Skip to content

Commit e37a3bb

Browse files
chkp-natanelmchkp-natanelm
committed
Azure vWAN Terraform | Added managed identity support
1 parent 4499a39 commit e37a3bb

File tree

6 files changed

+297
-171
lines changed

6 files changed

+297
-171
lines changed

Diff for: ‎terraform/azure/nva-into-existing-hub/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ please see the [CloudGuard Network for Azure Virtual WAN Deployment Guide](https
1818
- Choose the preferred login method to Azure in order to deploy the solution:
1919
<br>1. Using Service Principal:
2020
- Create a [Service Principal](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) (or use the existing one)
21-
- Grant the Service Principal at least "**Contributor**" permissions to the Azure subscription<br>
21+
- Grant the Service Principal at least "**Contributor**" and "**User Access Administrator**" permissions to the Azure subscription<br>
2222
- The Service Principal credentials can be stored either in the terraform.tfvars or as [Environment Variables](https://www.terraform.io/docs/providers/azuread/guides/service_principal_client_secret.html)<br>
2323

2424
In case the Environment Variables are used, perform modifications described below:<br>

Diff for: ‎terraform/azure/nva-into-existing-hub/main.tf

+136-84
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ locals {
5858
routing-intent-policies = var.routing-intent-internet-traffic == "yes" ? (var.routing-intent-private-traffic == "yes" ? tolist([local.routing_intent-internet-policy, local.routing_intent-private-policy]) : tolist([local.routing_intent-internet-policy])) : (var.routing-intent-private-traffic == "yes" ? tolist([local.routing_intent-private-policy]) : [])
5959
req_body = jsonencode({"properties": {"routingPolicies": local.routing-intent-policies}})
6060
req_url = "https://management.azure.com/subscriptions/${var.subscription_id}/resourceGroups/${var.vwan-hub-resource-group}/providers/Microsoft.Network/virtualHubs/${var.vwan-hub-name}/routingIntent/hubRoutingIntent?api-version=2022-01-01"
61+
public_ip_resource_group = var.new-public-ip == "yes" ? azurerm_resource_group.managed-app-rg.name : "/subscriptions/${var.subscription_id}/resourceGroups/${split("/", var.existing-public-ip)[4]}"
6162
}
6263

6364
//********************** Marketplace Terms & Solution Registration **************************//
@@ -91,101 +92,152 @@ resource "azurerm_resource_provider_registration" "solutions" {
9192
name = "Microsoft.Solutions"
9293
}
9394

95+
//********************** Managed Identiy **************************//
96+
resource "azurerm_user_assigned_identity" "managed_app_identiy" {
97+
location = azurerm_resource_group.managed-app-rg.location
98+
name = "managed_app_identiy"
99+
resource_group_name = azurerm_resource_group.managed-app-rg.name
100+
}
101+
102+
resource "azurerm_role_assignment" "reader" {
103+
depends_on = [azurerm_user_assigned_identity.managed_app_identiy]
104+
scope = data.azurerm_virtual_hub.vwan-hub.id
105+
role_definition_name = "Reader"
106+
principal_id = azurerm_user_assigned_identity.managed_app_identiy.principal_id
107+
}
108+
109+
resource "random_id" "randomId" {
110+
keepers = {
111+
resource_group = azurerm_resource_group.managed-app-rg.name
112+
}
113+
byte_length = 8
114+
}
115+
116+
resource "azurerm_role_definition" "public-ip-join-role" {
117+
count = var.new-public-ip == "yes" || length(var.existing-public-ip) > 0 ? 1 : 0
118+
name = "Managed Application Public IP Join Role - ${random_id.randomId.hex}"
119+
scope = local.public_ip_resource_group
120+
permissions {
121+
actions = ["Microsoft.Network/publicIPAddresses/join/action"]
122+
not_actions = []
123+
}
124+
assignable_scopes = [local.public_ip_resource_group]
125+
}
126+
127+
resource "azurerm_role_assignment" "public-ip-join-role-assignment" {
128+
count = var.new-public-ip == "yes" || length(var.existing-public-ip) > 0 ? 1 : 0
129+
scope = local.public_ip_resource_group
130+
role_definition_id = azurerm_role_definition.public-ip-join-role[0].role_definition_resource_id
131+
principal_id = azurerm_user_assigned_identity.managed_app_identiy.principal_id
132+
}
94133

95134
//********************** Managed Application Configuration **************************//
96-
resource "azurerm_managed_application" "nva" {
135+
resource "azapi_resource" "managed-app" {
97136
depends_on = [azurerm_marketplace_agreement.accept-marketplace-terms, azurerm_resource_provider_registration.solutions]
98-
name = var.managed-app-name
99-
location = azurerm_resource_group.managed-app-rg.location
100-
resource_group_name = azurerm_resource_group.managed-app-rg.name
101-
kind = "MarketPlace"
102-
managed_resource_group_name = var.nva-rg-name
103-
104-
plan {
105-
name = "vwan-app"
106-
product = "cp-vwan-managed-app"
107-
publisher = "checkpoint"
108-
version = "1.0.16"
137+
type = "Microsoft.Solutions/applications@2019-07-01"
138+
name = var.managed-app-name
139+
location = azurerm_resource_group.managed-app-rg.location
140+
parent_id = azurerm_resource_group.managed-app-rg.id
141+
body = {
142+
kind = "MarketPlace",
143+
plan = {
144+
name = "vwan-app"
145+
product = "cp-vwan-managed-app"
146+
publisher = "checkpoint"
147+
version = "1.0.21"
148+
},
149+
identity = {
150+
type = "UserAssigned"
151+
userAssignedIdentities = {
152+
(azurerm_user_assigned_identity.managed_app_identiy.id) = {}
153+
}
154+
},
155+
properties = {
156+
parameters = {
157+
location = {
158+
value = azurerm_resource_group.managed-app-rg.location
159+
},
160+
hubId = {
161+
value = data.azurerm_virtual_hub.vwan-hub.id
162+
},
163+
osVersion = {
164+
value = var.os-version
165+
},
166+
LicenseType = {
167+
value = var.license-type
168+
},
169+
imageVersion = {
170+
value = element(local.image_versions, length(local.image_versions) -1)
171+
},
172+
scaleUnit = {
173+
value = var.scale-unit
174+
},
175+
bootstrapScript = {
176+
value = var.bootstrap-script
177+
},
178+
adminShell = {
179+
value = var.admin-shell
180+
},
181+
sicKey = {
182+
value = var.sic-key
183+
},
184+
sshPublicKey = {
185+
value = var.ssh-public-key
186+
},
187+
BGP = {
188+
value = var.bgp-asn
189+
},
190+
NVA = {
191+
value = var.nva-name
192+
},
193+
customMetrics = {
194+
value = var.custom-metrics
195+
},
196+
hubASN = {
197+
value = data.azurerm_virtual_hub.vwan-hub.virtual_router_asn
198+
},
199+
hubPeers = {
200+
value = data.azurerm_virtual_hub.vwan-hub.virtual_router_ips
201+
},
202+
smart1CloudTokenA = {
203+
value = var.smart1-cloud-token-a
204+
},
205+
smart1CloudTokenB = {
206+
value = var.smart1-cloud-token-b
207+
},
208+
smart1CloudTokenC = {
209+
value = var.smart1-cloud-token-c
210+
},
211+
smart1CloudTokenD = {
212+
value = var.smart1-cloud-token-d
213+
},
214+
smart1CloudTokenE = {
215+
value = var.smart1-cloud-token-e
216+
},
217+
publicIPIngress = {
218+
value = (var.new-public-ip == "yes" || length(var.existing-public-ip) > 0) ? "yes" : "no"
219+
},
220+
createNewIPIngress = {
221+
value = var.new-public-ip
222+
},
223+
ipIngressExistingResourceId = {
224+
value = var.existing-public-ip
225+
},
226+
templateName = {
227+
value = "wan_terraform"
228+
}
229+
},
230+
managedResourceGroupId = "/subscriptions/${var.subscription_id}/resourcegroups/${var.nva-rg-name}"
231+
}
109232
}
110-
parameter_values = jsonencode({
111-
location = {
112-
value = azurerm_resource_group.managed-app-rg.location
113-
},
114-
hubId = {
115-
value = data.azurerm_virtual_hub.vwan-hub.id
116-
},
117-
osVersion = {
118-
value = var.os-version
119-
},
120-
LicenseType = {
121-
value = var.license-type
122-
},
123-
imageVersion = {
124-
value = element(local.image_versions, length(local.image_versions) -1)
125-
},
126-
scaleUnit = {
127-
value = var.scale-unit
128-
},
129-
bootstrapScript = {
130-
value = var.bootstrap-script
131-
},
132-
adminShell = {
133-
value = var.admin-shell
134-
},
135-
sicKey = {
136-
value = var.sic-key
137-
},
138-
sshPublicKey = {
139-
value = var.ssh-public-key
140-
},
141-
BGP = {
142-
value = var.bgp-asn
143-
},
144-
NVA = {
145-
value = var.nva-name
146-
},
147-
customMetrics = {
148-
value = var.custom-metrics
149-
},
150-
hubASN = {
151-
value = data.azurerm_virtual_hub.vwan-hub.virtual_router_asn
152-
},
153-
hubPeers = {
154-
value = data.azurerm_virtual_hub.vwan-hub.virtual_router_ips
155-
},
156-
smart1CloudTokenA = {
157-
value = var.smart1-cloud-token-a
158-
},
159-
smart1CloudTokenB = {
160-
value = var.smart1-cloud-token-b
161-
},
162-
smart1CloudTokenC = {
163-
value = var.smart1-cloud-token-c
164-
},
165-
smart1CloudTokenD = {
166-
value = var.smart1-cloud-token-d
167-
},
168-
smart1CloudTokenE = {
169-
value = var.smart1-cloud-token-e
170-
},
171-
publicIPIngress = {
172-
value = (var.new-public-ip == "yes" || length(var.existing-public-ip) > 0) ? "yes" : "no"
173-
},
174-
createNewIPIngress = {
175-
value = var.new-public-ip
176-
}
177-
ipIngressExistingResourceId = {
178-
value = var.existing-public-ip
179-
}
180-
})
181233
}
182234

183235
//********************** Routing Intent **************************//
184236

185237

186238
data "external" "update-routing-intent" {
187239
count = length(local.routing-intent-policies) != 0 ? 1 : 0
188-
depends_on = [azurerm_managed_application.nva]
240+
depends_on = [azapi_resource.managed-app]
189241
program = ["python", "../modules/add-routing-intent.py", "${local.req_url}", "${local.req_body}", "${local.access_token}"]
190242
}
191243

Diff for: ‎terraform/azure/nva-into-existing-hub/versions.tf

+11-1
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,23 @@ terraform {
55
source = "hashicorp/azurerm"
66
version = "~> 3.90.0"
77
}
8+
azapi = {
9+
source = "Azure/azapi"
10+
version = "~> 2.2.0"
11+
}
12+
random = {
13+
version = "~> 3.5.1"
14+
}
815
}
916
}
1017

18+
provider "azapi" {
19+
}
20+
1121
provider "azurerm" {
1222
subscription_id = var.subscription_id
1323
client_id = var.client_id
1424
client_secret = var.client_secret
1525
tenant_id = var.tenant_id
1626
features {}
17-
}
27+
}

Diff for: ‎terraform/azure/nva-into-new-vwan/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ please see the [CloudGuard Network for Azure Virtual WAN Deployment Guide](https
2121
- Choose the preferred login method to Azure in order to deploy the solution:
2222
<br>1. Using Service Principal:
2323
- Create a [Service Principal](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) (or use the existing one)
24-
- Grant the Service Principal at least "**Contributor**" permissions to the Azure subscription<br>
24+
- Grant the Service Principal at least "**Contributor**" and "**User Access Administrator**" permissions to the Azure subscription<br>
2525
- The Service Principal credentials can be stored either in the terraform.tfvars or as [Environment Variables](https://www.terraform.io/docs/providers/azuread/guides/service_principal_client_secret.html)<br>
2626

2727
In case the Environment Variables are used, perform modifications described below:<br>

0 commit comments

Comments
 (0)