azfw.tf

resource "azurerm_firewall" "azfw" {
  count               = var.create_fw_public_ip && var.create_hub_fw ? 1 : 0
  name                = "${var.label}-firewall"
  location            = var.resource_group_location
  resource_group_name = local.hub_resource_group_name[0]
  sku_name            = var.sku_az_fw
  sku_tier            = var.sku_tier_az_fw
  tags                = var.tags

  dynamic "ip_configuration" {

    for_each = var.sku_az_fw == "AZFW_VNet" ? toset([1]) : toset([])
    content {
      name                 = "AzureFirewallPublicIPAddress"
      subnet_id            = azurerm_subnet.az_fw_subnet[0].id
      public_ip_address_id = azurerm_public_ip.azfw_pip[0].id
    }

  }

  dynamic "virtual_hub" {

    for_each = var.sku_az_fw == "AZFW_Hub" ? toset([1]) : toset([])
    content {
      virtual_hub_id = azurerm_virtual_network.vnet["${local.hub_network_name[0]}"].id
    }

  }

  depends_on = [azurerm_resource_group.rg, azurerm_virtual_network.vnet]

}