{% set config = merged_configs.get('azurerm_network_security_group', {}) %}
{% set comments = compliance_comments.get('azurerm_network_security_group', []) %}
# ------------------------------------------------------------------------------
# Azure Network Security Group
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "azurerm_network_security_group" "this" {
  name                = "{{ config.get('name', project_id ~ '-nsg') }}"
  resource_group_name = var.resource_group_name
  location            = var.region

  # Default deny inbound
  security_rule {
    name                       = "DenyAllInbound"
    priority                   = 4096
    direction                  = "Inbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  {% if config.get('allow_https_inbound', false) %}
  security_rule {
    name                       = "AllowHTTPS"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "{{ config.get('https_source_prefix', 'VirtualNetwork') }}"
    destination_address_prefix = "*"
  }
  {% endif %}

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-nsg') }}"
    ManagedBy = "complyform"
  }
}
