Palo Alto Networks Panorama Module for AWS
A Terraform module for deploying Panorama in AWS cloud.
Panorama deployed on AWS is Bring Your Own License (BYOL), supports all deployment modes (Panorama, Log Collector, and Management Only), and shares the same processes and functionality as the M-Series hardware appliances. For more information on Panorama modes, see Panorama Models.
Usage
For usage, check the "examples" folder in the root of the repository.
Reference
Requirements
| Name | Version |
|---|---|
| terraform | >= 1.0.0, < 2.0.0 |
| aws | ~> 5.17 |
Providers
| Name | Version |
|---|---|
| aws | ~> 5.17 |
Modules
No modules.
Resources
| Name | Type |
|---|---|
| aws_ebs_volume.this | resource |
| aws_eip.this | resource |
| aws_instance.this | resource |
| aws_volume_attachment.this | resource |
| aws_ami.this | data source |
| aws_ebs_default_kms_key.current | data source |
| aws_kms_alias.current_arn | data source |
Inputs
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| availability_zone | Availability zone in which Panorama will be deployed. | string | n/a | yes |
| create_public_ip | If true, create an Elastic IP address for Panorama. | bool | false | no |
| ebs_encrypted | Whether to enable EBS encryption on root volume. | bool | true | no |
| ebs_kms_key_alias | The alias for the customer managed KMS key to use for volume encryption. If this is set to null the default master key that protects EBS volumes will be used | string | null | no |
| ebs_volumes | List of EBS volumes to create and attach to Panorama. Available options: - name (Optional) Name tag for the EBS volume. If not provided defaults to the value of var.name.- ebs_device_name (Required) The EBS device name to expose to the instance (for example, /dev/sdh or xvdh). See Device Naming on Linux Instances for more information. - ebs_size (Optional) The size of the EBS volume in GiBs. Defaults to 2000 GiB.- force_detach (Optional) Set to true if you want to force the volume to detach. Useful if previous attempts failed, but use this option only as a last resort, as this can result in data loss.- skip_destroy (Optional) Set this to true if you do not wish to detach the volume from the instance to which it is attached at destroy time, and instead just remove the attachment from Terraform state. This is useful when destroying an instance attached to third-party volumes. Note: Terraform must be running with credentials which have the GenerateDataKeyWithoutPlaintext permission on the specified KMS key as required by the EBS KMS CMK volume provisioning process to prevent a volume from being created and almost immediately deleted. If null, the default EBS encryption KMS key in the current region is used. Example:ebs_volumes = [ { name = "ebs-1" ebs_device_name = "/dev/sdb" ebs_size = "2000" }, { name = "ebs-2" ebs_device_name = "/dev/sdb" ebs_size = "2000" }, { name = "ebs-3" ebs_device_name = "/dev/sdb" ebs_size = "2000" }, ] | list(any) | [] | no |
| eip_domain | Indicates if this EIP is for use in VPC | string | "vpc" | no |
| enable_imdsv2 | Whether to enable IMDSv2 on the EC2 instance. Support for this feature has been added in VM-Series Plugin 3.0.0, which in turn requires PAN-OS version 10.2.0 at minimum. | string | false | no |
| global_tags | A map of tags to assign to the resources. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level." | map(any) | {} | no |
| instance_type | EC2 instance type for Panorama. Default set to Palo Alto Networks recommended instance type. | string | "c5.4xlarge" | no |
| name | Name for the Panorama instance. | string | "pan-panorama" | no |
| panorama_ami_id | Specific AMI ID to use for Panorama instance. If null (the default), panorama_version and product_code vars are used to determine a public image to use. | string | null | no |
| panorama_iam_role | IAM Role attached to Panorama instance contained curated IAM Policy. | string | n/a | yes |
| panorama_version | Panorama PAN-OS Software version. List published images with:aws ec2 describe-images \ --filters "Name=product-code,Values=eclz7j04vu9lf8ont8ta3n17o" "Name=name,Values=Panorama-AWS*" \ --output json --query "Images[].Description" | grep -o 'Panorama-AWS-.*' | tr -d '",' | string | "10.1.5" | no |
| private_ip_address | If provided, associates a private IP address to the Panorama instance. | string | null | no |
| product_code | Product code for Panorama BYOL license. | string | "eclz7j04vu9lf8ont8ta3n17o" | no |
| ssh_key_name | AWS EC2 key pair name. | string | n/a | yes |
| subnet_id | VPC Subnet ID to launch Panorama in. | string | n/a | yes |
| vpc_security_group_ids | A list of security group IDs to associate Panorama with. | list(any) | [] | no |
Outputs
| Name | Description |
|---|---|
| mgmt_ip_private_address | Panorama private IP address. |
| mgmt_ip_public_address | Panorama management IP address. If create_public_ip is set to true, it will output the public IP address otherwise it will show the 'no public IP assigned to Panorama' message. |