private / locked down storage account sample

storage_account.tf

# This template is used to deploy the storage account resources

resource "azurecaf_name" "storage_account" {
  name          = "msi"
  resource_type = "azurerm_storage_account"
  prefixes      = local.regional_name_prefixes
  suffixes      = local.azurecaf_name_suffixes
  clean_input   = true
}

resource "azurerm_storage_account" "storage_account" {
  name                     = azurecaf_name.storage_account.result
  resource_group_name      = azurerm_resource_group.app.name
  location                 = azurerm_resource_group.app.location
  account_tier             = "standard"
  account_kind             = "StorageV2"
  access_tier              = "Hot"
  account_replication_type = "RAGRS"
  min_tls_version          = "TLS1_2"
  allow_blob_public_access = false

  network_rules {
    default_action             = "Deny"
    ip_rules                   = []
    virtual_network_subnet_ids = [data.azurerm_subnet.mgmt.id]
  }

  tags = var.tags

  lifecycle {
    ignore_changes = [
      network_rules,
    ]
  }
}

resource "azurecaf_name" "container" {
  name          = "msi"
  resource_type = "azurerm_storage_container"
  prefixes      = local.regional_name_prefixes
  suffixes      = local.azurecaf_name_suffixes
  clean_input   = true
}

resource "azurerm_storage_container" "container" {
  name                  = azurecaf_name.container.result
  storage_account_name  = azurerm_storage_account.storage_account.name
  container_access_type = "private"
}

resource "azurecaf_name" "storageacc_private_link" {
  name          = "stracc"
  resource_type = "azurerm_private_endpoint"
  prefixes      = local.regional_name_prefixes
  suffixes      = local.azurecaf_name_suffixes
  clean_input   = true
}

resource "azurerm_private_endpoint" "storageacc_private_link" {

  name                = azurecaf_name.storageacc_private_link.result
  location            = var.location
  resource_group_name = azurerm_resource_group.app.name
  subnet_id           = module.subnet_data.this.id

  private_service_connection {
    is_manual_connection           = false
    name                           = "${azurecaf_name.storage_account.result}-svc-conn"
    private_connection_resource_id = azurerm_storage_account.storage_account.id
    private_ip_address             = null
    request_message                = null
    subresource_names              = ["blob"]
  }

  private_dns_zone_group {
    name                 = "${azurecaf_name.storage_account.result}-private-dns"
    private_dns_zone_ids = [data.terraform_remote_state.common.outputs.privatelink_dns_zone_ids["privatelink.blob.core.windows.net"]]
  }

  tags = var.tags
}