Skip to content

Commit f18f72b

Browse files
kumarvnakumarvna
committed
adding private link configuration and documentation
1 parent 6d2c09c commit f18f72b

File tree

10 files changed

+421
-2
lines changed

10 files changed

+421
-2
lines changed

‎README.md‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Azure Database for PostgreSQL Single Server is a fully managed database service with minimal requirements for customizations of database. The single server platform is designed to handle most of the database management functions such as patching, backups, high availability, security with minimal user configuration and control. The architecture is optimized for built-in high availability with 99.99% availability on single availability zone. It supports community version of PostgreSQL 9.5, 9,6, 10, and 11.
44

5-
## Resources are supported
5+
## Resources supported
66

77
* [PostgreSQL Server](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server)
88
* [PostgreSQL Database](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_database)
@@ -12,6 +12,8 @@ Azure Database for PostgreSQL Single Server is a fully managed database service
1212
* [PostgreSQL Customer Managed Key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_server_key)
1313
* [PostgreSQL Virtual Network Rule](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_virtual_network_rule)
1414
* [PostgreSQL Diagnostics](https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal)
15+
* [Private Endpoints](https://www.terraform.io/docs/providers/azurerm/r/private_endpoint.html)
16+
* [Private DNS zone for `privatelink` A records](https://www.terraform.io/docs/providers/azurerm/r/private_dns_zone.html)
1517

1618
```terraform
1719
module "postgresql-db" {
@@ -73,7 +75,15 @@ module "postgresql-db" {
7375
7476
# (Optional) To enable Azure Monitoring for Azure PostgreSQL database
7577
# (Optional) Specify `storage_account_name` to save monitoring logs to storage.
76-
# log_analytics_workspace_name = "loganalytics-we-sharedtest2"
78+
log_analytics_workspace_name = "loganalytics-we-sharedtest2"
79+
80+
# Creating Private Endpoint requires, VNet name and address prefix to create a subnet
81+
# By default this will create a `privatelink.mysql.database.azure.com` DNS zone.
82+
# To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name
83+
enable_private_endpoint = true
84+
virtual_network_name = "vnet-shared-hub-westeurope-001"
85+
private_subnet_address_prefix = ["10.1.5.0/29"]
86+
# existing_private_dns_zone = "demo.example.com"
7787
7888
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
7989
firewall_rules = {
@@ -228,6 +238,10 @@ An effective naming convention assembles resource names by using important resou
228238
firewall_rules|Range of IP addresses to allow firewall connections|map(object({}))|`null`
229239
`ad_admin_login_name`|The login name of the principal to set as the server administrator|string|`null`
230240
`key_vault_key_id`|The URL to a Key Vault custom managed key|string|`null`
241+
`enable_private_endpoint`|Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link|string|`"false"`
242+
`virtual_network_name` | The name of the virtual network|string|`""`
243+
`private_subnet_address_prefix`|A list of subnets address prefixes inside virtual network| list |`[]`
244+
`existing_private_dns_zone`|Name of the existing private DNS zone|string|`null`
231245
`Tags` | A map of tags to add to all resources | map | `{}`
232246

233247
## Outputs
@@ -241,6 +255,10 @@ firewall_rules|Range of IP addresses to allow firewall connections|map(object({}
241255
`postgresql_server_id`|The resource ID of the PostgreSQL Server
242256
`postgresql_server_fqdn`|The FQDN of the PostgreSQL Server
243257
`postgresql_database_id`|The ID of the PostgreSQL Database
258+
`postgresql_server_private_endpoint`|id of the PostgreSQL server Private Endpoint
259+
`postgresql_server_private_dns_zone_domain`|DNS zone name of PostgreSQL server Private endpoints dns name records
260+
`postgresql_server_private_endpoint_ip`|PostgreSQL server private endpoint IPv4 Addresses
261+
`postgresql_server_private_endpoint_fqdn`|PostgreSQL server private endpoint FQDN Addresses
244262

245263
## Resource Graph
246264

‎examples/PostgreSQL_Server/output.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
output "resource_group_name" {
2+
description = "The name of the resource group in which resources are created"
3+
value = module.postgresql-db.resource_group_name
4+
}
5+
6+
output "resource_group_location" {
7+
description = "The location of the resource group in which resources are created"
8+
value = module.postgresql-db.resource_group_location
9+
}
10+
11+
output "storage_account_id" {
12+
description = "The ID of the storage account"
13+
value = module.postgresql-db.storage_account_id
14+
}
15+
16+
output "storage_account_name" {
17+
description = "The name of the storage account"
18+
value = module.postgresql-db.storage_account_name
19+
}
20+
21+
output "postgresql_server_id" {
22+
description = "The ID of the PostgreSQL Server"
23+
value = module.postgresql-db.postgresql_server_id
24+
}
25+
26+
output "postgresql_server_fqdn" {
27+
description = "The FQDN of the PostgreSQL Server"
28+
value = module.postgresql-db.postgresql_server_fqdn
29+
}
30+
31+
output "postgresql_database_id" {
32+
description = "The ID of the PostgreSQL Database"
33+
value = module.postgresql-db.postgresql_database_id
34+
}

‎examples/postgresql_server_with_private_endpoints/README.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Azure Database for PostgreSQL Terraform Module
2+
3+
Azure Database for PostgreSQL Single Server is a fully managed database service with minimal requirements for customizations of database. The single server platform is designed to handle most of the database management functions such as patching, backups, high availability, security with minimal user configuration and control. The architecture is optimized for built-in high availability with 99.99% availability on single availability zone. It supports community version of PostgreSQL 9.5, 9,6, 10, and 11.
4+
5+
## Module Usage
6+
7+
```terraform
8+
module "postgresql-db" {
9+
source = "kumarvna/postgresql-db/azurerm"
10+
version = "1.0.0"
11+
12+
# By default, this module will create a resource group
13+
# proivde a name to use an existing resource group and set the argument
14+
# to `create_resource_group = false` if you want to existing resoruce group.
15+
# If you use existing resrouce group location will be the same as existing RG.
16+
create_resource_group = false
17+
resource_group_name = "rg-shared-westeurope-01"
18+
location = "westeurope"
19+
20+
# PostgreSQL Server and Database settings
21+
postgresql_server_name = "mypostgresdbsrv01"
22+
23+
postgresql_server_settings = {
24+
sku_name = "GP_Gen5_8"
25+
storage_mb = 640000
26+
version = "9.6"
27+
# default admin user `postgresadmin` and can be specified as per the choice here
28+
# by default random password created by this module. required password can be specified here
29+
admin_username = "postgresadmin"
30+
admin_password = "H@Sh1CoR3!"
31+
# Database name, charset and collection arguments
32+
database_name = "demo-postgres-db"
33+
charset = "UTF8"
34+
collation = "English_United States.1252"
35+
# Storage Profile and other optional arguments
36+
auto_grow_enabled = true
37+
backup_retention_days = 7
38+
geo_redundant_backup_enabled = true
39+
public_network_access_enabled = true
40+
ssl_enforcement_enabled = true
41+
ssl_minimal_tls_version_enforced = "TLS1_2"
42+
}
43+
44+
# PostgreSQL Server Parameters
45+
# For more information: https://bit.ly/3dbYTtB
46+
postgresql_configuration = {
47+
backslash_quote = "on"
48+
}
49+
50+
# Use Virtual Network service endpoints and rules for Azure Database for PostgreSQL
51+
subnet_id = var.subnet_id
52+
53+
# The URL to a Key Vault custom managed key
54+
key_vault_key_id = var.key_vault_key_id
55+
56+
# To enable Azure Defender for database set `enable_threat_detection_policy` to true
57+
enable_threat_detection_policy = true
58+
log_retention_days = 30
59+
email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"]
60+
61+
# AD administrator for an Azure database for PostgreSQL
62+
# Allows you to set a user or group as the AD administrator for PostgreSQL server
63+
ad_admin_login_name = "firstname.lastname@example.com"
64+
65+
# (Optional) To enable Azure Monitoring for Azure PostgreSQL database
66+
# (Optional) Specify `storage_account_name` to save monitoring logs to storage.
67+
log_analytics_workspace_name = "loganalytics-we-sharedtest2"
68+
69+
# Creating Private Endpoint requires, VNet name and address prefix to create a subnet
70+
# By default this will create a `privatelink.mysql.database.azure.com` DNS zone.
71+
# To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name
72+
enable_private_endpoint = true
73+
virtual_network_name = "vnet-shared-hub-westeurope-001"
74+
private_subnet_address_prefix = ["10.1.5.0/29"]
75+
# existing_private_dns_zone = "demo.example.com"
76+
77+
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
78+
firewall_rules = {
79+
access-to-azure = {
80+
start_ip_address = "0.0.0.0"
81+
end_ip_address = "0.0.0.0"
82+
},
83+
desktop-ip = {
84+
start_ip_address = "49.204.228.223"
85+
end_ip_address = "49.204.228.223"
86+
}
87+
}
88+
89+
# Tags for Azure Resources
90+
tags = {
91+
Terraform = "true"
92+
Environment = "dev"
93+
Owner = "test-user"
94+
}
95+
}
96+
```
97+
98+
## Terraform Usage
99+
100+
To run this example you need to execute following Terraform commands
101+
102+
```hcl
103+
terraform init
104+
105+
terraform plan
106+
107+
terraform apply
108+
```
109+
110+
Run `terraform destroy` when you don't need these resources.

‎examples/postgresql_server_with_private_endpoints/main.tf‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
module "postgresql-db" {
2+
source = "kumarvna/postgresql-db/azurerm"
3+
version = "1.0.0"
4+
5+
# By default, this module will create a resource group
6+
# proivde a name to use an existing resource group and set the argument
7+
# to `create_resource_group = false` if you want to existing resoruce group.
8+
# If you use existing resrouce group location will be the same as existing RG.
9+
create_resource_group = false
10+
resource_group_name = "rg-shared-westeurope-01"
11+
location = "westeurope"
12+
13+
# PostgreSQL Server and Database settings
14+
postgresql_server_name = "mypostgresdbsrv01"
15+
16+
postgresql_server_settings = {
17+
sku_name = "GP_Gen5_8"
18+
storage_mb = 640000
19+
version = "9.6"
20+
# default admin user `postgresadmin` and can be specified as per the choice here
21+
# by default random password created by this module. required password can be specified here
22+
admin_username = "postgresadmin"
23+
admin_password = "H@Sh1CoR3!"
24+
# Database name, charset and collection arguments
25+
database_name = "demo-postgres-db"
26+
charset = "UTF8"
27+
collation = "English_United States.1252"
28+
# Storage Profile and other optional arguments
29+
auto_grow_enabled = true
30+
backup_retention_days = 7
31+
geo_redundant_backup_enabled = true
32+
public_network_access_enabled = true
33+
ssl_enforcement_enabled = true
34+
ssl_minimal_tls_version_enforced = "TLS1_2"
35+
}
36+
37+
# PostgreSQL Server Parameters
38+
# For more information: https://bit.ly/3dbYTtB
39+
postgresql_configuration = {
40+
backslash_quote = "on"
41+
}
42+
43+
# Use Virtual Network service endpoints and rules for Azure Database for PostgreSQL
44+
subnet_id = var.subnet_id
45+
46+
# The URL to a Key Vault custom managed key
47+
key_vault_key_id = var.key_vault_key_id
48+
49+
# To enable Azure Defender for database set `enable_threat_detection_policy` to true
50+
enable_threat_detection_policy = true
51+
log_retention_days = 30
52+
email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"]
53+
54+
# AD administrator for an Azure database for PostgreSQL
55+
# Allows you to set a user or group as the AD administrator for PostgreSQL server
56+
ad_admin_login_name = "firstname.lastname@example.com"
57+
58+
# (Optional) To enable Azure Monitoring for Azure PostgreSQL database
59+
# (Optional) Specify `storage_account_name` to save monitoring logs to storage.
60+
log_analytics_workspace_name = "loganalytics-we-sharedtest2"
61+
62+
# Creating Private Endpoint requires, VNet name and address prefix to create a subnet
63+
# By default this will create a `privatelink.mysql.database.azure.com` DNS zone.
64+
# To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name
65+
enable_private_endpoint = true
66+
virtual_network_name = "vnet-shared-hub-westeurope-001"
67+
private_subnet_address_prefix = ["10.1.5.0/29"]
68+
# existing_private_dns_zone = "demo.example.com"
69+
70+
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
71+
firewall_rules = {
72+
access-to-azure = {
73+
start_ip_address = "0.0.0.0"
74+
end_ip_address = "0.0.0.0"
75+
},
76+
desktop-ip = {
77+
start_ip_address = "49.204.228.223"
78+
end_ip_address = "49.204.228.223"
79+
}
80+
}
81+
82+
# Tags for Azure Resources
83+
tags = {
84+
Terraform = "true"
85+
Environment = "dev"
86+
Owner = "test-user"
87+
}
88+
}

‎examples/postgresql_server_with_private_endpoints/output.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
output "resource_group_name" {
2+
description = "The name of the resource group in which resources are created"
3+
value = module.postgresql-db.resource_group_name
4+
}
5+
6+
output "resource_group_location" {
7+
description = "The location of the resource group in which resources are created"
8+
value = module.postgresql-db.resource_group_location
9+
}
10+
11+
output "storage_account_id" {
12+
description = "The ID of the storage account"
13+
value = module.postgresql-db.storage_account_id
14+
}
15+
16+
output "storage_account_name" {
17+
description = "The name of the storage account"
18+
value = module.postgresql-db.storage_account_name
19+
}
20+
21+
output "postgresql_server_id" {
22+
description = "The ID of the PostgreSQL Server"
23+
value = module.postgresql-db.postgresql_server_id
24+
}
25+
26+
output "postgresql_server_fqdn" {
27+
description = "The FQDN of the PostgreSQL Server"
28+
value = module.postgresql-db.postgresql_server_fqdn
29+
}
30+
31+
output "postgresql_database_id" {
32+
description = "The ID of the PostgreSQL Database"
33+
value = module.postgresql-db.postgresql_database_id
34+
}
35+
36+
output "postgresql_server_private_endpoint" {
37+
description = "id of the PostgreSQL server Private Endpoint"
38+
value = module.postgresql-db.postgresql_server_private_endpoint
39+
}
40+
41+
output "postgresql_server_private_dns_zone_domain" {
42+
description = "DNS zone name of PostgreSQL server Private endpoints dns name records"
43+
value = module.postgresql-db.postgresql_server_private_dns_zone_domain
44+
}
45+
46+
output "postgresql_server_private_endpoint_ip" {
47+
description = "PostgreSQL server private endpoint IPv4 Addresses "
48+
value = module.postgresql-db.postgresql_server_private_endpoint_ip
49+
}
50+
51+
output "postgresql_server_private_endpoint_fqdn" {
52+
description = "PostgreSQL server private endpoint FQDN Addresses "
53+
value = module.postgresql-db.postgresql_server_private_endpoint_fqdn
54+
}

‎examples/postgresql_server_with_private_endpoints/variables.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "key_vault_key_id" {
2+
description = "The URL to a Key Vault Key"
3+
default = null
4+
}
5+
6+
variable "subnet_id" {
7+
description = "The resource ID of the subnet"
8+
default = null
9+
}

‎graph.png‎

184 KB
Loading

0 commit comments

Comments
 (0)