Skip to content

Commit 3470d63

Browse files
linoy-zoaretzlinoy-zoaretz
committed
changed to TF MX files back
1 parent 2e1fcaa commit 3470d63

File tree

8 files changed

+239
-239
lines changed

8 files changed

+239
-239
lines changed

old-tf-files/init.tf renamed to init.tf

File renamed without changes.

‎main.tf‎

Lines changed: 141 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,162 @@
1-
terraform {
2-
required_providers {
3-
google = {
4-
source = "hashicorp/google"
5-
version = "~> 5.0"
6-
}
7-
}
1+
locals {
2+
resource_prefix = var.deployment_name != "" ? var.deployment_name : random_string.resource_prefix[0].result
3+
waf_image_url = "${module.commons.constants.gcp.image_url_prefix}${module.commons.builds[var.waf_version]}"
4+
mgt_network = var.vpc_network
5+
mx_tag = "${local.resource_prefix}-mx"
6+
mx_fw_rules = merge(
7+
length(var.ui_access_source_ranges) > 0 ? {
8+
UI = {
9+
name = "${local.resource_prefix}-mx-ui-access"
10+
direction = "INGRESS"
11+
network = local.mgt_network
12+
source_ranges = var.ui_access_source_ranges
13+
source_tags = []
14+
target_tags = [
15+
local.mx_tag
16+
]
17+
allow = [
18+
{
19+
protocol = "tcp"
20+
ports = [
21+
"8083"
22+
]
23+
}
24+
]
25+
}
26+
} : {},
27+
length(var.ssh_access_source_ranges) > 0 ? {
28+
SSH = {
29+
name = "${local.resource_prefix}-mx-ssh-access"
30+
direction = "INGRESS"
31+
network = local.mgt_network
32+
source_ranges = var.ssh_access_source_ranges
33+
source_tags = []
34+
target_tags = [
35+
local.mx_tag
36+
]
37+
allow = [
38+
{
39+
protocol = "tcp"
40+
ports = [
41+
"22"
42+
]
43+
}
44+
]
45+
}
46+
} : {}
47+
)
48+
mx_secret_id = google_secret_manager_secret.mx_admin_secret.secret_id
49+
management_ip = google_compute_instance.mx_instance.network_interface[0].network_ip
850
}
951

10-
provider "google" {
11-
project = var.project_id
12-
region = var.region
13-
zone = var.zone
14-
}
15-
16-
# Create a simple VM instance
17-
resource "google_compute_instance" "vm_instance" {
18-
name = var.instance_name
19-
machine_type = var.instance_type
20-
zone = var.zone
21-
22-
boot_disk {
23-
initialize_params {
24-
image = "debian-cloud/debian-11"
25-
size = 20
26-
}
27-
}
28-
29-
network_interface {
30-
network = var.vpc_network
31-
subnetwork = var.subnet_name
32-
33-
access_config {
34-
# Ephemeral public IP
35-
}
36-
}
37-
38-
tags = ["http-server", "https-server"]
39-
}
52+
data "google_client_config" "this" {}
4053

41-
# Variables
42-
variable "project_id" {
43-
description = "GCP Project ID"
44-
type = string
54+
data "google_compute_subnetwork" "data_mx_subnet" {
55+
name = var.subnet_name
56+
region = data.google_client_config.this.region
4557
}
4658

47-
variable "region" {
48-
description = "GCP Region"
49-
type = string
50-
default = "us-central1"
59+
module "commons" {
60+
source = "imperva/wafgateway-commons/google"
61+
version = "1.2.2"
5162
}
5263

53-
variable "zone" {
54-
description = "GCP Zone"
55-
type = string
56-
default = "us-central1-a"
64+
resource "random_string" "resource_prefix" {
65+
count = var.deployment_name != "" ? 0 : 1
66+
length = 4
67+
special = false
68+
upper = false
69+
numeric = false
5770
}
5871

59-
variable "instance_name" {
60-
description = "Name of the VM instance"
61-
type = string
62-
default = "test-vm-instance"
72+
resource "google_service_account" "deployment_service_account" {
73+
account_id = "${local.resource_prefix}-mx-svc-acc"
6374
}
6475

65-
variable "instance_type" {
66-
description = "Machine type for the instance"
67-
type = string
68-
default = "e2-medium"
76+
resource "google_secret_manager_secret" "mx_admin_secret" {
77+
secret_id = "${local.resource_prefix}-mx-secret"
78+
replication {
79+
auto {}
80+
}
6981
}
7082

71-
variable "vpc_network" {
72-
description = "VPC Network name"
73-
type = string
74-
default = "default"
83+
resource "google_secret_manager_secret_version" "mx_admin_secret_version" {
84+
secret = google_secret_manager_secret.mx_admin_secret.id
85+
secret_data = var.mx_password
7586
}
7687

77-
variable "subnet_name" {
78-
description = "Subnet name"
79-
type = string
80-
default = "default"
88+
resource "google_secret_manager_secret_iam_member" "mx_admin_secret_iam_member" {
89+
secret_id = local.mx_secret_id
90+
role = "roles/secretmanager.secretAccessor"
91+
member = "serviceAccount:${google_service_account.deployment_service_account.email}"
8192
}
8293

83-
84-
# Outputs
85-
output "instance_name" {
86-
description = "Name of the created instance"
87-
value = google_compute_instance.vm_instance.name
94+
resource "google_compute_instance" "mx_instance" {
95+
depends_on = [
96+
google_secret_manager_secret_version.mx_admin_secret_version
97+
]
98+
name = "${local.resource_prefix}-mx"
99+
description = "Imperva WAF Management Server (Deployment ID: ${local.resource_prefix})"
100+
zone = var.zone
101+
deletion_protection = var.enable_termination_protection
102+
tags = [
103+
local.mx_tag
104+
]
105+
machine_type = var.instance_type
106+
boot_disk {
107+
initialize_params {
108+
image = local.waf_image_url
109+
}
110+
}
111+
network_interface {
112+
subnetwork = var.subnet_name
113+
network_ip = var.private_ip_address
114+
dynamic "access_config" {
115+
for_each = var.external_ip_address != "" || var.external_ip_network_tier != "" ? [1] : []
116+
content {
117+
nat_ip = var.external_ip_address
118+
network_tier = var.external_ip_network_tier
119+
}
120+
}
121+
}
122+
metadata = {
123+
startup-script = data.template_cloudinit_config.mx_gcp_deploy.rendered
124+
block-project-ssh-keys = var.block_project_ssh_keys
125+
}
126+
service_account {
127+
email = google_service_account.deployment_service_account.email
128+
scopes = [
129+
"cloud-platform"
130+
]
131+
}
132+
lifecycle {
133+
precondition {
134+
condition = data.google_compute_subnetwork.data_mx_subnet.private_ip_google_access
135+
error_message = module.commons.validation.gcp.subnet.private_google_access.error_message
136+
}
137+
}
88138
}
89139

90-
output "instance_ip" {
91-
description = "Public IP address of the instance"
92-
value = google_compute_instance.vm_instance.network_interface[0].access_config[0].nat_ip
140+
resource "time_sleep" "await_mx_ftl" {
141+
depends_on = [
142+
google_compute_instance.mx_instance
143+
]
144+
create_duration = "20m"
93145
}
94146

95-
output "instance_internal_ip" {
96-
description = "Internal IP address of the instance"
97-
value = google_compute_instance.vm_instance.network_interface[0].network_ip
98-
}
147+
resource "google_compute_firewall" "mx_firewall" {
148+
for_each = local.mx_fw_rules
149+
name = each.value.name
150+
network = each.value.network
151+
direction = each.value.direction
152+
source_ranges = each.value.source_ranges
153+
source_tags = each.value.source_tags
154+
target_tags = each.value.target_tags
155+
dynamic "allow" {
156+
for_each = each.value.allow
157+
content {
158+
protocol = allow.value.protocol
159+
ports = allow.value.ports
160+
}
161+
}
162+
}

‎old-tf-files/main-try-work.tf‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
terraform {
2+
required_providers {
3+
google = {
4+
source = "hashicorp/google"
5+
version = "~> 5.0"
6+
}
7+
}
8+
}
9+
10+
provider "google" {
11+
project = var.project_id
12+
region = var.region
13+
zone = var.zone
14+
}
15+
16+
# Create a simple VM instance
17+
resource "google_compute_instance" "vm_instance" {
18+
name = var.instance_name
19+
machine_type = var.instance_type
20+
zone = var.zone
21+
22+
boot_disk {
23+
initialize_params {
24+
image = "debian-cloud/debian-11"
25+
size = 20
26+
}
27+
}
28+
29+
network_interface {
30+
network = var.vpc_network
31+
subnetwork = var.subnet_name
32+
33+
access_config {
34+
# Ephemeral public IP
35+
}
36+
}
37+
38+
tags = ["http-server", "https-server"]
39+
}
40+
41+
# Variables
42+
variable "project_id" {
43+
description = "GCP Project ID"
44+
type = string
45+
}
46+
47+
variable "region" {
48+
description = "GCP Region"
49+
type = string
50+
default = "us-central1"
51+
}
52+
53+
variable "zone" {
54+
description = "GCP Zone"
55+
type = string
56+
default = "us-central1-a"
57+
}
58+
59+
variable "instance_name" {
60+
description = "Name of the VM instance"
61+
type = string
62+
default = "test-vm-instance"
63+
}
64+
65+
variable "instance_type" {
66+
description = "Machine type for the instance"
67+
type = string
68+
default = "e2-medium"
69+
}
70+
71+
variable "vpc_network" {
72+
description = "VPC Network name"
73+
type = string
74+
default = "default"
75+
}
76+
77+
variable "subnet_name" {
78+
description = "Subnet name"
79+
type = string
80+
default = "default"
81+
}
82+
83+
84+
# Outputs
85+
output "instance_name" {
86+
description = "Name of the created instance"
87+
value = google_compute_instance.vm_instance.name
88+
}
89+
90+
output "instance_ip" {
91+
description = "Public IP address of the instance"
92+
value = google_compute_instance.vm_instance.network_interface[0].access_config[0].nat_ip
93+
}
94+
95+
output "instance_internal_ip" {
96+
description = "Internal IP address of the instance"
97+
value = google_compute_instance.vm_instance.network_interface[0].network_ip
98+
}

0 commit comments

Comments
 (0)