Skip to content

Commit 91304ec

Browse files
chkp-avivmchkp-avivm
committed
Publishing Terraform Registry CGNS modules for AWS
1 parent 57e5bb3 commit 91304ec

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

81 files changed

+4918
-0
lines changed

‎README.md

100644100755
Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
![GitHub Wachers](https://img.shields.io/github/watchers/checkpointsw/terraform-aws-cloudguard-network-security)
2+
![GitHub Release](https://img.shields.io/github/v/release/checkpointsw/terraform-aws-cloudguard-network-security)
3+
![GitHub Commits Since Last Commit](https://img.shields.io/github/commits-since/checkpointsw/terraform-aws-cloudguard-network-security/latest/main)
4+
![GitHub Last Commit](https://img.shields.io/github/last-commit/checkpointsw/terraform-aws-cloudguard-network-security/main)
5+
![GitHub Repo Size](https://img.shields.io/github/repo-size/checkpointsw/terraform-aws-cloudguard-network-security)
6+
![GitHub Downloads](https://img.shields.io/github/downloads/checkpointsw/terraform-aws-cloudguard-network-security/total)
7+
8+
# Terraform Modules for CloudGuard Network Security (CGNS) - AWS
9+
10+
## Introduction
11+
This repository provides a structured set of Terraform modules for deploying Check Point CloudGuard Network Security in Amazon Web Services (AWS). These modules automate the creation of Virtual Private Clouds (VPCs), Security Gateways, High-Availability architectures, and more, enabling secure and scalable cloud deployments.
12+
13+
## Repository Structure
14+
`Submodules`: Contains modular, reusable, production-grade Terraform components, each with its own documentation.
15+
16+
`Examples`: Demonstrates how to use the modules.
17+
18+
## Available Submodules
19+
20+
**Submodules:**
21+
* [`autoscale`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/autoscale) - Deploys Auto Scaling Group of CloudGuard Security Gateways into an existing VPC.
22+
* [`autoscale_gwlb`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/autoscale_gwlb) - Deploys Auto Scaling Group of CloudGuard Security Gateways into an existing VPC.
23+
* [`cluster`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cluster) - Deploys CloudGuard Network Security Cluster into an existing VPC on AWS.
24+
* [`cluster_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cluster_master) - Deploys CloudGuard Network Security Cluster into a new VPC.
25+
* [`cme_iam_role`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cme_iam_role) - Creates AWS IAM Role for Cloud Management Extension (CME) on Security Management Server.
26+
* [`cme_iam_role_gwlb`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cme_iam_role_gwlb) - Creates AWS IAM Role for Cloud Management Extension (CME) manages Gateway Load Balancer Auto Scale Group on Security Management Server.
27+
* [`cross_az_cluster`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cross_az_cluster) - Deploys Check Point CloudGuard Network Security Cross AZ Cluster into an existing VPC on AWS.
28+
* [`cross_az_cluster_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cross_az_cluster_master) - Deploys Check Point CloudGuard Network Security Cross AZ Cluster into into a new VPC.
29+
* [`gateway`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/gateway) - Deploys Check Point CloudGuard Network Security Gateway into an existing VPC.
30+
* [`gateway_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/gateway_master) -Check Point CloudGuard Network Security Gateway into a new VPC.
31+
* [`gwlb`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/gwlb) - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into an existing VPC.
32+
* [`gwlb_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/gwlb_master) - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into a new VPC.
33+
* [`management`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/management) - Deploys CloudGuard Network Security Management Server into an existing VPC.
34+
* [`mds`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/mds) - Deploys CloudGuard Network Multi-Domain Server into an existing VPC.
35+
* [`qs_autoscale`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/qs_autoscale) - Deploys CloudGuard Network Security Gateway Auto Scaling Group, an external ALB/NLB, and optionally a Security Management Server and a web server Auto Scaling Group.
36+
* [`qs_autoscale_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/qs_autoscale_master) - Deploys CloudGuard Network Security Gateway Auto Scaling Group, an external ALB/NLB, and optionally a Security Management Server and a web server Auto Scaling Group in a new VPC.
37+
* [`standalone`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/standalone) - Check Point CloudGuard Network Security Gateway & Management (Standalone) instance into an existing VPC.
38+
* [`standalone_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/standalone_master) - CloudGuard Network Security Gateway & Management (Standalone) instance into a new VPC.
39+
* [`tap`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/tap) - Deploys TAP solution in an existing VPC on AWS.
40+
* [`tgw_asg`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/tgw_asg) - Deploys CloudGuard Network Security Gateway Auto Scaling Group for Transit Gateway with an optional Management Server into an existing VPC.
41+
* [`tgw_asg_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/tgw_asg_master) - CloudGuard Network Security Gateway Auto Scaling Group for Transit Gateway with an optional Management Server in a new VPC.
42+
* [`tgw_cross_az_cluster`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/tgw_cross_az_cluster) - Deploys CloudGuard Network Security Cross AZ Cluster into an existing VPC on AWS for Transit Gateway.
43+
* [`tgw_cross_az_cluster_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/tgw_cross_az_cluster_master) - Deploys CloudGuard Network Security Cross AZ Cluster with a new VPC on AWS for Transit Gateway.
44+
* [`tgw_gwlb`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/tgw_gwlb) - Deploys WS Auto Scaling group configured for Gateway Load Balancer into existing Centralized Security VPC for Transit Gateway.
45+
* [`tgw_gwlb_master`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/tgw_gwlb_master) - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into new Centralized Security VPC for Transit Gateway.
46+
47+
48+
**Internal Submodules:**
49+
* [`amis`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/amis)
50+
* [`cloudwatch_policy`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cloudwatch_policy)
51+
* [`cluster_iam_role`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/cluster_iam_role)
52+
* [`custom_autoscale`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/custom_autoscale)
53+
* [`elastic_ip`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/common/elastic_ip)
54+
* [`gateway_instance`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/common/gateway_instance)
55+
* [`instance_type`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/common/instance_type)
56+
* [`internal_default_route`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/common/internal_default_route)
57+
* [`load_balancer`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/common/load_balancer)
58+
* [`permissive_sg`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/common/permissive_sg)
59+
* [`version_license`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/common/version_license)
60+
* [`vpc`](https://registry.terraform.io/modules/checkpointsw/cloudguard-network-security/aws/latest/submodules/vpc)
61+
62+
63+
***
64+
# AWS Terraform Security Group Configuration
65+
66+
## Default Security Rules
67+
Each submodule in this repository includes **preconfigured security group rules** designed to ensure the solution works properly out of the box. These rules are tailored for the default deployment scenarios but may require adjustments to meet your specific security and compliance requirements.
68+
69+
**Example:** To restrict inbound\outbound traffic, update the security_rules attribute in the submodule configuration:
70+
71+
```hcl
72+
security_rules = [
73+
{
74+
direction = "ingress"
75+
from_port = 22
76+
to_port = 22
77+
protocol = "tcp"
78+
cidr_blocks = ["10.0.0.0/30"]
79+
}
80+
]
81+
```
82+
# Best Practices for Using CloudGuard Modules
83+
84+
## Step 1: Use the Required Module
85+
Add the required module in your Terraform configuration file (`main.tf`) to deploy resources. For example:
86+
87+
```hcl
88+
provider "aws" { }
89+
90+
module "example_module" {
91+
source = "CheckPointSW/cloudguard-network-security/aws//modules/{module_name}"
92+
version = "{chosen_version}"
93+
# Add the required inputs
94+
}
95+
```
96+
---
97+
98+
## Step 2: Open the Terminal
99+
Ensure you have the AWS CLI installed and navigate to the directory containing your main.tf file: is located, using the appropriate terminal:
100+
101+
- **Linux/macOS**: **Terminal**.
102+
- **Windows**: **PowerShell** or **Command Prompt**.
103+
104+
---
105+
106+
## Step 3: Set Environment Variables and Log in with AWS CLI
107+
Set up your AWS credentials and configure the default region by setting environment variables:
108+
109+
110+
### Linux/macOS
111+
```hcl
112+
export AWS_ACCESS_KEY_ID="{your-access-key-id}"
113+
export AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
114+
export AWS_DEFAULT_REGION="{your-region}"
115+
116+
aws configure
117+
118+
```
119+
### PowerShell (Windows)
120+
```hcl
121+
$env:AWS_ACCESS_KEY_ID="{your-access-key-id}"
122+
$env:AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
123+
$env:AWS_DEFAULT_REGION="{your-region}"
124+
125+
aws configure
126+
```
127+
### Command Prompt (Windows)
128+
```hcl
129+
set AWS_ACCESS_KEY_ID="{your-access-key-id}"
130+
set AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
131+
set AWS_DEFAULT_REGION="{your-region}"
132+
133+
aws configure
134+
```
135+
---
136+
137+
138+
## Step 4: Deploy with Terraform
139+
Use Terraform commands to deploy resources securely.
140+
141+
### Initialize Terraform
142+
Prepare the working directory and download required provider plugins:
143+
```hcl
144+
terraform init
145+
```
146+
147+
### Plan Deployment
148+
Preview the changes Terraform will make:
149+
```hcl
150+
terraform plan
151+
```
152+
### Apply Deployment
153+
Apply the planned changes and deploy the resources:
154+
```hcl
155+
terraform apply
156+
```
157+
Note: The terraform apply command might vary slightly depending on the submodule configurations. Pay close attention to any additional instructions provided in the submodules' documentation to ensure correct usage and handling of the resources.

‎modules/amis/main.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
locals {
2+
amis_yaml_regionMap = yamldecode(split("Resources", data.http.amis_yaml_http.response_body)[0]).Mappings.RegionMap
3+
amis_yaml_converterMap = yamldecode(split("Resources", data.http.amis_yaml_http.response_body)[0]).Mappings.ConverterMap
4+
5+
6+
// Variables example:
7+
// version_license = "R81.10-PAYG-NGTX"
8+
// RESULT:
9+
// version_license_key = "R81.10-PAYG-NGTX-GW"
10+
11+
// version_license_value = "R8110PAYGNGTXGW"
12+
13+
version_license_key_mgmt_gw = format("%s%s", var.version_license, var.chkp_type == "gateway" ? "-GW" : var.chkp_type == "management" ? "-MGMT" : var.chkp_type == "mds" ? "-MGMT" : "")
14+
version_license_key = var.chkp_type == "standalone" ? format("%s%s", var.version_license, element(split("-", var.version_license), 1) == "BYOL" ? "-MGMT" : "") : local.version_license_key_mgmt_gw
15+
16+
version_license_value = local.amis_yaml_converterMap[local.version_license_key]["Value"]
17+
18+
// Variables example:
19+
// region = "us-east-1"
20+
// version_license_key - see above
21+
// RESULT: local.ami_id = "ami-1234567"
22+
ami_id = local.amis_yaml_regionMap[local.region][local.version_license_value]
23+
}

‎modules/amis/output.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
output "ami_id" {
2+
value = local.ami_id
3+
}
4+
output "version_license_with_suffix" {
5+
value = local.version_license_key
6+
}

‎modules/amis/variables.tf

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
variable "amis_url" {
2+
type = string
3+
description = "URL to amis.yaml"
4+
default = "https://cgi-cfts.s3.amazonaws.com/utils/amis.yaml"
5+
}
6+
7+
data "http" "amis_yaml_http" {
8+
url = var.amis_url
9+
}
10+
11+
data "aws_region" "current" {}
12+
locals {
13+
region = data.aws_region.current.name
14+
}
15+
16+
// --- Version & License ---
17+
variable "chkp_type" {
18+
type = string
19+
description = "The Check Point machine type"
20+
default = "gateway"
21+
}
22+
variable "version_license" {
23+
type = string
24+
description = "Version and license"
25+
}
26+

0 commit comments

Comments
 (0)