AzureProblem/main.tf at master · eprokofev/AzureProblem · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
# Local values for resource naming and configuration
locals {
  # Resource naming convention: {project}-{environment}-{resource_type}-{location_short}
  location_short = {
    "West Europe"    = "we"
    "East US"        = "eus"
    "East US 2"      = "eus2"
    "Central US"     = "cus"
    "North Europe"   = "ne"
    "Southeast Asia" = "sea"
  }

  location_abbreviation = lookup(local.location_short, var.location, "unk")

  # Generate resource names
  resource_group_name = var.resource_group_name != null ? var.resource_group_name : "rg-${var.project_name}-${var.environment}-${local.location_abbreviation}"
  cosmos_db_name      = var.cosmos_db_name != null ? var.cosmos_db_name : "cosmos-${var.project_name}-${var.environment}-${local.location_abbreviation}"

  # Common tags merged with environment-specific tags
  common_tags = merge(var.common_tags, {
    Environment = var.environment
    Location    = var.location
    DeployedAt  = timestamp()
  })
}

# Current Azure client configuration
data "azurerm_client_config" "current" {}

# Resource Group
resource "azurerm_resource_group" "main" {
  name     = local.resource_group_name
  location = var.location
  tags     = local.common_tags
}

# Random suffix for unique resource names
resource "random_string" "suffix" {
  length  = 6
  special = false
  upper   = false
}

# Networking Module
module "networking" {
  source = "./modules/networking"

  resource_group_name = azurerm_resource_group.main.name
  location           = var.location
  project_name       = var.project_name
  environment        = var.environment

  vnet_address_space                      = var.vnet_address_space
  database_subnet_address_prefixes        = var.database_subnet_address_prefixes
  private_endpoint_subnet_address_prefixes = var.private_endpoint_subnet_address_prefixes

  common_tags = local.common_tags
}

# Security Module
module "security" {
  source = "./modules/security"

  resource_group_name = azurerm_resource_group.main.name
  location           = var.location
  project_name       = var.project_name
  environment        = var.environment
  random_suffix      = random_string.suffix.result

  key_vault_sku          = var.key_vault_sku
  enable_audit_logging   = var.enable_audit_logging
  tenant_id             = data.azurerm_client_config.current.tenant_id

  common_tags = local.common_tags

  depends_on = [azurerm_resource_group.main]
}

# Database Module
module "database" {
  source = "./modules/database"

  resource_group_name = azurerm_resource_group.main.name
  location           = var.location
  project_name       = var.project_name
  environment        = var.environment
  random_suffix      = random_string.suffix.result

  cosmos_db_name             = local.cosmos_db_name
  database_throughput        = var.database_throughput
  backup_retention_days      = var.backup_retention_days
  enable_private_endpoint    = var.enable_private_endpoint
  allowed_ip_ranges         = var.allowed_ip_ranges
  enable_encryption_at_rest = var.enable_encryption_at_rest

  # Network configuration
  virtual_network_id         = module.networking.virtual_network_id
  database_subnet_id        = module.networking.database_subnet_id
  private_endpoint_subnet_id = module.networking.private_endpoint_subnet_id

  # Security configuration
  key_vault_id                        = module.security.key_vault_id
  managed_identity_id                 = module.security.managed_identity_id
  managed_identity_principal_id       = module.security.managed_identity_principal_id
  log_analytics_workspace_id          = module.security.log_analytics_workspace_id
  cosmos_db_key_id                    = var.enable_encryption_at_rest ? module.security.cosmos_db_key_id : null
  private_dns_zone_id                 = module.security.private_dns_zone_id
  private_dns_zone_name               = module.security.private_dns_zone_name
  database_admin_username_secret_name = module.security.database_admin_username_secret_name
  database_admin_password_secret_name = module.security.database_admin_password_secret_name

  # RBAC configuration
  database_administrators = var.database_administrators
  database_readers       = var.database_readers
  database_writers       = var.database_writers

  common_tags = local.common_tags

  depends_on = [
    module.networking,
    module.security
  ]
}