def create_firewall(context):
  """Creates a VPC firewall config.

  The VPC firewall config depends on the VPC network having been completely
  instantiated, so it includes a dependsOn reference to the list of resources
  generated by the network sub-template.

  Args:
      context: the DM context object.

  Returns:
      A resource instantiating the firewall.py sub-template.
  """
  return [{
    'type': 'templates/firewall.py',
    'name': 'fc-firewall',
    'properties': {
      'projectId':
        '$(ref.fc-project.projectId)',
      'network':
        '$(ref.fc-network.selfLink)',
      'dependsOn':
        '$(ref.fc-network.resourceNames)',
      'rules': [
        {
          'name': 'allow-internal',
          'description': 'Allow internal traffic on the network.',
          'allowed': [{
            'IPProtocol': 'icmp',
          }, {
            'IPProtocol': 'tcp',
            'ports': ['0-65535'],
          }, {
            'IPProtocol': 'udp',
            'ports': ['0-65535'],
          }],
          'direction': 'INGRESS',
          'sourceRanges': ['10.128.0.0/9'],
          'priority': 65534,
        },
        {
          'name': 'leonardo-ssl',
          'description': 'Allow SSL traffic from Leonardo-managed VMs.',
          'allowed': [{
            'IPProtocol': 'tcp',
            'ports': ['443'],
          }],
          'direction': 'INGRESS',
          'sourceRanges': ['0.0.0.0/0'],
          'targetTags': ['leonardo'],
        },
      ],
    },
  }]