> headers = optional(list(object({<br> x_azure_fdid = optional(list(string), null)<br> x_fd_health_probe = optional(list(string), null)<br> x_forwarded_for = optional(list(string), null)<br> x_forwarded_host = optional(list(string), null)<br> })), [])<br> }))</pre> | <pre>[<br> {<br> "action": "Allow",<br> "name": "allow_azure",<br> "service_tag": "AzureCloud"<br> }<br>]</pre> | no |
5050
| <a name="input_key_vault"></a> [key\_vault](#input\_key\_vault) | Configure Linux Function App to Key Vault | <pre>object({<br> id = optional(string, null)<br> key_permissions = optional(list(string), null)<br> secret_permissions = optional(list(string), ["Get", "List"])<br> storage_permissions = optional(list(string), null)<br> })</pre> | `{}` | no |
5151
| <a name="input_location"></a> [location](#input\_location) | Location | `string` | n/a | yes |
5252
| <a name="input_logs"></a> [logs](#input\_logs) | Logs configuration | <pre>object({<br> detailed_error_messages = bool<br> failed_request_tracing = bool<br> http_logs = object({<br> file_system = object({<br> retention_in_days = number<br> retention_in_mb = number<br> })<br> })<br> })</pre> | <pre>{<br> "detailed_error_messages": false,<br> "failed_request_tracing": false,<br> "http_logs": {<br> "file_system": {<br> "retention_in_days": 7,<br> "retention_in_mb": 35<br> }<br> }<br>}</pre> | no |
5353
| <a name="input_name"></a> [name](#input\_name) | Web index/name (like 007) | `string` | n/a | yes |
5454
| <a name="input_project"></a> [project](#input\_project) | Project name | `string` | n/a | yes |
5555
| <a name="input_resource_group"></a> [resource\_group](#input\_resource\_group) | Resource group name | `string` | n/a | yes |
56-
| <a name="input_scm_ip_restriction"></a> [scm\_ip\_restriction](#input\_scm\_ip\_restriction) | Firewall settings for the SCM web app | <pre>list(object({<br> name = string<br> ip_address = string<br> service_tag = string<br> virtual_network_subnet_id = string<br> priority = string<br> action = string<br> headers = list(object({<br> x_azure_fdid = list(string)<br> x_fd_health_probe = list(string)<br> x_forwarded_for = list(string)<br> x_forwarded_host = list(string)<br> }))<br> }))</pre> | `null` | no |
56+
| <a name="input_scm_ip_restriction"></a> [scm\_ip\_restriction](#input\_scm\_ip\_restriction) | Firewall settings for the function app | <pre>list(object({<br> name = string<br> ip_address = optional(string, null)<br> service_tag = optional(string, null)<br> virtual_network_subnet_id = optional(string, null)<br> priority = optional(string, "100")<br> action = string<br> headers = optional(list(object({<br> x_azure_fdid = optional(list(string), null)<br> x_fd_health_probe = optional(list(string), null)<br> x_forwarded_for = optional(list(string), null)<br> x_forwarded_host = optional(list(string), null)<br> })), [])<br> }))</pre> | <pre>[<br> {<br> "action": "Allow",<br> "name": "allow_azure",<br> "service_tag": "AzureCloud"<br> }<br>]</pre> | no |
5757
| <a name="input_service_plan_id"></a> [service\_plan\_id](#input\_service\_plan\_id) | App Service plan ID | `string` | n/a | yes |
5858
| <a name="input_storage_account"></a> [storage\_account](#input\_storage\_account) | BYOS storage mount configuration | <pre>list(object({<br> access_key = string<br> account_name = string<br> name = string<br> share_name = string<br> type = string<br> mount_path = string<br> }))</pre> | `[]` | no |
5959
| <a name="input_subnet_id"></a> [subnet\_id](#input\_subnet\_id) | Subnet ID for the web app | `string` | `null` | no |

‎main.tf‎

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,9 +85,47 @@ resource "azurerm_linux_web_app" "this" {
8585
http2_enabled = true
8686
websockets_enabled = var.websockets_enabled
8787
use_32_bit_worker = false
88-
ip_restriction = var.ip_restriction
89-
scm_ip_restriction = var.scm_ip_restriction == null ? var.ip_restriction : var.scm_ip_restriction
90-
worker_count = var.worker_count
88+
dynamic "ip_restriction" {
89+
for_each = var.ip_restriction
90+
content {
91+
name = ip_restriction.value.name
92+
ip_address = ip_restriction.value.ip_address
93+
service_tag = ip_restriction.value.service_tag
94+
virtual_network_subnet_id = ip_restriction.value.virtual_network_subnet_id
95+
priority = ip_restriction.value.priority
96+
action = ip_restriction.value.action
97+
dynamic "headers" {
98+
for_each = ip_restriction.value.headers
99+
content {
100+
x_azure_fdid = headers.value.x_azure_fdid
101+
x_fd_health_probe = headers.value.x_fd_health_probe
102+
x_forwarded_for = headers.value.x_forwarded_for
103+
x_forwarded_host = headers.value.x_forwarded_host
104+
}
105+
}
106+
}
107+
}
108+
dynamic "scm_ip_restriction" {
109+
for_each = var.scm_ip_restriction
110+
content {
111+
name = scm_ip_restriction.value.name
112+
ip_address = scm_ip_restriction.value.ip_address
113+
service_tag = scm_ip_restriction.value.service_tag
114+
virtual_network_subnet_id = scm_ip_restriction.value.virtual_network_subnet_id
115+
priority = scm_ip_restriction.value.priority
116+
action = scm_ip_restriction.value.action
117+
dynamic "headers" {
118+
for_each = scm_ip_restriction.value.headers
119+
content {
120+
x_azure_fdid = headers.value.x_azure_fdid
121+
x_fd_health_probe = headers.value.x_fd_health_probe
122+
x_forwarded_for = headers.value.x_forwarded_for
123+
x_forwarded_host = headers.value.x_forwarded_host
124+
}
125+
}
126+
}
127+
}
128+
worker_count = var.worker_count
91129
application_stack {
92130
docker_image = local.application_stack["docker_image"]
93131
docker_image_tag = local.application_stack["docker_image_tag"]

‎variables.tf‎

Lines changed: 32 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -45,51 +45,53 @@ variable "application_type" {
4545
}
4646

4747
variable "ip_restriction" {
48-
description = "Firewall settings for the web app"
48+
description = "Firewall settings for the function app"
4949
type = list(object({
5050
name = string
51-
ip_address = string
52-
service_tag = string
53-
virtual_network_subnet_id = string
54-
priority = string
51+
ip_address = optional(string, null)
52+
service_tag = optional(string, null)
53+
virtual_network_subnet_id = optional(string, null)
54+
priority = optional(string, "100")
5555
action = string
56-
headers = list(object({
57-
x_azure_fdid = list(string)
58-
x_fd_health_probe = list(string)
59-
x_forwarded_for = list(string)
60-
x_forwarded_host = list(string)
61-
}))
56+
headers = optional(list(object({
57+
x_azure_fdid = optional(list(string), null)
58+
x_fd_health_probe = optional(list(string), null)
59+
x_forwarded_for = optional(list(string), null)
60+
x_forwarded_host = optional(list(string), null)
61+
})), [])
6262
}))
6363
default = [
6464
{
65-
name = "allow_azure"
66-
ip_address = null
67-
service_tag = "AzureCloud"
68-
virtual_network_subnet_id = null
69-
priority = "100"
70-
action = "Allow"
71-
headers = null
65+
name = "allow_azure"
66+
service_tag = "AzureCloud"
67+
action = "Allow"
7268
}
7369
]
7470
}
7571

7672
variable "scm_ip_restriction" {
77-
description = "Firewall settings for the SCM web app"
73+
description = "Firewall settings for the function app"
7874
type = list(object({
7975
name = string
80-
ip_address = string
81-
service_tag = string
82-
virtual_network_subnet_id = string
83-
priority = string
76+
ip_address = optional(string, null)
77+
service_tag = optional(string, null)
78+
virtual_network_subnet_id = optional(string, null)
79+
priority = optional(string, "100")
8480
action = string
85-
headers = list(object({
86-
x_azure_fdid = list(string)
87-
x_fd_health_probe = list(string)
88-
x_forwarded_for = list(string)
89-
x_forwarded_host = list(string)
90-
}))
81+
headers = optional(list(object({
82+
x_azure_fdid = optional(list(string), null)
83+
x_fd_health_probe = optional(list(string), null)
84+
x_forwarded_for = optional(list(string), null)
85+
x_forwarded_host = optional(list(string), null)
86+
})), [])
9187
}))
92-
default = null
88+
default = [
89+
{
90+
name = "allow_azure"
91+
service_tag = "AzureCloud"
92+
action = "Allow"
93+
}
94+
]
9395
}
9496

9597
variable "app_settings" {

‎versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
azurerm = {
66
source = "hashicorp/azurerm"
7-
version = ">= 3.40.0"
7+
version = ">= 3.49.0"
88
}
99
}
1010
}

0 commit comments

Comments
 (0)