Skip to content

Manual Test Runbook — N2: Azure Firewall Premium Policy Module

Owner: Sagar  |  Time: ~5 min (Parts A + B offline) · +30 min (optional Part C integration)  |  Sandbox: snowops-sandbox-01

Promotes N2 (modules/azure/firewall-premium-policy/) from 🟦 Code Complete → 🟩 Shipped. Part C (the integration test) creates a Premium firewall policy, attaches it to a Premium-SKU Azure Firewall, and verifies IDPS is active. Requires a Premium firewall (F2 with firewall.sku_tier = "Premium", or a pre-created one). TLS-inspection verification additionally needs a Key Vault intermediate CA cert and a managed identity (see the N2 README prerequisite).

Prerequisites

  • Sandbox subscription access active (PIM activated if required)
  • az login done; az account show confirms the sandbox subscription is selected
  • SNOWOPS_SANDBOX_SUBSCRIPTION_ID + SNOWOPS_SANDBOX_TENANT_ID exported
  • Local tooling: terraform >= 1.6, go >= 1.22, az CLI >= 2.50
  • Working directory: repo root

Steps

Part A — terraform fmt + validate (offline, ~3 min)

  1. Module + example:
terraform -chdir=modules/azure/firewall-premium-policy fmt -recursive -check
terraform -chdir=modules/azure/firewall-premium-policy init -backend=false -input=false
terraform -chdir=modules/azure/firewall-premium-policy validate

terraform -chdir=modules/azure/firewall-premium-policy/examples/basic init -backend=false -input=false
terraform -chdir=modules/azure/firewall-premium-policy/examples/basic validate

Expected: Success! The configuration is valid. for both.

  1. Offline Terratest case:
cd tests/terratest
go test -v -timeout 5m ./modules/azure/... -run TestFirewallPremiumPolicyValidate

Expected: PASS.

Part B — full Terratest suite (offline, ~3 min)

  1. bash cd tests/terratest go test -count=1 -timeout 15m ./...

Expected: full offline suite green.

Part C — integration test: Premium policy apply/attach/destroy (sandbox, ~30 min)

Proves the Premium policy applies, IDPS is configured, and (optionally) TLS inspection works. Requires a Premium-SKU Azure Firewall in the sandbox. Cost: a running Premium firewall is ~$1.75/hr — destroy promptly.

  1. Apply the example policy (TLS inspection disabled — no Key Vault needed):
cd modules/azure/firewall-premium-policy/examples/basic
terraform init -input=false
terraform apply -auto-approve \
  -var "subscription_id=$SNOWOPS_SANDBOX_SUBSCRIPTION_ID" \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID" \
  -var "resource_group_name=snowops-n2-test-rg" \
  -var "policy_name=snowops-n2-test-fw-premium"

(Ensure snowops-n2-test-rg exists, or create it first with az group create.)

Expected: clean apply; firewall_policy_id output is a valid ARM ID, idps_mode = "Alert".

  1. Verify the policy is Premium with IDPS configured:
az network firewall policy show \
  -g snowops-n2-test-rg \
  -n snowops-n2-test-fw-premium \
  --query "{sku:sku.tier, threatIntel:threatIntelMode, idps:intrusionDetection.mode, dnsProxy:dnsSettings.enableProxy}" \
  -o json

Expected: sku = "Premium", idps = "Alert", dnsProxy = true.

  1. Attach the policy to a Premium firewall (skip if no Premium firewall is available in the sandbox):
az network firewall update \
  -g <FW_RG> -n <FW_NAME> \
  --firewall-policy /subscriptions/$SNOWOPS_SANDBOX_SUBSCRIPTION_ID/resourceGroups/snowops-n2-test-rg/providers/Microsoft.Network/firewallPolicies/snowops-n2-test-fw-premium

Then send traffic matching an IDPS signature from a spoke and confirm an alert appears in the firewall's AzureFirewallNetworkRule / IDPS logs (J1 workspace).

  1. (Optional) TLS inspection: enable it on a separate apply with a Key Vault intermediate CA cert + managed identity wired (see N2 README prerequisite), set terminate_tls = true on an HTTPS application rule, and confirm the firewall presents its minted cert for the inspected FQDN.

Pass criteria

  • Part A — module + example validate; TestFirewallPremiumPolicyValidate passes
  • Part B — full offline Terratest suite passes
  • (Part C) Policy applies cleanly; sku = Premium, IDPS mode visible in az output
  • (Part C) If attached: IDPS alerts appear for signature-matching traffic
  • (Part C, optional) TLS-inspected HTTPS presents the firewall's intermediate-CA-minted cert
  • All test resources removed

Teardown

cd modules/azure/firewall-premium-policy/examples/basic
terraform destroy -auto-approve \
  -var "subscription_id=$SNOWOPS_SANDBOX_SUBSCRIPTION_ID" \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID" \
  -var "resource_group_name=snowops-n2-test-rg"

Detach the policy from the firewall first (az network firewall update --firewall-policy "" or delete the firewall) if it was attached in step 6.

Sign-off

  • Tester: _  |  Date: _  |  Result: PASS / FAIL / N/A
  • Notes: