A Firewall that Blocks rather than Narrates

azure-firewall

An Azure Firewall that blocks rather than narrates. Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.

Every security feature on this service defaults to telling you, not to stopping it. threat_intelligence_mode defaults to Alert: traffic to addresses and domains on Microsoft's malicious-infrastructure feed is logged and then forwarded. Intrusion detection defaults to Alert as well: the signature fires, the alert is written, the packet is delivered. In both cases the portal shows the feature as enabled and the dashboards fill with detections, while nothing is prevented. Deny for both here, with blocks_known_malicious_traffic and blocks_intrusion_signatures as outputs.

IDPS and TLS inspection exist only on the Premium SKU. On Standard, setting an intrusion detection mode is accepted by Terraform and does nothing - the worst of both worlds, since you pay for neither and believe you have one. A precondition refuses that combination.

FQDN rules in network rule collections need the DNS proxy. Without dns_proxy_enabled, the firewall resolves the name when it evaluates the rule and the client resolves it separately - and a round-robin or geo-routed record can hand them different answers, so the address the client actually reaches is not the address the rule allowed. On here.

Azure Firewall records nothing by itself. An allow or deny that was never written down cannot be reviewed, which removes the only evidence that any of the above did what it claims.

Smaller things: the subnet must be named exactly AzureFirewallSubnet and Azure's error when it is not does not say so, so a precondition checks the name; and three availability zones by default, because every route in the virtual network points at this firewall by design and a single-zone deployment is a single point of failure for all of them.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.