How to create a Cloud Firewall instance-Terraform(Terraform)-阿里云帮助中心

This topic describes how to use Terraform to create a Cloud Firewall instance.

Note

The sample code in this topic supports Run Now. You can run the code directly.

Prerequisites

An Alibaba Cloud account (Alibaba Cloud primary account) has all resource permissions. Major risks may occur if the account is compromised. We recommend that you use a Resource Access Management (RAM) user and create an AccessKey pair for the RAM user. For more information, see Create a RAM user and Create an AccessKey pair.

To use the following sample policy to grant permissions to the RAM user, you must attach the Cloud Firewall (CloudFirewall) permission and the AliyunBSSFullAccess permission (used to manage Billing Management) to the RAM user. For more information, see Grant permissions to a RAM user.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "yundun-cloudfirewall:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "bssapi:*",
                "bss:*"
            ],
            "Resource": "*"
        }
    ]
}

Prepare a Terraform runtime environment. You can use one of the following methods to run Terraform.

Use Terraform in Explorer: Alibaba Cloud provides an online Terraform runtime environment that does not require you to install Terraform. You can log on to use and test Terraform online. This method is suitable for scenarios where you want to quickly and easily test Terraform at no cost.

Cloud Shell: Cloud Shell has Terraform components pre-installed and identity credentials pre-configured. You can run Terraform commands directly in Cloud Shell. This method is suitable for scenarios where you want to quickly and easily access and use Terraform at a low cost.

Install and configure Terraform on your computer: This method is suitable for scenarios where you have poor network connectivity or need a custom developer environment.

Important
Make sure that the Terraform version is V1.269.0 or later. To check the current version, run the terraform --version command.

Note

Some resources used in the sample code in this topic are billable. If you no longer need these resources, unsubscribe from them at the earliest opportunity.

Resources used

alicloud_cloud_firewall_instance_v2: creates a Cloud Firewall instance.

Create a Cloud Firewall instance

In this example, a Cloud Firewall instance is created.

Create a working directory and create a configuration file named main.tf in the working directory. main.tf is the main Terraform file that defines the resources to be deployed.

resource "alicloud_cloud_firewall_instance_v2" "default" {
  # The payment type of the resource. Valid values: Subscription, PayAsYouGo.
  payment_type = "PayAsYouGo"
  product_code = "cfw"
  # The product type. Valid values: cfw_elasticity_public_cn, cfw_elasticity_public_intl, cfw_sub_public_cn, cfw_sub_public_intl.
  product_type = "cfw_elasticity_public_cn"
  # The instance specification. Valid values: payg_version, premium_version, enterprise_version, ultimate_version.
  spec         = "payg_version"
  # Specifies whether to enable log analysis. Valid values: true, false.
  cfw_log         = false
  # The subscription duration. This parameter is required when payment_type is set to Subscription.
  # period          = 1
}

Run the following command to initialize the Terraform runtime environment.
```
terraform init
```
If the message Terraform has been successfully initialized! is returned, Terraform is initialized.
Create an execution plan and preview the changes.
```
terraform plan
```
Run the following command to create a Cloud Firewall instance.
```
terraform apply
```
During the execution, enter yes as prompted and press Enter. Wait for the command to complete. If the following information is displayed, the Cloud Firewall instance is created.
Verify the result.
Run the Terraform show command
You can run the following command to query the details of resources created by Terraform.
```
terraform show
```
Log on to the Cloud Firewall console
Log on to Cloud Firewall console. On the Overview page, view the current configuration of the Cloud Firewall instance.

Release resources

Important

You cannot unsubscribe from a subscription Cloud Firewall instance by using Terraform. After you run terraform destroy, the resource is removed from the state file. Unsubscribe from the instance in the console at the earliest opportunity.

Complete sample code

Sample code

resource "alicloud_cloud_firewall_instance_v2" "default" {
  # The payment type of the resource. Valid values: Subscription, PayAsYouGo.
  payment_type = "PayAsYouGo"
  product_code = "cfw"
  # The product type. Valid values: cfw_elasticity_public_cn, cfw_elasticity_public_intl, cfw_sub_public_cn, cfw_sub_public_intl.
  product_type = "cfw_elasticity_public_cn"
  # The instance specification. Valid values: payg_version, premium_version, enterprise_version, ultimate_version.
  spec         = "payg_version"
  # The subscription duration. This parameter is required when payment_type is set to Subscription.
  # period          = 1
}