Skip to content

Latest commit

 

History

History
93 lines (75 loc) · 6.1 KB

README.md

File metadata and controls

93 lines (75 loc) · 6.1 KB

terraform-aws-firewall

Terraform module to create an AWS firewall

Usage

module "firewall" {
  name        = "my-firewall"
  description = "my firewall for this vpc"

  # Cannot use vpc dependency as vpc will also depend on this
  subnet_ids = [
   "subnet-1a",
   "subnet-1b",
   "subnet-1c"
  ]

  vpc_id = "vpc-xx"

  # the key name will be used in sid, only accept numeric :*
  blocked_ips = {
    "30092021": [
      "277.333.444.555/32", "333.444.555.666/32"
    ]
  }

  blocked_domains = {
    "my-blocked-domain-list": [
      "example.com"
    ]
  }
}

Requirements

Name Version
terraform >= 0.13

Providers

Name Version
aws n/a
random n/a

Modules

No modules.

Resources

Name Type
aws_cloudwatch_log_group.main resource
aws_kms_alias.main resource
aws_kms_key.main resource
aws_networkfirewall_firewall.main resource
aws_networkfirewall_firewall_policy.main resource
aws_networkfirewall_logging_configuration.main resource
aws_networkfirewall_rule_group.allow-ips resource
aws_networkfirewall_rule_group.block-domains resource
aws_networkfirewall_rule_group.block-everything resource
aws_networkfirewall_rule_group.block-ips resource
random_id.sid resource
aws_caller_identity.current data source

Inputs

Name Description Type Default Required
allowed_ips IPs to allow (both ingress & egress), note that keys can only be numeric, and maximum capacity across all rules is 30000 
map(object({
    capacity = number
    ips      = list(string)
  }))
 {} no
aws_region Region which resources will be created in string "ap-southeast-1" no
block_everything_capacity Number of rules this rule group will contain number 25 no
blocked_domains Domains to block (both ingress & egress), maximum capacity across all rules is 30000 
map(object({
    capacity = number
    domains  = list(string)
  }))
 {} no
blocked_ips Block all traffic from/to specific IPs, note that keys can only be numeric, and maximum capacity across all rules is 30000 
map(object({
    capacity = number
    ips      = list(string)
  }))
 {} no
cloudwatch_log_retention_in_days Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653, and 0. If you select 0, the events in the log group are always retained and never expire. number 180 no
create_network_firewall toggle for creation of network firewall, set to false if you only want to create the firewall policy with this module bool true no
egress_allowed_ips Destination IPs to allow for outgoing, note that keys can only be numeric, and maximum capacity across all rules is 30000 
map(object({
    capacity = number
    ips      = list(string)
  }))
 {} no
enable_block_everything_by_default Creates rule that will block all traffic by default, and you will have to whitelist routes specifically to allow internet traffic bool false no
name The name of the network firewall string n/a yes
subnet_ids Subnets used to create network firewall. set(string) [] no
tags A map of tags to add to all resources map(any) {} no
vpc_id n/a string "" no
delete_protection n/a bool true no

Outputs

Name Description
firewall n/a
firewall_policy_arn n/a