|
1 | | -resource "azurerm_public_ip" "azure_bastion" { |
2 | | - name = "pip-azure-bastion" |
3 | | - location = azurerm_resource_group.default.location |
4 | | - resource_group_name = azurerm_resource_group.default.name |
5 | | - allocation_method = "Static" |
6 | | - sku = "Standard" |
| 1 | +resource "azurerm_public_ip" "azure_bastion" { |
| 2 | + name = "pip-azure-bastion" |
| 3 | + location = azurerm_resource_group.default.location |
| 4 | + resource_group_name = azurerm_resource_group.default.name |
| 5 | + allocation_method = "Static" |
| 6 | + sku = "Standard" |
7 | 7 | } |
8 | 8 |
|
9 | | -resource "azurerm_network_security_group" "bastion_nsg" { |
10 | | - name = "nsg-bastion" |
11 | | - location = azurerm_resource_group.default.location |
12 | | - resource_group_name = azurerm_resource_group.default.name |
| 9 | +resource "azurerm_network_security_group" "bastion_nsg" { |
| 10 | + name = "nsg-bastion" |
| 11 | + location = azurerm_resource_group.default.location |
| 12 | + resource_group_name = azurerm_resource_group.default.name |
13 | 13 |
|
14 | | - security_rule { |
15 | | - name = "AllowHTTPSInbound" |
16 | | - priority = 100 |
17 | | - direction = "Inbound" |
18 | | - access = "Allow" |
19 | | - protocol = "Tcp" |
20 | | - source_port_range = "*" |
21 | | - destination_port_range = "443" |
22 | | - source_address_prefix = "Internet" |
23 | | - destination_address_prefix = "*" |
24 | | - } |
25 | | - security_rule { |
26 | | - name = "AllowGatewayManagerInbound" |
27 | | - priority = 200 |
28 | | - direction = "Inbound" |
29 | | - access = "Allow" |
30 | | - protocol = "Tcp" |
31 | | - source_port_range = "*" |
32 | | - destination_port_range = "443" |
33 | | - source_address_prefix = "GatewayManager" |
34 | | - destination_address_prefix = "*" |
35 | | - } |
36 | | - security_rule { |
37 | | - name = "AllowAzureLBInbound" |
38 | | - priority = 300 |
39 | | - direction = "Inbound" |
40 | | - access = "Allow" |
41 | | - protocol = "Tcp" |
42 | | - source_port_range = "*" |
43 | | - destination_port_range = "443" |
44 | | - source_address_prefix = "AzureLoadBalancer" |
45 | | - destination_address_prefix = "*" |
46 | | - } |
47 | | - security_rule { |
48 | | - name = "AllowBastionHostCommunication" |
49 | | - priority = 400 |
50 | | - direction = "Inbound" |
51 | | - access = "Allow" |
52 | | - protocol = "*" |
53 | | - source_port_range = "*" |
54 | | - destination_port_ranges = ["5701","8080"] |
55 | | - source_address_prefix = "VirtualNetwork" |
56 | | - destination_address_prefix = "VirtualNetwork" |
57 | | - } |
58 | | - security_rule { |
59 | | - name = "AllowRdpSshOutbound" |
60 | | - priority = 100 |
61 | | - direction = "Outbound" |
62 | | - access = "Allow" |
63 | | - protocol = "Tcp" |
64 | | - source_port_range = "*" |
65 | | - destination_port_ranges = ["22", "3389"] |
66 | | - source_address_prefix = "*" |
67 | | - destination_address_prefix = "VirtualNetwork" |
68 | | - } |
69 | | - security_rule { |
70 | | - name = "AllowBastionHostCommunicationOutbound" |
71 | | - priority = 110 |
72 | | - direction = "Outbound" |
73 | | - access = "Allow" |
74 | | - protocol = "Tcp" |
75 | | - source_port_range = "*" |
76 | | - destination_port_ranges = ["5701", "8080"] |
77 | | - source_address_prefix = "VirtualNetwork" |
78 | | - destination_address_prefix = "VirtualNetwork" |
| 14 | + security_rule { |
| 15 | + name = "AllowHTTPSInbound" |
| 16 | + priority = 100 |
| 17 | + direction = "Inbound" |
| 18 | + access = "Allow" |
| 19 | + protocol = "Tcp" |
| 20 | + source_port_range = "*" |
| 21 | + destination_port_range = "443" |
| 22 | + source_address_prefix = "Internet" |
| 23 | + destination_address_prefix = "*" |
79 | 24 | } |
80 | | - security_rule { |
81 | | - name = "AllowAzureCloudOutbound" |
82 | | - priority = 120 |
83 | | - direction = "Outbound" |
84 | | - access = "Allow" |
85 | | - protocol = "Tcp" |
86 | | - source_port_range = "*" |
87 | | - destination_port_ranges = ["443"] |
88 | | - source_address_prefix = "*" |
89 | | - destination_address_prefix = "AzureCloud" |
90 | | - } |
91 | | - security_rule { |
92 | | - name = "AllowGetSessionInformation" |
93 | | - priority = 130 |
94 | | - direction = "Outbound" |
95 | | - access = "Allow" |
96 | | - protocol = "Tcp" |
97 | | - source_port_range = "*" |
98 | | - destination_port_ranges = ["80"] |
99 | | - source_address_prefix = "*" |
100 | | - destination_address_prefix = "Internet" |
101 | | -} |
102 | | - |
| 25 | + security_rule { |
| 26 | + name = "AllowGatewayManagerInbound" |
| 27 | + priority = 200 |
| 28 | + direction = "Inbound" |
| 29 | + access = "Allow" |
| 30 | + protocol = "Tcp" |
| 31 | + source_port_range = "*" |
| 32 | + destination_port_range = "443" |
| 33 | + source_address_prefix = "GatewayManager" |
| 34 | + destination_address_prefix = "*" |
| 35 | + } |
| 36 | + security_rule { |
| 37 | + name = "AllowAzureLBInbound" |
| 38 | + priority = 300 |
| 39 | + direction = "Inbound" |
| 40 | + access = "Allow" |
| 41 | + protocol = "Tcp" |
| 42 | + source_port_range = "*" |
| 43 | + destination_port_range = "443" |
| 44 | + source_address_prefix = "AzureLoadBalancer" |
| 45 | + destination_address_prefix = "*" |
| 46 | + } |
| 47 | + security_rule { |
| 48 | + name = "AllowBastionHostCommunication" |
| 49 | + priority = 400 |
| 50 | + direction = "Inbound" |
| 51 | + access = "Allow" |
| 52 | + protocol = "*" |
| 53 | + source_port_range = "*" |
| 54 | + destination_port_ranges = ["5701", "8080"] |
| 55 | + source_address_prefix = "VirtualNetwork" |
| 56 | + destination_address_prefix = "VirtualNetwork" |
| 57 | + } |
| 58 | + security_rule { |
| 59 | + name = "AllowRdpSshOutbound" |
| 60 | + priority = 100 |
| 61 | + direction = "Outbound" |
| 62 | + access = "Allow" |
| 63 | + protocol = "Tcp" |
| 64 | + source_port_range = "*" |
| 65 | + destination_port_ranges = ["22", "3389"] |
| 66 | + source_address_prefix = "*" |
| 67 | + destination_address_prefix = "VirtualNetwork" |
| 68 | + } |
| 69 | + security_rule { |
| 70 | + name = "AllowBastionHostCommunicationOutbound" |
| 71 | + priority = 110 |
| 72 | + direction = "Outbound" |
| 73 | + access = "Allow" |
| 74 | + protocol = "Tcp" |
| 75 | + source_port_range = "*" |
| 76 | + destination_port_ranges = ["5701", "8080"] |
| 77 | + source_address_prefix = "VirtualNetwork" |
| 78 | + destination_address_prefix = "VirtualNetwork" |
| 79 | + } |
| 80 | + security_rule { |
| 81 | + name = "AllowAzureCloudOutbound" |
| 82 | + priority = 120 |
| 83 | + direction = "Outbound" |
| 84 | + access = "Allow" |
| 85 | + protocol = "Tcp" |
| 86 | + source_port_range = "*" |
| 87 | + destination_port_ranges = ["443"] |
| 88 | + source_address_prefix = "*" |
| 89 | + destination_address_prefix = "AzureCloud" |
| 90 | + } |
| 91 | + security_rule { |
| 92 | + name = "AllowGetSessionInformation" |
| 93 | + priority = 130 |
| 94 | + direction = "Outbound" |
| 95 | + access = "Allow" |
| 96 | + protocol = "Tcp" |
| 97 | + source_port_range = "*" |
| 98 | + destination_port_ranges = ["80"] |
| 99 | + source_address_prefix = "*" |
| 100 | + destination_address_prefix = "Internet" |
| 101 | + } |
| 102 | + |
103 | 103 | } |
104 | 104 |
|
105 | 105 | resource "azurerm_subnet_network_security_group_association" "bastion_nsg_assoc" { |
106 | 106 | subnet_id = azurerm_subnet.azure_bastion.id |
107 | 107 | network_security_group_id = azurerm_network_security_group.bastion_nsg.id |
108 | | - depends_on = [ |
109 | | - azurerm_bastion_host.azure_bastion_instance |
110 | | - ] |
| 108 | + depends_on = [ |
| 109 | + azurerm_bastion_host.azure_bastion_instance |
| 110 | + ] |
111 | 111 | } |
112 | 112 |
|
113 | 113 |
|
114 | 114 | resource "azurerm_bastion_host" "azure_bastion_instance" { |
115 | | - name = "bas-${var.name}-${var.environment}" |
116 | | - location = azurerm_resource_group.default.location |
117 | | - resource_group_name = azurerm_resource_group.default.name |
| 115 | + name = "bas-${var.name}-${var.environment}" |
| 116 | + location = azurerm_resource_group.default.location |
| 117 | + resource_group_name = azurerm_resource_group.default.name |
118 | 118 |
|
119 | | - ip_configuration { |
120 | | - name = "configuration" |
121 | | - subnet_id = azurerm_subnet.azure_bastion.id |
122 | | - public_ip_address_id = azurerm_public_ip.azure_bastion.id |
123 | | - } |
| 119 | + ip_configuration { |
| 120 | + name = "configuration" |
| 121 | + subnet_id = azurerm_subnet.azure_bastion.id |
| 122 | + public_ip_address_id = azurerm_public_ip.azure_bastion.id |
| 123 | + } |
124 | 124 | } |
125 | 125 |
|
0 commit comments