forked from Azure/terraform-azurerm-network-security-group
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathmain.tf
58 lines (53 loc) · 5.79 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
data "azurerm_resource_group" "nsg" {
name = var.resource_group_name
}
resource "azurerm_network_security_group" "nsg" {
name = var.security_group_name
location = var.location != "" ? var.location : data.azurerm_resource_group.nsg.location
resource_group_name = data.azurerm_resource_group.nsg.name
tags = var.tags
}
#############################
# Simple security rules #
#############################
resource "azurerm_network_security_rule" "predefined_rules" {
count = length(var.predefined_rules)
name = lookup(var.predefined_rules[count.index], "name")
priority = lookup(var.predefined_rules[count.index], "priority", 4096 - length(var.predefined_rules) + count.index)
direction = element(var.rules[lookup(var.predefined_rules[count.index], "name")], 0)
access = element(var.rules[lookup(var.predefined_rules[count.index], "name")], 1)
protocol = element(var.rules[lookup(var.predefined_rules[count.index], "name")], 2)
source_port_ranges = split(",", replace(lookup(var.predefined_rules[count.index], "source_port_range", "*"), "*", "0-65535"))
destination_port_range = element(var.rules[lookup(var.predefined_rules[count.index], "name")], 4)
description = element(var.rules[lookup(var.predefined_rules[count.index], "name")], 5)
source_address_prefix = length(lookup(var.predefined_rules[count.index], "source_application_security_group_ids", [])) == 0 && length(lookup(var.predefined_rules[count.index], "source_address_prefixes", [])) == 0 ? lookup(var.predefined_rules[count.index], "source_address_prefix", "*") : null
destination_address_prefix = length(lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", [])) == 0 && length(lookup(var.predefined_rules[count.index], "destination_address_prefixes", [])) == 0 ? lookup(var.predefined_rules[count.index], "destination_address_prefix", "*") : null
source_address_prefixes = length(lookup(var.predefined_rules[count.index], "source_application_security_group_ids", [])) == 0 ? lookup(var.predefined_rules[count.index], "source_address_prefixes", null) : null
destination_address_prefixes = length(lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", [])) == 0 ? lookup(var.predefined_rules[count.index], "destination_address_prefixes", null) : null
resource_group_name = data.azurerm_resource_group.nsg.name
network_security_group_name = azurerm_network_security_group.nsg.name
source_application_security_group_ids = lookup(var.predefined_rules[count.index], "source_application_security_group_ids", null)
destination_application_security_group_ids = lookup(var.predefined_rules[count.index], "destination_application_security_group_ids", null)
}
#############################
# Detailed security rules #
#############################
resource "azurerm_network_security_rule" "custom_rules" {
count = length(var.custom_rules)
name = lookup(var.custom_rules[count.index], "name", "default_rule_name")
priority = lookup(var.custom_rules[count.index], "priority")
direction = lookup(var.custom_rules[count.index], "direction", "Any")
access = lookup(var.custom_rules[count.index], "access", "Allow")
protocol = lookup(var.custom_rules[count.index], "protocol", "*")
source_port_ranges = split(",", replace(lookup(var.custom_rules[count.index], "source_port_range", "*"), "*", "0-65535"))
destination_port_ranges = split(",", replace(lookup(var.custom_rules[count.index], "destination_port_range", "*"), "*", "0-65535"))
source_address_prefix = length(lookup(var.custom_rules[count.index], "source_application_security_group_ids", [])) == 0 && length(lookup(var.custom_rules[count.index], "source_address_prefixes", [])) == 0 ? lookup(var.custom_rules[count.index], "source_address_prefix", "*") : null
destination_address_prefix = length(lookup(var.custom_rules[count.index], "destination_application_security_group_ids", [])) == 0 && length(lookup(var.custom_rules[count.index], "destination_address_prefixes", [])) == 0 ? lookup(var.custom_rules[count.index], "destination_address_prefix", "*") : null
source_address_prefixes = length(lookup(var.custom_rules[count.index], "source_application_security_group_ids", [])) == 0 ? lookup(var.custom_rules[count.index], "source_address_prefixes", null) : null
destination_address_prefixes = length(lookup(var.custom_rules[count.index], "destination_application_security_group_ids", [])) == 0 ? lookup(var.custom_rules[count.index], "destination_address_prefixes", null) : null
description = lookup(var.custom_rules[count.index], "description", "Security rule for ${lookup(var.custom_rules[count.index], "name", "default_rule_name")}")
resource_group_name = data.azurerm_resource_group.nsg.name
network_security_group_name = azurerm_network_security_group.nsg.name
source_application_security_group_ids = lookup(var.custom_rules[count.index], "source_application_security_group_ids", null)
destination_application_security_group_ids = lookup(var.custom_rules[count.index], "destination_application_security_group_ids", null)
}