Skip to main content

NAT Gateway module

GitHub Logo Terraform Logo

Purpose

Terraform module used to deploy Azure NAT Gateway. For limitations and zone-resiliency considerations please refer to Microsoft documentation.

This module can be used to either create a new NAT Gateway or to connect an existing one with subnets deployed using (for example) the VNET module.

Usage

To deploy this resource in it's minimum configuration following code snippet can be used (assuming that the VNET module is used to deploy VNET and Subnets):

module "natgw" {
source = "PaloAltoNetworks/swfw-modules/azurerm//modules/natgw"

name = "NATGW_name"
resource_group_name = "resource_group_name"
location = "region_name"
subnet_ids = { "a_subnet_name" = module.vnet.subnet_ids["a_subnet_name"] }
}

This will create a NAT Gateway in with a single Public IP in a zone chosen by Azure.

Reference

Requirements

NameVersion
terraform>= 1.2, < 2.0
azurerm~> 3.25

Providers

NameVersion
azurerm~> 3.25

Modules

No modules.

Resources

NameType
azurerm_nat_gateway.thisresource
azurerm_nat_gateway_public_ip_association.thisresource
azurerm_nat_gateway_public_ip_prefix_association.nat_ipsresource
azurerm_public_ip.thisresource
azurerm_public_ip_prefix.thisresource
azurerm_subnet_nat_gateway_association.thisresource
azurerm_nat_gateway.thisdata source
azurerm_public_ip.thisdata source
azurerm_public_ip_prefix.thisdata source

Inputs

NameDescriptionTypeDefaultRequired
nameName of a NAT Gateway.stringn/ayes
create_natgwTriggers creation of a NAT Gateway when set to true.

Set it to false to source an existing resource. In this 'mode' the module will only bind an existing NAT Gateway to specified subnets.
booltrueno
resource_group_nameName of a Resource Group hosting the NAT Gateway (either the existing one or the one that will be created).stringn/ayes
locationAzure region. Only for newly created resources.stringn/ayes
tagsA map of tags that will be assigned to resources created by this module. Only for newly created resources.map(string){}no
zoneControls if the NAT Gateway will be bound to a specific zone or not. This is a string with the zone number or null. Only for newly created resources.

NAT Gateway is not zone-redundant. It is a zonal resource. It means that it's always deployed in a zone. It's up to the user to decide if a zone will be specified during resource deployment or if Azure will take that decision for the user.
Keep in mind that regardless of the fact that NAT Gateway is placed in a specific zone it can serve traffic for resources in all zones. But if that zone becomes unavailable resources in other zones will loose internet connectivity.

For design considerations, limitation and examples of zone-resiliency architecture please refer to Microsoft documentation.
stringnullno
idle_timeoutConnection IDLE timeout in minutes. Only for newly created resources.numbernullno
subnet_idsA map of subnet IDs what will be bound with this NAT Gateway. Value is the subnet ID, key value does not matter but should be unique, typically it can be a subnet name.map(string)n/ayes
create_pipSet true to create a Public IP resource that will be connected to newly created NAT Gateway. Not used when NAT Gateway is only sourced.

Setting this property to false has two meanings:
when existing_pip_name is null simply no Public IP will be created
when existing_pip_name is set to a name of an exiting Public IP resource it will be sourced and associated to this NAT Gateway.
booltrueno
existing_pip_nameName of an existing Public IP resource to associate with the NAT Gateway. Only for newly created resources.stringnullno
existing_pip_resource_group_nameName of a resource group hosting the Public IP resource specified in existing_pip_name. When omitted Resource Group specified in resource_group_name will be used.stringnullno
create_pip_prefixSet true to create a Public IP Prefix resource that will be connected to newly created NAT Gateway. Not used when NAT Gateway is only sourced.

Setting this property to false has two meanings:
when existing_pip_prefix_name is null simply no Public IP Prefix will be created
when existing_pip_prefix_name is set to a name of an exiting Public IP Prefix resource it will be sourced and associated to this NAT Gateway.
boolfalseno
pip_prefix_lengthNumber of bits of the Public IP Prefix. This basically specifies how many IP addresses are reserved. Azure default is /28.

This value can be between 0 and 31 but can be limited by limits set on Subscription level.
numbernullno
existing_pip_prefix_nameName of an existing Public IP Prefix resource to associate with the NAT Gateway. Only for newly created resources.stringnullno
existing_pip_prefix_resource_group_nameName of a resource group hosting the Public IP Prefix resource specified in existing_pip_name. When omitted Resource Group specified in resource_group_name will be used.stringnullno

Outputs

NameDescription
natgw_pipn/a
natgw_pip_prefixn/a