From 68f61b42e5b7c33e6ff139701caf8df190c322e6 Mon Sep 17 00:00:00 2001
From: Charles J Shea <58995422+cshea-msft@users.noreply.github.com>
Date: Wed, 26 Jun 2024 19:43:20 -0400
Subject: [PATCH] v0.3.0 (#56)
* fixed module_name locals
* added private link scope file in root, created new network isolation example.
* fixed formatting and linting
* updating formatting
* fixed variable
* removed variable
* avm fix
* updated variables and examples
* add for_each
* fixed example
* fixed linting
* updating linting errors
* fixed linting error
---
README.md | 39 +++-
examples/default/main.tf | 2 +-
examples/deploy_network_isolation/README.md | 192 ++++++++++++++++++
examples/deploy_network_isolation/_footer.md | 4 +
examples/deploy_network_isolation/_header.md | 11 +
examples/deploy_network_isolation/locals.tf | 15 ++
examples/deploy_network_isolation/main.tf | 94 +++++++++
.../deploy_network_isolation/variables.tf | 9 +
locals.telemetry.tf | 2 +-
locals.tf | 15 +-
locals.version.tf.json | 2 +-
main.law.tf | 33 ---
main.privateendpoint.tf | 11 +-
main.privatelinkscope.tf | 16 ++
main.tf | 33 +++
variables.tf | 31 ++-
16 files changed, 447 insertions(+), 62 deletions(-)
create mode 100644 examples/deploy_network_isolation/README.md
create mode 100644 examples/deploy_network_isolation/_footer.md
create mode 100644 examples/deploy_network_isolation/_header.md
create mode 100644 examples/deploy_network_isolation/locals.tf
create mode 100644 examples/deploy_network_isolation/main.tf
create mode 100644 examples/deploy_network_isolation/variables.tf
delete mode 100644 main.law.tf
create mode 100644 main.privatelinkscope.tf
diff --git a/README.md b/README.md
index 1779fa3..3160cbf 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,8 @@ The following resources are used by this module:
- [azurerm_log_analytics_workspace.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/log_analytics_workspace) (resource)
- [azurerm_management_lock.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/management_lock) (resource)
- [azurerm_monitor_diagnostic_setting.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_diagnostic_setting) (resource)
+- [azurerm_monitor_private_link_scope.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_private_link_scope) (resource)
+- [azurerm_monitor_private_link_scoped_service.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/monitor_private_link_scoped_service) (resource)
- [azurerm_private_endpoint.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) (resource)
- [azurerm_private_endpoint_application_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint_application_security_group_association) (resource)
- [azurerm_resource_group_template_deployment.telemetry](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group_template_deployment) (resource)
@@ -258,6 +260,35 @@ object({
Default: `null`
+### [monitor\_private\_link\_scope](#input\_monitor\_private\_link\_scope)
+
+Description: A map of objects representing Azure Monitor Private Link Scopes. Each object can contain the following attributes:
+ - ingestion\_access\_mode: (Optional) The default ingestion access mode for the associated private endpoints in scope. Possible values are 'Open' and 'PrivateOnly'. Defaults to 'Open'.
+ - name: The name of the Azure Monitor Private Link Scope. Changing this forces a new resource to be created.
+ - query\_access\_mode: (Optional) The default query access mode for the associated private endpoints in scope. Possible values are 'Open' and 'PrivateOnly'. Defaults to 'Open'.
+ - tags: (Optional) A mapping of tags which should be assigned to the Azure Monitor Private Link Scope.
+
+Type:
+
+```hcl
+map(object({
+ ingestion_access_mode = optional(string, "PrivateOnly")
+ name = optional(string, null)
+ query_access_mode = optional(string, "PrivateOnly")
+ tags = optional(map(string), null)
+ }))
+```
+
+Default: `{}`
+
+### [monitor\_private\_link\_scoped\_service\_name](#input\_monitor\_private\_link\_scoped\_service\_name)
+
+Description: (Required) The name of the Azure Monitor Private Link Scoped Service. Changing this forces a new resource to be created.
+
+Type: `string`
+
+Default: `null`
+
### [private\_endpoints](#input\_private\_endpoints)
Description: A map of private endpoints to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
@@ -315,14 +346,6 @@ map(object({
Default: `{}`
-### [private\_endpoints\_manage\_dns\_zone\_group](#input\_private\_endpoints\_manage\_dns\_zone\_group)
-
-Description: Whether to manage private DNS zone groups with this module. If set to false, you must manage private DNS zone groups externally, e.g. using Azure Policy.
-
-Type: `bool`
-
-Default: `true`
-
### [role\_assignments](#input\_role\_assignments)
Description: A map of role assignments to create on the . The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
diff --git a/examples/default/main.tf b/examples/default/main.tf
index 4268c7d..71051d7 100644
--- a/examples/default/main.tf
+++ b/examples/default/main.tf
@@ -47,4 +47,4 @@ module "log_analytics_workspace" {
log_analytics_workspace_identity = {
type = "SystemAssigned"
}
-}
+}
\ No newline at end of file
diff --git a/examples/deploy_network_isolation/README.md b/examples/deploy_network_isolation/README.md
new file mode 100644
index 0000000..d8b00ba
--- /dev/null
+++ b/examples/deploy_network_isolation/README.md
@@ -0,0 +1,192 @@
+
+# Deploy Network Isolation
+
+This examples deploys network isolation with log analytics workspace using Private Endpoints and Azure Monitor Private Link Service.
+
+- Log Analytics Workspace
+- Private Endpoint
+- Virtual Network
+- Subnet
+- Private DNS Zone
+- Azure Monitor Private Link Scope
+- Azure Monitor Private Link Scope Service
+
+```hcl
+terraform {
+ required_version = ">= 1.3.0"
+ required_providers {
+ azurerm = {
+ source = "hashicorp/azurerm"
+ version = ">= 3.7.0, < 4.0.0"
+ }
+ random = {
+ source = "hashicorp/random"
+ version = ">= 3.5.0, < 4.0.0"
+ }
+ }
+}
+
+provider "azurerm" {
+ features {}
+}
+
+# This ensures we have unique CAF compliant names for our resources.
+module "naming" {
+ source = "Azure/naming/azurerm"
+ version = "0.3.0"
+}
+
+# This picks a random region from the list of regions.
+resource "random_integer" "region_index" {
+ max = length(local.azure_regions) - 1
+ min = 0
+}
+
+# This is required for resource modules
+resource "azurerm_resource_group" "this" {
+ location = local.azure_regions[random_integer.region_index.result]
+ name = module.naming.resource_group.name_unique
+}
+
+module "vnet" {
+ source = "Azure/avm-res-network-virtualnetwork/azurerm"
+ version = "~> 0.2.3"
+ name = module.naming.virtual_network.name_unique
+ resource_group_name = azurerm_resource_group.this.name
+ location = azurerm_resource_group.this.location
+ address_space = ["10.0.0.0/16"]
+ subnets = {
+ subnet0 = {
+ name = module.naming.subnet.name_unique
+ address_prefixes = ["10.0.0.0/24"]
+ }
+ }
+}
+
+module "privatednszone" {
+ source = "Azure/avm-res-network-privatednszone/azurerm"
+ version = "~> 0.1.1"
+ domain_name = "privatelink.workspace.azure.net"
+ resource_group_name = azurerm_resource_group.this.name
+ virtual_network_links = {
+ vnetlink0 = {
+ vnetlinkname = "dnslinktovnet"
+ vnetid = module.vnet.resource.id
+ }
+ }
+}
+
+# This is the module call
+module "law" {
+ source = "../../"
+ # source = "Azure/avm-res-operationalinsights-workspace/azurerm"
+ enable_telemetry = var.enable_telemetry
+ location = azurerm_resource_group.this.location
+ resource_group_name = azurerm_resource_group.this.name
+ name = "thislaworkspace"
+ log_analytics_workspace_retention_in_days = 30
+ log_analytics_workspace_sku = "PerGB2018"
+ log_analytics_workspace_identity = {
+ type = "SystemAssigned"
+ }
+ monitor_private_link_scope = {
+ scope0 = {
+ name = "law_pl_scope"
+ ingestion_access_mode = "PrivateOnly"
+ query_access_mode = "PrivateOnly"
+ }
+ }
+ monitor_private_link_scoped_service_name = "law_pl_service"
+ private_endpoints = {
+ pe1 = {
+ name = module.naming.private_endpoint.name_unique
+ subnet_resource_id = module.vnet.subnets["subnet0"].resource.id
+ private_dns_zone_resource_ids = [module.privatednszone.private_dnz_zone_output.id]
+ network_interface_name = "nic-pe-law"
+ }
+ }
+}
+```
+
+
+## Requirements
+
+The following requirements are needed by this module:
+
+- [terraform](#requirement\_terraform) (>= 1.3.0)
+
+- [azurerm](#requirement\_azurerm) (>= 3.7.0, < 4.0.0)
+
+- [random](#requirement\_random) (>= 3.5.0, < 4.0.0)
+
+## Providers
+
+The following providers are used by this module:
+
+- [azurerm](#provider\_azurerm) (>= 3.7.0, < 4.0.0)
+
+- [random](#provider\_random) (>= 3.5.0, < 4.0.0)
+
+## Resources
+
+The following resources are used by this module:
+
+- [azurerm_resource_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) (resource)
+- [random_integer.region_index](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer) (resource)
+
+
+## Required Inputs
+
+No required inputs.
+
+## Optional Inputs
+
+The following input variables are optional (have default values):
+
+### [enable\_telemetry](#input\_enable\_telemetry)
+
+Description: This variable controls whether or not telemetry is enabled for the module.
+For more information see https://aka.ms/avm/telemetryinfo.
+If it is set to false, then no telemetry will be collected.
+
+Type: `bool`
+
+Default: `true`
+
+## Outputs
+
+No outputs.
+
+## Modules
+
+The following Modules are called:
+
+### [law](#module\_law)
+
+Source: ../../
+
+Version:
+
+### [naming](#module\_naming)
+
+Source: Azure/naming/azurerm
+
+Version: 0.3.0
+
+### [privatednszone](#module\_privatednszone)
+
+Source: Azure/avm-res-network-privatednszone/azurerm
+
+Version: ~> 0.1.1
+
+### [vnet](#module\_vnet)
+
+Source: Azure/avm-res-network-virtualnetwork/azurerm
+
+Version: ~> 0.2.3
+
+
+## Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at . You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
+
\ No newline at end of file
diff --git a/examples/deploy_network_isolation/_footer.md b/examples/deploy_network_isolation/_footer.md
new file mode 100644
index 0000000..bc56bcb
--- /dev/null
+++ b/examples/deploy_network_isolation/_footer.md
@@ -0,0 +1,4 @@
+
+## Data Collection
+
+The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at . You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
diff --git a/examples/deploy_network_isolation/_header.md b/examples/deploy_network_isolation/_header.md
new file mode 100644
index 0000000..d341373
--- /dev/null
+++ b/examples/deploy_network_isolation/_header.md
@@ -0,0 +1,11 @@
+# Deploy Network Isolation
+
+This examples deploys network isolation with log analytics workspace using Private Endpoints and Azure Monitor Private Link Service.
+
+- Log Analytics Workspace
+- Private Endpoint
+- Virtual Network
+- Subnet
+- Private DNS Zone
+- Azure Monitor Private Link Scope
+- Azure Monitor Private Link Scope Service
diff --git a/examples/deploy_network_isolation/locals.tf b/examples/deploy_network_isolation/locals.tf
new file mode 100644
index 0000000..9842c61
--- /dev/null
+++ b/examples/deploy_network_isolation/locals.tf
@@ -0,0 +1,15 @@
+locals {
+ azure_regions = [
+ "westeurope",
+ "northeurope",
+ "eastus",
+ "eastus2",
+ "westus",
+ "westus2",
+ "southcentralus",
+ "northcentralus",
+ "centralus",
+ "eastasia",
+ "southeastasia",
+ ]
+}
diff --git a/examples/deploy_network_isolation/main.tf b/examples/deploy_network_isolation/main.tf
new file mode 100644
index 0000000..104cadb
--- /dev/null
+++ b/examples/deploy_network_isolation/main.tf
@@ -0,0 +1,94 @@
+terraform {
+ required_version = ">= 1.3.0"
+ required_providers {
+ azurerm = {
+ source = "hashicorp/azurerm"
+ version = ">= 3.7.0, < 4.0.0"
+ }
+ random = {
+ source = "hashicorp/random"
+ version = ">= 3.5.0, < 4.0.0"
+ }
+ }
+}
+
+provider "azurerm" {
+ features {}
+}
+
+# This ensures we have unique CAF compliant names for our resources.
+module "naming" {
+ source = "Azure/naming/azurerm"
+ version = "0.3.0"
+}
+
+# This picks a random region from the list of regions.
+resource "random_integer" "region_index" {
+ max = length(local.azure_regions) - 1
+ min = 0
+}
+
+# This is required for resource modules
+resource "azurerm_resource_group" "this" {
+ location = local.azure_regions[random_integer.region_index.result]
+ name = module.naming.resource_group.name_unique
+}
+
+module "vnet" {
+ source = "Azure/avm-res-network-virtualnetwork/azurerm"
+ version = "~> 0.2.3"
+ name = module.naming.virtual_network.name_unique
+ resource_group_name = azurerm_resource_group.this.name
+ location = azurerm_resource_group.this.location
+ address_space = ["10.0.0.0/16"]
+ subnets = {
+ subnet0 = {
+ name = module.naming.subnet.name_unique
+ address_prefixes = ["10.0.0.0/24"]
+ }
+ }
+}
+
+module "privatednszone" {
+ source = "Azure/avm-res-network-privatednszone/azurerm"
+ version = "~> 0.1.1"
+ domain_name = "privatelink.workspace.azure.net"
+ resource_group_name = azurerm_resource_group.this.name
+ virtual_network_links = {
+ vnetlink0 = {
+ vnetlinkname = "dnslinktovnet"
+ vnetid = module.vnet.resource.id
+ }
+ }
+}
+
+# This is the module call
+module "law" {
+ source = "../../"
+ # source = "Azure/avm-res-operationalinsights-workspace/azurerm"
+ enable_telemetry = var.enable_telemetry
+ location = azurerm_resource_group.this.location
+ resource_group_name = azurerm_resource_group.this.name
+ name = "thislaworkspace"
+ log_analytics_workspace_retention_in_days = 30
+ log_analytics_workspace_sku = "PerGB2018"
+ log_analytics_workspace_identity = {
+ type = "SystemAssigned"
+ }
+ monitor_private_link_scope = {
+ scope0 = {
+ name = "law_pl_scope"
+ ingestion_access_mode = "PrivateOnly"
+ query_access_mode = "PrivateOnly"
+ }
+ }
+ monitor_private_link_scoped_service_name = "law_pl_service"
+ private_endpoints = {
+ pe1 = {
+ name = module.naming.private_endpoint.name_unique
+ subnet_resource_id = module.vnet.subnets["subnet0"].resource.id
+ private_dns_zone_resource_ids = [module.privatednszone.private_dnz_zone_output.id]
+ network_interface_name = "nic-pe-law"
+ }
+ }
+}
\ No newline at end of file
diff --git a/examples/deploy_network_isolation/variables.tf b/examples/deploy_network_isolation/variables.tf
new file mode 100644
index 0000000..1318944
--- /dev/null
+++ b/examples/deploy_network_isolation/variables.tf
@@ -0,0 +1,9 @@
+variable "enable_telemetry" {
+ type = bool
+ default = true
+ description = < assoc }
+ ]) : "${assoc.pe_key}-${assoc.asg_key}-${assoc.pl_key}" => assoc }
}
locals {
diff --git a/locals.version.tf.json b/locals.version.tf.json
index 2e987bc..be64eb4 100644
--- a/locals.version.tf.json
+++ b/locals.version.tf.json
@@ -1,5 +1,5 @@
{
"locals": {
- "module_version": "0.2.1"
+ "module_version": "0.3.0"
}
}
diff --git a/main.law.tf b/main.law.tf
deleted file mode 100644
index 4e965ad..0000000
--- a/main.law.tf
+++ /dev/null
@@ -1,33 +0,0 @@
-# TODO: insert resources here.
-resource "azurerm_log_analytics_workspace" "this" {
- location = var.location
- name = var.name
- resource_group_name = var.resource_group_name
- allow_resource_only_permissions = var.log_analytics_workspace_allow_resource_only_permissions
- cmk_for_query_forced = var.log_analytics_workspace_cmk_for_query_forced
- daily_quota_gb = var.log_analytics_workspace_daily_quota_gb
- internet_ingestion_enabled = var.log_analytics_workspace_internet_ingestion_enabled
- internet_query_enabled = var.log_analytics_workspace_internet_query_enabled
- local_authentication_disabled = var.log_analytics_workspace_local_authentication_disabled
- reservation_capacity_in_gb_per_day = var.log_analytics_workspace_reservation_capacity_in_gb_per_day
- retention_in_days = var.log_analytics_workspace_retention_in_days
- sku = var.log_analytics_workspace_sku
- tags = var.tags
-
- dynamic "identity" {
- for_each = var.log_analytics_workspace_identity == null ? [] : [var.log_analytics_workspace_identity]
- content {
- type = identity.value.type
- identity_ids = identity.value.identity_ids
- }
- }
- dynamic "timeouts" {
- for_each = var.log_analytics_workspace_timeouts == null ? [] : [var.log_analytics_workspace_timeouts]
- content {
- create = timeouts.value.create
- delete = timeouts.value.delete
- read = timeouts.value.read
- update = timeouts.value.update
- }
- }
-}
diff --git a/main.privateendpoint.tf b/main.privateendpoint.tf
index 7186da5..2c70ab1 100644
--- a/main.privateendpoint.tf
+++ b/main.privateendpoint.tf
@@ -1,6 +1,7 @@
# TODO remove this code & var.private_endpoints if private link is not support. Note it must be included in this module if it is supported.
resource "azurerm_private_endpoint" "this" {
- for_each = { for k, v in var.private_endpoints : k => v if var.private_endpoints_manage_dns_zone_group }
+ #for_each = { for k, v in var.private_endpoints : k => v if var.private_endpoints_manage_dns_zone_group }
+ for_each = local.private_endpoint_application_security_group_associations
location = each.value.location != null ? each.value.location : var.location
name = each.value.name != null ? each.value.name : "pep-${var.name}"
@@ -12,8 +13,8 @@ resource "azurerm_private_endpoint" "this" {
private_service_connection {
is_manual_connection = false
name = each.value.private_service_connection_name != null ? each.value.private_service_connection_name : "pse-${var.name}"
- private_connection_resource_id = azurerm_log_analytics_workspace.this.id
- subresource_names = ["law"] # map to each.value.subresource_name if there are multiple services.
+ private_connection_resource_id = azurerm_monitor_private_link_scope.this[each.value.pl_key].id
+ subresource_names = ["each.value.azuremonitor"] # map to each.value.subresource_name if there are multiple services.
}
dynamic "ip_configuration" {
for_each = each.value.ip_configurations
@@ -21,8 +22,8 @@ resource "azurerm_private_endpoint" "this" {
content {
name = ip_configuration.value.name
private_ip_address = ip_configuration.value.private_ip_address
- member_name = "law" # map to each.value.subresource_name if there are multiple services.
- subresource_name = "law" # map to each.value.subresource_name if there are multiple services.
+ member_name = "privatelink" # map to each.value.subresource_name if there are multiple services.
+ subresource_name = "privatelink" # map to each.value.subresource_name if there are multiple services.
}
}
dynamic "private_dns_zone_group" {
diff --git a/main.privatelinkscope.tf b/main.privatelinkscope.tf
new file mode 100644
index 0000000..137e0d5
--- /dev/null
+++ b/main.privatelinkscope.tf
@@ -0,0 +1,16 @@
+resource "azurerm_monitor_private_link_scope" "this" {
+ for_each = var.monitor_private_link_scope
+
+ name = each.value.name != null ? each.value.name : "pl-${var.name}"
+ resource_group_name = var.resource_group_name
+ tags = each.value.tags
+}
+
+resource "azurerm_monitor_private_link_scoped_service" "this" {
+ for_each = var.monitor_private_link_scope
+
+ linked_resource_id = azurerm_log_analytics_workspace.this.id
+ name = var.monitor_private_link_scoped_service_name
+ resource_group_name = var.resource_group_name
+ scope_name = azurerm_monitor_private_link_scope.this[each.key].name
+}
\ No newline at end of file
diff --git a/main.tf b/main.tf
index e69de29..4485771 100644
--- a/main.tf
+++ b/main.tf
@@ -0,0 +1,33 @@
+resource "azurerm_log_analytics_workspace" "this" {
+ location = var.location
+ name = var.name
+ resource_group_name = var.resource_group_name
+ allow_resource_only_permissions = var.log_analytics_workspace_allow_resource_only_permissions
+ cmk_for_query_forced = var.log_analytics_workspace_cmk_for_query_forced
+ daily_quota_gb = var.log_analytics_workspace_daily_quota_gb
+ internet_ingestion_enabled = var.log_analytics_workspace_internet_ingestion_enabled
+ internet_query_enabled = var.log_analytics_workspace_internet_query_enabled
+ local_authentication_disabled = var.log_analytics_workspace_local_authentication_disabled
+ reservation_capacity_in_gb_per_day = var.log_analytics_workspace_reservation_capacity_in_gb_per_day
+ retention_in_days = var.log_analytics_workspace_retention_in_days
+ sku = var.log_analytics_workspace_sku
+ tags = var.tags
+
+ dynamic "identity" {
+ for_each = var.log_analytics_workspace_identity == null ? [] : [var.log_analytics_workspace_identity]
+ content {
+ type = identity.value.type
+ identity_ids = identity.value.identity_ids
+ }
+ }
+ dynamic "timeouts" {
+ for_each = var.log_analytics_workspace_timeouts == null ? [] : [var.log_analytics_workspace_timeouts]
+ content {
+ create = timeouts.value.create
+ delete = timeouts.value.delete
+ read = timeouts.value.read
+ update = timeouts.value.update
+ }
+ }
+}
+
diff --git a/variables.tf b/variables.tf
index f86fa8d..0e40387 100644
--- a/variables.tf
+++ b/variables.tf
@@ -201,6 +201,30 @@ variable "log_analytics_workspace_timeouts" {
EOT
}
+variable "monitor_private_link_scope" {
+ type = map(object({
+ ingestion_access_mode = optional(string, "PrivateOnly")
+ name = optional(string, null)
+ query_access_mode = optional(string, "PrivateOnly")
+ tags = optional(map(string), null)
+ }))
+ default = {}
+ description = <