-
Notifications
You must be signed in to change notification settings - Fork 0
/
variables.network.tf
215 lines (207 loc) · 17.8 KB
/
variables.network.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
variable "network_interfaces" {
type = map(object({
name = string
ip_configurations = map(object({
name = string
app_gateway_backend_pools = optional(map(object({
app_gateway_backend_pool_resource_id = string
})), {})
create_public_ip_address = optional(bool, false)
gateway_load_balancer_frontend_ip_configuration_resource_id = optional(string)
is_primary_ipconfiguration = optional(bool, true)
load_balancer_backend_pools = optional(map(object({
load_balancer_backend_pool_resource_id = string
})), {})
load_balancer_nat_rules = optional(map(object({
load_balancer_nat_rule_resource_id = string
})), {})
private_ip_address = optional(string)
private_ip_address_allocation = optional(string, "Dynamic")
private_ip_address_version = optional(string, "IPv4")
private_ip_subnet_resource_id = optional(string)
public_ip_address_lock_name = optional(string)
public_ip_address_name = optional(string)
public_ip_address_resource_id = optional(string)
}))
accelerated_networking_enabled = optional(bool, true)
application_security_groups = optional(map(object({
application_security_group_resource_id = string
})), {})
diagnostic_settings = optional(map(object({
name = optional(string, null)
log_categories = optional(set(string), [])
log_groups = optional(set(string), [])
metric_categories = optional(set(string), ["AllMetrics"])
log_analytics_destination_type = optional(string, null)
workspace_resource_id = optional(string, null)
storage_account_resource_id = optional(string, null)
event_hub_authorization_rule_resource_id = optional(string, null)
event_hub_name = optional(string, null)
marketplace_partner_resource_id = optional(string, null)
})), {})
dns_servers = optional(list(string))
inherit_tags = optional(bool, true)
internal_dns_name_label = optional(string)
ip_forwarding_enabled = optional(bool, false)
lock_level = optional(string)
lock_name = optional(string)
network_security_groups = optional(map(object({
network_security_group_resource_id = string
})), {})
resource_group_name = optional(string)
role_assignments = optional(map(object({
principal_id = string
role_definition_id_or_name = string
assign_to_child_public_ip_addresses = optional(bool, true)
condition = optional(string, null)
condition_version = optional(string, null)
delegated_managed_identity_resource_id = optional(string, null)
description = optional(string, null)
skip_service_principal_aad_check = optional(bool, false)
principal_type = optional(string, null)
})), {})
tags = optional(map(string), null)
}))
description = <<NETWORK_INTERFACES
A map of objects representing each network virtual machine network interface
- `<map key>` - Use a custom map key to define each network interface
- `name` = (Required) The name of the Network Interface. Changing this forces a new resource to be created.
- `ip_configurations` - A required map of objects defining each interfaces IP configurations
- `<map key>` - Use a custom map key to define each ip configuration
- `name` = (Required) - A name used for this IP Configuration.
- `app_gateway_backend_pools` = (Optional) - A map defining app gateway backend pool(s) this IP configuration should be associated to.
- `<map key>` - Use a custom map key to define each app gateway backend pool association. This is done to handle issues with certain details not being known until after apply.
- `app_gateway_backend_pool_resource_id` = (Required) - An application gateway backend pool Azure Resource ID can be entered to join this ip configuration to the backend pool of an Application Gateway.
- `create_public_ip_address` = (Optional) - Select true here to have the module create the public IP address for this IP Configuration
- `gateway_load_balancer_frontend_ip_configuration_resource_id` = (Optional) - The Frontend IP Configuration Azure Resource ID of a Gateway SKU Load Balancer.)
- `is_primary_ipconfiguration` = (Optional) - Is this the Primary IP Configuration? Must be true for the first ip_configuration when multiple are specified.
- `load_balancer_backend_pools` = (Optional) - A map defining load balancer backend pool(s) this IP configuration should be associated to.
- `<map key>` - Use a custom map key to define each load balancer backend pool association. This is done to handle issues with certain details not being known until after apply.
- `load_balancer_backend_pool_resource_id` = (Required) - A Load Balancer backend pool Azure Resource ID can be entered to join this ip configuration to a load balancer backend pool.
- `load_balancer_nat_rules` = (Optional) - A map defining load balancer NAT rule(s) that this IP Configuration should be associated to.
- `<map key>` - Use a custom map key to define each load balancer NAT Rule association. This is done to handle issues with certain details not being known until after apply.
- `load_balancer_nat_rule_resource_id` = (Optional) - A Load Balancer Nat Rule Azure Resource ID can be entered to associate this ip configuration to a load balancer NAT rule.
- `private_ip_address` = (Optional) - The Static IP Address which should be used. Configured when private_ip_address_allocation is set to Static
- `private_ip_address_allocation` = (Optional) - The allocation method used for the Private IP Address. Possible values are Dynamic and Static. Dynamic means "An IP is automatically assigned during creation of this Network Interface" and is the default; Static means "User supplied IP address will be used"
- `private_ip_address_version` = (Optional) - The IP Version to use. Possible values are IPv4 or IPv6. Defaults to IPv4.
- `private_ip_subnet_resource_id` = (Optional) - The Azure Resource ID of the Subnet where this Network Interface should be located in.
- `public_ip_address_resource_id` = (Optional) - Reference to a Public IP Address resource ID to associate with this NIC
- `accelerated_networking_enabled` = (Optional) - Should Accelerated Networking be enabled? Defaults to true. Only certain Virtual Machine sizes are supported for Accelerated Networking. To use Accelerated Networking in an Availability Set, the Availability Set must be deployed onto an Accelerated Networking enabled cluster.
- `application_security_groups` = (Optional) - A map defining the Application Security Group(s) that this network interface should be a part of.
- `<map key>` - Use a custom map key to define each Application Security Group association. This is done to handle issues with certain details not being known until after apply.
- `application_security_group_resource_id` = (Required) - The Application Security Group (ASG) Azure Resource ID for this Network Interface to be associated to.
- `diagnostic_settings` = (Optional) - A map of objects defining the network interface resource diagnostic settings
- `<map key>` - Use a custom map key to define each diagnostic setting configuration
- `name` = (required) - Name to use for the Diagnostic setting configuration. Changing this creates a new resource
- `event_hub_authorization_rule_resource_id` = (Optional) - The Event Hub Namespace Authorization Rule Resource ID when sending logs or metrics to an Event Hub Namespace
- `event_hub_name` = (Optional) - The Event Hub name when sending logs or metrics to an Event Hub
- `log_analytics_destination_type` = (Optional) - Valid values are null, AzureDiagnostics, and Dedicated. Defaults to null
- `log_categories_and_groups` = (Optional) - List of strings used to define log categories and groups. Currently not valid for the VM resource
- `marketplace_partner_resource_id` = (Optional) - The marketplace partner solution Azure Resource ID when sending logs or metrics to a partner integration
- `metric_categories` = (Optional) - List of strings used to define metric categories. Currently only AllMetrics is valid
- `storage_account_resource_id` = (Optional) - The Storage Account Azure Resource ID when sending logs or metrics to a Storage Account
- `workspace_resource_id` = (Optional) - The Log Analytics Workspace Azure Resource ID when sending logs or metrics to a Log Analytics Workspace
- `dns_servers` = (Optional) - A list of IP Addresses defining the DNS Servers which should be used for this Network Interface.
- `inherit_tags` = (Optional) - Defaults to true. Set this to false if only the tags defined on this resource should be applied. This is potential future functionality and is currently ignored.
- `internal_dns_name_label` = (Optional) - The (relative) DNS Name used for internal communications between Virtual Machines in the same Virtual Network.
- `ip_forwarding_enabled` = (Optional) - Should IP Forwarding be enabled? Defaults to false
- `lock_level` = (Optional) - Set this value to override the resource level lock value. Possible values are `None`, `CanNotDelete`, and `ReadOnly`.
- `lock_name` = (Optional) - The name for the lock on this nic
- `network_security_groups` = (Optional) - A map describing Network Security Group(s) that this Network Interface should be associated to.
- `<map key>` - Use a custom map key to define each network security group association. This is done to handle issues with certain details not being known until after apply.
- `network_security_group_resource_id` = (Optional) - The Network Security Group (NSG) Azure Resource ID used to associate this Network Interface to the NSG.
- `resource_group_name` (Optional) - Specify a resource group name if the network interface should be created in a separate resource group from the virtual machine
- `role_assignments` = An optional map of objects defining role assignments on the individual network configuration resource
- `<map key>` - Use a custom map key to define each role assignment configuration
- `assign_to_child_public_ip_addresses` = (Optional) - Set this to true if the assignment should also apply to any children public IP addresses.
- `condition` = (Optional) - The condition that limits the resources that the role can be assigned to. Changing this forces a new resource to be created.
- `condition_version` = (Optional) - The version of the condition. Possible values are 1.0 or 2.0. Changing this forces a new resource to be created.
- `delegated_managed_identity_resource_id` = (Optional) - The delegated Azure Resource Id which contains a Managed Identity. Changing this forces a new resource to be created.
- `description` = (Optional) - The description for this Role Assignment. Changing this forces a new resource to be created.
- `principal_id` = (optional) - The ID of the Principal (User, Group or Service Principal) to assign the Role Definition to. Changing this forces a new resource to be created.
- `role_definition_id_or_name` = (Optional) - The Scoped-ID of the Role Definition or the built-in role name. Changing this forces a new resource to be created. Conflicts with role_definition_name
- `skip_service_principal_aad_check` = (Optional) - If the principal_id is a newly provisioned Service Principal set this value to true to skip the Azure Active Directory check which may fail due to replication lag. This argument is only valid if the principal_id is a Service Principal identity. Defaults to true.
- `principal_type` = (Optional) - The type of the `principal_id`. Possible values are `User`, `Group` and `ServicePrincipal`. It is necessary to explicitly set this attribute when creating role assignments if the principal creating the assignment is constrained by ABAC rules that filters on the PrincipalType attribute.
- `tags` = (Optional) - A mapping of tags to assign to the resource.
Example Inputs:
```hcl
#Simple private IP single NIC with IPV4 private address
network_interfaces = {
network_interface_1 = {
name = "testnic1"
ip_configurations = {
ip_configuration_1 = {
name = "testnic1-ipconfig1"
private_ip_subnet_resource_id = azurerm_subnet.this_subnet_1.id
}
}
}
}
#Simple NIC with private and public IP address
network_interfaces = {
network_interface_1 = {
name = "testnic1"
ip_configurations = {
ip_configuration_1 = {
name = "testnic1-ipconfig1"
private_ip_subnet_resource_id = azurerm_subnet.this_subnet_1.id
create_public_ip_address = true
public_ip_address_name = "vm1-testnic1-publicip1"
}
}
}
}
```
NETWORK_INTERFACES
nullable = false
}
variable "public_ip_configuration_details" {
type = object({
allocation_method = optional(string, "Static")
ddos_protection_mode = optional(string, "VirtualNetworkInherited")
ddos_protection_plan_id = optional(string)
domain_name_label = optional(string)
idle_timeout_in_minutes = optional(number, 30)
inherit_tags = optional(bool, false)
ip_version = optional(string, "IPv4")
lock_level = optional(string, null)
sku = optional(string, "Standard")
sku_tier = optional(string, "Regional")
tags = optional(map(string), null)
})
default = {
allocation_method = "Static"
ddos_protection_mode = "VirtualNetworkInherited"
idle_timeout_in_minutes = 30
ip_version = "IPv4"
sku_tier = "Regional"
sku = "Standard"
}
description = <<PUBLIC_IP_CONFIGURATION_DETAILS
This object describes the public IP configuration when creating VM's with a public IP. If creating more than one public IP, then these values will be used for all public IPs.
- `allocation_method` = (Required) - Defines the allocation method for this IP address. Possible values are Static or Dynamic.
- `ddos_protection_mode` = (Optional) - The DDoS protection mode of the public IP. Possible values are Disabled, Enabled, and VirtualNetworkInherited. Defaults to VirtualNetworkInherited.
- `ddos_protection_plan_id` = (Optional) - The ID of DDoS protection plan associated with the public IP. ddos_protection_plan_id can only be set when ddos_protection_mode is Enabled
- `domain_name_label` = (Optional) - Label for the Domain Name. Will be used to make up the FQDN. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system.
- `idle_timeout_in_minutes` = (Optional) - Specifies the timeout for the TCP idle connection. The value can be set between 4 and 30 minutes.
- `inherit_tags` = (Optional) - Defaults to false. Set this to false if only the tags defined on this resource should be applied. - Future functionality leaving in.
- `ip_version` = (Optional) - The IP Version to use, IPv6 or IPv4. Changing this forces a new resource to be created. Only static IP address allocation is supported for IPv6.
- `lock_level` = (Optional) - Set this value to override the resource level lock value. Possible values are `None`, `CanNotDelete`, and `ReadOnly`.
- `sku` = (Optional) - The SKU of the Public IP. Accepted values are Basic and Standard. Defaults to Standard to support zones by default. Changing this forces a new resource to be created. When sku_tier is set to Global, sku must be set to Standard.
- `sku_tier` = (Optional) - The SKU tier of the Public IP. Accepted values are Global and Regional. Defaults to Regional
- `tags` = (Optional) - A mapping of tags to assign to the resource.
Example Inputs:
```hcl
#Standard Regional IPV4 Public IP address configuration
public_ip_configuration_details = {
allocation_method = "Static"
ddos_protection_mode = "VirtualNetworkInherited"
idle_timeout_in_minutes = 30
ip_version = "IPv4"
sku_tier = "Regional"
sku = "Standard"
}
```
PUBLIC_IP_CONFIGURATION_DETAILS
nullable = false
}