Skip to content

Commit 2629166

Browse files
jimrightjimright
authored
Add terraform-aws-fw-vpc and terraform-aws-firewall modules (#89)
Signed-off-by: Jim Enright <[email protected]>
1 parent a5103f6 commit 2629166

File tree

26 files changed

+1302
-1
lines changed

26 files changed

+1302
-1
lines changed

‎README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,12 @@ This repository contains a number of Terraform modules for creation of the pre-r
1212
| [terraform-cdp-deploy](modules/terraform-cdp-deploy/README.md) | For deployment of CDP on AWS, Azure or GCP. |
1313
| [terraform-aws-cred-permissions](modules/terraform-aws-cred-permissions/README.md) | Module for creation of the Cross Account Credential pre-requisite on AWS. Note that this module is called from the terraform-cdp-aws-prereqs module. |
1414
| [terraform-aws-permissions](modules/terraform-aws-permissions/README.md) | Module for creation of the AWS IAM permissions required by the (CDP) Public Cloud environment and datalake deployment. Note that this module is called from the terraform-cdp-aws-prereqs module. |
15-
| [terraform-aws-vpc](modules/terraform-aws-vpc/README.md) | Module for creation of the VPC networking resources on AWS suitable. Can be used to create the CDP VPC and Subnets. Note that this module is called from the terraform-cdp-aws-prereqs module. |
15+
| [terraform-aws-vpc](modules/terraform-aws-vpc/README.md) | Module for creation of the VPC networking resources on AWS. Can be used to create the CDP VPC and Subnets. Note that this module is called from the terraform-cdp-aws-prereqs module. |
16+
| [terraform-aws-fw-vpc](modules/terraform-aws-fw-vpc/README.md) | Module for creation of the VPC networking resources on AWS suitable for running a Firewall in a distributed architecture on AWS. Can be used to create a networking VPC which runs the AWS Network Firewall and connects to a Cloudera on cloud full-private deployment. |
1617
| [terraform-aws-tgw](modules/terraform-aws-tgw/README.md) | Module for creation of AWS Transity Gateway (TGW) and attaching a specified list of VPCs via the TGW. This module can be used to assist in deploying Cloudera Data Platform (CDP) Public Cloud in a fully private networking configuration where a CDP VPC and Networking VPC are connected using the Transit Gateway. |
1718
| [terraform-aws-bastion](modules/terraform-aws-bastion/README.md) | Module to create a Bastion EC2 instance on AWS. This module can be used to assist in deploying Cloudera Data Platform (CDP) Public Cloud in a secure environment, where the CDP Environment requires a Bastion host. |
1819
| [terraform-aws-proxy](modules/terraform-aws-proxy/README.md) | Module to create and configure and EC2 Auto-Scaling Group for a highly available Squid Proxy service with Network Load Balancer (NLB) to forward traffic to the proxy instances. This module can be used to assist in deploying Cloudera Data Platform (CDP) Public Cloud in a fully private networking configuration where a the CDP Environments uses a proxy config via the NLB. |
20+
| [terraform-aws-firewall](modules/terraform-aws-firewall/README.md) | Module to create and configure to create and configure an AWS Network Firewall. This module can be used to assist in deploying Cloudera Data Platform (CDP) Public Cloud in a fully private networking configuration where the CDP Environment is connected to a Networking VPC running the Firewall. |
1921
| [terraform-azure-nfs](modules/terraform-azure-nfs/README.md) | Module for creation of Azure NFS File Share required for Cloudera Machine Learning (CML) Public Cloud. Also optionally creates a Virtual Machine which can be used to mount and set the required ownership for CML workspace's projects folder.|
2022
| [terraform-azure-cdw-permissions](modules/terraform-azure-cdw-permissions/README.md) | Module for creation of the Azure Kubernetes Service (AKS) managed identity required for the Cloudera Data Warehouse (CDW) service.|
2123
| [terraform-azure-storage-endpoints](modules/terraform-azure-storage-endpoints/README.md) | Module for creation creation of Azure private endpoints between specified storage accounts and VNet subnets.|

‎modules/terraform-aws-firewall/.terraform-docs.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
formatter: markdown
2+
header-from: doc_fragments/header.md
3+
settings:
4+
anchor: true
5+
color: true
6+
default: true
7+
escape: true
8+
html: true
9+
indent: 2
10+
required: true
11+
sensitive: true
12+
type: true
13+
14+
15+
sort:
16+
enabled: true
17+
by: required
18+
19+
output:
20+
file: README.md
21+
mode: replace

‎modules/terraform-aws-firewall/README.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
# Terraform Module for AWS Network Firewall
3+
4+
This module contains resource files and example variable definition files to create and configure an AWS Network Firewall. This module can be used to assist in deploying Cloudera Data Platform (CDP) Public Cloud in a fully private networking configuration where the CDP Environment is connected to a Networking VPC running the Firewall.
5+
6+
## Usage
7+
8+
The [examples](./examples) directory has example of using this module:
9+
10+
* `ex01-minimal_inputs` demonstrates how this module can be used to within a networking VPC. The [terraform-aws-nfw-vpc](../../../terraform-aws-nfw-vpc/README.md) module is also used as part of this example.
11+
12+
The sample `terraform.tfvars.sample` describes the required inputs for the example.
13+
14+
## Requirements
15+
16+
| Name | Version |
17+
|------|---------|
18+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | > 1.3.0 |
19+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.30 |
20+
21+
## Providers
22+
23+
| Name | Version |
24+
|------|---------|
25+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.30 |
26+
27+
## Modules
28+
29+
No modules.
30+
31+
## Resources
32+
33+
| Name | Type |
34+
|------|------|
35+
| [aws_cloudwatch_log_group.nfw_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
36+
| [aws_networkfirewall_firewall.fw](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall) | resource |
37+
| [aws_networkfirewall_firewall_policy.fw_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy) | resource |
38+
| [aws_networkfirewall_logging_configuration.nfw_log_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_logging_configuration) | resource |
39+
| [aws_networkfirewall_rule_group.cdp_env_fw_rg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_rule_group) | resource |
40+
| [aws_route.vpc_tgw_route](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route) | resource |
41+
| [aws_vpc.cdp_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
42+
| [aws_vpc.network_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source |
43+
44+
## Inputs
45+
46+
| Name | Description | Type | Default | Required |
47+
|------|-------------|------|---------|:--------:|
48+
| <a name="input_cdp_firewall_rule_group_name"></a> [cdp\_firewall\_rule\_group\_name](#input\_cdp\_firewall\_rule\_group\_name) | Name of the CDP Rule Group. | `string` | n/a | yes |
49+
| <a name="input_cdp_vpc_id"></a> [cdp\_vpc\_id](#input\_cdp\_vpc\_id) | VPC ID for where the CDP environment is running | `string` | n/a | yes |
50+
| <a name="input_firewall_name"></a> [firewall\_name](#input\_firewall\_name) | Name of the Firewall. | `string` | n/a | yes |
51+
| <a name="input_firewall_policy_name"></a> [firewall\_policy\_name](#input\_firewall\_policy\_name) | Name of the Firewall Policy. | `string` | n/a | yes |
52+
| <a name="input_firewall_subnet_ids"></a> [firewall\_subnet\_ids](#input\_firewall\_subnet\_ids) | List of subnet ids to assign to the Firewall. | `list(string)` | n/a | yes |
53+
| <a name="input_network_vpc_id"></a> [network\_vpc\_id](#input\_network\_vpc\_id) | VPC ID for where the Networking components are running | `string` | n/a | yes |
54+
| <a name="input_cdp_firewall_domain_allowlist"></a> [cdp\_firewall\_domain\_allowlist](#input\_cdp\_firewall\_domain\_allowlist) | Domain allowlist for CDP Rule Group. | `list(string)` | <pre>[<br> "cloudera.com"<br>]</pre> | no |
55+
| <a name="input_cdp_fw_rule_group_capacity"></a> [cdp\_fw\_rule\_group\_capacity](#input\_cdp\_fw\_rule\_group\_capacity) | Capacity (maximum number of operating resources) for the CDP Firewall Rule Group | `number` | `300` | no |
56+
| <a name="input_firewall_logging_config"></a> [firewall\_logging\_config](#input\_firewall\_logging\_config) | Logging config for cloudwatch logs created for network Firewall | `map(any)` | <pre>{<br> "alert": {<br> "retention_in_days": 3<br> },<br> "flow": {<br> "retention_in_days": 1<br> }<br>}</pre> | no |
57+
| <a name="input_route_tables_to_update"></a> [route\_tables\_to\_update](#input\_route\_tables\_to\_update) | List of any route tables to update to target the Firewall Endpoint | <pre>list(object({<br> route_tables = list(string)<br> availability_zones = optional(list(string))<br> destination_cidr_block = string<br> }))</pre> | `[]` | no |
58+
| <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to provisioned resources | `map(any)` | `{}` | no |
59+
60+
## Outputs
61+
62+
| Name | Description |
63+
|------|-------------|
64+
| <a name="output_nfw_arn"></a> [nfw\_arn](#output\_nfw\_arn) | The Amazon Resource Name (ARN) of the AWS Network Firewall |
65+
| <a name="output_nfw_id"></a> [nfw\_id](#output\_nfw\_id) | The Amazon Resource id of the AWS Network Firewall |
66+
| <a name="output_nfw_logging_configuration_ids"></a> [nfw\_logging\_configuration\_ids](#output\_nfw\_logging\_configuration\_ids) | The Amazon Resource id (ARN) of the logging configuration associated with the AWS Network Firewall |
67+
| <a name="output_nfw_policy_arn"></a> [nfw\_policy\_arn](#output\_nfw\_policy\_arn) | The Amazon Resource Name (ARN) that identifies the firewall policy |
68+
| <a name="output_nfw_policy_id"></a> [nfw\_policy\_id](#output\_nfw\_policy\_id) | The Amazon Resource id of the firewall policy for the AWS Network Firewall |
69+
<!-- END_TF_DOCS -->

‎modules/terraform-aws-firewall/data.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# Find details of the CDP and Networking VPCs
16+
data "aws_vpc" "network_vpc" {
17+
id = var.network_vpc_id
18+
}
19+
20+
data "aws_vpc" "cdp_vpc" {
21+
id = var.cdp_vpc_id
22+
}

‎modules/terraform-aws-firewall/defaults.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
locals {
16+
17+
# Local variables to determine route table to Firewall VPC Endpoint mapping
18+
route_tables_to_update = flatten([
19+
for route in var.route_tables_to_update :
20+
[
21+
for rti, rt in route.route_tables :
22+
{
23+
route_table = rt
24+
availability_zone = try(route.availability_zones[rti], null)
25+
destination_cidr_block = route.destination_cidr_block
26+
}
27+
]
28+
])
29+
30+
}

‎modules/terraform-aws-firewall/doc_fragments/header.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Terraform Module for AWS Network Firewall
2+
3+
This module contains resource files and example variable definition files to create and configure an AWS Network Firewall. This module can be used to assist in deploying Cloudera Data Platform (CDP) Public Cloud in a fully private networking configuration where the CDP Environment is connected to a Networking VPC running the Firewall.
4+
5+
## Usage
6+
7+
The [examples](./examples) directory has example of using this module:
8+
9+
* `ex01-minimal_inputs` demonstrates how this module can be used to within a networking VPC. The [terraform-aws-nfw-vpc](../../../terraform-aws-nfw-vpc/README.md) module is also used as part of this example.
10+
11+
The sample `terraform.tfvars.sample` describes the required inputs for the example.

‎modules/terraform-aws-firewall/examples/ex01-minimal_inputs/main.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
provider "aws" {
16+
region = var.aws_region
17+
}
18+
19+
module "ex01_network_vpc" {
20+
source = "../../../terraform-aws-nfw-vpc"
21+
22+
vpc_name = "${var.name_prefix}-network-vpc"
23+
24+
subnet_name_prefix = var.name_prefix
25+
nat_gateway_name_prefix = var.name_prefix
26+
route_table_name_prefix = var.name_prefix
27+
28+
vpc_cidr = var.vpc_cidr
29+
30+
tags = var.env_tags
31+
32+
}
33+
34+
module "ex01_nfw" {
35+
source = "../.."
36+
37+
cdp_firewall_rule_group_name = "${var.name_prefix}-cdp-rg"
38+
firewall_policy_name = "${var.name_prefix}-fwp"
39+
firewall_name = "${var.name_prefix}-fw"
40+
41+
cdp_vpc_id = module.ex01_network_vpc.vpc_id
42+
network_vpc_id = module.ex01_network_vpc.vpc_id
43+
44+
firewall_subnet_ids = module.ex01_network_vpc.fw_subnet_ids
45+
46+
# route_tables_to_update = []
47+
48+
tags = var.env_tags
49+
50+
51+
}

‎modules/terraform-aws-firewall/examples/ex01-minimal_inputs/terraform.tfvars.sample‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# ------- Global Settings -------
16+
name_prefix = "<ENTER_VALUE>"
17+
18+
# ------- Cloud Settings -------
19+
aws_region = "<ENTER_VALUE>" # Change this to specify Cloud Provider region, e.g. eu-west-1
20+
21+
# ------- VPC Settings -------
22+
23+
vpc_cidr = "10.11.0.0/16" # Change CIDR value if needed

‎modules/terraform-aws-firewall/examples/ex01-minimal_inputs/variables.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Copyright 2025 Cloudera, Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# ------- Global settings -------
16+
variable "aws_region" {
17+
type = string
18+
description = "Region which Cloud resources will be created"
19+
}
20+
21+
variable "env_tags" {
22+
type = map(any)
23+
description = "Tags applied to provised resources"
24+
25+
default = null
26+
}
27+
28+
variable "name_prefix" {
29+
type = string
30+
description = "Shorthand name to use when naming resources."
31+
}
32+
33+
# ------- Network Resources -------
34+
variable "vpc_cidr" {
35+
type = string
36+
description = "VPC CIDR Block. Required if create_vpc is true."
37+
38+
}

0 commit comments

Comments
 (0)