Skip to content

Commit ad44677

Browse files
kumarvnakumarvna
committed
adding terraform v0.15 support
1 parent 3a471d8 commit ad44677

File tree

1 file changed

+85
-114
lines changed

1 file changed

+85
-114
lines changed

‎README.md

Lines changed: 85 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
# Azure SQL Database - Using Failover Groups with Private Endpoints
22

3-
[![Terraform](https://img.shields.io/badge/Terraform%20-0.12-brightgreen.svg?style=flat)](https://github.com/hashicorp/terraform/releases) [![License](https://img.shields.io/badge/License%20-MIT-brightgreen.svg?style=flat)](https://github.com/kumarvna/cloudascode/blob/master/LICENSE)
3+
Terraform module to create an MS SQL server with initial database, Azure AD login, Firewall rules, geo-replication using auto-failover groups, Private endpoints, and corresponding private DNS zone. It also supports creating a database with a custom SQL script initialization.
44

5-
Terraform module for Azure to create a SQL server with initial database, Azure AD login, Firewall rules for SQL, Failover Group, Private endpoint, and corresponding private DNS zone for privatelink A records. It also allows creating an SQL server database with a SQL script initialization.
5+
A single database is the quickest and simplest deployment option for Azure SQL Database. You manage a single database within a SQL Database server, which is inside an Azure resource group in a specified Azure region with this module.
66

7-
A single database is the quickest and simplest deployment option for Azure SQL Database. You manage a single database within a SQL Database server, which is inside an Azure resource group in a specified Azure region. In this quickstart, you create a new resource group and SQL server for the new database.
8-
9-
You can create a single database in the provisioned or serverless compute tier. A provisioned database is pre-allocated a fixed amount of compute resources, including CPU and memory, and uses one of two purchasing models. This quickstart creates a provisioned database using the vCore-based purchasing model, but you can also choose a DTU-based model.
7+
You can also create a single database in the provisioned or serverless compute tier. A provisioned database is pre-allocated a fixed amount of computing resources, including CPU and memory, and uses one of two purchasing models. This module creates a provisioned database using the vCore-based purchasing model, but you can choose a DTU-based model as well.
108

119
## These types of resources are supported
1210

@@ -16,54 +14,79 @@ You can create a single database in the provisioned or serverless compute tier.
1614
* [Active Directory Administrator](https://www.terraform.io/docs/providers/azurerm/r/sql_active_directory_administrator.html)
1715
* [Firewall rule for azure services, resources, and client IP](https://www.terraform.io/docs/providers/azurerm/r/sql_firewall_rule.html)
1816
* [SQL Failover Group](https://www.terraform.io/docs/providers/azurerm/r/sql_failover_group.html)
19-
* [SQL Private Endpoint](https://www.terraform.io/docs/providers/azurerm/r/private_endpoint.html)
20-
* [Private DNS zone for privatelink A records](https://www.terraform.io/docs/providers/azurerm/r/private_dns_zone.html)
17+
* [Private Endpoints](https://www.terraform.io/docs/providers/azurerm/r/private_endpoint.html)
18+
* [Private DNS zone for `privatelink` A records](https://www.terraform.io/docs/providers/azurerm/r/private_dns_zone.html)
2119
* [SQL Script execution to create Database](https://docs.microsoft.com/en-us/sql/ssms/scripting/sqlcmd-run-transact-sql-script-files?view=sql-server-ver15)
22-
23-
>*Note: If you prefer private endpoints feature, firewall rules are not relevant. However, this module can support both the Public and Private availability of the Database. Disable the firewall rules, in case you want to create the database using private endpoints only.*
20+
* [SQL Server and Database Extended Auditing Policy](https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview)
21+
* [Azure Defender for SQL](https://docs.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql)
22+
* [SQL Vulnerability Assessment](https://docs.microsoft.com/en-us/azure/azure-sql/database/sql-vulnerability-assessment)
23+
* [SQL Log Monitoring and Diagnostics](https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal)
2424

2525
## Module Usage
2626

2727
### Simple Azure SQL single database using private Endpoint
2828

29-
Following example to create a SQL single database using private endpoints. This module also supports optional AD admin user for DB, Audit Policies, and creation of database schema using SQL script.
30-
31-
```
29+
```hcl
3230
module "mssql-server" {
33-
source = "kumarvna/mssql-db/azurerm"
34-
version = "1.0.0"
35-
36-
# Resource Group, VNet and Subnet declarations
37-
create_resource_group = false
38-
resource_group_name = "rg-demo-westeurope-01"
39-
location = "westeurope"
40-
virtual_network_name = "vnet-demo-westeurope-001"
41-
private_subnet_address_prefix = "10.0.5.0/29"
42-
43-
# SQL Server and Database scaling options
44-
sqlserver_name = "sqldbserver-db01"
45-
database_name = "demomssqldb"
46-
sql_database_edition = "Standard"
47-
sqldb_service_objective_name = "S1"
48-
49-
# SQL Server and Database Audit policies
50-
enable_auditing_policy = true
51-
enable_threat_detection_policy = true
52-
log_retention_days = 30
53-
email_addresses_for_alerts = ["[email protected]"]
54-
55-
# AD administrator for an Azure SQL server
56-
enable_sql_ad_admin = true
57-
ad_admin_login_name = "[email protected]"
58-
59-
# Private Endpoint for Sql servers
60-
enable_private_endpoint = true
61-
62-
# Create and initialize a database with SQL script
63-
initialize_sql_script_execution = false
64-
sqldb_init_script_file = "./artifacts/db-init-sample.sql"
65-
66-
# Tags for Azure Resources
31+
source = "kumarvna/mssql-db/azurerm"
32+
version = "1.1.0"
33+
34+
# By default, this module will not create a resource group
35+
# proivde a name to use an existing resource group, specify the existing resource group name,
36+
# and set the argument to `create_resource_group = false`. Location will be same as existing RG.
37+
resource_group_name = "rg-shared-westeurope-01"
38+
location = "westeurope"
39+
virtual_network_name = "vnet-shared-hub-westeurope-001"
40+
41+
# SQL Server and Database details
42+
# The valid service objective name for the database include S0, S1, S2, S3, P1, P2, P4, P6, P11
43+
sqlserver_name = "sqldbserver01"
44+
database_name = "demomssqldb"
45+
sql_database_edition = "Standard"
46+
sqldb_service_objective_name = "S1"
47+
48+
# SQL server extended auditing policy defaults to `true`. To turn off set enable_sql_server_extended_auditing_policy to `false`
49+
# DB extended auditing policy defaults to `false`. to tun on set the variable `enable_database_extended_auditing_policy` to `true`
50+
# To enable Azure Defender for Azure SQL database servers set `enable_threat_detection_policy` to true
51+
enable_threat_detection_policy = true
52+
log_retention_days = 30
53+
54+
# schedule scan notifications to the subscription administrators
55+
# Manages the Vulnerability Assessment for a MS SQL Server set `enable_vulnerability_assessment` to `true`
56+
enable_vulnerability_assessment = false
57+
sql_admin_email_addresses = ["[email protected]", "[email protected]"]
58+
59+
# AD administrator for an Azure SQL server
60+
# Allows you to set a user or group as the AD administrator for an Azure SQL server
61+
ad_admin_login_name = "[email protected]"
62+
63+
# (Optional) To enable Azure Monitoring for Azure SQL database including audit logs
64+
# log analytic workspace name required
65+
enable_log_monitoring = true
66+
log_analytics_workspace_name = "loganalytics-we-sharedtest2"
67+
68+
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
69+
enable_firewall_rules = true
70+
firewall_rules = [
71+
{
72+
name = "access-to-azure"
73+
start_ip_address = "0.0.0.0"
74+
end_ip_address = "0.0.0.0"
75+
},
76+
{
77+
name = "desktop-ip"
78+
start_ip_address = "49.204.225.134"
79+
end_ip_address = "49.204.225.134"
80+
}
81+
]
82+
83+
# Create and initialize a database with custom SQL script
84+
# need sqlcmd utility to run this command
85+
# your desktop public IP must be added firewall rules to run this command
86+
initialize_sql_script_execution = true
87+
sqldb_init_script_file = "../artifacts/db-init-sample.sql"
88+
89+
# Tags for Azure Resources
6790
tags = {
6891
Terraform = "true"
6992
Environment = "dev"
@@ -72,66 +95,11 @@ module "mssql-server" {
7295
}
7396
```
7497

75-
### Azure SQL database creation using geo-replication with auto-failover groups
98+
## Default Local Administrator and the Password
7699

77-
Following example to create a SQL database using geo-replication with auto-failover groups. This module also supports optional AD admin user for DB, Audit Policies, Firewall Rules, and creation of database schema using SQL script.
78-
79-
```
80-
module "mssql-server" {
81-
source = "kumarvna/mssql-db/azurerm"
82-
version = "1.0.0"
83-
84-
# Resource Group, VNet and Subnet declarations
85-
create_resource_group = false
86-
resource_group_name = "rg-demo-westeurope-01"
87-
location = "westeurope"
88-
virtual_network_name = "vnet-demo-westeurope-001"
89-
private_subnet_address_prefix = "10.0.5.0/29"
90-
91-
# SQL Server and Database scaling options
92-
sqlserver_name = "sqldbserver-db01"
93-
database_name = "demomssqldb"
94-
sql_database_edition = "Standard"
95-
sqldb_service_objective_name = "S1"
96-
97-
# SQL Server and Database Audit policies
98-
enable_auditing_policy = true
99-
enable_threat_detection_policy = true
100-
log_retention_days = 30
101-
email_addresses_for_alerts = ["[email protected]"]
102-
103-
# AD administrator for an Azure SQL server
104-
enable_sql_ad_admin = true
105-
ad_admin_login_name = "[email protected]"
106-
107-
# Firewall Rules to allow azure and external clients
108-
enable_firewall_rules = true
109-
firewall_rules = [
110-
{name = "access-to-azure"
111-
start_ip_address = "0.0.0.0"
112-
end_ip_address = "0.0.0.0"},
113-
{name = "desktop-ip"
114-
start_ip_address = "123.201.75.71"
115-
end_ip_address = "123.201.75.71"}]
116-
117-
# Sql failover group
118-
enable_failover_group = true
119-
secondary_sql_server_location = "northeurope"
120-
121-
# Create and initialize a database with SQL script
122-
initialize_sql_script_execution = false
123-
sqldb_init_script_file = "./artifacts/db-init-sample.sql"
124-
125-
# Tags for Azure Resources
126-
tags = {
127-
Terraform = "true"
128-
Environment = "dev"
129-
Owner = "test-user"
130-
}
131-
}
132-
```
100+
This module utilizes __`sqladmin`__ as a local administrator on SQL servers. If you want to you use custom username, then specify the same by setting up the argument `admin_username` with a valid user string.
133101

134-
## Requirements
102+
By default, this module generates a strong password for all virtual machines also allows you to change the length of the random password (currently 24) using the `random_password_length = 32` variable. If you want to set the custom password, specify the argument `admin_password` with a valid string.
135103

136104
### Resource Group
137105

@@ -141,38 +109,41 @@ By default, this module will not create a resource group and the name of an exis
141109

142110
### VNet and Subnets
143111

144-
This module is not going to create a Vnet and corresponding services. However, this module expect you to provide VPC and Subnet address space for private end points.
112+
This module is not going to create a `VNet` and corresponding services. However, this module expect you to provide VPC and Subnet address space for private end points.
145113

146-
Deploy Azure Vnet terraform module to overcome with this dependency. The [`terraform-azurerm-vnet`](https://github.com/tietoevry-cloud-infra/terraform-azurerm-vnet) module currently available from [GitHub](https://github.com/tietoevry-cloud-infra/terraform-azurerm-vnet), also aligned with this module.
114+
Deploy Azure VNet terraform module to overcome with this dependency. The [`terraform-azurerm-vnet`](https://github.com/tietoevry-cloud-infra/terraform-azurerm-vnet) module currently available from [GitHub](https://github.com/tietoevry-cloud-infra/terraform-azurerm-vnet), also aligned with this module.
147115

148116
### `sqlcmd` utility
149117

150118
This module uses the tool [slqcmd](https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15) as a local provisioner to connect and inject the SQL initialization. Therefore, the following dependencies must be installed beforehand on your machine:
151119

152120
* [Microsoft OBDC Driver](https://www.microsoft.com/en-us/download/details.aspx?id=56567)
153121

154-
* Install the Microsoft sqlcmd utility on [Ubuntu](https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-tools?view=sql-server-ver15#ubuntu) or on [Windows](https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15)
122+
* Install the Microsoft `sqlcmd` utility on [Ubuntu](https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-setup-tools?view=sql-server-ver15#ubuntu) or on [Windows](https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15)
123+
124+
## Advance usage of module
125+
126+
### `extended_auditing_policy` - Auditing for SQL Database
155127

156-
## `extended_auditing_policy` - Auditing for SQL Database
128+
Auditing for Azure SQL Database and servers tracks database events and writes them to an audit log in an Azure storage account. If server auditing is enabled, it always applies to the database. The database will be audited, regardless of the database auditing settings.
157129

158-
Auditing for Azure SQL Database tracks database events and writes them to an audit log in an Azure storage account, Log Analytics workspace, or Event Hubs. If server auditing is enabled, it always applies to the database. The database will be audited, regardless of the database auditing settings.
159-
By default, this feature not enabled on the module. To enable the threat detection policy for the database, set the argument `enable_auditing_policy = true`.
130+
By default, this feature enabled on SQL servers. To manage the threat detection policy for the severs set `enable_sql_server_extended_auditing_policy`to valid string. For database auditing, set the argument `enable_database_extended_auditing_policy` to `true`
160131

161-
## `threat_detection_policy` - SQL Database Advanced Threat Protection
132+
### `threat_detection_policy` - SQL Database Advanced Threat Protection
162133

163134
Advanced Threat Protection for single and pooled databases detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Advanced Threat Protection can identify Potential SQL injection, Access from unusual location or data center, Access from the unfamiliar principal or potentially harmful application, and Brute force SQL credentials - see more details in Advanced Threat Protection alerts.
164135

165136
By default, this feature not enabled on this module. To enable the threat detection policy for the database, set the argument `enable_threat_detection_policy = true`.
166137

167138
> #### Note: Enabling `extended_auditing_policy` and `threat_detection_policy` features on SQL servers and database going to create a storage account to keep all audit logs. Log retention policy to be configured to keep the size within limits for this storage account. Note that this module creates resources that can cost money
168139
169-
## Adding Active Directory Administrator to SQL Database
140+
### Adding Active Directory Administrator to SQL Database
170141

171142
Azure Active Directory authentication is a mechanism of connecting to Microsoft Azure SQL Database by using identities in Azure Active Directory (Azure AD). This module adds the provided Azure Active Directory user/group to SQL Database as an administrator so that the user can login to this database with Azure AD authentication.
172143

173-
By default, this feature not enabled on this module. To add the Active Directory Administrator to SQL database, set the argument `enable_sql_ad_admin = true` and provide valid Azure AD user login name (`ad_admin_login_name`).
144+
By default, this feature not enabled on this module. To add the Active Directory Administrator to SQL database, set the argument `ad_admin_login_name` with a valid Azure AD user login name.
174145

175-
## Configuring the Azure SQL Database Firewall
146+
### Configuring the Azure SQL Database Firewall
176147

177148
The Azure SQL Database firewall lets you decide which IP addresses may or may not have access to either your Azure SQL Server or your Azure SQL database. When creating an Azure SQL Database, the firewall needs to be configured before anyone will be able to access the database.
178149

0 commit comments

Comments
 (0)