Azure Managed Database - PostgreSQL flexible

This module creates an Azure PostgreSQL Flexible server with databases along with logging activated firewall rules. A user is created for each databases created with this module. This module does not allow users to create new objects in the public schema regarding the CVE-2018-1058.

Global versioning rule for Claranet Azure modules

Module version	Terraform version	AzureRM version
>= 7.x.x	1.3.x	>= 3.0
>= 6.x.x	1.x	>= 3.0
>= 5.x.x	0.15.x	>= 2.0
>= 4.x.x	0.13.x / 0.14.x	>= 2.0
>= 3.x.x	0.12.x	>= 2.0
>= 2.x.x	0.12.x	< 2.0
< 2.x.x	0.11.x	< 2.0

Contributing

If you want to contribute to this repository, feel free to use our pre-commit git hook configuration which will help you automatically update and format some files for you by enforcing our Terraform code module best-practices.

More details are available in the CONTRIBUTING.md file.

Usage

This module is optimized to work with the Claranet terraform-wrapper tool which set some terraform variables in the environment needed by this module. More details about variables set by the terraform-wrapper available in the documentation.

module "azure_region" {
  source  = "claranet/regions/azurerm"
  version = "x.x.x"

  azure_region = var.azure_region
}

module "rg" {
  source  = "claranet/rg/azurerm"
  version = "x.x.x"

  location    = module.azure_region.location
  client_name = var.client_name
  environment = var.environment
  stack       = var.stack
}

module "logs" {
  source  = "claranet/run-common/azurerm//modules/logs"
  version = "x.x.x"

  client_name         = var.client_name
  environment         = var.environment
  stack               = var.stack
  location            = module.azure_region.location
  location_short      = module.azure_region.location_short
  resource_group_name = module.rg.resource_group_name
}

resource "random_password" "admin_password" {
  special = "false"
  length  = 32
}

module "postgresql_flexible" {
  source  = "claranet/db-postgresql-flexible/azurerm"
  version = "x.x.x"

  client_name    = var.client_name
  location       = module.azure_region.location
  location_short = module.azure_region.location_short
  environment    = var.environment
  stack          = var.stack

  resource_group_name = module.rg.resource_group_name

  tier               = "GeneralPurpose"
  size               = "D2s_v3"
  storage_mb         = 32768
  postgresql_version = 13

  allowed_cidrs = {
    "1" = "10.0.0.0/24"
    "2" = "12.34.56.78/32"
  }

  backup_retention_days        = 14
  geo_redundant_backup_enabled = true

  administrator_login    = "azureadmin"
  administrator_password = random_password.admin_password.result

  databases = {
    mydatabase = {
      collation = "en_US.UTF8"
      charset   = "UTF8"
    }
  }

  maintenance_window = {
    day_of_week  = 3
    start_hour   = 3
    start_minute = 0
  }

  logs_destinations_ids = [
    module.logs.logs_storage_account_id,
    module.logs.log_analytics_workspace_id
  ]

  extra_tags = {
    foo = "bar"
  }
}

provider "postgresql" {
  host      = module.postgresql_flexible.postgresql_flexible_fqdn
  port      = 5432
  username  = module.postgresql_flexible.postgresql_flexible_administrator_login
  password  = module.postgresql_flexible.postgresql_flexible_administrator_password
  sslmode   = "require"
  superuser = false
}

module "postgresql_users" {
  source  = "claranet/users/postgresql"
  version = "x.x.x"

  for_each = toset(module.postgresql_flexible.postgresql_flexible_databases_names)

  administrator_login = module.postgresql_flexible.postgresql_flexible_administrator_login

  database = each.key
}

module "postgresql_configuration" {
  source  = "claranet/database-configuration/postgresql"
  version = "x.x.x"

  for_each = toset(module.postgresql_flexible.postgresql_flexible_databases_names)

  administrator_login = module.postgresql_flexible.postgresql_flexible_administrator_login

  database_admin_user = module.postgresql_users[each.key].user
  database            = each.key
  schema_name         = each.key
}

Providers

Name	Version
azurecaf	~> 1.2, >= 1.2.22
azurerm	>= 3.22

Modules

Name	Source	Version
diagnostics	claranet/diagnostic-settings/azurerm	6.2.0

Resources

Name	Type
azurerm_postgresql_flexible_server.postgresql_flexible_server	resource
azurerm_postgresql_flexible_server_configuration.postgresql_flexible_config	resource
azurerm_postgresql_flexible_server_database.postgresql_flexible_db	resource
azurerm_postgresql_flexible_server_firewall_rule.firewall_rules	resource
azurecaf_name.postgresql_flexible_dbs	data source
azurecaf_name.postgresql_flexible_server	data source

Inputs

Name	Description	Type	Default	Required
administrator_login	PostgreSQL administrator login.	string	n/a	yes
administrator_password	PostgreSQL administrator password. Strong Password : https://docs.microsoft.com/en-us/sql/relational-databases/security/strong-passwords?view=sql-server-2017.	string	n/a	yes
allowed_cidrs	Map of authorized cidrs.	map(string)	n/a	yes
backup_retention_days	Backup retention days for the PostgreSQL Flexible Server (Between 7 and 35 days).	number	7	no
client_name	Name of client.	string	n/a	yes
custom_diagnostic_settings_name	Custom name of the diagnostics settings, name will be 'default' if not set.	string	"default"	no
custom_server_name	Custom Server Name identifier.	string	""	no
databases	Map of databases configurations with database name as key and following available configuration option: * (optional) charset: Valid PostgreSQL charset : https://www.postgresql.org/docs/current/multibyte.html#CHARSET-TABLE * (optional) collation: Valid PostgreSQL collation : http://www.postgresql.cn/docs/13/collation.html - be careful about https://docs.microsoft.com/en-us/windows/win32/intl/locale-names?redirectedfrom=MSDN	map(object({ charset = optional(string, "UTF8") collation = optional(string, "en_US.UTF8") }))	{}	no
delegated_subnet_id	Id of the subnet to create the PostgreSQL Flexible Server. (Should not have any resource deployed in)	string	null	no
environment	Name of application's environnement.	string	n/a	yes
extra_tags	Map of custom tags.	map(string)	{}	no
geo_redundant_backup_enabled	Enable Geo Redundant Backup for the PostgreSQL Flexible Server.	bool	false	no
location	Azure location.	string	n/a	yes
location_short	Short string for Azure location.	string	n/a	yes
logs_categories	Log categories to send to destinations.	list(string)	null	no
logs_destinations_ids	List of destination resources IDs for logs diagnostic destination. Can be Storage Account, Log Analytics Workspace and Event Hub. No more than one of each can be set. If you want to specify an Azure EventHub to send logs and metrics to, you need to provide a formated string with both the EventHub Namespace authorization send ID and the EventHub name (name of the queue to use in the Namespace) separated by the `	` character.	list(string)	n/a
logs_metrics_categories	Metrics categories to send to destinations.	list(string)	null	no
logs_retention_days	Number of days to keep logs on storage account.	number	30	no
maintenance_window	Map of maintenance window configuration.	map(number)	null	no
name_prefix	Optional prefix for the generated name.	string	""	no
name_suffix	Optional suffix for the generated name.	string	""	no
postgresql_configurations	PostgreSQL configurations to enable.	map(string)	{}	no
postgresql_version	Version of PostgreSQL Flexible Server. Possible values are : https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_flexible_server#version.	number	13	no
private_dns_zone_id	ID of the private DNS zone to create the PostgreSQL Flexible Server.	string	null	no
resource_group_name	Name of the application ressource group, herited from infra module.	string	n/a	yes
size	Size for PostgreSQL Flexible server sku : https://docs.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-compute-storage.	string	"D2ds_v4"	no
stack	Name of application stack.	string	n/a	yes
standby_zone	Specify availability-zone to enable high_availability and create standby PostgreSQL Flexible Server. (Null to disable high-availability)	number	2	no
storage_mb	Storage allowed for PostgresSQL Flexible server. Possible values : https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_flexible_server#storage_mb.	number	32768	no
tier	Tier for PostgreSQL Flexible server sku : https://docs.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-compute-storage. Possible values are: GeneralPurpose, Burstable, MemoryOptimized.	string	"GeneralPurpose"	no
use_caf_naming	Use the Azure CAF naming provider to generate default resource name. custom_server_name override this if set. Legacy default name is used if this is set to false.	bool	true	no
use_caf_naming_for_databases	Use the Azure CAF naming provider to generate databases name.	bool	false	no
zone	Specify availability-zone for PostgreSQL Flexible main Server.	number	1	no

Outputs

Name	Description
postgresql_flexible_administrator_login	Administrator login for PostgreSQL Flexible server.
postgresql_flexible_administrator_password	Administrator password for PostgreSQL Flexible server.
postgresql_flexible_configurations	The map of all postgresql configurations set.
postgresql_flexible_database_ids	The map of all database resource ids.
postgresql_flexible_databases_names	Map of databases names.
postgresql_flexible_firewall_rules	Map of PostgreSQL created rules.
postgresql_flexible_fqdn	FQDN of the PostgreSQL server.
postgresql_flexible_server_id	PostgreSQL server ID.
terraform_module	Information about this Terraform module

Related documentation

Microsoft Azure documentation: docs.microsoft.com/fr-fr/azure/postgresql/flexible-server/