generated from cyber-scot/terraform-module-repo-template
-
Notifications
You must be signed in to change notification settings - Fork 0
/
variables.tf
125 lines (117 loc) · 6.15 KB
/
variables.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
variable "add_resource_lock_to_nsg_policy" {
description = "Configuration for policy which adds a resource lock to all NSGs"
type = object({
name = optional(string, "add-nsg-lock")
deploy_assignment = optional(bool, true)
management_group_id = optional(string)
attempt_role_assignment = optional(bool, true)
enforce = optional(bool, true)
location = optional(string, "uksouth")
role_definition_id = optional(string, "/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635")
non_compliance_message = optional(string)
description = optional(string)
})
}
variable "append_default_deny_nsg_rule_policy" {
description = "Configuration for append deny NSG rule deployment policy"
type = object({
name = optional(string, "append-nsg-default-deny1")
deploy_assignment = optional(bool, true)
nsg_rule_name = optional(string, "DenyAnyInbound")
management_group_id = optional(string)
enforce = optional(bool, true)
non_compliance_message = optional(string)
description = optional(string)
effect = optional(string, "Append")
protocol = optional(string, "*")
access = optional(string, "Deny")
name_suffix = optional(string, "*")
priority = optional(string, "4096")
direction = optional(string, "Inbound")
source_port_ranges = optional(list(string), ["*"])
destination_port_ranges = optional(list(string), ["*"])
source_address_prefixes = optional(list(string), ["*"])
destination_address_prefixes = optional(list(string), ["*"])
})
}
variable "attempt_read_tenant_root_group" {
type = bool
default = true
description = "Whether the module should attempt to read the tenant root group, your SPN may not have permissions"
}
variable "deny_nsg_deletion_action_policy" {
description = "Configuration for DenyAction policy for NSG"
type = object({
name = optional(string, "deny-nsg-delete")
deploy_assignment = optional(bool, true)
management_group_id = optional(string)
enforce = optional(bool, true)
non_compliance_message = optional(string)
description = optional(string)
})
}
variable "like_mandatory_resource_tagging_policy" {
description = "Configuration for the mandatory resource tagging policy for the like"
type = object({
name = optional(string, "like-mandatory-tags")
deploy_assignment = optional(bool, true)
management_group_id = optional(string)
enforce = optional(bool, true)
non_compliance_message = optional(string)
description = optional(string)
effect = optional(string, "Audit")
required_tags = list(object({
key = string
pattern = string
}))
})
}
variable "match_mandatory_resource_tagging_policy" {
description = "Configuration for the mandatory resource tagging policy for the match pattern"
type = object({
name = optional(string, "match-mandatory-tags")
deploy_assignment = optional(bool, true)
management_group_id = optional(string)
enforce = optional(bool, true)
non_compliance_message = optional(string)
description = optional(string)
effect = optional(string, "Audit")
required_tags = list(object({
key = string
pattern = string
}))
})
}
variable "non_privileged_role_restriction_policy" {
description = "Configuration for the non privileged role restriction policy, this policy allows you to restrict specific role definition IDs to specific principal types, in the event you would like users to have different access to other things like Managed Identities (normally used in automation)"
type = object({
name = optional(string, "restrict-roles-for-non-privileged")
management_group_id = optional(string)
deploy_assignment = optional(bool, true)
enforce = optional(bool, true)
non_compliance_message = optional(string)
description = optional(string)
effect = optional(string, "Audit")
non_privileged_role_definition_ids = optional(list(string), [])
non_privileged_role_definition_restricted_principal_types = optional(list(string), ["User", "Group"])
})
}
variable "policy_prefix" {
type = string
description = "The prefix to apply to the custom policies"
default = "[CyberScot]"
}
variable "privileged_role_restriction_policy" {
description = "Configuration for the role restriction policy, this policy allows you to restrict specific role definition IDs to specific principal types, in the event you would like users to have different access to other things like Managed Identities (normally used in automation)"
type = object({
name = optional(string, "restrict-roles-for-principal-type")
management_group_id = optional(string)
deploy_assignment = optional(bool, true)
enforce = optional(bool, true)
non_compliance_message = optional(string)
description = optional(string)
effect = optional(string, "Audit")
privileged_role_definition_ids = optional(list(string), [])
privileged_role_definition_restricted_principal_types = optional(list(string), ["ServicePrincipal", "ManagedIdentity", "Application"])
})
}