Skip to content

Commit 5168088

Browse files
donovm4jaredfholgate
donovm4
and
jaredfholgate
authored
bugfix: deployment slots sensitivity issue (#257)
* adding new example and new variable to help handle sensitive values * running pre-commit scripts * adding logic for empty slot app settings * running pre-commit script * refactor slot app settings * fix locals * fix typo --------- Co-authored-by: Jared Holgate <jaredholgate@microsoft.com>
1 parent bc4aee0 commit 5168088

14 files changed

Lines changed: 531 additions & 32 deletions

File tree

‎README.md‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -946,7 +946,6 @@ Type:
946946
```hcl
947947
map(object({
948948
name = optional(string)
949-
app_settings = optional(map(string))
950949
builtin_logging_enabled = optional(bool, true)
951950
content_share_force_disabled = optional(bool, false)
952951
client_affinity_enabled = optional(bool, false)
@@ -1352,15 +1351,7 @@ map(object({
13521351
virtual_path = optional(string)
13531352
})), {})
13541353
virtual_path = optional(string, "/")
1355-
})),
1356-
{
1357-
default = {
1358-
physical_path = "site\\wwwroot"
1359-
preload_enabled = false
1360-
virtual_path = "/"
1361-
}
1362-
}
1363-
)
1354+
})), {})
13641355
}), {})
13651356
13661357
timeouts = optional(object({
@@ -1947,6 +1938,14 @@ object({
19471938

19481939
Default: `{}`
19491940

1941+
### <a name="input_slot_app_settings"></a> [slot\_app\_settings](#input\_slot\_app\_settings)
1942+
1943+
Description: A map of app settings to apply to the deployment slot(s). The key MUST be the same key as the slot key, and the value is a map of app setting key-value pairs.
1944+
1945+
Type: `map(map(string))`
1946+
1947+
Default: `{}`
1948+
19501949
### <a name="input_slot_application_insights"></a> [slot\_application\_insights](#input\_slot\_application\_insights)
19511950

19521951
Description: Configures the Application Insights instance(s) for the deployment slot(s).

‎examples/deployment_slots_with_sensitive_values/.e2eignore‎

Whitespace-only changes.

‎examples/deployment_slots_with_sensitive_values/README.md‎

Lines changed: 259 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,259 @@
1+
<!-- BEGIN_TF_DOCS -->
2+
<!-- Code generated by terraform-docs. DO NOT EDIT. -->
3+
# Deployment slots with sensitive values example
4+
5+
This deploys the module utilizing app service slot capabilities with sensitive values.
6+
7+
```hcl
8+
## Section to provide a random Azure region for the resource group
9+
# This allows us to randomize the region for the resource group.
10+
module "regions" {
11+
source = "Azure/regions/azurerm"
12+
version = "0.8.0"
13+
}
14+
15+
# This allows us to randomize the region for the resource group.
16+
resource "random_integer" "region_index" {
17+
max = length(local.azure_regions) - 1
18+
min = 0
19+
}
20+
## End of section to provide a random Azure region for the resource group
21+
22+
# This ensures we have unique CAF compliant names for our resources.
23+
module "naming" {
24+
source = "Azure/naming/azurerm"
25+
version = "0.4.2"
26+
}
27+
28+
resource "azurerm_resource_group" "example" {
29+
location = local.azure_regions[random_integer.region_index.result]
30+
name = module.naming.resource_group.name_unique
31+
}
32+
33+
resource "azurerm_service_plan" "example" {
34+
location = azurerm_resource_group.example.location
35+
name = module.naming.app_service_plan.name_unique
36+
os_type = "Windows"
37+
resource_group_name = azurerm_resource_group.example.name
38+
sku_name = "P1v2"
39+
tags = {
40+
example = "deployment-slots-sensitive"
41+
}
42+
}
43+
44+
# resource "azurerm_storage_account" "example" {
45+
# account_replication_type = "LRS"
46+
# account_tier = "Standard"
47+
# location = azurerm_resource_group.example.location
48+
# name = "${module.naming.storage_account.name_unique}sens"
49+
# resource_group_name = azurerm_resource_group.example.name
50+
51+
# network_rules {
52+
# default_action = "Allow"
53+
# bypass = ["AzureServices"]
54+
# }
55+
# tags = {
56+
# SecurityControl = "Ignore"
57+
# }
58+
# }
59+
60+
# This is the module call with deployment slots containing sensitive values
61+
module "avm_res_web_site" {
62+
source = "../.."
63+
64+
kind = "webapp"
65+
location = azurerm_resource_group.example.location
66+
name = module.naming.app_service.name_unique
67+
os_type = "Windows"
68+
resource_group_name = azurerm_resource_group.example.name
69+
service_plan_resource_id = azurerm_service_plan.example.id
70+
# Deployment slots with SENSITIVE values
71+
deployment_slots = {
72+
test = {
73+
name = "test"
74+
site_config = {
75+
always_on = true
76+
application_stack = {
77+
dotnet = {
78+
current_stack = "dotnet"
79+
dotnet_version = "v8.0"
80+
use_custom_runtime = false
81+
use_dotnet_isolated_runtime = true
82+
}
83+
}
84+
}
85+
}
86+
staging = {
87+
name = "staging"
88+
site_config = {
89+
always_on = true
90+
application_stack = {
91+
dotnet = {
92+
current_stack = "dotnet"
93+
dotnet_version = "v8.0"
94+
use_custom_runtime = false
95+
use_dotnet_isolated_runtime = true
96+
}
97+
}
98+
}
99+
}
100+
production = {
101+
name = "prod"
102+
site_config = {
103+
always_on = true
104+
application_stack = {
105+
dotnet = {
106+
current_stack = "dotnet"
107+
dotnet_version = "v8.0"
108+
use_custom_runtime = false
109+
use_dotnet_isolated_runtime = true
110+
}
111+
}
112+
}
113+
}
114+
}
115+
enable_telemetry = var.enable_telemetry
116+
site_config = {
117+
application_stack = {
118+
dotnet = {
119+
current_stack = "dotnet"
120+
dotnet_version = "v8.0"
121+
use_custom_runtime = false
122+
use_dotnet_isolated_runtime = true
123+
}
124+
}
125+
}
126+
slot_app_settings = {
127+
staging = {
128+
"ASPNETCORE_ENVIRONMENT" = "Staging"
129+
"DATABASE_CONNECTION_STRING" = var.staging_database_connection_string
130+
"THIRD_PARTY_API_KEY" = var.staging_api_key
131+
"LOG_LEVEL" = "Debug"
132+
"FEATURE_FLAG_NEW_UI" = "true"
133+
}
134+
production = {
135+
"ASPNETCORE_ENVIRONMENT" = "Production"
136+
"DATABASE_CONNECTION_STRING" = var.production_database_connection_string
137+
"THIRD_PARTY_API_KEY" = var.production_api_key
138+
"STORAGE_CONNECTION_STRING" = var.production_storage_key
139+
"LOG_LEVEL" = "Warning"
140+
"FEATURE_FLAG_NEW_UI" = "false"
141+
}
142+
}
143+
tags = {
144+
example = "deployment-slots-with-sensitive-values"
145+
environment = "demo"
146+
SecurityControl = "Ignore"
147+
}
148+
}
149+
```
150+
151+
<!-- markdownlint-disable MD033 -->
152+
## Requirements
153+
154+
The following requirements are needed by this module:
155+
156+
- <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) (~> 1.9)
157+
158+
- <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) (~> 4.0)
159+
160+
- <a name="requirement_random"></a> [random](#requirement\_random) (>= 3.5.0, < 4.0.0)
161+
162+
## Resources
163+
164+
The following resources are used by this module:
165+
166+
- [azurerm_resource_group.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) (resource)
167+
- [azurerm_service_plan.example](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/service_plan) (resource)
168+
- [random_integer.region_index](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer) (resource)
169+
170+
<!-- markdownlint-disable MD013 -->
171+
## Required Inputs
172+
173+
No required inputs.
174+
175+
## Optional Inputs
176+
177+
The following input variables are optional (have default values):
178+
179+
### <a name="input_enable_telemetry"></a> [enable\_telemetry](#input\_enable\_telemetry)
180+
181+
Description: This variable controls whether or not telemetry is enabled for the module.
182+
For more information see <https://aka.ms/avm/telemetryinfo>.
183+
If it is set to false, then no telemetry will be collected.
184+
185+
Type: `bool`
186+
187+
Default: `true`
188+
189+
### <a name="input_production_api_key"></a> [production\_api\_key](#input\_production\_api\_key)
190+
191+
Description: API key for third-party service in production (marked as sensitive)
192+
193+
Type: `string`
194+
195+
Default: `"production-api-key-def456uvw012"`
196+
197+
### <a name="input_production_database_connection_string"></a> [production\_database\_connection\_string](#input\_production\_database\_connection\_string)
198+
199+
Description: Database connection string for the production environment (marked as sensitive)
200+
201+
Type: `string`
202+
203+
Default: `"Server=tcp:prod-db.database.windows.net,1433;Database=mydb;User ID=admin;Password=Pr0duct10nP@ssw0rd!;Encrypt=true;"`
204+
205+
### <a name="input_production_storage_key"></a> [production\_storage\_key](#input\_production\_storage\_key)
206+
207+
Description: Storage account key for production (marked as sensitive)
208+
209+
Type: `string`
210+
211+
Default: `"DefaultEndpointsProtocol=https;AccountName=prodstg;AccountKey=FAKE_STORAGE_KEY_EXAMPLE_DO_NOT_USE_IN_PRODUCTION==;EndpointSuffix=core.windows.net"`
212+
213+
### <a name="input_staging_api_key"></a> [staging\_api\_key](#input\_staging\_api\_key)
214+
215+
Description: API key for third-party service in staging (marked as sensitive)
216+
217+
Type: `string`
218+
219+
Default: `"staging-api-key-abc123xyz789"`
220+
221+
### <a name="input_staging_database_connection_string"></a> [staging\_database\_connection\_string](#input\_staging\_database\_connection\_string)
222+
223+
Description: Database connection string for the staging environment (marked as sensitive)
224+
225+
Type: `string`
226+
227+
Default: `"Server=tcp:staging-db.database.windows.net,1433;Database=mydb;User ID=admin;Password=StagingP@ssw0rd!;Encrypt=true;"`
228+
229+
## Outputs
230+
231+
No outputs.
232+
233+
## Modules
234+
235+
The following Modules are called:
236+
237+
### <a name="module_avm_res_web_site"></a> [avm\_res\_web\_site](#module\_avm\_res\_web\_site)
238+
239+
Source: ../..
240+
241+
Version:
242+
243+
### <a name="module_naming"></a> [naming](#module\_naming)
244+
245+
Source: Azure/naming/azurerm
246+
247+
Version: 0.4.2
248+
249+
### <a name="module_regions"></a> [regions](#module\_regions)
250+
251+
Source: Azure/regions/azurerm
252+
253+
Version: 0.8.0
254+
255+
<!-- markdownlint-disable-next-line MD041 -->
256+
## Data Collection
257+
258+
The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
259+
<!-- END_TF_DOCS -->

‎examples/deployment_slots_with_sensitive_values/_footer.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<!-- markdownlint-disable-next-line MD041 -->
2+
## Data Collection
3+
4+
The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.

‎examples/deployment_slots_with_sensitive_values/_header.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Deployment slots with sensitive values example
2+
3+
This deploys the module utilizing app service slot capabilities with sensitive values.

‎examples/deployment_slots_with_sensitive_values/locals.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
locals {
2+
azure_regions = [
3+
"eastus"
4+
]
5+
}

0 commit comments

Comments
 (0)