Skip to content

Commit e727fc5

Browse files
FTNT-HQCMFTNT-HQCM
committed
init/updateAWSTerraformModules: 1.1.0
Signed-off-by: FTNT-HQCM <hq-devops-admin@fortinet.com>
1 parent b79e0d1 commit e727fc5

37 files changed

+2535
-631
lines changed

‎CHANGELOG.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
## Unreleased
22

3+
## 1.1.0 (Nov 25, 2024)
4+
5+
IMPROVEMENTS:
6+
* Add module fgt;
7+
* Add example fgt_standalone;
8+
* Support option of not assign public IP for all FortiGate instance;
9+
* Support create extra interfaces for FortiGate instance;
10+
* Add output of 'gwlb_endps' to output the GWLB's endpoints information on all examples;
11+
* Support creating GWLB endpoints under spoke vpc for example spk_tgw_gwlb_asg_fgt_igw;
12+
313
## 1.0.3 (Oct 4, 2024)
414

515
IMPROVEMENTS:

‎examples/fgt_standalone/README.md

Lines changed: 50 additions & 0 deletions
Large diffs are not rendered by default.

‎examples/fgt_standalone/fgt_config.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# This is an FortiGate configuration example
2+

‎examples/fgt_standalone/main.tf

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
provider "aws" {
2+
access_key = var.access_key
3+
secret_key = var.secret_key
4+
region = var.region
5+
}
6+
7+
locals {
8+
module_prefix = var.module_prefix == "" ? "" : "${var.module_prefix}-"
9+
# Subnets
10+
subnets = var.existing_subnets == null ? module.security-vpc.subnets : {
11+
for k, v in var.existing_subnets : "${local.module_prefix}${k}" => v
12+
}
13+
}
14+
15+
# Create security VPC including subnets, IGW, and security groups
16+
module "security-vpc" {
17+
source = "../../modules/aws/vpc"
18+
19+
existing_vpc = var.existing_security_vpc
20+
existing_igw = var.existing_igw
21+
existing_security_groups = var.existing_security_groups
22+
vpc_name = var.vpc_name
23+
igw_name = var.igw_name
24+
security_groups = var.security_groups
25+
vpc_cidr_block = var.vpc_cidr_block
26+
subnets = var.subnets
27+
module_prefix = local.module_prefix
28+
29+
tags = {
30+
general = var.general_tags
31+
}
32+
}
33+
34+
# Create VPC route tables
35+
module "security_route_table" {
36+
source = "../../modules/aws/vpc_route_table"
37+
38+
for_each = var.route_tables
39+
vpc_id = module.security-vpc.vpc_id
40+
rt_name = each.key
41+
rt_association_subnets = [
42+
for v in each.value.rt_association_subnets : (
43+
v.id != null ? v.id : local.subnets["${local.module_prefix}${v.name}"].id
44+
) if v.id != null || (v.name != null && lookup(local.subnets, "${local.module_prefix}${v.name}", false) != false)
45+
]
46+
rt_association_gateways = [
47+
for v in each.value.rt_association_gateways : (
48+
v.id != null ? v.id : module.security-vpc.igw_id
49+
) if v.id != null || (v.name != null && v.name == var.igw_name)
50+
]
51+
routes = {
52+
for k, v in each.value.routes : k => merge([
53+
for sk, sv in v : [
54+
(
55+
sk == "gateway" && sv != null ? {
56+
gateway_id = (
57+
sv.id != null ? sv.id : sv.name == var.igw_name ? module.security-vpc.igw_id : null
58+
)
59+
} : {}
60+
),
61+
(
62+
sk == "nat_gateway" && sv != null ? {
63+
nat_gateway_id = sv.id
64+
} : {}
65+
),
66+
(
67+
sk == "network_interface" && sv != null ? {
68+
network_interface_id = (
69+
sv.id != null ? sv.id : module.fgts[split(".", sv.name)[0]].fgt_interface_ids["${local.module_prefix}${split(".", sv.name)[1]}"]
70+
)
71+
} : {}
72+
),
73+
(
74+
sv != null ? {
75+
"${sk}" = sv
76+
} : {}
77+
)
78+
][sk == "gateway" ? 0 : sk == "nat_gateway" ? 1 : sk == "network_interface" ? 2 : 3]
79+
]...)
80+
}
81+
depends_on = [
82+
module.security-vpc,
83+
module.fgts
84+
]
85+
}
86+
87+
# Create FortiGate Auto Scaling group
88+
locals {
89+
secgrp_idmap_with_prefixname = {
90+
for k, v in module.security-vpc.security_group : v.prefix_name => v.id
91+
}
92+
}
93+
module "fgts" {
94+
source = "../../modules/fortigate/fgt"
95+
for_each = var.fgts
96+
97+
module_prefix = local.module_prefix
98+
# FortiGate instance template
99+
instance_name = each.key
100+
ami_id = each.value.ami_id
101+
fgt_version = each.value.fgt_version
102+
instance_type = each.value.instance_type
103+
license_type = each.value.license_type
104+
fgt_hostname = each.value.fgt_hostname
105+
fgt_password = each.value.fgt_password
106+
fgt_multi_vdom = each.value.fgt_multi_vdom
107+
lic_file_path = each.value.lic_file_path
108+
fortiflex_sn = each.value.fortiflex_sn
109+
keypair_name = each.value.keypair_name
110+
fgt_admin_https_port = each.value.fgt_admin_https_port
111+
fgt_admin_ssh_port = each.value.fgt_admin_ssh_port
112+
user_conf = (
113+
lookup(each.value, "user_conf_content", "") != "" && lookup(each.value, "user_conf_file_path", "") != "" ?
114+
format("%s\n%s", file(each.value["user_conf_file_path"]), each.value["user_conf_content"]) :
115+
lookup(each.value, "user_conf_file_path", "") != "" ? file(each.value["user_conf_file_path"]) : lookup(each.value, "user_conf_content", "")
116+
)
117+
118+
network_interfaces = {
119+
for k, v in each.value.network_interfaces : k => merge([
120+
for sk, sv in v : [
121+
(
122+
sk == "subnet" && sv != null ? {
123+
subnet_id = (
124+
sv.id != null ? sv.id : sv.name != null && lookup(local.subnets, "${local.module_prefix}${sv.name}", null) != null ? local.subnets["${local.module_prefix}${sv.name}"].id : null
125+
)
126+
} : {}
127+
),
128+
(
129+
sk == "security_groups" && sv != null ? {
130+
security_groups = [
131+
for sg in sv : (
132+
sg.id != null ? sg.id : sg.name != null && lookup(local.secgrp_idmap_with_prefixname, "${local.module_prefix}${sg.name}", null) != null ? local.secgrp_idmap_with_prefixname["${local.module_prefix}${sg.name}"] : null
133+
)
134+
]
135+
} : {}
136+
),
137+
(
138+
sv == null ? {} : {
139+
"${sk}" = sv
140+
}
141+
)
142+
][sk == "subnet" ? 0 : sk == "security_groups" ? 1 : 2]
143+
]...)
144+
}
145+
146+
tags = {
147+
general = var.general_tags
148+
}
149+
depends_on = [
150+
module.security-vpc,
151+
]
152+
}

‎examples/fgt_standalone/outputs.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "subnets" {
2+
value = local.subnets
3+
}
4+
5+
output "security_group" {
6+
value = module.security-vpc.security_group
7+
}
8+
9+
output "fgts_public_ip" {
10+
value = { for k, v in module.fgts : k => v.fgt_public_ip }
11+
}

0 commit comments

Comments
 (0)