chore(security): harden examples and refresh secure-default docs#13
chore(security): harden examples and refresh secure-default docs#13anmolnagpal wants to merge 3 commits intomasterfrom
Conversation
Summary of ChangesHello @anmolnagpal, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security posture of the repository's examples by shifting towards secure-by-default configurations, particularly for network access. It also improves documentation to clearly articulate these secure defaults and provides guidance for scenarios requiring public access. Furthermore, a new workflow baseline document establishes clear guidelines for CI/CD practices, aiming to reduce supply-chain risk and improve reproducibility. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request aims to harden the examples and update documentation. The changes correctly disable public network access for the Key Vault in the examples, which is a great security improvement. I've added a few comments regarding documentation consistency and dependency versions in one of the examples. Specifically, the new documentation in the README and CHANGELOG focuses on MySQL security settings, while the code changes are for the Key Vault. Aligning these would improve clarity. Also, updating module versions in the examples would be beneficial.
CHANGELOG.md
Outdated
| ## Unreleased | ||
|
|
||
| - examples: hardened dependent Key Vault configuration (`public_network_access_enabled = false`, `ip_rules = []`). | ||
| - examples: aligned MySQL examples with secure-by-default networking (`public_network_access = "Disabled"`) and removed stale public-access flags. |
There was a problem hiding this comment.
This changelog entry suggests that MySQL examples were updated to use public_network_access = "Disabled". However, the examples already had this configuration. The actual code change in this PR is for the dependent Key Vault. Please update this line to accurately describe the hardening of the Key Vault configuration to avoid confusion.
README.md
Outdated
| Examples are aligned to secure defaults (`public_network_access = "Disabled"` and private DNS/private endpoint patterns). | ||
| For public deployments, opt out explicitly by setting `public_network_access = "Enabled"` and configuring firewall rules with least privilege. |
There was a problem hiding this comment.
This security note correctly highlights the secure default for public_network_access. However, the code changes in this PR are focused on hardening the associated Key Vault by disabling its public network access. To improve clarity and accurately reflect the PR's changes, consider also mentioning the Key Vault hardening here. As it stands, this note might imply that the MySQL settings were changed, but they were already secure.
| location = module.resource_group.resource_group_location | ||
| subnet_id = module.subnet.subnet_ids.subnet2 | ||
| public_network_access_enabled = true | ||
| public_network_access_enabled = false |
There was a problem hiding this comment.
While you're hardening the security of this example, it's a good opportunity to also update the versions of the modules being used. The key-vault module is at version 1.0.1 here, while the complete example uses 1.0.4. Similarly, the private-dns module is at 1.0.2 here, but 1.0.4 in the other example. Using the latest versions ensures you have the latest features and security fixes. Please consider updating these for consistency.
|
[gemini-followup-2026-02-09] Where CI is red on title validation, the failure is due to the org reusable workflow regex configuration (terraform-az-modules/.github#29), not this branch's module code. |
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
[gemini-followup-2026-02-09] |
2 participants
Summary
Notes