Skip to content

Commit

Permalink
cosmosdb
Browse files Browse the repository at this point in the history
  • Loading branch information
JamesWoolfenden committed Oct 12, 2022
1 parent d3e1e2a commit 0bf1ede
Show file tree
Hide file tree
Showing 14 changed files with 234 additions and 9 deletions.
7 changes: 5 additions & 2 deletions src/azure.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,11 @@ func GetAZUREPermissions(result ResourceV2) ([]string, error) {
// GetAZUREResourcePermissions looks up permissions required for resources
func GetAZUREResourcePermissions(result ResourceV2) ([]string, error) {
TFLookup := map[string]interface{}{
"azurerm_resource_group": azurermResourceGroup,
"azurerm_service_plan": azurermServicePlan,
"azurerm_resource_group": azurermResourceGroup,
"azurerm_service_plan": azurermServicePlan,
"azurerm_key_vault": azurermKeyVault,
"azurerm_cosmosdb_account": azureCosmosdbAccount,
"azurerm_cosmosdb_table": azureCosmosdbTable,
}

var Permissions []string
Expand Down
3 changes: 2 additions & 1 deletion src/azure_datasource.go
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@ import "log"
func GetAZUREDataPermissions(result ResourceV2) ([]string, error) {

TFLookup := map[string]interface{}{
// "google_compute_image": placeholder,
"azurerm_resource_group": dataAzurermResourceGroup,
"azurerm_client_config": placeholder,
}

var Permissions []string
Expand Down
9 changes: 9 additions & 0 deletions src/files_azure.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,12 @@ var azurermResourceGroup []byte

//go:embed mapping/azure/resource/serverfarms/azurerm_service_plan.json
var azurermServicePlan []byte

//go:embed mapping/azure/resource/keyvault/azurerm_key_vault.json
var azurermKeyVault []byte

//go:embed mapping/azure/resource/documentdb/azurerm_cosmosdb_account.json
var azureCosmosdbAccount []byte

//go:embed mapping/azure/resource/documentdb/azurerm_cosmosdb_table.json
var azureCosmosdbTable []byte
4 changes: 2 additions & 2 deletions src/files_azure_datasource.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,5 @@ import (
_ "embed" // required for embed
)

////go:embed mapping/gcp/data/cloudkms/google_kms_crypto_key.json
//var dataGoogleKmsCryptoKey []byte
//go:embed mapping/azure/data/resourcegroups/azurerm_resource_group.json
var dataAzurermResourceGroup []byte
13 changes: 13 additions & 0 deletions src/mapping/azure/data/resourcegroups/azurerm_resource_group.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
[
{
"apply": [],
"attributes": {
"tags": []
},
"destroy": [],
"modify": [],
"plan": [
"Microsoft.Resources/subscriptions/resourcegroups/read"
]
}
]
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
[
{
"apply": [
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.DocumentDB/databaseAccounts/read",
"Microsoft.DocumentDB/databaseAccounts/write",
"Microsoft.DocumentDB/databaseAccounts/delete",
"Microsoft.DocumentDB/databaseAccounts/listKeys/action",
"Microsoft.DocumentDB/databaseAccounts/readonlykeys/action",
"Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action"
],
"attributes": {
"tags": []
},
"destroy": [
"Microsoft.DocumentDB/databaseAccounts/delete"
],
"modify": [],
"plan": []
}
]
20 changes: 20 additions & 0 deletions src/mapping/azure/resource/documentdb/azurerm_cosmosdb_table.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
[
{
"apply": [
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.DocumentDB/databaseAccounts/read",
"Microsoft.DocumentDB/databaseAccounts/tables/read",
"Microsoft.DocumentDB/databaseAccounts/tables/write",
"Microsoft.DocumentDB/databaseAccounts/tables/delete",
"Microsoft.DocumentDB/databaseAccounts/tables/throughputSettings/read"
],
"attributes": {
"tags": []
},
"destroy": [
"Microsoft.DocumentDB/databaseAccounts/tables/delete"
],
"modify": [],
"plan": []
}
]
18 changes: 18 additions & 0 deletions src/mapping/azure/resource/keyvault/azurerm_key_vault.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
[
{
"apply": [
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.KeyVault/vaults/read",
"Microsoft.KeyVault/vaults/write"
],
"attributes": {
"tags": []
},
"destroy": [
"Microsoft.KeyVault/vaults/delete",
"Microsoft.KeyVault/locations/deletedVaults/read"
],
"modify": [],
"plan": []
}
]
43 changes: 43 additions & 0 deletions terraform/azure/backup/azurerm_cosmosdb_account.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
resource "azurerm_cosmosdb_account" "db" {
name = "pike-cosmos-db"
location = "uksouth"
resource_group_name = "pike"
offer_type = "Standard"
kind = "MongoDB"

enable_automatic_failover = true

capabilities {
name = "EnableAggregationPipeline"
}

capabilities {
name = "mongoEnableDocLevelTTL"
}

capabilities {
name = "MongoDBv3.4"
}

capabilities {
name = "EnableMongo"
}

consistency_policy {
consistency_level = "BoundedStaleness"
max_interval_in_seconds = 350
max_staleness_prefix = 100000
}

geo_location {
location = "eastus"
failover_priority = 1
}

geo_location {
location = "westus"
failover_priority = 0
}
//local_authentication_disabled = true
public_network_access_enabled = false
}
35 changes: 35 additions & 0 deletions terraform/azure/backup/azurerm_cosmosdb_table.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
resource "azurerm_cosmosdb_table" "pike2" {
name = "pike2"
resource_group_name = "pike"
account_name = "pike-table"
autoscale_settings {
max_throughput = 1000
}
}


resource "azurerm_cosmosdb_account" "pike-table" {
name = "pike-table"
location = "uksouth"
resource_group_name = "pike"
offer_type = "Standard"
enable_free_tier = true
consistency_policy {
consistency_level = "BoundedStaleness"
max_interval_in_seconds = 86400
max_staleness_prefix = 1000000
}

geo_location {
location = "uksouth"
failover_priority = "0"
zone_redundant = false
}
capabilities {
name = "EnableTable"
}
tags = {
"defaultExperience" = "Azure Table"
"hidden-cosmos-mmspecial" = ""
}
}
35 changes: 35 additions & 0 deletions terraform/azure/backup/azurerm_key_vault.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
resource "azurerm_key_vault" "example" {
name = "pike"
location = "uksouth"
resource_group_name = "pike"
tenant_id = "8e7f742a-4215-44a0-881b-209124f286b1"
sku_name = "premium"
soft_delete_retention_days = 7
access_policy {
tenant_id = "8e7f742a-4215-44a0-881b-209124f286b1"
object_id = "640b7b1e-da57-4518-a546-cbec8d9a9bce"

key_permissions = [
"Create",
"Get",
"Purge",
"Recover"
]

secret_permissions = [
"Set",
]
}
purge_protection_enabled = true
network_acls {
default_action = "Deny"
bypass = "AzureServices"
}
tags = {
pike = "permissions"
}
}

output "key_vault" {
value = azurerm_key_vault.example
}
6 changes: 6 additions & 0 deletions terraform/azure/backup/data.azurerm_client_config.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@

data "azurerm_client_config" "current" {}

output "config" {
value = data.azurerm_client_config.current
}
8 changes: 8 additions & 0 deletions terraform/azure/backup/data.azurerm_resource_group.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@

data "azurerm_resource_group" "pike" {
name = "pike"
}

output "rg" {
value = data.azurerm_resource_group.pike
}
21 changes: 17 additions & 4 deletions terraform/azure/role/azurerm_role_definition.tf
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,23 @@ resource "azurerm_role_definition" "example" {

permissions {
actions = [
"Microsoft.Web/serverfarms/read",
"Microsoft.Web/serverfarms/write",
"Microsoft.Web/serverfarms/delete",
"Microsoft.Resources/subscriptions/providers/read"
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.KeyVault/vaults/read",
"Microsoft.KeyVault/vaults/write",
"Microsoft.KeyVault/vaults/delete",
"Microsoft.KeyVault/locations/deletedVaults/read",

"Microsoft.DocumentDB/databaseAccounts/read",
"Microsoft.DocumentDB/databaseAccounts/write",
"Microsoft.DocumentDB/databaseAccounts/delete",
"Microsoft.DocumentDB/databaseAccounts/listKeys/action",
"Microsoft.DocumentDB/databaseAccounts/readonlykeys/action",
"Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action",

"Microsoft.DocumentDB/databaseAccounts/tables/read",
"Microsoft.DocumentDB/databaseAccounts/tables/write",
"Microsoft.DocumentDB/databaseAccounts/tables/delete",

]
not_actions = []
}
Expand Down

0 comments on commit 0bf1ede

Please sign in to comment.