Skip to content

Commit d6f5c95

Browse files
kumarvnakumarvna
committed
Adding custom manged key and Vnet rules
1 parent 5301333 commit d6f5c95

File tree

6 files changed

+257
-19
lines changed

6 files changed

+257
-19
lines changed

‎README.md‎

Lines changed: 99 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,99 @@
1-
# terraform-azurerm-postgresql-db
1+
# Azure Database for PostgreSQL Terraform Module
2+
3+
Azure Database for MySQL is easy to set up, manage and scale. It automates the management and maintenance of your infrastructure and database server, including routine updates, backups and security. Enjoy maximum control of database management with custom maintenance windows and multiple configuration parameters for fine grained tuning with Flexible Server (Preview).
4+
5+
## Resources are supported
6+
7+
* [MySQL Servers](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server)
8+
* [MySQL Database](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_database)
9+
* [MySQL Configuration](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_configuration)
10+
* [MySQL Firewall Rules](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_firewall_rule)
11+
* [MySQL Active Directory Administrator](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_active_directory_administrator)
12+
* [MySQL Customer Managed Key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_server_key)
13+
* [MySQL Virtual Network Rule](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mysql_virtual_network_rule)
14+
* [MySQL Diagnostics](https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal)
15+
* [Private Endpoints](https://www.terraform.io/docs/providers/azurerm/r/private_endpoint.html)
16+
* [Private DNS zone for `privatelink` A records](https://www.terraform.io/docs/providers/azurerm/r/private_dns_zone.html)
17+
18+
```terraform
19+
module "postgresql-db" {
20+
source = "kumarvna/postgresql-db/azurerm"
21+
version = "1.0.0"
22+
23+
# By default, this module will create a resource group
24+
# proivde a name to use an existing resource group and set the argument
25+
# to `create_resource_group = false` if you want to existing resoruce group.
26+
# If you use existing resrouce group location will be the same as existing RG.
27+
create_resource_group = false
28+
resource_group_name = "rg-shared-westeurope-01"
29+
location = "westeurope"
30+
31+
# MySQL Server and Database settings
32+
postgresql_server_name = "mypostgresdbsrv01"
33+
34+
postgresql_server_settings = {
35+
sku_name = "GP_Gen5_8"
36+
storage_mb = 640000
37+
version = "9.6"
38+
# default admin user `sqladmin` and can be specified as per the choice here
39+
# by default random password created by this module. required password can be specified here
40+
admin_username = "postgresadmin"
41+
admin_password = "H@Sh1CoR3!"
42+
# Database name, charset and collection arguments
43+
database_name = "demo-postgres-db"
44+
charset = "UTF8"
45+
collation = "English_United States.1252"
46+
# Storage Profile and other optional arguments
47+
auto_grow_enabled = true
48+
backup_retention_days = 7
49+
geo_redundant_backup_enabled = true
50+
public_network_access_enabled = true
51+
ssl_enforcement_enabled = true
52+
ssl_minimal_tls_version_enforced = "TLS1_2"
53+
}
54+
55+
# PostgreSQL Server Parameters
56+
# For more information: https://bit.ly/3dbYTtB
57+
postgresql_configuration = {
58+
backslash_quote = "on"
59+
}
60+
61+
# Use Virtual Network service endpoints and rules for Azure Database for MySQL
62+
subnet_id = var.subnet_id
63+
64+
# The URL to a Key Vault custom managed key
65+
key_vault_key_id = var.key_vault_key_id
66+
67+
# To enable Azure Defender for database set `enable_threat_detection_policy` to true
68+
enable_threat_detection_policy = true
69+
log_retention_days = 30
70+
email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"]
71+
72+
# AD administrator for an Azure MySQL server
73+
# Allows you to set a user or group as the AD administrator for an Azure SQL server
74+
ad_admin_login_name = "firstname.lastname@example.com"
75+
76+
# (Optional) To enable Azure Monitoring for Azure MySQL database
77+
# (Optional) Specify `storage_account_name` to save monitoring logs to storage.
78+
//log_analytics_workspace_name = "loganalytics-we-sharedtest2"
79+
80+
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
81+
firewall_rules = {
82+
access-to-azure = {
83+
start_ip_address = "0.0.0.0"
84+
end_ip_address = "0.0.0.0"
85+
},
86+
desktop-ip = {
87+
start_ip_address = "49.204.228.223"
88+
end_ip_address = "49.204.228.223"
89+
}
90+
}
91+
92+
# Tags for Azure Resources
93+
tags = {
94+
Terraform = "true"
95+
Environment = "dev"
96+
Owner = "test-user"
97+
}
98+
}
99+
```

‎examples/PostgreSQL_Server/README.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# Azure Database for MySQL Terraform Module
2+
3+
Azure Database for MySQL is easy to set up, manage and scale. It automates the management and maintenance of your infrastructure and database server, including routine updates, backups and security. Enjoy maximum control of database management with custom maintenance windows and multiple configuration parameters for fine grained tuning with Flexible Server (Preview).
4+
5+
## Module Usage
6+
7+
```hcl
8+
module "postgresql-db" {
9+
source = "kumarvna/postgresql-db/azurerm"
10+
version = "1.0.0"
11+
12+
# By default, this module will create a resource group
13+
# proivde a name to use an existing resource group and set the argument
14+
# to `create_resource_group = false` if you want to existing resoruce group.
15+
# If you use existing resrouce group location will be the same as existing RG.
16+
create_resource_group = false
17+
resource_group_name = "rg-shared-westeurope-01"
18+
location = "westeurope"
19+
20+
# MySQL Server and Database settings
21+
postgresql_server_name = "mypostgresdbsrv01"
22+
23+
postgresql_server_settings = {
24+
sku_name = "GP_Gen5_8"
25+
storage_mb = 640000
26+
version = "9.6"
27+
# default admin user `sqladmin` and can be specified as per the choice here
28+
# by default random password created by this module. required password can be specified here
29+
admin_username = "postgresadmin"
30+
admin_password = "H@Sh1CoR3!"
31+
# Database name, charset and collection arguments
32+
database_name = "demo-postgres-db"
33+
charset = "UTF8"
34+
collation = "English_United States.1252"
35+
# Storage Profile and other optional arguments
36+
auto_grow_enabled = true
37+
backup_retention_days = 7
38+
geo_redundant_backup_enabled = true
39+
public_network_access_enabled = true
40+
ssl_enforcement_enabled = true
41+
ssl_minimal_tls_version_enforced = "TLS1_2"
42+
}
43+
44+
# PostgreSQL Server Parameters
45+
# For more information: https://bit.ly/3dbYTtB
46+
postgresql_configuration = {
47+
backslash_quote = "on"
48+
}
49+
50+
# Use Virtual Network service endpoints and rules for Azure Database for MySQL
51+
subnet_id = var.subnet_id
52+
53+
# The URL to a Key Vault custom managed key
54+
key_vault_key_id = var.key_vault_key_id
55+
56+
# To enable Azure Defender for database set `enable_threat_detection_policy` to true
57+
enable_threat_detection_policy = true
58+
log_retention_days = 30
59+
email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"]
60+
61+
# AD administrator for an Azure MySQL server
62+
# Allows you to set a user or group as the AD administrator for an Azure SQL server
63+
ad_admin_login_name = "firstname.lastname@example.com"
64+
65+
# (Optional) To enable Azure Monitoring for Azure MySQL database
66+
# (Optional) Specify `storage_account_name` to save monitoring logs to storage.
67+
//log_analytics_workspace_name = "loganalytics-we-sharedtest2"
68+
69+
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
70+
firewall_rules = {
71+
access-to-azure = {
72+
start_ip_address = "0.0.0.0"
73+
end_ip_address = "0.0.0.0"
74+
},
75+
desktop-ip = {
76+
start_ip_address = "49.204.228.223"
77+
end_ip_address = "49.204.228.223"
78+
}
79+
}
80+
81+
# Tags for Azure Resources
82+
tags = {
83+
Terraform = "true"
84+
Environment = "dev"
85+
Owner = "test-user"
86+
}
87+
}
88+
```
89+
90+
## Terraform Usage
91+
92+
To run this example you need to execute following Terraform commands
93+
94+
```hcl
95+
terraform init
96+
97+
terraform plan
98+
99+
terraform apply
100+
```
101+
102+
Run `terraform destroy` when you don't need these resources.

‎examples/PostgreSQL_Server/main.tf‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
module "postgresql-db" {
2-
// source = "kumarvna/postgresql-db/azurerm"
3-
// version = "1.0.0"
4-
source = "../../"
2+
source = "kumarvna/postgresql-db/azurerm"
3+
version = "1.0.0"
54

65
# By default, this module will create a resource group
76
# proivde a name to use an existing resource group and set the argument
@@ -11,7 +10,7 @@ module "postgresql-db" {
1110
resource_group_name = "rg-shared-westeurope-01"
1211
location = "westeurope"
1312

14-
# MySQL Server and Database settings
13+
# PostgreSQL Server and Database settings
1514
postgresql_server_name = "mypostgresdbsrv01"
1615

1716
postgresql_server_settings = {
@@ -40,25 +39,25 @@ module "postgresql-db" {
4039
postgresql_configuration = {
4140
backslash_quote = "on"
4241
}
43-
/*
44-
# Use Virtual Network service endpoints and rules for Azure Database for MySQL
42+
43+
# Use Virtual Network service endpoints and rules for Azure Database for PostgreSQL
4544
subnet_id = var.subnet_id
4645

4746
# The URL to a Key Vault custom managed key
4847
key_vault_key_id = var.key_vault_key_id
49-
*/
48+
5049
# To enable Azure Defender for database set `enable_threat_detection_policy` to true
5150
enable_threat_detection_policy = true
5251
log_retention_days = 30
5352
email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"]
5453

55-
# AD administrator for an Azure MySQL server
56-
# Allows you to set a user or group as the AD administrator for an Azure SQL server
54+
# AD administrator for an Azure database for PostgreSQL
55+
# Allows you to set a user or group as the AD administrator for PostgreSQL server
5756
ad_admin_login_name = "firstname.lastname@example.com"
5857

59-
# (Optional) To enable Azure Monitoring for Azure MySQL database
58+
# (Optional) To enable Azure Monitoring for Azure PostgreSQL database
6059
# (Optional) Specify `storage_account_name` to save monitoring logs to storage.
61-
//log_analytics_workspace_name = "loganalytics-we-sharedtest2"
60+
log_analytics_workspace_name = "loganalytics-we-sharedtest2"
6261

6362
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
6463
firewall_rules = {

‎examples/PostgreSQL_Server/variables.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "key_vault_key_id" {
2+
description = "The URL to a Key Vault Key"
3+
default = null
4+
}
5+
6+
variable "subnet_id" {
7+
description = "The resource ID of the subnet"
8+
default = null
9+
}

‎main.tf‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,9 +139,9 @@ resource "azurerm_postgresql_configuration" "main" {
139139
value = each.value
140140
}
141141

142-
#------------------------------------------------------------
142+
#------------------------------------------------------------------
143143
# Adding Firewall rules for PostgreSQL Server - Default is "false"
144-
#------------------------------------------------------------
144+
#------------------------------------------------------------------
145145
resource "azurerm_postgresql_firewall_rule" "main" {
146146
for_each = var.firewall_rules != null ? { for k, v in var.firewall_rules : k => v if v != null } : {}
147147
name = format("%s", each.key)
@@ -162,3 +162,24 @@ resource "azurerm_postgresql_active_directory_administrator" "main" {
162162
tenant_id = data.azurerm_client_config.current.tenant_id
163163
object_id = data.azurerm_client_config.current.object_id
164164
}
165+
166+
#-----------------------------------------------------------------------------
167+
# Manages a Customer Managed Key for a PostgreSQL Server. - Default is "false"
168+
#-----------------------------------------------------------------------------
169+
resource "azurerm_postgresql_server_key" "main" {
170+
count = var.key_vault_key_id != null ? 1 : 0
171+
server_id = azurerm_postgresql_server.main.id
172+
key_vault_key_id = var.key_vault_key_id
173+
}
174+
175+
#--------------------------------------------------------------------------------
176+
# Allowing traffic between an PostgreSQL server and a subnet - Default is "false"
177+
#--------------------------------------------------------------------------------
178+
resource "azurerm_postgresql_virtual_network_rule" "main" {
179+
count = var.subnet_id != null ? 1 : 0
180+
name = format("%s-vnet-rule", var.postgresql_server_name)
181+
resource_group_name = local.resource_group_name
182+
server_name = azurerm_postgresql_server.main.name
183+
subnet_id = var.subnet_id
184+
ignore_missing_vnet_service_endpoint = var.ignore_missing_vnet_service_endpoint
185+
}

‎variables.tf‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ variable "location" {
1313
default = ""
1414
}
1515

16-
variable "subnet_id" {
17-
description = "The resource ID of the subnet"
18-
default = ""
19-
}
20-
2116
variable "log_analytics_workspace_name" {
2217
description = "The name of log analytics workspace name"
2318
default = null
@@ -129,6 +124,20 @@ variable "ad_admin_login_name" {
129124
default = null
130125
}
131126

127+
variable "key_vault_key_id" {
128+
description = "The URL to a Key Vault Key"
129+
default = null
130+
}
131+
132+
variable "subnet_id" {
133+
description = "The resource ID of the subnet"
134+
default = null
135+
}
136+
137+
variable "ignore_missing_vnet_service_endpoint" {
138+
description = "Should the Virtual Network Rule be created before the Subnet has the Virtual Network Service Endpoint enabled?"
139+
default = false
140+
}
132141
variable "tags" {
133142
description = "A map of tags to add to all resources"
134143
type = map(string)

0 commit comments

Comments
 (0)