Refactor hierarchical firewall policy variables

[ludoo]

In the organization/folder modules:

• the firewall_policies variable mixes policy and policy rules
• the locals in the firewall-policies.tf file are very hard to parse

One example while naming mixes policies and rules

_merged_rules = flatten([
    for policy, rules in local.firewall_policies : [
      for name, rule in rules : merge(rule, {
        policy = policy
        name   = name
      })
    ]
  ])

Also check description fields for all resource management modules.

[juliocc]

What do you think if we move hfw policies to its own module and we leave only the attachment in the resman modules?

[ludoo]

What do you think if we move hfw policies to its own module and we leave only the attachment in the resman modules?

Hmmmm the factory is pretty convenient to have in the org/folder modules, but I agree that it has very little relationship with resman. I both like splitting fw policies into a separate module, and the convenience/simplicity of the current approach, so whatever you prefer works for me.

[ludoo]

In hindsight, if we leverage the existing net firewall policy to create the policy (and optionally use it for attachment too), and only leave attachments in the resource management modules, that is probably the right way to go.

+1 to your approach

[ludoo]

Had a look at the VPC Network Firewall Policy module, and the resource attributes for network policies/rules are a 1:1 match for hirerachical policies/rules.

What we could do is integrate hierarchical policies in the same module and backport the factory. Then replace the project_id variable with a root_node one which accepts a project, folder, or organization. The first type of node creates a network policy, the second and third one a hierarchical policy. The region variable would of course be only valid for network policies.

Attachments should be optionally managed in the module itself via an attachments variable which would replace the current target_vpcs one and take VPC ids for network policy, org/folder ids for hierarchical policy. Attachments should still possible from individual VPCs/folders/org by passing in the policy id.

This is the variable set of the current module

I agree with @juliocc that this would result in a much cleaner design. I'm going to draft this unless you all don't like the approach.

[juliocc]

sounds great, go for it!

[ludoo]

This has been completed with the latest merge.