Cloudmarque.Azure

1.0.16

Public/Deploy/IaaS/networking/firewall/New-CmAzIaasFirewalls.ps1

function New-CmAzIaasFirewalls {

    <#
        .Synopsis
         Creates multiple firewalls and policies
 
        .Description
         Completes the following:
            * Creates firewall polices.
            * Creates firewalls.
            * Creates firewall subnet.
 
        .Parameter SettingsFile
         File path for the settings file to be converted into a settings object.
 
        .Parameter SettingsObject
         Object containing the configuration values required to run this cmdlet.
 
        .Parameter TagSettingsFile
         File path for the tag settings file to be converted into a tag settings object.
 
        .Parameter OmitTags
         Parameter to specify if the cmdlet should handle its own tagging.
 
        .Component
         IaaS
 
        .Example
         New-CmAzIaasFirewalls -settingsFile "firewalls.yml"
 
        .Example
         New-CmAzIaasFirewalls -settingsObject $firewalls
    #>

    [CmdletBinding(SupportsShouldProcess, ConfirmImpact = "Medium")]
    param(
        [parameter(Mandatory = $true, ParameterSetName = "Settings Yml File")]
        [String]$SettingsFile,
        [parameter(Mandatory = $true, ParameterSetName = "Settings Object")]
        [Object]$SettingsObject,
        [String]$TagSettingsFile
    )

    $ErrorActionPreference = "Stop"

    try {

        $commandName = $MyInvocation.MyCommand.Name

        Write-CommandStatus -CommandName $commandName

        $SettingsObject = Get-Settings -SettingsFile $SettingsFile -SettingsObject $SettingsObject -CmdletName $commandName

        if ($PSCmdlet.ShouldProcess((Get-CmAzSubscriptionName), "Create firewalls")) {

            foreach ($firewallPolicy in $SettingsObject.firewallPolicies) {

                Set-GlobalServiceValues -GlobalServiceContainer $SettingsObject -ServiceKey "resourceGroup" -ResourceServiceContainer $firewallPolicy -IsDependency
                Set-GlobalServiceValues -GlobalServiceContainer $SettingsObject -ServiceKey "vnet" -ResourceServiceContainer $firewallPolicy -IsDependency

                $resourceGroup = Get-CmAzService -Service $firewallPolicy.service.dependencies.resourceGroup -ThrowIfMultiple -IsResourceGroup
                $vnet = Get-CmAzService -Service $firewallPolicy.service.dependencies.vnet -ThrowIfMultiple -ThrowIfUnavailable

                if ($firewallPolicy.service.dependencies.baseFirewallPolicy) {
                    $basePolicy = Get-CmAzService -Service $firewallPolicy.service.dependencies.baseFirewallPolicy -ThrowIfUnavailable -ThrowIfMultiple
                    $firewallPolicy.basePolicy = @{ id = $basePolicy.ResourceId }
                }
                else {
                    $firewallPolicy.basePolicy = @{}
                }

                $firewallPolicy.resourceGroupName = $resourceGroup.resourceGroupName ? $resourceGroup.resourceGroupName : $vnet.resourceGroupName
                $firewallPolicy.location ??= $vnet.location ? $vnet.location : $resourceGroup.location
                $firewallPolicy.threatIntelMode ??= "Alert"
                $firewallPolicy.threatIntelWhitelist ??= @{ ipAddresses = @(); fqdns = @() }
                $firewallPolicy.dnsSettings ??= @{}
                $firewallPolicy.ruleCollectionGroups ??= @()

                foreach ($ruleCollectionGroupsSettingFile in $firewallPolicy.ruleCollectionGroupsSettingFiles) {
                    $firewallPolicy.ruleCollectionGroups += (Get-Settings -SettingsFile $ruleCollectionGroupsSettingFile `
                                                                 -CmdletName (Get-CurrentCmdletName -ScriptRoot $PSCommandPath) `
                                                                 -SubSchema 'New-CmAzIaasFirewalls.RuleCollectionGroups.SubSchema.json' ).ruleCollectionGroups
                }

                foreach ($ruleCollection in $firewallPolicy.ruleCollectionGroups.ruleCollections) {

                    switch ($ruleCollection.type) {

                        dnat {
                            $ruleCollection.ruleCollectionType = "FirewallPolicyNatRuleCollection"
                            $ruleType = "NatRule"
                            $ruleCollection.actionType ??= "Dnat"
                        }

                        network {
                            $ruleCollection.ruleCollectionType = "FirewallPolicyFilterRuleCollection"
                            $ruleType = "NetworkRule"
                            $ruleCollection.actionType ??= "allow"
                        }

                        application {
                            $ruleCollection.ruleCollectionType = "FirewallPolicyFilterRuleCollection"
                            $ruleType = "ApplicationRule"
                            $ruleCollection.actionType ??= "allow"
                        }
                    }

                    foreach ($rule in $ruleCollection.rules ) {
                        $rule.ruleType = $ruleType
                    }
                }

                if (!($firewallPolicy.ruleCollectionGroups -is [array])) {
                    $firewallPolicy.ruleCollectionGroups = @($firewallPolicy.ruleCollectionGroups)
                }

                if (!$firewallPolicy.ruleCollectionGroups) {
                    $firewallPolicy.ruleCollectionGroups = @( @{ name = 'none'; ruleCollections = @() })
                }

                $firewallPolicy.templateName = Get-CmAzResourceName -Resource "deployment" `
                    -Architecture "IaaS" `
                    -Location $firewallPolicy.location `
                    -Name "$commandName-$($firewallPolicy.name)"

                $firewallPolicy.name = Get-CmAzResourceName -Resource "firewallPolicy" `
                    -Architecture "IaaS" `
                    -Location $firewallPolicy.location `
                    -Name $firewallPolicy.name

                Set-GlobalServiceValues -GlobalServiceContainer $SettingsObject -ServiceKey "firewallPolicy" -ResourceServiceContainer $firewallPolicy
            }

            if ($SettingsObject.firewallPolicies) {

                Write-Verbose "Configuring firewall policies..."

                $location = $SettingsObject.firewallPolicies[0].location
                $deploymentName = Get-CmAzResourceName -Resource "Deployment" -Architecture "IaaS" -Location $location -Name "$commandName-Policies"

                New-AzDeployment `
                    -Name $deploymentName `
                    -TemplateFile $PSScriptRoot\New-CmAzIaasFirewallPolicies.json `
                    -Location $location `
                    -firewallPolicies $SettingsObject.firewallPolicies
            }


            foreach ($firewall in $SettingsObject.firewalls) {

                Set-GlobalServiceValues -GlobalServiceContainer $SettingsObject -ServiceKey "vnet" -ResourceServiceContainer $firewall -IsDependency
                Set-GlobalServiceValues -GlobalServiceContainer $SettingsObject -ServiceKey "firewallPolicy" -ResourceServiceContainer $firewall -IsDependency

                $vnet = Get-CmAzService -Service $firewall.service.dependencies.vnet -ThrowIfUnavailable -ThrowIfMultiple

                $firewallPolicyService = $SettingsObject.firewallPolicies | Where-Object { $_.service.publish.firewallPolicy -eq $firewall.service.dependencies.firewallPolicy }

                if ($firewallPolicyService -is [array]) {
                    Write-Error "Multiple firewall policies have same tags. Please provide unique service tag." -Category InvalidData -TargetObject $firewallPolicyService
                }

                $firewallPolicyService ??= Get-CmAzService -Service $firewall.service.dependencies.firewallPolicy -ThrowIfUnavailable -ThrowIfMultiple

                $firewall.firewallPolicy = @{
                    resourceGroupName = $firewallPolicyService.resourceGroupName
                    name              = $firewallPolicyService.name ?  $firewallPolicyService.name  : $firewallPolicyService.resourceName
                }

                $firewall.location = $vnet.location
                $firewall.resourceGroupName = $vnet.resourceGroupName
                $firewall.vnetName = $vnet.resourceName

                $firewall.templateName = Get-CmAzResourceName -Resource "deployment" `
                    -Architecture "IaaS" `
                    -Location $firewall.location `
                    -Name "$commandName-$($firewall.name)"

                $firewall.name = Get-CmAzResourceName -Resource "firewall" `
                    -Architecture "IaaS" `
                    -Location $firewall.location `
                    -Name $firewall.name

                $firewall.publicIpAddressName = Get-CmAzResourceName -Resource "PublicIPAddress" `
                    -Architecture "IaaS" `
                    -Location $firewall.location `
                    -Name $firewall.name

                Set-GlobalServiceValues -GlobalServiceContainer $SettingsObject -ServiceKey "firewall" -ResourceServiceContainer $firewall
            }

            if ($SettingsObject.firewalls) {

                Write-Verbose "Configuring firewalls..."

                $location = $SettingsObject.firewalls[0].location
                $deploymentName = Get-CmAzResourceName -Resource "Deployment" -Architecture "IaaS" -Location $location -Name $commandName

                New-AzDeployment `
                    -Name $deploymentName `
                    -TemplateFile $PSScriptRoot\New-CmAzIaasFirewalls.json `
                    -Location $location `
                    -firewalls $SettingsObject.firewalls
            }
        }

        Write-Verbose "Started tagging for firewall policies..."
        Set-DeployedResourceTags -TagSettingsFile $TagSettingsFile -ResourceIds $SettingsObject.firewallPolicies.name

        Write-Verbose "Started tagging for firewall..."
        Set-DeployedResourceTags -TagSettingsFile $TagSettingsFile -ResourceIds $SettingsObject.firewalls.name

        Write-CommandStatus -CommandName $commandName -Start $false
    }
    catch {
        $PSCmdlet.ThrowTerminatingError($PSItem)
    }
}