Support for service endpoints in AzureFirewallSubnet
Needs: Immediate Attention :bangbang:Needs: Triage :mag:Status: Response Overdue :triangular_flag_on_post:
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Description
Centralising service endpoints in the hub AzureFirewallSubnet is a common and Microsoft-recommended design pattern.
Currently, it is not possible to do so using the module and need to be done manually via the portal.
This is quite a pressing issue as there is no way to define a subnet service endpoint block externally in terraform and must be defined inline in the subnet resource block, which is created and managed by the module.
**Most importantly - if creating Service Endpoints manually via portal in AzureFirewallSubnet, the module overwrites and deletes these service endpoints!!!**
### New or Affected Resource(s)/Data Source(s)
azurerm_firewall, azurerm_subnet
### Potential Terraform Configuration
```hcl
module "hub" {
source = "Azure/avm-ptn-hubnetworking/azurerm"
version = "0.6.1"
hub_virtual_networks = {
primary = {
name = "hub-networking-primary"
address_space = ["10.0.0.0/16"]
location = "eastus"
resource_group_name = "rg-hub-networking"
firewall = {
sku_name = "AZFW_VNet"
sku_tier = "Standard"
subnet_address_prefix = "10.0.1.0/24"
# Proposed new configuration block for firewall subnet service endpoints
subnet_configuration = {
service_endpoints = [
"Microsoft.Storage",
"Microsoft.KeyVault",
"Microsoft.Sql"
]
# Optionally, service endpoint policies could also be supported
# service_endpoint_policy_ids = ["policy-id-1", "policy-id-2"]
}
}
# Regular subnets configuration (for reference)
subnets = {
workload-subnet = {
name = "workload-subnet"
address_prefixes = ["10.0.2.0/24"]
service_endpoints = [
"Microsoft.Storage",
"Microsoft.KeyVault"
]
}
}
}
}
}
```
Alternatively, if you prefer to keep the structure flatter within the firewall object:
```hcl
firewall = {
sku_name = "AZFW_VNet"
sku_tier = "Standard"
subnet_address_prefix = "10.0.1.0/24"
# Proposed new properties directly within the firewall object
subnet_service_endpoints = [
"Microsoft.Storage",
"Microsoft.KeyVault",
"Microsoft.Sql"
]
subnet_service_endpoint_policy_ids = optional(list(string))
}
```
12 条评论