Skip to content

Commit 5b43213

Browse files
roger-amorim-dvroger-amorim-dv
committed
feat: add network firewall example
1 parent 3f843ba commit 5b43213

File tree

7 files changed

+192
-142
lines changed

7 files changed

+192
-142
lines changed

‎examples/network-firewall/main.tf‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
provider "aws" {
2+
region = local.region
3+
}
4+
5+
locals {
6+
region = "us-east-2"
7+
name = "nf-example-${random_pet.this.id}"
8+
environment = "test"
9+
}
10+
11+
resource "random_pet" "this" {
12+
length = 2
13+
separator = "-"
14+
}
15+
16+
################################################################################
17+
# KMS Module
18+
################################################################################
19+
20+
module "kms" {
21+
#source = "git::https://github.com/withclutch/terraform-modules-registry?ref=aws-kms_v1.194"
22+
source = "/Users/roger.amorim/Clutch/projects/infrastructure/terraform-modules/modules/aws-kms"
23+
24+
name = local.name
25+
environment = "test"
26+
description = "KMS key used to test the ${local.name} AWS Network Firewall"
27+
allow_usage_in_network_log_groups = true
28+
}
29+
30+
################################################################################
31+
# VPC Module
32+
################################################################################
33+
34+
module "vpc" {
35+
source = "../../"
36+
37+
environment = "test"
38+
name = "nf-example"
39+
40+
######### VPC ##########
41+
cidr = "10.0.0.0/16"
42+
azs = ["${local.region}a", "${local.region}b", "${local.region}c"]
43+
44+
######### Subnets ##########
45+
private_subnets = ["10.0.0.0/24", "10.0.1.0/24", "10.0.2.0/24"]
46+
public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
47+
firewall_subnets = ["10.0.3.0/28", "10.0.3.16/28", "10.0.3.32/28"]
48+
49+
create_multiple_public_route_tables = true
50+
51+
######### NAT Gateway ##########
52+
enable_nat_gateway = true
53+
one_nat_gateway_per_az = true
54+
55+
########## Firewall ##########
56+
create_network_firewall = true
57+
enable_network_firewall = true
58+
59+
######### Firewall Logs ##########
60+
firewall_logs_retention_in_days = 14
61+
firewall_logs_kms_key_arn = module.kms.key_arn
62+
63+
######### Firewall Rules and Filter ##########
64+
firewall_log_types = ["FLOW", "ALERT"]
65+
firewall_managed_rules = [
66+
"AbusedLegitMalwareDomainsStrictOrder",
67+
"BotNetCommandAndControlDomainsStrictOrder",
68+
"AbusedLegitBotNetCommandAndControlDomainsStrictOrder",
69+
"MalwareDomainsStrictOrder",
70+
"ThreatSignaturesIOCStrictOrder",
71+
"ThreatSignaturesPhishingStrictOrder",
72+
"ThreatSignaturesBotnetWebStrictOrder",
73+
"ThreatSignaturesEmergingEventsStrictOrder",
74+
"ThreatSignaturesDoSStrictOrder",
75+
"ThreatSignaturesMalwareWebStrictOrder",
76+
"ThreatSignaturesExploitsStrictOrder",
77+
"ThreatSignaturesWebAttacksStrictOrder",
78+
"ThreatSignaturesScannersStrictOrder",
79+
"ThreatSignaturesBotnetStrictOrder",
80+
"ThreatSignaturesMalwareStrictOrder",
81+
"ThreatSignaturesMalwareCoinminingStrictOrder",
82+
"ThreatSignaturesFUPStrictOrder",
83+
"ThreatSignaturesSuspectStrictOrder",
84+
"ThreatSignaturesBotnetWindowsStrictOrder",
85+
]
86+
87+
depends_on = [module.kms]
88+
}

‎examples/network-firewall/outputs.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
################################################################################
2+
# VPC
3+
################################################################################
4+
5+
output "vpc_id" {
6+
description = "The ID of the VPC"
7+
value = module.vpc.vpc_id
8+
}
9+
10+
################################################################################
11+
# Subnets
12+
################################################################################
13+
14+
output "private_subnets" {
15+
description = "List of IDs of private subnets"
16+
value = module.vpc.private_subnets
17+
}
18+
19+
output "public_subnets" {
20+
description = "List of IDs of public subnets"
21+
value = module.vpc.public_subnets
22+
}
23+
24+
output "firewall_subnets" {
25+
description = "List of IDs of firewall subnets"
26+
value = module.vpc.firewall_subnets
27+
}
28+
29+
################################################################################
30+
# NAT Gateway
31+
################################################################################
32+
33+
output "nat_public_ips" {
34+
description = "List of public Elastic IPs created for AWS NAT Gateway"
35+
value = module.vpc.nat_public_ips
36+
}
37+
38+
output "network_firewall_arn" {
39+
description = "ARN of the Network Firewall"
40+
value = module.vpc.network_firewall_arn
41+
}

‎examples/network-firewall/variables.tf‎

Whitespace-only changes.

‎examples/network-firewall/versions.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.46"
8+
}
9+
random = {
10+
source = "hashicorp/random"
11+
version = ">= 3.0"
12+
}
13+
}
14+
}

‎network-firewall.tf‎

Lines changed: 28 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,24 @@
11
locals {
2-
#aws_managed_rules_prefix_arn = "arn:aws:network-firewall:${data.aws_region.current.name}:aws-managed:stateful-rulegroup"
3-
aws_managed_rules_prefix_arn = "arn:aws:network-firewall:us-east-2:aws-managed:stateful-rulegroup" // TODO - review this region
4-
5-
// TODO - Review these rules
6-
firewall_managed_rules = distinct(concat([
7-
"AbusedLegitMalwareDomainsStrictOrder",
8-
"BotNetCommandAndControlDomainsStrictOrder",
9-
"AbusedLegitBotNetCommandAndControlDomainsStrictOrder",
10-
"MalwareDomainsStrictOrder",
11-
"ThreatSignaturesIOCStrictOrder",
12-
"ThreatSignaturesPhishingStrictOrder",
13-
"ThreatSignaturesBotnetWebStrictOrder",
14-
"ThreatSignaturesEmergingEventsStrictOrder",
15-
"ThreatSignaturesDoSStrictOrder",
16-
"ThreatSignaturesMalwareWebStrictOrder",
17-
"ThreatSignaturesExploitsStrictOrder",
18-
"ThreatSignaturesWebAttacksStrictOrder",
19-
"ThreatSignaturesScannersStrictOrder",
20-
"ThreatSignaturesBotnetStrictOrder",
21-
"ThreatSignaturesMalwareStrictOrder",
22-
"ThreatSignaturesMalwareCoinminingStrictOrder",
23-
"ThreatSignaturesFUPStrictOrder",
24-
"ThreatSignaturesSuspectStrictOrder",
25-
"ThreatSignaturesBotnetWindowsStrictOrder",
26-
], var.firewall_managed_rules))
27-
28-
name = "${var.name}-network-firewall"
2+
aws_managed_rules_prefix_arn = "arn:aws:network-firewall:${var.region}:aws-managed:stateful-rulegroup"
3+
firewall_managed_rules = distinct(var.firewall_managed_rules)
4+
name = "${var.name}-network-firewall"
295
}
306

317
module "firewall" {
32-
source = "terraform-aws-modules/network-firewall/aws"
8+
source = "terraform-aws-modules/network-firewall/aws"
9+
version = "~> 1.0"
3310

3411
count = var.create_network_firewall ? 1 : 0
3512

36-
# Firewall
13+
3714
name = local.name
38-
description = var.description
15+
description = var.firewall_description
16+
3917

40-
# Only for example
41-
delete_protection = var.delete_protection
18+
delete_protection = var.firewall_delete_protection
4219
firewall_policy_change_protection = var.firewall_policy_change_protection
43-
subnet_change_protection = var.subnet_change_protection
20+
subnet_change_protection = var.firewall_subnet_change_protection
21+
4422

4523
vpc_id = aws_vpc.this[0].id
4624
subnet_mapping = { for subnet_id in aws_subnet.firewall.*.id :
@@ -50,8 +28,8 @@ module "firewall" {
5028
}
5129
}
5230

53-
# Logging configuration
54-
create_logging_configuration = true
31+
### Logging configuration ###
32+
create_logging_configuration = false
5533
logging_configuration_destination_config = [
5634
{
5735
log_destination = {
@@ -74,11 +52,10 @@ module "firewall" {
7452
type = "CUSTOMER_KMS"
7553
}
7654

77-
# Policy
55+
### Policy ###
7856
policy_name = local.name
7957
policy_description = "Default network firewall policy for ${local.name}"
8058

81-
# policy_stateful_rule_group_reference = {}
8259
policy_stateful_rule_group_reference = {
8360
for i, rule_group in local.firewall_managed_rules : rule_group => {
8461
resource_arn = "${local.aws_managed_rules_prefix_arn}/${rule_group}",
@@ -94,42 +71,46 @@ module "firewall" {
9471

9572
tags = var.tags // TODO - review these tags
9673

97-
depends_on = [module.kms]
74+
depends_on = [module.kms, module.logs_alerts, module.logs_flow]
9875
}
9976

10077
module "logs_alerts" {
10178
source = "git::https://github.com/withclutch/terraform-modules-registry?ref=aws-log-group_v1.194"
10279

10380
count = var.create_network_firewall ? 1 : 0
10481

105-
name = "${local.name}-alerts"
82+
name = "nf-network-log-alerts"
10683
tenant = var.tenant
10784
region = var.region
10885
environment = var.environment
10986

110-
retention_in_days = var.logs_retention_in_days
111-
kms_key_arn = var.logs_kms_key_arn
87+
retention_in_days = var.firewall_logs_retention_in_days
88+
kms_key_arn = module.kms[0].key_arn
11289
create_datadog_subscription_filter = true
90+
91+
depends_on = [module.kms]
11392
}
11493

115-
// TODO review if this module is really necessary
11694
module "logs_flow" {
11795
source = "git::https://github.com/withclutch/terraform-modules-registry?ref=aws-log-group_v1.194"
11896

11997
count = var.create_network_firewall ? 1 : 0
12098

121-
name = "${local.name}-flow" // TODO - review this name
99+
name = "nf-network-log-flow"
122100
tenant = var.tenant
123101
region = var.region
124102
environment = var.environment
125103

126-
retention_in_days = var.logs_retention_in_days
127-
kms_key_arn = var.logs_kms_key_arn
104+
retention_in_days = var.firewall_logs_retention_in_days
105+
kms_key_arn = module.kms[0].key_arn
128106
create_datadog_subscription_filter = false
107+
108+
depends_on = [module.kms]
129109
}
130110

131111
module "kms" {
132-
source = "git::https://github.com/withclutch/terraform-modules-registry?ref=aws-kms_v1.194"
112+
#source = "git::https://github.com/withclutch/terraform-modules-registry?ref=aws-kms_v1.194"
113+
source = "/Users/roger.amorim/Clutch/projects/infrastructure/terraform-modules/modules/aws-kms"
133114

134115
count = var.create_network_firewall ? 1 : 0
135116

@@ -140,5 +121,6 @@ module "kms" {
140121
namespace = var.namespace
141122
tenant = var.tenant
142123
tags = var.tags
124+
#allow_usage_in_network_log_groups = true
143125
}
144126

‎outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -708,6 +708,11 @@ output "firewall_status" {
708708
value = try(module.firewall[0].status, {})
709709
}
710710

711+
output "network_firewall_arn" {
712+
description = "ARN of the Network Firewall"
713+
value = try(module.firewall[0].arn, {})
714+
}
715+
711716
################################################################################
712717
# Static values (arguments)
713718
################################################################################

0 commit comments

Comments
 (0)