Skip to content

Commit 36a7416

Browse files
kumarvnakumarvna
committed
module update
1 parent 7a6d4b6 commit 36a7416

File tree

4 files changed

+216
-111
lines changed

4 files changed

+216
-111
lines changed

‎examples/Simple_SQL_Single_Database_creation/main.tf

Lines changed: 42 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -2,48 +2,57 @@ module "mssql-server" {
22
//source = "kumarvna/mssql-db/azurerm"
33
//version = "1.0.0"
44
source = "github.com/kumarvna/terraform-azurerm-mssql-db?ref=develop"
5-
6-
# Resource Group, VNet and Subnet declarations
7-
create_resource_group = false
8-
resource_group_name = "rg-demo-westeurope-01"
9-
location = "westeurope"
10-
virtual_network_name = "vnet-demo-westeurope-001"
11-
private_subnet_address_prefix = "10.0.5.0/29"
12-
13-
# SQL Server and Database scaling options
14-
sqlserver_name = "sqldbserver-db01"
15-
database_name = "demomssqldb"
16-
sql_database_edition = "Standard"
17-
sqldb_service_objective_name = "S1"
18-
19-
# SQL Server and Database Audit policies
20-
enable_auditing_policy = true
5+
//source = "../../"
6+
7+
# By default, this module will create a resource group, proivde the name here
8+
# to use an existing resource group, specify the existing resource group name,
9+
# and set the argument to `create_resource_group = false`. Location will be same as existing RG.
10+
create_resource_group = false
11+
resource_group_name = "rg-shared-westeurope-01"
12+
location = "westeurope"
13+
virtual_network_name = "vnet-shared-hub-westeurope-001"
14+
private_subnet_address_prefix = ["10.1.5.0/29"]
15+
16+
# SQL Server and Database scaling options
17+
sqlserver_name = "sqldbserver-db01"
18+
database_name = "demomssqldb"
19+
sql_database_edition = "Standard"
20+
sqldb_service_objective_name = "S1"
21+
22+
# SQL Server and Database Audit policies
23+
enable_extended_auditing_policy = true
2124
enable_threat_detection_policy = true
2225
log_retention_days = 30
23-
email_addresses_for_alerts = ["[email protected]"]
26+
sql_admin_email_addresses = ["[email protected]"]
2427

25-
# AD administrator for an Azure SQL server
26-
enable_sql_ad_admin = true
27-
ad_admin_login_name = "[email protected]"
28+
# AD administrator for an Azure SQL server
29+
enable_sql_ad_admin = true
30+
ad_admin_login_name = "[email protected]"
2831

29-
# Firewall Rules to allow azure and external clients
30-
enable_firewall_rules = true
32+
enable_vulnerability_assessment = false
33+
34+
# Firewall Rules to allow azure and external clients
35+
enable_firewall_rules = true
3136
firewall_rules = [
32-
{name = "access-to-azure"
33-
start_ip_address = "0.0.0.0"
34-
end_ip_address = "0.0.0.0"},
35-
{name = "desktop-ip"
36-
start_ip_address = "123.201.42.91"
37-
end_ip_address = "123.201.42.91"}]
38-
39-
# Create and initialize a database with SQL script
40-
initialize_sql_script_execution = false
37+
{
38+
name = "access-to-azure"
39+
start_ip_address = "0.0.0.0"
40+
end_ip_address = "0.0.0.0"
41+
},
42+
{
43+
name = "desktop-ip"
44+
start_ip_address = "49.204.225.134"
45+
end_ip_address = "49.204.225.134"
46+
}]
47+
48+
# Create and initialize a database with SQL script
49+
initialize_sql_script_execution = true
4150
sqldb_init_script_file = "../artifacts/db-init-sample.sql"
4251

43-
# Tags for Azure Resources
52+
# Tags for Azure Resources
4453
tags = {
4554
Terraform = "true"
4655
Environment = "dev"
4756
Owner = "test-user"
4857
}
49-
}
58+
}

‎examples/Simple_SQL_Single_Database_creation/output.tf

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
output "resource_group_name" {
2-
description = "The name of the resource group in which resources are created"
2+
description = "The name of the resource group in which resources are created"
33
value = module.mssql-server.resource_group_name
44
}
55

66
output "resource_group_location" {
7-
description = "The location of the resource group in which resources are created"
7+
description = "The location of the resource group in which resources are created"
88
value = module.mssql-server.resource_group_location
99
}
1010

@@ -24,18 +24,20 @@ output "primary_sql_server_id" {
2424
}
2525

2626
output "primary_sql_server_fqdn" {
27-
description = "The fully qualified domain name of the primary Azure SQL Server"
27+
description = "The fully qualified domain name of the primary Azure SQL Server"
2828
value = module.mssql-server.primary_sql_server_fqdn
2929
}
3030

3131
output "sql_server_admin_user" {
3232
description = "SQL database administrator login id"
33-
value = module.mssql-server.sql_server_admin_user
33+
value = module.mssql-server.sql_server_admin_user
34+
sensitive = true
3435
}
3536

3637
output "sql_server_admin_password" {
3738
description = "SQL database administrator login password"
38-
value = module.mssql-server.sql_server_admin_password
39+
value = module.mssql-server.sql_server_admin_password
40+
sensitive = true
3941
}
4042

4143
output "sql_database_id" {

‎main.tf

Lines changed: 94 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ locals {
22
resource_group_name = element(coalescelist(data.azurerm_resource_group.rgrp.*.name, azurerm_resource_group.rg.*.name, [""]), 0)
33
location = element(coalescelist(data.azurerm_resource_group.rgrp.*.location, azurerm_resource_group.rg.*.location, [""]), 0)
44
if_threat_detection_policy_enabled = var.enable_threat_detection_policy ? [{}] : []
5-
if_extended_auditing_policy_enabled = var.enable_auditing_policy ? [{}] : []
5+
if_extended_auditing_policy_enabled = var.enable_extended_auditing_policy ? [{}] : []
66
}
77

88
#---------------------------------------------------------
@@ -21,13 +21,15 @@ resource "azurerm_resource_group" "rg" {
2121
tags = merge({ "Name" = format("%s", var.resource_group_name) }, var.tags, )
2222
}
2323

24+
data "azurerm_client_config" "current" {}
25+
2426
#---------------------------------------------------------
2527
# Storage Account to keep Audit logs - Default is "false"
2628
#----------------------------------------------------------
2729

2830
resource "azurerm_storage_account" "storeacc" {
29-
count = var.enable_threat_detection_policy || var.enable_auditing_policy ? 1 : 0
30-
name = "stsqlauditlogs"
31+
count = var.enable_threat_detection_policy || var.enable_extended_auditing_policy ? 1 : 0
32+
name = var.storage_account_name == null ? "stsqlauditlogs" : var.storage_account_name
3133
resource_group_name = local.resource_group_name
3234
location = local.location
3335
account_kind = "StorageV2"
@@ -38,6 +40,12 @@ resource "azurerm_storage_account" "storeacc" {
3840
tags = merge({ "Name" = format("%s", "stsqlauditlogs") }, var.tags, )
3941
}
4042

43+
resource "azurerm_storage_container" "storcont" {
44+
name = "vulnerability-assessment"
45+
storage_account_name = azurerm_storage_account.storeacc.0.name
46+
container_access_type = "private"
47+
}
48+
4149
#-------------------------------------------------------------
4250
# SQL servers - Secondary server is depends_on Failover Group
4351
#-------------------------------------------------------------
@@ -63,26 +71,23 @@ resource "azurerm_sql_server" "primary" {
6371
administrator_login_password = random_password.main.result
6472
tags = merge({ "Name" = format("%s-primary", var.sqlserver_name) }, var.tags, )
6573

66-
/* dynamic "extended_auditing_policy" {
67-
for_each = local.if_extended_auditing_policy_enabled
74+
dynamic "identity" {
75+
for_each = var.identity == true ? [1] : [0]
6876
content {
69-
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
70-
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
71-
retention_in_days = var.log_retention_days
77+
type = "SystemAssigned"
7278
}
73-
} */
79+
}
7480
}
7581

76-
resource "azurerm_mssql_server_extended_auditing_policy" "main" {
77-
count = var.enable_auditing_policy ? 1 : 0
82+
resource "azurerm_mssql_server_extended_auditing_policy" "primary" {
83+
count = var.enable_extended_auditing_policy ? 1 : 0
7884
server_id = azurerm_sql_server.primary.id
7985
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
8086
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
8187
storage_account_access_key_is_secondary = false
8288
retention_in_days = var.log_retention_days
8389
}
8490

85-
8691
resource "azurerm_sql_server" "secondary" {
8792
count = var.enable_failover_group ? 1 : 0
8893
name = format("%s-secondary", var.sqlserver_name)
@@ -93,16 +98,24 @@ resource "azurerm_sql_server" "secondary" {
9398
administrator_login_password = random_password.main.result
9499
tags = merge({ "Name" = format("%s-secondary", var.sqlserver_name) }, var.tags, )
95100

96-
dynamic "extended_auditing_policy" {
97-
for_each = local.if_extended_auditing_policy_enabled
101+
dynamic "identity" {
102+
for_each = var.identity == true ? [1] : [0]
98103
content {
99-
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
100-
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
101-
retention_in_days = var.log_retention_days
104+
type = "SystemAssigned"
102105
}
103106
}
104107
}
105108

109+
resource "azurerm_mssql_server_extended_auditing_policy" "secondary" {
110+
count = var.enable_failover_group && var.enable_extended_auditing_policy ? 1 : 0
111+
server_id = azurerm_sql_server.secondary.0.id
112+
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
113+
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
114+
storage_account_access_key_is_secondary = false
115+
retention_in_days = var.log_retention_days
116+
}
117+
118+
106119
#--------------------------------------------------------------------
107120
# SQL Database creation - Default edition:"Standard" and objective:"S1"
108121
#--------------------------------------------------------------------
@@ -123,17 +136,73 @@ resource "azurerm_sql_database" "db" {
123136
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
124137
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
125138
retention_days = var.log_retention_days
126-
email_addresses = var.email_addresses_for_alerts
139+
email_addresses = var.sql_admin_email_addresses
127140
}
128141
}
142+
}
129143

130-
dynamic "extended_auditing_policy" {
131-
for_each = local.if_extended_auditing_policy_enabled
132-
content {
133-
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
134-
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
135-
retention_in_days = var.log_retention_days
136-
}
144+
resource "azurerm_mssql_database_extended_auditing_policy" "primary" {
145+
count = var.enable_extended_auditing_policy ? 1 : 0
146+
database_id = azurerm_sql_database.db.id
147+
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
148+
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
149+
storage_account_access_key_is_secondary = false
150+
retention_in_days = var.log_retention_days
151+
}
152+
153+
#-----------------------------------------------------------------------------------------------
154+
# SQL ServerVulnerability assessment and alert to admin team - Default is "false"
155+
#-----------------------------------------------------------------------------------------------
156+
157+
resource "azurerm_mssql_server_security_alert_policy" "sap_primary" {
158+
count = var.enable_vulnerability_assessment ? 1 : 0
159+
resource_group_name = local.resource_group_name
160+
server_name = azurerm_sql_server.primary.name
161+
state = "Enabled"
162+
email_account_admins = true
163+
email_addresses = var.sql_admin_email_addresses
164+
retention_days = var.threat_detection_audit_logs_retention_days
165+
disabled_alerts = var.disabled_alerts
166+
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
167+
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
168+
}
169+
170+
resource "azurerm_mssql_server_security_alert_policy" "sap_secondary" {
171+
count = var.enable_vulnerability_assessment && var.enable_failover_group ? 1 : 0
172+
resource_group_name = local.resource_group_name
173+
server_name = azurerm_sql_server.secondary.0.name
174+
state = "Enabled"
175+
email_account_admins = true
176+
email_addresses = var.sql_admin_email_addresses
177+
retention_days = var.threat_detection_audit_logs_retention_days
178+
disabled_alerts = var.disabled_alerts
179+
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
180+
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
181+
}
182+
183+
resource "azurerm_mssql_server_vulnerability_assessment" "va_primary" {
184+
count = var.enable_vulnerability_assessment ? 1 : 0
185+
server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.sap_primary.0.id
186+
storage_container_path = "${azurerm_storage_account.storeacc.0.primary_blob_endpoint}${azurerm_storage_container.storcont.name}/"
187+
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
188+
189+
recurring_scans {
190+
enabled = true
191+
email_subscription_admins = true
192+
emails = var.sql_admin_email_addresses
193+
}
194+
}
195+
196+
resource "azurerm_mssql_server_vulnerability_assessment" "va_secondary" {
197+
count = var.enable_vulnerability_assessment && var.enable_failover_group == true ? 1 : 0
198+
server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.sap_secondary.0.id
199+
storage_container_path = "${azurerm_storage_account.storeacc.0.primary_blob_endpoint}${azurerm_storage_container.storcont.name}/"
200+
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
201+
202+
recurring_scans {
203+
enabled = true
204+
email_subscription_admins = true
205+
emails = var.sql_admin_email_addresses
137206
}
138207
}
139208

@@ -152,8 +221,6 @@ resource "null_resource" "create_sql" {
152221
# Adding AD Admin to SQL Server - Secondary server depend on Failover Group - Default is "false"
153222
#-----------------------------------------------------------------------------------------------
154223

155-
data "azurerm_client_config" "current" {}
156-
157224
resource "azurerm_sql_active_directory_administrator" "aduser1" {
158225
count = var.enable_sql_ad_admin ? 1 : 0
159226
server_name = azurerm_sql_server.primary.name

0 commit comments

Comments
 (0)