Azure/terraform-azurerm-subnets

Terraform module to create/provision Azure Virtual Network and Subnets

terraform-azurerm-subnets

Create a basic virtual network in Azure

This Terraform module deploys a Virtual Network in Azure with a subnet or a set of subnets passed in as input parameters.

Basically this module is a modern version of terraform-azurerm-vnet(Github repo).

The terraform-azurerm-vnet module used count because it was the only option, nowadays we encourage using for_each instead, but there is no way for us to refactor existing resources from count to for_each without breaking users' infrastructure.

For the new infrastructure, you should use this module instead of terraform-azurerm-vnet. For existing infrastructure, we'll maintain terraform-azurerm-vnet module, fix bugs and amend new features.

The module does not create nor expose a security group. This would need to be defined separately as additional security rules on subnets in the deployed network.

Terraform and terraform-provider-azurerm version restrictions

Now Terraform core's version is v1.x and terraform-provider-azurerm's version is v3.x.

Example Usage

Please refer to the sub folders under examples folder. You can execute terraform apply command in examples's sub folder to try the module. These examples are tested against every PR with the E2E Test.

Example Usage

Please refer to the sub folders under examples folder. You can execute terraform apply command in examples's sub folder to try the module. These examples are tested against every PR with the E2E Test.

Enable or disable tracing tags

We're using BridgeCrew Yor and yorbox to help manage tags consistently across infrastructure as code (IaC) frameworks. In this module you might see tags like:

resource "azurerm_resource_group" "rg" {
  location = "eastus"
  name     = random_pet.name
  tags = merge(var.tags, (/*<box>*/ (var.tracing_tags_enabled ? { for k, v in /*</box>*/ {
    avm_git_commit           = "3077cc6d0b70e29b6e106b3ab98cee6740c916f6"
    avm_git_file             = "main.tf"
    avm_git_last_modified_at = "2023-05-05 08:57:54"
    avm_git_org              = "lonegunmanb"
    avm_git_repo             = "terraform-yor-tag-test-module"
    avm_yor_trace            = "a0425718-c57d-401c-a7d5-f3d88b2551a4"
  } /*<box>*/ : replace(k, "avm_", var.tracing_tags_prefix) => v } : {}) /*</box>*/))
}

To enable tracing tags, set the variable to true:

module "example" {
  source               = "{module_source}"
  ...
  tracing_tags_enabled = true
}

The tracing_tags_enabled is default to false.

To customize the prefix for your tracing tags, set the tracing_tags_prefix variable value in your Terraform configuration:

module "example" {
  source              = "{module_source}"
  ...
  tracing_tags_prefix = "custom_prefix_"
}

The actual applied tags would be:

{
  custom_prefix_git_commit           = "3077cc6d0b70e29b6e106b3ab98cee6740c916f6"
  custom_prefix_git_file             = "main.tf"
  custom_prefix_git_last_modified_at = "2023-05-05 08:57:54"
  custom_prefix_git_org              = "lonegunmanb"
  custom_prefix_git_repo             = "terraform-yor-tag-test-module"
  custom_prefix_yor_trace            = "a0425718-c57d-401c-a7d5-f3d88b2551a4"
}

Pre-Commit & Pr-Check & Test

Configurations

• Configure Terraform for Azure

We assumed that you have setup service principal's credentials in your environment variables like below:

export ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
export ARM_TENANT_ID="<azure_subscription_tenant_id>"
export ARM_CLIENT_ID="<service_principal_appid>"
export ARM_CLIENT_SECRET="<service_principal_password>"

On Windows Powershell:

$env:ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
$env:ARM_TENANT_ID="<azure_subscription_tenant_id>"
$env:ARM_CLIENT_ID="<service_principal_appid>"
$env:ARM_CLIENT_SECRET="<service_principal_password>"

We provide a docker image to run the pre-commit checks and tests for you: mcr.microsoft.com/azterraform:latest

To run the pre-commit task, we can run the following command:

$ docker run --rm -v $(pwd):/src -w /src mcr.microsoft.com/azterraform:latest make pre-commit

On Windows Powershell:

$ docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest make pre-commit

In pre-commit task, we will:

1. Run terraform fmt -recursive command for your Terraform code.
2. Run terrafmt fmt -f command for markdown files and go code files to ensure that the Terraform code embedded in these files are well formatted.
3. Run go mod tidy and go mod vendor for test folder to ensure that all the dependencies have been synced.
4. Run gofmt for all go code files.
5. Run gofumpt for all go code files.
6. Run terraform-docs on README.md file, then run markdown-table-formatter to format markdown tables in README.md.

Then we can run the pr-check task to check whether our code meets our pipeline's requirement(We strongly recommend you run the following command before you commit):

$ docker run --rm -v $(pwd):/src -w /src mcr.microsoft.com/azterraform:latest make pr-check

On Windows Powershell:

$ docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest make pr-check

To run the e2e-test, we can run the following command:

docker run --rm -v $(pwd):/src -w /src -e ARM_SUBSCRIPTION_ID -e ARM_TENANT_ID -e ARM_CLIENT_ID -e ARM_CLIENT_SECRET mcr.microsoft.com/azterraform:latest make e2e-test

On Windows Powershell:

docker run --rm -v ${pwd}:/src -w /src -e ARM_SUBSCRIPTION_ID -e ARM_TENANT_ID -e ARM_CLIENT_ID -e ARM_CLIENT_SECRET mcr.microsoft.com/azterraform:latest make e2e-test

Prerequisites

• Docker

License

MIT

Requirements

Name	Version
terraform	>= 1.2
azurerm	>= 3.11, < 4.0

Providers

Name	Version
azurerm	>= 3.11, < 4.0

Modules

No modules.

Resources

Name	Type
azurerm_network_ddos_protection_plan.this	resource
azurerm_subnet.subnet	resource
azurerm_subnet_nat_gateway_association.nat_gw	resource
azurerm_subnet_network_security_group_association.vnet	resource
azurerm_subnet_route_table_association.vnet	resource
azurerm_virtual_network.vnet	resource
azurerm_virtual_network_dns_servers.vnet_dns	resource

Inputs

Name	Description	Type	Default	Required
new_network_ddos_protection_plan	- name - (Required) Specifies the name of the Network DDoS Protection Plan. Changing this forces a new resource to be created. - tags - (Optional) A mapping of tags to assign to the resource. --- timeouts block supports the following: - create - (Defaults to 30 minutes) Used when creating the DDoS Protection Plan. - delete - (Defaults to 30 minutes) Used when deleting the DDoS Protection Plan. - read - (Defaults to 5 minutes) Used when retrieving the DDoS Protection Plan. - update - (Defaults to 30 minutes) Used when updating the DDoS Protection Plan.	object({ name = string tags = optional(map(string)) timeouts = optional(object({ create = optional(string) delete = optional(string) read = optional(string) update = optional(string) })) })	null	no
resource_group_name	(Required) The name of the resource group in which to create the subnets. Changing this forces new resources to be created.	string	n/a	yes
subnets	Subnets to create	map(object( { address_prefixes = list(string) # (Required) The address prefixes to use for the subnet. nat_gateway = optional(object({ id = string # (Required) The ID of the NAT Gateway which should be associated with the Subnet. Changing this forces a new resource to be created. })) network_security_group = optional(object({ id = string # (Required) The ID of the Network Security Group which should be associated with the Subnet. Changing this forces a new association to be created. })) private_endpoint_network_policies_enabled = optional(bool, true) # (Optional) Enable or Disable network policies for the private endpoint on the subnet. Setting this to true will Enable the policy and setting this to false will Disable the policy. Defaults to true. private_link_service_network_policies_enabled = optional(bool, true) # (Optional) Enable or Disable network policies for the private link service on the subnet. Setting this to true will Enable the policy and setting this to false will Disable the policy. Defaults to true. route_table = optional(object({ id = string # (Required) The ID of the Route Table which should be associated with the Subnet. Changing this forces a new association to be created. })) service_endpoints = optional(set(string)) # (Optional) The list of Service endpoints to associate with the subnet. Possible values include: Microsoft.AzureActiveDirectory, Microsoft.AzureCosmosDB, Microsoft.ContainerRegistry, Microsoft.EventHub, Microsoft.KeyVault, Microsoft.ServiceBus, Microsoft.Sql, Microsoft.Storage and Microsoft.Web. service_endpoint_policy_ids = optional(set(string)) # (Optional) The list of IDs of Service Endpoint Policies to associate with the subnet. delegations = optional(list( object( { name = string # (Required) A name for this delegation. service_delegation = object({ name = string # (Required) The name of service to delegate to. Possible values include Microsoft.ApiManagement/service, Microsoft.AzureCosmosDB/clusters, Microsoft.BareMetal/AzureVMware, Microsoft.BareMetal/CrayServers, Microsoft.Batch/batchAccounts, Microsoft.ContainerInstance/containerGroups, Microsoft.ContainerService/managedClusters, Microsoft.Databricks/workspaces, Microsoft.DBforMySQL/flexibleServers, Microsoft.DBforMySQL/serversv2, Microsoft.DBforPostgreSQL/flexibleServers, Microsoft.DBforPostgreSQL/serversv2, Microsoft.DBforPostgreSQL/singleServers, Microsoft.HardwareSecurityModules/dedicatedHSMs, Microsoft.Kusto/clusters, Microsoft.Logic/integrationServiceEnvironments, Microsoft.MachineLearningServices/workspaces, Microsoft.Netapp/volumes, Microsoft.Network/managedResolvers, Microsoft.Orbital/orbitalGateways, Microsoft.PowerPlatform/vnetaccesslinks, Microsoft.ServiceFabricMesh/networks, Microsoft.Sql/managedInstances, Microsoft.Sql/servers, Microsoft.StoragePool/diskPools, Microsoft.StreamAnalytics/streamingJobs, Microsoft.Synapse/workspaces, Microsoft.Web/hostingEnvironments, Microsoft.Web/serverFarms, NGINX.NGINXPLUS/nginxDeployments and PaloAltoNetworks.Cloudngfw/firewalls. actions = optional(list(string)) # (Optional) A list of Actions which should be delegated. This list is specific to the service to delegate to. Possible values include Microsoft.Network/networkinterfaces/*, Microsoft.Network/virtualNetworks/subnets/action, Microsoft.Network/virtualNetworks/subnets/join/action, Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action and Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action. }) } ) )) } ))	n/a	yes
tracing_tags_enabled	Whether enable tracing tags that generated by BridgeCrew Yor.	bool	false	no
tracing_tags_prefix	Default prefix for generated tracing tags	string	"avm_"	no
virtual_network_address_space	(Required) The address space that is used the virtual network. You can supply more than one address space.	list(string)	n/a	yes
virtual_network_bgp_community	(Optional) The BGP community attribute in format <as-number>:<community-value>.	string	null	no
virtual_network_ddos_protection_plan	AzureNetwork DDoS Protection Plan.	object({ id = string # (Required) The ID of DDoS Protection Plan. enable = bool # (Required) Enable/disable DDoS Protection Plan on Virtual Network. })	null	no
virtual_network_dns_servers	(Optional) List of IP addresses of DNS servers	object({ dns_servers = list(string) })	null	no
virtual_network_edge_zone	(Optional) Specifies the Edge Zone within the Azure Region where this Virtual Network should exist. Changing this forces a new Virtual Network to be created.	string	null	no
virtual_network_flow_timeout_in_minutes	(Optional) The flow timeout in minutes for the Virtual Network, which is used to enable connection tracking for intra-VM flows. Possible values are between 4 and 30minutes.	number	null	no
virtual_network_location	(Required) The location/region where the virtual network is created. Changing this forces new resources to be created.	string	n/a	yes
virtual_network_name	(Required) The name of the virtual network to which to attach the subnet. Changing this forces a new resource to be created.	string	n/a	yes
virtual_network_tags	(Optional) A mapping of tags to assign to the virtual network.	map(string)	null	no

Outputs

Name	Description
vnet_address_space	The address space of the newly created vNet
vnet_id	The id of the newly created vNet
vnet_location	The location of the newly created vNet
vnet_name	The Name of the newly created vNet
vnet_subnets_name_id	Can be queried subnet-id by subnet name by using lookup(module.vnet.vnet_subnets_name_id, subnet1)