Skip to content

Commit 24bc59a

Browse files
donovm4donovm4
authored
bigfix / feat: logicapp private endpoints and role assignments (#190)
* initial commit * role assignment fixes * linting fixes
1 parent 13e770b commit 24bc59a

5 files changed

Lines changed: 125 additions & 11 deletions

File tree

‎examples/logic_app/README.md‎

Lines changed: 61 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,11 +61,43 @@ resource "azurerm_storage_account" "example" {
6161
}
6262
}
6363
64+
resource "azurerm_virtual_network" "example" {
65+
address_space = ["192.168.0.0/24"]
66+
location = azurerm_resource_group.example.location
67+
name = module.naming.virtual_network.name_unique
68+
resource_group_name = azurerm_resource_group.example.name
69+
}
70+
71+
resource "azurerm_subnet" "example" {
72+
address_prefixes = ["192.168.0.0/24"]
73+
name = module.naming.subnet.name_unique
74+
resource_group_name = azurerm_resource_group.example.name
75+
virtual_network_name = azurerm_virtual_network.example.name
76+
}
77+
78+
resource "azurerm_private_dns_zone" "example" {
79+
name = local.azurerm_private_dns_zone_resource_name
80+
resource_group_name = azurerm_resource_group.example.name
81+
}
82+
83+
resource "azurerm_private_dns_zone_virtual_network_link" "example" {
84+
name = "${azurerm_virtual_network.example.name}-link"
85+
private_dns_zone_name = azurerm_private_dns_zone.example.name
86+
resource_group_name = azurerm_resource_group.example.name
87+
virtual_network_id = azurerm_virtual_network.example.id
88+
}
89+
90+
data "azurerm_client_config" "this" {}
91+
92+
data "azurerm_role_definition" "example" {
93+
name = "Contributor"
94+
}
95+
6496
module "avm_res_web_site" {
6597
source = "../../"
6698
6799
# source = "Azure/avm-res-web-site/azurerm"
68-
# version = "0.16.1"
100+
# version = "0.16.2"
69101
70102
enable_telemetry = var.enable_telemetry
71103
@@ -87,11 +119,31 @@ module "avm_res_web_site" {
87119
workspace_resource_id = azurerm_log_analytics_workspace.example.id
88120
}
89121
site_config = {
90-
always_on = false
122+
91123
}
124+
125+
role_assignments = {
126+
role_assignment_1 = {
127+
role_definition_id_or_name = data.azurerm_role_definition.example.id
128+
principal_id = data.azurerm_client_config.this.object_id
129+
}
130+
}
131+
132+
private_endpoints = {
133+
# Use of private endpoints requires Standard SKU
134+
primary = {
135+
name = "primary-interfaces"
136+
private_dns_zone_resource_ids = [azurerm_private_dns_zone.example.id]
137+
subnet_resource_id = azurerm_subnet.example.id
138+
tags = {
139+
webapp = "${module.naming.static_web_app.name_unique}-interfaces"
140+
}
141+
}
142+
}
143+
92144
tags = {
93145
module = "Azure/avm-res-web-site/azurerm"
94-
version = "0.16.1"
146+
version = "0.16.2"
95147
}
96148
97149
}
@@ -113,10 +165,16 @@ The following requirements are needed by this module:
113165
The following resources are used by this module:
114166

115167
- [azurerm_log_analytics_workspace.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/log_analytics_workspace) (resource)
168+
- [azurerm_private_dns_zone.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_dns_zone) (resource)
169+
- [azurerm_private_dns_zone_virtual_network_link.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_dns_zone_virtual_network_link) (resource)
116170
- [azurerm_resource_group.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) (resource)
117171
- [azurerm_service_plan.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/service_plan) (resource)
118172
- [azurerm_storage_account.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account) (resource)
173+
- [azurerm_subnet.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet) (resource)
174+
- [azurerm_virtual_network.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network) (resource)
119175
- [random_integer.region_index](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer) (resource)
176+
- [azurerm_client_config.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) (data source)
177+
- [azurerm_role_definition.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) (data source)
120178

121179
<!-- markdownlint-disable MD013 -->
122180
## Required Inputs

‎examples/logic_app/locals.tf‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,8 @@ locals {
33
"eastus",
44
"westus"
55
]
6-
}
6+
azurerm_private_dns_zone_resource_name = "privatelink.${local.reformatted_subdomain}"
7+
default_host_name = module.avm_res_web_site.resource_uri
8+
reformatted_subdomain = join(".", slice(local.split_subdomain, 1, length(local.split_subdomain)))
9+
split_subdomain = split(".", local.default_host_name)
10+
}

‎examples/logic_app/main.tf‎

Lines changed: 55 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,43 @@ resource "azurerm_storage_account" "example" {
5555
}
5656
}
5757

58+
resource "azurerm_virtual_network" "example" {
59+
address_space = ["192.168.0.0/24"]
60+
location = azurerm_resource_group.example.location
61+
name = module.naming.virtual_network.name_unique
62+
resource_group_name = azurerm_resource_group.example.name
63+
}
64+
65+
resource "azurerm_subnet" "example" {
66+
address_prefixes = ["192.168.0.0/24"]
67+
name = module.naming.subnet.name_unique
68+
resource_group_name = azurerm_resource_group.example.name
69+
virtual_network_name = azurerm_virtual_network.example.name
70+
}
71+
72+
resource "azurerm_private_dns_zone" "example" {
73+
name = local.azurerm_private_dns_zone_resource_name
74+
resource_group_name = azurerm_resource_group.example.name
75+
}
76+
77+
resource "azurerm_private_dns_zone_virtual_network_link" "example" {
78+
name = "${azurerm_virtual_network.example.name}-link"
79+
private_dns_zone_name = azurerm_private_dns_zone.example.name
80+
resource_group_name = azurerm_resource_group.example.name
81+
virtual_network_id = azurerm_virtual_network.example.id
82+
}
83+
84+
data "azurerm_client_config" "this" {}
85+
86+
data "azurerm_role_definition" "example" {
87+
name = "Contributor"
88+
}
89+
5890
module "avm_res_web_site" {
5991
source = "../../"
6092

6193
# source = "Azure/avm-res-web-site/azurerm"
62-
# version = "0.16.1"
94+
# version = "0.16.2"
6395

6496
enable_telemetry = var.enable_telemetry
6597

@@ -81,11 +113,31 @@ module "avm_res_web_site" {
81113
workspace_resource_id = azurerm_log_analytics_workspace.example.id
82114
}
83115
site_config = {
84-
always_on = false
116+
85117
}
118+
119+
role_assignments = {
120+
role_assignment_1 = {
121+
role_definition_id_or_name = data.azurerm_role_definition.example.id
122+
principal_id = data.azurerm_client_config.this.object_id
123+
}
124+
}
125+
126+
private_endpoints = {
127+
# Use of private endpoints requires Standard SKU
128+
primary = {
129+
name = "primary-interfaces"
130+
private_dns_zone_resource_ids = [azurerm_private_dns_zone.example.id]
131+
subnet_resource_id = azurerm_subnet.example.id
132+
tags = {
133+
webapp = "${module.naming.static_web_app.name_unique}-interfaces"
134+
}
135+
}
136+
}
137+
86138
tags = {
87139
module = "Azure/avm-res-web-site/azurerm"
88-
version = "0.16.1"
140+
version = "0.16.2"
89141
}
90142

91143
}

‎main.private_endpoints.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ resource "azurerm_private_endpoint" "this" {
1212
private_service_connection {
1313
is_manual_connection = false
1414
name = each.value.private_service_connection_name != null ? each.value.private_service_connection_name : "pse-${var.name}"
15-
private_connection_resource_id = (var.kind == "functionapp" || var.kind == "webapp") ? (var.kind == "functionapp" ? (var.function_app_uses_fc1 == true ? azurerm_function_app_flex_consumption.this[0].id : (var.os_type == "Windows" ? azurerm_windows_function_app.this[0].id : azurerm_linux_function_app.this[0].id)) : (var.os_type == "Windows" ? azurerm_windows_web_app.this[0].id : azurerm_linux_web_app.this[0].id)) : null
15+
private_connection_resource_id = (var.kind == "functionapp" || var.kind == "webapp" || var.kind == "logicapp") ? (var.kind == "functionapp" ? (var.function_app_uses_fc1 == true ? azurerm_function_app_flex_consumption.this[0].id : (var.os_type == "Windows" ? azurerm_windows_function_app.this[0].id : azurerm_linux_function_app.this[0].id)) : (var.kind == "webapp" ? (var.os_type == "Windows" ? azurerm_windows_web_app.this[0].id : azurerm_linux_web_app.this[0].id) : azurerm_logic_app_standard.this[0].id)) : null
1616
subresource_names = ["sites"]
1717
}
1818
dynamic "ip_configuration" {
@@ -48,7 +48,7 @@ resource "azurerm_private_endpoint" "this_unmanaged_dns_zone_groups" {
4848
private_service_connection {
4949
is_manual_connection = false
5050
name = each.value.private_service_connection_name != null ? each.value.private_service_connection_name : "pse-${var.name}"
51-
private_connection_resource_id = (var.kind == "functionapp" || var.kind == "webapp") ? (var.kind == "functionapp" ? (var.function_app_uses_fc1 == true ? azurerm_function_app_flex_consumption.this[0].id : (var.os_type == "Windows" ? azurerm_windows_function_app.this[0].id : azurerm_linux_function_app.this[0].id)) : (var.os_type == "Windows" ? azurerm_windows_web_app.this[0].id : azurerm_linux_web_app.this[0].id)) : null
51+
private_connection_resource_id = (var.kind == "functionapp" || var.kind == "webapp" || var.kind == "logicapp") ? (var.kind == "functionapp" ? (var.function_app_uses_fc1 == true ? azurerm_function_app_flex_consumption.this[0].id : (var.os_type == "Windows" ? azurerm_windows_function_app.this[0].id : azurerm_linux_function_app.this[0].id)) : (var.kind == "webapp" ? (var.os_type == "Windows" ? azurerm_windows_web_app.this[0].id : azurerm_linux_web_app.this[0].id) : azurerm_logic_app_standard.this[0].id)) : null
5252
subresource_names = ["sites"]
5353
}
5454
dynamic "ip_configuration" {

‎main.role_assignments.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ resource "azurerm_role_assignment" "this" {
22
for_each = var.role_assignments
33

44
principal_id = each.value.principal_id
5-
scope = (var.kind == "functionapp" || var.kind == "webapp") ? (var.kind == "functionapp" ? (var.function_app_uses_fc1 == true ? azurerm_function_app_flex_consumption.this[0].id : (var.os_type == "Windows" ? azurerm_windows_function_app.this[0].id : azurerm_linux_function_app.this[0].id)) : (var.os_type == "Windows" ? azurerm_windows_web_app.this[0].id : azurerm_linux_web_app.this[0].id)) : null
5+
scope = (var.kind == "functionapp" || var.kind == "webapp" || var.kind == "logicapp") ? (var.kind == "functionapp" ? (var.function_app_uses_fc1 == true ? azurerm_function_app_flex_consumption.this[0].id : (var.os_type == "Windows" ? azurerm_windows_function_app.this[0].id : azurerm_linux_function_app.this[0].id)) : (var.kind == "webapp" ? (var.os_type == "Windows" ? azurerm_windows_web_app.this[0].id : azurerm_linux_web_app.this[0].id) : azurerm_logic_app_standard.this[0].id)) : null
66
condition = each.value.condition
77
condition_version = each.value.condition_version
88
delegated_managed_identity_resource_id = each.value.delegated_managed_identity_resource_id
@@ -52,4 +52,4 @@ resource "azurerm_role_assignment" "slot_pe" {
5252
role_definition_id = strcontains(lower(each.value.role_assignment.role_definition_id_or_name), lower(local.role_definition_resource_substring)) ? each.value.role_assignment.role_definition_id_or_name : null
5353
role_definition_name = strcontains(lower(each.value.role_assignment.role_definition_id_or_name), lower(local.role_definition_resource_substring)) ? null : each.value.role_assignment.role_definition_id_or_name
5454
skip_service_principal_aad_check = each.value.role_assignment.skip_service_principal_aad_check
55-
}
55+
}

0 commit comments

Comments
 (0)