{% set config = merged_configs.get('azurerm_firewall', {}) %}
{% set comments = compliance_comments.get('azurerm_firewall', []) %}
# ------------------------------------------------------------------------------
# Azure Firewall
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "azurerm_firewall_policy" "this" {
  name                = "{{ config.get('policy_name', project_id ~ '-fw-policy') }}"
  resource_group_name = var.resource_group_name
  location            = var.region

  sku = "{{ config.get('sku_tier', 'Standard') }}"

  threat_intelligence_mode = "{{ config.get('threat_intelligence_mode', 'Alert') }}"

  {% if config.get('dns_proxy_enabled', false) %}
  dns {
    proxy_enabled = true
    servers       = {{ config.get('dns_servers', '[]') }}
  }
  {% endif %}

  {% if config.get('intrusion_detection_mode') %}
  intrusion_detection {
    mode = "{{ config.intrusion_detection_mode }}"
  }
  {% endif %}

  tags = {
    Name      = "{{ config.get('policy_name', project_id ~ '-fw-policy') }}"
    ManagedBy = "complyform"
  }
}

resource "azurerm_firewall" "this" {
  name                = "{{ config.get('name', project_id ~ '-fw') }}"
  resource_group_name = var.resource_group_name
  location            = var.region

  sku_name = "AZFW_VNet"
  sku_tier = "{{ config.get('sku_tier', 'Standard') }}"

  firewall_policy_id = azurerm_firewall_policy.this.id

  ip_configuration {
    name                 = "{{ project_id }}-fw-ipconfig"
    subnet_id            = "{{ config.get('subnet_id', '') }}"
    public_ip_address_id = "{{ config.get('public_ip_address_id', '') }}"
  }

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-fw') }}"
    ManagedBy = "complyform"
  }
}
