Support for creating multiple localrulestack rules (azurerm_palo_alto_local_rulestack_rule) under a single resource

[shankar-bala]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

With the current implementation of resource - azurerm_palo_alto_local_rulestack_rule, after every rule gets created we are performing implicit commit. This consumes about 1-2 mins for every rule. This will not be very effective for customers having 1000+ rules. Committing after each rule will take longer time for the terraform apply command to finish.

This request is to have a separate resource block that takes a list of rule definitions and perform commit only once in the end after all the rules are added.

New or Affected Resource(s)/Data Source(s)

azurerm_palo_alto_local_rulestack_rule

Potential Terraform Configuration

terraform {
    required_providers {
        azurerm = {
            source = "hashicorp/azurerm"
            version = "=3.75.0"
        }
    }
}

provider "azurerm" {
    features {}
}

resource "azurerm_palo_alto_local_rulestack_rule" "localrule1000" {
  name          = "rule1000-${var.resource_suffix}"
  rulestack_id = azurerm_palo_alto_local_rulestack.lrs1.id
  priority      = 1000
  applications  = ["any"]
  source {
    cidrs = ["192.168.16.0/24"]
  }
  destination {
    cidrs = ["192.168.16.0/24"]
  }
  action = "Allow"
  tags = var.tags
}
resource "azurerm_palo_alto_local_rulestack_rule" "localrule1001" {
  name          = "rule1001-${var.resource_suffix}"
  rulestack_id = azurerm_palo_alto_local_rulestack.lrs1.id
  priority      = 1001
  applications  = ["any"]
  source {
    cidrs = ["192.168.16.0/24"]
  }
  destination {
    cidrs = ["192.168.16.0/24"]
  }
  action = "Allow"
  tags = var.tags
}

# create resource group
resource azurerm_resource_group "rg" {
    name = "rg-${var.resource_suffix}"
    location = var.location
    tags = var.tags
} 

# create vnet/subnets

resource "azurerm_virtual_network" "vnet" {
  name                = "vnet-fw-${var.resource_suffix}"
  address_space       = [var.vnet_cidr]
  location            = var.location

  resource_group_name = azurerm_resource_group.rg.name

  tags = {
    Purpose = "terraform testing"
  }
}

# create localrulestack
resource azurerm_palo_alto_local_rulestack "lrs1" {
    name = "lrs-${var.resource_suffix}-1"
    resource_group_name = azurerm_resource_group.rg.name
    location = var.location
    description = "rulestack1"
}

module "vnet_firewall" {
  source = "./modules/vnet_firewall"
  vnet_name = azurerm_virtual_network.vnet.name
  resource_suffix = var.resource_suffix
  untrust_subnet_cidr = var.subnet_cidr.untrust_subnet_cidr_vnet_firewall
  trust_subnet_cidr = var.subnet_cidr.trust_subnet_cidr_vnet_firewall
  rgname = azurerm_resource_group.rg.name
  # cert_id = azurerm_palo_alto_local_rulestack_certificate.cert.id
  tags = var.tags
  location = var.location
  lrsname = azurerm_palo_alto_local_rulestack.lrs1.name
  lrsid = azurerm_palo_alto_local_rulestack.lrs1.id
  vnet_id = azurerm_virtual_network.vnet.id
}

### module content for creating vnet firewall

resource "azurerm_subnet" "trust" {
  name                 = "subnet-trust-vnetfw-${var.resource_suffix}"
  resource_group_name  = var.rgname
  virtual_network_name = var.vnet_name
  address_prefixes     = [var.trust_subnet_cidr]

  delegation {
    name = "trusted"

    service_delegation {
      name = "PaloAltoNetworks.Cloudngfw/firewalls"
      actions = [
        "Microsoft.Network/virtualNetworks/subnets/join/action",
      ]
    }
  }
}

resource "azurerm_subnet" "untrust" {
  name                 = "subnet-untrust-vnetfw-${var.resource_suffix}"
  resource_group_name  = var.rgname
  virtual_network_name = var.vnet_name
  address_prefixes     = [var.untrust_subnet_cidr]

  delegation {
    name = "untrusted"

    service_delegation {
      name = "PaloAltoNetworks.Cloudngfw/firewalls"
      actions = [
        "Microsoft.Network/virtualNetworks/subnets/join/action",
      ]
    }
  }
}

# create outbound certificate association
# resource "azurerm_palo_alto_local_rulestack_outbound_trust_certificate_association" "certassoc" {
#   certificate_id = var.cert_id
# }

# # create public ip
resource "azurerm_public_ip" "vnetfw-pubip" {
  name                ="pip-vnetfw-${var.resource_suffix}"
  location            = var.location
  resource_group_name = var.rgname
  allocation_method   = "Static"
  sku                 = "Standard"
}

# # create vnet firewall
resource "azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack" "firewall1" {
  name                = "vnetfw-${var.resource_suffix}"
  resource_group_name = var.rgname
  rulestack_id        = var.lrsid

  network_profile {
    public_ip_address_ids = [azurerm_public_ip.vnetfw-pubip.id]

    vnet_configuration {
      virtual_network_id  = var.vnet_id
      trusted_subnet_id   = azurerm_subnet.trust.id
      untrusted_subnet_id = azurerm_subnet.untrust.id
    }
  }

  dns_settings {
    dns_servers = [azurerm_public_ip.vnetfw-pubip.ip_address]
  }

  # destination_nat {
  #   backend_config {
  #     port = 80
  #     public_ip_address = "10.3.1.12"
  #   }
  #   frontend_config {
  #     port = 80
  #     public_ip_address_id = azurerm_public_ip.fw-vnet-pubip.id
  #   }
  #   protocol = "TCP"
  #   name = "dnat-fw-${var.resource_suffix}"
  # }
  tags = var.tags
}

References

#23471
#23505