main.tf

# Local Variables
locals {
  firewall_rule_name    = "AllowAllIPs"
  resource_group_name   = "${var.prefix}-rg"
  sql_server_name       = "${var.prefix}-sqlserver-${var.suffix}"
  app_service_plan_name = "${var.prefix}-app-service-plan-${var.suffix}"
  web_app_name          = "${var.prefix}-webapp-${var.suffix}"
  key_vault_name        = "${var.prefix}-kv-${var.suffix}"
  sql_identity_name     = "${var.prefix}-tde-identity-${var.suffix}"
  tde_key_name          = "${var.prefix}-tde-key-${var.suffix}"
}

# Retrieve the current Azure client configuration
data "azurerm_client_config" "current" {}

# Create a resource group
resource "azurerm_resource_group" "example" {
  name     = local.resource_group_name
  location = var.location
  tags     = var.tags
}

# Create the user-assigned managed identity the SQL server uses to reach the TDE protector key
resource "azurerm_user_assigned_identity" "sql_server" {
  name                = local.sql_identity_name
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  tags                = var.tags

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

# Create a SQL server
resource "azurerm_mssql_server" "example" {
  name                                 = local.sql_server_name
  resource_group_name                  = azurerm_resource_group.example.name
  location                             = azurerm_resource_group.example.location
  administrator_login                  = var.administrator_login
  administrator_login_password         = var.administrator_login_password
  minimum_tls_version                  = var.minimum_tls_version
  public_network_access_enabled        = var.public_network_access_enabled
  outbound_network_restriction_enabled = var.outbound_network_restriction_enabled
  version                              = var.sql_version
  primary_user_assigned_identity_id    = azurerm_user_assigned_identity.sql_server.id
  tags                                 = var.tags

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.sql_server.id]
  }

  # The TDE protector is managed by azurerm_mssql_server_transparent_data_encryption below
  lifecycle {
    ignore_changes = [
      tags,
      transparent_data_encryption_key_vault_key_id
    ]
  }
}

# Create a firewall rule
resource "azurerm_mssql_firewall_rule" "example" {
  name             = local.firewall_rule_name
  server_id        = azurerm_mssql_server.example.id
  start_ip_address = var.start_ip_address
  end_ip_address   = var.end_ip_address
}

# Create a database
resource "azurerm_mssql_database" "example" {
  name                        = var.sql_database_name
  server_id                   = azurerm_mssql_server.example.id
  sku_name                    = var.sku.name
  auto_pause_delay_in_minutes = var.auto_pause_delay
  collation                   = var.collation
  create_mode                 = var.create_mode
  elastic_pool_id             = var.elastic_pool_resource_id
  max_size_gb                 = var.max_size_gb
  min_capacity                = var.min_capacity != "0" ? tonumber(var.min_capacity) : null
  read_replica_count          = var.high_availability_replica_count
  read_scale                  = var.read_scale == "Enabled" ? true : false
  zone_redundant              = var.sql_database_zone_redundant
  license_type                = var.license_type
  ledger_enabled              = var.is_ledger_on
  tags                        = var.tags

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

# Create a service plan
resource "azurerm_service_plan" "example" {
  name                   = local.app_service_plan_name
  resource_group_name    = azurerm_resource_group.example.name
  location               = azurerm_resource_group.example.location
  sku_name               = var.sku_name
  os_type                = var.os_type
  zone_balancing_enabled = var.zone_balancing_enabled
  tags                   = var.tags

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

# Create a web app
resource "azurerm_linux_web_app" "example" {
  name                          = local.web_app_name
  resource_group_name           = azurerm_resource_group.example.name
  location                      = azurerm_resource_group.example.location
  service_plan_id               = azurerm_service_plan.example.id
  https_only                    = var.https_only
  public_network_access_enabled = var.webapp_public_network_access_enabled
  client_affinity_enabled       = false
  tags                          = var.tags

  identity {
    type = "SystemAssigned"
  }

  site_config {
    always_on           = var.always_on
    http2_enabled       = var.http2_enabled
    minimum_tls_version = var.minimum_tls_version
    application_stack {
      python_version = var.python_version
    }
  }

  app_settings = {
    SCM_DO_BUILD_DURING_DEPLOYMENT = "true"
    ENABLE_ORYX_BUILD              = "true"
    KEY_VAULT_NAME                 = azurerm_key_vault.example.name
    SECRET_NAME                    = azurerm_key_vault_secret.sql_connection_string.name
    KEYVAULT_URI                   = azurerm_key_vault.example.vault_uri
    CERT_NAME                      = azurerm_key_vault_certificate.example.name
    LOGIN_NAME                     = var.login_name
  }

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

# Create a Key Vault
resource "azurerm_key_vault" "example" {
  name                       = local.key_vault_name
  resource_group_name        = azurerm_resource_group.example.name
  location                   = azurerm_resource_group.example.location
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  sku_name                   = "standard"
  rbac_authorization_enabled = false
  soft_delete_retention_days = 7
  purge_protection_enabled   = true
  tags                       = var.tags

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

# Grant the Web App managed identity access to Key Vault secrets and certificates
resource "azurerm_key_vault_access_policy" "web_app" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_linux_web_app.example.identity[0].principal_id

  secret_permissions = [
    "Get",
    "List",
  ]

  certificate_permissions = [
    "Get",
  ]
}

# Grant the identity running Terraform access to manage the Key Vault key, secret and certificate
resource "azurerm_key_vault_access_policy" "deployer" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azurerm_client_config.current.object_id

  key_permissions = [
    "Create",
    "Delete",
    "Get",
    "GetRotationPolicy",
  ]

  secret_permissions = [
    "Delete",
    "Get",
    "Set",
  ]

  certificate_permissions = [
    "Create",
    "Delete",
    "Get",
  ]
}

# Grant the SQL server managed identity access to the TDE protector key
resource "azurerm_key_vault_access_policy" "sql_server" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_user_assigned_identity.sql_server.principal_id

  key_permissions = [
    "Get",
    "UnwrapKey",
    "WrapKey",
  ]
}

# Create the RSA key that protects the database encryption keys of the SQL server
resource "azurerm_key_vault_key" "tde" {
  name         = local.tde_key_name
  key_vault_id = azurerm_key_vault.example.id
  key_type     = "RSA"
  key_size     = 2048
  key_opts     = ["unwrapKey", "wrapKey"]

  depends_on = [azurerm_key_vault_access_policy.deployer]
}

# Make the Key Vault key the TDE protector of the SQL server
resource "azurerm_mssql_server_transparent_data_encryption" "example" {
  server_id             = azurerm_mssql_server.example.id
  key_vault_key_id      = azurerm_key_vault_key.tde.id
  auto_rotation_enabled = true

  depends_on = [azurerm_key_vault_access_policy.sql_server]
}

# Create a Key Vault secret for SQL connection string
resource "azurerm_key_vault_secret" "sql_connection_string" {
  name         = var.secret_name
  value        = "Server=tcp:${azurerm_mssql_server.example.fully_qualified_domain_name},1433;Database=${azurerm_mssql_database.example.name};User ID=${var.sql_database_username};Password=${var.sql_database_password};Encrypt=yes;TrustServerCertificate=no;Connection Timeout=30;"
  key_vault_id = azurerm_key_vault.example.id

  depends_on = [azurerm_key_vault_access_policy.deployer]
}

# Create a self-signed certificate in Key Vault
resource "azurerm_key_vault_certificate" "example" {
  name         = var.cert_name
  key_vault_id = azurerm_key_vault.example.id

  certificate_policy {
    issuer_parameters {
      name = "Self"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = false
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      subject            = "CN=${var.cert_subject}"
      validity_in_months = 12

      key_usage = [
        "digitalSignature",
        "keyEncipherment",
      ]
    }
  }

  depends_on = [azurerm_key_vault_access_policy.deployer]
}