Skip to content

Commit 784fc08

Browse files
helenakallekleivsefornes
helenakallekleiv
and
sefornes
authored
feat!: migrate to express vulnerability configuration (#192)
equinor/terraform-baseline#203 BREAKING CHANGE: remove variable `storage_account_id`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove variable `storage_blob_endpoint`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove variable `storage_container_name`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove variable `security_alert_policy_email_account_admins`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove variable `security_alert_policy_email_addresses`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove variable `vulnerability_assessment_recurring_scans_enabled`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove variable `vulnerability_assessment_recurring_scans_email_subscription_admins`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove variable `vulnerability_assessment_recurring_scans_emails`. To migrate your project, remove any references to this variable. BREAKING CHANGE: remove output `server_security_alert_policy_id`. To migrate your project, remove any references to this output. BREAKING CHANGE: remove output `server_vulnerability_assessment_id`. To migrate your project, remove any references to this output. --------- Co-authored-by: sefornes <41449429+sefornes@users.noreply.github.com>
1 parent b2c26d1 commit 784fc08

File tree

12 files changed

+137
-124
lines changed

12 files changed

+137
-124
lines changed

‎.github/workflows/test.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: Test
2+
on:
3+
pull_request:
4+
branches:
5+
- main
6+
jobs:
7+
test:
8+
name: Unit Tests
9+
uses: equinor/terraform-baseline/.github/workflows/terraform-test.yml@main
10+
with:
11+
test-filter: tests/unit.tftest.hcl

‎README.md‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Terraform module which creates Azure SQL resources.
88
- Microsoft Entra administrator enforced.
99
- Microsoft Entra-only authentication enabled by default.
1010
- Audit logs sent to given Log Analytics workspace by default.
11-
- Vulnerability assessment scan results stored in given Storage account.
11+
- Vulnerability assessment scan express configuration enabled.
1212

1313
## Prerequisites
1414

@@ -33,7 +33,6 @@ module "sql" {
3333
resource_group_name = azurerm_resource_group.example.name
3434
location = azurerm_resource_group.example.location
3535
log_analytics_workspace_id = module.log_analytics.workspace_id
36-
storage_account_id = module.storage.account_id
3736
3837
azuread_administrator_login_username = "EntraAdmin"
3938
azuread_administrator_object_id = "8954d564-505c-4cf8-a254-69e3b0facff2"
@@ -53,15 +52,6 @@ module "log_analytics" {
5352
location = azurerm_resource_group.example.location
5453
}
5554
56-
module "storage" {
57-
source = "equinor/storage/azurerm"
58-
version = "~> 12.0"
59-
60-
account_name = "sqlstorage"
61-
resource_group_name = azurerm_resource_group.example.name
62-
location = azurerm_resource_group.example.location
63-
log_analytics_workspace_id = module.log_analytics.workspace_id
64-
}
6555
```
6656

6757
## Known Issues

‎examples/basic/main.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,17 @@ resource "random_id" "this" {
1111
}
1212

1313
module "log_analytics" {
14-
source = "github.com/equinor/terraform-azurerm-log-analytics?ref=v1.5.0"
14+
source = "equinor/log-analytics/azurerm"
15+
version = "2.4.3"
1516

1617
workspace_name = "log-${random_id.this.hex}"
1718
resource_group_name = var.resource_group_name
1819
location = var.location
1920
}
2021

2122
module "storage" {
22-
source = "github.com/equinor/terraform-azurerm-storage?ref=v11.0.0"
23+
source = "equinor/storage/azurerm"
24+
version = "12.13.3"
2325

2426
account_name = "st${random_id.this.hex}"
2527
resource_group_name = var.resource_group_name
@@ -28,14 +30,14 @@ module "storage" {
2830
}
2931

3032
module "sql" {
31-
# source = "github.com/equinor/terraform-azurerm-sql?ref=v0.0.0"
33+
# source = "equinor/sql/azurerm"
34+
# version = "0.0.0"
3235
source = "../.."
3336

3437
server_name = "sql-${random_id.this.hex}"
3538
resource_group_name = var.resource_group_name
3639
location = var.location
3740
log_analytics_workspace_id = module.log_analytics.workspace_id
38-
storage_account_id = module.storage.account_id
3941

4042
azuread_administrator_login_username = "azureadadminlogin"
4143
azuread_administrator_object_id = data.azurerm_client_config.current.object_id

‎examples/complete/main.tf‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,17 @@ resource "random_id" "this" {
1717
}
1818

1919
module "log_analytics" {
20-
source = "github.com/equinor/terraform-azurerm-log-analytics?ref=v1.5.0"
20+
source = "equinor/log-analytics/azurerm"
21+
version = "2.4.3"
2122

2223
workspace_name = "log-${random_id.this.hex}"
2324
resource_group_name = var.resource_group_name
2425
location = var.location
2526
}
2627

2728
module "storage" {
28-
source = "github.com/equinor/terraform-azurerm-storage?ref=v10.3.0"
29+
source = "equinor/storage/azurerm"
30+
version = "12.13.3"
2931

3032
account_name = "st${random_id.this.hex}"
3133
resource_group_name = var.resource_group_name
@@ -34,14 +36,14 @@ module "storage" {
3436
}
3537

3638
module "sql" {
37-
# source = "github.com/equinor/terraform-azurerm-sql?ref=v0.0.0"
39+
# source = "equinor/sql/azurerm"
40+
# version = "0.0.0"
3841
source = "../.."
3942

4043
server_name = "sql-${random_id.this.hex}"
4144
resource_group_name = var.resource_group_name
4245
location = var.location
4346
log_analytics_workspace_id = module.log_analytics.workspace_id
44-
storage_account_id = module.storage.account_id
4547

4648
azuread_administrator_login_username = "azureadadminlogin"
4749
azuread_administrator_object_id = data.azurerm_client_config.current.object_id
@@ -57,8 +59,5 @@ module "sql" {
5759
}
5860
}
5961

60-
security_alert_policy_email_account_admins = true
61-
security_alert_policy_email_addresses = []
62-
6362
tags = local.tags
6463
}

‎locals.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,4 @@
11
locals {
2-
storage_account_name = provider::azurerm::parse_resource_id(var.storage_account_id).resource_name
3-
storage_blob_endpoint = "https://${local.storage_account_name}.blob.core.windows.net/"
4-
52
firewall_rules = var.firewall_rules_allow_azure_services ? {
63
# Allow connections from inside Azure.
74
# Ref: https://github.com/MicrosoftDocs/sql-docs/blob/2921bf7c9d2301d818479eae0488285403f48250/azure-sql/database/firewall-configure.md#connections-from-inside-azure

‎main.tf‎

Lines changed: 8 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,14 @@ resource "random_password" "this" {
1313
}
1414

1515
resource "azurerm_mssql_server" "this" {
16-
name = var.server_name
17-
location = var.location
18-
resource_group_name = var.resource_group_name
19-
version = "12.0"
20-
administrator_login = var.azuread_authentication_only ? null : var.administrator_login
21-
administrator_login_password = var.azuread_authentication_only ? null : random_password.this.result
22-
minimum_tls_version = "1.2"
16+
name = var.server_name
17+
location = var.location
18+
resource_group_name = var.resource_group_name
19+
version = "12.0"
20+
administrator_login = var.azuread_authentication_only ? null : var.administrator_login
21+
administrator_login_password = var.azuread_authentication_only ? null : random_password.this.result
22+
minimum_tls_version = "1.2"
23+
express_vulnerability_assessment_enabled = true
2324

2425
tags = var.tags
2526

@@ -85,36 +86,3 @@ resource "azurerm_monitor_diagnostic_setting" "server" {
8586
azurerm_mssql_server_extended_auditing_policy.this
8687
]
8788
}
88-
89-
resource "azurerm_mssql_server_security_alert_policy" "this" {
90-
resource_group_name = azurerm_mssql_server.this.resource_group_name
91-
server_name = azurerm_mssql_server.this.name
92-
state = "Enabled"
93-
disabled_alerts = []
94-
email_account_admins = var.security_alert_policy_email_account_admins
95-
email_addresses = var.security_alert_policy_email_addresses
96-
}
97-
98-
resource "azurerm_role_assignment" "this" {
99-
scope = var.storage_account_id
100-
role_definition_name = "Storage Blob Data Contributor"
101-
principal_id = azurerm_mssql_server.this.identity[0].principal_id
102-
}
103-
104-
resource "azurerm_mssql_server_vulnerability_assessment" "this" {
105-
server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.this.id
106-
storage_container_path = "${coalesce(var.storage_blob_endpoint, local.storage_blob_endpoint)}${var.storage_container_name}/"
107-
108-
# The following arguments are irrelevant when creating resource "azurerm_role_assignment.this".
109-
# This role assignment allows the SQL server to use its system-assigned identity to authenticate to the Storage account using Microsoft Entra ID, which is more secure than using an access key or shared access signature (SAS).
110-
storage_account_access_key = null
111-
storage_container_sas_key = null
112-
113-
recurring_scans {
114-
enabled = var.vulnerability_assessment_recurring_scans_enabled
115-
email_subscription_admins = var.vulnerability_assessment_recurring_scans_email_subscription_admins
116-
emails = var.vulnerability_assessment_recurring_scans_emails
117-
}
118-
119-
depends_on = [azurerm_role_assignment.this]
120-
}

‎outputs.tf‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,3 @@ output "administrator_password" {
2323
value = azurerm_mssql_server.this.administrator_login_password
2424
sensitive = true
2525
}
26-
27-
output "server_security_alert_policy_id" {
28-
description = "The ID of the security alert policy for this SQL server."
29-
value = azurerm_mssql_server_security_alert_policy.this.id
30-
}
31-
32-
output "server_vulnerability_assessment_id" {
33-
description = "The ID of the vulnerability assessment for this SQL server."
34-
value = azurerm_mssql_server_vulnerability_assessment.this.id
35-
}

‎tests/setup-unit-tests/main.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
terraform {
2+
required_providers {
3+
random = {
4+
source = "hashicorp/random"
5+
version = "~> 3.6.0"
6+
}
7+
}
8+
}
9+
10+
resource "random_id" "name_suffix" {
11+
byte_length = 8
12+
}
13+
14+
resource "random_uuid" "subscription_id" {}
15+
resource "random_uuid" "azuread_administrator_object_id" {}
16+
locals {
17+
name_suffix = random_id.name_suffix.hex
18+
subscription_id = random_uuid.subscription_id.result
19+
resource_group_name = "rg-${local.name_suffix}"
20+
server_name = "sql-${local.name_suffix}"
21+
log_analytics_workspace_name = "log-${local.name_suffix}"
22+
azuread_administrator_object_id = random_uuid.azuread_administrator_object_id.result
23+
24+
}

‎tests/setup-unit-tests/outputs.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
output "resource_group_name" {
2+
value = local.resource_group_name
3+
}
4+
5+
output "location" {
6+
value = "northeurope"
7+
}
8+
9+
output "administrator_login" {
10+
value = "azureadminuser"
11+
}
12+
13+
output "log_analytics_workspace_id" {
14+
value = "/subscriptions/${local.subscription_id}/resourceGroups/${local.resource_group_name}/providers/Microsoft.OperationalInsights/workspaces/${local.log_analytics_workspace_name}"
15+
}
16+
17+
output "azuread_administrator_login_username" {
18+
value = "azureadadminuser"
19+
}
20+
21+
output "azuread_administrator_object_id" {
22+
value = local.azuread_administrator_object_id
23+
}
24+
25+
output "subscription_id" {
26+
value = local.subscription_id
27+
}
28+
29+
output "server_name" {
30+
value = local.server_name
31+
}
32+
output "log_analytics_workspace_name" {
33+
value = local.log_analytics_workspace_name
34+
}

‎tests/unit.tftest.hcl‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
mock_provider "azurerm" {}
2+
3+
run "setup_tests" {
4+
module {
5+
source = "./tests/setup-unit-tests"
6+
}
7+
}
8+
9+
run "sql_server_azuread_authentication_only_enabled" {
10+
command = plan
11+
12+
variables {
13+
server_name = run.setup_tests.server_name
14+
resource_group_name = run.setup_tests.resource_group_name
15+
location = run.setup_tests.location
16+
log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
17+
azuread_administrator_login_username = run.setup_tests.azuread_administrator_login_username
18+
azuread_administrator_object_id = run.setup_tests.azuread_administrator_object_id
19+
azuread_authentication_only = true
20+
}
21+
22+
assert {
23+
condition = azurerm_mssql_server.this.azuread_administrator[0].login_username == run.setup_tests.azuread_administrator_login_username && azurerm_mssql_server.this.azuread_administrator[0].azuread_authentication_only == true
24+
error_message = "AzureAD authentication only not enabled"
25+
}
26+
}
27+
28+
run "sql_server_azuread_authentication_only_disabled" {
29+
command = plan
30+
31+
variables {
32+
server_name = run.setup_tests.server_name
33+
resource_group_name = run.setup_tests.resource_group_name
34+
location = run.setup_tests.location
35+
log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
36+
administrator_login = run.setup_tests.administrator_login
37+
azuread_administrator_login_username = run.setup_tests.azuread_administrator_login_username
38+
azuread_administrator_object_id = run.setup_tests.azuread_administrator_object_id
39+
azuread_authentication_only = false
40+
}
41+
42+
assert {
43+
condition = azurerm_mssql_server.this.administrator_login == run.setup_tests.administrator_login && azurerm_mssql_server.this.azuread_administrator[0].azuread_authentication_only == false
44+
error_message = "AzureAD authentication only not disabled"
45+
}
46+
}

0 commit comments

Comments
 (0)