feat(terraform): add the Azure storage module

Mirrors deployment/terraform/modules/aws/s3. Backs the Onyx file store, which
already speaks Azure Blob through backend/onyx/file_store/azure_blob_file_store.py.

The outputs line up with the environment the app reads: storage_account_name,
primary_blob_endpoint and container_name feed AZURE_STORAGE_ACCOUNT_NAME,
AZURE_STORAGE_ACCOUNT_URL and AZURE_FILE_STORE_CONTAINER_NAME.

Three places where Azure does not map cleanly onto the S3 module:

- Shared access keys are off by default. The app authenticates with
  DefaultAzureCredential, so a key never has to exist, and the account defaults
  to Entra ID authentication.
- Network rules replace the bucket policy. With no allowlist the account stays
  reachable and is gated on Entra ID alone, which is how the s3 module behaves
  with no policy attached. Supplying subnets or IPs flips it to deny-first.
- Cool tiering waits 30 days rather than the s3 module's 7. Azure has no
  Intelligent-Tiering, and Cool bills a 30-day minimum per blob, so moving
  earlier costs more than it saves.

Author: justin-tahara

deployment/terraform/modules/azure/storage/main.tf

@@ -0,0 +1,124 @@
+locals {
+  # With no allowlist the account stays reachable from any network and access
+  # is gated on Entra ID alone, which is how the AWS s3 module behaves when no
+  # bucket policy is set. Supplying either list flips the account to deny-first.
+  restrict_network = length(var.allowed_subnet_ids) > 0 || length(var.allowed_source_ips) > 0
+
+  # A management policy with no rules is rejected, so only create one when at
+  # least one rule applies.
+  has_lifecycle_rules = var.enable_versioning || var.expiration_days > 0 || var.transition_to_cool
+}
+
+resource "azurerm_storage_account" "this" {
+  name                = var.storage_account_name
+  resource_group_name = var.resource_group_name
+  location            = var.location
+
+  account_kind             = "StorageV2"
+  account_tier             = var.account_tier
+  account_replication_type = var.account_replication_type
+
+  https_traffic_only_enabled    = true
+  min_tls_version               = var.min_tls_version
+  public_network_access_enabled = var.public_network_access_enabled
+  shared_access_key_enabled     = var.shared_access_key_enabled
+
+  # The pair of settings that keep blobs from ever being served anonymously.
+  allow_nested_items_to_be_public = false
+  default_to_oauth_authentication = true
+
+  tags = var.tags
+
+  blob_properties {
+    versioning_enabled = var.enable_versioning
+
+    dynamic "delete_retention_policy" {
+      for_each = var.blob_soft_delete_days > 0 ? [1] : []
+      content {
+        days = var.blob_soft_delete_days
+      }
+    }
+
+    dynamic "container_delete_retention_policy" {
+      for_each = var.container_soft_delete_days > 0 ? [1] : []
+      content {
+        days = var.container_soft_delete_days
+      }
+    }
+  }
+
+  dynamic "network_rules" {
+    for_each = local.restrict_network ? [1] : []
+    content {
+      default_action             = "Deny"
+      bypass                     = var.network_rules_bypass
+      virtual_network_subnet_ids = var.allowed_subnet_ids
+      ip_rules                   = var.allowed_source_ips
+    }
+  }
+}
+
+resource "azurerm_storage_container" "this" {
+  name                  = var.container_name
+  storage_account_id    = azurerm_storage_account.this.id
+  container_access_type = "private"
+}
+
+resource "azurerm_storage_management_policy" "this" {
+  count              = local.has_lifecycle_rules ? 1 : 0
+  storage_account_id = azurerm_storage_account.this.id
+
+  dynamic "rule" {
+    for_each = var.enable_versioning ? [1] : []
+    content {
+      name    = "noncurrent-version-expiration"
+      enabled = true
+
+      filters {
+        blob_types = ["blockBlob"]
+      }
+
+      actions {
+        version {
+          delete_after_days_since_creation = var.noncurrent_expiration_days
+        }
+      }
+    }
+  }
+
+  dynamic "rule" {
+    for_each = var.expiration_days > 0 ? [1] : []
+    content {
+      name    = "object-expiration"
+      enabled = true
+
+      filters {
+        blob_types = ["blockBlob"]
+      }
+
+      actions {
+        base_blob {
+          delete_after_days_since_modification_greater_than = var.expiration_days
+        }
+      }
+    }
+  }
+
+  dynamic "rule" {
+    for_each = var.transition_to_cool ? [1] : []
+    content {
+      name    = "transition-to-cool"
+      enabled = true
+
+      filters {
+        blob_types = ["blockBlob"]
+      }
+
+      actions {
+        base_blob {
+          tier_to_cool_after_days_since_modification_greater_than = var.transition_to_cool_days
+        }
+      }
+    }
+  }
+}

deployment/terraform/modules/azure/storage/outputs.tf

@@ -0,0 +1,25 @@
+output "storage_account_id" {
+  description = "Resource ID of the storage account. Role assignments and flow log destinations take this."
+  value       = azurerm_storage_account.this.id
+}
+
+output "storage_account_name" {
+  description = "Name of the storage account. Set this as AZURE_STORAGE_ACCOUNT_NAME."
+  value       = azurerm_storage_account.this.name
+}
+
+output "primary_blob_endpoint" {
+  description = "Blob service endpoint. Set this as AZURE_STORAGE_ACCOUNT_URL."
+  value       = azurerm_storage_account.this.primary_blob_endpoint
+}
+
+output "container_name" {
+  description = "Name of the file store container. Set this as AZURE_FILE_STORE_CONTAINER_NAME."
+  value       = azurerm_storage_container.this.name
+}
+
+output "primary_access_key" {
+  description = "Shared access key, null unless shared_access_key_enabled is true. Onyx uses workload identity and does not need it."
+  value       = var.shared_access_key_enabled ? azurerm_storage_account.this.primary_access_key : null
+  sensitive   = true
+}

deployment/terraform/modules/azure/storage/tests/storage.tftest.hcl

@@ -0,0 +1,153 @@
+# Plans the module against a mocked provider, so these run without an Azure
+# subscription or credentials. Run with `terraform test` from the module directory.
+
+mock_provider "azurerm" {}
+
+variables {
+  storage_account_name = "onyxfilestoreprod"
+  resource_group_name  = "onyx-rg"
+  location             = "eastus"
+}
+
+run "defaults_are_private_and_keyless" {
+  command = plan
+
+  assert {
+    condition     = azurerm_storage_account.this.shared_access_key_enabled == false
+    error_message = "Onyx authenticates with workload identity, so shared keys should be off by default."
+  }
+
+  assert {
+    condition     = azurerm_storage_account.this.allow_nested_items_to_be_public == false
+    error_message = "Blobs must never be servable anonymously."
+  }
+
+  assert {
+    condition     = azurerm_storage_account.this.default_to_oauth_authentication == true
+    error_message = "The account should default to Entra ID authentication."
+  }
+
+  assert {
+    condition     = azurerm_storage_container.this.container_access_type == "private"
+    error_message = "The file store container must be private."
+  }
+
+  assert {
+    condition     = azurerm_storage_account.this.min_tls_version == "TLS1_2"
+    error_message = "The account should refuse TLS below 1.2."
+  }
+}
+
+run "no_allowlist_leaves_the_account_open_to_the_network" {
+  command = plan
+
+  assert {
+    condition     = length(azurerm_storage_account.this.network_rules) == 0
+    error_message = "With no allowlist the account is gated on Entra ID alone, matching how the AWS s3 module behaves with no bucket policy."
+  }
+}
+
+run "an_allowlist_flips_the_account_to_deny_first" {
+  command = plan
+
+  variables {
+    allowed_subnet_ids = ["/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/onyx-rg/providers/Microsoft.Network/virtualNetworks/onyx-vnet/subnets/onyx-aks"]
+  }
+
+  assert {
+    condition     = one(azurerm_storage_account.this.network_rules).default_action == "Deny"
+    error_message = "Supplying an allowlist must deny everything else."
+  }
+
+  assert {
+    condition     = contains(one(azurerm_storage_account.this.network_rules).bypass, "AzureServices")
+    error_message = "AzureServices must stay exempt or Monitor and Backup lose access."
+  }
+}
+
+run "default_lifecycle_rules" {
+  command = plan
+
+  assert {
+    condition     = length(azurerm_storage_management_policy.this[0].rule) == 2
+    error_message = "Versioning and cool-tiering are on by default; blob expiry is not."
+  }
+
+  assert {
+    condition     = contains(azurerm_storage_management_policy.this[0].rule[*].name, "noncurrent-version-expiration")
+    error_message = "Non-current versions should expire by default."
+  }
+
+  assert {
+    condition     = contains(azurerm_storage_management_policy.this[0].rule[*].name, "transition-to-cool")
+    error_message = "Blobs should tier to Cool by default."
+  }
+}
+
+run "expiry_adds_a_third_rule" {
+  command = plan
+
+  variables {
+    expiration_days = 365
+  }
+
+  assert {
+    condition     = length(azurerm_storage_management_policy.this[0].rule) == 3
+    error_message = "Setting expiration_days should add the object-expiration rule."
+  }
+}
+
+run "no_rules_means_no_policy" {
+  command = plan
+
+  variables {
+    enable_versioning  = false
+    transition_to_cool = false
+    expiration_days    = 0
+  }
+
+  assert {
+    condition     = length(azurerm_storage_management_policy.this) == 0
+    error_message = "Azure rejects a management policy with no rules, so the module must not create one."
+  }
+}
+
+run "rejects_a_name_azure_would_reject" {
+  command = plan
+
+  variables {
+    storage_account_name = "Onyx-File-Store"
+  }
+
+  expect_failures = [var.storage_account_name]
+}
+
+run "rejects_a_name_that_is_too_long" {
+  command = plan
+
+  variables {
+    storage_account_name = "onyxfilestoreproductioneastus"
+  }
+
+  expect_failures = [var.storage_account_name]
+}
+
+run "rejects_a_host_prefix_azure_would_reject" {
+  command = plan
+
+  variables {
+    allowed_source_ips = ["203.0.113.7/32"]
+  }
+
+  expect_failures = [var.allowed_source_ips]
+}
+
+run "rejects_an_invalid_bypass" {
+  command = plan
+
+  variables {
+    network_rules_bypass = ["AzureServices", "Everything"]
+  }
+
+  expect_failures = [var.network_rules_bypass]
+}