Support for customer provided IPs in secure hub firewall

[cgoenka1]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Since the customer IP is now released by Microsoft for Secure Hub Firewall, we need Terraform to support it. When using ip_configuration, it requires a subnet ID so we cannot use that.

https://learn.microsoft.com/en-us/azure/firewall/secured-hub-customer-public-ip

New or Affected Resource(s)/Data Source(s)

azurerm_firewall

Potential Terraform Configuration

virtual_hub {
    virtual_hub_id = azurerm_virtual_hub.vhub.id

    dynamic "public_ip_addresses" {
      for_each = var.public_ip_ids
      content {
        id = public_ip_addresses.value
      }
    }
  }

References

No response

[Maxyboy50]

To add on to what @cgoenka1 proposed, might be nice to denote the type of public IP to be provisioned, like so:

virtual_hub {
    virtual_hub_id = azurerm_virtual_hub.vhub.id

    public_ip_configuration = {
      name = "ip-config-01"
      type = "CustomerProvided"
      ## Couple of XOR options
      public_ip_id = azurerm_public_ip.azfw_pip_01.id
      public_ip_ids = [azurerm_public_ip.azfw_pip_01.id]
    }
    public_ip_configuration = {
    name = "ip-config-managed"
    type = "MicrosoftProvided"
    public_ip_count = 2
    }
  }

[ayejay-insight]

FYI, looks like the 'Preview" denotation for this feature has been removed from the Portal, any thoughts on when this functionality could be added?

[cgoenka1]

Team, any further updates?

[cgoenka1]

This is now in GA as well.
https://learn.microsoft.com/en-us/azure/firewall/secured-hub-customer-public-ip?tabs=portal

[itdoug77]

I voted to address this and wanted to provide some more context for why this is so important to address.

Current Workaround & Limitations:
As a workaround, users must either:

1. Deploy an Azure Virtual Hub without a firewall, then integrate the firewall separately
2. Update the public IP assignment via the Azure API post-deployment
3. Manually configure firewalls through the Azure portal and sync changes back to Terraform
4. While the existing code can bypass validation for manually configured firewalls with predefined public IPs using lifecycle ignore_changes, any subsequent Terraform changes trigger validation errors, making infrastructure management inconsistent and error-prone.

Business Impact:
This limitation significantly impacts organizations managing infrastructure at scale:

• Scale Challenges: Our company is deploying ~100 VNets across multiple regions with hub firewalls, making manual configuration management unsustainable
• Operational Risk: Manual processes are prone to human error and introduce inconsistencies across environments
• State Drift: Divergence between Terraform state and actual Azure configuration leads to unpredictable deployment outcomes
• Compliance Issues: Manual changes bypass infrastructure-as-code governance and audit trails
• Increased Operational Overhead: Teams must maintain dual processes (Terraform + manual Azure portal changes), increasing complexity and maintenance burden
• Deployment Reliability: Inability to fully automate firewall deployments creates deployment bottlenecks and reduces CI/CD pipeline effectiveness

Request:
Please prioritize adding native support for assigning existing public IPs to Azure Secure Hub Firewalls in the azurerm_firewall resource, enabling full infrastructure-as-code management of this now-GA Azure feature.

[dryhen]

Could the preview label be removed from this issue since it is GA? I don't know if that affects prioritization or not

[BHoggs]

I've submitted a PR that will enable this configuration. As for syntax, I've opted to leave it fairly API-centric, where you'd use multiple ip_configuration blocks, one for each public IP. This is how you would do it via ARM.

example:

resource "azurerm_firewall" "hub_firewall" {
  name                = local.names.firewall
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  firewall_policy_id  = azurerm_firewall_policy.main.id
  sku_name            = "AZFW_Hub"
  sku_tier            = "Standard"

  ip_configuration {
      name                 = "ipconfig0"
      public_ip_address_id = azurerm_public_ip.firewall[0].id
  }
  ip_configuration {
      name                 = "ipconfig1"
      public_ip_address_id = azurerm_public_ip.firewall[1].id
  }
  ip_configuration {
      name                 = "ipconfig2"
      public_ip_address_id = azurerm_public_ip.firewall[2].id
  }

  virtual_hub {
    virtual_hub_id = azurerm_virtual_hub.main.id
  }
}

Of course you could use a dynamic block to make this shorter - the example is simple for clarity.