Er 774 create database dev subscription

.github/workflows/tf-azure-deploy.yml

@@ -0,0 +1,174 @@
+name: 'Terraform Deploy [Azure]'
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Azure deployment environment'
+        required: true
+        default: 'development'
+        type: choice
+        options:
+          - development
+          - staging
+          - production
+
+defaults:
+  run:
+    working-directory: ./terraform-azure
+
+# Permissions for OIDC authentication
+permissions:
+  id-token: write
+  contents: write
+
+env:
+  ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+  ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+  ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+  ARM_USE_OIDC: true
+  ARM_SKIP_PROVIDER_REGISTRATION: true
+
+jobs:
+  terraform-plan:
+    name: 'Terraform Plan'
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    outputs:
+      tfplanExitCode: ${{ steps.tf-plan.outputs.exitcode }}
+
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      # Install the latest version of the Terraform CLI
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: 1.5.6
+          terraform_wrapper: false
+
+      # Initialise a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
+      - name: Terraform Init
+        run: >
+          terraform init
+          -backend-config="resource_group_name=${{ secrets.TERRAFORM_STATE_RESOURCE_GROUP }}"
+          -backend-config="storage_account_name=${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT_NAME }}"
+          -backend-config="container_name=${{ secrets.TERRAFORM_STATE_STORAGE_CONTAINER_NAME }}"
+          -backend-config="key=${{ secrets.TERRAFORM_STATE_KEY }}"
+
+      # Checks that all Terraform configuration files adhere to a canonical format
+      # Will fail the build if not
+      - name: Terraform Format
+        run: terraform fmt -check
+
+      # Generates Terraform input variables
+      - name: Generate Terraform Variables
+        shell: bash
+        env:
+          WEB_SECRETS: ${{ toJSON(secrets) }}
+          WEB_VARS: ${{ toJSON(vars) }}
+        run: |
+          printf '%s\n' "$WEB_SECRETS" > tmp-secrets.json
+          printf '%s\n' "$WEB_VARS" > tmp-vars.json
+          jq 'with_entries(.key |= ascii_downcase)' tmp-secrets.json > web-secrets.auto.tfvars.json
+          jq 'with_entries(.key |= ascii_downcase)' tmp-vars.json > web-vars.auto.tfvars.json
+
+      # Generates an execution plan for Terraform
+      # An exit code of 0 indicated no changes, 1 a terraform failure, 2 there are pending changes.
+      - name: Terraform Plan
+        id: tf-plan
+        run: |
+          export exitcode=0
+          terraform plan -detailed-exitcode -no-color -out tfplan || export exitcode=$?
+
+          echo "exitcode=$exitcode" >> $GITHUB_OUTPUT
+
+          if [ $exitcode -eq 1 ]; then
+            echo Terraform Plan Failed!
+            exit 1
+          else 
+            exit 0
+          fi
+
+      # Save Terraform Plan
+      - name: Publish Terraform Plan
+        uses: actions/upload-artifact@v3
+        with:
+          name: tfplan
+          path: terraform-azure/tfplan
+
+      # Create string output of Terraform Plan
+      - name: Create String Output
+        id: tf-plan-string
+        run: |
+          TERRAFORM_PLAN=$(terraform show -no-color tfplan)
+
+          delimiter="$(openssl rand -hex 8)"
+          echo "summary<<${delimiter}" >> $GITHUB_OUTPUT
+          echo "## Terraform Plan Output" >> $GITHUB_OUTPUT
+          echo "<details><summary>Click to expand</summary>" >> $GITHUB_OUTPUT
+          echo "" >> $GITHUB_OUTPUT
+          echo '```terraform' >> $GITHUB_OUTPUT
+          echo "$TERRAFORM_PLAN" >> $GITHUB_OUTPUT
+          echo '```' >> $GITHUB_OUTPUT
+          echo "</details>" >> $GITHUB_OUTPUT
+          echo "${delimiter}" >> $GITHUB_OUTPUT
+
+      # Publish Terraform Plan as task summary
+      - name: Publish Terraform Plan to Task Summary
+        env:
+          SUMMARY: ${{ steps.tf-plan-string.outputs.summary }}
+        run: |
+          echo "$SUMMARY" >> $GITHUB_STEP_SUMMARY
+
+  terraform-apply:
+    name: 'Terraform Apply'
+    if: needs.terraform-plan.outputs.tfplanExitCode == 2
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    needs: [terraform-plan]
+
+    steps:
+      # Checkout the repository to the GitHub Actions runner
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: 1.5.6
+
+      # Initialise a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
+      - name: Terraform Init
+        run: >
+          terraform init
+          -backend-config="resource_group_name=${{ secrets.TERRAFORM_STATE_RESOURCE_GROUP }}"
+          -backend-config="storage_account_name=${{ secrets.TERRAFORM_STATE_STORAGE_ACCOUNT_NAME }}"
+          -backend-config="container_name=${{ secrets.TERRAFORM_STATE_STORAGE_CONTAINER_NAME }}"
+          -backend-config="key=${{ secrets.TERRAFORM_STATE_KEY }}"
+
+      # Generates Terraform input variables
+      - name: Generate Terraform Variables
+        shell: bash
+        env:
+          WEB_SECRETS: ${{ toJSON(secrets) }}
+          WEB_VARS: ${{ toJSON(vars) }}
+        run: |
+          printf '%s\n' "$WEB_SECRETS" > tmp-secrets.json
+          printf '%s\n' "$WEB_VARS" > tmp-vars.json
+          jq 'with_entries(.key |= ascii_downcase)' tmp-secrets.json > web-secrets.auto.tfvars.json
+          jq 'with_entries(.key |= ascii_downcase)' tmp-vars.json > web-vars.auto.tfvars.json
+
+      # Download saved plan from artifacts
+      - name: Download Terraform Plan
+        uses: actions/download-artifact@v3
+        with:
+          name: tfplan
+          path: terraform-azure/tfplan
+
+      # Terraform Apply
+      - name: Terraform Apply
+        run: terraform apply -auto-approve tfplan/tfplan

.github/workflows/tf-azure-unit-tests.yml

@@ -0,0 +1,47 @@
+name: 'Terraform Unit Tests'
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'terraform-azure/**'
+      - '!terraform-azure/**.md'
+
+defaults:
+  run:
+    working-directory: ./terraform-azure
+
+jobs:
+  terraform-unit-tests:
+    name: 'Run Tests'
+    runs-on: ubuntu-latest
+
+    steps:
+    # Checkout the repository to the GitHub Actions runner
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    # Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
+    - name: Setup Terraform
+      uses: hashicorp/setup-terraform@v2
+
+    # Initialise a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
+    - name: Terraform Init
+      run: terraform init -backend=false
+
+    # Validate terraform files
+    - name: Terraform Validate
+      run: terraform validate
+
+    # Checks that all Terraform configuration files adhere to a canonical format
+    # Will fail the build if not
+    - name: Terraform Format
+      run: terraform fmt -check -recursive
+
+    # Perform a security scan of the terraform code using checkov
+    - name: Run Checkov action
+      id: checkov
+      uses: bridgecrewio/checkov-action@master
+      with:
+        framework: terraform

terraform-azure/terraform-azure-database/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 DFE-Digital
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

terraform-azure/terraform-azure-database/README.md

@@ -0,0 +1,3 @@
+# Azure Database Module
+
+This module provisions a new Azure Database for PostgreSQL instance.

terraform-azure/terraform-azure-database/main.tf

@@ -0,0 +1,49 @@
+resource "random_pet" "name" {
+  length = 1
+}
+
+# Create Database Server
+resource "azurerm_postgresql_flexible_server" "psqlfs" {
+  name                         = "${var.resource_name_prefix}-psqlfs"
+  resource_group_name          = var.resource_group
+  location                     = var.location
+  version                      = "13"
+  delegated_subnet_id          = var.psqlfs_subnet_id
+  private_dns_zone_id          = var.psqlfs_dns_zone_id
+  administrator_login          = var.psqlfs_username
+  administrator_password       = var.psqlfs_password
+  zone                         = "1"
+  storage_mb                   = var.psqlfs_storage
+  sku_name                     = var.psqlfs_sku
+  backup_retention_days        = 7
+  geo_redundant_backup_enabled = var.psqlfs_geo_redundant_backup
+
+  dynamic "high_availability" {
+    for_each = var.psqlfs_ha_enabled ? [1] : []
+    content {
+      mode                      = "SameZone"
+      standby_availability_zone = "1"
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [tags]
+  }
+
+  #checkov:skip=CKV_AZURE_136:Geo-redundant backup is configurable depending on environment
+}
+
+# Allow PostgreSQL extensions
+resource "azurerm_postgresql_flexible_server_configuration" "psqlfs_config" {
+  name      = "azure.extensions"
+  server_id = azurerm_postgresql_flexible_server.psqlfs.id
+  value     = "CITEXT,FUZZYSTRMATCH,PGCRYPTO,PLPGSQL,UUID-OSSP"
+}
+
+# Create Database
+resource "azurerm_postgresql_flexible_server_database" "psqldb" {
+  name      = "${var.resource_name_prefix}-${random_pet.name.id}-psqldb"
+  server_id = azurerm_postgresql_flexible_server.psqlfs.id
+  collation = "en_US.utf8"
+  charset   = "utf8"
+}

terraform-azure/terraform-azure-database/outputs.tf

@@ -0,0 +1,9 @@
+output "psqlfs_name" {
+  description = "Name of the Database Server"
+  value       = azurerm_postgresql_flexible_server.psqlfs.name
+}
+
+output "psqldb_name" {
+  description = "Name of the Database"
+  value       = azurerm_postgresql_flexible_server_database.psqldb.name
+}

terraform-azure/terraform-azure-database/variables.tf

@@ -0,0 +1,56 @@
+variable "location" {
+  description = "Name of the Azure region to deploy resources"
+  type        = string
+}
+
+variable "resource_group" {
+  description = "Name of the Azure Resource Group to deploy resources"
+  type        = string
+}
+
+variable "resource_name_prefix" {
+  description = "Prefix for resource names"
+  type        = string
+}
+
+variable "psqlfs_subnet_id" {
+  description = "ID of the delegated Subnet for the Database Server"
+  type        = string
+}
+
+variable "psqlfs_dns_zone_id" {
+  description = "ID of the Private DNS Zone for the Database Server"
+  type        = string
+}
+
+variable "psqlfs_sku" {
+  description = "SKU name for the Database Server"
+  type        = string
+}
+
+variable "psqlfs_storage" {
+  description = "Max storage allowed for the Database Server"
+  type        = number
+}
+
+variable "psqlfs_username" {
+  description = "Username of the Database Server"
+  type        = string
+  sensitive   = true
+}
+
+variable "psqlfs_password" {
+  description = "Password of the Database Server"
+  type        = string
+  sensitive   = true
+}
+
+variable "psqlfs_geo_redundant_backup" {
+  description = "Geo-redundant backup storage enabled"
+  type        = bool
+}
+
+variable "psqlfs_ha_enabled" {
+  description = "Enable high availability"
+  type        = bool
+}

terraform-azure/terraform-azure-network/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 DFE-Digital
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

terraform-azure/terraform-azure-network/README.md

@@ -0,0 +1,3 @@
+# Azure Network Module
+
+This module provisions the necessary network related resources such as a VNET and Subnets to provision a web application and database in Azure.