diff --git a/examples/qs_autoscale/README.md b/examples/qs_autoscale/README.md index 73dc5e6..2cd688b 100755 --- a/examples/qs_autoscale/README.md +++ b/examples/qs_autoscale/README.md @@ -105,44 +105,44 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-------------------------------------------------------------------------------------------------------------------------------------------| -| prefix | (Optional) Instances name prefix | string | | -| asg_name | Autoscaling Group name | string | | -| vpc_id | Select an existing VPC | string | | -| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | -| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true terraform destroy won't work properly | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | -| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | -| provision_tag | The tag used by the Security Management Server to automatically provision the Security Gateways | string |
**Default:** quickstart | -| load_balancers_type | Use Network Load Balancer if you wish to preserve the source IP address or Application Load Balancer for content-based routing | string | - Network Load Balancer
- Application Load Balancer
**Default:** Network Load Balancer | -| load_balancer_protocol | The protocol to use on the Load Balancer | string | Network Load Balancer: TCP, TLS, UDP, TCP_UDP
Application Load Balancer: HTTP, HTTPS
**Default:** TCP | -| certificate | Amazon Resource Name (ARN) of an HTTPS Certificate, ignored if the selected protocol is HTTP | string | | -| service_port | The external Load Balancer listens to this port. Leave blank for default: 80 (HTTP) or 443 (HTTPS) | string | | -| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | -| gateways_subnets | Select at least 2 public subnets in the VPC. If deploying a Security Management Server, it will be in the first subnet | list(string) | | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| gateways_min_group_size | The minimal number of Security Gateways | number |
**Default:** 2 | -| gateways_max_group_size | The maximal number of Security Gateways | number |
**Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
**Default:** R81.20-BYOL | -| gateway_password_hash | (Optional) Admin user's password hash (use `openssl passwd -6 PASSWORD` to get the hash) | string | | -| gateway_SIC_Key | Secure Internal Communication key for trusted connection between Check Point components | string |
**Default:** 12345678 | -| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | -| management_deploy | Select 'false' to use an existing Security Management Server or deploy one later | bool | true/false
**Default:** true | -| management_instance_type | The EC2 instance type of the Security Management Server | string | - c5.large
- c5.xlarge
- m6a.large
**Default:** m5.xlarge | -| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.20-BYOL
**Default:** R81.20-BYOL | -| gateways_policy | The name of the Security Policy package for gateways in the Auto Scaling group | string |
**Default:** Standard | -| gateways_blades | Turn on the Intrusion Prevention System, Application Control, Anti-Virus, and Anti-Bot Blades | bool | true/false
**Default:** true | -| admin_cidr | (CIDR) Allow web, SSH, and graphical clients only from this network to communicate with the Management Server | string | valid CIDR | -| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Management Server | string | valid CIDR | -| servers_deploy | Select 'true' to deploy web servers and an internal Application Load Balancer. 'False' ignores related parameters | bool | true/false
**Default:** false | -| servers_subnets | Provide at least 2 private subnet IDs in the chosen VPC | list(string) | | -| servers_instance_type | The EC2 instance type for the web servers | string | - t3.nano
- t3.micro
- t3.small
- t3.medium
- t3.large
- t3.xlarge
- t3.2xlarge**Default:** t3.micro | -| server_ami | Amazon Machine Image ID of a preconfigured web server | string | | -| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes | string | | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| Name | Description | Type | Allowed Values | +|----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| prefix | (Optional) Instances name prefix | string | | +| asg_name | Autoscaling Group name | string | | +| vpc_id | Select an existing VPC | string | | +| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | +| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true terraform destroy won't work properly | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | +| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | +| provision_tag | The tag used by the Security Management Server to automatically provision the Security Gateways | string |
**Default:** quickstart | +| load_balancers_type | Use Network Load Balancer if you wish to preserve the source IP address or Application Load Balancer for content-based routing | string | - Network Load Balancer
- Application Load Balancer
**Default:** Network Load Balancer | +| load_balancer_protocol | The protocol to use on the Load Balancer | string | Network Load Balancer: TCP, TLS, UDP, TCP_UDP
Application Load Balancer: HTTP, HTTPS
**Default:** TCP | +| certificate | Amazon Resource Name (ARN) of an HTTPS Certificate, ignored if the selected protocol is HTTP | string | | +| service_port | The external Load Balancer listens to this port. Leave blank for default: 80 (HTTP) or 443 (HTTPS) | string | | +| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | +| gateways_subnets | Select at least 2 public subnets in the VPC. If deploying a Security Management Server, it will be in the first subnet | list(string) | | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| gateways_min_group_size | The minimal number of Security Gateways | number |
**Default:** 2 | +| gateways_max_group_size | The maximal number of Security Gateways | number |
**Default:** 10 | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| gateway_password_hash | (Optional) Admin user's password hash (use `openssl passwd -6 PASSWORD` to get the hash) | string | | +| gateway_SIC_Key | Secure Internal Communication key for trusted connection between Check Point components | string |
**Default:** 12345678 | +| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | +| management_deploy | Select 'false' to use an existing Security Management Server or deploy one later | bool | true/false
**Default:** true | +| management_instance_type | The EC2 instance type of the Security Management Server | string | - c5.large
- c5.xlarge
- m6a.large
**Default:** m5.xlarge | +| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
- R82-BYOL
- R82-PAYG
- R82.10-BYOL
- R82.10-PAYG
**Default:** R81.20-BYOL | +| gateways_policy | The name of the Security Policy package for gateways in the Auto Scaling group | string |
**Default:** Standard | +| gateways_blades | Turn on the Intrusion Prevention System, Application Control, Anti-Virus, and Anti-Bot Blades | bool | true/false
**Default:** true | +| admin_cidr | (CIDR) Allow web, SSH, and graphical clients only from this network to communicate with the Management Server | string | valid CIDR | +| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Management Server | string | valid CIDR | +| servers_deploy | Select 'true' to deploy web servers and an internal Application Load Balancer. 'False' ignores related parameters | bool | true/false
**Default:** false | +| servers_subnets | Provide at least 2 private subnet IDs in the chosen VPC | list(string) | | +| servers_instance_type | The EC2 instance type for the web servers | string | - t3.nano
- t3.micro
- t3.small
- t3.medium
- t3.large
- t3.xlarge
- t3.2xlarge**Default:** t3.micro | +| server_ami | Amazon Machine Image ID of a preconfigured web server | string | | +| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes | string | | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | ## Outputs To display the outputs defined by the module, create an `outputs.tf` file with the following structure: diff --git a/examples/qs_autoscale_master/README.md b/examples/qs_autoscale_master/README.md index d96f71f..a185b45 100755 --- a/examples/qs_autoscale_master/README.md +++ b/examples/qs_autoscale_master/README.md @@ -138,7 +138,7 @@ module "example_module" { | gateway_instance_type | Instance type for the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | | gateways_min_group_size | Minimum number of Security Gateways | number |
**Default:** 2 | | gateways_max_group_size | Maximum number of Security Gateways | number |
**Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
**Default:** R81.20-BYOL | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | | gateway_SIC_Key | Secure Internal Communication key for trusted connection between Check Point components | string |
**Default:** 12345678 | | enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | | servers_deploy | Deploy web servers and an internal Application Load Balancer. 'False' ignores related parameters | bool | true/false
**Default:** false | diff --git a/modules/autoscale/README.md b/modules/autoscale/README.md index 45e8665..6fa73b7 100755 --- a/modules/autoscale/README.md +++ b/modules/autoscale/README.md @@ -90,38 +90,38 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-------------------------------------------------------------------------------------------------------------------------------------| -| prefix | (Optional) Instances name prefix | string | | -| asg_name | Autoscaling Group name | string | | -| vpc_id | The VPC ID in which to deploy | string | | -| subnet_ids | List of public subnet IDs to launch resources into. Recommended at least 2 | list(string) | | -| gateways_provision_address_type | Determines if the gateways are provisioned using their private or public address | string | - private
- public
**Default:** private | -| management_server | The name that represents the Security Management Server in the CME configuration | string | | -| configuration_template | Name of the provisioning template in the CME configuration | string | | -| gateway_name | The name tag of the Security Gateways instances | string | **Default:** Check-Point-ASG-gateway-tf | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | -| instances_tags | (Optional) A map of tags as key-value pairs. All tags will be added to all AutoScaling Group instances | map(string) | | -| metadata_imdsv2_required | Set to true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | -| minimum_group_size | The minimum number of instances in the Auto Scaling group | number | **Default:** 2 | -| maximum_group_size | The maximum number of instances in the Auto Scaling group | number | **Default:** 10 | -| target_groups | (Optional) List of Target Group ARNs to associate with the Auto Scaling group | list(string) | | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
**Default:** R81.20-BYOL | -| admin_shell | Set the admin shell to enable advanced command-line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | -| gateway_password_hash | (Optional) Admin user's password hash (use command `grub2-mkpasswd-pbkdf2` on Linux to generate a hash) | string | | -| gateway_SICKey | Secure Internal Communication key for trusted connection between Check Point components (at least 8 alphanumeric characters) | string | | -| enable_instance_connect | Enable SSH connection over AWS web console. Supported regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| allow_upload_download | Automatically download Blade Contracts and other important data to improve the product experience | bool | true/false
**Default:** true | -| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) Semicolon-separated commands to run on the initial boot | string | | -| proxy_elb_type | Type of ELB to create as an HTTP/HTTPS outbound proxy | string | - none
- internal
- internet-facing
**Default:** none | -| proxy_elb_port | The TCP port on which the proxy will be listening | number | **Default:** 8080 | -| proxy_elb_clients | The CIDR range of the clients of the proxy | string | **Default:** 0.0.0.0/0 | -| gateway_maintenance_mode_password_hash | (Optional) Admin user's password and maintenance-mode password for recovery purposes. Use `grub2-mkpasswd-pbkdf2` on Linux to generate a password hash | string | | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| Name | Description | Type | Allowed Values | +|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| prefix | (Optional) Instances name prefix | string | | +| asg_name | Autoscaling Group name | string | | +| vpc_id | The VPC ID in which to deploy | string | | +| subnet_ids | List of public subnet IDs to launch resources into. Recommended at least 2 | list(string) | | +| gateways_provision_address_type | Determines if the gateways are provisioned using their private or public address | string | - private
- public
**Default:** private | +| management_server | The name that represents the Security Management Server in the CME configuration | string | | +| configuration_template | Name of the provisioning template in the CME configuration | string | | +| gateway_name | The name tag of the Security Gateways instances | string | **Default:** Check-Point-ASG-gateway-tf | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | +| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | +| instances_tags | (Optional) A map of tags as key-value pairs. All tags will be added to all AutoScaling Group instances | map(string) | | +| metadata_imdsv2_required | Set to true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | +| minimum_group_size | The minimum number of instances in the Auto Scaling group | number | **Default:** 2 | +| maximum_group_size | The maximum number of instances in the Auto Scaling group | number | **Default:** 10 | +| target_groups | (Optional) List of Target Group ARNs to associate with the Auto Scaling group | list(string) | | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| admin_shell | Set the admin shell to enable advanced command-line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | +| gateway_password_hash | (Optional) Admin user's password hash (use command `grub2-mkpasswd-pbkdf2` on Linux to generate a hash) | string | | +| gateway_SICKey | Secure Internal Communication key for trusted connection between Check Point components (at least 8 alphanumeric characters) | string | | +| enable_instance_connect | Enable SSH connection over AWS web console. Supported regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| allow_upload_download | Automatically download Blade Contracts and other important data to improve the product experience | bool | true/false
**Default:** true | +| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) Semicolon-separated commands to run on the initial boot | string | | +| proxy_elb_type | Type of ELB to create as an HTTP/HTTPS outbound proxy | string | - none
- internal
- internet-facing
**Default:** none | +| proxy_elb_port | The TCP port on which the proxy will be listening | number | **Default:** 8080 | +| proxy_elb_clients | The CIDR range of the clients of the proxy | string | **Default:** 0.0.0.0/0 | +| gateway_maintenance_mode_password_hash | (Optional) Admin user's password and maintenance-mode password for recovery purposes. Use `grub2-mkpasswd-pbkdf2` on Linux to generate a password hash | string | | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | diff --git a/modules/autoscale_gwlb/README.md b/modules/autoscale_gwlb/README.md index 4bc29f4..33da205 100755 --- a/modules/autoscale_gwlb/README.md +++ b/modules/autoscale_gwlb/README.md @@ -93,7 +93,7 @@ module "example_module" { | minimum_group_size | The minimum number of instances in the Auto Scaling group | number | **Default:** 2 | | maximum_group_size | The maximum number of instances in the Auto Scaling group | number | **Default:** 10 | | target_groups | (Optional) List of Target Group ARNs to associate with the Auto Scaling group | list(string) | | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
**Default:** R81.20-BYOL | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
- R82-PAYG-NGTP
- R82.10-BYOL
- R82.10-PAYG-NGTP
**Default:** R81.20-BYOL | | admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | | gateway_password_hash | (Optional) Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | | | gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components (at least 8 alphanumeric characters) | string | **Default:** "12345678" | diff --git a/modules/cluster/README.md b/modules/cluster/README.md index cd6bf26..302b503 100755 --- a/modules/cluster/README.md +++ b/modules/cluster/README.md @@ -96,37 +96,37 @@ module "example_module" { ## Inputs # Parameters Description -| Name | Description | Type | Allowed values | -|------|-------------|------|----------------| -| **vpc_id** | The VPC ID in which to deploy | string | Required | -| **public_subnet_id** | The public subnet of the cluster. The cluster's public IPs will be generated from this subnet | string | Required | -| **private_subnet_id** | The private subnet of the cluster. The cluster's private IPs will be generated from this subnet | string | Required | -| **private_route_table** | (Optional) Set 0.0.0.0/0 route to the Active Cluster member instance in this route table (e.g. rtb-12a34567). Route table cannot have an existing 0.0.0.0/0 route | string | **Default:** "" | -| **gateway_name** | (Optional) The name tag of the Security Gateway instances | string | **Default:** "Check-Point-Cluster-tf" | +| Name | Description | Type | Allowed values | +|------|-------------|------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **vpc_id** | The VPC ID in which to deploy | string | Required | +| **public_subnet_id** | The public subnet of the cluster. The cluster's public IPs will be generated from this subnet | string | Required | +| **private_subnet_id** | The private subnet of the cluster. The cluster's private IPs will be generated from this subnet | string | Required | +| **private_route_table** | (Optional) Set 0.0.0.0/0 route to the Active Cluster member instance in this route table (e.g. rtb-12a34567). Route table cannot have an existing 0.0.0.0/0 route | string | **Default:** "" | +| **gateway_name** | (Optional) The name tag of the Security Gateway instances | string | **Default:** "Check-Point-Cluster-tf" | | **gateway_instance_type** | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** "c5.xlarge" | -| **key_name** | The EC2 Key Pair name to allow SSH access to the instance | string | Required | -| **allocate_and_associate_eip** | If true, an Elastic IP will be allocated and associated with each cluster member, in addition to the shared cluster Elastic IP | bool | true;
false.
**Default:** true | -| **volume_size** | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| **volume_encryption** | KMS or CMK key identifier. Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' | string | **Default:** "alias/aws/ebs" | -| **enable_instance_connect** | Enable AWS Instance Connect. Supported regions are listed [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true;
false.
**Default:** false | -| **disable_instance_termination** | Prevents an instance from accidental termination. Note: Setting this true may prevent `terraform destroy` from working properly | bool | true;
false.
**Default:** false | -| **metadata_imdsv2_required** | Set true to deploy the instance with metadata v2 token required | bool | true;
false.
**Default:** true
Required | -| **instance_tags** | (Optional) A map of tags as key=value pairs. Tags will be added to the Gateway EC2 instances | map(string) | **Default:** {} | -| **predefined_role** | (Optional) A predefined IAM role to attach to the cluster profile | string | **Default:** "" | -| **gateway_version** | Gateway version and license | string | "R81.10-BYOL";
"R81.20-BYOL";
"R82-BYOL".
**Default:** "R81.20-BYOL" | -| **admin_shell** | Set the admin shell to enable advanced command line configuration | string | "/etc/cli.sh";
"/bin/bash";
"/bin/csh".
**Default:** "/etc/cli.sh" | -| **gateway_SICKey** | The Secure Internal Communication key for trusted connection between Check Point components. Must be at least 8 alphanumeric characters | string | **Default:** "12345678" | -| **gateway_password_hash** | (Optional) Admin user's password hash (use `openssl passwd -6 PASSWORD` to generate) | string | **Default:** "" | -| **memberAToken** | (Recommended) Token for quick connection to Smart-1 Cloud. Instructions in SK180501 | string | **Default:** "" | -| **memberBToken** | (Recommended) Token for quick connection to Smart-1 Cloud. Instructions in SK180501 | string | **Default:** "" | -| **resources_tag_name** | (Optional) Name tag prefix for resources | string | **Default:** "" | -| **gateway_hostname** | (Optional) Hostname will append 'member-a' or 'member-b' accordingly. Cannot contain reserved words (see SK40179 for details) | string | **Default:** "" | -| **allow_upload_download** | Automatically download Blade Contracts and other important data to enhance product experience | bool | true;
false.
**Default:** true | -| **enable_cloudwatch** | Report Check Point-specific CloudWatch metrics | bool | true;
false.
**Default:** false | -| **gateway_bootstrap_script** | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | -| **primary_ntp** | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** "169.254.169.123" | -| **secondary_ntp** | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** "0.pool.ntp.org" | -| **gateway_maintenance_mode_password_hash** | (Optional) Maintenance-mode password hash (generate using `grub2-mkpasswd-pbkdf2` on Linux) | string | **Default:** "" | +| **key_name** | The EC2 Key Pair name to allow SSH access to the instance | string | Required | +| **allocate_and_associate_eip** | If true, an Elastic IP will be allocated and associated with each cluster member, in addition to the shared cluster Elastic IP | bool | true;
false.
**Default:** true | +| **volume_size** | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| **volume_encryption** | KMS or CMK key identifier. Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' | string | **Default:** "alias/aws/ebs" | +| **enable_instance_connect** | Enable AWS Instance Connect. Supported regions are listed [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true;
false.
**Default:** false | +| **disable_instance_termination** | Prevents an instance from accidental termination. Note: Setting this true may prevent `terraform destroy` from working properly | bool | true;
false.
**Default:** false | +| **metadata_imdsv2_required** | Set true to deploy the instance with metadata v2 token required | bool | true;
false.
**Default:** true
Required | +| **instance_tags** | (Optional) A map of tags as key=value pairs. Tags will be added to the Gateway EC2 instances | map(string) | **Default:** {} | +| **predefined_role** | (Optional) A predefined IAM role to attach to the cluster profile | string | **Default:** "" | +| **gateway_version** | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| **admin_shell** | Set the admin shell to enable advanced command line configuration | string | "/etc/cli.sh";
"/bin/bash";
"/bin/csh".
**Default:** "/etc/cli.sh" | +| **gateway_SICKey** | The Secure Internal Communication key for trusted connection between Check Point components. Must be at least 8 alphanumeric characters | string | **Default:** "12345678" | +| **gateway_password_hash** | (Optional) Admin user's password hash (use `openssl passwd -6 PASSWORD` to generate) | string | **Default:** "" | +| **memberAToken** | (Recommended) Token for quick connection to Smart-1 Cloud. Instructions in SK180501 | string | **Default:** "" | +| **memberBToken** | (Recommended) Token for quick connection to Smart-1 Cloud. Instructions in SK180501 | string | **Default:** "" | +| **resources_tag_name** | (Optional) Name tag prefix for resources | string | **Default:** "" | +| **gateway_hostname** | (Optional) Hostname will append 'member-a' or 'member-b' accordingly. Cannot contain reserved words (see SK40179 for details) | string | **Default:** "" | +| **allow_upload_download** | Automatically download Blade Contracts and other important data to enhance product experience | bool | true;
false.
**Default:** true | +| **enable_cloudwatch** | Report Check Point-specific CloudWatch metrics | bool | true;
false.
**Default:** false | +| **gateway_bootstrap_script** | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | +| **primary_ntp** | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** "169.254.169.123" | +| **secondary_ntp** | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** "0.pool.ntp.org" | +| **gateway_maintenance_mode_password_hash** | (Optional) Maintenance-mode password hash (generate using `grub2-mkpasswd-pbkdf2` on Linux) | string | **Default:** "" | ## Outputs To display the outputs defined by the module, create an `outputs.tf` file with the following structure: diff --git a/modules/cluster_master/README.md b/modules/cluster_master/README.md index 1fc1655..e96f56e 100755 --- a/modules/cluster_master/README.md +++ b/modules/cluster_master/README.md @@ -104,38 +104,38 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|----------------------------------------|----------------------------|--------------|---------------------------------------------------------------------------------------------------------------| -| vpc_cidr | The CIDR block of the VPC | string | | -| public_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair (e.g., {"us-east-1a" = 1}). | map | | -| private_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair (e.g., {"us-east-1a" = 2}). | map | | -| subnets_bit_length | Number of additional bits to extend the VPC CIDR. For example, with a VPC CIDR ending in /16 and subnets_bit_length = 4, resulting subnet will have length /20. | number | | -| gateway_name | (Optional) The name tag of the Security Gateway instances | string | **Default:** Check-Point-Cluster-tf | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | -| allocate_and_associate_eip | Allocate and associate Elastic IP for each cluster member, in addition to the shared cluster Elastic IP. | bool | true/false
**Default:** true | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| volume_encryption | KMS or CMK key Identifier. Use key ID, alias, or ARN (e.g., alias/aws/ebs). | string | **Default:** alias/aws/ebs | -| enable_instance_connect | Enable AWS Instance Connect. Supporting regions are listed [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/). | bool | true/false
**Default:** false | -| disable_instance_termination | Prevent accidental termination. Note: When set, `terraform destroy` may not work properly. | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Deploy the instance with metadata v2 token requirement | bool | true/false
**Default:** true | -| instance_tags | (Optional) A map of tags (key=value) to add to Gateway EC2 Instances | map(string) | **Default:** {} | -| predefined_role | (Optional) Predefined IAM role to attach to the cluster profile | string | | -| gateway_version | Gateway version and license | string | R81.10-BYOL, R81.20-BYOL, R82-BYOL, etc.
**Default:** R81.20-BYOL | -| admin_shell | Set the admin shell to enable advanced CLI configuration | string | /etc/cli.sh, /bin/bash, /bin/csh, /bin/tcsh
**Default:** /etc/cli.sh | -| gateway_SICKey | Secure Internal Communication key for trusted connection (at least 8 alphanumeric characters) | string | **Default:** "12345678" | -| gateway_password_hash | (Optional) Admin user's password hash (use `openssl passwd -6 PASSWORD`). | string | | -| memberAToken | (Optional) Quick connect token for Smart-1 Cloud, for Member A. | string | | -| memberBToken | (Optional) Quick connect token for Smart-1 Cloud, for Member B. | string | | -| resources_tag_name | (Optional) Prefix for resource tags | string | | -| gateway_hostname | (Optional) Hostname of the gateway (appended with member-a/b). | string | | -| allow_upload_download | Automatically download Blade Contracts and other important data. | bool | true/false
**Default:** true | -| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) Commands to run on the initial boot, separated by semicolons (;). | string | | -| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol (NTP) server | string | **Default:** 169.254.169.123 | -| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol (NTP) server | string | **Default:** 0.pool.ntp.org | -| gateway_maintenance_mode_password_hash | (Optional) Maintenance-mode password hash (use `grub2-mkpasswd-pbkdf2` for hash generation). | string | | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| Name | Description | Type | Allowed Values | +|----------------------------------------|----------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_cidr | The CIDR block of the VPC | string | | +| public_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair (e.g., {"us-east-1a" = 1}). | map | | +| private_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair (e.g., {"us-east-1a" = 2}). | map | | +| subnets_bit_length | Number of additional bits to extend the VPC CIDR. For example, with a VPC CIDR ending in /16 and subnets_bit_length = 4, resulting subnet will have length /20. | number | | +| gateway_name | (Optional) The name tag of the Security Gateway instances | string | **Default:** Check-Point-Cluster-tf | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | +| allocate_and_associate_eip | Allocate and associate Elastic IP for each cluster member, in addition to the shared cluster Elastic IP. | bool | true/false
**Default:** true | +| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| volume_encryption | KMS or CMK key Identifier. Use key ID, alias, or ARN (e.g., alias/aws/ebs). | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable AWS Instance Connect. Supporting regions are listed [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/). | bool | true/false
**Default:** false | +| disable_instance_termination | Prevent accidental termination. Note: When set, `terraform destroy` may not work properly. | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Deploy the instance with metadata v2 token requirement | bool | true/false
**Default:** true | +| instance_tags | (Optional) A map of tags (key=value) to add to Gateway EC2 Instances | map(string) | **Default:** {} | +| predefined_role | (Optional) Predefined IAM role to attach to the cluster profile | string | | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| admin_shell | Set the admin shell to enable advanced CLI configuration | string | /etc/cli.sh, /bin/bash, /bin/csh, /bin/tcsh
**Default:** /etc/cli.sh | +| gateway_SICKey | Secure Internal Communication key for trusted connection (at least 8 alphanumeric characters) | string | **Default:** "12345678" | +| gateway_password_hash | (Optional) Admin user's password hash (use `openssl passwd -6 PASSWORD`). | string | | +| memberAToken | (Optional) Quick connect token for Smart-1 Cloud, for Member A. | string | | +| memberBToken | (Optional) Quick connect token for Smart-1 Cloud, for Member B. | string | | +| resources_tag_name | (Optional) Prefix for resource tags | string | | +| gateway_hostname | (Optional) Hostname of the gateway (appended with member-a/b). | string | | +| allow_upload_download | Automatically download Blade Contracts and other important data. | bool | true/false
**Default:** true | +| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) Commands to run on the initial boot, separated by semicolons (;). | string | | +| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol (NTP) server | string | **Default:** 169.254.169.123 | +| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol (NTP) server | string | **Default:** 0.pool.ntp.org | +| gateway_maintenance_mode_password_hash | (Optional) Maintenance-mode password hash (use `grub2-mkpasswd-pbkdf2` for hash generation). | string | | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | diff --git a/modules/cross_az_cluster_master/README.md b/modules/cross_az_cluster_master/README.md index 8b5d864..ad6ab1e 100755 --- a/modules/cross_az_cluster_master/README.md +++ b/modules/cross_az_cluster_master/README.md @@ -102,38 +102,38 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-------------------------------------------------------------------------------------------------------| -| vpc_cidr | The CIDR block of the VPC | string | | -| public_subnets_map | Map of {availability-zone = subnet-suffix-number}. Minimum 2 pairs. Example: {"us-east-1a" = 1, "us-east-1b" = 2} | map | | -| private_subnets_map | Map of {availability-zone = subnet-suffix-number}. Minimum 2 pairs. Example: {"us-east-1a" = 3, "us-east-1b" = 4} | map | | -| subnets_bit_length | Number of additional bits to extend the VPC CIDR. For example, /16 CIDR with 4-bit length results in /20 subnets. | number | | -| gateway_name | (Optional) The name tag of the Security Gateway instances | string | **Default:** Check-Point-Cluster-tf | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | -| volume_encryption | KMS or CMK key identifier. Use key ID, alias, or ARN. Prefix key alias with 'alias/' (e.g., alias/aws/ebs). | string | **Default:** alias/aws/ebs | -| enable_instance_connect | Enable AWS Instance Connect. [More info](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents accidental termination. Note: Enabling this will prevent proper `terraform destroy`. | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | -| instance_tags | (Optional) A map of tags as key-value pairs. Applied to Gateway EC2 Instances | map(string) | | -| predefined_role | (Optional) A predefined IAM role to attach to the cluster profile | string | | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R82-BYOL
**Default:** R81.20-BYOL | -| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | -| gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. Minimum 8 alphanumeric characters. | string | | -| gateway_password_hash | (Optional) Admin user's password hash. | string | | -| memberAToken | (Recommended) Token for quick connection to Smart-1 Cloud. Follow instructions in SK180501. | string | | -| memberBToken | (Recommended) Token for quick connection to Smart-1 Cloud. Follow instructions in SK180501. | string | | -| resources_tag_name | (Optional) Name tag prefix of the resources | string | | -| gateway_hostname | (Optional) Host name will be appended with member-a/b. Must not contain reserved words. Refer to SK40179. | string | | -| allow_upload_download | Automatically download Blade Contracts and other important data. | bool | true/false
**Default:** true | -| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | | -| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** 169.254.169.123 | -| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** 0.pool.ntp.org | -| gateway_maintenance_mode_password_hash | (Optional) Password hash for maintenance mode. Follow Check Point's recommendations. | string | | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| Name | Description | Type | Allowed Values | +|----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_cidr | The CIDR block of the VPC | string | | +| public_subnets_map | Map of {availability-zone = subnet-suffix-number}. Minimum 2 pairs. Example: {"us-east-1a" = 1, "us-east-1b" = 2} | map | | +| private_subnets_map | Map of {availability-zone = subnet-suffix-number}. Minimum 2 pairs. Example: {"us-east-1a" = 3, "us-east-1b" = 4} | map | | +| subnets_bit_length | Number of additional bits to extend the VPC CIDR. For example, /16 CIDR with 4-bit length results in /20 subnets. | number | | +| gateway_name | (Optional) The name tag of the Security Gateway instances | string | **Default:** Check-Point-Cluster-tf | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | +| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | +| volume_encryption | KMS or CMK key identifier. Use key ID, alias, or ARN. Prefix key alias with 'alias/' (e.g., alias/aws/ebs). | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable AWS Instance Connect. [More info](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents accidental termination. Note: Enabling this will prevent proper `terraform destroy`. | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | +| instance_tags | (Optional) A map of tags as key-value pairs. Applied to Gateway EC2 Instances | map(string) | | +| predefined_role | (Optional) A predefined IAM role to attach to the cluster profile | string | | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | +| gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. Minimum 8 alphanumeric characters. | string | | +| gateway_password_hash | (Optional) Admin user's password hash. | string | | +| memberAToken | (Recommended) Token for quick connection to Smart-1 Cloud. Follow instructions in SK180501. | string | | +| memberBToken | (Recommended) Token for quick connection to Smart-1 Cloud. Follow instructions in SK180501. | string | | +| resources_tag_name | (Optional) Name tag prefix of the resources | string | | +| gateway_hostname | (Optional) Host name will be appended with member-a/b. Must not contain reserved words. Refer to SK40179. | string | | +| allow_upload_download | Automatically download Blade Contracts and other important data. | bool | true/false
**Default:** true | +| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | | +| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** 169.254.169.123 | +| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** 0.pool.ntp.org | +| gateway_maintenance_mode_password_hash | (Optional) Password hash for maintenance mode. Follow Check Point's recommendations. | string | | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | diff --git a/modules/gateway/README.md b/modules/gateway/README.md index cba4d76..7c09808 100755 --- a/modules/gateway/README.md +++ b/modules/gateway/README.md @@ -85,36 +85,36 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed values | -|------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| vpc_id | The VPC id in which to deploy | string | | -| public_subnet_id | The public subnet of the security gateway | string | | -| private_subnet_id | The private subnet of the security gateway | string | | -| private_route_table | Sets '0.0.0.0/0' route to the Gateway instance in the specified route table (e.g. rtb-12a34567) | string | **Default:** "" | -| gateway_name | (Optional) The name tag of the Security Gateway instance | string | **Default:** Check-Point-Gateway-tf | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | -| allocate_and_associate_eip | If set to true, an elastic IP will be allocated and associated with the launched instance | bool | true/false
**Default:** true | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| volume_encryption | KMS or CMK key Identifier: Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' (e.g., 'alias/aws/ebs') | string | **Default:** alias/aws/ebs | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions [AWS docs](https://aws.amazon.com/about-aws/whats-new/...) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents an instance from accidental termination. Note: Once true, terraform destroy won't work | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | -| instance_tags | A map of tags as key=value pairs. All tags will be added to the Security Gateway EC2 Instance | map(string) | **Default:** {} | -| gateway_version | Gateway version and license | string | - R81.10-BYOL
- R81.10-PAYG-NGTP
- R81.10-PAYG-NGTX
- R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
**Default:** R81.20-BYOL | -| admin_shell | Set the admin shell to enable advanced command-line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | -| gateway_SIC_Key | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random 8+ string | string | | -| gateway_password_hash | (Optional) Admin user's password hash (use 'openssl passwd -6 PASSWORD' to generate hash) | string | **Default:** "" | -| allow_upload_download | Automatically download Blade Contracts and other important data | bool | true/false
**Default:** true | -| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | -| primary_ntp | (Optional) IPv4 address of Network Time Protocol primary server | string | **Default:** 169.254.169.123 | -| secondary_ntp | (Optional) IPv4 address of Network Time Protocol secondary server | string | **Default:** 0.pool.ntp.org | -| control_gateway_over_public_or_private_address | Determines if the Security Gateway is provisioned using its private or public address | string | - public
- private
**Default:** private | -| management_server | (Optional) Name that represents the Security Management Server in auto provisioning | string | **Default:** "" | -| configuration_template | (Optional) Name of a Security Gateway configuration template in auto provisioning | string | **Default:** "" | -| gateway_maintenance_mode_password_hash | (Optional) Admin user's password and maintenance-mode password. For R81.10 and below, Admin password used as both | string | **Default:** "" | -| security_rules | List of security rules for ingress and egress. | list(object(
{ direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)})) | ****Default:**** []| +| Name | Description | Type | Allowed values | +|------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_id | The VPC id in which to deploy | string | | +| public_subnet_id | The public subnet of the security gateway | string | | +| private_subnet_id | The private subnet of the security gateway | string | | +| private_route_table | Sets '0.0.0.0/0' route to the Gateway instance in the specified route table (e.g. rtb-12a34567) | string | **Default:** "" | +| gateway_name | (Optional) The name tag of the Security Gateway instance | string | **Default:** Check-Point-Gateway-tf | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | +| allocate_and_associate_eip | If set to true, an elastic IP will be allocated and associated with the launched instance | bool | true/false
**Default:** true | +| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| volume_encryption | KMS or CMK key Identifier: Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' (e.g., 'alias/aws/ebs') | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions [AWS docs](https://aws.amazon.com/about-aws/whats-new/...) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents an instance from accidental termination. Note: Once true, terraform destroy won't work | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | +| instance_tags | A map of tags as key=value pairs. All tags will be added to the Security Gateway EC2 Instance | map(string) | **Default:** {} | +| gateway_version | Gateway version and license | string | - R81.10-BYOL
- R81.10-PAYG-NGTP
- R81.10-PAYG-NGTX
- R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| admin_shell | Set the admin shell to enable advanced command-line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | +| gateway_SIC_Key | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random 8+ string | string | | +| gateway_password_hash | (Optional) Admin user's password hash (use 'openssl passwd -6 PASSWORD' to generate hash) | string | **Default:** "" | +| allow_upload_download | Automatically download Blade Contracts and other important data | bool | true/false
**Default:** true | +| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | +| primary_ntp | (Optional) IPv4 address of Network Time Protocol primary server | string | **Default:** 169.254.169.123 | +| secondary_ntp | (Optional) IPv4 address of Network Time Protocol secondary server | string | **Default:** 0.pool.ntp.org | +| control_gateway_over_public_or_private_address | Determines if the Security Gateway is provisioned using its private or public address | string | - public
- private
**Default:** private | +| management_server | (Optional) Name that represents the Security Management Server in auto provisioning | string | **Default:** "" | +| configuration_template | (Optional) Name of a Security Gateway configuration template in auto provisioning | string | **Default:** "" | +| gateway_maintenance_mode_password_hash | (Optional) Admin user's password and maintenance-mode password. For R81.10 and below, Admin password used as both | string | **Default:** "" | +| security_rules | List of security rules for ingress and egress. | list(object(
{ direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)})) | ****Default:**** [] | diff --git a/modules/gateway_master/README.md b/modules/gateway_master/README.md index ca7de7b..2fa6a1b 100755 --- a/modules/gateway_master/README.md +++ b/modules/gateway_master/README.md @@ -86,39 +86,39 @@ module "example_module" { ``` ## Inputs -| Name | Description | Type | Allowed values | -|------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| vpc_cidr | The CIDR block of the VPC | string | | -| public_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. (e.g., {\"us-east-1a\" = 1}) | map | | -| private_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. (e.g., {\"us-east-1a\" = 2}) | map | | -| subnets_bit_length | Number of additional bits with which to extend the VPC CIDR. For example, if given a vpc_cidr ending in /16 and a subnets_bit_length value of 4, the resulting subnet address will have length /20 | number | | -| gateway_name | (Optional) The name tag of the Security Gateway instance | string | **Default:** Check-Point-Gateway-tf | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | -| allocate_and_associate_eip | If set to true, an elastic IP will be allocated and associated with the launched instance | bool | true/false
**Default:** true | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| volume_encryption | KMS or CMK key Identifier: Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' (e.g., for KMS default alias 'aws/ebs' - insert 'alias/aws/ebs') | string | **Default:** alias/aws/ebs | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true, terraform destroy won't work properly | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | -| instance_tags | (Optional) A map of tags as key=value pairs. All tags will be added to the Security Gateway EC2 Instance | map(string) | **Default:** {} | -| gateway_version | Gateway version and license | string | - R81.10-BYOL
- R81.10-PAYG-NGTP
- R81.10-PAYG-NGTX
- R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
**Default:** R81.20-BYOL | -| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | -| gateway_SIC_Key | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters | string | **Default:** "12345678" | -| gateway_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | **Default:** "" | -| gateway_TokenKey | (Recommended) Quick connect to Smart-1 Cloud. Paste here the token copied from the Connect Gateway screen in Smart-1 Cloud portal. Follow the instructions in SK180501 to quickly connect this Gateway to Smart-1 Cloud. | string | **Default:** "" | -| resources_tag_name | (Optional) | string | **Default:** "" | -| gateway_hostname | (Optional) Security Gateway prompt hostname. The name must not contain reserved words. For details, refer to sk40179. | string | **Default:** "" | -| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | -| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | -| primary_ntp | (Optional) The IPv4 addresses of Network Time Protocol primary server | string | **Default:** 169.254.169.123 | -| secondary_ntp | (Optional) The IPv4 addresses of Network Time Protocol secondary server | string | **Default:** 0.pool.ntp.org | -| control_gateway_over_public_or_private_address | Determines if the Security Gateway is provisioned using its private or public address | string | - public
- private
**Default:** private | -| management_server | (Optional) The name that represents the Security Management Server in the automatic provisioning configuration | string | **Default:** "" | -| configuration_template | (Optional) A name of a Security Gateway configuration template in the automatic provisioning configuration | string | **Default:** "" | -| gateway_maintenance_mode_password_hash | (Optional) Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command 'grub2-mkpasswd-pbkdf2' on Linux and paste it here). | string | **Default:** "" | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| Name | Description | Type | Allowed values | +|------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_cidr | The CIDR block of the VPC | string | | +| public_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. (e.g., {\"us-east-1a\" = 1}) | map | | +| private_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. (e.g., {\"us-east-1a\" = 2}) | map | | +| subnets_bit_length | Number of additional bits with which to extend the VPC CIDR. For example, if given a vpc_cidr ending in /16 and a subnets_bit_length value of 4, the resulting subnet address will have length /20 | number | | +| gateway_name | (Optional) The name tag of the Security Gateway instance | string | **Default:** Check-Point-Gateway-tf | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | +| allocate_and_associate_eip | If set to true, an elastic IP will be allocated and associated with the launched instance | bool | true/false
**Default:** true | +| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| volume_encryption | KMS or CMK key Identifier: Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' (e.g., for KMS default alias 'aws/ebs' - insert 'alias/aws/ebs') | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true, terraform destroy won't work properly | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | +| instance_tags | (Optional) A map of tags as key=value pairs. All tags will be added to the Security Gateway EC2 Instance | map(string) | **Default:** {} | +| gateway_version | Gateway version and license | string | - R81.10-BYOL
- R81.10-PAYG-NGTP
- R81.10-PAYG-NGTX
- R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX

- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX**Default:** R81.20-BYOL | +| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | +| gateway_SIC_Key | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters | string | **Default:** "12345678" | +| gateway_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | **Default:** "" | +| gateway_TokenKey | (Recommended) Quick connect to Smart-1 Cloud. Paste here the token copied from the Connect Gateway screen in Smart-1 Cloud portal. Follow the instructions in SK180501 to quickly connect this Gateway to Smart-1 Cloud. | string | **Default:** "" | +| resources_tag_name | (Optional) | string | **Default:** "" | +| gateway_hostname | (Optional) Security Gateway prompt hostname. The name must not contain reserved words. For details, refer to sk40179. | string | **Default:** "" | +| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | +| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | +| primary_ntp | (Optional) The IPv4 addresses of Network Time Protocol primary server | string | **Default:** 169.254.169.123 | +| secondary_ntp | (Optional) The IPv4 addresses of Network Time Protocol secondary server | string | **Default:** 0.pool.ntp.org | +| control_gateway_over_public_or_private_address | Determines if the Security Gateway is provisioned using its private or public address | string | - public
- private
**Default:** private | +| management_server | (Optional) The name that represents the Security Management Server in the automatic provisioning configuration | string | **Default:** "" | +| configuration_template | (Optional) A name of a Security Gateway configuration template in the automatic provisioning configuration | string | **Default:** "" | +| gateway_maintenance_mode_password_hash | (Optional) Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command 'grub2-mkpasswd-pbkdf2' on Linux and paste it here). | string | **Default:** "" | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | ## Outputs diff --git a/modules/gwlb/README.md b/modules/gwlb/README.md index 7812f8e..2dd8c11 100755 --- a/modules/gwlb/README.md +++ b/modules/gwlb/README.md @@ -99,48 +99,47 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|------------------------|-------------------------------------------------------------------------------------------------------------|--------|-------------------------------------------------------------------------------------------------------------------------| -| vpc_id | Select an existing VPC | string | | -| subnet_ids | The VPC subnets ID | string | | -| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | -| ip_mode | Specifies the IP mode for inspection of traffic encapsulation in IPv4 Geneve headers. When set to DualStack, both IPv4 and IPv6 traffic are inspected (supported on version R81.20 with JHF 99 and above). | string | "IPv4"/"DualStack"
**Default:** "IPv4" | +| Name | Description | Type | Allowed Values | +|------------------------|-------------------------------------------------------------------------------------------------------------|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_id | Select an existing VPC | string | | +| subnet_ids | The VPC subnets ID | string | | +| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | +| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true terraform destroy won't work properly | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | +| volume_size | Instances volume size | number | **Default:** 200 | +| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | +| management_server | The name that represents the Security Management Server in the automatic provisioning configuration | string | **Default:** CP-Management-gwlb-tf | +| configuration_template | The tag is used by the Security Management Server to automatically provision the Security Gateways. Must be up to 12 alphanumeric characters and unique for each Quick Start deployment | string | **Default:** gwlb-configuration | +| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | +| gateway_load_balancer_name | Load Balancer name in AWS | string | **Default:** gwlb1 | +| target_group_name | Target Group Name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens | string | **Default:** tg1 | +| connection_acceptance_required | Indicate whether requests from service consumers to create an endpoint to your service must be accepted. Default is set to false (acceptance not required). | bool | true/false
**Default:** false | +| enable_cross_zone_load_balancing | Select 'true' to enable cross-az load balancing. NOTE! this may cause a spike in cross-az charges. | bool | true/false
**Default:** true | +| gateway_name | The name tag of the Security Gateway instances. (optional) | string | **Default:** Check-Point-GW-tf | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| gateways_min_group_size | The minimal number of Security Gateways | number | **Default:** 2 | +| gateways_max_group_size | The maximal number of Security Gateways | number | **Default:** 10 | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| gateway_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | +| gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters | string | | +| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) An optional script with semicolon (;) separated commands to run on the initial boot | string | | +| gateways_provision_address_type | Determines if the gateways are provisioned using their private or public address. | string | - private
- public
**Default:** private | | allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false | -| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true terraform destroy won't work properly | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | -| volume_size | Instances volume size | number | **Default:** 200 | -| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | -| management_server | The name that represents the Security Management Server in the automatic provisioning configuration | string | **Default:** CP-Management-gwlb-tf | -| configuration_template | The tag is used by the Security Management Server to automatically provision the Security Gateways. Must be up to 12 alphanumeric characters and unique for each Quick Start deployment | string | **Default:** gwlb-configuration | -| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | -| gateway_load_balancer_name | Load Balancer name in AWS | string | **Default:** gwlb1 | -| target_group_name | Target Group Name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens | string | **Default:** tg1 | -| connection_acceptance_required | Indicate whether requests from service consumers to create an endpoint to your service must be accepted. Default is set to false (acceptance not required). | bool | true/false
**Default:** false | -| enable_cross_zone_load_balancing | Select 'true' to enable cross-az load balancing. NOTE! this may cause a spike in cross-az charges. | bool | true/false
**Default:** true | -| gateway_name | The name tag of the Security Gateway instances. (optional) | string | **Default:** Check-Point-GW-tf | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| gateways_min_group_size | The minimal number of Security Gateways | number | **Default:** 2 | -| gateways_max_group_size | The maximal number of Security Gateways | number | **Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
**Default:** R81.20-BYOL | -| gateway_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | -| gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters | string | | -| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) An optional script with semicolon (;) separated commands to run on the initial boot | string | | -| gateways_provision_address_type | Determines if the gateways are provisioned using their private or public address. | string | - private
- public
**Default:** private | -| allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false | -| management_deploy | Select 'false' to use an existing Security Management Server or to deploy one later and to ignore the other parameters of this section | bool | true/false
**Default:** true | -| management_instance_type | The EC2 instance type of the Security Management Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | -| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
**Default:** R81.20-BYOL | -| management_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | -| gateways_policy | The name of the Security Policy package to be installed on the gateways in the Security Gateways Auto Scaling group | string | **Default:** Standard | -| gateway_management | Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address. | string | - Locally managed
- Over the internet
**Default:** Locally managed | -| admin_cidr | (CIDR) Allow web, ssh, and graphical clients only from this network to communicate with the Management Server | string | valid CIDR | -| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Management Server | string | valid CIDR | -| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | -| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command "grub2-mkpasswd-pbkdf2" on Linux and paste it here). | string | | -| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command "grub2-mkpasswd-pbkdf2" on Linux and paste it here). | string | | +| management_deploy | Select 'false' to use an existing Security Management Server or to deploy one later and to ignore the other parameters of this section | bool | true/false
**Default:** true | +| management_instance_type | The EC2 instance type of the Security Management Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | +| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
- R82.10-BYOL
- R82.10-PAYG
**Default:** R81.20-BYOL | +| management_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | +| gateways_policy | The name of the Security Policy package to be installed on the gateways in the Security Gateways Auto Scaling group | string | **Default:** Standard | +| gateway_management | Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address. | string | - Locally managed
- Over the internet
**Default:** Locally managed | +| admin_cidr | (CIDR) Allow web, ssh, and graphical clients only from this network to communicate with the Management Server | string | valid CIDR | +| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Management Server | string | valid CIDR | +| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | +| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command "grub2-mkpasswd-pbkdf2" on Linux and paste it here). | string | | +| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. For R81.10 and below the Admin user's password is used also as maintenance-mode password. (To generate a password hash use the command "grub2-mkpasswd-pbkdf2" on Linux and paste it here). | string | | +| enable_ipv6 | Enables dual-stack networking (IPv4 and IPv6) for the GWLB, [Please see version compatibility in the following guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/Content/Topics-AWS-GWLB-ASG-DG/IPv6-Support.htm) | bool | true/false
**Default:** false | ## Outputs To display the outputs defined by the module, create an `outputs.tf` file with the following structure: diff --git a/modules/gwlb_master/README.md b/modules/gwlb_master/README.md index 2801c8c..74c85ac 100755 --- a/modules/gwlb_master/README.md +++ b/modules/gwlb_master/README.md @@ -116,7 +116,7 @@ module "example_module" { | gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | | gateways_min_group_size | The minimal number of Security Gateways | number | **Default:** 2 | | gateways_max_group_size | The maximal number of Security Gateways | number | **Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
**Default:** R81.20-BYOL | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | | gateway_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | **Default:** "" | | gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters | string | **Default:** "12345678" | | enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | @@ -125,7 +125,7 @@ module "example_module" { | allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false | | management_deploy | Select 'false' to use an existing Security Management Server or to deploy one later and to ignore the other parameters of this section | bool | true/false
**Default:** true | | management_instance_type | The EC2 instance type of the Security Management Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | -| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
**Default:** R81.20-BYOL | +| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
- R82.10-BYOL
- R82.10-PAYG
**Default:** R81.20-BYOL | | management_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | **Default:** "" | | gateways_policy | The name of the Security Policy package to be installed on the gateways in the Security Gateways Auto Scaling group | string | **Default:** Standard | | gateway_management | Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address. | string | - Locally managed
- Over the internet
**Default:** Locally managed | diff --git a/modules/management/README.md b/modules/management/README.md index e8b936d..3ba2729 100755 --- a/modules/management/README.md +++ b/modules/management/README.md @@ -75,37 +75,36 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed values | -|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| vpc_id | The VPC id in which to deploy | string | | -| subnet_id | To access the instance from the internet, make sure the subnet has a route to the internet | string | | -| management_name | (Optional) The name tag of the Security Management instance | string | **Default:** Check-Point-Management-tf | +| Name | Description | Type | Allowed values | +|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_id | The VPC id in which to deploy | string | | +| subnet_id | To access the instance from the internet, make sure the subnet has a route to the internet | string | | +| management_name | (Optional) The name tag of the Security Management instance | string | **Default:** Check-Point-Management-tf | | management_instance_type | The instance type of the Security Management Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | -| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | -| allocate_and_associate_eip | If set to true, an elastic IP will be allocated and associated with the launched instance | bool | true/false
**Default:** true | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| volume_encryption | KMS or CMK key Identifier: Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' (e.g., for KMS default alias 'aws/ebs' - insert 'alias/aws/ebs') | string | **Default:** alias/aws/ebs | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true, terraform destroy won't work properly | bool | true/false
**Default:** false | -| instance_tags | (Optional) A map of tags as key=value pairs. All tags will be added to the Management EC2 Instance | map(string) | **Default:** {} | -| iam_permissions | IAM role to attach to the instance profile | string | - None (configure later)
- Use existing (specify an existing IAM role name)
- Create with assume role permissions (specify an STS role ARN)
- Create with read permissions
- Create with read-write permissions
**Default:** Create with read permissions | -| predefined_role | (Optional) A predefined IAM role to attach to the instance profile. Ignored if var.iam_permissions is not set to 'Use existing' | string | **Default:** "" | -| sts_roles | (Optional) The IAM role will be able to assume these STS Roles (list of ARNs). Ignored if var.iam_permissions is set to 'None' or 'Use existing' | list(string) | **Default:** [] | -| management_version | Management version and license | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
- R82-BYOL
- R82-PAYG
**Default:** R81.20-BYOL | -| admin_shell | Set the admin shell to enable advanced command | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | -| management_password_hash | (Optional) Admin user's password hash (use command "openssl passwd -6 PASSWORD" to get the PASSWORD's hash) | string | **Default:** "" | -| management_hostname | (Optional) Security Management Server prompt hostname. The name must not contain reserved words | string | **Default:** "" | -| management_installation_type | Determines if this is the primary management server, secondary management server, or log server | string | - Primary management
- Secondary management
- Log Server
**Default:** Primary management | -| SICKey | Mandatory only when deploying a secondary Management Server. The Secure Internal Communication key creates trusted connections between Check Point components. | string | **Default:** "" | -| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | -| gateway_management | Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address | string | - Locally managed
- Over the internet
**Default:** Locally managed | -| admin_cidr | (CIDR) Allow web, ssh, and graphical clients only from this network to communicate with the Security Management Server | string | valid CIDR
**Default:** 0.0.0.0/0 | -| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Security Management Server | string | valid CIDR
**Default:** 0.0.0.0/0 | -| primary_ntp | (Optional) The IPv4 addresses of Network Time Protocol primary server | string | **Default:** 169.254.169.123 | -| secondary_ntp | (Optional) The IPv4 addresses of Network Time Protocol secondary server | string | **Default:** 0.pool.ntp.org | -| management_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | -| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | **Default:** "" | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| key_name | The EC2 Key Pair name to allow SSH access to the instance | string | | +| allocate_and_associate_eip | If set to true, an elastic IP will be allocated and associated with the launched instance | bool | true/false
**Default:** true | +| volume_encryption | KMS or CMK key Identifier: Use key ID, alias, or ARN. Key alias should be prefixed with 'alias/' (e.g., for KMS default alias 'aws/ebs' - insert 'alias/aws/ebs') | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true, terraform destroy won't work properly | bool | true/false
**Default:** false | +| instance_tags | (Optional) A map of tags as key=value pairs. All tags will be added to the Management EC2 Instance | map(string) | **Default:** {} | +| iam_permissions | IAM role to attach to the instance profile | string | - None (configure later)
- Use existing (specify an existing IAM role name)
- Create with assume role permissions (specify an STS role ARN)
- Create with read permissions
- Create with read-write permissions
**Default:** Create with read permissions | +| predefined_role | (Optional) A predefined IAM role to attach to the instance profile. Ignored if var.iam_permissions is not set to 'Use existing' | string | **Default:** "" | +| sts_roles | (Optional) The IAM role will be able to assume these STS Roles (list of ARNs). Ignored if var.iam_permissions is set to 'None' or 'Use existing' | list(string) | **Default:** [] | +| management_version | Management version and license | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
- R82-BYOL
- R82-PAYG
- R82.10-BYOL
- R82.10-PAYG
**Default:** R81.20-BYOL | +| admin_shell | Set the admin shell to enable advanced command | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | +| management_password_hash | (Optional) Admin user's password hash (use command "openssl passwd -6 PASSWORD" to get the PASSWORD's hash) | string | **Default:** "" | +| management_hostname | (Optional) Security Management Server prompt hostname. The name must not contain reserved words | string | **Default:** "" | +| management_installation_type | Determines if this is the primary management server, secondary management server, or log server | string | - Primary management
- Secondary management
- Log Server
**Default:** Primary management | +| SICKey | Mandatory only when deploying a secondary Management Server. The Secure Internal Communication key creates trusted connections between Check Point components. | string | **Default:** "" | +| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | +| gateway_management | Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address | string | - Locally managed
- Over the internet
**Default:** Locally managed | +| admin_cidr | (CIDR) Allow web, ssh, and graphical clients only from this network to communicate with the Security Management Server | string | valid CIDR
**Default:** 0.0.0.0/0 | +| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Security Management Server | string | valid CIDR
**Default:** 0.0.0.0/0 | +| primary_ntp | (Optional) The IPv4 addresses of Network Time Protocol primary server | string | **Default:** 169.254.169.123 | +| secondary_ntp | (Optional) The IPv4 addresses of Network Time Protocol secondary server | string | **Default:** 0.pool.ntp.org | +| management_bootstrap_script | (Optional) Semicolon (;) separated commands to run on the initial boot | string | **Default:** "" | +| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | **Default:** "" | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | diff --git a/modules/mds/README.md b/modules/mds/README.md index c2ef23f..372fcab 100755 --- a/modules/mds/README.md +++ b/modules/mds/README.md @@ -79,36 +79,36 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------------| -| vpc_id | The VPC ID in which to deploy | string | | -| subnet_id | Subnet with a route to the internet | string | | -| mds_name | (Optional) Name tag of the Multi-Domain Server | string | **Default:** Check-Point-MDS-tf | -| mds_instance_type | Instance type of the Multi-Domain Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.12xlarge | -| key_name | EC2 Key Pair name to allow SSH access | string | | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| volume_encryption | KMS or CMK key identifier (e.g., alias/aws/ebs) | string | **Default:** alias/aws/ebs | -| enable_instance_connect | Enable SSH connection over AWS web console | bool | true/false
**Default:** false | -| disable_instance_termination | Prevent accidental termination | bool | true/false
**Default:** false | -| instance_tags | (Optional) Map of tags as key-value pairs | map(string) | | -| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | -| iam_permissions | IAM role to attach to instance profile | string | - None
- Use existing
- Create with assume role permissions
- Create with read/write
**Default:** Create with read permissions | -| predefined_role | (Optional) Predefined IAM role (only applies with 'Use existing') | string | | -| sts_roles | (Optional) List of IAM roles for STS assumption (only applies with 'Create with assume role permissions') | list(string) | | -| mds_version | Multi-Domain Server version and license | string | - R81.10-BYOL
- R81.20-BYOL
- R82-BYOL
**Default:** R81.20-BYOL | -| mds_admin_shell | Set admin shell for advanced configurations | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | -| mds_password_hash | (Optional) Admin user's password hash | string | | -| mds_hostname | (Optional) Multi-Domain Server prompt hostname | string | | -| mds_SICKey | Secure Internal Communication key for trusted connections | string | | -| allow_upload_download | Automatically download Blade Contracts and related data | bool | true/false
**Default:** true | -| mds_installation_type | Multi-Domain Server installation type | string | - Primary Multi-Domain Server
- Secondary Multi-Domain Server
- Multi-Domain Log Server
**Default:** Primary Multi-Domain Server | -| admin_cidr | CIDR for allowing access to the Multi-Domain Server | string | valid CIDR
**Default:** 0.0.0.0/0 | -| gateway_addresses | CIDR for allowing gateway access to the Multi-Domain Server | string | valid CIDR
**Default:** 0.0.0.0/0 | -| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** 169.254.169.123 | -| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** 0.pool.ntp.org | -| mds_bootstrap_script | (Optional) Semicolon-separated commands to run during initial boot | string | | -| mds_maintenance_mode_password_hash | (Optional) Admin user's password hash for maintenance mode | string | | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| Name | Description | Type | Allowed Values | +|------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_id | The VPC ID in which to deploy | string | | +| subnet_id | Subnet with a route to the internet | string | | +| mds_name | (Optional) Name tag of the Multi-Domain Server | string | **Default:** Check-Point-MDS-tf | +| mds_instance_type | Instance type of the Multi-Domain Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.12xlarge | +| key_name | EC2 Key Pair name to allow SSH access | string | | +| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| volume_encryption | KMS or CMK key identifier (e.g., alias/aws/ebs) | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable SSH connection over AWS web console | bool | true/false
**Default:** false | +| disable_instance_termination | Prevent accidental termination | bool | true/false
**Default:** false | +| instance_tags | (Optional) Map of tags as key-value pairs | map(string) | | +| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | +| iam_permissions | IAM role to attach to instance profile | string | - None
- Use existing
- Create with assume role permissions
- Create with read/write
**Default:** Create with read permissions | +| predefined_role | (Optional) Predefined IAM role (only applies with 'Use existing') | string | | +| sts_roles | (Optional) List of IAM roles for STS assumption (only applies with 'Create with assume role permissions') | list(string) | | +| mds_version | Multi-Domain Server version and license | string | - R81.10-BYOL
- R81.20-BYOL
- R82-BYOL
- R82.10-BYOL
**Default:** R81.20-BYOL | +| mds_admin_shell | Set admin shell for advanced configurations | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | +| mds_password_hash | (Optional) Admin user's password hash | string | | +| mds_hostname | (Optional) Multi-Domain Server prompt hostname | string | | +| mds_SICKey | Secure Internal Communication key for trusted connections | string | | +| allow_upload_download | Automatically download Blade Contracts and related data | bool | true/false
**Default:** true | +| mds_installation_type | Multi-Domain Server installation type | string | - Primary Multi-Domain Server
- Secondary Multi-Domain Server
- Multi-Domain Log Server
**Default:** Primary Multi-Domain Server | +| admin_cidr | CIDR for allowing access to the Multi-Domain Server | string | valid CIDR
**Default:** 0.0.0.0/0 | +| gateway_addresses | CIDR for allowing gateway access to the Multi-Domain Server | string | valid CIDR
**Default:** 0.0.0.0/0 | +| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** 169.254.169.123 | +| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** 0.pool.ntp.org | +| mds_bootstrap_script | (Optional) Semicolon-separated commands to run during initial boot | string | | +| mds_maintenance_mode_password_hash | (Optional) Admin user's password hash for maintenance mode | string | | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | diff --git a/modules/standalone/README.md b/modules/standalone/README.md index cd4af31..8b1fb41 100755 --- a/modules/standalone/README.md +++ b/modules/standalone/README.md @@ -79,32 +79,32 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|---------------------------------------------------------------------------------------------------| -| vpc_id | The VPC ID in which to deploy | string | | -| public_subnet_id | Public subnet for Security Gateway & Management (Standalone) | string | | -| private_subnet_id | Private subnet for Security Gateway & Management (Standalone) | string | | -| private_route_table | Sets `0.0.0.0/0` route in the specified route table (e.g., rtb-12a34567) | string | | -| standalone_name | (Optional) Name tag of the Standalone instance | string | **Default:** Check-Point-Standalone-tf | -| standalone_instance_type | Instance type of the Standalone instance | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| key_name | EC2 Key Pair name to allow SSH access | string | | -| allocate_and_associate_eip | Allocates and associates an Elastic IP | bool | true/false
**Default:** true | -| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | -| volume_encryption | KMS or CMK key identifier (e.g., alias/aws/ebs) | string | **Default:** alias/aws/ebs | -| enable_instance_connect | Enable SSH connection over AWS web console | bool | true/false
**Default:** false | -| disable_instance_termination | Prevent accidental termination | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | -| instance_tags | (Optional) Map of tags as key-value pairs | map(string) | | -| standalone_version | Standalone version and license | string | - R81.10-BYOL
- R82-BYOL
**Default:** R81.20-BYOL | -| admin_shell | Set admin shell for advanced configurations | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | -| standalone_password_hash | (Optional) Admin user's password hash | string | | -| resources_tag_name | (Optional) Name tag prefix for resources | string | | -| standalone_hostname | (Optional) Standalone instance prompt hostname | string | | -| allow_upload_download | Automatically download Blade Contracts and other data | bool | true/false
**Default:** true | -| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | -| standalone_bootstrap_script | (Optional) Semicolon-separated commands to run during initial boot | string | | -| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** 169.254.169.123 | -| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** 0.pool.ntp.org | -| admin_cidr | CIDR for allowing access to Management Server | string | **Default:** 0.0.0.0/0 | -| gateway_addresses | CIDR for allowing gateway access to Management Server | string | **Default:** 0.0.0.0/0 | -| standalone_maintenance_mode_password_hash | (Optional) Admin user's password hash for maintenance mode | string | | +| Name | Description | Type | Allowed Values | +|----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_id | The VPC ID in which to deploy | string | | +| public_subnet_id | Public subnet for Security Gateway & Management (Standalone) | string | | +| private_subnet_id | Private subnet for Security Gateway & Management (Standalone) | string | | +| private_route_table | Sets `0.0.0.0/0` route in the specified route table (e.g., rtb-12a34567) | string | | +| standalone_name | (Optional) Name tag of the Standalone instance | string | **Default:** Check-Point-Standalone-tf | +| standalone_instance_type | Instance type of the Standalone instance | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| key_name | EC2 Key Pair name to allow SSH access | string | | +| allocate_and_associate_eip | Allocates and associates an Elastic IP | bool | true/false
**Default:** true | +| volume_size | Root volume size (GB) - minimum 100 | number | **Default:** 200 | +| volume_encryption | KMS or CMK key identifier (e.g., alias/aws/ebs) | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable SSH connection over AWS web console | bool | true/false
**Default:** false | +| disable_instance_termination | Prevent accidental termination | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | +| instance_tags | (Optional) Map of tags as key-value pairs | map(string) | | +| standalone_version | Standalone version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
- R82-PAYG-NGTP
- R82.10-BYOL
- R82.10-PAYG-NGTP
**Default:** R81.20-BYOL | +| admin_shell | Set admin shell for advanced configurations | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | +| standalone_password_hash | (Optional) Admin user's password hash | string | | +| resources_tag_name | (Optional) Name tag prefix for resources | string | | +| standalone_hostname | (Optional) Standalone instance prompt hostname | string | | +| allow_upload_download | Automatically download Blade Contracts and other data | bool | true/false
**Default:** true | +| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | +| standalone_bootstrap_script | (Optional) Semicolon-separated commands to run during initial boot | string | | +| primary_ntp | (Optional) IPv4 address of the primary Network Time Protocol server | string | **Default:** 169.254.169.123 | +| secondary_ntp | (Optional) IPv4 address of the secondary Network Time Protocol server | string | **Default:** 0.pool.ntp.org | +| admin_cidr | CIDR for allowing access to Management Server | string | **Default:** 0.0.0.0/0 | +| gateway_addresses | CIDR for allowing gateway access to Management Server | string | **Default:** 0.0.0.0/0 | +| standalone_maintenance_mode_password_hash | (Optional) Admin user's password hash for maintenance mode | string | | diff --git a/modules/standalone_master/README.md b/modules/standalone_master/README.md index 04ab3fb..560be79 100755 --- a/modules/standalone_master/README.md +++ b/modules/standalone_master/README.md @@ -88,36 +88,36 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|--------------------------------------------------------------------------------------------------------------------| -| vpc_cidr | The CIDR block of the VPC | string | | -| public_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. | map | | -| private_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. | map | | -| subnets_bit_length | Number of additional bits with which to extend the VPC CIDR | number | | -| standalone_name | The name tag of the Security Gateway & Management (Standalone) instance | string |**Default:** Check-Point-Standalone-tf | -| standalone_instance_type | The instance type of the Security Gateway & Management (Standalone) instance | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | -| allocate_and_associate_eip | Allocate and associate an Elastic IP with the launched instance | bool | true/false
**Default:** true | -| volume_size | Root volume size (GB) | number |**Default:** 200 | -| volume_encryption | KMS or CMK key Identifier | string |**Default:** alias/aws/ebs | -| enable_instance_connect | Enable SSH connection over AWS web console | bool | true/false
**Default:** false | -| disable_instance_termination | Prevent accidental termination of the instance | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | -| instance_tags | A map of tags as key=value pairs. | map(string) |**Default:** {} | -| standalone_version | Security Gateway & Management (Standalone) version and license | string | - R81.20-BYOL
- R82-PAYG-NGTP
**Default:** R81.20-BYOL | -| admin_shell | Set the admin shell to enable advanced command-line configuration | string | - /etc/cli.sh
- /bin/bash
**Default:** /etc/cli.sh | -| standalone_password_hash | Admin user's password hash | string | | -| resources_tag_name | (Optional) | string | | -| standalone_hostname | Security Gateway & Management (Standalone) prompt hostname | string | | -| allow_upload_download | Automatically download Blade Contracts and other important data | bool | true/false
**Default:** true | -| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | -| standalone_bootstrap_script | Semicolon (;) separated commands to run on the initial boot | string | | -| primary_ntp | IPv4 address of Network Time Protocol primary server | string |**Default:** 169.254.169.123 | -| secondary_ntp | IPv4 address of Network Time Protocol secondary server | string |**Default:** 0.pool.ntp.org | -| admin_cidr | Allow web, SSH, and graphical clients from this network to communicate with the Management Server | string |**Default:** 0.0.0.0/0 | -| gateway_addresses | Allow gateways only from this network to communicate with the Management Server | string |**Default:** 0.0.0.0/0 | -| standalone_maintenance_mode_password_hash | Maintenance-mode password hash | string | | - security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** []| +| Name | Description | Type | Allowed Values | +|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_cidr | The CIDR block of the VPC | string | | +| public_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. | map | | +| private_subnets_map | A map of pairs {availability-zone = subnet-suffix-number}. Each entry creates a subnet. Minimum 1 pair. | map | | +| subnets_bit_length | Number of additional bits with which to extend the VPC CIDR | number | | +| standalone_name | The name tag of the Security Gateway & Management (Standalone) instance | string | **Default:** Check-Point-Standalone-tf | +| standalone_instance_type | The instance type of the Security Gateway & Management (Standalone) instance | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | +| allocate_and_associate_eip | Allocate and associate an Elastic IP with the launched instance | bool | true/false
**Default:** true | +| volume_size | Root volume size (GB) | number | **Default:** 200 | +| volume_encryption | KMS or CMK key Identifier | string | **Default:** alias/aws/ebs | +| enable_instance_connect | Enable SSH connection over AWS web console | bool | true/false
**Default:** false | +| disable_instance_termination | Prevent accidental termination of the instance | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | +| instance_tags | A map of tags as key=value pairs. | map(string) | **Default:** {} | +| standalone_version | Security Gateway & Management (Standalone) version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
- R82-PAYG-NGTP
- R82.10-BYOL
- R82.10-PAYG-NGTP
**Default:** R81.20-BYOL | +| admin_shell | Set the admin shell to enable advanced command-line configuration | string | - /etc/cli.sh
- /bin/bash
**Default:** /etc/cli.sh | +| standalone_password_hash | Admin user's password hash | string | | +| resources_tag_name | (Optional) | string | | +| standalone_hostname | Security Gateway & Management (Standalone) prompt hostname | string | | +| allow_upload_download | Automatically download Blade Contracts and other important data | bool | true/false
**Default:** true | +| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | +| standalone_bootstrap_script | Semicolon (;) separated commands to run on the initial boot | string | | +| primary_ntp | IPv4 address of Network Time Protocol primary server | string | **Default:** 169.254.169.123 | +| secondary_ntp | IPv4 address of Network Time Protocol secondary server | string | **Default:** 0.pool.ntp.org | +| admin_cidr | Allow web, SSH, and graphical clients from this network to communicate with the Management Server | string | **Default:** 0.0.0.0/0 | +| gateway_addresses | Allow gateways only from this network to communicate with the Management Server | string | **Default:** 0.0.0.0/0 | +| standalone_maintenance_mode_password_hash | Maintenance-mode password hash | string | | + security_rules | List of security rules for ingress and egress. | list(object({
direction = string
from_port = any
to_port = any
protocol = any
cidr_blocks = list(any)
})) | **Default:** [] | diff --git a/modules/tgw_asg/README.md b/modules/tgw_asg/README.md index cdc5d4f..24c3688 100755 --- a/modules/tgw_asg/README.md +++ b/modules/tgw_asg/README.md @@ -94,39 +94,39 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|--------------|-------------------------------------------------------------------------------------------------------| -| vpc_id | Select an existing VPC | string | | -| gateways_subnets | Select at least 2 public subnets in the VPC. If deploying a Security Management Server, it will be in the first subnet | list(string) | | -| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | -| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevent accidental termination of an instance | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | -| allow_upload_download | Automatically download Blade Contracts and other data | bool | true/false
**Default:** true | -| gateway_name | (Optional) Name tag of the Security Gateway instances | string | **Default:** Check-Point-Gateway | -| gateway_instance_type | Instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| gateways_min_group_size | Minimum number of Security Gateways | number | **Default:** 2 | -| gateways_max_group_size | Maximum number of Security Gateways | number | **Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R82-PAYG-NGTP
**Default:** R81.20-BYOL | -| gateway_password_hash | (Optional) Admin user's password hash | string | | -| gateway_SIC_Key | Secure Internal Communication key | string | **Default:** "12345678" | -| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | -| asn | Organization Autonomous System Number (ASN) identifying the routing domain | string | **Default:** 6500 | -| management_deploy | Set to 'false' to use an existing Security Management Server | bool | true/false
**Default:** true | -| management_instance_type | Instance type of the Security Management Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | -| management_version | License for the Security Management Server | string | - R81.20-BYOL
- R82-BYOL
**Default:** R81.20-BYOL | -| management_password_hash | (Optional) Admin user's password hash | string | | -| management_permissions | IAM role for the instance profile | string | - None
- Use existing
- Create with read-write permissions
**Default:** Create with read-write permissions | -| gateways_blades | Enable the Intrusion Prevention System, Application Control, Anti-Virus, and Anti-Bot Blades | bool | true/false
**Default:** true | -| admin_cidr | Allow web, SSH, and graphical clients only from this network | string | | -| gateway_addresses | Allow gateways only from this network | string | | -| gateway_management | Select 'Over the internet' if gateways aren't accessed via private IP | string | - Locally managed
- Over the internet
**Default:** Locally managed | -| control_gateway_over_public_or_private_address | Determines if gateways use private or public address | string | - private
- public
**Default:** private | -| management_server | (Optional) Name representing the Security Management Server | string |
**Default:** management-server | -| configuration_template | (Optional) Security Gateway configuration template | string |
**Default:** TGW-ASG-configuration | -| gateway_maintenance_mode_password_hash | Maintenance-mode password hash | string | | -| management_maintenance_mode_password_hash | Maintenance-mode password hash for Security Management Server | string | | +| Name | Description | Type | Allowed Values | +|-------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------|--------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_id | Select an existing VPC | string | | +| gateways_subnets | Select at least 2 public subnets in the VPC. If deploying a Security Management Server, it will be in the first subnet | list(string) | | +| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | +| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevent accidental termination of an instance | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Deploy instance with metadata v2 token required | bool | true/false
**Default:** true | +| allow_upload_download | Automatically download Blade Contracts and other data | bool | true/false
**Default:** true | +| gateway_name | (Optional) Name tag of the Security Gateway instances | string | **Default:** Check-Point-Gateway | +| gateway_instance_type | Instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| gateways_min_group_size | Minimum number of Security Gateways | number | **Default:** 2 | +| gateways_max_group_size | Maximum number of Security Gateways | number | **Default:** 10 | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| gateway_password_hash | (Optional) Admin user's password hash | string | | +| gateway_SIC_Key | Secure Internal Communication key | string | **Default:** "12345678" | +| enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | +| asn | Organization Autonomous System Number (ASN) identifying the routing domain | string | **Default:** 6500 | +| management_deploy | Set to 'false' to use an existing Security Management Server | bool | true/false
**Default:** true | +| management_instance_type | Instance type of the Security Management Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | +| management_version | License for the Security Management Server | string | - R81.20-BYOL
- R81.20-PAYG
- R82-BYOL
- R82-PAYG
- R82.10-BYOL
- R82.10-PAYG
**Default:** R81.20-BYOL | +| management_password_hash | (Optional) Admin user's password hash | string | | +| management_permissions | IAM role for the instance profile | string | - None
- Use existing
- Create with read-write permissions
**Default:** Create with read-write permissions | +| gateways_blades | Enable the Intrusion Prevention System, Application Control, Anti-Virus, and Anti-Bot Blades | bool | true/false
**Default:** true | +| admin_cidr | Allow web, SSH, and graphical clients only from this network | string | | +| gateway_addresses | Allow gateways only from this network | string | | +| gateway_management | Select 'Over the internet' if gateways aren't accessed via private IP | string | - Locally managed
- Over the internet
**Default:** Locally managed | +| control_gateway_over_public_or_private_address | Determines if gateways use private or public address | string | - private
- public
**Default:** private | +| management_server | (Optional) Name representing the Security Management Server | string |
**Default:** management-server | +| configuration_template | (Optional) Security Gateway configuration template | string |
**Default:** TGW-ASG-configuration | +| gateway_maintenance_mode_password_hash | Maintenance-mode password hash | string | | +| management_maintenance_mode_password_hash | Maintenance-mode password hash for Security Management Server | string | | ## Outputs diff --git a/modules/tgw_asg_master/README.md b/modules/tgw_asg_master/README.md index 37c7c8b..088929c 100755 --- a/modules/tgw_asg_master/README.md +++ b/modules/tgw_asg_master/README.md @@ -116,14 +116,14 @@ module "example_module" { | gateway_instance_type | Instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | | gateways_min_group_size | Minimum number of Security Gateways | number | **Default:** 2 | | gateways_max_group_size | Maximum number of Security Gateways | number | **Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R82-PAYG
**Default:** R81.20-BYOL | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | | gateway_password_hash | (Optional) Admin user's password hash | string | | | gateway_SIC_Key | Secure Internal Communication key | string | **Default:** "12345678" | | enable_cloudwatch | Report Check Point-specific CloudWatch metrics | bool | true/false
**Default:** false | | asn | Organization Autonomous System Number (ASN) | string | **Default:** 6500 | | management_deploy | Deploy or use an existing Security Management Server | bool | true/false
**Default:** true | | management_instance_type | Instance type of the Security Management Server | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | -| management_version | License for the Security Management Server | string | - R81.10-BYOL
- R82-BYOL
**Default:** R81.20-BYOL | +| management_version | License for the Security Management Server | string | - R81.20-BYOL
- R81.20-PAYG
- R82-BYOL
- R82-PAYG
- R82.10-BYOL
- R82.10-PAYG
**Default:** R81.20-BYOL | | management_password_hash | (Optional) Admin user's password hash | string | | | management_permissions | IAM role for the instance profile | string | - None
- Use existing
- Create with read-write permissions
**Default:** Create with read-write permissions | | gateways_blades | Enable Intrusion Prevention System, Application Control, and other blades | bool | true/false
**Default:** true | diff --git a/modules/tgw_cross_az_cluster/README.md b/modules/tgw_cross_az_cluster/README.md index f08f25f..59150d1 100755 --- a/modules/tgw_cross_az_cluster/README.md +++ b/modules/tgw_cross_az_cluster/README.md @@ -118,7 +118,7 @@ module "example_module" { | metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | | instance_tags | (Optional) A map of tags as key=value pairs | map(string) | **Default:** {} | | predefined_role | (Optional) A predefined IAM role to attach to the cluster profile | string | | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
**Default:** R81.20-BYOL | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | | admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/tcsh
**Default:** /etc/cli.sh | | gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. | string | **Default:** "12345678" | | gateway_password_hash | (Optional) Admin user's password hash | string | | diff --git a/modules/tgw_cross_az_cluster_master/README.md b/modules/tgw_cross_az_cluster_master/README.md index 7aa4c64..f185f70 100755 --- a/modules/tgw_cross_az_cluster_master/README.md +++ b/modules/tgw_cross_az_cluster_master/README.md @@ -127,7 +127,7 @@ module "example_module" { | metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | | instance_tags | (Optional) A map of tags as key=value pairs. All tags will be added to the Gateway EC2 instances | map(string) |**Default:** {} | | predefined_role | (Optional) A predefined IAM role to attach to the cluster profile | string | | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R82-BYOL
**Default:** R81.20-BYOL | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | | admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
**Default:** /etc/cli.sh | | gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components | string |**Default:** "12345678" | | gateway_password_hash | (Optional) Admin user's password hash | string | | diff --git a/modules/tgw_gwlb/README.md b/modules/tgw_gwlb/README.md index a01ec92..2ae27c5 100755 --- a/modules/tgw_gwlb/README.md +++ b/modules/tgw_gwlb/README.md @@ -118,61 +118,61 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| vpc_id | Select an existing VPC | string | | -| internet_gateway_id | VPC's Internet Gateway Id | string | | -| availability_zones | The Availability Zones (AZs) to use for the subnets in the VPC. | string | | -| Number_of_AZs | Number of Availability Zones to use in the VPC. | number | **Default:** 2 | -| Gateways_subnets | Select at least 2 public subnets in the VPC. If you choose to deploy a Security Management Server it will be deployed in the first subnet | string | | -| transit_gateway_attachment_subnet_1_id | The TGW attachment subnet ID located in the 1st Availability Zone | string | | -| transit_gateway_attachment_subnet_2_id | The TGW attachment subnet ID located in the 2nd Availability Zone | string | | -| transit_gateway_attachment_subnet_3_id | The TGW attachment subnet ID located in the 3rd Availability Zone | string | | -| transit_gateway_attachment_subnet_4_id | The TGW attachment subnet ID located in the 4th Availability Zone | string | | -| nat_gw_subnet_1_cidr | CIDR block for NAT subnet 1 located in the 1st Availability Zone | string | **Default:** 10.0.13.0/24 | -| nat_gw_subnet_2_cidr | CIDR block for NAT subnet 2 located in the 2nd Availability Zone | string | **Default:** 10.0.23.0/24 | -| nat_gw_subnet_3_cidr | CIDR block for NAT subnet 3 located in the 3rd Availability Zone | string | **Default:** 10.0.33.0/24 | -| nat_gw_subnet_4_cidr | CIDR block for NAT subnet 4 located in the 4th Availability Zone | string | **Default:** 10.0.43.0/24 | -| gwlbe_subnet_1_cidr | CIDR block for GWLBe subnet 1 located in the 1st Availability Zone | string | **Default:** 10.0.14.0/24 | -| gwlbe_subnet_2_cidr | CIDR block for GWLBe subnet 2 located in the 2nd Availability Zone | string | **Default:** 10.0.24.0/24 | -| gwlbe_subnet_3_cidr | CIDR block for GWLBe subnet 3 located in the 3rd Availability Zone | string | **Default:** 10.0.34.0/24 | -| gwlbe_subnet_4_cidr | CIDR block for GWLBe subnet 4 located in the 4th Availability Zone | string | **Default:** 10.0.44.0/24 | -| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | -| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | -| management_server | The name that represents the Security Management Server in the automatic provisioning configuration | string | **Default:** CP-Management-gwlb-tf | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true terraform destroy won't work properly | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | -| volume_size | Instances volume size | number | **Default:** 200 | -| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | -| configuration_template | The tag is used by the Security Management Server to automatically provision the Security Gateways. Must be up to 12 alphanumeric characters and unique for each Quick Start deployment | string | **Default:** gwlb-ter | -| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | -| gateway_load_balancer_name | Load Balancer name in AWS | string | **Default:** gwlb-terraform | -| target_group_name | Target Group Name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens. | string | **Default:** tg1-terraform | -| connection_acceptance_required | Indicate whether requests from service consumers to create an endpoint to your service must be accepted. Default is set to false (acceptance not required). | bool | true/false
**Default:** false | -| enable_cross_zone_load_balancing | Select 'true' to enable cross-az load balancing. NOTE! this may cause a spike in cross-az charges. | bool | true/false
**Default:** true | -| gateway_name | The name tag of the Security Gateway instances. (optional) | string | **Default:** gwlb-terraform | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| gateways_min_group_size | The minimal number of Security Gateways | number | **Default:** 2 | -| gateways_max_group_size | The maximal number of Security Gateways | number | **Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
**Default:** R81.20-BYOL | -| gateway_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | -| gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters | string | **Default:** "12345678" | -| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) An optional script with semicolon (;) separated commands to run on the initial boot | string | | -| gateways_provision_address_type | Determines if the gateways are provisioned using their private or public address. | string | - private
- public
**Default:** private | -| allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false | -| management_deploy | Select 'false' to use an existing Security Management Server or to deploy one later and to ignore the other parameters of this section | bool | true/false
**Default:** true | -| management_instance_type | The EC2 instance type of the Security Management Server | string | - c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | -| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
**Default:** R81.20-BYOL | -| management_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | -| gateways_policy | The name of the Security Policy package to be installed on the gateways in the Security Gateways Auto Scaling group | string | **Default:** Standard | -| gateway_management | Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address. | string | - Locally managed
- Over the internet
**Default:** Locally managed | -| admin_cidr | (CIDR) Allow web, ssh, and graphical clients only from this network to communicate with the Management Server | string | valid CIDR | -| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Management Server | string | valid CIDR | -| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | -| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | | -| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | | +| Name | Description | Type | Allowed Values | +|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_id | Select an existing VPC | string | | +| internet_gateway_id | VPC's Internet Gateway Id | string | | +| availability_zones | The Availability Zones (AZs) to use for the subnets in the VPC. | string | | +| Number_of_AZs | Number of Availability Zones to use in the VPC. | number | **Default:** 2 | +| Gateways_subnets | Select at least 2 public subnets in the VPC. If you choose to deploy a Security Management Server it will be deployed in the first subnet | string | | +| transit_gateway_attachment_subnet_1_id | The TGW attachment subnet ID located in the 1st Availability Zone | string | | +| transit_gateway_attachment_subnet_2_id | The TGW attachment subnet ID located in the 2nd Availability Zone | string | | +| transit_gateway_attachment_subnet_3_id | The TGW attachment subnet ID located in the 3rd Availability Zone | string | | +| transit_gateway_attachment_subnet_4_id | The TGW attachment subnet ID located in the 4th Availability Zone | string | | +| nat_gw_subnet_1_cidr | CIDR block for NAT subnet 1 located in the 1st Availability Zone | string | **Default:** 10.0.13.0/24 | +| nat_gw_subnet_2_cidr | CIDR block for NAT subnet 2 located in the 2nd Availability Zone | string | **Default:** 10.0.23.0/24 | +| nat_gw_subnet_3_cidr | CIDR block for NAT subnet 3 located in the 3rd Availability Zone | string | **Default:** 10.0.33.0/24 | +| nat_gw_subnet_4_cidr | CIDR block for NAT subnet 4 located in the 4th Availability Zone | string | **Default:** 10.0.43.0/24 | +| gwlbe_subnet_1_cidr | CIDR block for GWLBe subnet 1 located in the 1st Availability Zone | string | **Default:** 10.0.14.0/24 | +| gwlbe_subnet_2_cidr | CIDR block for GWLBe subnet 2 located in the 2nd Availability Zone | string | **Default:** 10.0.24.0/24 | +| gwlbe_subnet_3_cidr | CIDR block for GWLBe subnet 3 located in the 3rd Availability Zone | string | **Default:** 10.0.34.0/24 | +| gwlbe_subnet_4_cidr | CIDR block for GWLBe subnet 4 located in the 4th Availability Zone | string | **Default:** 10.0.44.0/24 | +| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | +| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | +| management_server | The name that represents the Security Management Server in the automatic provisioning configuration | string | **Default:** CP-Management-gwlb-tf | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents an instance from accidental termination. Note: Once this attribute is true terraform destroy won't work properly | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Set true to deploy the instance with metadata v2 token required | bool | true/false
**Default:** true | +| volume_size | Instances volume size | number | **Default:** 200 | +| allow_upload_download | Automatically download Blade Contracts and other important data. Improve product experience by sending data to Check Point | bool | true/false
**Default:** true | +| configuration_template | The tag is used by the Security Management Server to automatically provision the Security Gateways. Must be up to 12 alphanumeric characters and unique for each Quick Start deployment | string | **Default:** gwlb-ter | +| admin_shell | Set the admin shell to enable advanced command line configuration | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | +| gateway_load_balancer_name | Load Balancer name in AWS | string | **Default:** gwlb-terraform | +| target_group_name | Target Group Name. This name must be unique within your AWS account and can have a maximum of 32 alphanumeric characters and hyphens. | string | **Default:** tg1-terraform | +| connection_acceptance_required | Indicate whether requests from service consumers to create an endpoint to your service must be accepted. Default is set to false (acceptance not required). | bool | true/false
**Default:** false | +| enable_cross_zone_load_balancing | Select 'true' to enable cross-az load balancing. NOTE! this may cause a spike in cross-az charges. | bool | true/false
**Default:** true | +| gateway_name | The name tag of the Security Gateway instances. (optional) | string | **Default:** gwlb-terraform | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| gateways_min_group_size | The minimal number of Security Gateways | number | **Default:** 2 | +| gateways_max_group_size | The maximal number of Security Gateways | number | **Default:** 10 | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| gateway_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | +| gateway_SICKey | The Secure Internal Communication key for trusted connection between Check Point components. Choose a random string consisting of at least 8 alphanumeric characters | string | **Default:** "12345678" | +| enable_cloudwatch | Report Check Point specific CloudWatch metrics | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) An optional script with semicolon (;) separated commands to run on the initial boot | string | | +| gateways_provision_address_type | Determines if the gateways are provisioned using their private or public address. | string | - private
- public
**Default:** private | +| allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false | +| management_deploy | Select 'false' to use an existing Security Management Server or to deploy one later and to ignore the other parameters of this section | bool | true/false
**Default:** true | +| management_instance_type | The EC2 instance type of the Security Management Server | string | - c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** m5.xlarge | +| management_version | The license to install on the Security Management Server | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
**Default:** R81.20-BYOL | +| management_password_hash | (Optional) Admin user's password hash (use command 'openssl passwd -6 PASSWORD' to get the PASSWORD's hash) | string | | +| gateways_policy | The name of the Security Policy package to be installed on the gateways in the Security Gateways Auto Scaling group | string | **Default:** Standard | +| gateway_management | Select 'Over the internet' if any of the gateways you wish to manage are not directly accessed via their private IP address. | string | - Locally managed
- Over the internet
**Default:** Locally managed | +| admin_cidr | (CIDR) Allow web, ssh, and graphical clients only from this network to communicate with the Management Server | string | valid CIDR | +| gateway_addresses | (CIDR) Allow gateways only from this network to communicate with the Management Server | string | valid CIDR | +| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | +| gateway_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | | +| management_maintenance_mode_password_hash | Check Point recommends setting Admin user's password and maintenance-mode password for recovery purposes. | string | | ## Outputs To display the outputs defined by the module, create an `outputs.tf` file with the following structure: ``` diff --git a/modules/tgw_gwlb_master/README.md b/modules/tgw_gwlb_master/README.md index fea1859..af716ee 100755 --- a/modules/tgw_gwlb_master/README.md +++ b/modules/tgw_gwlb_master/README.md @@ -122,58 +122,58 @@ module "example_module" { ## Inputs -| Name | Description | Type | Allowed Values | -|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| vpc_cidr | The CIDR block of the VPC | string | | -| subnets_bit_length | Number of additional bits to extend the VPC CIDR. For example, a /16 CIDR with a subnets_bit_length of 4 results in /20 subnets. | number | | -| public_subnets_map | A map of {availability-zone = subnet-suffix-number}. Minimum 1 pair (e.g., {"us-east-1a" = 1}). | map | | -| availability_zones | The Availability Zones (AZs) to use for the subnets in the VPC. | string | | -| Number_of_AZs | Number of Availability Zones to use in the VPC. | number | **Default:** 2 | -| tgw_subnets_map | A map of {availability-zone = subnet-suffix-number} for TGW subnets. Minimum 2 pairs (e.g., {"us-east-1a" = 1}). | map | | -| nat_gw_subnet_1_cidr | CIDR block for NAT subnet 1 in the 1st Availability Zone | string | **Default:** 10.0.13.0/24 | -| nat_gw_subnet_2_cidr | CIDR block for NAT subnet 2 in the 2nd Availability Zone | string | **Default:** 10.0.23.0/24 | -| nat_gw_subnet_3_cidr | CIDR block for NAT subnet 3 in the 3rd Availability Zone | string | **Default:** 10.0.33.0/24 | -| nat_gw_subnet_4_cidr | CIDR block for NAT subnet 4 in the 4th Availability Zone | string | **Default:** 10.0.43.0/24 | -| gwlbe_subnet_1_cidr | CIDR block for GWLBe subnet 1 in the 1st Availability Zone | string | **Default:** 10.0.14.0/24 | -| gwlbe_subnet_2_cidr | CIDR block for GWLBe subnet 2 in the 2nd Availability Zone | string | **Default:** 10.0.24.0/24 | -| gwlbe_subnet_3_cidr | CIDR block for GWLBe subnet 3 in the 3rd Availability Zone | string | **Default:** 10.0.34.0/24 | -| gwlbe_subnet_4_cidr | CIDR block for GWLBe subnet 4 in the 4th Availability Zone | string | **Default:** 10.0.44.0/24 | -| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | -| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | -| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | -| disable_instance_termination | Prevents accidental termination. Note: When true, `terraform destroy` won’t work properly. | bool | true/false
**Default:** false | -| metadata_imdsv2_required | Set true to deploy instances with IMDSv2 metadata token required. | bool | true/false
**Default:** true | -| volume_size | Instance volume size | number | **Default:** 200 | -| allow_upload_download | Automatically download Blade Contracts and other data. | bool | true/false
**Default:** true | -| management_server | The name representing the Security Management Server in the automatic provisioning configuration. | string | **Default:** CP-Management-gwlb-tf | -| configuration_template | The provisioning tag for the Security Gateways. Must be up to 12 alphanumeric characters and unique. | string | **Default:** gwlb-ter | -| admin_shell | Set the admin shell for advanced command line configuration. | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | -| gateway_load_balancer_name | Load Balancer name in AWS | string | **Default:** gwlb-terraform | -| target_group_name | Target Group Name. Must be unique within your AWS account with up to 32 alphanumeric characters and hyphens. | string | **Default:** tg1-terraform | -| connection_acceptance_required | Indicate whether service consumers must accept endpoint requests. Default is false (not required). | bool | true/false
**Default:** false | -| enable_cross_zone_load_balancing | Enable cross-AZ load balancing. This may increase cross-AZ charges. | bool | true/false
**Default:** true | -| gateway_name | The name tag of the Security Gateway instances. | string | **Default:** gwlb-terraform | -| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| gateways_min_group_size | The minimum number of Security Gateways | number | **Default:** 2 | -| gateways_max_group_size | The maximum number of Security Gateways | number | **Default:** 10 | -| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
**Default:** R81.20-BYOL | -| gateway_password_hash | (Optional) Admin user's password hash (use command `openssl passwd -6 PASSWORD` to get the PASSWORD's hash). | string | | -| gateway_SICKey | The Secure Internal Communication key for trusted connections between Check Point components. At least 8 alphanumeric characters. | string | **Default:** "12345678" | -| enable_cloudwatch | Report Check Point-specific CloudWatch metrics. | bool | true/false
**Default:** false | -| gateway_bootstrap_script | (Optional) Semicolon-separated commands to run on initial boot. | string | | -| gateways_provision_address_type | Determines if gateways are provisioned using private or public addresses. | string | - private
- public
**Default:** private | -| allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false | -| management_deploy | Use an existing Security Management Server or deploy a new one. | bool | true/false
**Default:** true | -| management_instance_type | The EC2 instance type of the Security Management Server | string | - c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | -| management_version | The license to install on the Security Management Server. | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
**Default:** R81.20-BYOL | -| management_password_hash | (Optional) Admin user's password hash (use command `openssl passwd -6 PASSWORD` to get the PASSWORD's hash). | string | | -| gateways_policy | The name of the Security Policy package to install on gateways in the Auto Scaling group. | string | **Default:** Standard | -| gateway_management | Select 'Over the internet' if managing gateways not directly accessible via private IP addresses. | string | - Locally managed
- Over the internet
**Default:** Locally managed | -| admin_cidr | (CIDR) Allow web, ssh, and graphical clients from this network to communicate with the Management Server. | string | valid CIDR | -| gateway_addresses | (CIDR) Allow gateways from this network to communicate with the Management Server. | string | valid CIDR | -| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | -| gateway_maintenance_mode_password_hash | (Optional) Maintenance-mode password hash for recovery purposes. | string | | -| management_maintenance_mode_password_hash | (Optional) Maintenance-mode password hash for recovery purposes. | string | | +| Name | Description | Type | Allowed Values | +|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| vpc_cidr | The CIDR block of the VPC | string | | +| subnets_bit_length | Number of additional bits to extend the VPC CIDR. For example, a /16 CIDR with a subnets_bit_length of 4 results in /20 subnets. | number | | +| public_subnets_map | A map of {availability-zone = subnet-suffix-number}. Minimum 1 pair (e.g., {"us-east-1a" = 1}). | map | | +| availability_zones | The Availability Zones (AZs) to use for the subnets in the VPC. | string | | +| Number_of_AZs | Number of Availability Zones to use in the VPC. | number | **Default:** 2 | +| tgw_subnets_map | A map of {availability-zone = subnet-suffix-number} for TGW subnets. Minimum 2 pairs (e.g., {"us-east-1a" = 1}). | map | | +| nat_gw_subnet_1_cidr | CIDR block for NAT subnet 1 in the 1st Availability Zone | string | **Default:** 10.0.13.0/24 | +| nat_gw_subnet_2_cidr | CIDR block for NAT subnet 2 in the 2nd Availability Zone | string | **Default:** 10.0.23.0/24 | +| nat_gw_subnet_3_cidr | CIDR block for NAT subnet 3 in the 3rd Availability Zone | string | **Default:** 10.0.33.0/24 | +| nat_gw_subnet_4_cidr | CIDR block for NAT subnet 4 in the 4th Availability Zone | string | **Default:** 10.0.43.0/24 | +| gwlbe_subnet_1_cidr | CIDR block for GWLBe subnet 1 in the 1st Availability Zone | string | **Default:** 10.0.14.0/24 | +| gwlbe_subnet_2_cidr | CIDR block for GWLBe subnet 2 in the 2nd Availability Zone | string | **Default:** 10.0.24.0/24 | +| gwlbe_subnet_3_cidr | CIDR block for GWLBe subnet 3 in the 3rd Availability Zone | string | **Default:** 10.0.34.0/24 | +| gwlbe_subnet_4_cidr | CIDR block for GWLBe subnet 4 in the 4th Availability Zone | string | **Default:** 10.0.44.0/24 | +| key_name | The EC2 Key Pair name to allow SSH access to the instances | string | | +| enable_volume_encryption | Encrypt Environment instances volume with default AWS KMS key | bool | true/false
**Default:** true | +| enable_instance_connect | Enable SSH connection over AWS web console. Supporting regions can be found [here](https://aws.amazon.com/about-aws/whats-new/2019/06/introducing-amazon-ec2-instance-connect/) | bool | true/false
**Default:** false | +| disable_instance_termination | Prevents accidental termination. Note: When true, `terraform destroy` won’t work properly. | bool | true/false
**Default:** false | +| metadata_imdsv2_required | Set true to deploy instances with IMDSv2 metadata token required. | bool | true/false
**Default:** true | +| volume_size | Instance volume size | number | **Default:** 200 | +| allow_upload_download | Automatically download Blade Contracts and other data. | bool | true/false
**Default:** true | +| management_server | The name representing the Security Management Server in the automatic provisioning configuration. | string | **Default:** CP-Management-gwlb-tf | +| configuration_template | The provisioning tag for the Security Gateways. Must be up to 12 alphanumeric characters and unique. | string | **Default:** gwlb-ter | +| admin_shell | Set the admin shell for advanced command line configuration. | string | - /etc/cli.sh
- /bin/bash
- /bin/csh
- /bin/tcsh
**Default:** /etc/cli.sh | +| gateway_load_balancer_name | Load Balancer name in AWS | string | **Default:** gwlb-terraform | +| target_group_name | Target Group Name. Must be unique within your AWS account with up to 32 alphanumeric characters and hyphens. | string | **Default:** tg1-terraform | +| connection_acceptance_required | Indicate whether service consumers must accept endpoint requests. Default is false (not required). | bool | true/false
**Default:** false | +| enable_cross_zone_load_balancing | Enable cross-AZ load balancing. This may increase cross-AZ charges. | bool | true/false
**Default:** true | +| gateway_name | The name tag of the Security Gateway instances. | string | **Default:** gwlb-terraform | +| gateway_instance_type | The instance type of the Security Gateways | string | - c4.large
- c4.xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| gateways_min_group_size | The minimum number of Security Gateways | number | **Default:** 2 | +| gateways_max_group_size | The maximum number of Security Gateways | number | **Default:** 10 | +| gateway_version | Gateway version and license | string | - R81.20-BYOL
- R81.20-PAYG-NGTP
- R81.20-PAYG-NGTX
- R82-BYOL
- R82-PAYG-NGTP
- R82-PAYG-NGTX
- R82.10-BYOL
- R82.10-PAYG-NGTP
- R82.10-PAYG-NGTX
**Default:** R81.20-BYOL | +| gateway_password_hash | (Optional) Admin user's password hash (use command `openssl passwd -6 PASSWORD` to get the PASSWORD's hash). | string | | +| gateway_SICKey | The Secure Internal Communication key for trusted connections between Check Point components. At least 8 alphanumeric characters. | string | **Default:** "12345678" | +| enable_cloudwatch | Report Check Point-specific CloudWatch metrics. | bool | true/false
**Default:** false | +| gateway_bootstrap_script | (Optional) Semicolon-separated commands to run on initial boot. | string | | +| gateways_provision_address_type | Determines if gateways are provisioned using private or public addresses. | string | - private
- public
**Default:** private | +| allocate_public_IP | Allocate a Public IP for gateway members. | bool | true/false
**Default:** false | +| management_deploy | Use an existing Security Management Server or deploy a new one. | bool | true/false
**Default:** true | +| management_instance_type | The EC2 instance type of the Security Management Server | string | - c5.large
- c5.xlarge
- c5.2xlarge
- c5.4xlarge
- c5.9xlarge
- c5.12xlarge
- c5.18xlarge
- c5.24xlarge
- c5n.large
- c5n.xlarge
- c5n.2xlarge
- c5n.4xlarge
- c5n.9xlarge
- c5n.18xlarge
- c5d.large
- c5d.xlarge
- c5d.2xlarge
- c5d.4xlarge
- c5d.9xlarge
- c5d.12xlarge
- c5d.18xlarge
- c5d.24xlarge
- m5.large
- m5.xlarge
- m5.2xlarge
- m5.4xlarge
- m5.8xlarge
- m5.12xlarge
- m5.16xlarge
- m5.24xlarge
- m6i.large
- m6i.xlarge
- m6i.2xlarge
- m6i.4xlarge
- m6i.8xlarge
- m6i.12xlarge
- m6i.16xlarge
- m6i.24xlarge
- m6i.32xlarge
- c6i.large
- c6i.xlarge
- c6i.2xlarge
- c6i.4xlarge
- c6i.8xlarge
- c6i.12xlarge
- c6i.16xlarge
- c6i.24xlarge
- c6i.32xlarge
- c6in.large
- c6in.xlarge
- c6in.2xlarge
- c6in.4xlarge
- c6in.8xlarge
- c6in.12xlarge
- c6in.16xlarge
- c6in.24xlarge
- c6in.32xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5.4xlarge
- r5.8xlarge
- r5.12xlarge
- r5.16xlarge
- r5.24xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
- r5a.4xlarge
- r5a.8xlarge
- r5a.12xlarge
- r5a.16xlarge
- r5a.24xlarge
- r5b.large
- r5b.xlarge
- r5b.2xlarge
- r5b.4xlarge
- r5b.8xlarge
- r5b.12xlarge
- r5b.16xlarge
- r5b.24xlarge
- r5n.large
- r5n.xlarge
- r5n.2xlarge
- r5n.4xlarge
- r5n.8xlarge
- r5n.12xlarge
- r5n.16xlarge
- r5n.24xlarge
- r6i.large
- r6i.xlarge
- r6i.2xlarge
- r6i.4xlarge
- r6i.8xlarge
- r6i.12xlarge
- r6i.16xlarge
- r6i.24xlarge
- r6i.32xlarge
- m6a.large
- m6a.xlarge
- m6a.2xlarge
- m6a.4xlarge
- m6a.8xlarge
- m6a.12xlarge
- m6a.16xlarge
- m6a.24xlarge
- m6a.32xlarge
- m6a.48xlarge
**Default:** c5.xlarge | +| management_version | The license to install on the Security Management Server. | string | - R81.10-BYOL
- R81.10-PAYG
- R81.20-BYOL
- R81.20-PAYG
**Default:** R81.20-BYOL | +| management_password_hash | (Optional) Admin user's password hash (use command `openssl passwd -6 PASSWORD` to get the PASSWORD's hash). | string | | +| gateways_policy | The name of the Security Policy package to install on gateways in the Auto Scaling group. | string | **Default:** Standard | +| gateway_management | Select 'Over the internet' if managing gateways not directly accessible via private IP addresses. | string | - Locally managed
- Over the internet
**Default:** Locally managed | +| admin_cidr | (CIDR) Allow web, ssh, and graphical clients from this network to communicate with the Management Server. | string | valid CIDR | +| gateway_addresses | (CIDR) Allow gateways from this network to communicate with the Management Server. | string | valid CIDR | +| volume_type | General Purpose SSD Volume Type | string | - gp3
- gp2
**Default:** gp3 | +| gateway_maintenance_mode_password_hash | (Optional) Maintenance-mode password hash for recovery purposes. | string | | +| management_maintenance_mode_password_hash | (Optional) Maintenance-mode password hash for recovery purposes. | string | | ## Outputs diff --git a/modules/version_license/main.tf b/modules/version_license/main.tf index 9351529..3560789 100755 --- a/modules/version_license/main.tf +++ b/modules/version_license/main.tf @@ -8,7 +8,10 @@ locals { "R81.20-PAYG-NGTX", "R82-BYOL", "R82-PAYG-NGTP", - "R82-PAYG-NGTX" + "R82-PAYG-NGTX", + "R82.10-BYOL", + "R82.10-PAYG-NGTP", + "R82.10-PAYG-NGTX" ] mgmt_versions = [ "R81.10-BYOL", @@ -16,12 +19,15 @@ locals { "R81.20-BYOL", "R81.20-PAYG", "R82-BYOL", - "R82-PAYG" + "R82-PAYG", + "R82.10-BYOL", + "R82.10-PAYG" ] mds_versions = [ "R81.10-BYOL", "R81.20-BYOL", - "R82-BYOL" + "R82-BYOL", + "R82.10-BYOL" ] standalone_versions = [ "R81.10-BYOL", @@ -29,7 +35,9 @@ locals { "R81.20-BYOL", "R81.20-PAYG-NGTP", "R82-BYOL", - "R82-PAYG-NGTP" + "R82-PAYG-NGTP", + "R82.10-BYOL", + "R82.10-PAYG-NGTP" ] gwlb_gw_versions = [ "R81.20-BYOL", @@ -37,7 +45,10 @@ locals { "R81.20-PAYG-NGTX", "R82-BYOL", "R82-PAYG-NGTP", - "R82-PAYG-NGTX" + "R82-PAYG-NGTX", + "R82.10-BYOL", + "R82.10-PAYG-NGTP", + "R82.10-PAYG-NGTX" ] }