Cloud Firewall
Cloud Firewall
Document
- Documentation
Cloud FirewallDevelopment toolTerraform
Copy page
Download PDFDevelopment tool
Terraform
Copy pageDownload PDFTerraform
This article introduces the installation and configuration of Terraform.
warning
This article contains important notes that you need to pay attention to; ignoring this information may impact your business, so please read carefully.
Introduction to Terraform
Terraform is an open-source IT infrastructure orchestration tool that supports defining infrastructure or applications using configuration files. With Terraform, you can easily orchestrate cloud firewall resources, such as creating and modifying access control policies.
Requirements
You are familiar with the basics of Terraform, including Introduction to Terraform, Installing Terraform, and Terraform Tool Guide.
Note
- volcengine_cfw_address_book Address book management
- volcengine_cfw_control_policy Internet boundary firewall policy management
- volcengine_cfw_control_policy_priority Internet boundary firewall policy priority management
- volcengine_cfw_vpc_firewall_acl_rule VPC boundary firewall policy management
- volcengine_cfw_vpc_firewall_acl_rule_priority VPC boundary firewall policy priority management
- volcengine_cfw_nat_firewall_control_policy NAT boundary firewall policy management
- volcengine_cfw_nat_firewall_control_policy_priority NAT boundary firewall policy priority management
- volcengine_cfw_dns_control_policy Domain name blocklist management
Usage example:
This article takes the Internet boundary firewall as an example, using Terraform to sequentially add the address book, add Internet boundary firewall policies, modify priorities, and clean up resources.
Create address book
Address Book Name | Address book content | Address book Data type | Address book <描述> |
tf-test-ecs-ip | 10.0.0.1 10.0.0.2 | IP address book | volc-terraform-test |
resource "volcengine_cfw_address_book" "ip_address_book_1" {
group_name = "tf-test-ecs-ip"
description = "volc-terraform-test"
group_type = "ip"
address_list = ["10.0.0.1","10.0.0.2"]
}
Configure Internet access control policy
warning
- When creating a rule, if the specified priority is greater than the number of existing rules, the priority will be automatically adjusted to the current maximum. If there are currently 5 rules in the access control policy, and one of the rules is configured with a priority of 10, the cloud firewall will automatically adjust the priority to 5.
- When creating a large number of rules in bulk, they must be created in order of priority from high to low (priority values from smallest to largest), and the depends_on relationship must be configured properly. Otherwise, there may be inconsistencies between the priority of some rules and the configuration file.
resource "volcengine_cfw_control_policy" "create_1" {\n action = "accept"\n description = "Allow 1.1.1.1"\n destination = volcengine_cfw_address_book.IP address book_1.id\n destination_type = "group"\n direction = "in"\n priority = 1\n proto = "TCP"\n dest_port = "80"\n dest_port_type = "port"\n repeat_type = "Permanent"\n source = "1.1.1.1"\n source_type = "net"\n status = true\n}\nresource "volcengine_cfw_control_policy" "create_2" {\n action = "deny"\n description = "Full block fallback policy"\n destination = "0.0.0.0/0"\n destination_type = "net"\n direction = "in"\n priority = 2\n proto = "ANY"\n repeat_type = "Permanent"\n source = "0.0.0.0/0"\n source_type = "net"\n status = true\n depends_on = [volcengine_cfw_control_policy.create_1]\n}
Adjust the priority of the internet access control policy.
warning
- To modify the priority of existing policies, you need to use the firewall priority resources for adjustment. If you directly modify the firewall priority policy, Terraform will not perform validation and the configuration will not take effect.
- When modifying rule priority, it is recommended to modify the priority one by one each time, as batch modification of priority can easily lead to errors in priority configuration.
resource "volcengine_cfw_control_policy_priority" "prio_1" {
direction = "in"
rule_id = volcengine_cfw_control_policy.create_2.rule_id
new_prio = 1
}
Example of erroneous priority modification in bulk: If you want to batch modify the priority of policy 5 (in5) and policy 2 (in2) to priority 3 and priority 4, respectively.
Error example:
resource "volcengine_cfw_control_policy_priority" "prio_in_2" {
direction = "in"
rule_id = volcengine_cfw_control_policy.in2.rule_id
new_prio = 4
}
resource "volcengine_cfw_control_policy_priority" "prio_in_5" {
direction = "in"
rule_id = volcengine_cfw_control_policy.in5.rule_id
new_prio = 3
depends_on = [volcengine_cfw_control_policy_priority.prio_in_2]
}
The cloud firewall system will modify the priority in batches in two steps. If you modify Policy 5 first and then Policy 2, the following situation will occur:
- Modify the priority of Policy 5 to 3
- Modify the priority of Policy 2 to 4
Actual result: Policy 5 changes to priority 2, Policy 2 changes to priority 4. The actual result does not match the expectation.
Clean up resources
terraform destroy
Last updated: 2025.06.11 20:34:09
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
