This README serves as a quick start guide to deploy Zscaler Cloud Connector resources in Microsoft Azure using Terraform. To learn more about the resources created when deploying Cloud Connector with Terraform, see Deployment Templates for Zscaler Cloud Connector.
Use this repository to create the deployment resources required to deploy and operate Cloud Connector in a new or existing resource group and virtual network. The examples directory contains complete automation scripts for both greenfield/POV and brownfield/production use.
Our Deployment scripts are leveraging Terraform v1.1.9 which includes full binary and provider support for macOS M1 chips, but any Terraform version 0.13.7 should be generally supported.
- provider registry.terraform.io/hashicorp/azurerm v3.116.x (minimum 3.108.x)
- provider registry.terraform.io/hashicorp/random v3.3.x
- provider registry.terraform.io/hashicorp/local v2.2.x
- provider registry.terraform.io/hashicorp/null v3.1.x
- provider registry.terraform.io/providers/hashicorp/tls v3.4.x
- Azure Subscription Id link to Azure subscriptions
- Have/Create a Service Principal. See: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal). Then Collect:
- Application (client) ID
- Directory (tenant) ID
- Client Secret Value
- Azure Region (e.g. westus2) where Cloud Connector resources are to be deployed
- User-created Azure Managed Identity. Role Assignment: Network Contributor (If using a Custom Role, the minimum requirement is: Microsoft. Network/networkInterfaces/read) Scope: Subscription or Resource Group (where Cloud Connector VMs will be deployed)
- Azure Vault URL with Zscaler Cloud Connector Credentials (E.g. https://zscaler-cc-demo.vault.azure.net) Add an access policy to the above Key Vault as below
- Secret Permissions: Get, List
- Select Principal: The Managed Identity created in the above step
- Accept the Cloud Connector VM image terms for the Subscription(s) where Cloud Connector is to be deployed. This can be done via the Azure Portal, Cloud Shell or az cli / powershell with a valid admin user/service principal in the correct subscription where Cloud Connector is being deployed Run Command:
az vm image terms accept --urn zscaler1579058425289:zia_cloud_connector:zs_ser_gen1_cc_01:latest
- If executing Terraform via the "zsec" wrapper bash script, it is advised that you run from a MacOS or Linux workstation. Minimum installed application requirements to successfully from the script are:
- bash | curl | unzip | rm | cp | find | grep | sed | dig | jq (for vmss manual_sync script)
These can all be installed via your distribution app installer. ie: sudo apt install bash curl unzip
- A valid Zscaler Cloud Connector provisioning URL generated. This is done via the Cloud Connector portal (E.g. connector..net/login)
- Zscaler Cloud Connector Credentials (api key, username, password) are stored in Azure Key Vault from step 5.
To enable host encryption. You must subscribe to the feature on your azure account. Official Microsoft Documentation on how to enable this feature can be found here
Use this if you are building an entire cluster from the ground up. These templates include a bastion host and test workloads and are designed for greenfield/POV testing. See Modules for the Terraform configurations for greenfield deployment.
bash
cd examples
Optional: Edit the terraform.tfvars file under your desired deployment type (ie: base_1cc) to setup your Cloud Connector (Details are documented inside the file)
- ./zsec up
- enter "1" for greenfield
- enter <desired deployment type>
- follow prompts for any additional configuration inputs. *keep in mind, any modifications done to terraform.tfvars first will override any inputs from the zsec script*
- script will detect client operating system and download/run a specific version of terraform in a temporary bin directory
- inputs will be validated and terraform init/apply will automatically exectute.
- verify all resources that will be created/modified and enter "yes" to confirm
Use the Starter Deployment Template to deploy your Cloud Connector in a new resource group and virtual network.
Use the Starter Deployment Template with ZPA to deploy your Cloud Connector in a new resource group and virtual network with Azure Private DNS Resolver capability.
Use the Starter Deployment Template with Load Balancer to deploy your Cloud Connector in a new resource group and virtual network and to load balance traffic across multiple Cloud Connectors. Zscaler's recommended deployment method is Azure Standard Load Balancer. Azure Load Balancer distributes traffic across multiple Cloud Connectors and achieves high availability.
Use the Starter Deployment Template with Load Balancer and ZPA to deploy your Cloud Connector in a new resource group and virtual network and to load balance traffic across multiple Cloud Connectors with Azure Private DNS Resolver capability. Zscaler's recommended deployment method is Azure Standard Load Balancer. Azure Load Balancer distributes traffic across multiple Cloud Connectors and achieves high availability.
Use the Starter Deployment Template with VMSS to deploy your Cloud Connectors in a new resource group and virtual network to load balance traffic across multiple Cloud Connectors. Zscaler's recommended deployment method is Azure Standard Load Balancer. Azure Load Balancer distributes traffic across multiple Cloud Connectors and achieves high availability. For added resiliency and elasticity, Cloud Connectors are deployed in Virtual Machine Scale Sets (VMSS) with accompanying Zscaler Function App packaged zip file.
Use the Starter Deployment Template with VMSS to deploy your Cloud Connectors in a new resource group and virtual network to load balance traffic across multiple Cloud Connectors with Azure Private DNS Resolver capability. Zscaler's recommended deployment method is Azure Standard Load Balancer. Azure Load Balancer distributes traffic across multiple Cloud Connectors and achieves high availability. For added resiliency and elasticity, Cloud Connectors are deployed in Virtual Machine Scale Sets (VMSS) with accompanying Zscaler Function App packaged zip file.
Use the Starter Deployment Template with Gateway Load Balancer to deploy your Cloud Connectors in a new resource group and virtual network with an Azure Gateway Load Balancer for transparent inline traffic inspection.
Use the Starter Deployment Template with Gateway Load Balancer and VMSS to deploy your Cloud Connectors in a new resource group and virtual network with an Azure Gateway Load Balancer and Virtual Machine Scale Sets for auto-scaling inline traffic inspection.
Use the Starter Deployment Template with Public Load Balancer to deploy your Cloud Connectors in a new resource group and virtual network fronted by an Azure Standard Public Load Balancer for inbound traffic distribution (e.g. fwd ZIA DNAT use cases).
Use the Starter Deployment Template with Public Load Balancer and VMSS to deploy your Cloud Connectors in a new resource group and virtual network fronted by an Azure Standard Public Load Balancer with Virtual Machine Scale Sets for elastic inbound traffic handling.
Brownfield deployment templates are most applicable for production deployments and have more customization options than a "base" deployment. They also do not include a bastion or workload hosts deployed. See Modules for the Terraform configurations for brownfield deployment.
bash
cd examples
Optional: Edit the terraform.tfvars file under your desired deployment type (ie: cc_lb) to setup your Cloud Connector (Details are documented inside the file)
- ./zsec up
- enter "2" for brownfield
- enter <desired deployment type>
- follow prompts for any additional configuration inputs. *keep in mind, any modifications done to terraform.tfvars first will override any inputs from the zsec script*
- script will detect client operating system and download/run a specific version of terraform in a temporary bin directory
- inputs will be validated and terraform init/apply will automatically exectute.
- verify all resources that will be created/modified and enter "yes" to confirm
Brownfield Deployment Types
Deployment Type: (cc_lb | cc_vmss | cc_gwlb | cc_gwlb_vmss):
Use the Custom Deployment template with Azure Load Balancer to deploy your Cloud Connector in a new or existing VNet and load balance traffic across multiple Cloud Connectors. Zscaler's recommended deployment method is Azure Load Balancer. Azure Load Balancer distributes traffic across multiple Cloud Connectors and achieves high availability. Optional Azure Private DNS Resolver resource creation per variable zpa_enabled.
Use the Custom Deployment template with Virtual Machine Scale Sets (VMSS) to deploy your Cloud Connectors in a new or existing VNet and load balance traffic across multiple Cloud Connectors. Zscaler's recommended deployment method is Azure Load Balancer. Azure Load Balancer distributes traffic across multiple Cloud Connectors and achieves high availability. For added resiliency and elasticity, Cloud Connectors are deployed in Virtual Machine Scale Sets (VMSS) with accompanying Zscaler Function App packaged zip file. Optional Azure Private DNS Resolver resource creation per variable zpa_enabled.
Use the Custom Deployment template with Gateway Load Balancer to deploy your Cloud Connectors in a new or existing VNet with an Azure Gateway Load Balancer for transparent inline traffic inspection.
Use the Custom Deployment template with Gateway Load Balancer and VMSS to deploy your Cloud Connectors in a new or existing VNet with an Azure Gateway Load Balancer and Virtual Machine Scale Sets for transparent inline traffic inspection with auto-scaling.
Brownfield deployment types provide numerous customization options within terraform.tfvars to enable/disable bring-your-own resources for Cloud Connector deployment in existing environments. Custom paramaters include: BYO existing Resource Group, PIPs, NAT Gateways and associations, VNet, and subnets. Optional Azure Private DNS Resolver resource creation per variable zpa_enabled. The number of Cloud Connector VMs or Virtual Machine Scale Sets, Cloud Connector subnets, NAT Gateways, and Public IPs can vary based on if zones support is enabled and the amount of zone redundancy chosen.
3. Standalone Deployments
(These templates are most applicable for custom/specialized deployment configurations). No Cloud Connector resources are provisioned with this template as the dependency of this feature assumes the resources already exist.
bash
cd examples
Optional: Edit the terraform.tfvars file under your desired deployment type (ie: ztags_standalone) to manually set variable values (Details are documented inside the file)
- ./zsec up
- enter "3" for standalone ztags enablement
- follow prompts for any additional configuration inputs. *keep in mind, any modifications done to terraform.tfvars first will override any inputs from the zsec script*
- script will detect client operating system and download/run a specific version of terraform in a temporary bin directory
- inputs will be validated and terraform init/apply will automatically exectute.
- verify all resources that will be created/modified and enter "yes" to confirm
Standalone Deployment Types
Deployment Type: (ztags_standalone):
**ztags_standalone** - Creates a new Resource Group (or use an existing); Event Grid System Topic; and PartnerDestination Event Subscription for Zscaler Tag Discovery Service automation