Skip to content

Commit c7c0f07

Browse files
imrannayerimrannayer
authored
feat: add hierarchical firewall policy sub-module (#553)
1 parent 761db96 commit c7c0f07

File tree

21 files changed

+998
-29
lines changed

21 files changed

+998
-29
lines changed

‎README.md‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,27 @@ It supports creating:
77
- A Google Virtual Private Network (VPC)
88
- Subnets within the VPC
99
- Secondary ranges for the subnets (if applicable)
10-
11-
Sub modules are provided for creating individual vpc, subnets, and routes. See the modules directory for the various sub modules usage.
10+
- routes
11+
- firewall rules
12+
13+
[Sub modules](./modules/) are provided for creating individual vpc, subnets, routes, firewall rules, and firewall policies. See the [modules](./modules/) directory for the various sub modules usage.
14+
- [vpc](./modules/vpc/)
15+
- [subnet](./modules/subnets/)
16+
- [route](./modules/routes/)
17+
- [firewall rules](./modules/firewall-rules/)
18+
- [hierarchical firewall policy](./modules/hierarchical-firewall-policy/)
19+
- [network firewall policy](./modules/network-firewall-policy/)
20+
- [serverless vpc access connector](./modules/vpc-serverless-connector-beta/)
21+
- [hierarchical firewall policy](./modules/hierarchical-firewall-policy/)
1222

1323
## Compatibility
1424

1525
This module is meant for use with Terraform 1.3+ and tested using Terraform 1.4+.
1626
If you find incompatibilities using Terraform `>=1.3`, please open an issue.
1727

18-
If you haven't [upgraded][terraform-0.13-upgrade] and need a Terraform
19-
0.12.x-compatible version of this module, the last released version
20-
intended for Terraform 0.12.x is [2.6.0].
2128

2229
## Usage
23-
You can go to the examples folder, however the usage of the module could be like this in your own main.tf file:
30+
You can go to the [examples](./examples/) folder, however the usage of the module could be like this in your own main.tf file:
2431

2532
```hcl
2633
module "vpc" {

‎build/int.cloudbuild.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,21 @@ steps:
211211
- verify firewall-rule
212212
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
213213
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/bidirectional-firewall-rules --stage teardown --verbose']
214+
- id: converge hierarchical-firewall-policy
215+
waitFor:
216+
- destroy firewall-rule
217+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
218+
args: ['/bin/bash', '-c', 'cft test run TestHierarchicalFirewallPolicy --stage apply --verbose']
219+
- id: verify hierarchical-firewall-policy
220+
waitFor:
221+
- converge hierarchical-firewall-policy
222+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
223+
args: ['/bin/bash', '-c', 'cft test run TestHierarchicalFirewallPolicy --stage verify --verbose']
224+
- id: destroy hierarchical-firewall-policy
225+
waitFor:
226+
- verify hierarchical-firewall-policy
227+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
228+
args: ['/bin/bash', '-c', 'cft test run TestHierarchicalFirewallPolicy --stage teardown --verbose']
214229
tags:
215230
- 'ci'
216231
- 'integration'

‎examples/hierarchical-firewall-policy/README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# hierarchical Firewall Policy Rule
2+
3+
This example creates a Service Account and 2 hierarchical firewall policy. First policy will have a few rules and will be attached to folders. Second policy will not be attached and any folders/org and will not have any rules.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|------|---------|:--------:|
10+
| folder1 | The folder\_id ID 1 to to create firewall policy in | `any` | n/a | yes |
11+
| folder2 | The folder\_id ID 2 to attach firewal policy to | `any` | n/a | yes |
12+
| folder3 | The folder\_id ID 3 to attach firewal policy to | `any` | n/a | yes |
13+
| org\_id | The org ID attach firewal policy to | `any` | n/a | yes |
14+
| project\_id | The project ID to host the network in | `any` | n/a | yes |
15+
16+
## Outputs
17+
18+
| Name | Description |
19+
|------|-------------|
20+
| firewal\_policy\_no\_rules\_id | ID of Firewall policy created without any rules and association |
21+
| firewal\_policy\_no\_rules\_name | Name of Firewall policy created without any rules and association |
22+
| firewal\_policy\_no\_rules\_parent\_folder | Firewall policy parent |
23+
| fw\_policy\_id | Firewall policy ID |
24+
| fw\_policy\_name | Firewall policy name |
25+
| fw\_policy\_parent\_folder | Firewall policy parent |
26+
| project\_id | Project ID |
27+
| rules | Firewall policy rules |
28+
| target\_associations | Firewall policy association |
29+
30+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/hierarchical-firewall-policy/main.tf‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
/**
2+
* Copyright 2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
prefix = "hierarchical"
19+
}
20+
21+
resource "random_string" "random_suffix" {
22+
length = 6
23+
special = false
24+
lower = true
25+
upper = false
26+
}
27+
28+
resource "google_service_account" "service_account" {
29+
project = var.project_id
30+
account_id = "${local.prefix}-fw-test-svc-acct"
31+
display_name = "${local.prefix} firewall policy test service account"
32+
}
33+
34+
resource "google_compute_network" "network" {
35+
project = var.project_id
36+
name = "${local.prefix}-network"
37+
}
38+
39+
resource "google_compute_network" "network_backup" {
40+
project = var.project_id
41+
name = "${local.prefix}-network-backup"
42+
}
43+
44+
module "firewal_policy" {
45+
source = "terraform-google-modules/network/google//modules/hierarchical-firewall-policy"
46+
version = "~> 9.0"
47+
48+
parent_node = "folders/${var.folder1}"
49+
policy_name = "${local.prefix}-firewall-policy-${random_string.random_suffix.result}"
50+
description = "test ${local.prefix} firewall policy"
51+
target_org = var.org_id
52+
target_folders = [var.folder2, var.folder3]
53+
54+
rules = [
55+
{
56+
priority = "1"
57+
direction = "INGRESS"
58+
action = "allow"
59+
rule_name = "ingress-1"
60+
description = "test ingres rule 1"
61+
enable_logging = true
62+
match = {
63+
src_ip_ranges = ["10.100.0.1/32"]
64+
src_fqdns = ["example.com"]
65+
src_region_codes = ["US"]
66+
src_threat_intelligences = ["iplist-public-clouds"]
67+
layer4_configs = [
68+
{
69+
ip_protocol = "all"
70+
},
71+
]
72+
}
73+
},
74+
{
75+
priority = "2"
76+
direction = "INGRESS"
77+
action = "deny"
78+
rule_name = "ingress-2"
79+
disabled = true
80+
description = "test ingres rule 2"
81+
target_resources = [
82+
"projects/${var.project_id}/global/networks/${local.prefix}-network-backup",
83+
]
84+
match = {
85+
src_ip_ranges = ["10.100.0.2/32"]
86+
src_fqdns = ["example.org"]
87+
src_region_codes = ["BE"]
88+
layer4_configs = [
89+
{
90+
ip_protocol = "all"
91+
},
92+
]
93+
}
94+
},
95+
{
96+
priority = "3"
97+
direction = "INGRESS"
98+
action = "allow"
99+
rule_name = "ingress-3"
100+
disabled = true
101+
description = "test ingres rule 3"
102+
enable_logging = true
103+
target_service_accounts = ["fw-test-svc-acct@${var.project_id}.iam.gserviceaccount.com"]
104+
match = {
105+
src_ip_ranges = ["10.100.0.3/32"]
106+
dest_ip_ranges = ["10.100.0.103/32"]
107+
layer4_configs = [
108+
{
109+
ip_protocol = "tcp"
110+
ports = ["80"]
111+
},
112+
]
113+
}
114+
},
115+
{
116+
priority = "101"
117+
direction = "EGRESS"
118+
action = "allow"
119+
rule_name = "egress-101"
120+
description = "test egress rule 101"
121+
enable_logging = true
122+
match = {
123+
src_ip_ranges = ["10.100.0.2/32"]
124+
dest_fqdns = ["example.com"]
125+
dest_region_codes = ["US"]
126+
dest_threat_intelligences = ["iplist-public-clouds"]
127+
layer4_configs = [
128+
{
129+
ip_protocol = "all"
130+
},
131+
]
132+
}
133+
},
134+
{
135+
priority = "102"
136+
direction = "EGRESS"
137+
action = "deny"
138+
rule_name = "egress-102"
139+
disabled = true
140+
description = "test egress rule 102"
141+
target_resources = [
142+
"projects/${var.project_id}/global/networks/${local.prefix}-network",
143+
]
144+
match = {
145+
src_ip_ranges = ["10.100.0.102/32"]
146+
dest_ip_ranges = ["10.100.0.2/32"]
147+
dest_region_codes = ["AR"]
148+
layer4_configs = [
149+
{
150+
ip_protocol = "all"
151+
},
152+
]
153+
}
154+
},
155+
{
156+
priority = "103"
157+
direction = "EGRESS"
158+
action = "allow"
159+
rule_name = "egress-103"
160+
disabled = true
161+
description = "test ingres rule 103"
162+
enable_logging = true
163+
target_service_accounts = ["fw-test-svc-acct@${var.project_id}.iam.gserviceaccount.com"]
164+
match = {
165+
dest_ip_ranges = ["10.100.0.103/32"]
166+
layer4_configs = [
167+
{
168+
ip_protocol = "tcp"
169+
ports = ["80", "8080", "8081-8085"]
170+
},
171+
]
172+
}
173+
},
174+
175+
]
176+
depends_on = [
177+
google_compute_network.network,
178+
google_compute_network.network_backup,
179+
]
180+
181+
}
182+
183+
module "firewal_policy_no_rule" {
184+
source = "terraform-google-modules/network/google//modules/hierarchical-firewall-policy"
185+
version = "~> 9.0"
186+
187+
parent_node = "folders/${var.folder1}"
188+
policy_name = "${local.prefix}-firewall-policy-no-rules-${random_string.random_suffix.result}"
189+
description = "${local.prefix} test firewall policy without any rules"
190+
}

‎examples/hierarchical-firewall-policy/outputs.tf‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/**
2+
* Copyright 2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "project_id" {
18+
value = var.project_id
19+
description = "Project ID"
20+
}
21+
22+
output "fw_policy_id" {
23+
value = module.firewal_policy.fw_policy.name
24+
description = "Firewall policy ID"
25+
}
26+
27+
output "fw_policy_parent_folder" {
28+
value = module.firewal_policy.fw_policy.parent
29+
description = "Firewall policy parent"
30+
}
31+
32+
output "fw_policy_name" {
33+
value = module.firewal_policy.fw_policy.short_name
34+
description = "Firewall policy name"
35+
}
36+
37+
output "target_associations" {
38+
value = module.firewal_policy.target_associations
39+
description = "Firewall policy association"
40+
}
41+
42+
output "rules" {
43+
value = module.firewal_policy.rules
44+
description = "Firewall policy rules"
45+
}
46+
47+
output "firewal_policy_no_rules_id" {
48+
value = module.firewal_policy_no_rule.fw_policy.name
49+
description = "ID of Firewall policy created without any rules and association"
50+
}
51+
52+
output "firewal_policy_no_rules_name" {
53+
value = module.firewal_policy_no_rule.fw_policy.short_name
54+
description = "Name of Firewall policy created without any rules and association"
55+
}
56+
57+
output "firewal_policy_no_rules_parent_folder" {
58+
value = module.firewal_policy.fw_policy.parent
59+
description = "Firewall policy parent"
60+
}

‎examples/hierarchical-firewall-policy/variables.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Copyright 2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the network in"
19+
}
20+
21+
variable "folder1" {
22+
description = "The folder_id ID 1 to to create firewall policy in"
23+
}
24+
25+
variable "folder2" {
26+
description = "The folder_id ID 2 to attach firewal policy to"
27+
}
28+
29+
variable "folder3" {
30+
description = "The folder_id ID 3 to attach firewal policy to"
31+
}
32+
33+
variable "org_id" {
34+
description = "The org ID attach firewal policy to"
35+
}

‎modules/fabric-net-firewall/main.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,6 @@ resource "google_compute_firewall" "allow-tag-https" {
116116
################################################################################
117117

118118
resource "google_compute_firewall" "custom" {
119-
# provider = "google-beta"
120119
for_each = var.custom_rules
121120
name = each.key
122121
description = each.value.description

0 commit comments

Comments
 (0)