Cloud Security Connector PriCPA for Azure

This Terraform template deploys one or two Cloud Security Connector (CSC) PriCPA appliances into an existing Azure Virtual Network (VNet).

It consolidates multiple deployment scenarios (Availability Zones, Availability Sets, and single/dual VM) into a single, flexible Terraform configuration using the official Azure Marketplace image.

Features

• Flexible Deployment: Deploy in High Availability (2 VMs) or as a single instance (1 VM) using the vm_count variable.
• Flexible Infrastructure:
  • az: Deploys VMs across different Availability Zones.
  • as: Deploys VMs into a new Availability Set.
  • ni: Deploys VMs with no specific HA infrastructure.
• Azure Marketplace Integration: Automatically provisions the VMs using the official maidenhead-bridge publisher offer (pricpa-csc-az).
• Multi-IP Networking: Provisions ServiceIP and PriCPA-FW network configurations with dedicated static Public IPs on the external interface (eth0).
• Automated Role Assignments: Automatically grants the VM's System-Assigned Managed Identity the "Contributor" and "Network Contributor" roles on:
  1. The VM's Resource Group.
  2. The VNet's Resource Group (if different from the VM's).
• User Data Provisioning: Reads a configUserData.json file from the local directory, Base64 encodes it, and passes it to the VM's user_data property for provisioning.

Prerequisites

Before running this template, you must have:

1. Terraform (v1.0+) and the Azure provider (v3.0+).
2. Azure Credentials configured (e.g., by running az login).
3. Marketplace Terms Accepted: Ensure your Azure subscription has accepted the legal terms for this specific Marketplace image.
4. An Existing Azure VNet.
5. Two Existing Subnets in the VNet (e.g., csc-external-subnet-name and csc-internal-subnet-name).
6. A configUserData.json file in the same directory. You can pass configuration values or leave it with default settings.

Usage

1. Place all .tf files, terraform.auto.tfvars, and configUserData.json in the same directory.
2. Edit terraform.auto.tfvars to match your environment.
3. Edit configUserData.json with your specific CSC provisioning data.
4. Initialize the project:

   terraform init
   

5. Review the plan:

   terraform plan
   

6. Apply the configuration:

   terraform apply
   

Configuration Files

terraform.auto.tfvars (User Configuration)

This is the primary file you will edit.

# ----------------------------------------------------------------
#               CSC Deployment Configuration (Marketplace)
# ----------------------------------------------------------------

# --- Select Single or HA ---
vm_count = 2

# -- Deployment Choices --
# "az" = Availability Zones (Recommended for HA)
# "as" = Availability Sets (For regions without AZs)
# "ni" = No Infrastructure (Single VM or standalone VMs)
deployment_type = "as"

# -- Availability Zone Settings (Only used if deployment_type = "az") --
availability_zones = ["1", "2"]

# -- Availability Set Settings (Only used if deployment_type = "as") --
availability_set_name = "pricpa-csc-aS"
fault_domains         = 2
update_domains        = 5

# -- VM Configuration --
vm_name_prefix        = "pricpa-csc-aS"
resource_group_name   = "my-rg"

# Recommended VM Size
vm_size               = "Standard_B2ats_v2"

# Storage account type for the OS Disk.
storage_disk_type     = "StandardSSD_LRS"

# -- VM Authentication --
admin_username        = "cscadmin"
authentication_type   = "sshPublicKey"
admin_password_or_key = "ssh-rsa AAAA..." # <--- REPLACE THIS

# -- Network Configuration --
vnet_name                = "vnet-name"
vnet_resource_group_name = "vnet-name-resource-group"
external_subnet_name     = "csc-external-subnet-name"
internal_subnet_name     = "csc-internal-subnet-name"