本文介绍 Terraform 的安装配置。

Terraform 介绍 #

Terraform 是一个开源的 IT 基础设施编排工具，支持使用配置文件定义基础设施或应用。通过 Terraform，可以轻松的编排云防火墙的资源，例如创建和修改访问控制策略等。

前提条件 #

您已熟悉Terraform的基础知识，包括Terraform介绍、安装Terraform以及Terraform工具指南。

使用说明 #

• volcengine_cfw_address_book 地址簿管理
• volcengine_cfw_control_policy 互联网边界防火墙策略管理
• volcengine_cfw_control_policy_priority 互联网边界防火墙策略优先级管理
• volcengine_cfw_vpc_firewall_acl_rule VPC边界防火墙策略管理
• volcengine_cfw_vpc_firewall_acl_rule_priority VPC边界防火墙策略优先级管理
• volcengine_cfw_nat_firewall_control_policy NAT边界防火墙策略管理
• volcengine_cfw_nat_firewall_control_policy_priority NAT边界防火墙策略优先级管理
• volcengine_cfw_dns_control_policy 域名黑名单管理

使用示例 #

本文互联网边界防火墙为例，使用Terraform依次添加地址簿、添加互联网边界防火墙策略、修改优先级、到清理资源。

创建地址簿 #

resource "volcengine_cfw_address_book" "ip_address_book_1" {
  group_name   = "tf-test-ecs-ip"
  description  = "volc-terraform-test"
  group_type   = "ip"
  address_list = ["10.0.0.1","10.0.0.2"]
}

配置互联网访问控制策略 #

resource "volcengine_cfw_control_policy" "create_1" {
  action            = "accept"
  description       = "放行1.1.1.1"
  destination       = volcengine_cfw_address_book.ip_address_book_1.id
  destination_type  = "group"
  direction         = "in"
  priority          = 1
  proto             = "TCP"
  dest_port         = "80"
  dest_port_type    = "port"
  repeat_type       = "Permanent"
  source            = "1.1.1.1"
  source_type       = "net"
  status            = true
}
resource "volcengine_cfw_control_policy" "create_2" {
  action            = "deny"
  description       = "全阻断兜底策略"
  destination       = "0.0.0.0/0"
  destination_type  = "net"
  direction         = "in"
  priority          = 2
  proto             = "ANY"
  repeat_type       = "Permanent"
  source            = "0.0.0.0/0"
  source_type       = "net"
  status            = true
  depends_on = [volcengine_cfw_control_policy.create_1]
}

调整互联网访问控制策略优先级 #

resource "volcengine_cfw_control_policy_priority" "prio_1" {
  direction = "in"
  rule_id   = volcengine_cfw_control_policy.create_2.rule_id
  new_prio  = 1
}

批量修改优先级错误示例 #

若需要将策略5(in5)和策略2(in2)的优先级批量修改分别改成优先级3和优先级4。

错误示例：

resource "volcengine_cfw_control_policy_priority" "prio_in_2" {
  direction = "in"
  rule_id   = volcengine_cfw_control_policy.in2.rule_id
  new_prio  = 4
}
resource "volcengine_cfw_control_policy_priority" "prio_in_5" {
  direction = "in"
  rule_id   = volcengine_cfw_control_policy.in5.rule_id
  new_prio  = 3
  depends_on = [volcengine_cfw_control_policy_priority.prio_in_2]
}

云防火墙系统将批量修改优先级分成两步修改。先修改策略5再修改策略2，则会出现以下状况：

• 修改策略5优先级为3

• 修改策略2优先级为4

实际结果：策略5变成优先级2，策略2变成优先级4。实际结果与预期不符。

清理资源 #

terraform destroy