terraform-google-modules/terraform-google-network

The fabric-net-firewall module creates a minimal VPC firewall setup. It supports several types of rules:

1. Intra-VPC Rules: Configurable IP range-based rules for internal traffic. By default, it only allows icmp.
2. Administrator Ingress: Rules allowing complete access from specific admin CIDR ranges.
3. Tag-based Ingress: Pre-configured rules for common services using network tags:
   • SSH: Uses the ssh tag by default.
   • HTTP: Uses the http-server tag by default.
   • HTTPS: Uses the https-server tag by default.
4. Custom Rules: User-defined ingress or egress rules using a map of rule objects.

All IP source ranges for tag-based rules default to 0.0.0.0/0 unless specified otherwise.

module "net-firewall" {
  source                  = "terraform-google-modules/network/google//modules/fabric-net-firewall"
  project_id              = "my-project"
  network                 = "my-vpc"
  internal_ranges_enabled = true
  internal_ranges         = ["10.0.0.0/0"]
  internal_target_tags    = ["internal"]
  custom_rules = {
    ingress-sample = {
      description          = "Dummy sample ingress rule, tag-based."
      direction            = "INGRESS"
      action               = "allow"
      ranges               = ["192.168.0.0"]
      sources              = ["spam-tag"]
      targets              = ["foo-tag", "egg-tag"]
      use_service_accounts = false
      rules = [
        {
          protocol = "tcp"
          ports    = []
        }
      ]
      extra_attributes = {}
    }
  }
}

This module configures service project access to a Shared VPC host project. It automates two primary tasks:

1. Attaching Service Projects: It uses the google_compute_shared_vpc_service_project resource to attach specified service projects to the host project.
2. Assigning Subnet IAM Roles: It uses google_compute_subnetwork_iam_binding to grant specific IAM roles for individual subnets within the host project.

This is useful for managing how service projects interact with the network infrastructure provided by a host project.

module "net-shared-vpc-access" {
  source              = "terraform-google-modules/network/google//modules/fabric-net-svpc-access"
  version             = "~> 11.0"

  host_project_id     = "my-host-project-id"
  service_project_num = 1
  service_project_ids = ["my-service-project-id"]
  host_subnets        = ["my-subnet"]
  host_subnet_regions = ["europe-west1"]
  host_subnet_users   = {
    my-subnet = "group:my-service-owners@example.org,serviceAccount:1234567890@cloudservices.gserviceaccount.com"
  }
  host_service_agent_role = true
  host_service_agent_users = [
    "serviceAccount:service-123456789@container-engine-robot.iam.gserviceaccount.com"
  ]
}

This module manages Google Cloud Global and Regional Network Firewall Policies and their associated Rules.

Key Behaviors:

• Policy Scope: If policy_region is provided, a Regional policy is created. If policy_region is omitted (null), a Global policy is created.
• Tier Support: Supports both Cloud Firewall Essentials and Cloud Firewall Standard tier rules.
• VPC Attachment: You can optionally attach the policy to multiple VPCs using the target_vpcs argument.
• Rule Attachment: Firewall rules and VPC attachments are optional components.

module "network_firewall_policy" {
  source       = "terraform-google-modules/network/google//modules/network-firewall-policy"
  version      = "~> 11.0"
  project_id   = var.project_id
  policy_name  = "my-firewall-policy"
  description  = "Test firewall policy"
  target_vpcs  = [var.vpc1_id, var.vpc2_id]

  rules = [
    {},
    {},
  ]
}

Rules are defined as a list of objects passed to the rules input. Each rule specifies an action (allow or deny) and a direction (INGRESS or EGRESS).

Key Rule Components:

• priority: A unique positive integer between 0 and 2147483647.
• target_resources: A list of network resource URLs. If empty, the rule applies to all VMs in the organization.
• target_service_accounts: A list of service account URLs. If empty, the rule applies to all VMs in the organization.
• match: A block defining the traffic criteria:
  • For INGRESS rules: Use src_ip_ranges, src_fqdns, src_region_codes, src_threat_intelligences, and src_address_groups. Note that dest_* fields are ignored for Ingress.
  • For EGRESS rules: Use dest_ip_ranges, dest_fqdns, dest_region_codes, dest_threat_intelligences, and dest_address_groups. Note that src_* fields are ignored for Egress.
  • layer4_configs: A list of maps specifying ip_protocol (e.g., tcp, udp, icmp, esp, ah, ipip, sctp, or a protocol number) and an optional list of ports (integers or ranges like 8081-8085).

rules = [
  {
    priority                = 1
    direction               = "INGRESS"
    action                  = "allow"
    rule_name               = "my-test-rule"
    description             = "My test firewall policy"
    enable_logging          = true
    target_service_accounts = ["service-account@project.iam.gserviceaccount.com"]
    match = {
      src_ip_ranges = ["10.0.0.0/24"]
      layer4_configs = [
        {
          ip_protocol = "tcp"
          ports       = ["80", "443"]
        },
      ]
    }
  }
]

When creating multiple peering connections for the same VPC Network (e.g., Network A peering to both Network B and Network C), you must ensure they are created sequentially. It is not possible to create more than one peering connection for a VPC Network simultaneously.

To enforce this order, use the module_depends_on argument to make subsequent peering modules depend on the complete output of the previous peering module.

module "peering-a-b" {
  source = "terraform-google-modules/network/google//modules/network-peering"

  prefix        = "name-prefix"
  local_network = "<A NETWORK SELF LINK>"
  peer_network  = "<B NETWORK SELF LINK>"
}

module "peering-a-c" {
  source = "terraform-google-modules/network/google//modules/network-peering"

  prefix        = "name-prefix"
  local_network = "<A NETWORK SELF LINK>"
  peer_network  = "<C NETWORK SELF LINK>"

  module_depends_on = [module.peering-a-b.complete]
}

Rules are defined within the rules list. Each rule object follows a specific schema and logic:

Core Rule Attributes

• priority: A unique positive integer between 0 and 2147483647.
• direction: Either INGRESS or EGRESS.
• action: Valid actions include allow, deny, goto_next, apply_security_profile_group, mirror, and do_not_mirror.
  • Note: mirror and do_not_mirror require is_mirroring = true.
• rule_name: Optional name for the rule.
• disabled: Optional boolean to disable the rule.
• enable_logging: Optional boolean to enable logging.
• target_secure_tags vs target_service_accounts: You cannot set both. Providing both will result in an error.

Match Criteria Logic

• For INGRESS policies: dest_fqdns, dest_region_codes, dest_threat_intelligences, and dest_address_groups are ignored.
• For EGRESS policies: src_fqdns, src_region_codes, src_threat_intelligences, and src_address_groups are ignored.

Layer 4 Configuration

layer4_configs is a list of objects used to specify protocols and ports:

• ip_protocol: Required. Can be a well-known string (tcp, udp, icmp, esp, ah, ipip, sctp) or an IP protocol number. Defaults to all.
• ports: Optional list of strings (integers or ranges like 8081-8085). Only applicable for UDP or TCP protocols.

{
  priority                = 1
  direction               = "INGRESS"
  action                  = "allow"
  rule_name               = "my-test-policy"
  disabled                = false
  description             = "My test firewall policy"
  enable_logging          = true
  target_secure_tags      = ["tagValues/${google_tags_tag_value.tag_value.name}"]
  target_service_accounts = ["fw-test-svc-acct@$my-project-id.iam.gserviceaccount.com"]
  match = {
    src_ip_ranges             = ["10.100.0.2"]
    src_fqdns                 = []
    src_region_codes          = []
    src_secure_tags           = []
    src_address_groups        = []
    dest_ip_ranges            = ["10.100.100.2"]
    dest_fqdns                = []
    dest_region_codes         = []
    dest_threat_intelligences = []
    dest_address_groups       = []
    layer4_configs = [
      {
        ip_protocol = "tcp"
        ports       = ["80", "8080", "8081-8085"]
      },
    ]
  }
  is_mirroring = false
  tls_inspect = null
  security_profile_group_id = null
}