feat: add express route gateway support

README.md

@@ -33,6 +33,7 @@ End-to-end testing is not conducted on these modules, as they are individual com
 - site to site vpn capabilities for secure connectivity between networks
 - point to site vpn support for secure client access to virtual hub
 - nat rules support for address translation on vpn gateways
+- expressroute gateway enablement on virtual hubs for hybrid connectivity
 
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
@@ -52,6 +53,7 @@ End-to-end testing is not conducted on these modules, as they are individual com
 
 | Name | Type |
 |------|------|
+| [azurerm_express_route_gateway.er_gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/express_route_gateway) | resource |
 | [azurerm_point_to_site_vpn_gateway.p2s_gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/point_to_site_vpn_gateway) | resource |
 | [azurerm_virtual_hub.vhub](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_hub) | resource |
 | [azurerm_virtual_hub_security_partner_provider.spp](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_hub_security_partner_provider) | resource |

examples/er-gateway/README.md

@@ -0,0 +1,23 @@
+# ER Gateway
+
+This enables a express route gateway on a virtual hub
+
+## Types
+
+```hcl
+vwan = object({
+  name                           = string
+  allow_branch_to_branch_traffic = optional(bool, true)
+  disable_vpn_encryption         = optional(bool, false)
+
+  vhubs = optional(map(object({
+    location       = string
+    address_prefix = string
+
+    express_route_gateway = optional(object({
+      name        = optional(string)
+      scale_units = number
+    }))
+  })))
+})
+```

examples/er-gateway/main.tf

@@ -0,0 +1,60 @@
+module "naming" {
+  source  = "cloudnationhq/naming/azure"
+  version = "~> 0.1"
+
+  suffix = ["demo", "dev"]
+}
+
+module "rg" {
+  source  = "cloudnationhq/rg/azure"
+  version = "~> 2.0"
+
+  groups = {
+    demo = {
+      name     = module.naming.resource_group.name_unique
+      location = "westeurope"
+    }
+  }
+}
+
+module "vwan" {
+  source  = "cloudnationhq/vwan/azure"
+  version = "~> 3.0"
+
+  naming         = local.naming
+  location       = module.rg.groups.demo.location
+  resource_group = module.rg.groups.demo.name
+
+  vwan = {
+    name                           = module.naming.virtual_wan.name
+    allow_branch_to_branch_traffic = true
+    disable_vpn_encryption         = false
+    vhubs = {
+      weu = {
+        location       = "westeurope"
+        address_prefix = "10.0.0.0/23"
+        express_route_gateway = {
+          scale_units = 1
+        }
+      }
+    }
+  }
+}
+
+module "firewall" {
+  source  = "cloudnationhq/fw/azure"
+  version = "~> 2.0"
+
+  resource_group = module.rg.groups.demo.name
+
+  instance = {
+    name     = module.naming.firewall.name
+    location = module.rg.groups.demo.location
+
+    sku_name = "AZFW_Hub"
+    sku_tier = "Standard"
+    virtual_hub = {
+      virtual_hub_id = module.vwan.vhubs.weu.id
+    }
+  }
+}

examples/er-gateway/naming.tf

@@ -0,0 +1,8 @@
+locals {
+  naming = {
+    # lookup outputs to have consistent naming
+    for type in local.naming_types : type => lookup(module.naming, type).name
+  }
+
+  naming_types = ["virtual_hub", "express_route_gateway"]
+}

examples/er-gateway/terraform.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = "~> 1.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 4.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+}

main.tf

@@ -30,7 +30,9 @@ resource "azurerm_virtual_hub" "vhub" {
 resource "azurerm_vpn_server_configuration" "p2s_config" {
   for_each = {
     for k, v in lookup(var.vwan, "vhubs", {}) : k => v
-    if lookup(v, "point_to_site_vpn", null) != null
+    if lookup(
+      v, "point_to_site_vpn", null
+    ) != null
   }
 
   name                     = try(each.value.point_to_site_vpn.vpn_server_configuration_name, "p2s-vpn-config-${each.key}")
@@ -76,7 +78,9 @@ resource "azurerm_vpn_server_configuration" "p2s_config" {
 resource "azurerm_point_to_site_vpn_gateway" "p2s_gateway" {
   for_each = {
     for k, v in lookup(var.vwan, "vhubs", {}) : k => v
-    if lookup(v, "point_to_site_vpn", null) != null
+    if lookup(
+      v, "point_to_site_vpn", null
+    ) != null
   }
 
   name                                = try(each.value.name, join("-", [var.naming.point_to_site_vpn_gateway, each.key]))
@@ -103,7 +107,9 @@ resource "azurerm_point_to_site_vpn_gateway" "p2s_gateway" {
 resource "azurerm_vpn_gateway" "vpn_gateway" {
   for_each = {
     for k, v in lookup(var.vwan, "vhubs", {}) : k => v
-    if lookup(v, "site_to_site_vpn", null) != null
+    if lookup(
+      v, "site_to_site_vpn", null
+    ) != null
   }
   name                = lookup(each.value.site_to_site_vpn, "name", null)
   resource_group_name = coalesce(lookup(var.vwan, "resource_group", null), var.resource_group)
@@ -232,11 +238,31 @@ resource "azurerm_vpn_gateway_nat_rule" "nat_rule" {
   }
 }
 
+# express route gateway
+resource "azurerm_express_route_gateway" "er_gateway" {
+  for_each = {
+    for k, v in lookup(var.vwan, "vhubs", {}) : k => v
+    if lookup(
+      v, "express_route_gateway", null
+    ) != null
+  }
+
+  name                          = try(each.value.express_route_gateway.name, join("-", [var.naming.express_route_gateway, each.key]))
+  resource_group_name           = coalesce(lookup(var.vwan, "resource_group", null), var.resource_group)
+  location                      = coalesce(lookup(each.value, "location", null), var.location)
+  virtual_hub_id                = azurerm_virtual_hub.vhub[each.key].id
+  scale_units                   = each.value.express_route_gateway.scale_units
+  allow_non_virtual_wan_traffic = try(each.value.express_route_gateway.allow_non_virtual_wan_traffic, false)
+  tags                          = try(each.value.tags, var.tags)
+}
+
 # security partner provider
 resource "azurerm_virtual_hub_security_partner_provider" "spp" {
   for_each = {
     for k, v in lookup(var.vwan, "vhubs", {}) : k => v
-    if lookup(v, "security_partner_provider", null) != null
+    if lookup(
+      v, "security_partner_provider", null
+    ) != null
   }
 
   name                   = each.value.security_partner_provider.name