From 1323ddded107d1d2c1b3354cf6421155797bd243 Mon Sep 17 00:00:00 2001 From: Chris Jaimon Date: Thu, 7 Jul 2022 12:03:04 +0530 Subject: [PATCH] EN-949: wrap mutually exclusive objects (patch) --- modules/azure-local-network-gateway/README.md | 7 +- modules/azure-local-network-gateway/main.tf | 4 +- .../{variables.tf => vars.tf} | 29 ++-- modules/azure-network-security-rule/README.md | 12 +- modules/azure-network-security-rule/main.tf | 17 +-- modules/azure-network-security-rule/vars.tf | 132 +++++++++++------- .../{variables.tf => vars.tf} | 0 7 files changed, 119 insertions(+), 82 deletions(-) rename modules/azure-local-network-gateway/{variables.tf => vars.tf} (64%) rename modules/azure-virtual-network-gateway-connection/{variables.tf => vars.tf} (100%) diff --git a/modules/azure-local-network-gateway/README.md b/modules/azure-local-network-gateway/README.md index 0838949..bbf8100 100644 --- a/modules/azure-local-network-gateway/README.md +++ b/modules/azure-local-network-gateway/README.md @@ -9,7 +9,7 @@ | Name | Version | |------|---------| -| [azurerm](#provider\_azurerm) | n/a | +| [azurerm](#provider\_azurerm) | 3.12.0 | ## Modules @@ -26,9 +26,8 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [address\_space](#input\_address\_space) | The list of string CIDRs representing the address spaces the gateway exposes. | `list(string)` | `[]` | no | -| [bgp\_settings](#input\_bgp\_settings) | The Local Network Gateway's BGP speaker settings. | 
list(object({
    asn = number
    bgp_peering_address = string
    peer_weight = optional(number)
  }))
| `[]` | no | -| [gateway\_address](#input\_gateway\_address) | The gateway IP address to connect with. | `string` | `null` | no | -| [gateway\_fqdn](#input\_gateway\_fqdn) | The gateway FQDN to connect with. | `string` | `null` | no | +| [bgp\_settings](#input\_bgp\_settings) | The Local Network Gateway's BGP speaker settings. | 
list(object({
    asn                 = number
    bgp_peering_address = string
    peer_weight         = optional(number)
  }))
| `[]` | no | +| [gateway](#input\_gateway) | gateway\_address - The gateway IP address to connect with.
gateway\_fqdn - The gateway FQDN to connect with. | 
object({
    address  = optional(string)
    fqdn = optional(string)
  })
| 
{
  "address": null,
  "fqdn": null
}
| no | | [location](#input\_location) | The location in which this network security group will be provisioned. | `string` | n/a | yes | | [name](#input\_name) | The name of the connection. | `string` | n/a | yes | | [resource\_group\_name](#input\_resource\_group\_name) | The name of the resource group in which this resource will be provisioned. | `string` | n/a | yes | diff --git a/modules/azure-local-network-gateway/main.tf b/modules/azure-local-network-gateway/main.tf index e4bdd7e..ddb2174 100644 --- a/modules/azure-local-network-gateway/main.tf +++ b/modules/azure-local-network-gateway/main.tf @@ -21,7 +21,7 @@ resource "azurerm_local_network_gateway" "remote" { peer_weight = bgp_settings.value["peer_weight"] } } - gateway_address = var.gateway_address - gateway_fqdn = var.gateway_fqdn + gateway_address = var.gateway.address + gateway_fqdn = var.gateway.fqdn tags = var.tags } diff --git a/modules/azure-local-network-gateway/variables.tf b/modules/azure-local-network-gateway/vars.tf similarity index 64% rename from modules/azure-local-network-gateway/variables.tf rename to modules/azure-local-network-gateway/vars.tf index 4c6cbc5..8d43616 100644 --- a/modules/azure-local-network-gateway/variables.tf +++ b/modules/azure-local-network-gateway/vars.tf @@ -29,18 +29,23 @@ variable "bgp_settings" { default = [] } -# This is required if `gateway_fqdn` is not specified. -variable "gateway_address" { - description = "The gateway IP address to connect with." - type = string - default = null -} - -# This is required if `gateway_address` is not specified. -variable "gateway_fqdn" { - description = "The gateway FQDN to connect with." - type = string - default = null +variable "gateway" { + description = < [access](#input\_access) | Specifies whether network traffic is allowed or denied. | `string` | n/a | yes | | [description](#input\_description) | A description for this rule. | `string` | `null` | no | -| [destination\_address\_prefix](#input\_destination\_address\_prefix) | CIDR or destination IP range or * to match any IP. | `string` | `null` | no | -| [destination\_address\_prefixes](#input\_destination\_address\_prefixes) | List of destination address prefixes. | `set(string)` | `null` | no | +| [destination\_address](#input\_destination\_address) | destination\_address\_prefix - CIDR or destination IP range or `*` to match any IP. Tags such as `VirtualNetwork`, `AzureLoadBalancer` and `Internet` can also be used.
destination\_address\_prefixes - List of destination address prefixes. Tags may not be used. | 
object({
    prefix   = optional(string)
    prefixes = optional(set(string))
  })
| 
{
  "prefix": null,
  "prefixes": null
}
| no | | [destination\_application\_security\_group\_ids](#input\_destination\_application\_security\_group\_ids) | List of destination Application Security Group ID's. | `set(string)` | `null` | no | -| [destination\_port\_range](#input\_destination\_port\_range) | Destination Port or Range. | `string` | `null` | no | -| [destination\_port\_ranges](#input\_destination\_port\_ranges) | List of destination ports or port ranges. | `set(string)` | `null` | no | +| [destination\_port](#input\_destination\_port) | destination\_port\_range - Destination Port or Range. Integer or range between `0` and `65535` or `*` to match any.
destination\_port\_ranges - List of destination ports or port ranges. | 
object({
    range  = optional(string)
    ranges = optional(set(string))
  })
| 
{
  "range": null,
  "ranges": null
}
| no | | [direction](#input\_direction) | Specifies whether the rule will be evaluated on incoming or outgoing traffic. | `string` | n/a | yes | | [name](#input\_name) | The name of the network security rule. | `string` | n/a | yes | | [network\_security\_group\_name](#input\_network\_security\_group\_name) | The name of the network security group to which this rule will be attached. | `string` | n/a | yes | | [priority](#input\_priority) | Specifies the priority of the rule. | `number` | n/a | yes | | [protocol](#input\_protocol) | The network protocol to which this rule applies. | `string` | n/a | yes | | [resource\_group\_name](#input\_resource\_group\_name) | The name of the resource group in which this resource will be provisioned. | `string` | n/a | yes | -| [source\_address\_prefix](#input\_source\_address\_prefix) | CIDR or source IP range or * to match any IP. | `string` | `null` | no | -| [source\_address\_prefixes](#input\_source\_address\_prefixes) | List of source address prefixes. | `set(string)` | `null` | no | +| [source\_address](#input\_source\_address) | source\_address\_prefix - CIDR or source IP range or `*` to match any IP. Tags such as `VirtualNetwork`, `AzureLoadBalancer` and `Internet` can also be used.
source\_address\_prefixes - List of source address prefixes. Tags may not be used. | 
object({
    prefix   = optional(string)
    prefixes = optional(set(string))
  })
| 
{
  "prefix": null,
  "prefixes": null
}
| no | | [source\_application\_security\_group\_ids](#input\_source\_application\_security\_group\_ids) | List of source Application Security Group ID's. | `set(string)` | `null` | no | -| [source\_port\_range](#input\_source\_port\_range) | Source Port or Range. | `string` | `null` | no | -| [source\_port\_ranges](#input\_source\_port\_ranges) | List of source ports or port ranges. | `set(string)` | `null` | no | +| [source\_port](#input\_source\_port) | source\_port\_range - Source Port or Range. Integer or range between `0` and `65535` or `*` to match any.
source\_port\_ranges - List of source ports or port ranges. | 
object({
    range  = optional(string)
    ranges = optional(set(string))
  })
| 
{
  "range": "*",
  "ranges": null
}
| no | ## Outputs diff --git a/modules/azure-network-security-rule/main.tf b/modules/azure-network-security-rule/main.tf index bcf629d..a8a9cfb 100644 --- a/modules/azure-network-security-rule/main.tf +++ b/modules/azure-network-security-rule/main.tf @@ -4,6 +4,7 @@ terraform { required_version = ">= 0.12" + experiments = [module_variable_optional_attrs] } resource "azurerm_network_security_rule" "rule" { @@ -16,15 +17,15 @@ resource "azurerm_network_security_rule" "rule" { priority = var.priority direction = var.direction - source_port_range = var.source_port_range - source_port_ranges = var.source_port_ranges - source_address_prefix = var.source_address_prefix - source_address_prefixes = var.source_address_prefixes + source_port_range = var.source_port.range + source_port_ranges = var.source_port.ranges + source_address_prefix = var.source_address.prefix + source_address_prefixes = var.source_address.prefixes source_application_security_group_ids = var.source_application_security_group_ids - destination_port_range = var.destination_port_range - destination_port_ranges = var.destination_port_ranges - destination_address_prefix = var.destination_address_prefix - destination_address_prefixes = var.destination_address_prefixes + destination_port_range = var.destination_port.range + destination_port_ranges = var.destination_port.ranges + destination_address_prefix = var.destination_address.prefix + destination_address_prefixes = var.destination_address.prefixes destination_application_security_group_ids = var.destination_application_security_group_ids } diff --git a/modules/azure-network-security-rule/vars.tf b/modules/azure-network-security-rule/vars.tf index b6abf08..fcaef58 100644 --- a/modules/azure-network-security-rule/vars.tf +++ b/modules/azure-network-security-rule/vars.tf @@ -66,32 +66,50 @@ variable "direction" { } } -# This is required if `source_port_ranges` is not specified. -variable "source_port_range" { - description = "Source Port or Range." - type = string - default = null -} - -# This is required if `source_port_range` is not specified. -variable "source_port_ranges" { - description = "List of source ports or port ranges." - type = set(string) - default = null -} - -# This is required if `source_address_prefixes` is not specified. -variable "source_address_prefix" { - description = "CIDR or source IP range or * to match any IP." - type = string - default = null +variable "source_port" { + description = <