Palo Alto Networks Bootstrap Module for Azure

A terraform module for deploying a storage account and the dependencies required to bootstrap a VM-Series firewalls in Azure.

The module does not configure the bootstrap images, licenses, or configurations.

Usage

Simple example usage is shown below. For more real life code please check examples folder.

module "bootstrap" {
  source = "PaloAltoNetworks/vmseries-modules/azurerm//modules/bootstrap"

  storage_account_name = "accountname"
  resource_group_name  = "rg-name"
  location             = "West US"

  storage_share_name = "vm_bootstrap"

  files = {
    "files/init-cfg.txt" = "config/init-cfg.txt"
    "files/bootstrap.xml" = "config/bootstrap.xml"
  }
}

Known Limitations

If a file does not exist because it is supposed to be generated by the same Terraform run, add a hash of its contents to the input files_md5 as a workaround. For example:

module "bootstrap" {
  # ...
  files     = { (local_file.this.filename) = "config/dynamic-content-test.txt" }
  files_md5 = { (local_file.this.filename) = md5(local_file.this.content) }
}

resource "local_file" "this" {
  filename = "test.txt"
  content  = "hello world"
}

Reference

Requirements

Name	Version
terraform	>= 1.2, < 2.0
azurerm	~> 3.25
random	~> 3.1

Providers

Name	Version
azurerm	~> 3.25

Modules

No modules.

Resources

Name	Type
azurerm_storage_account.this	resource
azurerm_storage_share.this	resource
azurerm_storage_share_directory.this	resource
azurerm_storage_share_file.this	resource
azurerm_storage_account.this	data source

Inputs

Name	Description	Type	Default	Required
create_storage_account	If true, create a Storage Account.	bool	true	no
name	Name of the Storage Account, either a new or an existing one (depending on the value of create_storage_account). The name you choose must be unique across Azure. The name also must be between 3 and 24 characters in length, and may include only numbers and lowercase letters.	string	n/a	yes
resource_group_name	Name of the Resource Group to use.	string	n/a	yes
location	Region to deploy bootstrap resources. Ignored when create_storage_account is set to false.	string	null	no
min_tls_version	The minimum supported TLS version for the storage account.	string	"TLS1_2"	no
files	Map of all files to copy to bucket. The keys are local paths, the values are remote paths. Always use slash / as directory separator (unix-like), not the backslash \. Example: files = { "dir/my.txt" = "config/init-cfg.txt" }	map(string)	{}	no
bootstrap_files_dir	Bootstrap file directory. If the variable has a value of null (default) - then it will not upload any other files other than the ones specified in the files variable. More information can be found at https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/bootstrap-the-vm-series-firewall/bootstrap-package.	string	null	no
files_md5	Optional map of MD5 hashes of file contents. Normally the map could be empty, because all the files that exist before the terraform apply will have their hashes auto-calculated. This input is necessary only for the selected files which are created/modified within the same Terraform run as this module. The keys of the map should be identical with selected keys of the files input, while the values should be MD5 hashes of the contents of that file. Example: files_md5 = { "dir/my.txt" = "6f7ce3191b50a58cc13e751a8f7ae3fd" }	map(string)	{}	no
storage_share_name	Name of a storage File Share to be created that will hold files used for bootstrapping. For rules defining a valid name see Microsoft documentation.	string	null	no
storage_share_quota	Maximum size of a File Share.	number	50	no
storage_share_access_tier	Access tier for the File Share.	string	"Cool"	no
tags	A map of tags to be associated with the resources created.	map(string)	{}	no
retention_policy_days	Log retention policy in days	number	7	no
blob_delete_retention_policy_days	Specifies the number of days that the blob should be retained	number	7	no
storage_allow_inbound_public_ips	List of IP CIDR ranges (like ["23.23.23.23"]) that are allowed to access the Storage Account. Only public IPs are allowed - RFC1918 address space is not permitted.	list(string)	[]	no
storage_allow_vnet_subnet_ids	List of the allowed VNet subnet ids. Note that this option requires network service endpoint enabled for Microsoft Storage for the specified subnets. If you are using vnet module - set storage_private_access to true for the specific subnet. Example: [ module.vnet.subnet_ids["subnet-mgmt"], module.vnet.subnet_ids["subnet-pub"], module.vnet.subnet_ids["subnet-priv"] ]	list(string)	[]	no
storage_acl	If true, storage account network rules will be activated with Deny as the default action. In such case, at least one of storage_allow_inbound_public_ips or storage_allow_vnet_subnet_ids must be a non-empty list.	bool	true	no

Outputs

Name	Description
storage_account	The Azure Storage Account object used for the Bootstrap.
storage_share	The File Share object within Azure Storage used for the Bootstrap.
primary_access_key	The primary access key for the Azure Storage Account.