feat(database): add new long_term_retention_policy_time_based_immutability and long_term_retention_policy_time_based_immutability_mode variables (#197)

Co-authored-by: Henrik Knutsen <46495473+hknutsen@users.noreply.github.com>

Author: sondresjolyst

modules/database/main.tf

@@ -60,6 +60,21 @@ resource "azurerm_mssql_database" "this" {
   }
 }
 
+resource "azapi_update_resource" "long_term_retention_policy" {
+  count = var.long_term_retention_policy_time_based_immutability == "Enabled" ? 1 : 0
+
+  type      = "Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies@2024-11-01-preview"
+  parent_id = azurerm_mssql_database.this.id
+  name      = "default"
+
+  body = {
+    properties = {
+      timeBasedImmutability     = var.long_term_retention_policy_time_based_immutability
+      timeBasedImmutabilityMode = var.long_term_retention_policy_time_based_immutability_mode
+    }
+  }
+}
+
 resource "azurerm_monitor_diagnostic_setting" "database" {
   name                       = var.diagnostic_setting_name
   target_resource_id         = azurerm_mssql_database.this.id

modules/database/variables.tf

@@ -97,6 +97,26 @@ variable "long_term_retention_policy_week_of_year" {
   default     = 1
 }
 
+variable "long_term_retention_policy_time_based_immutability" {
+  description = "Whether time based immutability backups are enabled for long-term retention policy. Value must be either 'Enabled' or 'Disabled'."
+  type        = string
+  default     = "Disabled"
+  validation {
+    condition     = var.long_term_retention_policy_time_based_immutability == "Enabled" || var.long_term_retention_policy_time_based_immutability == "Disabled"
+    error_message = "The value must be either 'Enabled' or 'Disabled'."
+  }
+}
+
+variable "long_term_retention_policy_time_based_immutability_mode" {
+  description = "The mode of time based immutability for long-term retention policy. Value must be either 'Locked' or 'Unlocked'. Only effective if long_term_retention_policy_time_based_immutability is enabled"
+  type        = string
+  default     = "Unlocked"
+  validation {
+    condition     = var.long_term_retention_policy_time_based_immutability_mode == "Locked" || var.long_term_retention_policy_time_based_immutability_mode == "Unlocked"
+    error_message = "The value must be either 'Locked' or 'Unlocked'."
+  }
+}
+
 variable "identity_ids" {
   description = "A list of user assigned identities to be assigned to this SQL database."
   type        = list(string)

modules/database/versions.tf

@@ -7,5 +7,10 @@ terraform {
       # Version 4.31.0 is required to use the "enabled_metric" argument for the "azurerm_monitor_diagnostic_setting" resource.
       version = ">= 4.31.0"
     }
+
+    azapi = {
+      source  = "azure/azapi"
+      version = ">= 2.0.0"
+    }
   }
 }