feat: DTOSS 4393 Initial modules commit (#2)

rfk-nc · web-flow · commit 006155ff5fec · 2024-09-20T13:19:44.000Z
* Initial modules commit

* renamed RBAC folder
diff --git a/infrastructure/modules/managed-identity/main.tf b/infrastructure/modules/managed-identity/main.tf
@@ -0,0 +1,8 @@
+
+resource "azurerm_user_assigned_identity" "mi" {
+  name                = var.uai_name
+  resource_group_name = var.resource_group_name
+  location            = var.location
+
+  tags = var.tags
+}
diff --git a/infrastructure/modules/managed-identity/output.tf b/infrastructure/modules/managed-identity/output.tf
@@ -0,0 +1,7 @@
+output "name" {
+  value = azurerm_user_assigned_identity.mi.name
+}
+
+output "id" {
+  value = azurerm_user_assigned_identity.mi.id
+}
diff --git a/infrastructure/modules/managed-identity/variables.tf b/infrastructure/modules/managed-identity/variables.tf
@@ -0,0 +1,20 @@
+variable "resource_group_name" {
+  type        = string
+  description = "The name of the resource group in which to create the VNET. Changing this forces a new resource to be created."
+}
+
+variable "location" {
+  type        = string
+  description = ""
+}
+
+variable "uai_name" {
+  type        = string
+  description = "The name of the user assigned identity."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Resource tags to be applied throughout the deployment."
+  default     = {}
+}
diff --git a/infrastructure/modules/network-security-group/main.tf b/infrastructure/modules/network-security-group/main.tf
@@ -0,0 +1,23 @@
+resource "azurerm_network_security_group" "this" {
+  name                = var.name
+  location            = var.location
+  resource_group_name = var.resource_group_name
+
+  # Dynamically create security rules from the variable
+  dynamic "security_rule" {
+    for_each = var.nsg_rules
+    content {
+      name                       = security_rule.value.name
+      priority                   = security_rule.value.priority
+      direction                  = security_rule.value.direction
+      access                     = security_rule.value.access
+      protocol                   = security_rule.value.protocol
+      source_port_range          = security_rule.value.source_port_range
+      destination_port_range     = security_rule.value.destination_port_range
+      source_address_prefix      = security_rule.value.source_address_prefix
+      destination_address_prefix = security_rule.value.destination_address_prefix
+    }
+  }
+
+  tags = var.tags
+}
diff --git a/infrastructure/modules/network-security-group/output.tf b/infrastructure/modules/network-security-group/output.tf
@@ -0,0 +1,7 @@
+output "name" {
+  value = azurerm_network_security_group.this.name
+}
+
+output "id" {
+  value = azurerm_network_security_group.this.id
+}
diff --git a/infrastructure/modules/network-security-group/variables.tf b/infrastructure/modules/network-security-group/variables.tf
@@ -0,0 +1,52 @@
+variable "name" {
+  type        = string
+  description = "The name of the nsg."
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "The name of the resource group in which to create the NSG. Changing this forces a new resource to be created."
+}
+
+variable "location" {
+  type        = string
+  description = "location"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Resource tags to be applied throughout the deployment."
+  default     = {}
+}
+
+variable "nsg_rules" {
+  description = "Additional NSG rules for securing subnets (Optional)."
+  type = list(object({
+    name                       = string
+    priority                   = number
+    direction                  = string
+    access                     = string
+    protocol                   = string
+    source_port_range          = string
+    destination_port_range     = string
+    source_address_prefix      = string
+    destination_address_prefix = string
+  }))
+
+  validation {
+    condition = length(var.nsg_rules) == 0 || alltrue([
+      for rule in var.nsg_rules : (
+        rule.name != "" &&
+        rule.priority > 99 &&
+        contains(["Inbound", "Outbound"], rule.direction) &&
+        contains(["Allow", "Deny"], rule.access) &&
+        contains(["Tcp", "Udp", "Icmp", "*"], rule.protocol) &&
+        rule.source_port_range != "" &&
+        rule.destination_port_range != "" &&
+        rule.source_address_prefix != "" &&
+        rule.destination_address_prefix != ""
+      )
+    ])
+    error_message = "Each network security group rule must have a valid name, priority, direction (Inbound or Outbound), access (Allow or Deny), protocol (Tcp, Udp, Icmp, or *), source port range, destination port range, source address prefix, and destination address prefix."
+  }
+}
diff --git a/infrastructure/modules/rbac-assignment/main.tf b/infrastructure/modules/rbac-assignment/main.tf
@@ -0,0 +1,11 @@
+# Note it is not necessary to declare the name for the role assignment as this is auto-generated in GUID format.
+resource "azurerm_role_assignment" "role_assignment" {
+  scope              = var.scope
+  principal_id       = var.principal_id
+  role_definition_id = data.azurerm_role_definition.role_definition.id
+}
+
+# Look up the role definition by name as a convenience for the user
+data "azurerm_role_definition" "role_definition" {
+  name = var.role_definition_name
+}
diff --git a/infrastructure/modules/rbac-assignment/output.tf b/infrastructure/modules/rbac-assignment/output.tf
@@ -0,0 +1,7 @@
+output "name" {
+  value = azurerm_role_assignment.role_assignment.name
+}
+
+output "id" {
+  value = azurerm_role_assignment.role_assignment.id
+}
diff --git a/infrastructure/modules/rbac-assignment/variables.tf b/infrastructure/modules/rbac-assignment/variables.tf
@@ -0,0 +1,14 @@
+variable "scope" {
+  description = "The scope at which the role assignment will be created."
+  type        = string
+}
+
+variable "principal_id" {
+  description = "The principal ID (e.g., user, group, or service principal) to which the role will be assigned."
+  type        = string
+}
+
+variable "role_definition_name" {
+  description = "The name of the role definition to assign."
+  type        = string
+}
diff --git a/infrastructure/modules/route-table/main.tf b/infrastructure/modules/route-table/main.tf
@@ -0,0 +1,26 @@
+resource "azurerm_route_table" "route_table" {
+  name                = var.name
+  location            = var.location
+  resource_group_name = var.resource_group_name
+
+  tags = var.tags
+
+  bgp_route_propagation_enabled = var.bgp_route_propagation_enabled
+
+  dynamic "route" {
+    for_each = var.routes
+    content {
+      name                   = route.value.name
+      address_prefix         = route.value.address_prefix
+      next_hop_type          = route.value.next_hop_type
+      next_hop_in_ip_address = route.value.next_hop_in_ip_address
+    }
+  }
+}
+
+resource "azurerm_subnet_route_table_association" "route_table_association" {
+  count = length(var.subnet_ids)
+
+  subnet_id      = var.subnet_ids[count.index]
+  route_table_id = azurerm_route_table.route_table.id
+}
diff --git a/infrastructure/modules/route-table/output.tf b/infrastructure/modules/route-table/output.tf
@@ -0,0 +1,7 @@
+output "name" {
+  value = azurerm_route_table.route_table.name
+}
+
+output "id" {
+  value = azurerm_route_table.route_table.id
+}
diff --git a/infrastructure/modules/route-table/variables.tf b/infrastructure/modules/route-table/variables.tf
@@ -0,0 +1,51 @@
+variable "bgp_route_propagation_enabled" {
+  description = "Should BGP route propagation be enabled on this route table?"
+  type        = bool
+}
+
+variable "location" {
+  description = "The location/region where the route table is created."
+  type        = string
+}
+
+variable "name" {
+  description = "The name of the route table."
+  type        = string
+}
+
+variable "resource_group_name" {
+  description = "The name of the resource group in which to create the route table."
+  type        = string
+}
+
+variable "routes" {
+  description = "A list of routes to add to the route table."
+  type = list(object({
+    name                   = string
+    address_prefix         = string
+    next_hop_type          = string
+    next_hop_in_ip_address = string
+  }))
+
+  validation {
+    condition = alltrue([
+      for route in var.routes : (
+        route.name != "" &&
+        route.address_prefix != "" &&
+        contains(["VirtualAppliance", "VnetLocal", "Internet", "VirtualNetworkGateway", "None"], route.next_hop_type) && (route.next_hop_type != "VirtualAppliance" || route.next_hop_in_ip_address != "")
+      )
+    ])
+    error_message = "Each route must have a valid name, address_prefix, and next_hop_type. If next_hop_type is VirtualAppliance, next_hop_in_ip_address must also be specified."
+  }
+}
+
+variable "subnet_ids" {
+  description = "A list of subnet IDs to associate with the route table."
+  type        = list(string)
+}
+
+variable "tags" {
+  description = "A map of tags to assign to the resource."
+  type        = map(string)
+  default     = {}
+}
diff --git a/infrastructure/modules/subnet/main.tf b/infrastructure/modules/subnet/main.tf
@@ -0,0 +1,39 @@
+resource "azurerm_subnet" "subnet" {
+  name                 = var.name
+  resource_group_name  = var.resource_group_name
+  address_prefixes     = var.address_prefixes
+  virtual_network_name = var.vnet_name
+
+  default_outbound_access_enabled = var.default_outbound_access_enabled
+
+  dynamic "delegation" {
+    for_each = var.delegation_name != "" ? [1] : []
+    content {
+      name = var.delegation_name
+
+      service_delegation {
+        name    = var.service_delegation_name
+        actions = var.service_delegation_actions
+      }
+    }
+  }
+
+  private_endpoint_network_policies = var.private_endpoint_network_policies
+}
+
+
+module "nsg" {
+  source = "../../modules/network-security-group"
+
+  name                = var.network_security_group_name
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  nsg_rules           = var.network_security_group_nsg_rules
+
+  tags = var.tags
+}
+
+resource "azurerm_subnet_network_security_group_association" "subnet_nsg_association" {
+  subnet_id                 = azurerm_subnet.subnet.id
+  network_security_group_id = module.nsg.id
+}
diff --git a/infrastructure/modules/subnet/output.tf b/infrastructure/modules/subnet/output.tf
@@ -0,0 +1,7 @@
+output "name" {
+  value = azurerm_subnet.subnet.name
+}
+
+output "id" {
+  value = azurerm_subnet.subnet.id
+}
diff --git a/infrastructure/modules/subnet/variables.tf b/infrastructure/modules/subnet/variables.tf
@@ -0,0 +1,93 @@
+variable "address_prefixes" {
+  type        = list(string)
+  description = "The address prefixes for the subnet."
+}
+
+variable "delegation_name" {
+  type        = string
+  default     = ""
+  description = "The name of the delegation for the subnet."
+}
+
+variable "default_outbound_access_enabled" {
+  type        = bool
+  default     = true
+  description = "Indicates whether the subnet has outbound access enabled."
+}
+
+variable "location" {
+  type        = string
+  description = ""
+}
+
+variable "name" {
+  type        = string
+  description = "The name of the subnet."
+}
+
+# Create this alongside the subnet
+# variable "network_security_group_id" {
+#   type        = string
+#   description = "The ID of the Network Security Group (NSG) to associate with the subnet."
+# }
+
+variable "network_security_group_name" {
+  type        = string
+  description = "The name of the network security group."
+}
+
+variable "network_security_group_nsg_rules" {
+  description = "The network security group rules."
+  default     = []
+  type = list(object({
+    name                       = string
+    priority                   = number
+    direction                  = string
+    access                     = string
+    protocol                   = string
+    source_port_range          = string
+    destination_port_range     = string
+    source_address_prefix      = string
+    destination_address_prefix = string
+  }))
+}
+
+variable "private_endpoint_network_policies" {
+  type        = string
+  default     = "Disabled" # Default as per compliance requirements
+  description = "Enable or disable network policies for private endpoints."
+
+  validation {
+    condition     = contains(["Disabled", "Enabled", "NetworkSecurityGroupEnabled", "RouteTableEnabled"], var.private_endpoint_network_policies)
+    error_message = "The private_endpoint_network_policies variable must be one of the following: Disabled, Enabled, NetworkSecurityGroupEnabled, RouteTableEnabled."
+  }
+}
+
+variable "resource_group_name" {
+  type        = string
+  description = "The name of the resource group in which to create the VNET. Changing this forces a new resource to be created."
+}
+
+variable "service_delegation_name" {
+  type        = string
+  default     = ""
+  description = "The name of the service delegation."
+}
+
+variable "service_delegation_actions" {
+  type        = list(string)
+  default     = []
+  description = "The actions for the service delegation."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Resource tags to be applied throughout the deployment."
+  default     = {}
+}
+
+variable "vnet_name" {
+  type        = string
+  default     = null
+  description = "The name of the VNets to which the subnet will be associated."
+}
diff --git a/infrastructure/modules/vnet-peering/main.tf b/infrastructure/modules/vnet-peering/main.tf
@@ -0,0 +1,12 @@
+resource "azurerm_virtual_network_peering" "peering" {
+  name                         = var.name
+  resource_group_name          = var.resource_group_name
+  virtual_network_name         = var.vnet_name
+  remote_virtual_network_id    = var.remote_vnet_id
+  allow_virtual_network_access = var.allow_virtual_network_access
+  allow_forwarded_traffic      = var.allow_forwarded_traffic
+
+  # `allow_gateway_transit` must be set to false for vnet Global Peering
+  allow_gateway_transit = var.allow_gateway_transit
+
+}
diff --git a/infrastructure/modules/vnet-peering/output.tf b/infrastructure/modules/vnet-peering/output.tf
diff --git a/infrastructure/modules/vnet-peering/variables.tf b/infrastructure/modules/vnet-peering/variables.tf
diff --git a/infrastructure/modules/vnet/main.tf b/infrastructure/modules/vnet/main.tf
diff --git a/infrastructure/modules/vnet/output.tf b/infrastructure/modules/vnet/output.tf
diff --git a/infrastructure/modules/vnet/variables.tf b/infrastructure/modules/vnet/variables.tf
