rename custom rules variable, fix tag-based egress

Author: ludoo

modules/fabric-net-firewall/main.tf

@@ -109,17 +109,17 @@ resource "google_compute_firewall" "allow-tag-https" {
 #                                dynamic rules                                 #
 ################################################################################
 
-resource "google_compute_firewall" "dynamic" {
+resource "google_compute_firewall" "custom" {
   # provider                = "google-beta"
-  for_each                = var.dynamic_rules
+  for_each                = var.custom_rules
   name                    = each.key
   description             = each.value.description
   direction               = each.value.direction
   network                 = var.network
   project                 = var.project_id
   source_ranges           = each.value.direction == "INGRESS" ? each.value.ranges : null
   destination_ranges      = each.value.direction == "EGRESS" ? each.value.ranges : null
-  source_tags             = each.value.use_service_accounts ? null : each.value.sources
+  source_tags             = each.value.use_service_accounts || each.value.direction == "EGRESS" ? null : each.value.sources
   target_tags             = each.value.use_service_accounts ? null : each.value.targets
   source_service_accounts = each.value.use_service_accounts ? each.value.sources : null
   target_service_accounts = each.value.use_service_accounts ? each.value.targets : null

modules/fabric-net-firewall/outputs.tf

@@ -32,3 +32,34 @@ output "admin_ranges" {
   }
 }
 
+output "custom_ingress_allow_rules" {
+  description = "Custom ingress rules with allow blocks."
+  value = [
+    for rule in google_compute_firewall.custom :
+    rule.name if rule.direction == "INGRESS" && length(rule.allow) > 0
+  ]
+}
+
+output "custom_ingress_deny_rules" {
+  description = "Custom ingress rules with deny blocks."
+  value = [
+    for rule in google_compute_firewall.custom :
+    rule.name if rule.direction == "INGRESS" && length(rule.deny) > 0
+  ]
+}
+
+output "custom_egress_allow_rules" {
+  description = "Custom egress rules with allow blocks."
+  value = [
+    for rule in google_compute_firewall.custom :
+    rule.name if rule.direction == "EGRESS" && length(rule.allow) > 0
+  ]
+}
+
+output "custom_egress_deny_rules" {
+  description = "Custom egress rules with allow blocks."
+  value = [
+    for rule in google_compute_firewall.custom :
+    rule.name if rule.direction == "EGRESS" && length(rule.deny) > 0
+  ]
+}

modules/fabric-net-firewall/variables.tf

@@ -66,8 +66,8 @@ variable "https_source_ranges" {
   default     = ["0.0.0.0/0"]
 }
 
-variable "dynamic_rules" {
-  description = "List of dynamic rule definitions."
+variable "custom_rules" {
+  description = "List of custom rule definitions."
   type = map(object({
     description          = string
     direction            = string