Fix location variable

CHANGELOG.md

@@ -7,6 +7,17 @@ and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## [2.0.0] - 2024-04-09
+
+### Added
+
+### Changed
+
+### Removed
+- `default_location` from variables as it is not needed
+
+### Fixed
+
 ## [1.2.0] - 2024-04-08
 
 ### Added

README.md

@@ -37,10 +37,7 @@ module "firewall_rules" {
 
   firewall_policy_id  = azurerm_firewall_policy.example.id
   resource_group_name = azurerm_resource_group.example.name
-
-  responsibility   = "Platform"
-  stage            = "prd"
-  default_location = local.location
+  stage               = "tst"
 
   ipg_application_lz_id = azurerm_ip_group.application_lz.id
   ipg_platform_id       = azurerm_ip_group.platform.id
@@ -57,12 +54,11 @@ module "firewall_rules" {
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_default_location"></a> [default\_location](#input\_default\_location) | The default location used for this module. | `string` | n/a | yes |
 | <a name="input_ipg_application_lz_id"></a> [ipg\_application\_lz\_id](#input\_ipg\_application\_lz\_id) | IP ranges for all application landing zones. | `string` | n/a | yes |
 | <a name="input_ipg_platform_id"></a> [ipg\_platform\_id](#input\_ipg\_platform\_id) | IP ranges for the whole platform service, defined by the azure landing zone core modules. | `string` | n/a | yes |
 | <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of the resource group in which the firewall policy and the azure firewall are located. | `string` | n/a | yes |
 | <a name="input_stage"></a> [stage](#input\_stage) | The stage that the resource is located in, e.g. prod, dev. | `string` | n/a | yes |
-| <a name="input_bastion_config"></a> [bastion\_config](#input\_bastion\_config) | <pre>ipg_bastion_id: If the customer uses bastion, provide the bastion ip-group in this variable.<br>  ipg_rdp_access_ids: If rdp access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion.<br>  ipg_ssh_access_ids: If ssh access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion.</pre> | <pre>object({<br>    ipg_bastion_id = string<br>    ipg_rdp_access_ids = optional(list(string), [])<br>    ipg_ssh_access_ids = optional(list(string), [])<br>  })</pre> | `null` | no |
+| <a name="input_bastion_config"></a> [bastion\_config](#input\_bastion\_config) | <pre>ipg_bastion_id: If the customer uses bastion, provide the bastion ip-group in this variable.<br>  ipg_rdp_access_ids: If RDP access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion via RDP.<br>  ipg_ssh_access_ids: If SSH access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion via SSH.</pre> | <pre>object({<br>    ipg_bastion_id = string<br>    ipg_rdp_access_ids = optional(list(string), [])<br>    ipg_ssh_access_ids = optional(list(string), [])<br>  })</pre> | `null` | no |
 | <a name="input_firewall_policy_id"></a> [firewall\_policy\_id](#input\_firewall\_policy\_id) | For testing use this | `string` | `null` | no |
 | <a name="input_ipg_azure_dc_id"></a> [ipg\_azure\_dc\_id](#input\_ipg\_azure\_dc\_id) | The ip addresses of the domain controller located in azure. If the value is not provided, this network rule collection will not be created. | `string` | `null` | no |
 | <a name="input_ipg_dnsprivateresolver_id"></a> [ipg\_dnsprivateresolver\_id](#input\_ipg\_dnsprivateresolver\_id) | The ip address of the private dns resolver inbound endpoint. If the value is not provided, this network rule collection will not be created | `string` | `null` | no |

examples/advanced/main.tf

@@ -23,10 +23,7 @@ module "firewall_rules" {
 
   firewall_policy_id  = azurerm_firewall_policy.example.id
   resource_group_name = azurerm_resource_group.example.name
-
-  responsibility   = "Platform"
-  stage            = "prd"
-  default_location = local.location
+  stage               = "tst"
 
   ipg_dnsprivateresolver_id = azurerm_ip_group.dnsprivateresolver.id
   ipg_azure_dc_id           = azurerm_ip_group.azure_dc.id

examples/basic/main.tf

@@ -23,10 +23,7 @@ module "firewall_rules" {
 
   firewall_policy_id  = azurerm_firewall_policy.example.id
   resource_group_name = azurerm_resource_group.example.name
-
-  responsibility   = "Platform"
-  stage            = "prd"
-  default_location = local.location
+  stage               = "tst"
 
   ipg_application_lz_id = azurerm_ip_group.application_lz.id
   ipg_platform_id       = azurerm_ip_group.platform.id

main.tf

@@ -75,10 +75,10 @@ resource "azurerm_firewall_policy_rule_collection_group" "this" {
 
       rule {
         name                  = "allow-dc-to-dnsresolver-inbound"
-        protocols             = ["Any"]
+        protocols             = ["UDP","TCP"]
         source_ip_groups      = var.ipg_onpremise_dc_id != null ? [var.ipg_azure_dc_id, var.ipg_onpremise_dc_id] : [var.ipg_azure_dc_id]
         destination_ip_groups = [var.ipg_dnsprivateresolver_id]
-        destination_ports     = ["*"]
+        destination_ports     = ["53"]
       }
     }
   }
@@ -93,6 +93,7 @@ resource "azurerm_firewall_policy_rule_collection_group" "this" {
       dynamic "rule" {
         for_each = var.bastion_config.ipg_rdp_access_ids
         content {
+          # The regex outputs the name of the ip group from id.
           name                  = "allow-bastion-to-${regex(".+\\/(.+)?", rule.value)[0]}-rdp"
           protocols             = ["TCP"]
           source_ip_groups      = [network_rule_collection.value]
@@ -104,6 +105,7 @@ resource "azurerm_firewall_policy_rule_collection_group" "this" {
       dynamic "rule" {
         for_each = var.bastion_config.ipg_ssh_access_ids
         content {
+          # The regex outputs the name of the ip group from id.
           name                  = "allow-bastion-to-${regex(".+\\/(.+)?", rule.value)[0]}-ssh"
           protocols             = ["TCP"]
           source_ip_groups      = [network_rule_collection.value]

variables.tf

@@ -21,12 +21,6 @@ variable "stage" {
   description = "The stage that the resource is located in, e.g. prod, dev."
 }
 
-variable "default_location" {
-  type        = string
-  description = "The default location used for this module."
-  nullable    = false
-}
-
 variable "ipg_azure_dc_id" {
   type        = string
   description = "The ip addresses of the domain controller located in azure. If the value is not provided, this network rule collection will not be created."
@@ -65,8 +59,8 @@ variable "bastion_config" {
   description = <<-DOC
   ```
     ipg_bastion_id: If the customer uses bastion, provide the bastion ip-group in this variable.
-    ipg_rdp_access_ids: If rdp access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion.
-    ipg_ssh_access_ids: If ssh access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion.     
+    ipg_rdp_access_ids: If RDP access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion via RDP.
+    ipg_ssh_access_ids: If SSH access is needed, provide vm ip-groups in this variable. Every ip-group provided in this list, will be accessible by bastion via SSH.     
   ```
   DOC
 }