Skip to content

Instantly share code, notes, and snippets.

@joshjohanning
Created October 27, 2021 15:01
Show Gist options
  • Save joshjohanning/f95a774932148a36683904e8e5785bec to your computer and use it in GitHub Desktop.
Save joshjohanning/f95a774932148a36683904e8e5785bec to your computer and use it in GitHub Desktop.
private / locked down storage account sample
# This template is used to deploy the storage account resources
resource "azurecaf_name" "storage_account" {
name = "msi"
resource_type = "azurerm_storage_account"
prefixes = local.regional_name_prefixes
suffixes = local.azurecaf_name_suffixes
clean_input = true
}
resource "azurerm_storage_account" "storage_account" {
name = azurecaf_name.storage_account.result
resource_group_name = azurerm_resource_group.app.name
location = azurerm_resource_group.app.location
account_tier = "standard"
account_kind = "StorageV2"
access_tier = "Hot"
account_replication_type = "RAGRS"
min_tls_version = "TLS1_2"
allow_blob_public_access = false
network_rules {
default_action = "Deny"
ip_rules = []
virtual_network_subnet_ids = [data.azurerm_subnet.mgmt.id]
}
tags = var.tags
lifecycle {
ignore_changes = [
network_rules,
]
}
}
resource "azurecaf_name" "container" {
name = "msi"
resource_type = "azurerm_storage_container"
prefixes = local.regional_name_prefixes
suffixes = local.azurecaf_name_suffixes
clean_input = true
}
resource "azurerm_storage_container" "container" {
name = azurecaf_name.container.result
storage_account_name = azurerm_storage_account.storage_account.name
container_access_type = "private"
}
resource "azurecaf_name" "storageacc_private_link" {
name = "stracc"
resource_type = "azurerm_private_endpoint"
prefixes = local.regional_name_prefixes
suffixes = local.azurecaf_name_suffixes
clean_input = true
}
resource "azurerm_private_endpoint" "storageacc_private_link" {
name = azurecaf_name.storageacc_private_link.result
location = var.location
resource_group_name = azurerm_resource_group.app.name
subnet_id = module.subnet_data.this.id
private_service_connection {
is_manual_connection = false
name = "${azurecaf_name.storage_account.result}-svc-conn"
private_connection_resource_id = azurerm_storage_account.storage_account.id
private_ip_address = null
request_message = null
subresource_names = ["blob"]
}
private_dns_zone_group {
name = "${azurecaf_name.storage_account.result}-private-dns"
private_dns_zone_ids = [data.terraform_remote_state.common.outputs.privatelink_dns_zone_ids["privatelink.blob.core.windows.net"]]
}
tags = var.tags
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment