How to add a second IP to Azure Firewall

[ddejaham]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform:
v1.4.6

azure provider:
v3.61.0

module:
source = "Azure/caf-enterprise-scale/azurerm"
version = "4.2.0"

Description

Describe the bug

Hello,
We currently have an Azure Firewall deployed with one public IP and would like to add a second. We couldn't find in the documentation how to do this, so we looked in the code and saw that it's possible to enforce the "ip_configuration" part with "custom_settings".
However, according to the azurerm_firewall documentation, each IP requires it's own "ip_configuration" block and in "custom_settings" we can only set one.
So I'd like to know how to add a second public IP.

Steps to Reproduce

No Steps as it's not a bug.

Screenshots

Additional context

[hlokensgard]

@ddejaham a workaround can be to implement the firewall outside of the module and using the output of the module for inputs to the firewall. I hope that we can get the option to configure multiple blocks of ip_configuration in the custom_setting.

[matt-FFFFFF]

Hi we don't support this at the moment. Will will consider this as an enhancement

[tobiasehlert]

I've played around with that a little as mentioned at #3653 (comment) with some success.
The issue I encounter (as mentioned in #513 (comment)) is that the resources created by the module managing the pip (first public IP) is to be removed and forces management outside the landing zone module.

In addition to that, I can't apply a lifecycle management in module.enterprise_scale.azurerm_firewall.connectivity since it's inside a module and can't be used since that block type is reserved for usage in future versions.

[tobiasehlert]

@ddejaham, I'v created PR Azure/terraform-azurerm-caf-enterprise-scale#1243 thats add the option to have multiple IPs in the firewall.