Skip to content

Commit d4323ea

Browse files
bryantbiggsbryantbiggs
committed
chore: Update documentation, add example outputs
1 parent 42c1f01 commit d4323ea

File tree

7 files changed

+313
-411
lines changed

7 files changed

+313
-411
lines changed

‎README.md

Lines changed: 66 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,76 @@
22

33
Terraform module which creates AWS network firewall resources.
44

5+
[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
6+
57
## Usage
68

7-
See [`examples`](https://github.com/clowdhaus/terraform-aws-network-firewall/tree/main/examples) directory for working examples to reference:
9+
This project supports creating resources through individual sub-modules for better support for RAM resource sharing, or through a single module that creates both the firewall and firewall policy resources.
10+
See the respective sub-module directory for more details and example usage.
811

9-
### Firewall & Firewall Policy
1012
```hcl
1113
module "network_firewall" {
12-
source = "clowdhaus/network-firewall/aws"
14+
source = "terraform-aws-modules/network-firewall/aws"
15+
16+
# Firewall
17+
name = "example"
18+
description = "Example network firewall"
19+
20+
vpc_id = "vpc-1234556abcdef"
21+
subnet_mapping = {
22+
subnet1 = {
23+
subnet_id = "subnet-abcde012"
24+
ip_address_type = "IPV4"
25+
}
26+
subnet2 = {
27+
subnet_id = "subnet-bcde012a"
28+
ip_address_type = "IPV4"
29+
}
30+
subnet2 = {
31+
subnet_id = "subnet-fghi345a"
32+
ip_address_type = "IPV4"
33+
}
34+
}
35+
36+
# Logging configuration
37+
create_logging_configuration = true
38+
logging_configuration_destination_config = [
39+
{
40+
log_destination = {
41+
logGroup = "/aws/network-firewall/example"
42+
}
43+
log_destination_type = "CloudWatchLogs"
44+
log_type = "ALERT"
45+
},
46+
{
47+
log_destination = {
48+
bucketName = "s3-example-bucket-firewall-flow-logs"
49+
prefix = "example"
50+
}
51+
log_destination_type = "S3"
52+
log_type = "FLOW"
53+
}
54+
]
55+
56+
# Policy
57+
policy_name = "example"
58+
policy_description = "Example network firewall policy"
59+
60+
policy_stateful_rule_group_reference = {
61+
one = {
62+
priority = 0
63+
resource_arn = "arn:aws:network-firewall:us-east-1:1234567890:stateful-rulegroup/example"
64+
}
65+
}
1366
67+
policy_stateless_default_actions = ["aws:pass"]
68+
policy_stateless_fragment_default_actions = ["aws:drop"]
69+
policy_stateless_rule_group_reference = {
70+
one = {
71+
priority = 0
72+
resource_arn = "arn:aws:network-firewall:us-east-1:1234567890:stateless-rulegroup/example"
73+
}
74+
}
1475
1576
tags = {
1677
Terraform = "true"
@@ -19,11 +80,13 @@ module "network_firewall" {
1980
}
2081
```
2182

83+
2284
## Examples
2385

2486
Examples codified under the [`examples`](https://github.com/clowdhaus/terraform-aws-network-firewall/tree/main/examples) are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!
2587

2688
- [Complete](https://github.com/clowdhaus/terraform-aws-network-firewall/tree/main/examples/complete)
89+
- [Separate](https://github.com/clowdhaus/terraform-aws-network-firewall/tree/main/examples/separate)
2790

2891
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
2992
## Requirements

‎examples/complete/README.md

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,25 @@ No inputs.
5757

5858
## Outputs
5959

60-
No outputs.
60+
| Name | Description |
61+
|------|-------------|
62+
| <a name="output_firewall_arn"></a> [firewall\_arn](#output\_firewall\_arn) | The Amazon Resource Name (ARN) that identifies the firewall |
63+
| <a name="output_firewall_id"></a> [firewall\_id](#output\_firewall\_id) | The Amazon Resource Name (ARN) that identifies the firewall |
64+
| <a name="output_firewall_logging_configuration_id"></a> [firewall\_logging\_configuration\_id](#output\_firewall\_logging\_configuration\_id) | The Amazon Resource Name (ARN) of the associated firewall |
65+
| <a name="output_firewall_policy_arn"></a> [firewall\_policy\_arn](#output\_firewall\_policy\_arn) | The Amazon Resource Name (ARN) that identifies the firewall policy |
66+
| <a name="output_firewall_policy_id"></a> [firewall\_policy\_id](#output\_firewall\_policy\_id) | The Amazon Resource Name (ARN) that identifies the firewall policy |
67+
| <a name="output_firewall_policy_resource_policy_id"></a> [firewall\_policy\_resource\_policy\_id](#output\_firewall\_policy\_resource\_policy\_id) | The Amazon Resource Name (ARN) of the firewall policy associated with the resource policy |
68+
| <a name="output_firewall_policy_update_token"></a> [firewall\_policy\_update\_token](#output\_firewall\_policy\_update\_token) | A string token used when updating a firewall policy |
69+
| <a name="output_firewall_rule_group_stateful_arn"></a> [firewall\_rule\_group\_stateful\_arn](#output\_firewall\_rule\_group\_stateful\_arn) | The Amazon Resource Name (ARN) that identifies the rule group |
70+
| <a name="output_firewall_rule_group_stateful_id"></a> [firewall\_rule\_group\_stateful\_id](#output\_firewall\_rule\_group\_stateful\_id) | The Amazon Resource Name (ARN) that identifies the rule group |
71+
| <a name="output_firewall_rule_group_stateful_resource_policy_id"></a> [firewall\_rule\_group\_stateful\_resource\_policy\_id](#output\_firewall\_rule\_group\_stateful\_resource\_policy\_id) | The Amazon Resource Name (ARN) of the rule group associated with the resource policy |
72+
| <a name="output_firewall_rule_group_stateful_update_token"></a> [firewall\_rule\_group\_stateful\_update\_token](#output\_firewall\_rule\_group\_stateful\_update\_token) | A string token used when updating the rule group |
73+
| <a name="output_firewall_rule_group_stateless_arn"></a> [firewall\_rule\_group\_stateless\_arn](#output\_firewall\_rule\_group\_stateless\_arn) | The Amazon Resource Name (ARN) that identifies the rule group |
74+
| <a name="output_firewall_rule_group_stateless_id"></a> [firewall\_rule\_group\_stateless\_id](#output\_firewall\_rule\_group\_stateless\_id) | The Amazon Resource Name (ARN) that identifies the rule group |
75+
| <a name="output_firewall_rule_group_stateless_resource_policy_id"></a> [firewall\_rule\_group\_stateless\_resource\_policy\_id](#output\_firewall\_rule\_group\_stateless\_resource\_policy\_id) | The Amazon Resource Name (ARN) of the rule group associated with the resource policy |
76+
| <a name="output_firewall_rule_group_stateless_update_token"></a> [firewall\_rule\_group\_stateless\_update\_token](#output\_firewall\_rule\_group\_stateless\_update\_token) | A string token used when updating the rule group |
77+
| <a name="output_firewall_status"></a> [firewall\_status](#output\_firewall\_status) | Nested list of information about the current status of the firewall |
78+
| <a name="output_firewall_update_token"></a> [firewall\_update\_token](#output\_firewall\_update\_token) | A string token used when updating a firewall |
6179
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6280

6381
Apache-2.0 Licensed. See [LICENSE](https://github.com/clowdhaus/terraform-aws-network-firewall/blob/main/LICENSE).

‎examples/complete/outputs.tf

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
################################################################################
2+
# Firewall
3+
################################################################################
4+
5+
output "firewall_id" {
6+
description = "The Amazon Resource Name (ARN) that identifies the firewall"
7+
value = module.network_firewall.id
8+
}
9+
10+
output "firewall_arn" {
11+
description = "The Amazon Resource Name (ARN) that identifies the firewall"
12+
value = module.network_firewall.arn
13+
}
14+
15+
output "firewall_status" {
16+
description = "Nested list of information about the current status of the firewall"
17+
value = module.network_firewall.status
18+
}
19+
20+
output "firewall_update_token" {
21+
description = "A string token used when updating a firewall"
22+
value = module.network_firewall.update_token
23+
}
24+
25+
################################################################################
26+
# Firewall Logging Configuration
27+
################################################################################
28+
29+
output "firewall_logging_configuration_id" {
30+
description = "The Amazon Resource Name (ARN) of the associated firewall"
31+
value = module.network_firewall.logging_configuration_id
32+
}
33+
34+
################################################################################
35+
# Firewall Policy
36+
################################################################################
37+
38+
output "firewall_policy_id" {
39+
description = "The Amazon Resource Name (ARN) that identifies the firewall policy"
40+
value = module.network_firewall.policy_id
41+
}
42+
43+
output "firewall_policy_arn" {
44+
description = "The Amazon Resource Name (ARN) that identifies the firewall policy"
45+
value = module.network_firewall.policy_arn
46+
}
47+
48+
output "firewall_policy_update_token" {
49+
description = "A string token used when updating a firewall policy"
50+
value = module.network_firewall.policy_update_token
51+
}
52+
53+
output "firewall_policy_resource_policy_id" {
54+
description = "The Amazon Resource Name (ARN) of the firewall policy associated with the resource policy"
55+
value = module.network_firewall.policy_resource_policy_id
56+
}
57+
58+
################################################################################
59+
# Rule Group - Stateful
60+
################################################################################
61+
62+
output "firewall_rule_group_stateful_id" {
63+
description = "The Amazon Resource Name (ARN) that identifies the rule group"
64+
value = module.network_firewall_rule_group_stateful.id
65+
}
66+
67+
output "firewall_rule_group_stateful_arn" {
68+
description = "The Amazon Resource Name (ARN) that identifies the rule group"
69+
value = module.network_firewall_rule_group_stateful.arn
70+
}
71+
72+
output "firewall_rule_group_stateful_update_token" {
73+
description = "A string token used when updating the rule group"
74+
value = module.network_firewall_rule_group_stateful.update_token
75+
}
76+
77+
output "firewall_rule_group_stateful_resource_policy_id" {
78+
description = "The Amazon Resource Name (ARN) of the rule group associated with the resource policy"
79+
value = module.network_firewall_rule_group_stateful.resource_policy_id
80+
}
81+
82+
################################################################################
83+
# Rule Group - Stateless
84+
################################################################################
85+
86+
output "firewall_rule_group_stateless_id" {
87+
description = "The Amazon Resource Name (ARN) that identifies the rule group"
88+
value = module.network_firewall_rule_group_stateless.id
89+
}
90+
91+
output "firewall_rule_group_stateless_arn" {
92+
description = "The Amazon Resource Name (ARN) that identifies the rule group"
93+
value = module.network_firewall_rule_group_stateless.arn
94+
}
95+
96+
output "firewall_rule_group_stateless_update_token" {
97+
description = "A string token used when updating the rule group"
98+
value = module.network_firewall_rule_group_stateless.update_token
99+
}
100+
101+
output "firewall_rule_group_stateless_resource_policy_id" {
102+
description = "The Amazon Resource Name (ARN) of the rule group associated with the resource policy"
103+
value = module.network_firewall_rule_group_stateless.resource_policy_id
104+
}

‎foo.tf

Lines changed: 0 additions & 164 deletions
This file was deleted.

0 commit comments

Comments
 (0)