### Install Terratest Package

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/tests/README.md

Installs the Terratest package, a Go library that simplifies the process of writing automated tests for infrastructure code. This is a prerequisite for running module tests.

```bash
go get -u github.com/gruntwork-io/terratest
```

--------------------------------

### Terraform Output Value: names Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/names_generator/README.md

This example shows the structure of the `names` output value, which provides a map of generated resource names. The names are organized by resource type and include examples for VPCs, Gateway Load Balancers, and their endpoints.

```Terraform
names = {
    vpc                           = {
        app1_vpc     = "example-vpc-app1-cloud-tst-ec1"
        app2_vpc     = "example-vpc-app2-cloud-tst-ec1"
        security_vpc = "example-vpc-security-cloud-tst-ec1"
    }
    gateway_loadbalancer          = {
        security_gwlb = "example-gwlb-security-cloud-tst"
    }
    gateway_loadbalancer_endpoint = {
        app1_inbound           = "example-gwep-app1-cloud-tst-ec1"
        app2_inbound           = "example-gwep-app2-cloud-tst-ec1"
        security_gwlb_eastwest = "example-gwep-eastwest-cloud-tst-ec1"
        security_gwlb_outbound = "example-gwep-outbound-cloud-tst-ec1"
    }
}
```

--------------------------------

### Install Semantic Release Packages for Testing

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/docs/contributing.md

Installs the necessary Node.js packages globally for testing the release process using semantic-release. This includes specific versions of semantic-release and related plugins.

```shell
npm install -g semantic-release@^17.1.1 @semantic-release/git@^9.0.0 @semantic-release/exec@^5.0.0 conventional-changelog-conventionalcommits@^4.4.0
```

--------------------------------

### ALB Rules Configuration Example (Terraform)

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/alb/README.md

This example demonstrates the structure for configuring ALB listener rules, including application-specific settings like protocol, port, SSL policies, health checks, and listener rules. It shows how to define listener rule priorities, target group details, and various rule conditions.

```Terraform
rules = {
  "application_name" = {
    protocol            = "HTTP" # or HTTPS
    port                = 80
    certificate_arn     = null # Required for HTTPS
    ssl_policy          = null # Optional for HTTPS

    health_check_protocol            = "HTTP"
    health_check_port                = 80
    health_check_healthy_threshold   = 3
    health_check_unhealthy_threshold = 3
    health_check_interval            = "30s"
    health_check_timeout             = "5s" # AWS default
    health_check_matcher             = "200"
    health_check_path                = "/"

    listener_rules    = {
      "1" = {
        target_port           = 8080
        target_protocol       = "HTTP"
        protocol_version      = "HTTP1"
        round_robin           = true
        host_headers          = ["example.com"]
        http_headers          = {}
        http_request_method   = null
        path_pattern          = ["/api/*"]
        query_strings         = {}
        source_ip_sets        = []
      }
    }
  }
}
```

--------------------------------

### Terraform VPC Configuration Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

This Terraform code snippet demonstrates the configuration of a VPC, including its name, CIDR block, Network Access Control Lists (NACLs), security groups with outbound rules, subnets, and routes. It showcases how to define network infrastructure within AWS using Terraform.

```terraform
vpcs = {
  example_vpc = {
    name = "example-spoke-vpc"
    cidr = "10.104.0.0/16"
    nacls = {
      trusted_path_monitoring = {
        name = "trusted-path-monitoring"
        rules = {
          allow_inbound = {
            rule_number = 300
            egress      = false
            protocol    = "-1"
            rule_action = "allow"
            cidr_block  = "0.0.0.0/0"
            from_port   = null
            to_port     = null
          }
        }
      }
    }
    security_groups = {
      example_vm = {
        name = "example_vm"
        rules = {
          all_outbound = {
            description = "Permit All traffic outbound"
            type        = "egress", from_port = "0", to_port = "0", protocol = "-1"
            cidr_blocks = ["0.0.0.0/0"]
          }
        }
      }
    }
    subnets = {
      "10.104.0.0/24"   = { az = "eu-central-1a", subnet_group = "vm", nacl = null }
      "10.104.128.0/24" = { az = "eu-central-1b", subnet_group = "vm", nacl = null }
    }
    routes = {
      vm_default = {
        vpc           = "app1_vpc"
        subnet_group        = "app1_vm"
        to_cidr       = "0.0.0.0/0"
        next_hop_key  = "app1"
        next_hop_type = "transit_gateway_attachment"
      }
    }
  }
}
```

--------------------------------

### Terraform Input Variable: template_assignments Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/names_generator/README.md

This example demonstrates the expected format for the `template_assignments` input variable, which maps resource types to naming templates. This is used to control how resource names are generated.

```Terraform
template_assignments = {
  default                               = "name_after_abbr"
  subnet                                = "name_with_az"
  route_table                           = "name_with_az"
  nat_gateway                           = "name_at_the_end"
  vm                                    = "name_at_the_end"
  vmseries                              = "name_at_the_end"
  vmseries_network_interface            = "name_at_the_end"
  application_loadbalancer              = "name_max_32_characters"
  application_loadbalancer_target_group = "name_max_32_characters"
  network_loadbalancer                  = "name_max_32_characters"
  network_loadbalancer_target_group     = "name_max_32_characters"
  gateway_loadbalancer                  = "name_max_32_characters"
  gateway_loadbalancer_target_group     = "name_max_32_characters"
}
```

--------------------------------

### Run Specific Test for Module

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/tests/README.md

Executes a single, specific test case for a module. This is useful for targeted debugging or verification of a particular functionality.

```bash
go test -v -timeout 30m -count=1 -run TestOutputForModuleVmseriesWithFullVariablesWithS3Bootstrapping
```

--------------------------------

### Terraform Configuration for Panorama Deployment

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

This is a Terraform configuration file example for deploying Panorama in AWS. It specifies the required Terraform version, AWS provider configuration, and references modules for VPC, subnets, NAT gateway, and the Panorama instance itself. It also defines IAM roles and instance profiles.

```hcl
terraform {
  required_version = ">= 1.5.0, < 2.0.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.17"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

module "vpc" {
  source = "../../modules/vpc"
}

module "subnet_sets" {
  source = "../../modules/subnet_set"

  vpc_id = module.vpc.vpc_id
}

module "natgw_set" {
  source = "../../modules/nat_gateway_set"

  vpc_id = module.vpc.vpc_id
  public_subnet_id = module.subnet_sets.public_subnet_ids[0]
}

module "vpc_routes" {
  source = "../../modules/vpc_route"

  vpc_id = module.vpc.vpc_id
  natgw_id = module.natgw_set.natgw_id
  subnet_ids = module.subnet_sets.private_subnet_ids
}

module "panorama" {
  source = "../../modules/panorama"

  vpc_id              = module.vpc.vpc_id
  private_subnet_id   = module.subnet_sets.private_subnet_ids[0]
  public_subnet_id    = module.subnet_sets.public_subnet_ids[0]
  panorama_instance_type = "m5.xlarge"
  ami                 = data.aws_ami.panorama.id
  tags = {
    Name = "panorama-standalone"
  }
}

data "aws_partition" "this" {}

data "aws_caller_identity" "this" {}

resource "aws_iam_role" "this" {
  name = "panorama-instance-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "this" {
  name = "panorama-instance-policy"
  role = aws_iam_role.this.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:DescribeInstances",
          "ec2:DescribeTags",
          "ec2:CreateNetworkInterface",
          "ec2:DescribeNetworkInterfaces",
          "ec2:ModifyNetworkInterfaceAttribute",
          "ec2:DeleteNetworkInterface",
          "ec2:DescribeSubnets",
          "ec2:DescribeVpcs",
          "ec2:DescribeSecurityGroups",
          "ec2:CreateTags",
          "ec2:DeleteTags",
          "ec2:AttachNetworkInterface",
          "ec2:DetachNetworkInterface",
          "ec2:DescribeImages",
          "ec2:DescribeSnapshots",
          "ec2:CreateVolume",
          "ec2:DeleteVolume",
          "ec2:AttachVolume",
          "ec2:DetachVolume",
          "ec2:ModifyInstanceAttribute",
          "ec2:DescribeInstanceAttribute",
          "ec2:StopInstances",
          "ec2:StartInstances",
          "ec2:CreateSnapshot",
          "ec2:DeleteSnapshot",
          "ec2:DescribeAddresses",
          "ec2:AllocateAddress",
          "ec2:AssociateAddress",
          "ec2:DisassociateAddress",
          "ec2:ReleaseAddress",
          "ec2:DescribeVpcAttribute",
          "ec2:DescribeInternetGateways",
          "ec2:DescribeRouteTables",
          "ec2:CreateRoute",
          "ec2:ReplaceRoute",
          "ec2:DeleteRoute",
          "ec2:DescribeEips",
          "ec2:DescribePublicIpv4Pools"
        ]
        Effect = "Allow"
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_instance_profile" "this" {
  name = "panorama-instance-profile"
  role = aws_iam_role.this.name
}

data "aws_ami" "panorama" {
  most_recent = true
  filter {
    name   = "name"
    values = ["panorama-*)${var.panorama_version}*"]
  }
  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
  filter {
    name = "root-device-type"
    values = ["ebs"]
  }
  owners = ["679593309084"] # Palo Alto Networks Official Account
}

variable "panorama_version" {
  description = "PAN-OS version to deploy"
  type        = string
  default     = "10.2.3"
}

```

--------------------------------

### Run All Tests and Generate Report

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/tests/README.md

Runs all tests within the project and pipes the JSON output to 'go-test-report' to generate HTML reports. This command is suitable for comprehensive testing and reporting.

```bash
go test -timeout 130m ./... -json | go-test-report
```

--------------------------------

### Execute Bootstrap Module Tests

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/tests/README.md

Executes the tests for the 'bootstrap' module using Go's testing framework. It specifies verbose output, a timeout, and ensures tests are run without caching.

```bash
cd tests/bootstrap
go test -v -timeout 30m -count=1
```

--------------------------------

### Terraform: Initialize and Deploy Panorama Infrastructure

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

This snippet demonstrates the Terraform commands to initialize the project, prepare a deployment plan, and apply the infrastructure for a Panorama standalone deployment. It assumes the AWS provider is configured and the necessary variables are set.

```bash
terraform init
terraform plan
terraform apply -auto-approve
```

--------------------------------

### Terraform Module Versioning Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/docs/terraform-conventions.md

Demonstrates how to version Terraform modules using Git tags and pin module versions in the root configuration with the `ref` argument. This ensures consistent and controlled use of modules.

```terraform
module "bootstrap_bucket" {
  source          = "spring.paloaltonetworks.com/mekanayake/terraform-aws-panfw-bootstrap?ref=0.1.0"
  bucket_prefix   = "GlobalProtect-bootstrap-"
  local_directory = "vmseries-bootstrap-package"
}
```

--------------------------------

### AWS Terraform Deployment and Destruction

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/isolated_design_autoscale/README.md

Commands to initialize, plan, apply, and destroy infrastructure managed by Terraform. Ensures proper setup and cleanup of cloud resources.

```bash
terraform init
terraform plan
terraform apply -auto-approve
terraform destroy -auto-approve
```

--------------------------------

### Terraform: Bad Example - Disjointed Input Variables

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/docs/terraform-conventions.md

This Terraform example demonstrates a non-intuitive way to structure input variables for a module. It uses separate variables for subnet names and CIDR blocks, requiring the module user to ensure the lists are parallel and of the same length. This can lead to errors and makes the module harder to use.

```Terraform
module "vpc" {
  source = "..."
  subnet_names = ["Public", "Private"]
  subnet_cidr = ["192.168.0.0/24", "192.168.1.0/24"]
}
```

--------------------------------

### Terraform Lambda Python Package Installation Control

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/asg/README.md

A boolean flag to control the execution frequency of the local-exec command for installing Python packages required by Lambda. Setting to 'true' ensures installation happens only once after resource creation, promoting idempotency. Setting to 'false' checks for package downloads on every apply, which is useful in CI/CD environments but may require two apply calls for full idempotency from scratch.

```terraform
lambda_execute_pip_install_once = false
```

--------------------------------

### Terraform Transit Gateway Next Hop Set Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/transit_gateway_attachment/README.md

This snippet demonstrates the structure of the `next_hop_set` output, which is intended for routing traffic from subnets to the Transit Gateway. It includes example values for IDs, attachment ID, and type.

``` Terraform
next_hop_set = {
  ids = {}
  id   = "tgw-attach-123"
  type = "transit_gateway"
}
```

--------------------------------

### Terraform AWS ALB Module Usage Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/alb/README.md

This code demonstrates how to use the Palo Alto Networks Application Load Balancer module for AWS. It shows the configuration for a public ALB with two example rules: a 'defaults' rule with HTTP protocol and a 'https-custom' rule with HTTPS protocol, custom certificate, and health check configurations. It also defines target group configurations and applies global tags.

```Terraform
module "public_alb" {
  source = "../../modules/alb"

  lb_name = "public-alb"
  region  = var.region

  subnets                    = { for k, v in module.security_subnet_sets["untrust"].subnets : k => { id = v.id } }
  desync_mitigation_mode     = "monitor"
  vpc_id                     = module.security_vpc.id
  configure_access_logs      = true
  access_logs_s3_bucket_name = "alb-logs-bucket"
  security_groups            = [module.security_vpc.security_group_ids["load_balancer"]]

  rules = {
    "defaults" = {
      protocol = "HTTP"
      listener_rules = {
        "1" = {
          target_port     = 8080
          target_protocol = "HTTP"
          host_headers    = ["default.com", "www.default.com"]
        }
      }
    }
    "https-custom" = {
      protocol        = "HTTPS"
      port            = 443
      certificate_arn = "arn:aws:acm:eu-west-1:123456789012:certificate/97bd27c1-3822-4082-967d-d7084e0fe52f"

      health_check_port     = "80"
      health_check_protocol = "HTTP"
      health_check_matcher  = "302"
      health_check_path     = "/"
      health_check_interval = 10

      listener_rules = {
        "1" = {
          target_port         = 8443
          target_protocol     = "HTTP"
          host_headers        = ["www.custom.org"]
          http_request_method = ["GET", "HEAD"]
        }
        "2" = {
          target_port         = 8444
          target_protocol     = "HTTP"
          host_headers        = ["api.custom.org"]
          http_request_method = ["POST", "OPTIONS", "DELETE"]
        }
      }
    }
  }

  targets = { for k, v in var.vmseries : k => module.vmseries[k].interfaces["untrust"].private_ip }

  tags = var.global_tags
}

```

--------------------------------

### Terraform AWS Provider Configuration

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/vmseries_standalone/README.md

This section specifies the required Terraform providers and their versions. It includes the Terraform core version and the AWS provider version, ensuring compatibility for the deployment.

```hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.17"
    }
  }
  required_version = ">= 1.5.0, < 2.0.0"
}
```

--------------------------------

### Terraform Network Interface Configuration Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/asg/README.md

Defines the structure for network interface specifications, including device index, subnet ID, naming, public IP creation, source-destination check, and security group association. This map allows for detailed configuration of network interfaces for instances. Ensure 'device_index' is set correctly if 'mgmt-interface-swap' is enabled.

```terraform
interfaces = {
  mgmt = {
    device_index       = 0
    subnet_id          = aws_subnet.mgmt.id
    name               = "mgmt"
    create_public_ip   = true
    source_dest_check  = true
    security_group_ids = ["sg-123456"]
  },
  public = {
    device_index     = 1
    subnet_id        = aws_subnet.public.id
    name             = "public"
    create_public_ip = true
  },
  private = {
    device_index = 2
    subnet_id    = aws_subnet.private.id
    name         = "private"
  }
}
```

--------------------------------

### Terraform AWS Load Balancer Targets Configuration Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/alb/README.md

Provides an example of configuring targets for an AWS Application Load Balancer using Terraform. It demonstrates how to map VM-Series instances to their private IP addresses within a specific subnet, enabling direct routing.

```terraform
fw_instance_ips = { for k, v in var.vmseries : k => module.vmseries[k].interfaces["untrust"].private_ip }
```

--------------------------------

### Terraform: Get Panorama Public IPs

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

This snippet demonstrates how to retrieve the public IP addresses assigned to the Panorama instances after deployment using Terraform output. This information is crucial for accessing the Panorama instances.

```bash
terraform output panorama_public_ips
```

--------------------------------

### Terraform NACL Configuration Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/vpc/README.md

Demonstrates the structure for configuring Network Access Control Lists (NACLs) within a Terraform setup. This includes defining NACL names, rule numbers, direction (egress), protocols, actions, CIDR blocks, and port ranges. It shows how to block outbound ICMP and allow all inbound traffic.

```terraform
nacls = {
    trusted_path_monitoring = {
      name = "trusted-path-monitoring"
      rules = {
        block_outbound_icmp = {
          rule_number = 110
          egress      = true
          protocol    = "icmp"
          rule_action = "deny"
          cidr_block  = "10.100.1.0/24"
          from_port   = null
          to_port     = null
        }
        allow_inbound = {
          rule_number = 300
          egress      = false
          protocol    = "-1"
          rule_action = "allow"
          cidr_block  = "0.0.0.0/0"
          from_port   = null
          to_port     = null
        }
      }
    }
  }
```

--------------------------------

### List VM-Series Firewall Versions (AWS CLI)

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/asg/README.md

Retrieves a sorted list of available VM-Series Firewall versions deployable in AWS. This command requires the AWS CLI to be installed and configured. It filters EC2 images by product code and name pattern, then extracts and sorts the descriptions.

```bash
aws ec2 describe-images --region us-west-1 --filters "Name=product-code,Values=6njl1pau431dv1qxipg63mvah" "Name=name,Values=PA-VM-AWS-*" --output json --query "Images[].Description" | grep -o 'PA-VM-AWS-.*' | sort
```

--------------------------------

### Terraform Route Configuration

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

Defines routing rules within the VPC. This allows for specifying the destination CIDR block, next hop type and key, and destination type. It also supports managed prefix list IDs for more granular control over traffic.

```Terraform
routes = optional(map(object({
            vpc                    = string
            subnet_group           = string
            to_cidr                = string
            next_hop_key           = string
            next_hop_type          = string
            destination_type       = optional(string, "ipv4")
            managed_prefix_list_id = optional(string)
          })), {})
```

--------------------------------

### Terraform - Default Abbreviations for Resources

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/names_generator/README.md

Defines a map of abbreviations used for various AWS resources within the Terraform configuration. These abbreviations can be substituted for resource names in templates.

```terraform
{
  "application_loadbalancer": "alb",
  "application_loadbalancer_target_group": "atg",
  "gateway_loadbalancer": "gwlb",
  "gateway_loadbalancer_endpoint": "gwep",
  "gateway_loadbalancer_target_group": "gwtg",
  "iam_instance_profile": "profile",
  "iam_role": "role",
  "internet_gateway": "igw",
  "nat_gateway": "ngw",
  "network_loadbalancer": "nlb",
  "network_loadbalancer_target_group": "ntg",
  "route_table": "rt",
  "route_table_internet_gateway": "rt",
  "security_group": "sg",
  "subnet": "snet",
  "transit_gateway": "tgw",
  "transit_gateway_attachment": "att",
  "transit_gateway_route_table": "trt",
  "vm": "vm",
  "vmseries": "vm",
  "vmseries_network_interface": "nic",
  "vpc": "vpc",
  "vpn_gateway": "vgw"
}
```

--------------------------------

### Configure NAT Gateways in Terraform

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

Defines NAT Gateways with specified names, VPC, subnet group, and Elastic IP configurations. Supports custom EIP attributes and tags.

```terraform
natgws = {
  sec_natgw = {
    vpc = "security_vpc"
    subnet_group = "natgw"
    nat_gateway_names = {
      "eu-west-1a" = "nat-gw-1"
      "eu-west-1b" = "nat-gw-2"
    }
    eips ={
      "eu-west-1a" = { 
        name = "natgw-1-pip"
      }
    }
  }
}
```

--------------------------------

### Terraform - Name Templates for Resource Naming

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/names_generator/README.md

Defines various templates for generating resource names. These templates allow customization through delimiters, prefixes, abbreviations, and dynamic markers like '%s', '__default__', '__az_numeric__', and '__az_literal__'.

```terraform
{
  name_at_the_end = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
      { name = "%s" },
  ] } 
  name_after_abbr = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
  ] }
  name_with_az = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
      { az = "__az_numeric__" }, # __az_literal__, __az_numeric__
  ] }
  name_max_32_characters = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
  ] }
}
```

--------------------------------

### Spoke NLB Configuration Example (Terraform)

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/combined_design/README.md

Defines Network Load Balancers (NLBs) deployed in spoke VPCs. Configures NLB names, VPC and subnet group associations, target VMs, and optional settings for internal load balancing and stickiness rules.

```Terraform
spoke_lbs = {
  "app1-nlb" = {
    vpc    = "app1_vpc"
    subnet_group = "app1_lb"
    vms    = ["app1_vm01", "app1_vm02"]
  }
}
```

--------------------------------

### Terraform VPC Configuration

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

Defines the configuration for a Virtual Private Cloud (VPC) within the Terraform module. It accepts arguments for VPC CIDR block, tags, DHCP options, and DNS settings. This structure is crucial for network isolation and management.

```Terraform
vpc = optional(object({
  cidr_block              = string
  assign_generated_ipv6_cidr_block = optional(bool, false)
  enable_dns_hostnames    = optional(bool, true)
  enable_dns_support      = optional(bool, true)
  instance_tenancy        = optional(string, "default")
  public_ipv4_τητα_id = optional(string)
  network_acl             = optional(object({
    id   = string
    name = string
  }))
  internet_gateway = optional(object({
    create = optional(bool, true)
    name   = optional(string)
  }))
  nat_gateway = optional(object({
    create = optional(bool, true)
    name   = optional(string)
  }))
  tags = optional(map(string), {})<br/>}))
```

--------------------------------

### Spoke ALB Configuration Example (Terraform)

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/combined_design/README.md

Defines Application Load Balancers (ALBs) deployed in spoke VPCs. Configures rules for traffic balancing, target VMs, VPC and subnet group associations, and security groups. Supports custom listener rules with path patterns.

```Terraform
spoke_albs = {
  # Example ALB configuration
  # ... other ALB configurations
}
```

--------------------------------

### Define GWLB Subnets with Module Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/gwlb/README.md

Specifies the AWS subnets where the Gateway Load Balancer will be created. This input expects a map where keys are availability zone names and values contain the subnet ID. It demonstrates using the `subnet_set` module's output for convenience.

```terraform
subnets = module.subnet_set.subnets
# Example:
# subnets = {
#   "us-east-1a" = { id = "snet-123007" }
#   "us-east-1b" = { id = "snet-123008" }
# }
```

--------------------------------

### Terraform Subnet Configuration

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

Defines the configuration for subnets within a VPC. Each subnet can be configured with its availability zone, subnet group, NACL association, route table association, and whether to create the subnet automatically. It also supports mapping public IPs on launch.

```Terraform
subnets = optional(map(object({
  name                    = optional(string, "")
  az                      = string
  subnet_group            = string
  nacl                    = optional(string)
  create_subnet           = optional(bool, true)
  create_route_table      = optional(bool, true)
  existing_route_table_id = optional(string)
  route_table_name        = optional(string)
  associate_route_table   = optional(bool, true)
  local_tags              = optional(map(string), {})
  map_public_ip_on_launch = optional(bool, false)
})), {})
```

--------------------------------

### Connect to VM-Series via SSH

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/vmseries_standalone/README.md

This command demonstrates how to establish an SSH connection to the VM-Series instance using its public IP address and a specified private key. Replace 'x.x.x.x' with the actual public IP and '/PATH/TO/YOUR/KEY/id_rsa' with the correct path to your SSH private key.

```bash
ssh admin@x.x.x.x -i /PATH/TO/YOUR/KEY/id_rsa
```

--------------------------------

### Configure Panorama Instances in Terraform

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

Sets up Panorama instances, including high-availability pairs, with specified PAN-OS versions, network configurations (VPC, subnet, security group, public IP), EBS volumes with KMS encryption, and IAM roles. Supports IMDSv2 enablement.

```terraform
panoramas = {
  panorama_ha_pair = {
    instances = {
      "primary" = {
        az                 = "eu-central-1a"
        private_ip_address = "10.255.0.4"
      }
      "secondary" = {
        az                 = "eu-central-1b"
        private_ip_address = "10.255.1.4"
      }
    }

    panos_version = "10.2.3"

    network = {
      vpc              = "management_vpc"
      subnet_group     = "mgmt"
      security_group   = "panorama_mgmt"
      create_public_ip = true
    }

    ebs = {
      volumes = [
        {
          name            = "ebs-1"
          ebs_device_name = "/dev/sdb"
          ebs_size        = "2000"
          ebs_encrypted   = true
        },
        {
          name            = "ebs-2"
          ebs_device_name = "/dev/sdc"
          ebs_size        = "2000"
          ebs_encrypted   = true
        }
      ]
      kms_key_alias = "aws/ebs"
    }

    iam = {
      create_role = true
      role_name   = "panorama"
    }

    enable_imdsv2 = false
  }
}
```

--------------------------------

### Enable IPv6 on VM-Series Management Interface

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/vmseries_standalone/README.md

This optional configuration enables dynamic IPv6 addressing on the management interface of the VM-Series firewall. It's typically needed for IPv6 connectivity scenarios.

```bash
> configure
# set deviceconfig system ipv6-type dynamic non-temporary-address yes
# set deviceconfig system ipv6-gw-type dynamic
```

--------------------------------

### Terraform: Intuitive Variable Structure - List of Maps

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/docs/terraform-conventions.md

This Terraform example shows an intuitive way to structure input variables for a module, specifically for subnets. It accepts a list of maps, where each map contains details for a subnet. The module code would then transform this list into a map internally if needed for resource creation.

```Terraform
module "vpc" {
  source = "..."
  subnet_cidr = [
    {
      name = "Public"
      az   = "eu-est-2a"
      cidr = "192.168.0.0/24"
    },
    {
      name = "Private"
      az = "eu-est-2b"
      cidr = "192.168.1.0/24"
    }
  ]
}
```

--------------------------------

### Terraform: Destroy Panorama Infrastructure

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

This snippet shows the Terraform command to destroy the deployed Panorama infrastructure. It is used to clean up resources after the deployment is no longer needed.

```bash
terraform destroy -auto-approve
```

--------------------------------

### Terraform - Map of Resource Names

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/names_generator/README.md

A map used to define names for various resources. It iterates through defined resource blocks (e.g., vpcs, gwlbs) and assigns their respective names.

```terraform
{
  vpc                           = { for k, v in var.vpcs : k => v.name }
  gateway_loadbalancer          = { for k, v in var.gwlbs : k => v.name }
  gateway_loadbalancer_endpoint = { for k, v in var.gwlb_endpoints : k => v.name }
}
```

--------------------------------

### Terraform: Set Panorama Admin Password

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/panorama_standalone/README.md

This snippet outlines the CLI commands to connect to a Panorama instance via SSH and set the administrative password. It requires the instance's public IP address and the associated private key.

```bash
ssh admin@x.x.x.x -i /PATH/TO/YOUR/KEY/id_rsa
> configure
# set mgt-config users admin password
```

--------------------------------

### Terraform Transit Gateway Configuration Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/cloudngfw_centralized_design/README.md

Defines the configuration for Transit Gateways, including options for creating new Transit Gateways or reusing existing ones. It also allows for the definition of associated route tables.

```terraform
tgw = {
  create = true
  id     = null
  name   = "tgw"
  asn    = "64512"
  route_tables = {
    "from_security_vpc" = {
      create = true
      name   = "from_security"
    }
  }
}
```

--------------------------------

### Deploy VM-Series Firewalls with Terraform

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/vmseries_standalone/README.md

Configures VM-Series firewall instances, including their network interfaces, bootstrap options for Panorama integration, PAN-OS version, and EBS KMS ID for encryption. Supports multiple network interfaces (private, management, public) with specific security groups and VPC/subnet assignments.

```Terraform
vmseries = {
  vmseries = {
    instances = {
      "01" = { az = "eu-central-1a" }
      "02" = { az = "eu-central-1b" }
    }

    bootstrap_options = {
      mgmt-interface-swap         = "enable"
      plugin-op-commands          = "panorama-licensing-mode-on,aws-gwlb-inspect:enable,aws-gwlb-overlay-routing:enable"
      dhcp-send-hostname          = "yes"
      dhcp-send-client-id         = "yes"
      dhcp-accept-server-hostname = "yes"
      dhcp-accept-server-domain   = "yes"
    }

    panos_version = "10.2.3"        
    ebs_kms_id    = "alias/aws/ebs" 

    vpc = "security_vpc"

    gwlb = "security_gwlb"

    interfaces = {
      private = {
        device_index      = 0
        security_group    = "vmseries_private"
        vpc               = "security_vpc"
        subnet_group            = "private"
        create_public_ip  = false
        source_dest_check = false
      }
      mgmt = {
        device_index      = 1
        security_group    = "vmseries_mgmt"
        vpc               = "security_vpc"
        subnet_group            = "mgmt"
        create_public_ip  = true
        source_dest_check = true
      }
      public = {
        device_index      = 2
        security_group    = "vmseries_public"
        vpc               = "security_vpc"
        subnet_group            = "public"
        create_public_ip  = true
        source_dest_check = false
      }
    }
  }
}
```

--------------------------------

### Terraform Spoke ALB Configuration Example

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/isolated_design_autoscale/README.md

Defines Application Load Balancers (ALBs) for spoke VPCs, including rules for traffic balancing, target VMs, VPC and subnet group associations, and security groups. It supports customizable listener rules with target protocols, ports, and path patterns.

```Terraform
spoke_albs = {
  "example-alb" = {
    rules = {
      "http-rule" = {
        protocol = "HTTP"
        port = 80
        health_check_port = "80"
        health_check_matcher = "200"
        health_check_path = "/"
        health_check_interval = 10
        listener_rules = {
          "app1-targets" = {
            target_protocol = "HTTP"
            target_port     = 80
            path_pattern    = ["/*"]
          }
        }
      }
    }
    vms             = ["vm-1", "vm-2"]
    vpc             = "spoke_vpc"
    subnet_group    = "alb_subnets"
    security_groups = "alb_sg"
  }
}
```

--------------------------------

### Terraform AWS VPC Module Usage

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/vpc/README.md

Example HCL code demonstrating how to instantiate and configure the Palo Alto Networks VPC module for AWS. It showcases essential parameters for VPC creation, including name, CIDR blocks, internet gateway creation, and tag management.

```hcl
module "vpc" {
  source = "../../modules/vpc"

  name                    = var.name
  cidr_block              = var.vpc_cidr_block
  secondary_cidr_blocks   = var.vpc_secondary_cidr_blocks
  create_internet_gateway = true
  global_tags             = var.global_tags
  vpc_tags                = var.vpc_tags
  security_groups         = var.security_groups
}
```

--------------------------------

### Deploy VPC and Subnet Sets using Terraform

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/subnet_set/README.md

This example demonstrates how to define and deploy both a VPC and a set of subnets using Terraform. It utilizes the Palo Alto Networks subnet-set module for AWS and assumes a pre-existing VPC module. Input variables for VPC CIDR blocks, tags, and subnet configurations are expected.

```hcl
module "vpc" {
  source = "../../modules/vpc"

  name                    = var.name
  cidr_block              = var.vpc_cidr_block
  secondary_cidr_blocks   = var.vpc_secondary_cidr_blocks
  create_internet_gateway = true
  global_tags             = var.global_tags
  vpc_tags                = var.vpc_tags
  security_groups         = var.security_groups
}

module "subnet_sets" {
  source   = "../../modules/subnet_set"

  for_each = toset(distinct([for _, v in var.subnets : v.set]))
  
  name   = each.key
  cidrs  = { for k, v in var.subnets : k => v if v.set == each.key }
  vpc_id = module.vpc.id
}
```

--------------------------------

### Terraform Optional Variable for Extensibility

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/docs/terraform-conventions.md

Shows how to include optional variables in Terraform resource definitions to enhance future extensibility. The example uses the `lookup` function to provide a default value (null) if the optional argument is not specified.

```terraform
resource "aws_subnet" "in_secondary_cidr" {
  vpc_id     = vpc_id
  cidr_block = each.value.cidr_block
  ipv6_cidr_block = lookup(each.value, "ipv6_cidr_block", null)
}
```

--------------------------------

### Define Name Templates for Resource Naming (HCL)

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/names_generator/README.md

This HCL code block defines various naming templates that can be used within the `names_generator` module. Each template specifies a delimiter and a list of parts, including prefixes, abbreviations, business units, environments, suffixes, and dynamic elements like the name itself or availability zone.

```hcl
name_templates = {
  name_at_the_end = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
      { name = "%s" },
  ] }
  name_after_abbr = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
  ] }
  name_with_az = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
      { suffix = "ec1" },
      { az = "__az_numeric__" }, # __az_literal__, __az_numeric__
  ] }
  name_max_32_characters = {
    delimiter = "-"
    parts = [
      { prefix = null },
      { abbreviation = "__default__" },
      { name = "%s" },
      { bu = "cloud" },
      { env = "tst" },
  ] }
}
```

--------------------------------

### Terraform Configuration for Firewall Subinterfaces and System Services

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/vmseries_standalone/README.md

This Terraform configuration defines nested structures for managing subinterfaces and system services within a firewall deployment. It specifies routing configurations for inbound, outbound, and east-west traffic, assigning GWLB endpoints and subinterface identifiers. System services like DNS and NTP servers can also be configured, with placeholders for future updates.

```terraform
subinterfaces = {
  inbound = {
    app1 = {
      gwlb_endpoint = "app1_inbound"
      subinterface  = "ethernet1/1.11"
    }
    app2 = {
      gwlb_endpoint = "app2_inbound"
      subinterface  = "ethernet1/1.12"
    }
  }
  outbound = {
    only_1_outbound = {
      gwlb_endpoint = "security_gwlb_outbound"
      subinterface  = "ethernet1/1.20"
    }
  }
  eastwest = {
    only_1_eastwest = {
      gwlb_endpoint = "security_gwlb_eastwest"
      subinterface  = "ethernet1/1.30"
    }
  }
}

system_services = {
  dns_primary = "4.2.2.2"      # TODO: update here
  dns_secondy = null           # TODO: update here
  ntp_primary = "pool.ntp.org" # TODO: update here
  ntp_secondy = null           # TODO: update here
}
```

--------------------------------

### Terraform Schema for Palo Alto Networks VM-Series on AWS

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/examples/vmseries_standalone/README.md

This Terraform schema defines the input parameters for deploying Palo Alto Networks VM-Series firewalls on AWS. It includes configurations for instance details, bootstrap options, networking interfaces, licensing, and advanced features like load balancers and subinterfaces. The schema supports various customization options for network and security configurations.

```hcl
map(object({
  instances = map(object({
    az   = string
    name = optional(string)
  }))

  bootstrap_options = object({
    hostname                              = optional(string)
    mgmt-interface-swap                   = string
    plugin-op-commands                    = string
    op-command-modes                      = optional(string)
    panorama-server                       = string
    panorama-server-2                     = optional(string)
    auth-key                              = optional(string)
    vm-auth-key                           = optional(string)
    dgname                                = string
    tplname                               = optional(string)
    cgname                                = optional(string)
    dns-primary                           = optional(string)
    dns-secondary                         = optional(string)
    dhcp-send-hostname                    = optional(string)
    dhcp-send-client-id                   = optional(string)
    dhcp-accept-server-hostname           = optional(string)
    dhcp-accept-server-domain             = optional(string)
    authcodes                             = optional(string)
    vm-series-auto-registration-pin-id    = optional(string)
    vm-series-auto-registration-pin-value = optional(string)
  })

  panos_version                          = string
  vmseries_ami_id                        = optional(string)
  vmseries_product_code                  = optional(string, "6njl1pau431dv1qxipg63mvah")
  include_deprecated_ami                 = optional(bool, false)
  instance_type                          = optional(string, "m5.xlarge")
  ebs_encrypted                          = optional(bool, true)
  ebs_kms_id                             = optional(string, "alias/aws/ebs")
  enable_instance_termination_protection = optional(bool, false)
  enable_monitoring                      = optional(bool, false)
  fw_license_type                        = optional(string, "byol")

  vpc  = string
  gwlb = optional(string)

  interfaces = map(object({
    device_index       = number
    name               = optional(string)
    description        = optional(string)
    security_group     = string
    subnet_group       = string
    create_public_ip   = optional(bool, false)
    eip_allocation_id  = optional(string)
    source_dest_check  = optional(bool, false)
    private_ips        = optional(list(string))
    ipv6_address_count = optional(number, null)
    public_ipv4_pool   = optional(string)
  }))

  subinterfaces = optional(map(map(object({
    gwlb_endpoint = string
    subinterface  = string
  }))), {})

  tags = optional(map(string))

  system_services = object({
    dns_primary = string
    dns_secondy = optional(string)
    ntp_primary = string
    ntp_secondy = optional(string)
  })

  application_lb = optional(object({
    name           = optional(string)
    subnet_group   = optional(string)
    security_group = optional(string)
    rules          = optional(any)
  }), {})

  network_lb = optional(object({
    name         = optional(string)
    subnet_group = optional(string)
    rules        = optional(any)
  }), {})
}))
```

--------------------------------

### List AIRS Runtime Security Versions (AWS CLI)

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/asg/README.md

Retrieves a sorted list of available AIRS (Advanced Threat Prevention) runtime security versions deployable in AWS. This command requires the AWS CLI to be installed and configured. It filters EC2 images by product code and name pattern, then extracts and sorts the names.

```bash
aws ec2 describe-images --region us-west-1 --filters "Name=product-code,Values=b261y39exndwe1ltro1tqpeog" "Name=name,Values=PA-AI-Runtime-Security-AWS-*" --output json --query "Images[].Name" | grep -o 'PA-AI-Runtime-Security-AWS-.*' | sort
```

--------------------------------

### Next Hop Set Example for VPC Routing

Source: https://github.com/paloaltonetworks/terraform-aws-swfw-modules/blob/main/modules/gwlb_endpoint_set/README.md

Demonstrates the structure of the 'next_hop_set' output, which is used to configure VPC routing. It specifies IDs for next hops based on availability zones and the type of next hop, intended for routing traffic to endpoints within the same AZ.

```hcl
next_hop_set = {
  ids = {
    "us-east-1a" = "gwlbe-0ddf598f93a8ea8ae"
    "us-east-1b" = "gwlbe-0862c4b707b012111"
  }
  id   = null
  type = "vpc_endpoint"
}
```