Azure Network

Source code & Installation

The source code of this kit module can be found here

Run the following command to install the kit module:

collie kit import azure/networking

The Azure Network Kit defines the networking components within the Azure cloud environment. This infrastructure is designed to facilitate communication between various resources, whether they are within the same virtual network, on-premise, or on the internet.

Requirements

Name	Version
terraform	>= 1.0
azuread	~> 2.41.0
azurerm	~> 3.85.0

Modules

No modules.

Resources

Name	Type
azuread_group.network_admins	resource
azurerm_firewall.fw	resource
azurerm_firewall_application_rule_collection.fw	resource
azurerm_firewall_nat_rule_collection.fw	resource
azurerm_firewall_network_rule_collection.fw	resource
azurerm_management_group_subscription_association.vnet	resource
azurerm_monitor_diagnostic_setting.fw	resource
azurerm_monitor_diagnostic_setting.fw_pip	resource
azurerm_monitor_diagnostic_setting.mgmt	resource
azurerm_monitor_diagnostic_setting.vnet	resource
azurerm_network_ddos_protection_plan.hub	resource
azurerm_network_security_group.mgmt	resource
azurerm_network_security_rule.mgmt	resource
azurerm_network_watcher.netwatcher	resource
azurerm_network_watcher_flow_log.mgmt_logs	resource
azurerm_public_ip.fw	resource
azurerm_public_ip.fw_mgmt	resource
azurerm_public_ip_prefix.fw	resource
azurerm_resource_group.hub_resource_group	resource
azurerm_resource_group.netwatcher	resource
azurerm_role_assignment.cloudfoundation_tfdeploy	resource
azurerm_role_assignment.network_admins	resource
azurerm_role_assignment.network_admins_connectivity	resource
azurerm_role_assignment.network_admins_dns	resource
azurerm_role_assignment.network_admins_landingzone	resource
azurerm_role_definition.cloudfoundation_tfdeploy	resource
azurerm_route.fw	resource
azurerm_route_table.out	resource
azurerm_storage_account.flowlogs	resource
azurerm_storage_container.flowlogs	resource
azurerm_subnet.firewall	resource
azurerm_subnet.firewallmgmt	resource
azurerm_subnet.gateway	resource
azurerm_subnet.mgmt	resource
azurerm_subnet_network_security_group_association.mgmt	resource
azurerm_subnet_route_table_association.mgmt	resource
azurerm_virtual_network.hub_network	resource
random_string.dns	resource
random_string.resource_code	resource
terraform_data.subscription_name	resource
azurerm_monitor_diagnostic_categories.fw	data source
azurerm_monitor_diagnostic_categories.fw_pip	data source
azurerm_monitor_diagnostic_categories.hub	data source
azurerm_monitor_diagnostic_categories.mgmt	data source
azurerm_subscription.current	data source

Inputs

Name	Description	Type	Default	Required
address_space	List of address spaces for virtual networks	string	n/a	yes
cloudfoundation	Name of your cloud foundation	string	n/a	yes
cloudfoundation_deploy_principal_id	Principal ID authorized for deploying Cloud Foundation resources	string	n/a	yes
connectivity_scope	Identifier for the management group connectivity	string	n/a	yes
create_ddos_plan	Create a DDos protection plan and attach it to the virtual network.	bool	false	no
deploy_firewall	Toggle to deploy or bypass the firewall.	bool	false	no
diagnostics	Diagnostic settings for supporting resources. Refer to README.md for configuration details.	object({ destination = string logs = list(string) metrics = list(string) })	null	no
firewall_application_rules	List of application rules to apply to the firewall.	list(object({ name = string action = string source_addresses = list(string) target_fqdns = list(string) protocol = object({ type = string port = string }) }))	[]	no
firewall_nat_rules	List of NAT rules to apply to the firewall.	list(object({ name = string action = string source_addresses = list(string) destination_ports = list(string) destination_addresses = list(string) protocols = list(string) translated_address = string translated_port = string }))	[]	no
firewall_network_rules	List of network rules to apply to the firewall.	list(object({ name = string action = string source_addresses = list(string) destination_ports = list(string) destination_addresses = list(string) protocols = list(string) }))	[]	no
firewall_sku_tier	Specify the tier for the firewall, choosing from options like Basic or Standard, Premium.	string	"Basic"	no
firewall_zones	Collection of availability zones to distribute the Firewall across.	list(string)	null	no
hub_networking_deploy	Service Principal responsible for deploying the central hub networking	string	"cloudfoundation_hub_network_deploy_user"	no
hub_resource_group	Name of the central hub resource group	string	"hub-vnet-rg"	no
hub_subscription_name	Name of your hub subscription	string	"hub"	no
hub_vnet_name	Name of the central virtual network	string	"hub-vnet"	no
landingzone_scope	Identifier for the management group landinzone	string	n/a	yes
location	Region for resource deployment	string	n/a	yes
lz_networking_deploy	Service Principal responsible for deploying the landing zone networking	string	"cloudfoundation_lz_network_deploy_user"	no
management_nsg_rules	Network security rules to add to the management subnet. Refer to README for setup details.	list(any)	[]	no
netwatcher	Properties for creating network watcher. If set, it creates a Network Watcher resource using standard naming conventions.	object({ log_analytics_workspace_id = string log_analytics_workspace_id_short = string log_analytics_resource_id = string })	null	no
network_admin_group	Name of the Cloud Foundation network administration group	string	"cloudfoundation-network-admins"	no
public_ip_names	List of public IP names connected to the firewall. At least one is required.	list(string)	[ "fw-public" ]	no
public_ip_prefix_length	Specifies the number of bits in the prefix. Value can be set between 24 (256 addresses) and 31 (2 addresses).	number	30	no
service_endpoints	Service endpoints to add to the firewall subnet.	list(string)	[ "Microsoft.AzureActiveDirectory", "Microsoft.AzureCosmosDB", "Microsoft.EventHub", "Microsoft.KeyVault", "Microsoft.ServiceBus", "Microsoft.Sql", "Microsoft.Storage" ]	no
threat_intel_mode	Operation mode for threat intelligence-based filtering. Possible values: Off, Alert, Deny, and "" (empty string).	string	"Off"	no

Outputs

Name	Description
documentation_md	n/a
firewall_name	Hub VNet firewall name
hub_location	Location of hub vnet
hub_rg	Hub Resource Group name
hub_subscription	Subscription of hub vnet
hub_vnet	Hub VNet name
hub_vnet_id	Hub VNet id
network_admins_azuread_group_id	n/a