Skip to content

Commit 01be2c8

Browse files
kumarvnakumarvna
committed
module update
1 parent 2d1dd8e commit 01be2c8

File tree

3 files changed

+103
-18
lines changed

3 files changed

+103
-18
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,4 @@ override.tf.json
2929
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
3030
# example: *tfplan*
3131
versions.tf
32+
examples/artifacts/db-init-sample.log

‎main.tf

Lines changed: 68 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
locals {
2-
resource_group_name = element(coalescelist(data.azurerm_resource_group.rgrp.*.name, azurerm_resource_group.rg.*.name, [""]), 0)
3-
location = element(coalescelist(data.azurerm_resource_group.rgrp.*.location, azurerm_resource_group.rg.*.location, [""]), 0)
4-
if_threat_detection_policy_enabled = var.enable_threat_detection_policy ? [{}] : []
5-
if_extended_auditing_policy_enabled = var.enable_extended_auditing_policy ? [{}] : []
2+
resource_group_name = element(coalescelist(data.azurerm_resource_group.rgrp.*.name, azurerm_resource_group.rg.*.name, [""]), 0)
3+
location = element(coalescelist(data.azurerm_resource_group.rgrp.*.location, azurerm_resource_group.rg.*.location, [""]), 0)
4+
if_threat_detection_policy_enabled = var.enable_threat_detection_policy ? [{}] : []
5+
#if_extended_auditing_policy_enabled = var.enable_extended_auditing_policy ? [{}] : []
66
}
77

88
#---------------------------------------------------------
@@ -23,13 +23,29 @@ resource "azurerm_resource_group" "rg" {
2323

2424
data "azurerm_client_config" "current" {}
2525

26+
data "azurerm_log_analytics_workspace" "logws" {
27+
count = var.log_analytics_workspace_name != null ? 1 : 0
28+
name = var.log_analytics_workspace_name
29+
resource_group_name = local.resource_group_name
30+
}
31+
2632
#---------------------------------------------------------
2733
# Storage Account to keep Audit logs - Default is "false"
2834
#----------------------------------------------------------
2935

36+
resource "random_string" "str" {
37+
count = var.enable_sql_server_extended_auditing_policy || var.enable_database_extended_auditing_policy || var.enable_vulnerability_assessment ? 1 : 0
38+
length = 6
39+
special = false
40+
upper = false
41+
keepers = {
42+
name = var.storage_account_name
43+
}
44+
}
45+
3046
resource "azurerm_storage_account" "storeacc" {
31-
count = var.enable_threat_detection_policy || var.enable_extended_auditing_policy ? 1 : 0
32-
name = var.storage_account_name == null ? "stsqlauditlogs" : var.storage_account_name
47+
count = var.enable_sql_server_extended_auditing_policy || var.enable_database_extended_auditing_policy || var.enable_vulnerability_assessment || var.enable_audit_log_monitoring == true ? 1 : 0
48+
name = var.storage_account_name == null ? "stsqlauditlogs${element(concat(random_string.str.*.result, [""]), 0)}" : substr(var.storage_account_name, 0, 24)
3349
resource_group_name = local.resource_group_name
3450
location = local.location
3551
account_kind = "StorageV2"
@@ -41,6 +57,7 @@ resource "azurerm_storage_account" "storeacc" {
4157
}
4258

4359
resource "azurerm_storage_container" "storcont" {
60+
count = var.enable_vulnerability_assessment ? 1 : 0
4461
name = "vulnerability-assessment"
4562
storage_account_name = azurerm_storage_account.storeacc.0.name
4663
container_access_type = "private"
@@ -67,8 +84,8 @@ resource "azurerm_sql_server" "primary" {
6784
resource_group_name = local.resource_group_name
6885
location = local.location
6986
version = "12.0"
70-
administrator_login = "sqladmin"
71-
administrator_login_password = random_password.main.result
87+
administrator_login = var.admin_username == null ? "sqladmin" : var.admin_username
88+
administrator_login_password = var.admin_password == null ? random_password.main.result : var.admin_password
7289
tags = merge({ "Name" = format("%s-primary", var.sqlserver_name) }, var.tags, )
7390

7491
dynamic "identity" {
@@ -80,12 +97,13 @@ resource "azurerm_sql_server" "primary" {
8097
}
8198

8299
resource "azurerm_mssql_server_extended_auditing_policy" "primary" {
83-
count = var.enable_extended_auditing_policy ? 1 : 0
100+
count = var.enable_sql_server_extended_auditing_policy ? 1 : 0
84101
server_id = azurerm_sql_server.primary.id
85102
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
86103
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
87104
storage_account_access_key_is_secondary = false
88105
retention_in_days = var.log_retention_days
106+
log_monitoring_enabled = var.enable_audit_log_monitoring == true && var.log_analytics_workspace_name != null ? true : false
89107
}
90108

91109
resource "azurerm_sql_server" "secondary" {
@@ -95,7 +113,7 @@ resource "azurerm_sql_server" "secondary" {
95113
location = var.secondary_sql_server_location
96114
version = "12.0"
97115
administrator_login = "sqladmin"
98-
administrator_login_password = random_password.main.result
116+
administrator_login_password = var.admin_password == null ? random_password.main.result : var.admin_password
99117
tags = merge({ "Name" = format("%s-secondary", var.sqlserver_name) }, var.tags, )
100118

101119
dynamic "identity" {
@@ -107,12 +125,13 @@ resource "azurerm_sql_server" "secondary" {
107125
}
108126

109127
resource "azurerm_mssql_server_extended_auditing_policy" "secondary" {
110-
count = var.enable_failover_group && var.enable_extended_auditing_policy ? 1 : 0
128+
count = var.enable_failover_group && var.enable_sql_server_extended_auditing_policy ? 1 : 0
111129
server_id = azurerm_sql_server.secondary.0.id
112130
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
113131
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
114132
storage_account_access_key_is_secondary = false
115133
retention_in_days = var.log_retention_days
134+
log_monitoring_enabled = var.enable_audit_log_monitoring == true && var.log_analytics_workspace_name != null ? true : null
116135
}
117136

118137

@@ -142,12 +161,13 @@ resource "azurerm_sql_database" "db" {
142161
}
143162

144163
resource "azurerm_mssql_database_extended_auditing_policy" "primary" {
145-
count = var.enable_extended_auditing_policy ? 1 : 0
164+
count = var.enable_database_extended_auditing_policy ? 1 : 0
146165
database_id = azurerm_sql_database.db.id
147166
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
148167
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
149168
storage_account_access_key_is_secondary = false
150169
retention_in_days = var.log_retention_days
170+
log_monitoring_enabled = var.enable_audit_log_monitoring == true && var.log_analytics_workspace_name != null ? true : null
151171
}
152172

153173
#-----------------------------------------------------------------------------------------------
@@ -183,7 +203,7 @@ resource "azurerm_mssql_server_security_alert_policy" "sap_secondary" {
183203
resource "azurerm_mssql_server_vulnerability_assessment" "va_primary" {
184204
count = var.enable_vulnerability_assessment ? 1 : 0
185205
server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.sap_primary.0.id
186-
storage_container_path = "${azurerm_storage_account.storeacc.0.primary_blob_endpoint}${azurerm_storage_container.storcont.name}/"
206+
storage_container_path = "${azurerm_storage_account.storeacc.0.primary_blob_endpoint}${azurerm_storage_container.storcont.0.name}/"
187207
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
188208

189209
recurring_scans {
@@ -196,7 +216,7 @@ resource "azurerm_mssql_server_vulnerability_assessment" "va_primary" {
196216
resource "azurerm_mssql_server_vulnerability_assessment" "va_secondary" {
197217
count = var.enable_vulnerability_assessment && var.enable_failover_group == true ? 1 : 0
198218
server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.sap_secondary.0.id
199-
storage_container_path = "${azurerm_storage_account.storeacc.0.primary_blob_endpoint}${azurerm_storage_container.storcont.name}/"
219+
storage_container_path = "${azurerm_storage_account.storeacc.0.primary_blob_endpoint}${azurerm_storage_container.storcont.0.name}/"
200220
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
201221

202222
recurring_scans {
@@ -222,7 +242,7 @@ resource "null_resource" "create_sql" {
222242
#-----------------------------------------------------------------------------------------------
223243

224244
resource "azurerm_sql_active_directory_administrator" "aduser1" {
225-
count = var.enable_sql_ad_admin ? 1 : 0
245+
count = var.ad_admin_login_name != null ? 1 : 0
226246
server_name = azurerm_sql_server.primary.name
227247
resource_group_name = local.resource_group_name
228248
login = var.ad_admin_login_name
@@ -231,7 +251,7 @@ resource "azurerm_sql_active_directory_administrator" "aduser1" {
231251
}
232252

233253
resource "azurerm_sql_active_directory_administrator" "aduser2" {
234-
count = var.enable_failover_group && var.enable_sql_ad_admin ? 1 : 0
254+
count = var.enable_failover_group && var.ad_admin_login_name != null ? 1 : 0
235255
server_name = azurerm_sql_server.secondary.0.name
236256
resource_group_name = local.resource_group_name
237257
login = var.ad_admin_login_name
@@ -389,3 +409,35 @@ resource "azurerm_private_dns_a_record" "arecord2" {
389409
records = [data.azurerm_private_endpoint_connection.private-ip2.0.private_service_connection.0.private_ip_address]
390410

391411
}
412+
413+
#------------------------------------------------------------------
414+
# azurerm monitoring diagnostics - Default is "false"
415+
#------------------------------------------------------------------
416+
resource "azurerm_monitor_diagnostic_setting" "extaudit" {
417+
count = var.enable_audit_log_monitoring == true && var.log_analytics_workspace_name != null ? 1 : 0
418+
name = lower("extaudit-${var.database_name}-diag")
419+
target_resource_id = azurerm_sql_database.db.id
420+
log_analytics_workspace_id = data.azurerm_log_analytics_workspace.logws.0.id
421+
storage_account_id = azurerm_storage_account.storeacc.0.id
422+
423+
log {
424+
category = "SQLSecurityAuditEvents"
425+
enabled = true
426+
427+
retention_policy {
428+
enabled = false
429+
}
430+
}
431+
432+
metric {
433+
category = "AllMetrics"
434+
435+
retention_policy {
436+
enabled = false
437+
}
438+
}
439+
440+
lifecycle {
441+
ignore_changes = [log, metric]
442+
}
443+
}

‎variables.tf

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ variable "storage_account_name" {
1313
default = null
1414
}
1515

16+
variable "log_analytics_workspace_name" {
17+
description = "The name of log analytics workspace name"
18+
default = null
19+
}
20+
1621
variable "location" {
1722
description = "The location/region to keep all your network resources. To get the list of all locations with table format from azure cli, run 'az account list-locations -o table'"
1823
default = "westeurope"
@@ -23,8 +28,13 @@ variable "random_password_length" {
2328
default = 24
2429
}
2530

26-
variable "enable_extended_auditing_policy" {
27-
description = "Audit policy for SQL server and database"
31+
variable "enable_sql_server_extended_auditing_policy" {
32+
description = "Manages Extended Audit policy for SQL servers"
33+
default = true
34+
}
35+
36+
variable "enable_database_extended_auditing_policy" {
37+
description = "Manages Extended Audit policy for SQL database"
2838
default = false
2939
}
3040

@@ -38,6 +48,16 @@ variable "sqlserver_name" {
3848
default = "sqldbserver-demodbapp"
3949
}
4050

51+
variable "admin_username" {
52+
description = "The administrator login name for the new SQL Server"
53+
default = null
54+
}
55+
56+
variable "admin_password" {
57+
description = "The password associated with the admin_username user"
58+
default = null
59+
}
60+
4161
variable "database_name" {
4262
description = "The name of the database"
4363
default = ""
@@ -134,6 +154,11 @@ variable "firewall_rules" {
134154
default = []
135155
}
136156

157+
variable "enable_audit_log_monitoring" {
158+
description = "Enable audit events to Azure Monitor?"
159+
default = false
160+
}
161+
137162
variable "initialize_sql_script_execution" {
138163
description = "Allow/deny to Create and initialize a Microsoft SQL Server database"
139164
default = false
@@ -143,8 +168,15 @@ variable "sqldb_init_script_file" {
143168
description = "SQL Script file name to create and initialize the database"
144169
}
145170

171+
variable "extaudit_diag_logs" {
172+
description = "Database Monitoring Category details for Azure Diagnostic setting"
173+
default = ["SQLSecurityAuditEvents", "SQLInsights", "AutomaticTuning", "QueryStoreRuntimeStatistics", "QueryStoreWaitStatistics", "Errors", "DatabaseWaitStatistics", "Timeouts", "Blocks", "Deadlocks"]
174+
}
175+
146176
variable "tags" {
147177
description = "A map of tags to add to all resources"
148178
type = map(string)
149179
default = {}
150180
}
181+
182+

0 commit comments

Comments
 (0)