feat: Change old firewall to new network-firewall

0-bootstrap/modules/cb-private-pool/network.tf

@@ -20,7 +20,7 @@ locals {
 
 module "peered_network" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
   count   = var.private_worker_pool.create_peered_network ? 1 : 0
 
   project_id                             = var.project_id

0-bootstrap/modules/jenkins-agent/main.tf

@@ -18,7 +18,6 @@ locals {
   cicd_project_name           = format("%s-%s", var.project_prefix, "b-cicd")
   impersonation_enabled_count = var.sa_enable_impersonation ? 1 : 0
   activate_apis               = distinct(concat(var.activate_apis, ["billingbudgets.googleapis.com"]))
-  jenkins_gce_fw_tags         = ["ssh-jenkins-agent"]
 }
 
 resource "random_id" "suffix" {
@@ -70,7 +69,11 @@ resource "google_compute_instance" "jenkins_agent_gce_instance" {
   machine_type = var.jenkins_agent_gce_machine_type
   zone         = "${var.default_region}-a"
 
-  tags = local.jenkins_gce_fw_tags
+  params {
+    resource_manager_tags = {
+      "tagKeys/${google_tags_tag_key.jenkins_agents.name}" = "tagValues/${google_tags_tag_value.jenkins_agents.name}"
+    }
+  }
 
   boot_disk {
     initialize_params {
@@ -105,26 +108,52 @@ resource "google_compute_instance" "jenkins_agent_gce_instance" {
 }
 
 /******************************************
-  Jenkins Agent GCE Network and Firewall rules
+  Jenkins Agent GCE Network, Resource Manager Tags and Firewall rules
 *******************************************/
-
-resource "google_compute_firewall" "fw_allow_ssh_into_jenkins_agent" {
-  project       = module.cicd_project.project_id
-  name          = "fw-${google_compute_network.jenkins_agents.name}-1000-i-a-all-all-tcp-22"
-  description   = "Allow the Jenkins Controller (Client) to connect to the Jenkins Agents (Servers) using SSH."
-  network       = google_compute_network.jenkins_agents.name
-  source_ranges = var.jenkins_controller_subnetwork_cidr_range
-  target_tags   = local.jenkins_gce_fw_tags
-  priority      = 1000
-
-  log_config {
-    metadata = "INCLUDE_ALL_METADATA"
+resource "google_tags_tag_key" "jenkins_agents" {
+  description = "Tag Key to control the connection between Jenkins Controller (Client) and the Jenkins Agents (Servers) using SSH."
+  parent      = "organizations/${var.org_id}"
+  purpose     = "GCE_FIREWALL"
+  short_name  = "ssh-jenkins-agent"
+  purpose_data = {
+    network = "${module.cicd_project.project_id}/${google_compute_network.jenkins_agents.name}"
   }
+}
 
-  allow {
-    protocol = "tcp"
-    ports    = ["22"]
-  }
+resource "google_tags_tag_value" "jenkins_agents" {
+  description = "Allow the connection."
+  parent      = "tagKeys/${google_tags_tag_key.jenkins_agents.name}"
+  short_name  = "allow"
+}
+
+module "jenkins_firewall_rules" {
+  source      = "terraform-google-modules/network/google//modules/network-firewall-policy"
+  version     = "~> 8.0"
+  project_id  = module.cicd_project.project_id
+  policy_name = "fp-${google_compute_network.jenkins_agents.name}-jenkins-firewall"
+  description = "Jenkins Agent GCE network firewall rules."
+  target_vpcs = [google_compute_network.jenkins_agents.name]
+
+  rules = [
+    {
+      priority           = "1000"
+      direction          = "INGRESS"
+      action             = "allow"
+      rule_name          = "fw-${google_compute_network.jenkins_agents.name}-1000-i-a-all-all-tcp-22"
+      description        = "Allow the Jenkins Controller (Client) to connect to the Jenkins Agents (Servers) using SSH."
+      enable_logging     = true
+      target_secure_tags = ["tagValues/${google_tags_tag_value.jenkins_agents.name}"]
+      match = {
+        dest_ip_ranges = var.jenkins_controller_subnetwork_cidr_range
+        layer4_configs = [
+          {
+            ip_protocol = "tcp"
+            ports       = ["22"]
+          },
+        ]
+      }
+    }
+  ]
 }
 
 resource "google_compute_network" "jenkins_agents" {

3-networks-dual-svpc/envs/shared/dns-hub.tf

@@ -20,7 +20,7 @@
 
 module "dns_hub_vpc" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = local.dns_hub_project_id
   network_name                           = "vpc-c-dns-hub"

3-networks-dual-svpc/modules/base_env/main.tf

@@ -240,8 +240,6 @@ module "restricted_shared_vpc" {
   secondary_ranges = {
     "sb-${var.environment_code}-shared-restricted-${var.default_region1}" = var.restricted_subnet_secondary_ranges[var.default_region1]
   }
-  allow_all_ingress_ranges = null
-  allow_all_egress_ranges  = null
 }
 
 /******************************************
@@ -282,6 +280,4 @@ module "base_shared_vpc" {
   secondary_ranges = {
     "sb-${var.environment_code}-shared-base-${var.default_region1}" = var.base_subnet_secondary_ranges[var.default_region1]
   }
-  allow_all_ingress_ranges = null
-  allow_all_egress_ranges  = null
 }

3-networks-dual-svpc/modules/base_shared_vpc/README.md

@@ -3,15 +3,14 @@
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| allow\_all\_egress\_ranges | List of network ranges to which all egress traffic will be allowed | `any` | `null` | no |
-| allow\_all\_ingress\_ranges | List of network ranges from which all ingress traffic will be allowed | `any` | `null` | no |
 | bgp\_asn\_subnet | BGP ASN for Subnets cloud routers. | `number` | n/a | yes |
 | default\_region1 | Default region 1 for subnets and Cloud Routers | `string` | n/a | yes |
 | default\_region2 | Default region 2 for subnets and Cloud Routers | `string` | n/a | yes |
 | dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | `bool` | `true` | no |
 | dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
 | dns\_hub\_project\_id | The DNS hub project ID | `string` | n/a | yes |
 | domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
+| enable\_all\_vpc\_internal\_traffic | Enable firewall policy rule to allow internal traffic (ingress and egress). | `bool` | `false` | no |
 | environment\_code | A short form of the folder level resources (environment) within the Google Cloud organization. | `string` | n/a | yes |
 | firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
 | nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |
@@ -22,7 +21,7 @@
 | private\_service\_connect\_ip | Internal IP to be used as the private service connect endpoint | `string` | n/a | yes |
 | project\_id | Project ID for Private Shared VPC. | `string` | n/a | yes |
 | secondary\_ranges | Secondary ranges that will be used in some of the subnets | `map(list(object({ range_name = string, ip_cidr_range = string })))` | `{}` | no |
-| subnets | The list of subnets being created | `list(map(string))` | `[]` | no |
+| subnets | The list of subnets being created | <pre>list(object({<br>    subnet_name                      = string<br>    subnet_ip                        = string<br>    subnet_region                    = string<br>    subnet_private_access            = optional(string, "false")<br>    subnet_private_ipv6_access       = optional(string)<br>    subnet_flow_logs                 = optional(string, "false")<br>    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")<br>    subnet_flow_logs_sampling        = optional(string, "0.5")<br>    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")<br>    subnet_flow_logs_filter          = optional(string, "true")<br>    subnet_flow_logs_metadata_fields = optional(list(string), [])<br>    description                      = optional(string)<br>    purpose                          = optional(string)<br>    role                             = optional(string)<br>    stack_type                       = optional(string)<br>    ipv6_access_type                 = optional(string)<br>  }))</pre> | `[]` | no |
 | windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
 
 ## Outputs

3-networks-dual-svpc/modules/base_shared_vpc/firewall.tf

@@ -15,108 +15,87 @@
  */
 
 /******************************************
-  Mandatory firewall rules
+  Mandatory and optional firewall rules
  *****************************************/
-
-resource "google_compute_firewall" "deny_all_egress" {
-  name      = "fw-${var.environment_code}-shared-base-65530-e-d-all-all-all"
-  network   = module.main.network_name
-  project   = var.project_id
-  direction = "EGRESS"
-  priority  = 65530
-
-  dynamic "log_config" {
-    for_each = var.firewall_enable_logging == true ? [{
-      metadata = "INCLUDE_ALL_METADATA"
-    }] : []
-
-    content {
-      metadata = log_config.value.metadata
-    }
-  }
-
-  deny {
-    protocol = "all"
-  }
-
-  destination_ranges = ["0.0.0.0/0"]
-}
-
-
-resource "google_compute_firewall" "allow_private_api_egress" {
-  name      = "fw-${var.environment_code}-shared-base-65430-e-a-allow-google-apis-all-tcp-443"
-  network   = module.main.network_name
-  project   = var.project_id
-  direction = "EGRESS"
-  priority  = 65430
-
-  dynamic "log_config" {
-    for_each = var.firewall_enable_logging == true ? [{
-      metadata = "INCLUDE_ALL_METADATA"
-    }] : []
-
-    content {
-      metadata = log_config.value.metadata
-    }
-  }
-
-  allow {
-    protocol = "tcp"
-    ports    = ["443"]
-  }
-
-  destination_ranges = [local.private_googleapis_cidr]
-
-  target_tags = ["allow-google-apis"]
-}
-
-
-resource "google_compute_firewall" "allow_all_egress" {
-  count     = var.allow_all_egress_ranges != null ? 1 : 0
-  name      = "fw-${var.environment_code}-shared-base-1000-e-a-all-all-all"
-  network   = module.main.network_name
-  project   = var.project_id
-  direction = "EGRESS"
-  priority  = 1000
-
-  dynamic "log_config" {
-    for_each = var.firewall_enable_logging == true ? [{
-      metadata = "INCLUDE_ALL_METADATA"
-    }] : []
-
-    content {
-      metadata = log_config.value.metadata
-    }
-  }
-
-  allow {
-    protocol = "all"
-  }
-
-  destination_ranges = var.allow_all_egress_ranges
-}
-
-resource "google_compute_firewall" "allow_all_ingress" {
-  count     = var.allow_all_ingress_ranges != null ? 1 : 0
-  name      = "fw-${var.environment_code}-shared-base-1000-i-a-all"
-  network   = module.main.network_name
-  project   = var.project_id
-  direction = "INGRESS"
-  priority  = 1000
-
-  dynamic "log_config" {
-    for_each = var.firewall_enable_logging == true ? [{
-      metadata = "INCLUDE_ALL_METADATA"
-    }] : []
-
-    content {
-      metadata = log_config.value.metadata
-    }
-  }
-
-  allow {
-    protocol = "all"
-  }
-
-  source_ranges = var.allow_all_ingress_ranges
+module "firewall_rules" {
+  source      = "terraform-google-modules/network/google//modules/network-firewall-policy"
+  version     = "~> 8.0"
+  project_id  = var.project_id
+  policy_name = "fp-${var.environment_code}-dual-svpc-base-firewalls"
+  description = "Firewall rules for base dual shared vpc: ${module.main.network_name}."
+  target_vpcs = ["projects/${var.project_id}/global/networks/${module.main.network_name}"]
+
+  rules = concat(
+    [
+      {
+        priority       = "65530"
+        direction      = "EGRESS"
+        action         = "deny"
+        rule_name      = "fw-${var.environment_code}-shared-base-65530-e-d-all-all-all"
+        description    = "Lower priority rule to deny all egress traffic."
+        enable_logging = var.firewall_enable_logging
+        match = {
+          dest_ip_ranges = ["0.0.0.0/0"]
+          layer4_configs = [
+            {
+              ip_protocol = "all"
+            },
+          ]
+        }
+      },
+      {
+        priority       = "1000"
+        direction      = "EGRESS"
+        action         = "allow"
+        rule_name      = "fw-${var.environment_code}-shared-base-1000-e-a-allow-google-apis-all-tcp-443"
+        description    = "Lower priority rule to allow private google apis on TCP port 443."
+        enable_logging = var.firewall_enable_logging
+        match = {
+          dest_ip_ranges = [local.private_googleapis_cidr]
+          layer4_configs = [
+            {
+              ip_protocol = "tcp"
+              ports       = ["443"]
+            },
+          ]
+        }
+      }
+    ],
+    !var.enable_all_vpc_internal_traffic ? [] : [
+      {
+        priority       = "10000"
+        direction      = "EGRESS"
+        action         = "allow"
+        rule_name      = "fw-${var.environment_code}-shared-base-10000-e-a-all-all-all"
+        description    = "Allow all egress to the provided IP range."
+        enable_logging = var.firewall_enable_logging
+        match = {
+          dest_ip_ranges = module.main.subnets_ips
+          layer4_configs = [
+            {
+              ip_protocol = "all"
+            },
+          ]
+        }
+      }
+    ],
+    !var.enable_all_vpc_internal_traffic ? [] : [
+      {
+        priority       = "10001"
+        direction      = "INGRESS"
+        action         = "allow"
+        rule_name      = "fw-${var.environment_code}-shared-base-10001-i-a-all"
+        description    = "Allow all ingress to the provided IP range."
+        enable_logging = var.firewall_enable_logging
+        match = {
+          src_ip_ranges = module.main.subnets_ips
+          layer4_configs = [
+            {
+              ip_protocol = "all"
+            },
+          ]
+        }
+      }
+    ]
+  )
 }

3-networks-dual-svpc/modules/base_shared_vpc/main.tf

@@ -26,7 +26,7 @@ locals {
 
 module "main" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 7.0"
+  version = "~> 8.0"
 
   project_id                             = var.project_id
   network_name                           = local.network_name

3-networks-dual-svpc/modules/base_shared_vpc/variables.tf

@@ -69,7 +69,24 @@ variable "bgp_asn_subnet" {
 }
 
 variable "subnets" {
-  type        = list(map(string))
+  type = list(object({
+    subnet_name                      = string
+    subnet_ip                        = string
+    subnet_region                    = string
+    subnet_private_access            = optional(string, "false")
+    subnet_private_ipv6_access       = optional(string)
+    subnet_flow_logs                 = optional(string, "false")
+    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")
+    subnet_flow_logs_sampling        = optional(string, "0.5")
+    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")
+    subnet_flow_logs_filter          = optional(string, "true")
+    subnet_flow_logs_metadata_fields = optional(list(string), [])
+    description                      = optional(string)
+    purpose                          = optional(string)
+    role                             = optional(string)
+    stack_type                       = optional(string)
+    ipv6_access_type                 = optional(string)
+  }))
   description = "The list of subnets being created"
   default     = []
 }
@@ -120,12 +137,8 @@ variable "windows_activation_enabled" {
   default     = false
 }
 
-variable "allow_all_egress_ranges" {
-  description = "List of network ranges to which all egress traffic will be allowed"
-  default     = null
-}
-
-variable "allow_all_ingress_ranges" {
-  description = "List of network ranges from which all ingress traffic will be allowed"
-  default     = null
+variable "enable_all_vpc_internal_traffic" {
+  type        = bool
+  description = "Enable firewall policy rule to allow internal traffic (ingress and egress)."
+  default     = false
 }