diff --git a/README.md b/README.md index 8a42027..9869818 100644 --- a/README.md +++ b/README.md @@ -49,14 +49,14 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [vnet\_name](#input\_vnet\_name) | The name of the virtual network. | `string` | n/a | yes | -| [azure\_bastion\_security\_rules](#input\_azure\_bastion\_security\_rules) | A map of security rules to be created in the AzureBastionSubnet Network Security Group. The key of the map is the name of the security rule.
This Map contains the required rules for the Azure Bastion Subnet. These rules are required for the Azure Bastion service to work properly.
This map is merged with the default rules and security rules to create the final set of rules for the Azure Bastion Subnet.
hcl
subnets = {
  "AzureBastionSubnet" = {
    address_prefixes                = ["100.0.5.0/24"]
  }
hcl | 
map(object({
    access                                     = string
    name                                       = string
    direction                                  = string
    priority                                   = number
    protocol                                   = string
    description                                = optional(string)
    destination_address_prefix                 = optional(string, null)
    destination_address_prefixes               = optional(set(string), null)
    destination_application_security_group_ids = optional(set(string), null)
    destination_port_range                     = optional(string, null)
    destination_port_ranges                    = optional(set(string), null)
    source_address_prefix                      = optional(string, null)
    source_address_prefixes                    = optional(set(string), null)
    source_application_security_group_ids      = optional(set(string), null)
    source_port_range                          = optional(string, null)
    source_port_ranges                         = optional(set(string), null)
    timeouts = optional(object({
      create = optional(string, "30")
      delete = optional(string, "30")
      read   = optional(string, "5")
      update = optional(string, "30")
    }))
  }))
| 
{
  "Allow-DataPlane-in-from-VirtualNetwork": {
    "access": "Allow",
    "description": "Allow DataPlane traffic from the VirtualNetwork",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "8080",
    "direction": "Inbound",
    "name": "Allow-DataPlane-in-from-VirtualNetwork",
    "priority": 4042,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Allow-DataPlane-in-from-VirtualNetwork-5701": {
    "access": "Allow",
    "description": "Allow DataPlane traffic from the VirtualNetwork on port 5701",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "5701",
    "direction": "Inbound",
    "name": "Allow-DataPlane-in-from-VirtualNetwork-5701",
    "priority": 4043,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Allow-DataPlane-out-to-VirtualNetwork-5701": {
    "access": "Allow",
    "description": "Allow DataPlane traffic to the VirtualNetwork on port 5701",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "5701",
    "direction": "Outbound",
    "name": "Allow-DataPlane-out-to-VirtualNetwork-5701",
    "priority": 4043,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-DataPlane-out-to-VirtualNetwork-8080": {
    "access": "Allow",
    "description": "Allow DataPlane traffic to the VirtualNetwork on port 8080",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "8080",
    "direction": "Outbound",
    "name": "Allow-DataPlane-out-to-VirtualNetwork-8080",
    "priority": 4042,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Http-out-to-Internet": {
    "access": "Allow",
    "description": "Allow HTTP traffic to the Internet",
    "destination_address_prefix": "Internet",
    "destination_port_range": "80",
    "direction": "Outbound",
    "name": "Allow-Http-out-to-Internet",
    "priority": 4045,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Https-in-from-AzureLoadBalancer": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from the AzureLoadBalancer",
    "destination_address_prefix": "*",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-AzureLoadBalancer",
    "priority": 4044,
    "protocol": "Tcp",
    "source_address_prefix": "AzureLoadBalancer",
    "source_port_range": "*"
  },
  "Allow-Https-in-from-GatewayManager": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from the GatewayManager",
    "destination_address_prefix": "*",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-GatewayManager",
    "priority": 4041,
    "protocol": "Tcp",
    "source_address_prefix": "GatewayManager",
    "source_port_range": "*"
  },
  "Allow-Https-in-from-Internet": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from the Internet",
    "destination_address_prefix": "*",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-Internet",
    "priority": 4040,
    "protocol": "Tcp",
    "source_address_prefix": "Internet",
    "source_port_range": "*"
  },
  "Allow-Https-out-to-AzureCloud": {
    "access": "Allow",
    "description": "Allow HTTPS traffic to the AzureCloud",
    "destination_address_prefix": "AzureCloud",
    "destination_port_range": "443",
    "direction": "Outbound",
    "name": "Allow-Https-out-to-AzureCloud",
    "priority": 4044,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Rdp-out-to-VirtualNetwork": {
    "access": "Allow",
    "description": "Allow RDP traffic to the VirtualNetwork",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "3389",
    "direction": "Outbound",
    "name": "Allow-Rdp-out-to-VirtualNetwork",
    "priority": 4040,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Ssh-out-to-VirtualNetwork": {
    "access": "Allow",
    "description": "Allow SSH traffic to the VirtualNetwork",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "22",
    "direction": "Outbound",
    "name": "Allow-Ssh-out-to-VirtualNetwork",
    "priority": 4041,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  }
}
| no | -| [default\_rules](#input\_default\_rules) | A map of default security rules to be created in **every** Network Security Group, except if you specificy "network\_security\_group\_config -> Azure default" in the subnet configuration.
but of course, you can override these defaults by specifying the same rule in a new `default_rules` map.
This map is merged with the security rules map to create the final set of rules for the Network Security Group.
hcl
subnets = {
  "ToolingSubnet" = {
    address_prefixes                = ["100.0.3.0/24"]
    default_outbound_access_enabled = false
    create_network_security_group   = true
    network_security_group_config = {
      azure_default = true
    }
  }
hcl | 
map(object({
    access                                     = string
    name                                       = string
    direction                                  = string
    priority                                   = number
    protocol                                   = string
    description                                = optional(string)
    destination_address_prefix                 = optional(string, null)
    destination_address_prefixes               = optional(set(string), null)
    destination_application_security_group_ids = optional(set(string), null)
    destination_port_range                     = optional(string, null)
    destination_port_ranges                    = optional(set(string), null)
    source_address_prefix                      = optional(string, null)
    source_address_prefixes                    = optional(set(string), null)
    source_application_security_group_ids      = optional(set(string), null)
    source_port_range                          = optional(string, null)
    source_port_ranges                         = optional(set(string), null)
    timeouts = optional(object({
      create = optional(string, "30")
      delete = optional(string, "30")
      read   = optional(string, "5")
      update = optional(string, "30")
    }))
  }))
| 
{
  "Allow-Https-in-from-vnets": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from VNets",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-vnets",
    "priority": 4095,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Allow-Https-out-to-vnets": {
    "access": "Allow",
    "description": "Allow HTTPS traffic to VNets",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "443",
    "direction": "Outbound",
    "name": "Allow-Https-out-to-vnets",
    "priority": 4095,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Deny-Any-Any-Any-In": {
    "access": "Deny",
    "description": "Deny all inbound traffic",
    "destination_address_prefix": "*",
    "destination_port_range": "*",
    "direction": "Inbound",
    "name": "Deny-Any-Any-Any-In",
    "priority": 4096,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Deny-Any-Any-Any-Out": {
    "access": "Deny",
    "description": "Deny all outbound traffic",
    "destination_address_prefix": "*",
    "destination_port_range": "*",
    "direction": "Outbound",
    "name": "Deny-Any-Any-Any-Out",
    "priority": 4096,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  }
}
| no | -| [natgateway](#input\_natgateway) | This object describes the public IP configuration when creating Nat Gateway's with a public IP. If creating more than one public IP, then these values will be used for all public IPs.

- `allocation_method` = (Required) - Defines the allocation method for this IP address. Possible values are Static or Dynamic.
- `ddos_protection_mode` = (Optional) - The DDoS protection mode of the public IP. Possible values are Disabled, Enabled, and VirtualNetworkInherited. Defaults to VirtualNetworkInherited.
- `ddos_protection_plan_id` = (Optional) - The ID of DDoS protection plan associated with the public IP. ddos\_protection\_plan\_id can only be set when ddos\_protection\_mode is Enabled
- `domain_name_label` = (Optional) - Label for the Domain Name. Will be used to make up the FQDN. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system.
- `idle_timeout_in_minutes` = (Optional) - Specifies the timeout for the TCP idle connection. The value can be set between 4 and 30 minutes.
- `inherit_tags` = (Optional) - Defaults to false. Set this to false if only the tags defined on this resource should be applied. - Future functionality leaving in.
- `ip_version` = (Optional) - The IP Version to use, IPv6 or IPv4. Changing this forces a new resource to be created. Only static IP address allocation is supported for IPv6.
- `lock_level` = (Optional) - Set this value to override the resource level lock value. Possible values are `None`, `CanNotDelete`, and `ReadOnly`.
- `name` = (Optional) - The name of the Nat gateway. Changing this forces a new resource to be created.
- `sku` = (Optional) - The SKU of the Public IP. Accepted values are Basic and Standard. Defaults to Standard to support zones by default. Changing this forces a new resource to be created. When sku\_tier is set to Global, sku must be set to Standard.
- `sku_tier` = (Optional) - The SKU tier of the Public IP. Accepted values are Global and Regional. Defaults to Regional
- `zones` = (Optional) - A list of zones where this public IP should be deployed. Defaults to no zone. if you prefer, you can set other values for the zones ["1","2","3"]. Changing this forces a new resource to be created.

Example Inputs:
hcl
  natgateway = {
    name = "my-nat-gw"
  }
hcl | 
object({
    allocation_method       = optional(string, "Static")
    ddos_protection_mode    = optional(string, "VirtualNetworkInherited")
    ddos_protection_plan_id = optional(string, null)
    domain_name_label       = optional(string, null)
    idle_timeout_in_minutes = optional(number, 4)
    inherit_tags            = optional(bool, true)
    ip_version              = optional(string, "IPv4")
    lock_level              = optional(string, null)
    name                    = optional(string, null)
    sku                     = optional(string, "Standard")
    sku_tier                = optional(string, "Regional")
    zones                   = optional(list(string))
  })
| `null` | no | +| [azure\_bastion\_security\_rules](#input\_azure\_bastion\_security\_rules) | A map of security rules to be created in the AzureBastionSubnet Network Security Group. The key of the map is the name of the security rule.
This Map contains the required rules for the Azure Bastion Subnet. These rules are required for the Azure Bastion service to work properly.
This map is merged with the default rules and security rules to create the final set of rules for the Azure Bastion Subnet.
hcl
subnets = {
  "AzureBastionSubnet" = {
    address_prefixes                = ["100.0.5.0/24"]
  }
hcl | 
map(object({
    name                                       = string
    access                                     = string
    direction                                  = string
    priority                                   = number
    protocol                                   = string
    description                                = optional(string)
    destination_address_prefix                 = optional(string, null)
    destination_address_prefixes               = optional(set(string), null)
    destination_application_security_group_ids = optional(set(string), null)
    destination_port_range                     = optional(string, null)
    destination_port_ranges                    = optional(set(string), null)
    source_address_prefix                      = optional(string, null)
    source_address_prefixes                    = optional(set(string), null)
    source_application_security_group_ids      = optional(set(string), null)
    source_port_range                          = optional(string, null)
    source_port_ranges                         = optional(set(string), null)
    timeouts = optional(object({
      create = optional(string, "30")
      delete = optional(string, "30")
      read   = optional(string, "5")
      update = optional(string, "30")
    }))
  }))
| 
{
  "Allow-DataPlane-in-from-VirtualNetwork": {
    "access": "Allow",
    "description": "Allow DataPlane traffic from the VirtualNetwork",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "8080",
    "direction": "Inbound",
    "name": "Allow-DataPlane-in-from-VirtualNetwork",
    "priority": 4042,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Allow-DataPlane-in-from-VirtualNetwork-5701": {
    "access": "Allow",
    "description": "Allow DataPlane traffic from the VirtualNetwork on port 5701",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "5701",
    "direction": "Inbound",
    "name": "Allow-DataPlane-in-from-VirtualNetwork-5701",
    "priority": 4043,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Allow-DataPlane-out-to-VirtualNetwork-5701": {
    "access": "Allow",
    "description": "Allow DataPlane traffic to the VirtualNetwork on port 5701",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "5701",
    "direction": "Outbound",
    "name": "Allow-DataPlane-out-to-VirtualNetwork-5701",
    "priority": 4043,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-DataPlane-out-to-VirtualNetwork-8080": {
    "access": "Allow",
    "description": "Allow DataPlane traffic to the VirtualNetwork on port 8080",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "8080",
    "direction": "Outbound",
    "name": "Allow-DataPlane-out-to-VirtualNetwork-8080",
    "priority": 4042,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Http-out-to-Internet": {
    "access": "Allow",
    "description": "Allow HTTP traffic to the Internet",
    "destination_address_prefix": "Internet",
    "destination_port_range": "80",
    "direction": "Outbound",
    "name": "Allow-Http-out-to-Internet",
    "priority": 4045,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Https-in-from-AzureLoadBalancer": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from the AzureLoadBalancer",
    "destination_address_prefix": "*",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-AzureLoadBalancer",
    "priority": 4044,
    "protocol": "Tcp",
    "source_address_prefix": "AzureLoadBalancer",
    "source_port_range": "*"
  },
  "Allow-Https-in-from-GatewayManager": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from the GatewayManager",
    "destination_address_prefix": "*",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-GatewayManager",
    "priority": 4041,
    "protocol": "Tcp",
    "source_address_prefix": "GatewayManager",
    "source_port_range": "*"
  },
  "Allow-Https-in-from-Internet": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from the Internet",
    "destination_address_prefix": "*",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-Internet",
    "priority": 4040,
    "protocol": "Tcp",
    "source_address_prefix": "Internet",
    "source_port_range": "*"
  },
  "Allow-Https-out-to-AzureCloud": {
    "access": "Allow",
    "description": "Allow HTTPS traffic to the AzureCloud",
    "destination_address_prefix": "AzureCloud",
    "destination_port_range": "443",
    "direction": "Outbound",
    "name": "Allow-Https-out-to-AzureCloud",
    "priority": 4044,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Rdp-out-to-VirtualNetwork": {
    "access": "Allow",
    "description": "Allow RDP traffic to the VirtualNetwork",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "3389",
    "direction": "Outbound",
    "name": "Allow-Rdp-out-to-VirtualNetwork",
    "priority": 4040,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Allow-Ssh-out-to-VirtualNetwork": {
    "access": "Allow",
    "description": "Allow SSH traffic to the VirtualNetwork",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "22",
    "direction": "Outbound",
    "name": "Allow-Ssh-out-to-VirtualNetwork",
    "priority": 4041,
    "protocol": "Tcp",
    "source_address_prefix": "*",
    "source_port_range": "*"
  }
}
| no | +| [default\_rules](#input\_default\_rules) | A map of default security rules to be created in **every** Network Security Group, except if you specificy "network\_security\_group\_config -> Azure default" in the subnet configuration.
but of course, you can override these defaults by specifying the same rule in a new `default_rules` map.
This map is merged with the security rules map to create the final set of rules for the Network Security Group.
hcl
subnets = {
  "ToolingSubnet" = {
    address_prefixes                = ["100.0.3.0/24"]
    default_outbound_access_enabled = false
    create_network_security_group   = true
    network_security_group_config = {
      azure_default = true
    }
  }
hcl | 
map(object({
    name                                       = string
    access                                     = string
    direction                                  = string
    priority                                   = number
    protocol                                   = string
    description                                = optional(string)
    destination_address_prefix                 = optional(string, null)
    destination_address_prefixes               = optional(set(string), null)
    destination_application_security_group_ids = optional(set(string), null)
    destination_port_range                     = optional(string, null)
    destination_port_ranges                    = optional(set(string), null)
    source_address_prefix                      = optional(string, null)
    source_address_prefixes                    = optional(set(string), null)
    source_application_security_group_ids      = optional(set(string), null)
    source_port_range                          = optional(string, null)
    source_port_ranges                         = optional(set(string), null)
    timeouts = optional(object({
      create = optional(string, "30")
      delete = optional(string, "30")
      read   = optional(string, "5")
      update = optional(string, "30")
    }))
  }))
| 
{
  "Allow-Https-in-from-vnets": {
    "access": "Allow",
    "description": "Allow HTTPS traffic from VNets",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "443",
    "direction": "Inbound",
    "name": "Allow-Https-in-from-vnets",
    "priority": 4095,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Allow-Https-out-to-vnets": {
    "access": "Allow",
    "description": "Allow HTTPS traffic to VNets",
    "destination_address_prefix": "VirtualNetwork",
    "destination_port_range": "443",
    "direction": "Outbound",
    "name": "Allow-Https-out-to-vnets",
    "priority": 4095,
    "protocol": "Tcp",
    "source_address_prefix": "VirtualNetwork",
    "source_port_range": "*"
  },
  "Deny-Any-Any-Any-In": {
    "access": "Deny",
    "description": "Deny all inbound traffic",
    "destination_address_prefix": "*",
    "destination_port_range": "*",
    "direction": "Inbound",
    "name": "Deny-Any-Any-Any-In",
    "priority": 4096,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  },
  "Deny-Any-Any-Any-Out": {
    "access": "Deny",
    "description": "Deny all outbound traffic",
    "destination_address_prefix": "*",
    "destination_port_range": "*",
    "direction": "Outbound",
    "name": "Deny-Any-Any-Any-Out",
    "priority": 4096,
    "protocol": "*",
    "source_address_prefix": "*",
    "source_port_range": "*"
  }
}
| no | +| [natgateway](#input\_natgateway) | This object describes the public IP configuration when creating Nat Gateway's with a public IP. If creating more than one public IP, then these values will be used for all public IPs.

- `allocation_method` = (Required) - Defines the allocation method for this IP address. Possible values are Static or Dynamic.
- `ddos_protection_mode` = (Optional) - The DDoS protection mode of the public IP. Possible values are Disabled, Enabled, and VirtualNetworkInherited. Defaults to VirtualNetworkInherited.
- `ddos_protection_plan_id` = (Optional) - The ID of DDoS protection plan associated with the public IP. ddos\_protection\_plan\_id can only be set when ddos\_protection\_mode is Enabled
- `domain_name_label` = (Optional) - Label for the Domain Name. Will be used to make up the FQDN. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system.
- `idle_timeout_in_minutes` = (Optional) - Specifies the timeout for the TCP idle connection. The value can be set between 4 and 30 minutes.
- `inherit_tags` = (Optional) - Defaults to false. Set this to false if only the tags defined on this resource should be applied. - Future functionality leaving in.
- `ip_version` = (Optional) - The IP Version to use, IPv6 or IPv4. Changing this forces a new resource to be created. Only static IP address allocation is supported for IPv6.
- `lock_level` = (Optional) - Set this value to override the resource level lock value. Possible values are `None`, `CanNotDelete`, and `ReadOnly`.
- `name` = (Optional) - The name of the Nat gateway. Changing this forces a new resource to be created.
- `sku` = (Optional) - The SKU of the Public IP. Accepted values are Basic and Standard. Defaults to Standard to support zones by default. Changing this forces a new resource to be created. When sku\_tier is set to Global, sku must be set to Standard.
- `sku_tier` = (Optional) - The SKU tier of the Public IP. Accepted values are Global and Regional. Defaults to Regional
- `zones` = (Optional) - A list of zones where this public IP should be deployed. Defaults to no zone. if you prefer, you can set other values for the zones ["1","2","3"]. Changing this forces a new resource to be created.

Example Inputs:
hcl
  natgateway = {
    name = "my-nat-gw"
  }
hcl | 
object({
    name                    = optional(string, null)
    allocation_method       = optional(string, "Static")
    ddos_protection_mode    = optional(string, "VirtualNetworkInherited")
    ddos_protection_plan_id = optional(string, null)
    domain_name_label       = optional(string, null)
    idle_timeout_in_minutes = optional(number, 4)
    inherit_tags            = optional(bool, true)
    ip_version              = optional(string, "IPv4")
    lock_level              = optional(string, null)
    sku                     = optional(string, "Standard")
    sku_tier                = optional(string, "Regional")
    zones                   = optional(list(string))
  })
| `null` | no | | [private\_dns](#input\_private\_dns) | This object describes the private DNS configuration for the virtual network.

- `zone_name` = (Required) - The name of the private DNS zone.
- `zone_link_enabled` = (Optional) - Whether to link the private DNS zone to the virtual network. Defaults to true.
- `zone_link_name` = (Optional) - The name of the private DNS zone link. Changing this forces a new resource to be created.
- `resource_group_name` = (Optional) - The name of the resource group to link the private DNS zone to. Changing this forces a new resource to be created.

Example Inputs:
hcl
private_dns = {
  "keyvault" = {
    zone_name = "privatelink.vaultcore.azure.net"
  }
  "blob" = {
    zone_name = "privatelink.blob.core.windows.net"
  }
  "azurecr" = {
    zone_name = "privatelink.azurecr.io"
  }
}
hcl | 
map(object({
    zone_name           = string
    zone_link_enabled   = optional(bool, true)
    zone_link_name      = optional(string)
    resource_group_name = optional(string)
  }))
| `null` | no | -| [public\_ip](#input\_public\_ip) | This object describes the public IP configuration when creating a public IP.
Its is preconfigured by the Nat Gateway.

- `allocation_method` = (Optional) - Defines the allocation method for this IP address. Possible values are Static or Dynamic, default is Static.
- `ip_version` = (Optional) - The IP Version to use, IPv6 or IPv4. Changing this forces a new resource to be created. Only static IP address allocation is supported for IPv6, Default is IPv4.
- `name` = (Optional) - The name of the Public IP. Changing this forces a new resource to be created.
- `sku` = (Optional) - The SKU of the Public IP. Accepted values are Basic and Standard. Defaults to Standard. Changing this forces a new resource to be created.
- `sku_tier` = (Optional) - The SKU Tier that should be used for the Public IP. Possible values are Regional and Global. Defaults to Regional. Changing this forces a new resource to be created.
- `zones` = (Optional) - A collection containing the availability zone to allocate the Public IP in. Changing this forces a new resource to be created, Availability Zones are only supported with a Standard SKU and in select regions at this time. Standard SKU Public IP Addresses that do not specify a zone are not zone-redundant by default.
} | 
object({
    allocation_method = optional(string, "Static")
    ip_version        = optional(string, "IPv4")
    name              = optional(string, null)
    sku               = optional(string, "Standard")
    sku_tier          = optional(string, "Regional")
    zones             = optional(list(string))
  })
| `{}` | no | +| [public\_ip](#input\_public\_ip) | This object describes the public IP configuration when creating a public IP.
Its is preconfigured by the Nat Gateway.

- `allocation_method` = (Optional) - Defines the allocation method for this IP address. Possible values are Static or Dynamic, default is Static.
- `ip_version` = (Optional) - The IP Version to use, IPv6 or IPv4. Changing this forces a new resource to be created. Only static IP address allocation is supported for IPv6, Default is IPv4.
- `name` = (Optional) - The name of the Public IP. Changing this forces a new resource to be created.
- `sku` = (Optional) - The SKU of the Public IP. Accepted values are Basic and Standard. Defaults to Standard. Changing this forces a new resource to be created.
- `sku_tier` = (Optional) - The SKU Tier that should be used for the Public IP. Possible values are Regional and Global. Defaults to Regional. Changing this forces a new resource to be created.
- `zones` = (Optional) - A collection containing the availability zone to allocate the Public IP in. Changing this forces a new resource to be created, Availability Zones are only supported with a Standard SKU and in select regions at this time. Standard SKU Public IP Addresses that do not specify a zone are not zone-redundant by default.
} | 
object({
    name              = optional(string, null)
    allocation_method = optional(string, "Static")
    ip_version        = optional(string, "IPv4")
    sku               = optional(string, "Standard")
    sku_tier          = optional(string, "Regional")
    zones             = optional(list(string))
  })
| `{}` | no | | [resource\_group](#input\_resource\_group) | The name of the resource group in which to create the resources. | 
object({
    name     = string
    location = string
  })
| 
{
  "location": null,
  "name": null
}
| no | -| [security\_rules](#input\_security\_rules) | A map of security rules to be created in **every** Network Security Group. The key of the map is the name of the security rule.

- `access` - (Required) Specifies whether network traffic is allowed or denied. Possible values are `Allow` and `Deny`.
- `name` - (Required) Name of the network security rule to be created.
- `description` - (Optional) A description for this rule. Restricted to 140 characters.
- `destination_address_prefix` - (Optional) CIDR or destination IP range or * to match any IP. Tags such as `VirtualNetwork`, `AzureLoadBalancer` and `Internet` can also be used. Besides, it also supports all available Service Tags like ‘Sql.WestEurope‘, ‘Storage.EastUS‘, etc. You can list the available service tags with the CLI:
shell az network list-service-tags --location westcentralus
. For further information please see [Azure CLI
- `destination_address_prefixes` - (Optional) List of destination address prefixes. Tags may not be used. This is required if `destination_address_prefix` is not specified.
- `destination_application_security_group_ids` - (Optional) A List of destination Application Security Group IDs
- `destination_port_range` - (Optional) Destination Port or Range. Integer or range between `0` and `65535` or `*` to match any. This is required if `destination_port_ranges` is not specified.
- `destination_port_ranges` - (Optional) List of destination ports or port ranges. This is required if `destination_port_range` is not specified.
- `direction` - (Required) The direction specifies if rule will be evaluated on incoming or outgoing traffic. Possible values are `Inbound` and `Outbound`.
- `name` - (Required) The name of the security rule. This needs to be unique across all Rules in the Network Security Group. Changing this forces a new resource to be created.
- `priority` - (Required) Specifies the priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule.
- `protocol` - (Required) Network protocol this rule applies to. Possible values include `Tcp`, `Udp`, `Icmp`, `Esp`, `Ah` or `*` (which matches all).
- `resource_group_name` - (Required) The name of the resource group in which to create the Network Security Rule. Changing this forces a new resource to be created.
- `source_address_prefix` - (Optional) CIDR or source IP range or * to match any IP. Tags such as `VirtualNetwork`, `AzureLoadBalancer` and `Internet` can also be used. This is required if `source_address_prefixes` is not specified.
- `source_address_prefixes` - (Optional) List of source address prefixes. Tags may not be used. This is required if `source_address_prefix` is not specified.
- `source_application_security_group_ids` - (Optional) A List of source Application Security Group IDs
- `source_port_range` - (Optional) Source Port or Range. Integer or range between `0` and `65535` or `*` to match any. This is required if `source_port_ranges` is not specified.
- `source_port_ranges` - (Optional) List of source ports or port ranges. This is required if `source_port_range` is not specified.

---
`timeouts` block supports the following:
- `create` - (Defaults to 30 minutes) Used when creating the Network Security Rule.
- `delete` - (Defaults to 30 minutes) Used when deleting the Network Security Rule.
- `read` - (Defaults to 5 minutes) Used when retrieving the Network Security Rule.
- `update` - (Defaults to 30 minutes) Used when updating the Network Security Rule.
hcl
security_rules = {
  "test" = {
    access                     = "Allow"
    name                       = "BLAAAAAA"
    description                = "Allow HTTPS traffic to the Internet"
    destination_address_prefix = "Internet"
    destination_port_range     = "443"
    direction                  = "Outbound"
    priority                   = 555
    protocol                   = "Tcp"
    source_address_prefix      = "VirtualNetwork"
    source_port_range          = "*"
  }
}
hcl | 
map(object({
    access                                     = string
    name                                       = string
    description                                = optional(string)
    destination_address_prefix                 = optional(string)
    destination_address_prefixes               = optional(set(string))
    destination_application_security_group_ids = optional(set(string))
    destination_port_range                     = optional(string)
    destination_port_ranges                    = optional(set(string))
    direction                                  = string
    priority                                   = number
    protocol                                   = string
    source_address_prefix                      = optional(string)
    source_address_prefixes                    = optional(set(string))
    source_application_security_group_ids      = optional(set(string))
    source_port_range                          = optional(string)
    source_port_ranges                         = optional(set(string))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
| `{}` | no | -| [subnets](#input\_subnets) | This object describes the subnets to create within the virtual network.

- `address_prefix` = (Optional) - The address prefix to use for the subnet. Changing this forces a new resource to be created.
- `address_prefixes` = (Optional) - The address prefixes to use for the subnet. Changing this forces a new resource to be created.
- `name` = (Optional) - The name of the subnet. Changing this forces a new resource to be created.
- `create_network_security_group` = (Optional) - Whether to create a specific Network Security Group for the subnet. Defaults to false.
- `network_security_group_config` = (Optional) - The configuration for the Network Security Group. Changing this forces a new resource to be created.
`azure_default` = (Optional) - Whether to use the Azure default Network Security Group rules. Defaults to false.
- `network_security_group_id` = (Optional) - The ID of the Network Security Group to associate with the subnet. Changing this forces a new resource to be created.
- `no_nsg_association` = (Optional) - Whether to associate a Network Security Group with the subnet. Defaults to false.
- `nat_gateway` = (Optional) - The NAT Gateway to associate with the subnet. Changing this forces a new resource to be created.
- `network_security_group` = (Optional) - The Network Security Group to associate with the subnet. Changing this forces a new resource to be created.
- `private_endpoint_network_policies` = (Optional) - The network policies for private endpoints on the subnet. Possible values are Enabled and Disabled. Defaults to Enabled.
- `private_link_service_network_policies_enabled` = (Optional) - Enable or disable network policies for private link service on the subnet. Defaults to true.
- `route_table` = (Optional) - The Route Table to associate with the subnet. Changing this forces a new resource to be created.
- `service_endpoint_policies` = (Optional) - The service endpoint policies to associate with the subnet. Changing this forces a new resource to be created.
- `service_endpoints` = (Optional) - The service endpoints to associate with the subnet. Changing this forces a new resource to be created.
- `default_outbound_access_enabled` = (Optional) - Whether to allow outbound traffic from the subnet. Defaults to false.
- `sharing_scope` = (Optional) - The sharing scope of the subnet. Possible values are None, Shared, and Service. Defaults to None.
- `delegate_to` = (Optional) - The service to delegate to. Changing this forces a new resource to be created.
- `timeouts` = (Optional) - The timeouts for the subnet.
- `role_assignments` = (Optional) - The role assignments for the subnet.

Example Inputs:
hcl
subnets = {
  "CoreSubnet" = {
    address_prefixes                = ["100.0.1.0/24"]
    default_outbound_access_enabled = false
  }
  "DevopsSubnet" = {
    address_prefixes                = ["100.0.2.0/24"]
    default_outbound_access_enabled = false
    delegate_to                     = "Microsoft.ContainerInstance/containerGroups"
    create_network_security_group   = true
  }
  "ToolingSubnet" = {
    address_prefixes                = ["100.0.3.0/24"]
    default_outbound_access_enabled = false
    create_network_security_group   = true
    network_security_group_config = {
      azure_default = true
    }
  }
  "OtherSubnet" = {
    address_prefixes                = ["100.0.4.0/24"]
    default_outbound_access_enabled = false
    no_nsg_association              = true
  }
  "AzureBastionSubnet" = {
    address_prefixes                = ["100.0.5.0/24"]
    default_outbound_access_enabled = false
  }
}
hcl | 
map(object({
    address_prefix                  = optional(string)
    address_prefixes                = optional(list(string))
    default_outbound_access_enabled = optional(bool, false)
    delegate_to                     = optional(string, null)
    nat_gateway = optional(object({
      id = string
    }))
    name                          = optional(string)
    no_nsg_association            = optional(bool, false)
    create_network_security_group = optional(bool, false)
    network_security_group_config = optional(object({
      azure_default = optional(bool, false)
    }), null)
    network_security_group_id                     = optional(string, null)
    private_endpoint_network_policies             = optional(string, "Enabled")
    private_link_service_network_policies_enabled = optional(bool, true)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })))
    route_table = optional(object({
      id = string
    }))
    service_endpoint_policies = optional(map(object({
      id = string
    })))
    service_endpoints = optional(set(string))
    sharing_scope     = optional(string, null)
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
| `{}` | no | +| [security\_rules](#input\_security\_rules) | A map of security rules to be created in **every** Network Security Group. The key of the map is the name of the security rule.

- `access` - (Required) Specifies whether network traffic is allowed or denied. Possible values are `Allow` and `Deny`.
- `name` - (Required) Name of the network security rule to be created.
- `description` - (Optional) A description for this rule. Restricted to 140 characters.
- `destination_address_prefix` - (Optional) CIDR or destination IP range or * to match any IP. Tags such as `VirtualNetwork`, `AzureLoadBalancer` and `Internet` can also be used. Besides, it also supports all available Service Tags like ‘Sql.WestEurope‘, ‘Storage.EastUS‘, etc. You can list the available service tags with the CLI:
shell az network list-service-tags --location westcentralus
. For further information please see [Azure CLI
- `destination_address_prefixes` - (Optional) List of destination address prefixes. Tags may not be used. This is required if `destination_address_prefix` is not specified.
- `destination_application_security_group_ids` - (Optional) A List of destination Application Security Group IDs
- `destination_port_range` - (Optional) Destination Port or Range. Integer or range between `0` and `65535` or `*` to match any. This is required if `destination_port_ranges` is not specified.
- `destination_port_ranges` - (Optional) List of destination ports or port ranges. This is required if `destination_port_range` is not specified.
- `direction` - (Required) The direction specifies if rule will be evaluated on incoming or outgoing traffic. Possible values are `Inbound` and `Outbound`.
- `name` - (Required) The name of the security rule. This needs to be unique across all Rules in the Network Security Group. Changing this forces a new resource to be created.
- `priority` - (Required) Specifies the priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule.
- `protocol` - (Required) Network protocol this rule applies to. Possible values include `Tcp`, `Udp`, `Icmp`, `Esp`, `Ah` or `*` (which matches all).
- `resource_group_name` - (Required) The name of the resource group in which to create the Network Security Rule. Changing this forces a new resource to be created.
- `source_address_prefix` - (Optional) CIDR or source IP range or * to match any IP. Tags such as `VirtualNetwork`, `AzureLoadBalancer` and `Internet` can also be used. This is required if `source_address_prefixes` is not specified.
- `source_address_prefixes` - (Optional) List of source address prefixes. Tags may not be used. This is required if `source_address_prefix` is not specified.
- `source_application_security_group_ids` - (Optional) A List of source Application Security Group IDs
- `source_port_range` - (Optional) Source Port or Range. Integer or range between `0` and `65535` or `*` to match any. This is required if `source_port_ranges` is not specified.
- `source_port_ranges` - (Optional) List of source ports or port ranges. This is required if `source_port_range` is not specified.

---
`timeouts` block supports the following:
- `create` - (Defaults to 30 minutes) Used when creating the Network Security Rule.
- `delete` - (Defaults to 30 minutes) Used when deleting the Network Security Rule.
- `read` - (Defaults to 5 minutes) Used when retrieving the Network Security Rule.
- `update` - (Defaults to 30 minutes) Used when updating the Network Security Rule.
hcl
security_rules = {
  "test" = {
    access                     = "Allow"
    name                       = "BLAAAAAA"
    description                = "Allow HTTPS traffic to the Internet"
    destination_address_prefix = "Internet"
    destination_port_range     = "443"
    direction                  = "Outbound"
    priority                   = 555
    protocol                   = "Tcp"
    source_address_prefix      = "VirtualNetwork"
    source_port_range          = "*"
  }
}
hcl | 
map(object({
    name                                       = string
    access                                     = string
    description                                = optional(string)
    destination_address_prefix                 = optional(string)
    destination_address_prefixes               = optional(set(string))
    destination_application_security_group_ids = optional(set(string))
    destination_port_range                     = optional(string)
    destination_port_ranges                    = optional(set(string))
    direction                                  = string
    priority                                   = number
    protocol                                   = string
    source_address_prefix                      = optional(string)
    source_address_prefixes                    = optional(set(string))
    source_application_security_group_ids      = optional(set(string))
    source_port_range                          = optional(string)
    source_port_ranges                         = optional(set(string))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
| `{}` | no | +| [subnets](#input\_subnets) | This object describes the subnets to create within the virtual network.

- `address_prefix` = (Optional) - The address prefix to use for the subnet. Changing this forces a new resource to be created.
- `address_prefixes` = (Optional) - The address prefixes to use for the subnet. Changing this forces a new resource to be created.
- `name` = (Optional) - The name of the subnet. Changing this forces a new resource to be created.
- `create_network_security_group` = (Optional) - Whether to create a specific Network Security Group for the subnet. Defaults to false.
- `network_security_group_config` = (Optional) - The configuration for the Network Security Group. Changing this forces a new resource to be created.
`azure_default` = (Optional) - Whether to use the Azure default Network Security Group rules. Defaults to false.
- `network_security_group_id` = (Optional) - The ID of the Network Security Group to associate with the subnet. Changing this forces a new resource to be created.
- `no_nsg_association` = (Optional) - Whether to associate a Network Security Group with the subnet. Defaults to false.
- `nat_gateway` = (Optional) - The NAT Gateway to associate with the subnet. Changing this forces a new resource to be created.
- `network_security_group` = (Optional) - The Network Security Group to associate with the subnet. Changing this forces a new resource to be created.
- `private_endpoint_network_policies` = (Optional) - The network policies for private endpoints on the subnet. Possible values are Enabled and Disabled. Defaults to Enabled.
- `private_link_service_network_policies_enabled` = (Optional) - Enable or disable network policies for private link service on the subnet. Defaults to true.
- `route_table` = (Optional) - The Route Table to associate with the subnet. Changing this forces a new resource to be created.
- `service_endpoint_policies` = (Optional) - The service endpoint policies to associate with the subnet. Changing this forces a new resource to be created.
- `service_endpoints` = (Optional) - The service endpoints to associate with the subnet. Changing this forces a new resource to be created.
- `default_outbound_access_enabled` = (Optional) - Whether to allow outbound traffic from the subnet. Defaults to false.
- `sharing_scope` = (Optional) - The sharing scope of the subnet. Possible values are None, Shared, and Service. Defaults to None.
- `delegate_to` = (Optional) - The service to delegate to. Changing this forces a new resource to be created.
- `timeouts` = (Optional) - The timeouts for the subnet.
- `role_assignments` = (Optional) - The role assignments for the subnet.

Example Inputs:
hcl
subnets = {
  "CoreSubnet" = {
    address_prefixes                = ["100.0.1.0/24"]
    default_outbound_access_enabled = false
  }
  "DevopsSubnet" = {
    address_prefixes                = ["100.0.2.0/24"]
    default_outbound_access_enabled = false
    delegate_to                     = "Microsoft.ContainerInstance/containerGroups"
    create_network_security_group   = true
  }
  "ToolingSubnet" = {
    address_prefixes                = ["100.0.3.0/24"]
    default_outbound_access_enabled = false
    create_network_security_group   = true
    network_security_group_config = {
      azure_default = true
    }
  }
  "OtherSubnet" = {
    address_prefixes                = ["100.0.4.0/24"]
    default_outbound_access_enabled = false
    no_nsg_association              = true
  }
  "AzureBastionSubnet" = {
    address_prefixes                = ["100.0.5.0/24"]
    default_outbound_access_enabled = false
  }
}
hcl | 
map(object({
    name                            = optional(string)
    address_prefix                  = optional(string)
    address_prefixes                = optional(list(string))
    default_outbound_access_enabled = optional(bool, false)
    delegate_to                     = optional(string, null)
    nat_gateway = optional(object({
      id = string
    }))
    no_nsg_association            = optional(bool, false)
    create_network_security_group = optional(bool, false)
    network_security_group_config = optional(object({
      azure_default = optional(bool, false)
    }), null)
    network_security_group_id                     = optional(string, null)
    private_endpoint_network_policies             = optional(string, "Enabled")
    private_link_service_network_policies_enabled = optional(bool, true)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })))
    route_table = optional(object({
      id = string
    }))
    service_endpoint_policies = optional(map(object({
      id = string
    })))
    service_endpoints = optional(set(string))
    sharing_scope     = optional(string, null)
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
| `{}` | no | | [tags](#input\_tags) | A map of tags to assign to the resource. | `map(string)` | `{}` | no | | [vnet\_address\_space](#input\_vnet\_address\_space) | The address space that is used by the virtual network. | `list(string)` | 
[
  "10.0.0.0/16"
]
| no | | [vnet\_dns\_servers](#input\_vnet\_dns\_servers) | The DNS servers to be used by the virtual network. | `list(string)` | `[]` | no |