terraform-azurerm-hubnetworking
所属分类：其他
开发工具：HCL
文件大小：0KB
下载次数：0
上传日期：2023-10-20 11:00:23
上 传 者：
sh-1993
说明： 用于部署多中心辐射架构的地形验证模块，
(Terraform verified module for deploying multi-hub & spoke architectures,)
文件列表:
.devcontainer/ (0, 2023-10-20)
.devcontainer/devcontainer.json (549, 2023-10-20)
.terraform-docs.yml (1209, 2023-10-20)
CHANGELOG.md (3488, 2023-10-20)
CODE_OF_CONDUCT.md (444, 2023-10-20)
GNUmakefile (271, 2023-10-20)
LICENSE (1141, 2023-10-20)
SECURITY.md (2757, 2023-10-20)
SUPPORT.md (1219, 2023-10-20)
_footer.md (3283, 2023-10-20)
_header.md (1758, 2023-10-20)
examples/ (0, 2023-10-20)
examples/startup/ (0, 2023-10-20)
examples/startup/TestRecord.md (3961, 2023-10-20)
examples/startup/main.spoke1.tf (3906, 2023-10-20)
examples/startup/main.spoke2.tf (4261, 2023-10-20)
examples/startup/main.tf (3127, 2023-10-20)
examples/startup/outputs.tf (125, 2023-10-20)
examples/startup/providers.tf (516, 2023-10-20)
examples/startup/variables.tf (1, 2023-10-20)
locals.tf (6636, 2023-10-20)
main.tf (8313, 2023-10-20)
outputs.tf (2118, 2023-10-20)
terraform.tf (165, 2023-10-20)
test/ (0, 2023-10-20)
... ...
# Terraform Verified Module for multi-hub network architectures
[](http://isitmaintained.com/project/Azure/terraform-azure-hubnetworking "Average time to resolve an issue")
[](http://isitmaintained.com/project/Azure/terraform-azure-hubnetworking "Percentage of issues still open")
This module is designed to simplify the creation of multi-region hub networks in Azure. It will create a number of virtual networks and subnets, and optionally peer them together in a mesh topology with routing.
## Features
- This module will deploy `n` number of virtual networks and subnets.
Optionally, these virtual networks can be peered in a mesh topology.
- A routing address space can be specified for each hub network, this module will then create route tables for the other hub networks and associate them with the subnets.
- Azure Firewall can be deployed iun each hub network. This module will configure routing for the AzureFirewallSubnet.
## Example
```terraform
module "hubnetworks" {
source = "Azure/hubnetworking/azure"
version = "
" # change this to your desired version, https://www.terraform.io/language/expressions/version-constraints
hub_virtual_networks = {
weu-hub = {
name = "vnet-prod-weu-0001"
address_space = ["192.168.0.0/23"]
routing_address_space = ["192.168.0.0/20"]
firewall = {
subnet_address_prefix = "192.168.1.0/24"
sku_tier = "Premium"
sku_name = "AZFW_VNet"
}
}
}
}
```
## Documentation
## Requirements
The following requirements are needed by this module:
- [terraform](#requirement\_terraform) (>= 1.3.0)
- [azurerm](#requirement\_azurerm) (>= 3.7.0, < 4.0)
## Modules
The following Modules are called:
### [hub\_virtual\_networks](#module\_hub\_virtual\_networks)
Source: Azure/subnets/azurerm
Version: 1.0.0
## Required Inputs
No required inputs.
## Optional Inputs
The following input variables are optional (have default values):
### [hub\_virtual\_networks](#input\_hub\_virtual\_networks)
Description: A map of the hub virtual networks to create. The map key is an arbitrary value to avoid Terraform's restriction that map keys must be known at plan time.
### Mandatory fields
- `name` - The name of the Virtual Network.
- `address_space` - A list of IPv4 address spaces that are used by this virtual network in CIDR format, e.g. `["192.168.0.0/24"]`.
- `location` - The Azure location where the virtual network should be created.
- `resource_group_name` - The name of the resource group in which the virtual network should be created.
### Optional fields
- `bgp_community` - The BGP community associated with the virtual network.
- `ddos_protection_plan_id` - The ID of the DDoS protection plan associated with the virtual network.
- `dns_servers` - A list of DNS servers IP addresses for the virtual network.
- `flow_timeout_in_minutes` - The flow timeout in minutes for the virtual network. Default `4`.
- `mesh_peering_enabled` - Should the virtual network be peered to other hub networks with this flag enabled? Default `true`.
- `resource_group_creation_enabled` - Should the resource group for this virtual network be created by this module? Default `true`.
- `resource_group_lock_enabled` - Should the resource group for this virtual network be locked? Default `true`.
- `resource_group_lock_name` - The name of the resource group lock.
- `resource_group_tags` - A map of tags to apply to the resource group.
- `routing_address_space` - A list of IPv4 address spaces in CIDR format that are used for routing to this hub, e.g. `["192.168.0.0","172.16.0.0/12"]`.
- `hub_router_ip_address` - If not using Azure Firewall, this is the IP address of the hub router. This is used to create route table entries for other hub networks.
- `tags` - A map of tags to apply to the virtual network.
#### Route table entries
- `route_table_entries` - (Optional) A set of additional route table entries to add to the route table for this hub network. Default empty `[]`. The value is an object with the following fields:
- `name` - The name of the route table entry.
- `address_prefix` - The address prefix to match for this route table entry.
- `next_hop_type` - The type of the next hop. Possible values include `Internet`, `VirtualAppliance`, `VirtualNetworkGateway`, `VnetLocal`, `None`.
- `has_bgp_override` - Should the BGP override be enabled for this route table entry? Default `false`.
- `next_hop_ip_address` - The IP address of the next hop. Required if `next_hop_type` is `VirtualAppliance`.
#### Subnets
- `subnets` - (Optional) A map of subnets to create in the virtual network. The value is an object with the following fields:
- `address_prefixes` - The IPv4 address prefixes to use for the subnet in CIDR format.
- `nat_gateway` - (Optional) An object with the following fields:
- `id` - The ID of the NAT Gateway which should be associated with the Subnet. Changing this forces a new resource to be created.
- `network_security_group` - (Optional) An object with the following fields:
- `id` - The ID of the Network Security Group which should be associated with the Subnet. Changing this forces a new association to be created.
- `private_endpoint_network_policies_enabled` - (Optional) Enable or Disable network policies for the private endpoint on the subnet. Setting this to true will Enable the policy and setting this to false will Disable the policy. Defaults to true.
- `private_link_service_network_policies_enabled` - (Optional) Enable or Disable network policies for the private link service on the subnet. Setting this to true will Enable the policy and setting this to false will Disable the policy. Defaults to true.
- `assign_generated_route_table` - (Optional) Should the Route Table generated by this module be associated with this Subnet? Default `true`. Cannot be used with `external_route_table_id`.
- `external_route_table_id` - (Optional) The ID of the Route Table which should be associated with the Subnet. Changing this forces a new association to be created. Cannot be used with `assign_generated_route_table`.
- `service_endpoints` - (Optional) The list of Service endpoints to associate with the subnet.
- `service_endpoint_policy_ids` - (Optional) The list of Service Endpoint Policy IDs to associate with the subnet.
- `service_endpoint_policy_assignment_enabled` - (Optional) Should the Service Endpoint Policy be assigned to the subnet? Default `true`.
- `delegation` - (Optional) An object with the following fields:
- `name` - The name of the delegation.
- `service_delegation` - An object with the following fields:
- `name` - The name of the service delegation.
- `actions` - A list of actions that should be delegated, the list is specific to the service being delegated.
#### Azure Firewall
- `firewall` - (Optional) An object with the following fields:
- `sku_name` - The name of the SKU to use for the Azure Firewall. Possible values include `AZFW_Hub`, `AZFW_VNet`.
- `sku_tier` - The tier of the SKU to use for the Azure Firewall. Possible values include `Basic`, `Standard`, `Premium`.
- `subnet_address_prefix` - The IPv4 address prefix to use for the Azure Firewall subnet in CIDR format. Needs to be a part of the virtual network's address space.
- `dns_servers` - (Optional) A list of DNS server IP addresses for the Azure Firewall.
- `firewall_policy_id` - (Optional) The resource id of the Azure Firewall Policy to associate with the Azure Firewall.
- `management_subnet_address_prefix` - (Optional) The IPv4 address prefix to use for the Azure Firewall management subnet in CIDR format. Needs to be a part of the virtual network's address space.
- `name` - (Optional) The name of the firewall resource. If not specified will use `afw-{vnetname}`.
- `private_ip_ranges` - (Optional) A list of private IP ranges to use for the Azure Firewall, to which the firewall will not NAT traffic. If not specified will use RFC1918.
- `subnet_route_table_id` = (Optional) The resource id of the Route Table which should be associated with the Azure Firewall subnet. If not specified the module will assign the generated route table.
- `tags` - (Optional) A map of tags to apply to the Azure Firewall. If not specified
- `threat_intel_mode` - (Optional) The threat intelligence mode for the Azure Firewall. Possible values include `Alert`, `Deny`, `Off`.
- `zones` - (Optional) A list of availability zones to use for the Azure Firewall. If not specified will be `null`.
- `default_ip_configuration` - (Optional) An object with the following fields. If not specified the defaults below will be used:
- `name` - (Optional) The name of the default IP configuration. If not specified will use `default`.
- `public_ip_config` - (Optional) An object with the following fields:
- `name` - (Optional) The name of the public IP configuration. If not specified will use `pip-afw-{vnetname}`.
- `zones` - (Optional) A list of availability zones to use for the public IP configuration. If not specified will be `null`.
- `ip_version` - (Optional) The IP version to use for the public IP configuration. Possible values include `IPv4`, `IPv6`. If not specified will be `IPv4`.
- `sku_tier` - (Optional) The SKU tier to use for the public IP configuration. Possible values include `Regional`, `Global`. If not specified will be `Regional`.
- `management_ip_configuration` - (Optional) An object with the following fields. If not specified the defaults below will be used:
- `name` - (Optional) The name of the management IP configuration. If not specified will use `defaultMgmt`.
- `public_ip_config` - (Optional) An object with the following fields:
- `name` - (Optional) The name of the public IP configuration. If not specified will use `pip-afw-mgmt-