Skip to content

Commit c108688

Browse files
kumarvnakumarvna
committed
adding Postgres server and database config
1 parent 90c5612 commit c108688

File tree

4 files changed

+324
-0
lines changed

4 files changed

+324
-0
lines changed

‎examples/PostgreSQL_Server/main.tf‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
module "postgresql-db" {
2+
// source = "kumarvna/postgresql-db/azurerm"
3+
// version = "1.0.0"
4+
source = "../../"
5+
6+
# By default, this module will create a resource group
7+
# proivde a name to use an existing resource group and set the argument
8+
# to `create_resource_group = false` if you want to existing resoruce group.
9+
# If you use existing resrouce group location will be the same as existing RG.
10+
create_resource_group = false
11+
resource_group_name = "rg-shared-westeurope-01"
12+
location = "westeurope"
13+
14+
# MySQL Server and Database settings
15+
postgresql_server_name = "mypostgresdbsrv01"
16+
17+
postgresql_server_settings = {
18+
sku_name = "GP_Gen5_8"
19+
storage_mb = 640000
20+
version = "9.6"
21+
# default admin user `sqladmin` and can be specified as per the choice here
22+
# by default random password created by this module. required password can be specified here
23+
admin_username = "postgresadmin"
24+
admin_password = "H@Sh1CoR3!"
25+
# Database name, charset and collection arguments
26+
database_name = "demomy-postgres-db"
27+
charset = "utf8"
28+
collation = "utf8_unicode_ci"
29+
# Storage Profile and other optional arguments
30+
auto_grow_enabled = true
31+
backup_retention_days = 7
32+
geo_redundant_backup_enabled = true
33+
public_network_access_enabled = false
34+
ssl_enforcement_enabled = true
35+
ssl_minimal_tls_version_enforced = "TLS1_2"
36+
}
37+
/*
38+
# MySQL Server Parameters
39+
# For more information: https://docs.microsoft.com/en-us/azure/mysql/concepts-server-parameters
40+
mysql_configuration = {
41+
interactive_timeout = "600"
42+
}
43+
44+
# Use Virtual Network service endpoints and rules for Azure Database for MySQL
45+
subnet_id = var.subnet_id
46+
47+
# The URL to a Key Vault custom managed key
48+
key_vault_key_id = var.key_vault_key_id
49+
50+
# To enable Azure Defender for database set `enable_threat_detection_policy` to true
51+
enable_threat_detection_policy = true
52+
log_retention_days = 30
53+
email_addresses_for_alerts = ["user@example.com", "firstname.lastname@example.com"]
54+
55+
# AD administrator for an Azure MySQL server
56+
# Allows you to set a user or group as the AD administrator for an Azure SQL server
57+
ad_admin_login_name = "firstname.lastname@example.com"
58+
59+
# (Optional) To enable Azure Monitoring for Azure MySQL database
60+
# (Optional) Specify `storage_account_name` to save monitoring logs to storage.
61+
log_analytics_workspace_name = "loganalytics-we-sharedtest2"
62+
63+
# Firewall Rules to allow azure and external clients and specific Ip address/ranges.
64+
firewall_rules = {
65+
access-to-azure = {
66+
start_ip_address = "0.0.0.0"
67+
end_ip_address = "0.0.0.0"
68+
},
69+
desktop-ip = {
70+
start_ip_address = "49.204.228.223"
71+
end_ip_address = "49.204.228.223"
72+
}
73+
}
74+
*/
75+
# Tags for Azure Resources
76+
tags = {
77+
Terraform = "true"
78+
Environment = "dev"
79+
Owner = "test-user"
80+
}
81+
}

‎examples/complete/main.tf‎

Whitespace-only changes.

‎main.tf‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
#------------------------------------------------------------
2+
# Local configuration - Default (required).
3+
#------------------------------------------------------------
4+
locals {
5+
resource_group_name = element(coalescelist(data.azurerm_resource_group.rgrp.*.name, azurerm_resource_group.rg.*.name, [""]), 0)
6+
location = element(coalescelist(data.azurerm_resource_group.rgrp.*.location, azurerm_resource_group.rg.*.location, [""]), 0)
7+
# if_threat_detection_policy_enabled = var.enable_threat_detection_policy ? [{}] : []
8+
}
9+
10+
#---------------------------------------------------------
11+
# Resource Group Creation or selection - Default is "false"
12+
#----------------------------------------------------------
13+
data "azurerm_resource_group" "rgrp" {
14+
count = var.create_resource_group == false ? 1 : 0
15+
name = var.resource_group_name
16+
}
17+
18+
resource "azurerm_resource_group" "rg" {
19+
count = var.create_resource_group ? 1 : 0
20+
name = var.resource_group_name
21+
location = var.location
22+
tags = merge({ "Name" = format("%s", var.resource_group_name) }, var.tags, )
23+
}
24+
25+
data "azurerm_client_config" "current" {}
26+
27+
data "azurerm_log_analytics_workspace" "logws" {
28+
count = var.log_analytics_workspace_name != null ? 1 : 0
29+
name = var.log_analytics_workspace_name
30+
resource_group_name = local.resource_group_name
31+
}
32+
33+
#---------------------------------------------------------
34+
# Storage Account to keep Audit logs - Default is "false"
35+
#----------------------------------------------------------
36+
resource "random_string" "str" {
37+
count = var.enable_threat_detection_policy ? 1 : 0
38+
length = 6
39+
special = false
40+
upper = false
41+
keepers = {
42+
name = var.storage_account_name
43+
}
44+
}
45+
46+
resource "azurerm_storage_account" "storeacc" {
47+
count = var.enable_threat_detection_policy ? 1 : 0
48+
name = var.storage_account_name == null ? "stsqlauditlogs${element(concat(random_string.str.*.result, [""]), 0)}" : substr(var.storage_account_name, 0, 24)
49+
resource_group_name = local.resource_group_name
50+
location = local.location
51+
account_kind = "StorageV2"
52+
account_tier = "Standard"
53+
account_replication_type = "GRS"
54+
enable_https_traffic_only = true
55+
min_tls_version = "TLS1_2"
56+
tags = merge({ "Name" = format("%s", "stsqlauditlogs") }, var.tags, )
57+
}
58+
59+
resource "random_password" "main" {
60+
count = var.admin_password == null ? 1 : 0
61+
length = var.random_password_length
62+
min_upper = 4
63+
min_lower = 2
64+
min_numeric = 4
65+
special = false
66+
67+
keepers = {
68+
administrator_login_password = var.postgresql_server_name
69+
}
70+
}
71+
72+
#----------------------------------------------------------------
73+
# Adding PostgreSQL Server creation and settings - Default is "True"
74+
#-----------------------------------------------------------------
75+
resource "azurerm_postgresql_server" "main" {
76+
name = format("%s", var.postgresql_server_name)
77+
resource_group_name = local.resource_group_name
78+
location = local.location
79+
administrator_login = var.admin_username == null ? "sqladmin" : var.admin_username
80+
administrator_login_password = var.admin_password == null ? random_password.main.0.result : var.admin_password
81+
sku_name = var.postgresql_server_settings.sku_name
82+
version = var.postgresql_server_settings.version
83+
storage_mb = var.postgresql_server_settings.storage_mb
84+
auto_grow_enabled = var.postgresql_server_settings.auto_grow_enabled
85+
backup_retention_days = var.postgresql_server_settings.backup_retention_days
86+
geo_redundant_backup_enabled = var.postgresql_server_settings.geo_redundant_backup_enabled
87+
infrastructure_encryption_enabled = var.postgresql_server_settings.infrastructure_encryption_enabled
88+
public_network_access_enabled = var.postgresql_server_settings.public_network_access_enabled
89+
ssl_enforcement_enabled = var.postgresql_server_settings.ssl_enforcement_enabled
90+
ssl_minimal_tls_version_enforced = var.postgresql_server_settings.ssl_minimal_tls_version_enforced
91+
create_mode = var.create_mode
92+
creation_source_server_id = var.create_mode != "Default" ? var.creation_source_server_id : null
93+
restore_point_in_time = var.create_mode == "PointInTimeRestore" ? var.restore_point_in_time : null
94+
tags = merge({ "Name" = format("%s", var.postgresql_server_name) }, var.tags, )
95+
96+
dynamic "identity" {
97+
for_each = var.identity == true ? [1] : [0]
98+
content {
99+
type = "SystemAssigned"
100+
}
101+
}
102+
103+
dynamic "threat_detection_policy" {
104+
for_each = var.enable_threat_detection_policy == true ? [1] : []
105+
content {
106+
enabled = var.enable_threat_detection_policy
107+
disabled_alerts = var.disabled_alerts
108+
email_account_admins = var.email_addresses_for_alerts != null ? true : false
109+
email_addresses = var.email_addresses_for_alerts
110+
retention_days = var.log_retention_days
111+
storage_account_access_key = azurerm_storage_account.storeacc.0.primary_access_key
112+
storage_endpoint = azurerm_storage_account.storeacc.0.primary_blob_endpoint
113+
}
114+
}
115+
}
116+
117+
#------------------------------------------------------------
118+
# Adding PostgreSQL Server Database - Default is "true"
119+
#------------------------------------------------------------
120+
resource "azurerm_postgresql_database" "main" {
121+
name = var.postgresql_server_settings.database_name
122+
resource_group_name = local.resource_group_name
123+
server_name = azurerm_postgresql_server.main.name
124+
charset = var.postgresql_server_settings.charset
125+
collation = var.postgresql_server_settings.collation
126+
}
127+

‎variables.tf‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
variable "create_resource_group" {
2+
description = "Whether to create resource group and use it for all networking resources"
3+
default = true
4+
}
5+
6+
variable "resource_group_name" {
7+
description = "A container that holds related resources for an Azure solution"
8+
default = ""
9+
}
10+
11+
variable "location" {
12+
description = "The location/region to keep all your network resources. To get the list of all locations with table format from azure cli, run 'az account list-locations -o table'"
13+
default = ""
14+
}
15+
16+
variable "subnet_id" {
17+
description = "The resource ID of the subnet"
18+
default = ""
19+
}
20+
21+
variable "log_analytics_workspace_name" {
22+
description = "The name of log analytics workspace name"
23+
default = null
24+
}
25+
26+
variable "random_password_length" {
27+
description = "The desired length of random password created by this module"
28+
default = 24
29+
}
30+
31+
variable "postgresql_server_name" {
32+
description = "PostgreSQL server Name"
33+
default = ""
34+
}
35+
36+
variable "admin_username" {
37+
description = "The administrator login name for the new SQL Server"
38+
default = null
39+
}
40+
41+
variable "admin_password" {
42+
description = "The password associated with the admin_username user"
43+
default = null
44+
}
45+
46+
variable "identity" {
47+
description = "If you want your SQL Server to have an managed identity. Defaults to false."
48+
default = false
49+
}
50+
51+
variable "postgresql_server_settings" {
52+
description = "PostgreSQL server settings"
53+
type = object({
54+
sku_name = string
55+
version = string
56+
storage_mb = number
57+
auto_grow_enabled = optional(bool)
58+
backup_retention_days = optional(number)
59+
geo_redundant_backup_enabled = optional(bool)
60+
infrastructure_encryption_enabled = optional(bool)
61+
public_network_access_enabled = optional(bool)
62+
ssl_enforcement_enabled = optional(bool)
63+
ssl_minimal_tls_version_enforced = optional(string)
64+
database_name = string
65+
charset = string
66+
collation = string
67+
})
68+
}
69+
70+
variable "create_mode" {
71+
description = " The creation mode. Can be used to restore or replicate existing servers. Possible values are `Default`, `Replica`, `GeoRestore`, and `PointInTimeRestore`. Defaults to `Default`"
72+
default = "Default"
73+
}
74+
75+
variable "creation_source_server_id" {
76+
description = "For creation modes other than `Default`, the source server ID to use."
77+
default = null
78+
}
79+
80+
variable "restore_point_in_time" {
81+
description = "When `create_mode` is `PointInTimeRestore`, specifies the point in time to restore from `creation_source_server_id`"
82+
default = null
83+
}
84+
85+
variable "storage_account_name" {
86+
description = "The name of the storage account name"
87+
default = null
88+
}
89+
90+
variable "enable_threat_detection_policy" {
91+
description = "Threat detection policy configuration, known in the API as Server Security Alerts Policy"
92+
default = false
93+
}
94+
95+
variable "email_addresses_for_alerts" {
96+
description = "A list of email addresses which alerts should be sent to."
97+
type = list(any)
98+
default = []
99+
}
100+
101+
variable "disabled_alerts" {
102+
description = "Specifies an array of alerts that are disabled. Allowed values are: Sql_Injection, Sql_Injection_Vulnerability, Access_Anomaly, Data_Exfiltration, Unsafe_Action."
103+
type = list(any)
104+
default = []
105+
}
106+
107+
variable "log_retention_days" {
108+
description = "Specifies the number of days to keep in the Threat Detection audit logs"
109+
default = "30"
110+
}
111+
112+
variable "tags" {
113+
description = "A map of tags to add to all resources"
114+
type = map(string)
115+
default = {}
116+
}

0 commit comments

Comments
 (0)