Quickstart: Create an Azure Firewall and IP Groups - Terraform

In this quickstart, use Terraform to deploy an Azure Firewall with sample IP Groups used in a network rule and application rule. An IP Group is a top-level resource that you use to define and group IP addresses, ranges, and subnets into a single object. An IP Group is useful for managing IP addresses in Azure Firewall rules. You can either manually enter IP addresses or import them from a file.

Terraform enables the definition, preview, and deployment of cloud infrastructure. Using Terraform, you create configuration files using HCL syntax. The HCL syntax allows you to specify the cloud provider - such as Azure - and the elements that make up your cloud infrastructure. After you create your configuration files, you create an execution plan that allows you to preview your infrastructure changes before they're deployed. Once you verify the changes, you apply the execution plan to deploy the infrastructure.

In this article, you learn how to:

Prerequisites

• Install and configure Terraform

Implement the Terraform code

1. Create a directory to test the sample Terraform code and make it the current directory.

2. Create a file named providers.tf and insert the following code:

   terraform {
    required_providers {
    azurerm = {
    source = "hashicorp/azurerm"
    version = "~>3.0"
    }
    random = {
    source = "hashicorp/random"
    version = "~>3.0"
    }
    azapi = {
    source = "azure/azapi"
    version = "~>1.5"
    }
    }
   }
   
   provider "azurerm" {
    features {}
   }
   

3. Create a file named ssh.tf and insert the following code:

   resource "random_pet" "ssh_key_name" {
    prefix = "ssh"
    separator = ""
   }
   
   resource "azapi_resource_action" "ssh_public_key_gen" {
    type = "Microsoft.Compute/sshPublicKeys@2022-11-01"
    resource_id = azapi_resource.ssh_public_key.id
    action = "generateKeyPair"
    method = "POST"
   
    response_export_values = ["publicKey", "privateKey"]
   }
   
   resource "azapi_resource" "ssh_public_key" {
    type = "Microsoft.Compute/sshPublicKeys@2022-11-01"
    name = random_pet.ssh_key_name.id
    location = azurerm_resource_group.rg.location
    parent_id = azurerm_resource_group.rg.id
   }
   
   output "key_data" {
    value = azapi_resource_action.ssh_public_key_gen.output.publicKey
   }
   

4. Create a file named main.tf and insert the following code:

   resource "random_pet" "rg_name" {
    prefix = var.resource_group_name_prefix
   }
   
   resource "random_string" "storage_account_name" {
    length = 8
    lower = true
    numeric = false
    special = false
    upper = false
   }
   
   resource "random_password" "password" {
    length = 20
    min_lower = 1
    min_upper = 1
    min_numeric = 1
    min_special = 1
    special = true
   }
   
   resource "azurerm_resource_group" "rg" {
    name = random_pet.rg_name.id
    location = var.resource_group_location
   }
   
   resource "azurerm_public_ip" "pip_azfw" {
    name = "pip-azfw"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    allocation_method = "Static"
    sku = "Standard"
   }
   
   resource "azurerm_storage_account" "sa" {
    name = random_string.storage_account_name.result
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    account_tier = "Standard"
    account_replication_type = "LRS"
    account_kind = "StorageV2"
   }
   
   resource "azurerm_firewall_policy" "azfw_policy" {
    name = "azfw-policy"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    sku = var.firewall_sku_tier
    threat_intelligence_mode = "Alert"
   }
   
   resource "azurerm_firewall_policy_rule_collection_group" "prcg" {
    name = "prcg"
    firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
    priority = 300
    application_rule_collection {
    name = "app-rule-collection-1"
    priority = 101
    action = "Allow"
    rule {
    name = "someAppRule"
    protocols {
    type = "Https"
    port = 443
    }
    destination_fqdns = ["*bing.com"]
    source_ip_groups = [azurerm_ip_group.ip_group_1.id]
    }
    }
    network_rule_collection {
    name = "net-rule-collection-1"
    priority = 200
    action = "Allow"
    rule {
    name = "someNetRule"
    protocols = ["TCP", "UDP", "ICMP"]
    source_ip_groups = [azurerm_ip_group.ip_group_1.id]
    destination_ip_groups = [azurerm_ip_group.ip_group_2.id]
    destination_ports = ["90"]
    }
    }
   }
   
   resource "azurerm_firewall" "fw" {
    name = "azfw"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    sku_name = "AZFW_VNet"
    sku_tier = var.firewall_sku_tier
    ip_configuration {
    name = "azfw-ipconfig"
    subnet_id = azurerm_subnet.azfw_subnet.id
    public_ip_address_id = azurerm_public_ip.pip_azfw.id
    }
    firewall_policy_id = azurerm_firewall_policy.azfw_policy.id
   }
   
   resource "azurerm_ip_group" "ip_group_1" {
    name = "ip-group_1"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    cidrs = ["13.73.64.64/26", "13.73.208.128/25", "52.126.194.0/23"]
   }
   resource "azurerm_ip_group" "ip_group_2" {
    name = "ip_group_2"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    cidrs = ["12.0.0.0/24", "13.9.0.0/24"]
   }
   
   resource "azurerm_virtual_network" "azfw_vnet" {
    name = "azfw-vnet"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    address_space = ["10.10.0.0/16"]
   }
   
   resource "azurerm_subnet" "azfw_subnet" {
    name = "AzureFirewallSubnet"
    resource_group_name = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.azfw_vnet.name
    address_prefixes = ["10.10.0.0/26"]
   }
   
   resource "azurerm_subnet" "server_subnet" {
    name = "subnet-server"
    resource_group_name = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.azfw_vnet.name
    address_prefixes = ["10.10.1.0/24"]
   }
   
   resource "azurerm_subnet" "jump_subnet" {
    name = "subnet-jump"
    resource_group_name = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.azfw_vnet.name
    address_prefixes = ["10.10.2.0/24"]
   }
   
   resource "azurerm_public_ip" "vm_jump_pip" {
    name = "pip-jump"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    allocation_method = "Static"
    sku = "Standard"
   }
   
   resource "azurerm_network_interface" "vm_server_nic" {
    name = "nic-server"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
   
    ip_configuration {
    name = "ipconfig-workload"
    subnet_id = azurerm_subnet.server_subnet.id
    private_ip_address_allocation = "Dynamic"
    }
   }
   
   resource "azurerm_network_interface" "vm_jump_nic" {
    name = "nic-jump"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
   
    ip_configuration {
    name = "ipconfig-jump"
    subnet_id = azurerm_subnet.jump_subnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id = azurerm_public_ip.vm_jump_pip.id
    }
   }
   
   resource "azurerm_network_security_group" "vm_server_nsg" {
    name = "nsg-server"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
   }
   
   resource "azurerm_network_security_group" "vm_jump_nsg" {
    name = "nsg-jump"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    security_rule {
    name = "Allow-SSH"
    priority = 1000
    direction = "Inbound"
    access = "Allow"
    protocol = "Tcp"
    source_port_range = "*"
    destination_port_range = "22"
    source_address_prefix = "*"
    destination_address_prefix = "*"
    }
   }
   
   resource "azurerm_network_interface_security_group_association" "vm_server_nsg_association" {
    network_interface_id = azurerm_network_interface.vm_server_nic.id
    network_security_group_id = azurerm_network_security_group.vm_server_nsg.id
   }
   
   resource "azurerm_network_interface_security_group_association" "vm_jump_nsg_association" {
    network_interface_id = azurerm_network_interface.vm_jump_nic.id
    network_security_group_id = azurerm_network_security_group.vm_jump_nsg.id
   }
   
   resource "azurerm_linux_virtual_machine" "vm_server" {
    name = "server-vm"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    size = var.virtual_machine_size
    admin_username = var.admin_username
    admin_ssh_key {
    username = var.admin_username
    public_key = azapi_resource_action.ssh_public_key_gen.output.publicKey
    }
    network_interface_ids = [azurerm_network_interface.vm_server_nic.id]
    os_disk {
    caching = "ReadWrite"
    storage_account_type = "Standard_LRS"
    }
    source_image_reference {
    publisher = "Canonical"
    offer = "UbuntuServer"
    sku = "18.04-LTS"
    version = "latest"
    }
    boot_diagnostics {
    storage_account_uri = azurerm_storage_account.sa.primary_blob_endpoint
    }
   }
   
   resource "azurerm_linux_virtual_machine" "vm_jump" {
    name = "jump-vm"
    resource_group_name = azurerm_resource_group.rg.name
    location = azurerm_resource_group.rg.location
    size = var.virtual_machine_size
    network_interface_ids = [azurerm_network_interface.vm_jump_nic.id]
    admin_username = var.admin_username
    os_disk {
    caching = "ReadWrite"
    storage_account_type = "Standard_LRS"
    }
    admin_ssh_key {
    username = var.admin_username
    public_key = azapi_resource_action.ssh_public_key_gen.output.publicKey
    }
    source_image_reference {
    publisher = "Canonical"
    offer = "UbuntuServer"
    sku = "18.04-LTS"
    version = "latest"
    }
    boot_diagnostics {
    storage_account_uri = azurerm_storage_account.sa.primary_blob_endpoint
    }
    computer_name = "JumpBox"
   
   }
   
   resource "azurerm_route_table" "rt" {
    name = "rt-azfw-eus"
    location = azurerm_resource_group.rg.location
    resource_group_name = azurerm_resource_group.rg.name
    disable_bgp_route_propagation = false
    route {
    name = "azfwDefaultRoute"
    address_prefix = "0.0.0.0/0"
    next_hop_type = "VirtualAppliance"
    next_hop_in_ip_address = azurerm_firewall.fw.ip_configuration[0].private_ip_address
    }
   }
   
   resource "azurerm_subnet_route_table_association" "server_subnet_rt_association" {
    subnet_id = azurerm_subnet.server_subnet.id
    route_table_id = azurerm_route_table.rt.id
   }
   

5. Create a file named variables.tf and insert the following code:

   variable "resource_group_location" {
    type = string
    description = "Location for all resources."
    default = "eastus"
   }
   
   variable "resource_group_name_prefix" {
    type = string
    description = "Prefix for the Resource Group Name that's combined with a random id so name is unique in your Azure subcription."
    default = "rg"
   }
   
   variable "firewall_sku_tier" {
    type = string
    description = "Firewall SKU."
    default = "Premium" # Valid values are Standard and Premium
    validation {
    condition = contains(["Standard", "Premium"], var.firewall_sku_tier)
    error_message = "The SKU must be one of the following: Standard, Premium"
    }
   }
   
   variable "virtual_machine_size" {
    type = string
    description = "Size of the virtual machine."
    default = "Standard_D2_v3"
   }
   
   variable "admin_username" {
    type = string
    description = "Value of the admin username."
    default = "azureuser"
   }
   

6. Create a file named outputs.tf and insert the following code:

   output "resource_group_name" {
    value = azurerm_resource_group.rg.name
   }
   
   output "firewall_name" {
    value = azurerm_firewall.fw.name
   }
   

Initialize Terraform

Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.

terraform init -upgrade

Key points:

• The -upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.

Create a Terraform execution plan

Run terraform plan to create an execution plan.

terraform plan -out main.tfplan

Key points:

• The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
• The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

Apply a Terraform execution plan

Run terraform apply to apply the execution plan to your cloud infrastructure.

terraform apply main.tfplan

Key points:

• The example terraform apply command assumes you previously ran terraform plan -out main.tfplan.
• If you specified a different filename for the -out parameter, use that same filename in the call to terraform apply.
• If you didn't use the -out parameter, call terraform apply without any parameters.

Verify the results

Clean up resources

When you no longer need the resources created via Terraform, do the following steps:

1. Run terraform plan and specify the destroy flag.

   terraform plan -destroy -out main.destroy.tfplan
   

   Key points:

   • The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
   • The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

2. Run terraform apply to apply the execution plan.

   terraform apply main.destroy.tfplan
   

Troubleshoot Terraform on Azure

Troubleshoot common problems when using Terraform on Azure

Next steps