Support for firewall policy association with security providers- Azure Firewall

[chanakanissanka]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Hi There,

This came through during our recent azure firewall module creation via terraform 1.0.11. We are creating AZ firewall, policies all via terraform and once it's deployed still there is a manual-click ops part remains which is adding policy under "security providers" In the sake of total automation do we have a workaround to this ? or am I missing something here ?

New or Affected Resource(s)/Data Source(s)

azurerm_firewall_policy,azurerm_firewall

Potential Terraform Configuration

resource "azurerm_firewall_policy_associate" "example" {
  name                = "example-policy"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
}

References

No response

[sinbai]

@chanakanissanka thank you for posting this issue here. Could you please provide your terraform config that could help reproduce the above symptom?

[chanakanissanka]

@mbfrahry Apologies for taking the time to come back as I was away on a break. terraform config is as follows 1.) We are creating the firewall as part of the HUB-Spoke deployment model. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall 2.) Then we create policies for it. https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall_network_rule_collection

Once these steps are done we need to log into GUI to associate our firewall policy with the virtual network. Don't seem to be able to find a terraform code to it.

let me know if this is clear enough. if not I will change the code piece and upload it to make it more sense.

[gradinDotCom]

Specifically, the Security Provider policy assignment that associates a policy to a VNET...

[michaelrechani]

@sinbai, any update here? This is a bummer to not be able to fully automate the deployment of an Azure Firewall.

[chanakanissanka]

@michaelrechani, No update yet . any possibility to get CLI or SDK details so that we can give it a go

[archmangler]

Any update on this? It looks like 'ClickOps' is the only way to associate AFW policy with an AFW at present.

[spcdw]

Any update on this?

[danwernickeFM]

The firewall_policy_id in the firewall resource seems to solve this?

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/firewall#firewall_policy_id

[EldinEgrlic]

I can confirm, it works if you associate firewall_policy_id in the firewall resource. You can ignore the virtual hub part of the code (it worked in my case at least)