Skip to content

Commit 7374ae6

Browse files
committed
Merge branch 'main' into managed_identity
2 parents 8932bcd + 6daeb66 commit 7374ae6

6 files changed

Lines changed: 61 additions & 3 deletions

File tree

m365/README.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ Optional::
9090
`app_multi_tenant` (bool) [default=False]::: If true, the app will be able to be installed in multiple tenants. By default, it is only available in this tenant
9191
`vnet` (object) [default=None]::: Configuration for the vnet, including the address space, ACI subnet, and a list of allowed IP ranges. All strings in CIDR format
9292
`firewall` (object) [default=None]::: Configuration for an Azure Firewall; if not null, traffic will be routed through this firewall
93+
`tags` (map(string)) [default={}]::: Tags to apply to all resources created. Application is done via policies
9394
`serial_number` (string) [default=01]::: Increment by 1 when re-provisioning with the same resource group name
9495
`image_path` (string) [default=./cisa_logo.png]::: Path to image used for app logo. Displayed in Azure console on installed tenants
9596
Advanced::

m365/terraform/env/example/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,5 @@ module "scuba_connect" {
1414
container_registry = var.container_registry
1515
input_storage_container_url = var.input_storage_container_url
1616
output_storage_container_url = var.output_storage_container_url
17+
tags = var.tags
1718
}
18-

m365/terraform/env/example/variables.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,12 @@ variable "firewall" {
6161
description = "Configuration for an Azure Firewall; if not null, traffic will be routed through this firewall"
6262
}
6363

64+
variable "tags" {
65+
type = map(string)
66+
description = "Tags to apply to all resources created. Application is done via policies"
67+
default = {}
68+
}
69+
6470
variable "serial_number" {
6571
default = "01"
6672
type = string
@@ -111,7 +117,7 @@ variable "container_registry" {
111117
username = string
112118
password = string
113119
})
114-
default = null
120+
default = null
115121
description = "Credentials for logging into registry with container image"
116122
}
117123

m365/terraform/main.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22
resource "azurerm_resource_group" "rg" {
33
name = "${var.resource_group_name}-${var.serial_number}"
44
location = var.location
5+
6+
lifecycle {
7+
ignore_changes = [tags]
8+
}
59
}
610

711
data "azuread_client_config" "current" {}
@@ -21,6 +25,7 @@ resource "azurerm_log_analytics_workspace" "monitor_law" {
2125
lifecycle {
2226
ignore_changes = [tags]
2327
}
28+
depends_on = [azurerm_resource_group_policy_assignment.tagging_assignments]
2429
}
2530

2631
module "networking" {
@@ -31,6 +36,7 @@ module "networking" {
3136
resource_prefix = local.name
3237
firewall = var.firewall
3338
vnet = var.vnet
39+
depends_on = [azurerm_resource_group_policy_assignment.tagging_assignments]
3440
}
3541

3642
# Creates the app registration, or reads an existing one, which is used by the ScubaGear container
@@ -46,6 +52,7 @@ module "app" {
4652
allowed_access_ips = try(var.vnet.allowed_access_ip_list, null)
4753
aci_subnet_id = try(module.networking[0].aci_subnet_id, null)
4854
app_multi_tenant = var.app_multi_tenant
55+
depends_on = [azurerm_resource_group_policy_assignment.tagging_assignments]
4956
}
5057

5158
module "container" {
@@ -65,4 +72,5 @@ module "container" {
6572
log_analytics_workspace = azurerm_log_analytics_workspace.monitor_law
6673
container_memory_gb = var.container_memory_gb
6774
cert_info = module.app.cert_info
75+
depends_on = [azurerm_resource_group_policy_assignment.tagging_assignments]
6876
}

m365/terraform/tagging.tf

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
data "azurerm_policy_definition_built_in" "tagging_policy" {
2+
display_name = "Add a tag to resources"
3+
}
4+
5+
# Tagging policy for all resources in the main resource group
6+
resource "azurerm_resource_group_policy_assignment" "tagging_assignments" {
7+
for_each = var.tags
8+
name = "add-tags-${azurerm_resource_group.rg.name}-${each.key}"
9+
resource_group_id = azurerm_resource_group.rg.id
10+
policy_definition_id = data.azurerm_policy_definition_built_in.tagging_policy.id
11+
12+
parameters = jsonencode({
13+
tagName = { value = each.key },
14+
tagValue = { value = each.value }
15+
})
16+
17+
identity {
18+
type = "SystemAssigned"
19+
}
20+
location = var.location
21+
}
22+
23+
resource "azurerm_role_assignment" "tag_contributor" {
24+
for_each = var.tags
25+
scope = azurerm_resource_group.rg.id
26+
role_definition_name = "Tag Contributor"
27+
principal_id = azurerm_resource_group_policy_assignment.tagging_assignments[each.key].identity[0].principal_id
28+
}
29+
30+
resource "azurerm_resource_group_policy_remediation" "remediation" {
31+
for_each = var.tags
32+
name = "add-tags-policy-remediation-${each.key}"
33+
resource_group_id = azurerm_resource_group.rg.id
34+
policy_assignment_id = azurerm_resource_group_policy_assignment.tagging_assignments[each.key].id
35+
resource_discovery_mode = "ReEvaluateCompliance"
36+
depends_on = [ azurerm_role_assignment.tag_contributor, module.app, module.container, module.networking ]
37+
}

m365/terraform/variables.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,12 @@ variable "firewall" {
6161
description = "Configuration for an Azure Firewall; if not null, traffic will be routed through this firewall"
6262
}
6363

64+
variable "tags" {
65+
type = map(string)
66+
description = "Tags to apply to all resources created. Application is done via policies"
67+
default = {}
68+
}
69+
6470
variable "serial_number" {
6571
default = "01"
6672
type = string
@@ -111,7 +117,7 @@ variable "container_registry" {
111117
username = string
112118
password = string
113119
})
114-
default = null
120+
default = null
115121
description = "Credentials for logging into registry with container image"
116122
}
117123

0 commit comments

Comments
 (0)