Quickstart: Deploy Azure Firewall with Availability Zones - Terraform

In this quickstart, use Terraform to deploy an Azure Firewall in three Availability Zones.

Terraform enables the definition, preview, and deployment of cloud infrastructure. Using Terraform, you create configuration files using HCL syntax. The HCL syntax allows you to specify the cloud provider - such as Azure - and the elements that make up your cloud infrastructure. After you create your configuration files, you create an execution plan that allows you to preview your infrastructure changes before they're deployed. Once you verify the changes, you apply the execution plan to deploy the infrastructure.

The Terraform configuration creates a test network environment with a firewall. The network has one virtual network with three subnets: AzureFirewallSubnet, subnet-server, and subnet-jump. The subnet-server and subnet-jump subnets each have a single two-core Windows Server virtual machine.

The firewall is in the AzureFirewallSubnet subnet and has an application rule collection with a single rule that allows access to www.microsoft.com.

A user-defined route points network traffic from the subnet-server subnet through the firewall where the firewall rules are applied.

For more information about Azure Firewall, see Deploy and configure Azure Firewall using the Azure portal.

In this article, you learn how to:

Prerequisites

• Install and configure Terraform

Implement the Terraform code

1. Create a directory to test the sample Terraform code and make it the current directory.

2. Create a file named providers.tf and insert the following code:

   terraform {
    required_providers {
    azurerm = {
    source = "hashicorp/azurerm"
    version = "~>3.0"
    }
    random = {
    source = "hashicorp/random"
    version = "~>3.0"
    }
    }
   }
   
   provider "azurerm" {
    features {}
   }
   

3. Create a file named main.tf and insert the following code:

   resource "random_pet" "rg_name" {
    prefix = var.resource_group_name_prefix
   }
   
   resource "random_string" "storage_account_name" {
    length = 8
    lower = true
    numeric = false
    special = false
    upper = false
   }
   
   resource "random_password" "password" {
    length = 20
    min_lower = 1
    min_upper = 1
    min_numeric = 1
    min_special = 1
    special = true
   }
   
   resource "azurerm_resource_group" "rg" {
    name = random_pet.rg_name.id
    location = var.resource_group_location
   }
   
   resource "azurerm_public_ip" "pip_azfw" {
    name = "pip-azfw"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    allocation_method = "Static"
    sku = "Standard"
    zones = ["1", "2", "3"]
   }
   
   resource "azurerm_storage_account" "sa" {
    name = random_string.storage_account_name.result
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    account_tier = "Standard"
    account_replication_type = "LRS"
    account_kind = "StorageV2"
   }
   
   resource "azurerm_virtual_network" "azfw_vnet" {
    name = "azfw-vnet"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    address_space = ["10.10.0.0/16"]
   }
   
   resource "azurerm_subnet" "azfw_subnet" {
    name = "AzureFirewallSubnet"
    resource_group_name = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.azfw_vnet.name
    address_prefixes = ["10.10.0.0/26"]
   }
   
   resource "azurerm_subnet" "server_subnet" {
    name = "subnet-server"
    resource_group_name = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.azfw_vnet.name
    address_prefixes = ["10.10.1.0/24"]
   }
   
   resource "azurerm_subnet" "jump_subnet" {
    name = "subnet-jump"
    resource_group_name = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.azfw_vnet.name
    address_prefixes = ["10.10.2.0/24"]
   }
   
   resource "azurerm_public_ip" "vm_jump_pip" {
    name = "pip-jump"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    allocation_method = "Static"
    sku = "Standard"
   }
   
   resource "azurerm_network_interface" "vm_server_nic" {
    name = "nic-server"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
   
    ip_configuration {
    name = "ipconfig-workload"
    subnet_id = azurerm_subnet.server_subnet.id
    private_ip_address_allocation = "Dynamic"
    }
   }
   
   resource "azurerm_network_interface" "vm_jump_nic" {
    name = "nic-jump"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
   
    ip_configuration {
    name = "ipconfig-jump"
    subnet_id = azurerm_subnet.jump_subnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = azurerm_public_ip.vm_jump_pip.id
    }
   }
   
   resource "azurerm_network_security_group" "vm_server_nsg" {
    name = "nsg-server"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
   }
   
   resource "azurerm_network_security_group" "vm_jump_nsg" {
    name = "nsg-jump"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    security_rule {
    name = "Allow-TCP"
    priority = 1000
    direction = "Inbound"
    access = "Allow"
    protocol = "Tcp"
    source_port_range = "*"
    destination_port_range = "3389"
    source_address_prefix = "*"
    destination_address_prefix = "*"
    }
   }
   
   resource "azurerm_network_interface_security_group_association" "vm_server_nsg_association" {
    network_interface_id = azurerm_network_interface.vm_server_nic.id
    network_security_group_id = azurerm_network_security_group.vm_server_nsg.id
   }
   
   resource "azurerm_network_interface_security_group_association" "vm_jump_nsg_association" {
    network_interface_id = azurerm_network_interface.vm_jump_nic.id
    network_security_group_id = azurerm_network_security_group.vm_jump_nsg.id
   }
   
   resource "azurerm_windows_virtual_machine" "vm_server" {
    name = "server-vm"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    computer_name = "server"
    size = var.virtual_machine_size
    admin_username = var.admin_username
    admin_password = random_password.password.result
    network_interface_ids = [azurerm_network_interface.vm_server_nic.id]
    os_disk {
    caching = "ReadWrite"
    storage_account_type = "Standard_LRS"
    disk_size_gb = "128"
    }
    source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer = "WindowsServer"
    sku = "2019-Datacenter"
    version = "latest"
    }
    boot_diagnostics {
    storage_account_uri = azurerm_storage_account.sa.primary_blob_endpoint
    }
   }
   
   resource "azurerm_windows_virtual_machine" "vm_jump" {
    name = "jump-vm"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    computer_name = "jumpbox"
    size = var.virtual_machine_size
    admin_username = var.admin_username
    admin_password = random_password.password.result
    network_interface_ids = [azurerm_network_interface.vm_jump_nic.id]
    os_disk {
    caching = "ReadWrite"
    storage_account_type = "Standard_LRS"
    disk_size_gb = "128"
    }
    source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer = "WindowsServer"
    sku = "2019-Datacenter"
    version = "latest"
    }
    boot_diagnostics {
    storage_account_uri = azurerm_storage_account.sa.primary_blob_endpoint
    }
   }
   
   resource "azurerm_firewall_policy" "azfw_policy" {
    name = "azfw-policy"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    sku = var.firewall_sku_tier
    threat_intelligence_mode = "Alert"
   }
   
   resource "azurerm_firewall_policy_rule_collection_group" "prcg" {
    name = "prcg"
    firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
    priority = 300
    application_rule_collection {
    name = "appRc1"
    priority = 101
    action = "Allow"
    rule {
    name = "appRule1"
    protocols {
    type = "Http"
    port = 80
    }
    protocols {
    type = "Https"
    port = 443
    }
    destination_fqdns = ["www.microsoft.com"]
    source_addresses = ["10.10.1.0/24"]
    }
    }
    network_rule_collection {
    name = "netRc1"
    priority = 200
    action = "Allow"
    rule {
    name = "netRule1"
    protocols = ["TCP"]
    source_addresses = ["10.10.1.0/24"]
    destination_addresses = ["*"]
    destination_ports = ["8000", "8999"]
    }
    }
   }
   
   resource "azurerm_firewall" "fw" {
    name = "azfw"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    sku_name = "AZFW_VNet"
    sku_tier = var.firewall_sku_tier
    zones = ["1", "2", "3"]
    ip_configuration {
    name = "azfw-ipconfig"
    subnet_id = azurerm_subnet.azfw_subnet.id
    public_ip_address_id = azurerm_public_ip.pip_azfw.id
    }
    firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
   }
   
   resource "azurerm_route_table" "rt" {
    name = "rt-azfw-eus"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    disable_bgp_route_propagation = false
    route {
    name = "azfwDefaultRoute"
    address_prefix = "0.0.0.0/0"
    next_hop_type = "VirtualAppliance"
    next_hop_in_ip_address = azurerm_firewall.fw.ip_configuration[0].private_ip_address
    }
   }
   
   resource "azurerm_subnet_route_table_association" "jump_subnet_rt_association" {
    subnet_id = azurerm_subnet.server_subnet.id
    route_table_id = azurerm_route_table.rt.id
   }
   

4. Create a file named variables.tf and insert the following code:

   variable "resource_group_location" {
    type = string
    description = "Location for all resources."
    default = "eastus"
   }
   
   variable "resource_group_name_prefix" {
    type = string
    description = "Prefix for the Resource Group Name that's combined with a random id so name is unique in your Azure subcription."
    default = "rg"
   }
   
   variable "firewall_sku_tier" {
    type = string
    description = "Firewall SKU."
    default = "Premium" # Valid values are Standard and Premium
    validation {
    condition = contains(["Standard", "Premium"], var.firewall_sku_tier)
    error_message = "The SKU must be one of the following: Standard, Premium"
    }
   }
   
   variable "virtual_machine_size" {
    type = string
    description = "Size of the virtual machine."
    default = "Standard_D2_v3"
   }
   
   variable "admin_username" {
    type = string
    description = "Value of the admin username."
    default = "azureuser"
   }
   

5. Create a file named outputs.tf and insert the following code:

   output "resource_group_name" {
    value = azurerm_resource_group.rg.name
   }
   
   output "firewall_name" {
    value = azurerm_firewall.fw.name
   }
   

Initialize Terraform

Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.

terraform init -upgrade

Key points:

• The -upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.

Create a Terraform execution plan

Run terraform plan to create an execution plan.

terraform plan -out main.tfplan

Key points:

• The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
• The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

Apply a Terraform execution plan

Run terraform apply to apply the execution plan to your cloud infrastructure.

terraform apply main.tfplan

Key points:

• The example terraform apply command assumes you previously ran terraform plan -out main.tfplan.
• If you specified a different filename for the -out parameter, use that same filename in the call to terraform apply.
• If you didn't use the -out parameter, call terraform apply without any parameters.

Verify the results

Clean up resources

When you no longer need the resources created via Terraform, do the following steps:

1. Run terraform plan and specify the destroy flag.

   terraform plan -destroy -out main.destroy.tfplan
   

   Key points:

   • The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
   • The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

2. Run terraform apply to apply the execution plan.

   terraform apply main.destroy.tfplan
   

Troubleshoot Terraform on Azure

Troubleshoot common problems when using Terraform on Azure

Next steps

Next, you can monitor the Azure Firewall logs.