Skip to content

Commit 6c685ef

Browse files
aaron-laneaaron-lane
authored
Merge pull request #40 from terraform-google-modules/fabric-firewall
Initial import of net-firewall submodule from internal version.
2 parents d3ffb6f + 30dbf50 commit 6c685ef

File tree

19 files changed

+532
-2
lines changed

19 files changed

+532
-2
lines changed

‎.kitchen.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,20 @@ suites:
9393
backend: local
9494
controls:
9595
- gcloud
96+
- name: "submodule_firewall"
97+
driver:
98+
name: "terraform"
99+
command_timeout: 1800
100+
root_module_directory: test/fixtures/submodule_firewall/
101+
verifier:
102+
name: terraform
103+
color: true
104+
systems:
105+
- name: inspec-gcp
106+
backend: gcp
107+
controls:
108+
- gcp
109+
- name: local
110+
backend: local
111+
controls:
112+
- gcloud

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning][semver-site].
77

88
## [Unreleased]
99

10+
### Added
11+
12+
- New firewall submodule [#40]
13+
1014
## [0.6.0] - 2019-02-21
1115

1216
### Added

‎examples/submodule_firewall/README.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Simple Project With Firewall
2+
3+
This example configures a single simple VPC inside of a project, and adds a basic firewall.
4+
5+
This VPC has two subnets, with no secondary ranges.
6+
7+
[^]: (autogen_docs_start)
8+
9+
## Inputs
10+
11+
| Name | Description | Type | Default | Required |
12+
|------|-------------|:----:|:-----:|:-----:|
13+
| network\_name | The name of the VPC network being created | string | n/a | yes |
14+
| project\_id | The project ID to host the network in | string | n/a | yes |
15+
16+
## Outputs
17+
18+
| Name | Description |
19+
|------|-------------|
20+
| admin\_ranges | Firewall attributes for admin ranges. |
21+
| internal\_ranges | Firewall attributes for internal ranges. |
22+
| network\_name | The name of the VPC being created |
23+
24+
[^]: (autogen_docs_end)

‎examples/submodule_firewall/main.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
locals {
17+
subnet_01 = "${var.network_name}-subnet-01"
18+
subnet_02 = "${var.network_name}-subnet-02"
19+
}
20+
21+
module "test-vpc-module" {
22+
source = "../../"
23+
project_id = "${var.project_id}"
24+
network_name = "${var.network_name}"
25+
26+
subnets = [
27+
{
28+
subnet_name = "${local.subnet_01}"
29+
subnet_ip = "10.10.10.0/24"
30+
subnet_region = "us-west1"
31+
},
32+
{
33+
subnet_name = "${local.subnet_02}"
34+
subnet_ip = "10.10.20.0/24"
35+
subnet_region = "us-west1"
36+
subnet_private_access = "true"
37+
subnet_flow_logs = "true"
38+
},
39+
]
40+
41+
secondary_ranges = {
42+
"${local.subnet_01}" = []
43+
"${local.subnet_02}" = []
44+
}
45+
}
46+
47+
module "test-firewall-submodule" {
48+
source = "../../modules/fabric-net-firewall"
49+
project_id = "${var.project_id}"
50+
network = "${module.test-vpc-module.network_name}"
51+
internal_ranges_enabled = true
52+
internal_ranges = ["${module.test-vpc-module.subnets_ips}"]
53+
54+
internal_allow = [{
55+
protocol = "icmp"
56+
},
57+
{
58+
protocol = "tcp"
59+
},
60+
{
61+
protocol = "udp"
62+
},
63+
]
64+
}

‎examples/submodule_firewall/outputs.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "network_name" {
18+
value = "${module.test-vpc-module.network_name}"
19+
description = "The name of the VPC being created"
20+
}
21+
22+
output "internal_ranges" {
23+
description = "Firewall attributes for internal ranges."
24+
value = "${module.test-firewall-submodule.internal_ranges}"
25+
}
26+
27+
output "admin_ranges" {
28+
description = "Firewall attributes for admin ranges."
29+
value = "${module.test-firewall-submodule.admin_ranges}"
30+
}

‎examples/submodule_firewall/variables.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the network in"
19+
}
20+
21+
variable "network_name" {
22+
description = "The name of the VPC network being created"
23+
}

‎modules/fabric-net-firewall/README.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Google Cloud Simple VPC Firewall Creation
2+
3+
This module allows creation of a minimal VPC firewall, supporting basic configurable rules for IP range-based intra-VPC and administrator ingress, and tag-based SSH, HTTP, and HTTPS ingress.
4+
5+
The HTTP and HTTPS rules use the same network tags network tags that are assigned to instances when flaggging the "Allow HTTP[S] traffic" checkbox in the Cloud Console. The SSH rule uses a generic `ssh` tag.
6+
7+
All IP source ranges are configurable through variables, and are set by default to `0.0.0.0/0` for tag-based rules. Allowed protocols and/or ports for the intra-VPC rule are also configurable through a variable.
8+
9+
The resources created/managed by this module are:
10+
11+
- one optional ingress rule from internal CIDR ranges, only allowing ICMP by default
12+
- one optional ingress rule from admin CIDR ranges, allowing all protocols on all ports
13+
- one optional ingress rule for SSH on network tag `ssh`
14+
- one optional ingress rule for HTTP on network tag `http-server`
15+
- one optional ingress rule for HTTPS on network tag `https-server`
16+
17+
18+
## Usage
19+
20+
Basic usage of this module is as follows:
21+
22+
```hcl
23+
module "net-firewall" {
24+
source = "terraform-google-modules/terraform-google-network/google//modules/fabric-net-firewall"
25+
project_id = "my-project"
26+
network = "my-vpc"
27+
internal_ranges_enabled = true
28+
internal_ranges = ["10.0.0.0/0"]
29+
}
30+
```
31+
32+
[^]: (autogen_docs_start)
33+
34+
## Inputs
35+
36+
| Name | Description | Type | Default | Required |
37+
|------|-------------|:----:|:-----:|:-----:|
38+
| admin\_ranges | IP CIDR ranges that have complete access to all subnets. | list | `<list>` | no |
39+
| admin\_ranges\_enabled | Enable admin ranges-based rules. | string | `"false"` | no |
40+
| http\_source\_ranges | List of IP CIDR ranges for tag-based HTTP rule, defaults to 0.0.0.0/0. | list | `<list>` | no |
41+
| https\_source\_ranges | List of IP CIDR ranges for tag-based HTTPS rule, defaults to 0.0.0.0/0. | list | `<list>` | no |
42+
| internal\_allow | Allow rules for internal ranges. | list | `<list>` | no |
43+
| internal\_ranges | IP CIDR ranges for intra-VPC rules. | list | `<list>` | no |
44+
| internal\_ranges\_enabled | Create rules for intra-VPC ranges. | string | `"false"` | no |
45+
| network | Name of the network this set of firewall rules applies to. | string | n/a | yes |
46+
| project\_id | Project id of the project that holds the network. | string | n/a | yes |
47+
| ssh\_source\_ranges | List of IP CIDR ranges for tag-based SSH rule, defaults to 0.0.0.0/0. | list | `<list>` | no |
48+
49+
## Outputs
50+
51+
| Name | Description |
52+
|------|-------------|
53+
| admin\_ranges | Admin ranges data. |
54+
| internal\_ranges | Internal ranges. |
55+
56+
[^]: (autogen_docs_end)

‎modules/fabric-net-firewall/main.tf‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
###############################################################################
18+
# rules based on IP ranges
19+
###############################################################################
20+
21+
resource "google_compute_firewall" "allow-internal" {
22+
count = "${var.internal_ranges_enabled && length(var.internal_allow) > 0 ? 1 : 0}"
23+
name = "${var.network}-ingress-internal"
24+
description = "Allow ingress traffic from internal IP ranges"
25+
network = "${var.network}"
26+
project = "${var.project_id}"
27+
source_ranges = ["${var.internal_ranges}"]
28+
allow = ["${var.internal_allow}"]
29+
}
30+
31+
resource "google_compute_firewall" "allow-admins" {
32+
count = "${var.admin_ranges_enabled > 0 ? 1 : 0}"
33+
name = "${var.network}-ingress-admins"
34+
description = "Access from the admin subnet to all subnets"
35+
network = "${var.network}"
36+
project = "${var.project_id}"
37+
source_ranges = ["${var.admin_ranges}"]
38+
39+
allow {
40+
protocol = "icmp"
41+
}
42+
43+
allow {
44+
protocol = "tcp"
45+
}
46+
47+
allow {
48+
protocol = "udp"
49+
}
50+
}
51+
52+
###############################################################################
53+
# rules based on tags
54+
###############################################################################
55+
56+
resource "google_compute_firewall" "allow-tag-ssh" {
57+
count = "${length(var.ssh_source_ranges) > 0 ? 1 : 0}"
58+
name = "${var.network}-ingress-tag-ssh"
59+
description = "Allow SSH to machines with the 'ssh' tag"
60+
network = "${var.network}"
61+
project = "${var.project_id}"
62+
source_ranges = ["${var.ssh_source_ranges}"]
63+
target_tags = ["ssh"]
64+
65+
allow {
66+
protocol = "tcp"
67+
ports = ["22"]
68+
}
69+
}
70+
71+
resource "google_compute_firewall" "allow-tag-http" {
72+
count = "${length(var.http_source_ranges) > 0 ? 1 : 0}"
73+
name = "${var.network}-ingress-tag-http"
74+
description = "Allow HTTP to machines with the 'http-server' tag"
75+
network = "${var.network}"
76+
project = "${var.project_id}"
77+
source_ranges = ["${var.http_source_ranges}"]
78+
target_tags = ["http-server"]
79+
80+
allow {
81+
protocol = "tcp"
82+
ports = ["80"]
83+
}
84+
}
85+
86+
resource "google_compute_firewall" "allow-tag-https" {
87+
count = "${length(var.https_source_ranges) > 0 ? 1 : 0}"
88+
name = "${var.network}-ingress-tag-https"
89+
description = "Allow HTTPS to machines with the 'https' tag"
90+
network = "${var.network}"
91+
project = "${var.project_id}"
92+
source_ranges = ["${var.https_source_ranges}"]
93+
target_tags = ["https-server"]
94+
95+
allow {
96+
protocol = "tcp"
97+
ports = ["443"]
98+
}
99+
}

‎modules/fabric-net-firewall/outputs.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "internal_ranges" {
18+
description = "Internal ranges."
19+
20+
value = {
21+
enabled = "${var.internal_ranges_enabled}"
22+
ranges = "${var.internal_ranges_enabled ? join(",", var.internal_ranges) : ""}"
23+
}
24+
}
25+
26+
output "admin_ranges" {
27+
description = "Admin ranges data."
28+
29+
value = {
30+
enabled = "${var.admin_ranges_enabled}"
31+
ranges = "${var.admin_ranges_enabled ? join(",", var.admin_ranges) : ""}"
32+
}
33+
}

0 commit comments

Comments
 (0)