OTC Subnet Firewall Terraform module

A module that applies caller-defined ingress and egress allow / deny rules to one or more OTC subnets.

NOTE: Each OTC firewall denies all inbound and outbound traffic on the associated subnets until rules are added (see the Firewall Overview). On top of that, OTC ships preset, non-deletable rules that always allow same-subnet traffic, broadcast and multicast, the instance metadata service (169.254.169.254), and OTC's public-service CIDRs (notably 100.125.0.0/16, the source range OTC's ELB uses for forwarded traffic and health checks). The rules you define here stack on top of those presets and are evaluated before the implicit deny-all.

Usage

Minimal subnet firewall

Allow HTTPS in, allow everything out. Anything else (other than the OTC presets) is blocked by the implicit deny-all.

module "subnet_firewall" {
  source = "iits-consulting/subnet-firewall/opentelekomcloud"

  name    = "my-firewall"
  subnets = [module.vpc.subnets["app-subnet"].id]

  rules = {
    allow-https-in = {
      protocol         = "tcp"
      action           = "allow"
      direction        = "ingress"
      destination_port = "443"
    }
    allow-all-out = {
      protocol  = "any"
      action    = "allow"
      direction = "egress"
    }
  }
}

Multi-subnet with mixed rules

Bind the same firewall to several subnets and combine ingress and egress allows. The optional per-rule description shows up in the OTC console.

module "app_tier_firewall" {
  source = "iits-consulting/subnet-firewall/opentelekomcloud"

  name        = "app-tier-firewall"
  description = "Stateless filter for the application-tier subnets."
  subnets = [
    module.vpc.subnets["app-eu-de-02"].id,
    module.vpc.subnets["app-eu-de-03"].id,
  ]

  rules = {
    "10-allow-ssh-from-jumphost" = {
      description       = "SSH from the jumphost CIDR."
      protocol          = "tcp"
      action            = "allow"
      direction         = "ingress"
      source_ip_address = module.vpc.subnets["jumphost-subnet"].cidr
      destination_port  = "22"
    }
    "20-allow-postgres-out" = {
      protocol               = "tcp"
      action                 = "allow"
      direction              = "egress"
      destination_ip_address = module.vpc.subnets["db-subnet"].cidr
      destination_port       = "5432"
    }
    "30-allow-dns-out" = {
      protocol         = "udp"
      action           = "allow"
      direction        = "egress"
      destination_port = "53"
    }
  }
}

What gets created

1. opentelekomcloud_fw_rule_v2 per entry in var.rules. Rule names come from the map keys.
2. opentelekomcloud_fw_policy_v2.ingress bundling every rule with direction in {"ingress", "any"}.
3. opentelekomcloud_fw_policy_v2.egress bundling every rule with direction in {"egress", "any"}.
4. opentelekomcloud_fw_firewall_group_v2 binding both policies to the router-interface ports of every subnet in var.subnets.

Rule semantics

direction is a module-added field; the underlying OTC firewall rule doesn't carry one. The module routes each rule into the right policy based on its value:

• "ingress" puts the rule in the ingress policy only.
• "egress" puts the rule in the egress policy only.
• "any" puts the rule in both policies, for cases where the same allow needs to apply symmetrically.

Invalid values fail at plan time via an errorcheck_is_valid resource.

Rules within a policy are evaluated top-down, first match wins. Terraform iterates the rules map in lexicographic key order, so the rule keys double as ordering hints; use a numeric prefix (10-allow-..., 20-allow-...) when order matters.

Omitting source_ip_address, destination_ip_address, source_port, or destination_port matches any value for that field. OTC's console renders these unset fields as --.

Requirements

Name	Version
errorcheck	3.0.3
opentelekomcloud	~> 1.32

Providers

Name	Version
errorcheck	3.0.3
opentelekomcloud	~> 1.32

Modules

No modules.

Resources

Name	Type
errorcheck_is_valid.check_rule_direction	resource
opentelekomcloud_fw_firewall_group_v2.group	resource
opentelekomcloud_fw_policy_v2.egress	resource
opentelekomcloud_fw_policy_v2.ingress	resource
opentelekomcloud_fw_rule_v2.rules	resource
opentelekomcloud_networking_port_v2.subnets	data source
opentelekomcloud_vpc_subnet_v1.subnets	data source

Inputs

Name	Description	Type	Default	Required
name	Firewall group name.	string	n/a	yes
rules	A map of firewall rule names to firewall rule configurations.	map(object({ description = optional(string) // A description for the firewall rule. protocol = string // The protocol type on which the firewall rule operates. Valid values are: tcp, udp, icmp, and any. action = string // Action to be taken (must be "allow" or "deny") when the firewall rule matches. direction = string // The direction for the rule to take effect. Value can be "ingress", "egress" or "any". ip_version = optional(number) // IP version, either 4 (default) or 6. source_ip_address = optional(string) // The source IP address on which the firewall rule operates. destination_ip_address = optional(string) // The destination IP address on which the firewall rule operates. source_port = optional(string) // The source port on which the firewall rule operates. destination_port = optional(string) // The destination port on which the firewall rule operates. enabled = optional(bool, true) // Enabled status for the firewall rule. }))	n/a	yes
subnets	A set of subnet IDs to associate with the firewall group.	set(string)	n/a	yes
description	Description of the firewall group.	string	null	no

Outputs

Name	Description
egress_policy	Egress firewall policy resource bundling every rule with direction "egress" or "any".
egress_policy_id	UUID of the egress firewall policy.
firewall_group	Firewall group resource binding the ingress and egress policies to the configured subnets' router-interface ports.
firewall_group_id	UUID of the firewall group.
ingress_policy	Ingress firewall policy resource bundling every rule with direction "ingress" or "any".
ingress_policy_id	UUID of the ingress firewall policy.
rule_ids	Map of firewall rule names to their UUIDs.
rules	Map of created firewall rule resources keyed by rule name.