Summoners War: Sky Arena multi-cloud and firewall redesign Design and implementation

Firewall rules from a map (related public repository pf-02)

What this code does: Creates one GCP firewall rule for each entry in the rule map (var.rules) and uses the map key as the rule name. For INGRESS the ranges become sources, for EGRESS they become destinations, and use_service_accounts decides whether sources and targets are set by network tags or by service accounts. Because each rule is declared as a map entry rather than its own resource block, a policy grouped by role can be managed directly as data.

resource "google_compute_firewall" "rules" {
  for_each = var.rules

  network                 = each.value.network
  name                    = each.key
  direction               = each.value.direction
  source_ranges           = each.value.direction == "INGRESS" ? each.value.ranges : null
  destination_ranges      = each.value.direction == "EGRESS" ? each.value.ranges : null
  source_tags             = each.value.use_service_accounts || each.value.direction == "EGRESS" ? null : each.value.sources
  source_service_accounts = each.value.use_service_accounts && each.value.direction == "INGRESS" ? each.value.sources : null
  target_tags             = each.value.use_service_accounts ? null : each.value.targets
  target_service_accounts = each.value.use_service_accounts ? each.value.targets : null
  priority                = each.value.priority