Skip to content

Commit c9d37b8

Browse files
cgns-gitlab-mirror-app[bot]shirbab
cgns-gitlab-mirror-app[bot]
and
shirbab
authored
fix(CGNSPC-1634): Fix broken sub-modules links and add required permissions section (#65)
Co-authored-by: shirba <shirba@checkpoint.com>
1 parent 7ca8bc4 commit c9d37b8

1 file changed

Lines changed: 53 additions & 74 deletions

File tree

‎README.md‎

Lines changed: 53 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -18,26 +18,20 @@ This repository provides a structured set of Terraform modules for deploying Che
1818

1919

2020
**Submodules:**
21-
* [`high_availability_existing_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/high_availability_existing_vnet) - Deploys CloudGuard High Availability solution into an existing VNet in azure.
22-
* [`high_availability_new_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/high_availability_new_vnet) Deploys CloudGuard High Availability solution into a new VNet.
23-
* [`management_existing_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/management_existing_vnet) - Deploys CloudGuard Management solution into an existing VNet.
24-
* [`management_new_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/management_new_vnet) - Deploys CloudGuard Management solution into a new VNet
25-
* [`mds_existing_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/mds_existing_vnet) - Deploys CloudGuard Management solution into a new VNet.
26-
* [`mds_new_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/mds_new_vnet) - Deploys CloudGuard Management solution into a new VNet.
27-
* [`nva_into_existing_hub`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/nva_into_existing_hub) - Deploys CloudGuard Virtual WAN NVA solution into an existing vWAN Hub.
28-
* [`nva_into_new_vwan`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/nva_into_new_vwan) - Deploys CloudGuard Virtual WAN NVA solution into a new vWAN Hub.
29-
* [`single_gateway_existing_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/single_gateway_existing_vnet) - Deploys CloudGuard Single Gateway solution into an existing VNet.
30-
* [`single_gateway_new_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/single_gateway_new_vnet) - Deploys CloudGuard Single Gateway solution into a new VNet.
31-
* [`vmss_existing_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/vmss_existing_vnet) - Deploys CloudGuard VMSS solution into an existing VNet.
32-
* [`vmss_new_vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/vmss_new_vnet) - Deploys CloudGuard VMSS solution into a new VNet.
33-
34-
Internal Submodules -
35-
21+
* [`high-availability`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/high-availability) - Deploys CloudGuard High Availability solution.
22+
* [`management`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/management) - Deploys CloudGuard Management solution.
23+
* [`mds`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/mds) - Deploys CloudGuard Multi-Domain Security Management solution.
24+
* [`nva`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/nva) - Deploys CloudGuard Virtual WAN NVA solution.
25+
* [`single-gateway`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/single-gateway) - Deploys CloudGuard Single Gateway solution.
26+
* [`vmss`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/vmss) - Deploys CloudGuard VMSS solution.
27+
28+
Internal Submodules:
3629
* [`common`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/common) - Contains shared configurations and reusable components for all modules.
37-
38-
* [`network_security_group`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/network_security_group) - Manages Network Security Groups (NSGs) with CloudGuard-specific rules.
39-
40-
- [`vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/vnet) - Simplifies Virtual Network and subnet configurations.
30+
* [`custom-image`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/custom-image) - Manages custom image configurations.
31+
* [`network-security-group`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/network-security-group) - Manages Network Security Groups (NSGs) with CloudGuard-specific rules.
32+
* [`storage-account`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/storage-account) - Manages storage account configurations.
33+
* [`vnet`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/vnet) - Simplifies Virtual Network and subnet configurations.
34+
* [`vwan`](https://registry.terraform.io/modules/CheckPointSW/cloudguard-network-security/azure/latest/submodules/vwan) - Manages Virtual WAN configurations.
4135

4236

4337
## Security Rules Default Configuration
@@ -67,8 +61,16 @@ security_rules = [
6761

6862
# Best Practices for Using CloudGuard Modules
6963

70-
## Step 1: Use the Required Module
71-
Add the required module in your Terraform configuration file (`main.tf`) to deploy resources. For example:
64+
## Prerequisites
65+
- [Terraform](https://www.terraform.io/downloads.html) version 1.9 or higher
66+
- Azure Service Principal with required permissions (see [Required Permissions](#required-permissions) below)
67+
68+
---
69+
70+
## Deployment Steps
71+
72+
### 1. Configure Your Terraform Module
73+
Create a `main.tf` file with the required module and **mandatory authentication variables**:
7274

7375
```hcl
7476
provider "azurerm" {
@@ -77,72 +79,49 @@ provider "azurerm" {
7779
7880
module "example_module" {
7981
source = "CheckPointSW/cloudguard-network-security/azure//modules/{module_name}"
80-
version = "{chosen_version}"
81-
# Add the required inputs
82+
version = "~> 1.0"
83+
84+
# Authentication Variables (Required)
85+
client_secret = "<your-client-secret>"
86+
client_id = "<your-client-id>"
87+
tenant_id = "<your-tenant-id>"
88+
subscription_id = "<your-subscription-id>"
89+
90+
# Add additional module-specific variables here
8291
}
8392
```
84-
---
8593

86-
## Step 2: Open the Terminal
87-
Ensure you have [Azure CLI installed](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) and navigate to the directory where your `main.tf` file is located, using the appropriate terminal:
88-
89-
- **Linux/macOS**: **Terminal**.
90-
- **Windows**: **PowerShell** or **Command Prompt**.
94+
**Important:** All four authentication variables (`client_secret`, `client_id`, `tenant_id`, `subscription_id`) are mandatory for all modules.
9195

9296
---
9397

94-
## Step 3: Set Environment Variables and Log in with Azure CLI
95-
Set the required environment variables and authenticate with Azure using your Service Principal. Then, select the correct subscription.
98+
### 2. Initialize and Deploy
99+
Run the following Terraform commands to deploy your resources:
96100

97-
### Linux/macOS
98-
```hcl
99-
export TF_VAR_client_id="{your-client-id}"
100-
export TF_VAR_client_secret="{your-client-secret}"
101-
export TF_VAR_subscription_id="{your-subscription-id}"
102-
export TF_VAR_tenant_id="{your-tenant-id}"
101+
```bash
102+
# Initialize Terraform and download providers
103+
terraform init
103104

104-
az login --service-principal -u $TF_VAR_client_id -p $TF_VAR_client_secret --tenant $TF_VAR_tenant_id
105-
az account set --subscription $TF_VAR_subscription_id
106-
```
107-
### PowerShell (Windows)
108-
```hcl
109-
$env:TF_VAR_client_id="{your-client-id}"
110-
$env:TF_VAR_client_secret="{your-client-secret}"
111-
$env:TF_VAR_subscription_id="{your-subscription-id}"
112-
$env:TF_VAR_tenant_id="{your-tenant-id}"
105+
# Preview the changes
106+
terraform plan
113107

114-
az login --service-principal -u $env:TF_VAR_client_id -p $env:TF_VAR_client_secret --tenant $env:TF_VAR_tenant_id
115-
az account set --subscription $env:TF_VAR_subscription_id
108+
# Apply the configuration
109+
terraform apply
116110
```
117-
### Command Prompt (Windows)
118-
```hcl
119-
set TF_VAR_client_id="{your-client-id}"
120-
set TF_VAR_client_secret="{your-client-secret}"
121-
set TF_VAR_subscription_id="{your-subscription-id}"
122-
set TF_VAR_tenant_id="{your-tenant-id}"
123111

124-
az login --service-principal -u %TF_VAR_client_id% -p %TF_VAR_client_secret% --tenant %TF_VAR_tenant_id%
125-
az account set --subscription %TF_VAR_subscription_id%
126-
```
127112
---
113+
114+
## Required Permissions
128115

116+
The Azure Service Principal used for authentication must have the following permissions:
129117

130-
## Step 4: Deploy with Terraform
131-
Use Terraform commands to deploy resources securely.
118+
- **Contributor** role - for creating and managing Azure resources
119+
- **User Access Administrator** role - for role assignments (required for VMSS deployments)
120+
- For additional roles and permissions, see [Azure Built-in Roles](https://learn.microsoft.com/he-il/azure/role-based-access-control/built-in-roles)
132121

133-
### Initialize Terraform
134-
Prepare the working directory and download required provider plugins:
135-
```hcl
136-
terraform init
137-
```
122+
For detailed information on creating a Service Principal and assigning roles, refer to:
123+
- [Azure Service Principal Documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal)
124+
- [Azure RBAC Role Assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal)
125+
- [Terraform Azure Provider Authentication](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_client_secret)
138126

139-
### Plan Deployment
140-
Preview the changes Terraform will make:
141-
```hcl
142-
terraform plan
143-
```
144-
### Apply Deployment
145-
Apply the planned changes and deploy the resources:
146-
```hcl
147-
terraform apply
148-
```
127+
---

0 commit comments

Comments
 (0)