Azure App Service Environment Overlay Terraform Module

This Overlay terraform module can create a an Azure Service Environment associated with an Application Insights component and manage related parameters (Private Endpoints, etc.) to be used in a SCCA compliant Network.

SCCA Compliance

This module can be SCCA compliant and can be used in a SCCA compliant Network. Enable private endpoints and SCCA compliant network rules to make it SCCA compliant.

For more information, please read the SCCA documentation.

Contributing

If you want to contribute to this repository, feel free to to contribute to our Terraform module.

More details are available in the CONTRIBUTING.md file.

Resources Used

• Azure App Service Environment
• Azure Application Insights
• Private Endpoints
• Private DNS zone for privatelink A records
• Azure Reource Locks

Overlay Module Usage

# Azurerm Provider configuration
provider "azurerm" {
  features {}
}

module "app_service_environment" {
  source  = "POps-Rox/tf-az-overlays-app-service-environment/azurerm"
  version = "x.x.x"

  # By default, this module will create a resource group and 
  # provide a name for an existing resource group. If you wish 
  # to use an existing resource group, change the option 
  # to "create_sql_resource_group = false." The location of the group 
  # will remain the same if you use the current resource.
  existing_resource_group_name = azurerm_resource_group.ase-rg.name
  location                     = module.mod_azure_region_lookup.location_cli
  environment                  = "public"
  deploy_environment           = "dev"
  org_name                     = "anoa"
  workload_name                = "ase"

  ase_subnet_name      = azurerm_subnet.ase-snet.name
  virtual_network_name = azurerm_virtual_network.ase-vnet.name

  # Tags
  add_tags = local.tags # Tags to be applied to all resources
}

Resource Group

By default, this module will not create a resource group and the name of an existing resource group to be given in an argument existing_resource_group_name. If you want to create a new resource group, set the argument create_ase_resource_group = true.

Note

If you are using an existing resource group, then this module uses the same resource group location to create all resources in this module.

Recommended naming and tagging conventions

Applying tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For example, you can apply the name Environment and the value Production to all the resources in production. For recommendations on how to implement a tagging strategy, see Resource naming and tagging decision guide.

Important

Tag names are case-insensitive for operations. A tag with a tag name, regardless of the casing, is updated or retrieved. However, the resource provider might keep the casing you provide for the tag name. You'll see that casing in cost reports. Tag values are case-sensitive.

An effective naming convention assembles resource names by using important resource information as parts of a resource's name. For example, using these recommended naming conventions, a public IP resource for a production SharePoint workload is named like this: pip-sharepoint-prod-westus-001.

Requirements

Providers

Name	Version
popsrox-utils	~> 1.0.4
azurerm	~> 3.116

Modules

Name	Source	Version
mod_azregions	POps-Rox/overlays-azregions-lookup/azurerm	~> 1.0.0
mod_scaffold_rg	POps-Rox/overlays-resource-group/azurerm	~> 1.0.1

Resources

Name	Type
azurerm_app_service_environment_v3.ase	resource
azurerm_management_lock.ase_level_lock	resource
azurerm_network_security_group.ase-nsg	resource
azurerm_private_dns_a_record.ase_at_a_rec	resource
azurerm_private_dns_a_record.ase_scm_a_rec	resource
azurerm_private_dns_a_record.ase_wildcard_a_rec	resource
azurerm_private_dns_zone.ase_dns_zone	resource
azurerm_private_dns_zone_virtual_network_link.ase_vnet_link	resource
azurerm_subnet_network_security_group_association.ase-subnet-nsg-association	resource
popsrox_resource_name.ase	data source
azurerm_app_service_environment_v3.ase	data source
azurerm_client_config.current	data source
azurerm_network_security_group.ase-nsg	data source
azurerm_resource_group.rgrp	data source
azurerm_subnet.ase_subnet	data source
azurerm_virtual_network.pe_vnet	data source

Inputs

Name	Description	Type	Default	Required
add_tags	Map of custom tags.	map(string)	{}	no
allow_new_private_endpoint_connections	Allow new private endpoint connections to the ASE. Default is true.	bool	true	no
ase_custom_name	Custom name for the ASE. If not set, the name will be generated using the org_name, workload_name, deploy_environment and environment variables.	string	null	no
ase_subnet_name	Name of the subnet	string	n/a	yes
create_ase_resource_group	Controls if the resource group should be created. If set to false, the resource group name must be provided. Default is false.	bool	false	no
custom_resource_group_name	The name of the custom resource group to create. If not set, the name will be generated using the org_name, workload_name, deploy_environment and environment variables.	string	null	no
default_tags_enabled	Option to enable or disable default tags.	bool	true	no
deploy_environment	Name of the workload's environment	string	n/a	yes
enable_resource_locks	(Optional) Enable resource locks, default is false. If true, resource locks will be created for the resource group and the storage account.	bool	false	no
environment	The Terraform backend environment e.g. public or usgovernment	string	n/a	yes
existing_resource_group_name	The name of the existing resource group to use. If not set, the name will be generated using the org_name, workload_name, deploy_environment and environment variables.	string	null	no
location	Azure region in which instance will be hosted	string	n/a	yes
lock_level	(Optional) id locks are enabled, Specifies the Level to be used for this Lock.	string	"CanNotDelete"	no
name_prefix	Optional prefix for the generated name	string	""	no
name_suffix	Optional suffix for the generated name	string	""	no
org_name	Name of the organization	string	n/a	yes
use_location_short_name	Use short location name for resources naming (ie eastus -> eus). Default is true. If set to false, the full cli location name will be used. if custom naming is set, this variable will be ignored.	bool	true	no
use_naming	Use the Azure NoOps naming provider to generate default resource name. storage_account_custom_name override this if set. Legacy default name is used if this is set to false.	bool	true	no
virtual_network_name	Name of the virtual network	string	n/a	yes
workload_name	Name of the workload_name	string	n/a	yes

Outputs

Name	Description
ase_dns_suffix	App Service Environment DNS suffix
ase_id	App Service Environment id
ase_internal_inbound_ip_addresses	App Service Environment internal inbound IP addresses
ase_linux_outbound_ip_addresses	App Service Environment Linux outbound IP addresses
ase_name	App Service Environment name
ase_windows_outbound_ip_addresses	App Service Environment Windows outbound IP addresses