mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
.
This commit is contained in:
@@ -0,0 +1,59 @@
|
||||
---
|
||||
name: terraform-azure
|
||||
description: Provision Azure infrastructure with Terraform. Configure providers, manage state, and deploy resources. Use when implementing IaC for Azure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Terraform Azure
|
||||
|
||||
Provision Azure infrastructure with Terraform.
|
||||
|
||||
## Provider Configuration
|
||||
|
||||
```hcl
|
||||
terraform {
|
||||
required_providers {
|
||||
azurerm = {
|
||||
source = "hashicorp/azurerm"
|
||||
version = "~> 3.0"
|
||||
}
|
||||
}
|
||||
backend "azurerm" {
|
||||
resource_group_name = "tfstate"
|
||||
storage_account_name = "tfstate12345"
|
||||
container_name = "tfstate"
|
||||
key = "prod.terraform.tfstate"
|
||||
}
|
||||
}
|
||||
|
||||
provider "azurerm" {
|
||||
features {}
|
||||
}
|
||||
```
|
||||
|
||||
## Example Resources
|
||||
|
||||
```hcl
|
||||
resource "azurerm_resource_group" "main" {
|
||||
name = "myapp-rg"
|
||||
location = "East US"
|
||||
}
|
||||
|
||||
resource "azurerm_virtual_network" "main" {
|
||||
name = "myapp-vnet"
|
||||
address_space = ["10.0.0.0/16"]
|
||||
location = azurerm_resource_group.main.location
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
}
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use remote state in Azure Storage
|
||||
- Implement resource naming conventions
|
||||
- Use data sources for existing resources
|
||||
- Tag all resources
|
||||
- Use modules for reusability
|
||||
@@ -0,0 +1,80 @@
|
||||
# Azure Virtual Network Module Template
|
||||
|
||||
variable "address_space" {
|
||||
description = "VNet address space"
|
||||
type = list(string)
|
||||
default = ["10.0.0.0/16"]
|
||||
}
|
||||
|
||||
# Virtual Network
|
||||
resource "azurerm_virtual_network" "main" {
|
||||
name = "${var.project_name}-${var.environment}-vnet"
|
||||
location = azurerm_resource_group.main.location
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
address_space = var.address_space
|
||||
|
||||
tags = local.common_tags
|
||||
}
|
||||
|
||||
# Public Subnet
|
||||
resource "azurerm_subnet" "public" {
|
||||
name = "public-subnet"
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
virtual_network_name = azurerm_virtual_network.main.name
|
||||
address_prefixes = ["10.0.1.0/24"]
|
||||
}
|
||||
|
||||
# Private Subnet
|
||||
resource "azurerm_subnet" "private" {
|
||||
name = "private-subnet"
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
virtual_network_name = azurerm_virtual_network.main.name
|
||||
address_prefixes = ["10.0.2.0/24"]
|
||||
}
|
||||
|
||||
# AKS Subnet
|
||||
resource "azurerm_subnet" "aks" {
|
||||
name = "aks-subnet"
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
virtual_network_name = azurerm_virtual_network.main.name
|
||||
address_prefixes = ["10.0.10.0/23"]
|
||||
}
|
||||
|
||||
# Network Security Group
|
||||
resource "azurerm_network_security_group" "main" {
|
||||
name = "${var.project_name}-${var.environment}-nsg"
|
||||
location = azurerm_resource_group.main.location
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
|
||||
security_rule {
|
||||
name = "SSH"
|
||||
priority = 1001
|
||||
direction = "Inbound"
|
||||
access = "Allow"
|
||||
protocol = "Tcp"
|
||||
source_port_range = "*"
|
||||
destination_port_range = "22"
|
||||
source_address_prefix = "*"
|
||||
destination_address_prefix = "*"
|
||||
}
|
||||
|
||||
tags = local.common_tags
|
||||
}
|
||||
|
||||
# NSG Association
|
||||
resource "azurerm_subnet_network_security_group_association" "public" {
|
||||
subnet_id = azurerm_subnet.public.id
|
||||
network_security_group_id = azurerm_network_security_group.main.id
|
||||
}
|
||||
|
||||
output "vnet_id" {
|
||||
value = azurerm_virtual_network.main.id
|
||||
}
|
||||
|
||||
output "subnet_ids" {
|
||||
value = {
|
||||
public = azurerm_subnet.public.id
|
||||
private = azurerm_subnet.private.id
|
||||
aks = azurerm_subnet.aks.id
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,130 @@
|
||||
#!/bin/bash
|
||||
# Terraform Azure Project Initialization Script
|
||||
# Usage: ./tf-init-azure.sh <project-name> [location]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PROJECT_NAME="${1:-}"
|
||||
LOCATION="${2:-eastus}"
|
||||
|
||||
if [ -z "$PROJECT_NAME" ]; then
|
||||
echo "Usage: $0 <project-name> [location]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "========================================="
|
||||
echo "Terraform Azure Project Setup"
|
||||
echo "Project: $PROJECT_NAME"
|
||||
echo "Location: $LOCATION"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
mkdir -p "$PROJECT_NAME"
|
||||
cd "$PROJECT_NAME"
|
||||
|
||||
# Create main.tf
|
||||
cat > main.tf << EOF
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
azurerm = {
|
||||
source = "hashicorp/azurerm"
|
||||
version = "~> 3.0"
|
||||
}
|
||||
}
|
||||
|
||||
# Uncomment for remote state
|
||||
# backend "azurerm" {
|
||||
# resource_group_name = "${PROJECT_NAME}-tfstate-rg"
|
||||
# storage_account_name = "${PROJECT_NAME}tfstate"
|
||||
# container_name = "tfstate"
|
||||
# key = "terraform.tfstate"
|
||||
# }
|
||||
}
|
||||
|
||||
provider "azurerm" {
|
||||
features {}
|
||||
}
|
||||
|
||||
# Resource Group
|
||||
resource "azurerm_resource_group" "main" {
|
||||
name = "\${var.project_name}-\${var.environment}-rg"
|
||||
location = var.location
|
||||
|
||||
tags = local.common_tags
|
||||
}
|
||||
|
||||
locals {
|
||||
common_tags = {
|
||||
Project = var.project_name
|
||||
Environment = var.environment
|
||||
ManagedBy = "terraform"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create variables.tf
|
||||
cat > variables.tf << EOF
|
||||
variable "project_name" {
|
||||
description = "Project name for resource naming"
|
||||
type = string
|
||||
default = "${PROJECT_NAME}"
|
||||
}
|
||||
|
||||
variable "environment" {
|
||||
description = "Environment (dev, staging, prod)"
|
||||
type = string
|
||||
default = "dev"
|
||||
}
|
||||
|
||||
variable "location" {
|
||||
description = "Azure region"
|
||||
type = string
|
||||
default = "${LOCATION}"
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create outputs.tf
|
||||
cat > outputs.tf << EOF
|
||||
output "resource_group_name" {
|
||||
description = "Resource group name"
|
||||
value = azurerm_resource_group.main.name
|
||||
}
|
||||
|
||||
output "location" {
|
||||
description = "Azure region"
|
||||
value = azurerm_resource_group.main.location
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create terraform.tfvars
|
||||
cat > terraform.tfvars << EOF
|
||||
project_name = "${PROJECT_NAME}"
|
||||
environment = "dev"
|
||||
location = "${LOCATION}"
|
||||
EOF
|
||||
|
||||
# Create .gitignore
|
||||
cat > .gitignore << EOF
|
||||
.terraform/
|
||||
*.tfstate
|
||||
*.tfstate.*
|
||||
*.tfvars.json
|
||||
crash.log
|
||||
*.tfplan
|
||||
!terraform.tfvars.example
|
||||
.idea/
|
||||
*.swp
|
||||
.vscode/
|
||||
EOF
|
||||
|
||||
# Initialize Terraform
|
||||
echo ""
|
||||
echo "Initializing Terraform..."
|
||||
terraform init
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Project created successfully!"
|
||||
echo "========================================="
|
||||
Reference in New Issue
Block a user