How to create an access control policy for the Internet firewall using Terraform-Cloud Firewall(Cloud Firewall)-阿里云帮助中心

This topic describes how to create an access control policy for the Internet firewall using Terraform.

Note

You can run the sample code in this topic with a single click. Run with one click

Prerequisites

An Alibaba Cloud account has full permissions on all resources. If the identity credentials of your Alibaba Cloud account are leaked, your resources are exposed to high security risks. We recommend that you use a Resource Access Management (RAM) user and create an AccessKey for the RAM user. For more information, see Create a RAM user and Create an AccessKey.

Grant the required permissions for Cloud Firewall to the RAM user. For security, we recommend that you grant permissions based on the principle of least privilege. For more information, see Manage RAM user permissions.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "yundun-cloudfirewall:*",
                "yundun-ndr:*"
            ],
            "Resource": "*"
        }
    ]
}

Prepare a Terraform runtime environment. You can use one of the following methods to run Terraform.

Use Terraform in Explorer: Alibaba Cloud provides an online Terraform runtime environment that does not require you to install Terraform. You can log on to use and test Terraform online. This method is suitable for scenarios where you want to quickly and easily test Terraform at no cost.

Cloud Shell: Cloud Shell has Terraform components pre-installed and identity credentials pre-configured. You can run Terraform commands directly in Cloud Shell. This method is suitable for scenarios where you want to quickly and easily access and use Terraform at a low cost.

Install and configure Terraform on your computer: This method is suitable for scenarios where you have poor network connectivity or need a custom developer environment.

Important
Make sure that your Terraform version is v0.12.28 or later. To check your current version, run the terraform --version command.

Resources used

alicloud_cloud_firewall_control_policy: An access control policy for Cloud Firewall.

Configure an access control policy for the Internet firewall using Terraform

This section provides an example of how to configure an access control policy for the Internet firewall.

Create a working directory. In this directory, create a configuration file named main.tf. The main.tf file is the main Terraform file that defines the resources to be deployed.

resource "alicloud_cloud_firewall_control_policy" "example" {
  # The application type supported by the access control policy. Valid values: ANY, HTTP, HTTPS, MQTT, Memcache, MongoDB, MySQL, RDP, Redis, SMTP, SMTPS, SSH, SSL, and VNC.
  application_name = "ANY"
  # The action that Cloud Firewall performs on the traffic. Valid values: accept, drop, and log.
  acl_action       = "accept"
  # The description.
  description      = "Created_by_terraform"
  # The type of the destination address in the access control policy. Valid values: net, group, domain, and location.
  destination_type = "net"
  # The destination address in the access control policy.
  destination      = "100.1.1.0/24"
  # The traffic direction for which the access control policy is applied. Valid values: in and out.
  direction        = "out"
  # The protocol type supported by the access control policy. Valid values: ANY, TCP, UDP, and ICMP.
  proto            = "ANY"
  # The source address in the access control policy.
  source           = "1.2.3.0/24"
  # The type of the source address in the access control policy. Valid values: net, group, and location.
  source_type      = "net"
}

Run the following command to initialize the Terraform runtime environment.

terraform init

The following output indicates that Terraform has been initialized.

Initializing the backend...

Initializing provider plugins...
- Checking for available provider plugins...
- Downloading plugin for provider "alicloud" (hashicorp/alicloud) 1.203.0...


Warning: registry.terraform.io: For users on Terraform 0.13 or greater, this provider has moved to aliyun/alicloud. Please update your source in required_providers.


Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Create an execution plan and preview the changes.
```
terraform plan
```

Run the following command to configure the access control policy for the Internet firewall.

terraform apply

When prompted, enter yes and press the Enter key. Wait for the command to complete. The following output indicates that the access control policy for the Internet firewall has been configured.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_cloud_firewall_control_policy.example: Creating...
alicloud_cloud_firewall_control_policy.example: Creation complete after 1s [id=ef9bdf22-07d4-4080-8ec0-824ec3****:out]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Verification results

Run the following command to query the details of the resources that were created by Terraform.

terraform show

# alicloud_cloud_firewall_control_policy.example:
resource "alicloud_cloud_firewall_control_policy" "example" {
    acl_action       = "accept"
    acl_uuid         = "ef9bdf22-07d4-4080-8ec0-824ec3f0****"
    application_name = "ANY"
    description      = "Created_by_terraform"
    dest_port        = "0/0"
    dest_port_type   = "port"
    destination      = "100.X.X.X/24"
    destination_type = "net"
    direction        = "out"
    id               = "ef9bdf22-07d4-4080-8ec0-824ec****:out"
    ip_version       = "4"
    proto            = "ANY"
    release          = "true"
    source           = "1.X.X.X/24"
    source_type      = "net"
}

Log on to the Cloud Firewall console and search for the policy ID to view the access control policy.

Clean up resources

When you no longer need the resources created or managed by Terraform, run the following command to release them. For more information about the terraform destroy command, see Common commands.

terraform destroy

Complete example

Note

You can run the sample code in this topic with a single click. Run with one click

Sample code

resource "alicloud_cloud_firewall_control_policy" "example" {
  # The application type supported by the access control policy. Valid values: ANY, HTTP, HTTPS, MQTT, Memcache, MongoDB, MySQL, RDP, Redis, SMTP, SMTPS, SSH, SSL, and VNC.
  application_name = "ANY"
  # The action that Cloud Firewall performs on the traffic. Valid values: accept, drop, and log.
  acl_action       = "accept"
  # The description.
  description      = "Created_by_terraform"
  # The type of the destination address in the access control policy. Valid values: net, group, domain, and location.
  destination_type = "net"
  # The destination address in the access control policy.
  destination      = "100.1.1.0/24"
  # The traffic direction for which the access control policy is applied. Valid values: in and out.
  direction        = "out"
  # The protocol type supported by the access control policy. Valid values: ANY, TCP, UDP, and ICMP.
  proto            = "ANY"
  # The source address in the access control policy.
  source           = "1.2.3.0/24"
  # The type of the source address in the access control policy. Valid values: net, group, and location.
  source_type      = "net"
}