feat: fix reachability from appbel3 to downstream applications

[christian-calabrese]

Motivation and Context

Adding a new appbackend instance required to whitelist its subnet in tens of downstream functions and app services (and their slots). With private endpoints, this is not needed anymore.

Major Changes

Dependencies

Testing

Documentation

Other Considerations

[github-actions]

Terraform Plan ('src/domains/cgn/prod') 📖

Terraform Plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.functions.module.function_cgn.azurerm_linux_function_app.this will be updated in-place
  ~ resource "azurerm_linux_function_app" "this" {
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-cgn-be-rg/providers/Microsoft.Web/sites/io-p-cgn-fn"
        name                                           = "io-p-cgn-fn"
        tags                                           = {
            "CostCenter"                                     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"                                      = "Terraform"
            "Environment"                                    = "Prod"
            "ManagementTeam"                                 = "IO Comunicazione"
            "Owner"                                          = "IO"
            "Source"                                         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod/westeurope"
        }
        # (28 unchanged attributes hidden)

      ~ site_config {
          ~ health_check_eviction_time_in_min       = 0 -> 2
            # (24 unchanged attributes hidden)

            # (7 unchanged blocks hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.functions.module.function_cgn_staging_slot.azurerm_linux_function_app_slot.this will be updated in-place
  ~ resource "azurerm_linux_function_app_slot" "this" {
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-cgn-be-rg/providers/Microsoft.Web/sites/io-p-cgn-fn/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Comunicazione"
            "Owner"          = "IO"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod/westeurope"
        }
        # (24 unchanged attributes hidden)

      ~ site_config {
          ~ health_check_eviction_time_in_min       = 0 -> 2
            # (24 unchanged attributes hidden)

            # (8 unchanged blocks hidden)
        }
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Warning: Deprecated Resource

  with module.functions.azurerm_app_service_plan.app_service_plan_cgn_common,
  on ../_modules/functions_apps/app_service_plan_cgn_common.tf line 1, in resource "azurerm_app_service_plan" "app_service_plan_cgn_common":
   1: resource "azurerm_app_service_plan" "app_service_plan_cgn_common" {

The `azurerm_app_service_plan` resource has been superseded by the
`azurerm_service_plan` resource. Whilst this resource will continue to be
available in the 2.x and 3.x releases it is feature-frozen for compatibility
purposes, will no longer receive any updates and will be removed in a future
major release of the Azure Provider.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

[github-actions]

📖 Terraform Plan ('src/common/prod') - success

Terraform Plan

module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages[0]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages[1]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [10s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [10s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [10s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [20s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [20s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [20s elapsed]
data.azurerm_linux_function_app.function_cgn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile[0]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile[1]: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_04: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [20s elapsed]
data.azurerm_linux_function_app.function_profile[1]: Still reading... [20s elapsed]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app will be updated in-place
  ~ resource "azurerm_web_application_firewall_policy" "api_app" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-external/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/io-p-waf-appgateway-api-app-policy"
        name                = "io-p-waf-appgateway-api-app-policy"
        tags                = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra"
        }
        # (4 unchanged attributes hidden)

      ~ policy_settings {
          ~ request_body_inspect_limit_in_kb          = 0 -> 128
            # (6 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.app_backend_li_weu.module.appservice_app_backend.azurerm_linux_web_app.this will be updated in-place
  ~ resource "azurerm_linux_web_app" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli"
        name                                           = "io-p-app-appbackendli"
        tags                                           = {
            "CostCenter"                                     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"                                      = "Terraform"
            "Environment"                                    = "Prod"
            "Owner"                                          = "IO"
            "Source"                                         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (21 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.app_backend_li_weu.module.appservice_app_backend_slot_staging.azurerm_linux_web_app_slot.this will be updated in-place
  ~ resource "azurerm_linux_web_app_slot" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (20 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.app_backend_weu["1"].module.appservice_app_backend.azurerm_linux_web_app.this will be updated in-place
  ~ resource "azurerm_linux_web_app" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1"
        name                                           = "io-p-app-appbackendl1"
        tags                                           = {
            "CostCenter"                                     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"                                      = "Terraform"
            "Environment"                                    = "Prod"
            "Owner"                                          = "IO"
            "Source"                                         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (21 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.app_backend_weu["1"].module.appservice_app_backend_slot_staging.azurerm_linux_web_app_slot.this will be updated in-place
  ~ resource "azurerm_linux_web_app_slot" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl1/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (20 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.app_backend_weu["2"].module.appservice_app_backend.azurerm_linux_web_app.this will be updated in-place
  ~ resource "azurerm_linux_web_app" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2"
        name                                           = "io-p-app-appbackendl2"
        tags                                           = {
            "CostCenter"                                     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"                                      = "Terraform"
            "Environment"                                    = "Prod"
            "Owner"                                          = "IO"
            "Source"                                         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (21 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.app_backend_weu["2"].module.appservice_app_backend_slot_staging.azurerm_linux_web_app_slot.this will be updated in-place
  ~ resource "azurerm_linux_web_app_slot" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl2/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (20 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.app_backend_weu["3"].module.appservice_app_backend.azurerm_linux_web_app.this will be updated in-place
  ~ resource "azurerm_linux_web_app" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl3"
        name                                           = "io-p-app-appbackendl3"
        tags                                           = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (21 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.app_backend_weu["3"].module.appservice_app_backend_slot_staging.azurerm_linux_web_app_slot.this will be updated in-place
  ~ resource "azurerm_linux_web_app_slot" "this" {
      ~ app_settings                                   = {
          ~ "IO_WALLET_API_KEY"                               = (sensitive value)
            # (114 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendl3/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (20 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 9 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app,
  on ../_modules/application_gateway/firewall.tf line 61, in resource "azurerm_web_application_firewall_policy" "api_app":
  61:         rule_group_name = "REQUEST-942-APPLICATION-ATTACK-SQLI"

`disabled_rules` will be removed in favour of the `rule` property in version
4.0 of the AzureRM Provider.

(and 50 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud