Cloud Security Connector MUX for Zscaler (ZIA) with PriCPA for Azure (Public Azure Marketplace)

This Terraform template deploys one or two Cloud Security Connector (CSC) MUX with PriCPA for Azure appliances using public Azure Marketplace offers (maidenhead-bridge) with Trusted Launch enabled inside an existing Azure Virtual Network (VNet).

Features

• Azure Marketplace Integration: Automatically maps csc_model_version (1, 2, 4, or 8) to the corresponding maidenhead-bridge public offer and SKU (*-gen2).
• Trusted Launch Support: Configures Secure Boot and vTPM for Gen2 VM deployment.
• Flexible Deployment: Deploy in High Availability (2 VMs) or as a single instance (1 VM) using the vm_count variable.
• Flexible Infrastructure:
  • az: Deploys VMs across different Availability Zones.
  • as: Deploys VMs into a new Availability Set.
  • ni: Deploys VMs with no specific HA infrastructure.
• Automated Role Assignments: Automatically grants the VM's Managed Identity the "Contributor" and "Network Contributor" roles.
• User Data Provisioning: Reads a configUserData.json file from the local directory and passes base64-encoded user data during initialization.

Prerequisites

1. Terraform (v1.0+) and Azure Provider (v3.1+).
2. Accepted Azure Marketplace terms for the maidenhead-bridge offers (if deploying for the first time in a subscription via CLI/Portal).
3. Existing Azure VNet and Subnets (external and internal).

Accepting Marketplace Terms via Azure CLI

Run the command corresponding to the CSC MUX model version (csc_model_version) you intend to deploy in your target Azure subscription:

# CSC MUX 1
az vm image terms accept \
  --publisher maidenhead-bridge \
  --offer zs-csc-mux-1-pricpa \
  --plan zs-csc-mux-1-pricpa-plan-gen2

# CSC MUX 2
az vm image terms accept \
  --publisher maidenhead-bridge \
  --offer zs-csc-mux-2-pricpa \
  --plan zs-csc-mux-2-pricpa-plan-gen2

# CSC MUX 4
az vm image terms accept \
  --publisher maidenhead-bridge \
  --offer zs-csc-mux-4-pricpa \
  --plan zs-csc-mux-4-pricpa-plan-gen2

# CSC MUX 8
az vm image terms accept \
  --publisher maidenhead-bridge \
  --offer zs-csc-mux-8-pricpa \
  --plan zs-csc-mux-8-pricpa-plan-gen2

Usage

1. Place all .tf files, terraform.auto.tfvars, and configUserData.json in the same directory.
2. Edit terraform.auto.tfvars to select csc_model_version (1, 2, 4, or 8) and configure network/authentication details.
3. Run the deployment:

   terraform init
   terraform plan
   terraform apply