From 64a67a4981037817165ec483e40ab3241a6ff89d Mon Sep 17 00:00:00 2001 From: Sebastian Czech Date: Tue, 6 Feb 2024 14:22:39 +0100 Subject: [PATCH] Fix EBS encrypted setting in Panorama example --- examples/panorama_standalone/README.md | 2 +- examples/panorama_standalone/example.tfvars | 3 +-- examples/panorama_standalone/main.tf | 3 ++- examples/panorama_standalone/variables.tf | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/examples/panorama_standalone/README.md b/examples/panorama_standalone/README.md index 89ccdf5..92b4994 100644 --- a/examples/panorama_standalone/README.md +++ b/examples/panorama_standalone/README.md @@ -96,7 +96,7 @@ Use a web browser to access https://x.x.x.x and login with admin and your previo |------|-------------|------|---------|:--------:| | [global\_tags](#input\_global\_tags) | Global tags configured for all provisioned resources | `map(any)` | `{}` | no | | [name\_prefix](#input\_name\_prefix) | Prefix used in names for the resources (VPCs, EC2 instances, autoscaling groups etc.) | `string` | `""` | no | -| [panoramas](#input\_panoramas) | A map defining Panorama instances

Following properties are available:
- `instances`: map of Panorama instances with attributes:
- `az`: name of the Availability Zone
- `private_ip_address`: private IP address for management interface
- `panos_version`: PAN-OS version used for Panorama
- `network`: definition of network settings in object with attributes:
- `vpc`: name of the VPC (needs to be one of the keys in map `vpcs`)
- `vpc_subnet`: key of the VPC and subnet connected by '-' character
- `security_group`: security group assigned to ENI used by Panorama
- `create_public_ip`: true, if public IP address for management should be created
- `ebs`: EBS settings defined in object with attributes:
- `volumes`: list of EBS volumes attached to each instance
- `kms_key_alias`: KMS key alias used for encrypting Panorama EBS
- `iam`: IAM settings in object with attrbiutes:
- `create_role`: enable creation of IAM role
- `role_name`: name of the role to create or use existing one
- `enable_imdsv2`: whether to enable IMDSv2 on the EC2 instance

Example:
{
  panorama_ha_pair = {
    instances = {
      "primary" = {
        az                 = "eu-central-1a"
        private_ip_address = "10.255.0.4"
      }
      "secondary" = {
        az                 = "eu-central-1b"
        private_ip_address = "10.255.1.4"
      }
    }

    panos_version = "10.2.3"

    network = {
      vpc              = "management_vpc"
      vpc_subnet       = "management_vpc-mgmt"
      security_group   = "panorama_mgmt"
      create_public_ip = true
    }

    ebs = {
      volumes = [
        {
          name            = "ebs-1"
          ebs_device_name = "/dev/sdb"
          ebs_size        = "2000"
          ebs_encrypted   = true
        },
        {
          name            = "ebs-2"
          ebs_device_name = "/dev/sdc"
          ebs_size        = "2000"
          ebs_encrypted   = true
        }
      ]
      kms_key_alias = "aws/ebs"
    }

    iam = {
      create_role = true
      role_name   = "panorama"
    }

    enable_imdsv2 = false
  }
}
| 
map(object({
    instances = map(object({
      az                 = string
      private_ip_address = string
    }))

    panos_version = string

    network = object({
      vpc              = string
      vpc_subnet       = string
      security_group   = string
      create_public_ip = bool
    })

    ebs = object({
      volumes = list(object({
        name            = string
        ebs_device_name = string
        ebs_size        = string
        ebs_encrypted   = bool
      }))
      kms_key_alias = string
    })

    iam = object({
      create_role = bool
      role_name   = string
    })

    enable_imdsv2 = bool
  }))
| `{}` | no | +| [panoramas](#input\_panoramas) | A map defining Panorama instances

Following properties are available:
- `instances`: map of Panorama instances with attributes:
- `az`: name of the Availability Zone
- `private_ip_address`: private IP address for management interface
- `panos_version`: PAN-OS version used for Panorama
- `network`: definition of network settings in object with attributes:
- `vpc`: name of the VPC (needs to be one of the keys in map `vpcs`)
- `vpc_subnet`: key of the VPC and subnet connected by '-' character
- `security_group`: security group assigned to ENI used by Panorama
- `create_public_ip`: true, if public IP address for management should be created
- `ebs`: EBS settings defined in object with attributes:
- `volumes`: list of EBS volumes attached to each instance
- `kms_key_alias`: KMS key alias used for encrypting Panorama EBS
- `iam`: IAM settings in object with attrbiutes:
- `create_role`: enable creation of IAM role
- `role_name`: name of the role to create or use existing one
- `enable_imdsv2`: whether to enable IMDSv2 on the EC2 instance

Example:
{
  panorama_ha_pair = {
    instances = {
      "primary" = {
        az                 = "eu-central-1a"
        private_ip_address = "10.255.0.4"
      }
      "secondary" = {
        az                 = "eu-central-1b"
        private_ip_address = "10.255.1.4"
      }
    }

    panos_version = "10.2.3"

    network = {
      vpc              = "management_vpc"
      vpc_subnet       = "management_vpc-mgmt"
      security_group   = "panorama_mgmt"
      create_public_ip = true
    }

    ebs = {
      volumes = [
        {
          name            = "ebs-1"
          ebs_device_name = "/dev/sdb"
          ebs_size        = "2000"
          ebs_encrypted   = true
        },
        {
          name            = "ebs-2"
          ebs_device_name = "/dev/sdc"
          ebs_size        = "2000"
          ebs_encrypted   = true
        }
      ]
      kms_key_alias = "aws/ebs"
    }

    iam = {
      create_role = true
      role_name   = "panorama"
    }

    enable_imdsv2 = false
  }
}
| 
map(object({
    instances = map(object({
      az                 = string
      private_ip_address = string
    }))

    panos_version = string

    network = object({
      vpc              = string
      vpc_subnet       = string
      security_group   = string
      create_public_ip = bool
    })

    ebs = object({
      volumes = list(object({
        name            = string
        ebs_device_name = string
        ebs_size        = string
      }))
      encrypted     = bool
      kms_key_alias = string
    })

    iam = object({
      create_role = bool
      role_name   = string
    })

    enable_imdsv2 = bool
  }))
| `{}` | no | | [region](#input\_region) | AWS region used to deploy whole infrastructure | `string` | n/a | yes | | [ssh\_key\_name](#input\_ssh\_key\_name) | Name of the SSH key pair existing in AWS key pairs and used to authenticate to VM-Series or test boxes | `string` | n/a | yes | | [vpcs](#input\_vpcs) | A map defining VPCs with security groups and subnets.

Following properties are available:
- `name`: VPC name
- `cidr`: CIDR for VPC
- `security_groups`: map of security groups
- `subnets`: map of subnets with properties:
- `az`: availability zone
- `set`: internal identifier referenced by main.tf
- `routes`: map of routes with properties:
- `vpc_subnet`: built from key of VPCs concatenate with `-` and key of subnet in format: `VPCKEY-SUBNETKEY`
- `to_cidr`: destination IP range
- `next_hop_key`: must match keys use to create TGW attachment, IGW, GWLB endpoint or other resources
- `next_hop_type`: internet\_gateway, nat\_gateway, transit\_gateway\_attachment or gwlbe\_endpoint

Example:
{
  security_vpc = {
    name = "security-vpc"
    cidr = "10.100.0.0/16"
    security_groups = {
      panorama_mgmt = {
        name = "panorama_mgmt"
        rules = {
          all_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from_port = "0", to_port = "0", protocol = "-1"
            cidr_blocks = ["0.0.0.0/0"]
          }
          https = {
            description = "Permit HTTPS"
            type        = "ingress", from_port = "443", to_port = "443", protocol = "tcp"
            cidr_blocks = ["130.41.247.0/24"]
          }
          ssh = {
            description = "Permit SSH"
            type        = "ingress", from_port = "22", to_port = "22", protocol = "tcp"
            cidr_blocks = ["130.41.247.0/24"]
          }
        }
      }
    }
    subnets = {
      "10.100.0.0/24"  = { az = "eu-central-1a", set = "mgmt" }
      "10.100.64.0/24" = { az = "eu-central-1b", set = "mgmt" }
    }
    routes = {
      mgmt_default = {
        vpc_subnet    = "security_vpc-mgmt"
        to_cidr       = "0.0.0.0/0"
        next_hop_key  = "security_vpc"
        next_hop_type = "internet_gateway"
      }
    }
  }
}
| 
map(object({
    name            = string
    cidr            = string
    security_groups = any
    subnets = map(object({
      az  = string
      set = string
    }))
    routes = map(object({
      vpc_subnet    = string
      to_cidr       = string
      next_hop_key  = string
      next_hop_type = string
    }))
  }))
| `{}` | no | diff --git a/examples/panorama_standalone/example.tfvars b/examples/panorama_standalone/example.tfvars index 0ea17b1..b11ea35 100644 --- a/examples/panorama_standalone/example.tfvars +++ b/examples/panorama_standalone/example.tfvars @@ -86,15 +86,14 @@ panoramas = { name = "ebs-1" ebs_device_name = "/dev/sdb" ebs_size = "2000" - ebs_encrypted = true }, { name = "ebs-2" ebs_device_name = "/dev/sdc" ebs_size = "2000" - ebs_encrypted = true } ] + encrypted = true kms_key_alias = "aws/ebs" } diff --git a/examples/panorama_standalone/main.tf b/examples/panorama_standalone/main.tf index 7937cbd..2482ab1 100644 --- a/examples/panorama_standalone/main.tf +++ b/examples/panorama_standalone/main.tf @@ -141,7 +141,7 @@ data "aws_ebs_default_kms_key" "this" { } data "aws_kms_alias" "this" { - for_each = { for panorama in local.panorama_instances : "${panorama.group}-${panorama.instance}" => panorama if anytrue([for ebs in panorama.common.ebs.volumes : ebs.ebs_encrypted]) } + for_each = { for panorama in local.panorama_instances : "${panorama.group}-${panorama.instance}" => panorama if panorama.common.ebs.encrypted } name = each.value.common.ebs.kms_key_alias != null ? "alias/${each.value.common.ebs.kms_key_alias}" : data.aws_ebs_default_kms_key.this.key_arn } @@ -167,6 +167,7 @@ module "panorama" { create_public_ip = each.value.common.network.create_public_ip private_ip_address = each.value.private_ip_address ebs_volumes = each.value.common.ebs.volumes + ebs_encrypted = each.value.common.ebs.encrypted panorama_version = each.value.common.panos_version ssh_key_name = var.ssh_key_name ebs_kms_key_alias = try(data.aws_kms_alias.this[each.key].target_key_arn, null) diff --git a/examples/panorama_standalone/variables.tf b/examples/panorama_standalone/variables.tf index 1d0b3bb..5ad11a4 100644 --- a/examples/panorama_standalone/variables.tf +++ b/examples/panorama_standalone/variables.tf @@ -194,8 +194,8 @@ variable "panoramas" { name = string ebs_device_name = string ebs_size = string - ebs_encrypted = bool })) + encrypted = bool kms_key_alias = string })