Skip to content

SCOPE.md

Latest commit

 

History

History
98 lines (88 loc) · 7 KB

SCOPE.md

File metadata and controls

98 lines (88 loc) · 7 KB
Raw

SCOPE — terraform-azurerm-route-table

Design intent

Manage an Azure route table together with its user-defined routes as one keyed unit. The keystone azurerm_route_table is named this; routes use for_each over a keyed map so adding or removing one never re-indexes the rest. The empty call creates a table with no custom routes (system routes still apply). A composition associates this table to subnets by id.

In scope

  • azurerm_route_table — keystone this (single).
  • azurerm_route — for_each over the keyed routes map (managed as separate resources, not inline).

Out of scope / consumed by id

  • Subnet associations — owned by terraform-azurerm-virtual-network (subnets); this module only emits the route table id and reads back the computed subnets set.
  • The firewall / network virtual appliance that a route points at — created elsewhere; consumed by its private IP in next_hop_in_ip_address.
  • The resource group — consumed via resource_group_name.

Consumes

Input Type Source module
resource_group_name string terraform-azurerm-resource-group (name)
location string caller / terraform-azurerm-resource-group (location)
routes[*].next_hop_in_ip_address string a firewall / NVA private IP

🔑 Required Azure RBAC Roles / Permissions

  • Network Contributor on the target resource group (or a custom role with Microsoft.Network/routeTables/* and Microsoft.Network/routeTables/routes/*).

Azure Prerequisites

  • The Microsoft.Network resource provider registered on the subscription.
  • An existing resource group.
  • For VirtualAppliance routes, the appliance and its private IP already exist.
  • The caller configures the provider "azurerm" { features {} } block, auth, and subscription; the module declares none of these.

Emits

Output Description Kind
id Resource ID of the route table (emitted first) Passthrough
name Name of the route table Passthrough
resource_group_name Resource group the route table and its routes live in Passthrough
location Azure region of the route table, as the provider NORMALIZED it - lowercased with spaces stripped Passthrough
subscription_id Subscription the route table lives in, parsed from its Resource ID Derived
route_ids Map of route key to that route's Azure Resource ID Derived
route_names Map of route key to the effective route name Azure sees Derived
route_count Number of user-defined routes in the table Passthrough
address_prefixes Map of route key to the destination the route applies to Derived
next_hop_types Map of route key to that route's next hop type Derived
next_hop_types_used Sorted, distinct next hop types present in the configuration Derived
default_route_keys Keys of routes whose destination is 0.0.0.0/0 - every IPv4 destination Derived
has_default_route Whether the table carries a 0.0.0.0/0 route Derived
default_route_next_hop_types Sorted, distinct next hop types used by the 0.0.0.0/0 routes, or an empty list when there is no default route Derived
forces_all_egress_through_a_virtual_appliance True when a 0.0.0.0/0 route points at a VirtualAppliance Derived
blackhole_route_keys Keys of routes whose next hop type is "None" Derived
virtual_appliance_route_keys Keys of routes that forward to a network virtual appliance Derived
virtual_appliance_next_hop_ips Sorted, distinct next hop addresses this table forwards to Derived
gateway_learned_routes_suppressed True when bgp_route_propagation_enabled is false Derived
bgp_route_propagation_enabled The propagation setting as configured, stated positively Passthrough
non_cidr_address_prefixes Destination prefixes in this table that carry no "/" and so are not in CIDR form Derived
subnets The set of subnet Resource IDs currently associated with this route table, as Azure reports them Passthrough
associated_subnet_count How many subnets Azure currently reports as associated with this table Passthrough
tags Tags as applied to the route table Passthrough
tag_count Number of tags on the route table, against the Azure maximum of 50 Passthrough
routes_take_effect_only_when_a_subnet_is_associated Always true Constant
this_module_creates_no_subnet_association Always true Constant
a_subnet_may_have_at_most_one_route_table Always true Constant
azure_selects_a_route_by_longest_prefix_match Always true, and the reason route order is meaningless here Constant
inline_route_blocks_are_never_rendered_by_this_module Always true, and the reason this module is safe to combine with the route table's own schema Constant
an_inline_route_block_elsewhere_would_overwrite_these_routes Always true Constant
removing_every_route_requires_an_explicit_empty_set Always true, and a consequence of route being computed on the table Constant
routes_are_written_one_at_a_time Always true Constant
next_hop_type_is_compared_case_sensitively Always true Constant
location_is_compared_case_and_space_insensitively Always true, and the opposite of how next_hop_type behaves Constant
the_virtual_appliance_next_hop_requirement_is_not_checked_by_the_provider Always true, and the reason this module checks it Constant
azure_never_validates_that_a_next_hop_is_reachable Always true Constant
name_resource_group_and_location_are_force_new Always true Constant
routes_tags_and_propagation_update_in_place Always true, and the useful counterpart to the force-new fields Constant
recreating_a_route_briefly_removes_it_from_the_data_path Always true Constant
routes_carry_no_tags_of_their_own Always true Constant
the_route_quota_is_a_subscription_limit_this_module_cannot_see Always true Constant
accepts_no_credential Always true Constant

No secret is emitted.

Provider gotchas

  • Changing name, resource_group_name, or location forces replacement.
  • Managing routes here and inline on the table causes perpetual diffs — this module owns the routes.
  • A VirtualAppliance route requires next_hop_in_ip_address, and the field is illegal on any other hop type. This module validates both at parse time; the provider defers both to apply.
  • bgp_route_propagation_enabled = false can black-hole ExpressRoute/VPN routes if no explicit path exists.

Design decisions

  • Per this module suite's composite-module convention, the keystone is named this and routes use for_each over a keyed map so a route rename never re-creates an unrelated route.
  • Per this suite's secure-by-default convention, no custom route is added by default; egress control (for example forcing 0.0.0.0/0 through a firewall) is an explicit opt-in.
  • These are this module suite's conventions; all argument facts are confirmed against the live provider schema.