Allow access to Terraform/Hashicorp domains (#2716)

Revert "Block TRE access to Terraform/Hashicorp domains (#2590)" to be added back in a future release
microsoft · Oct 10, 2022 · 466a542 · 466a542
1 parent 239df38
commit 466a542
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,7 +5,6 @@
 
 **BREAKING CHANGES & MIGRATIONS**:
 
-* Firewall now blocks terraform/hasicorp domains ([#2590](https://github.com/microsoft/AzureTRE/pull/2590)). **Migration** is manual - update the templateVersion of `tre-shared-service-firewall` resource in Cosmos to `0.5.0`. Check the PR for more details.
 * Github Actions deployments use a single ACR instead of two. Github secrets might need updating, see PR for details. ([#2654](https://github.com/microsoft/AzureTRE/pull/2654))
 * Align Github Action secret names. Existing Github environments must be updated, see PR for details. ([#2655](https://github.com/microsoft/AzureTRE/pull/2655))
 * Add workspace creator as an owner of the workspace enterprise application ([#2627](https://github.com/microsoft/AzureTRE/pull/2627)). **Migration** if the `AUTO_WORKSPACE_APP_REGISTRATION` is set, the `Directory.Read.All` MS Graph API permission permission needs granting to the Application Registration identified by `APPLICATION_ADMIN_CLIENT_ID`.

diff --git a/templates/shared_services/firewall/porter.yaml b/templates/shared_services/firewall/porter.yaml
@@ -1,6 +1,6 @@
 ---
 name: tre-shared-service-firewall
-version: 0.6.0
+version: 0.6.1
 description: "An Azure TRE Firewall shared service"
 dockerfile: Dockerfile.tmpl
 registry: azuretre

diff --git a/templates/shared_services/firewall/terraform/firewall.tf b/templates/shared_services/firewall/terraform/firewall.tf
@@ -156,6 +156,26 @@ resource "azurerm_firewall_application_rule_collection" "resource_processor_subn
     source_addresses = data.azurerm_subnet.resource_processor.address_prefixes
   }
 
+  # TODO: remove this rule when all bundles have mirrored their plugins
+  # https://github.com/microsoft/AzureTRE/issues/2445
+  rule {
+    name = "terraform-sources"
+    protocol {
+      port = "443"
+      type = "Https"
+    }
+    protocol {
+      port = "80"
+      type = "Http"
+    }
+
+    target_fqdns = [
+      "registry.terraform.io",
+      "releases.hashicorp.com",
+    ]
+    source_addresses = data.azurerm_subnet.resource_processor.address_prefixes
+  }
+
   depends_on = [
     azurerm_firewall_application_rule_collection.shared_subnet
   ]