Skip to content

Commit 83a7e85

Browse files
imrannayerimrannayer
authored
feat: add destination_ranges and source_ranges in firewall rules (#464)
1 parent 764cbaa commit 83a7e85

File tree

9 files changed

+502
-11
lines changed

9 files changed

+502
-11
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,21 @@ steps:
196196
- verify regional-firewall-policy
197197
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
198198
args: ['/bin/bash', '-c', 'cft test run TestRegionalNetworkFirewallPolicy --stage teardown --verbose']
199+
- id: converge firewall-rule
200+
waitFor:
201+
- create all
202+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
203+
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/bidirectional-firewall-rules --stage apply --verbose']
204+
- id: verify firewall-rule
205+
waitFor:
206+
- converge firewall-rule
207+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
208+
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/bidirectional-firewall-rules --stage verify --verbose']
209+
- id: destroy firewall-rule
210+
waitFor:
211+
- verify firewall-rule
212+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
213+
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/bidirectional-firewall-rules --stage teardown --verbose']
199214
tags:
200215
- 'ci'
201216
- 'integration'

‎examples/bidirectional-firewall-rules/README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Simple Project With Firewall
2+
3+
This example configures a single simple VPC inside of a project, and adds a ingress/egress firewall rules.
4+
5+
This VPC has two subnets, with no secondary ranges.
6+
7+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8+
## Inputs
9+
10+
| Name | Description | Type | Default | Required |
11+
|------|-------------|------|---------|:--------:|
12+
| network\_name | The name of the VPC network being created | `string` | `"test-fw-rules"` | no |
13+
| project\_id | The project ID to host the network in | `any` | n/a | yes |
14+
15+
## Outputs
16+
17+
| Name | Description |
18+
|------|-------------|
19+
| network\_name | The name of the VPC being created |
20+
| network\_self\_link | The URI of the VPC being created |
21+
| project\_id | VPC project id |
22+
| route\_names | The routes associated with this VPC |
23+
| subnets\_flow\_logs | Whether the subnets will have VPC flow logs enabled |
24+
| subnets\_ips | The IP and cidrs of the subnets being created |
25+
| subnets\_names | The names of the subnets being created |
26+
| subnets\_private\_access | Whether the subnets will have access to Google API's without a public IP |
27+
| subnets\_regions | The region where subnets will be created |
28+
| subnets\_secondary\_ranges | The secondary ranges associated with these subnets |
29+
30+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/bidirectional-firewall-rules/main.tf‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
subnet_01 = "${var.network_name}-subnet-01"
19+
subnet_02 = "${var.network_name}-subnet-02"
20+
21+
custom_rules = [
22+
// Example of custom tcp/udp rule
23+
{
24+
name = "fwtest-deny-ingress-6534-6566"
25+
description = "Deny all INGRESS to port 6534-6566"
26+
direction = "INGRESS"
27+
ranges = ["0.0.0.0/0"]
28+
deny = [{
29+
protocol = "tcp"
30+
ports = ["6534-6566"]
31+
},
32+
{
33+
protocol = "udp"
34+
ports = ["6534-6566"]
35+
}]
36+
37+
},
38+
39+
{
40+
name = "fwtest-deny-egress-6534-6566"
41+
description = "Deny all EGRESS to 47.189.12.139/32 port 6534-6566"
42+
direction = "EGRESS"
43+
ranges = ["47.189.12.139/32"]
44+
deny = [{
45+
protocol = "tcp"
46+
ports = ["6534-6566"]
47+
},
48+
{
49+
protocol = "udp"
50+
ports = ["6534-6566"]
51+
}]
52+
53+
},
54+
55+
// Example how to allow connection from instances with `backend` tag, to instances with `databases` tag
56+
{
57+
name = "fwtest-allow-backend-to-databases"
58+
description = "Allow backend nodes connection to databases instances"
59+
direction = "INGRESS"
60+
target_tags = ["databases"]
61+
source_tags = ["backed"]
62+
allow = [{
63+
protocol = "tcp"
64+
ports = ["3306", "5432", "1521", "1433"]
65+
}]
66+
67+
},
68+
69+
// Example how to allow connection from an instance with a given service account
70+
{
71+
name = "fwtest-allow-all-admin-sa"
72+
description = "Allow all traffic from admin sa instances"
73+
direction = "INGRESS"
74+
source_service_accounts = ["[email protected]"]
75+
allow = [{
76+
protocol = "tcp"
77+
ports = null # all ports
78+
},
79+
{
80+
protocol = "udp"
81+
ports = null # all ports
82+
}
83+
]
84+
},
85+
86+
]
87+
88+
89+
custom_rules_ingress = [
90+
// Example of custom tcp/udp rule
91+
{
92+
name = "fwtest-deny-ingress-6500-6566"
93+
description = "Deny all INGRESS to port 6500-6566"
94+
source_ranges = ["0.0.0.0/0"]
95+
deny = [{
96+
protocol = "tcp"
97+
ports = ["6500-6566"]
98+
},
99+
{
100+
protocol = "udp"
101+
ports = ["6500-6566"]
102+
}]
103+
104+
},
105+
{
106+
name = "fwtest-allow-backend-to-db"
107+
description = "Allow backend nodes connection to databases instances"
108+
target_tags = ["db"] # target_tags
109+
source_tags = ["backed"] # source_tags
110+
allow = [{
111+
protocol = "tcp"
112+
ports = ["3306", "5432", "1521", "1433"]
113+
}]
114+
115+
},
116+
{
117+
name = "fwtest-allow-admin-svc-acct"
118+
description = "Allow all traffic from admin sa instances"
119+
source_service_accounts = ["[email protected]"]
120+
allow = [{
121+
protocol = "tcp"
122+
ports = null # all ports
123+
},
124+
{
125+
protocol = "udp"
126+
ports = null # all ports
127+
}
128+
]
129+
},
130+
{
131+
name = "fwtest-allow-ssh-ing"
132+
description = "Allow all traffic from 10.2.0.0/24 to 10.3.0.0/24"
133+
ranges = null
134+
destination_ranges = ["10.2.0.0/24"]
135+
source_ranges = ["10.3.0.0/24"]
136+
allow = [{
137+
protocol = "tcp"
138+
ports = ["22"]
139+
}]
140+
},
141+
142+
]
143+
144+
145+
custom_rules_egress = [
146+
{
147+
name = "fwtest-deny-egress-6400-6466"
148+
description = "Deny all EGRESS to 47.190.12.139/32 port 6400-6466"
149+
destination_ranges = ["47.190.12.139/32"]
150+
deny = [{
151+
protocol = "tcp"
152+
ports = ["6400-6466"]
153+
},
154+
{
155+
protocol = "udp"
156+
ports = ["6400-6466"]
157+
}]
158+
159+
},
160+
161+
{
162+
name = "fwtest-deny-ssh-egr"
163+
description = "Deny all traffic to 10.10.0.0/24 to 10.11.0.0/24"
164+
destination_ranges = ["10.10.0.0/24"]
165+
source_ranges = ["10.11.0.0/24"]
166+
deny = [{
167+
protocol = "tcp"
168+
ports = ["22"]
169+
}]
170+
},
171+
172+
173+
]
174+
175+
176+
}
177+
178+
module "test-vpc-module" {
179+
source = "../../"
180+
project_id = var.project_id
181+
network_name = var.network_name
182+
183+
subnets = [
184+
{
185+
subnet_name = local.subnet_01
186+
subnet_ip = "10.10.10.0/24"
187+
subnet_region = "us-west1"
188+
},
189+
{
190+
subnet_name = local.subnet_02
191+
subnet_ip = "10.10.20.0/24"
192+
subnet_region = "us-west1"
193+
subnet_private_access = "true"
194+
subnet_flow_logs = "true"
195+
},
196+
]
197+
}
198+
199+
200+
module "test-firewall-submodule" {
201+
source = "../../modules/firewall-rules"
202+
project_id = var.project_id
203+
network_name = module.test-vpc-module.network_name
204+
rules = local.custom_rules
205+
}
206+
207+
module "test-firewall-submodule-ing-egr" {
208+
source = "../../modules/firewall-rules"
209+
project_id = var.project_id
210+
network_name = module.test-vpc-module.network_name
211+
ingress_rules = local.custom_rules_ingress
212+
egress_rules = local.custom_rules_egress
213+
}

‎examples/bidirectional-firewall-rules/outputs.tf‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "network_name" {
18+
value = module.test-vpc-module.network_name
19+
description = "The name of the VPC being created"
20+
}
21+
22+
output "network_self_link" {
23+
value = module.test-vpc-module.network_self_link
24+
description = "The URI of the VPC being created"
25+
}
26+
27+
output "project_id" {
28+
value = module.test-vpc-module.project_id
29+
description = "VPC project id"
30+
}
31+
32+
output "subnets_names" {
33+
value = module.test-vpc-module.subnets_names
34+
description = "The names of the subnets being created"
35+
}
36+
37+
output "subnets_ips" {
38+
value = module.test-vpc-module.subnets_ips
39+
description = "The IP and cidrs of the subnets being created"
40+
}
41+
42+
output "subnets_regions" {
43+
value = module.test-vpc-module.subnets_regions
44+
description = "The region where subnets will be created"
45+
}
46+
47+
output "subnets_private_access" {
48+
value = module.test-vpc-module.subnets_private_access
49+
description = "Whether the subnets will have access to Google API's without a public IP"
50+
}
51+
52+
output "subnets_flow_logs" {
53+
value = module.test-vpc-module.subnets_flow_logs
54+
description = "Whether the subnets will have VPC flow logs enabled"
55+
}
56+
57+
output "subnets_secondary_ranges" {
58+
value = module.test-vpc-module.subnets_secondary_ranges
59+
description = "The secondary ranges associated with these subnets"
60+
}
61+
62+
output "route_names" {
63+
value = module.test-vpc-module.route_names
64+
description = "The routes associated with this VPC"
65+
}

‎examples/bidirectional-firewall-rules/variables.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the network in"
19+
}
20+
21+
variable "network_name" {
22+
description = "The name of the VPC network being created"
23+
default = "test-fw-rules"
24+
}

‎examples/bidirectional-firewall-rules/versions.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 1.3.0"
19+
20+
required_providers {
21+
google = {
22+
version = ">= 4.0.0"
23+
}
24+
null = {
25+
version = ">= 2.1.0"
26+
}
27+
}
28+
}

0 commit comments

Comments
 (0)