diff --git a/src/domains/citizen-auth-app/06_storage.tf b/src/domains/citizen-auth-app/06_storage.tf index ca2bdde15..3f237f0af 100644 --- a/src/domains/citizen-auth-app/06_storage.tf +++ b/src/domains/citizen-auth-app/06_storage.tf @@ -6,4 +6,4 @@ data "azurerm_storage_account" "lollipop_assertion_storage" { data "azurerm_storage_account" "lv_audit_logs_storage" { name = replace(format("%s-lv-logs-st", local.product), "-", "") resource_group_name = format("%s-%s-data-rg", local.product, var.domain) -} \ No newline at end of file +} diff --git a/src/domains/citizen-auth-common/.terraform.lock.hcl b/src/domains/citizen-auth-common/.terraform.lock.hcl index 3cabe466a..fb04f50f0 100644 --- a/src/domains/citizen-auth-common/.terraform.lock.hcl +++ b/src/domains/citizen-auth-common/.terraform.lock.hcl @@ -26,7 +26,7 @@ provider "registry.terraform.io/hashicorp/azuread" { provider "registry.terraform.io/hashicorp/azurerm" { version = "3.40.0" - constraints = ">= 3.30.0, <= 3.40.0" + constraints = ">= 3.30.0, <= 3.40.0, <= 3.43.0, <= 3.45.0, <= 3.71.0" hashes = [ "h1:/Jbhw/zNAsDYDoASaG6w+0KZyay9BkUVOpR8b7m0CsA=", "h1:7Vfig36efXmcsWQSZwdB+bqZLtoZ/RyytY9lXHx9Fic=", diff --git a/src/domains/citizen-auth-common/01_network.tf b/src/domains/citizen-auth-common/01_network.tf index db1fb2b5f..70c22857e 100644 --- a/src/domains/citizen-auth-common/01_network.tf +++ b/src/domains/citizen-auth-common/01_network.tf @@ -41,6 +41,11 @@ data "azurerm_private_dns_zone" "privatelink_redis_cache" { resource_group_name = local.vnet_common_resource_group_name } +data "azurerm_private_dns_zone" "privatelink_table_core" { + name = "privatelink.table.core.windows.net" + resource_group_name = local.vnet_common_resource_group_name +} + ## Redis Common subnet module "redis_common_snet" { @@ -51,4 +56,4 @@ module "redis_common_snet" { virtual_network_name = local.vnet_common_name private_endpoint_network_policies_enabled = false -} \ No newline at end of file +} diff --git a/src/domains/citizen-auth-common/03_storage.tf b/src/domains/citizen-auth-common/03_storage.tf index 58ac57dca..6765679ec 100644 --- a/src/domains/citizen-auth-common/03_storage.tf +++ b/src/domains/citizen-auth-common/03_storage.tf @@ -86,7 +86,6 @@ resource "azurerm_storage_queue" "lollipop_assertions_storage_revoke_queue" { ### # LV Audit Log Storage ### - module "lv_audit_logs_storage" { source = "git::https://github.com/pagopa/terraform-azurerm-v3//storage_account?ref=v6.1.0" @@ -142,3 +141,52 @@ resource "azurerm_storage_container" "lv_audit_logs_storage_logs" { storage_account_name = module.lv_audit_logs_storage.name container_access_type = "private" } + +### +# Citizen Auth Storage +### +module "io_citizen_auth_storage" { + source = "git::https://github.com/pagopa/terraform-azurerm-v3//storage_account?ref=v6.1.0" + + name = replace(format("%s-st", local.product), "-", "") + domain = upper(var.domain) + account_kind = "StorageV2" + account_tier = "Standard" + access_tier = "Hot" + account_replication_type = "GZRS" + resource_group_name = azurerm_resource_group.data_rg.name + location = var.location + advanced_threat_protection = true + enable_identity = true + public_network_access_enabled = false + + tags = var.tags +} + +resource "azurerm_private_endpoint" "table" { + depends_on = [module.io_citizen_auth_storage] + name = format("%s-table-endpoint", module.io_citizen_auth_storage.name) + location = var.location + resource_group_name = azurerm_resource_group.data_rg.name + subnet_id = data.azurerm_subnet.private_endpoints_subnet.id + + private_service_connection { + name = format("%s-table", module.io_citizen_auth_storage.name) + private_connection_resource_id = module.io_citizen_auth_storage.id + is_manual_connection = false + subresource_names = ["table"] + } + + private_dns_zone_group { + name = "private-dns-zone-group" + private_dns_zone_ids = [data.azurerm_private_dns_zone.privatelink_table_core.id] + } + + tags = var.tags +} + +resource "azurerm_storage_table" "unique_emails" { + depends_on = [module.io_citizen_auth_storage] + name = "uniqueEmails" + storage_account_name = module.io_citizen_auth_storage.name +} diff --git a/src/domains/citizen-auth-common/README.md b/src/domains/citizen-auth-common/README.md index a656c6fe2..44d3d4b9d 100644 --- a/src/domains/citizen-auth-common/README.md +++ b/src/domains/citizen-auth-common/README.md @@ -19,6 +19,7 @@ | [cosmosdb\_account\_mongodb\_fims](#module\_cosmosdb\_account\_mongodb\_fims) | git::https://github.com/pagopa/terraform-azurerm-v3//cosmosdb_account | v4.1.5 | | [cosmosdb\_sql\_database\_citizen\_auth](#module\_cosmosdb\_sql\_database\_citizen\_auth) | git::https://github.com/pagopa/terraform-azurerm-v3//cosmosdb_sql_database | v4.3.1 | | [cosmosdb\_sql\_database\_fims](#module\_cosmosdb\_sql\_database\_fims) | git::https://github.com/pagopa/terraform-azurerm-v3//cosmosdb_sql_database | v4.3.1 | +| [io\_citizen\_auth\_storage](#module\_io\_citizen\_auth\_storage) | git::https://github.com/pagopa/terraform-azurerm-v3//storage_account | v6.1.0 | | [key\_vault](#module\_key\_vault) | git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault | v4.1.3 | | [lollipop\_assertions\_storage](#module\_lollipop\_assertions\_storage) | git::https://github.com/pagopa/terraform-azurerm-v3//storage_account | v6.1.0 | | [lollipop\_assertions\_storage\_customer\_managed\_key](#module\_lollipop\_assertions\_storage\_customer\_managed\_key) | git::https://github.com/pagopa/terraform-azurerm-v3//storage_account_customer_managed_key | v4.3.1 | @@ -58,11 +59,13 @@ | [azurerm_private_endpoint.lollipop_assertion_storage_blob](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) | resource | | [azurerm_private_endpoint.lollipop_assertion_storage_queue](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) | resource | | [azurerm_private_endpoint.lv_audit_logs_storage_blob](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) | resource | +| [azurerm_private_endpoint.table](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) | resource | | [azurerm_resource_group.data_rg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) | resource | | [azurerm_resource_group.sec_rg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) | resource | | [azurerm_storage_container.lollipop_assertions_storage_assertions](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_container) | resource | | [azurerm_storage_container.lv_audit_logs_storage_logs](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_container) | resource | | [azurerm_storage_queue.lollipop_assertions_storage_revoke_queue](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_queue) | resource | +| [azurerm_storage_table.unique_emails](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_table) | resource | | [azuread_group.adgroup_admin](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/group) | data source | | [azuread_group.adgroup_developers](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/group) | data source | | [azuread_group.adgroup_externals](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/group) | data source | @@ -85,6 +88,7 @@ | [azurerm_private_dns_zone.privatelink_mongo_cosmos_azure_com](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/private_dns_zone) | data source | | [azurerm_private_dns_zone.privatelink_queue_core_windows_net](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/private_dns_zone) | data source | | [azurerm_private_dns_zone.privatelink_redis_cache](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/private_dns_zone) | data source | +| [azurerm_private_dns_zone.privatelink_table_core](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/private_dns_zone) | data source | | [azurerm_resource_group.monitor_rg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source | | [azurerm_subnet.azdoa_snet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subnet) | data source | | [azurerm_subnet.private_endpoints_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subnet) | data source |