[CES-458] Added new storage account iopstcdnassets for ITN migration

[cfcuffari120400]

Motivation and Context

Storage accounts must be replicated to italy north in view of the infrastructure migration

Major Changes

Create replication of iopstcdnassets in italy north

Dependencies

Testing

Documentation

Other Considerations

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[github-actions]

📖 Terraform Plan ('src/common/prod') - success

Terraform Plan

module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_04: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile[0]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile[1]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_cgn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages_xl[0]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.app_messages_xl[1]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile[1]: Still reading... [20s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [10s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [20s elapsed]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app will be updated in-place
  ~ resource "azurerm_web_application_firewall_policy" "api_app" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-external/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/io-p-waf-appgateway-api-app-policy"
        name                = "io-p-waf-appgateway-api-app-policy"
        tags                = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra"
        }
        # (4 unchanged attributes hidden)

      ~ policy_settings {
          ~ request_body_inspect_limit_in_kb          = 0 -> 128
            # (6 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.assets_cdn_weu.module.assets_cdn_itn.azurerm_monitor_metric_alert.storage_account_health_check[0] will be created
  + resource "azurerm_monitor_metric_alert" "storage_account_health_check" {
      + auto_mitigate            = false
      + description              = "The average availability is less than 99.8%. Runbook: not needed."
      + enabled                  = true
      + frequency                = "PT5M"
      + id                       = (known after apply)
      + name                     = "[iopweuassetscdnst01] Low Availability"
      + resource_group_name      = "io-p-rg-common"
      + scopes                   = (known after apply)
      + severity                 = 0
      + tags                     = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
      + target_resource_location = (known after apply)
      + target_resource_type     = (known after apply)
      + window_size              = "PT5M"

      + criteria {
          + aggregation            = "Average"
          + metric_name            = "Availability"
          + metric_namespace       = "Microsoft.Storage/storageAccounts"
          + operator               = "LessThan"
          + skip_metric_validation = false
          + threshold              = 99.8
        }
    }

  # module.assets_cdn_weu.module.assets_cdn_itn.azurerm_private_endpoint.this["blob"] will be created
  + resource "azurerm_private_endpoint" "this" {
      + custom_dns_configs       = (known after apply)
      + id                       = (known after apply)
      + location                 = "westeurope"
      + name                     = "io-p-weu-assetscdn-blob-pep-01"
      + network_interface        = (known after apply)
      + private_dns_zone_configs = (known after apply)
      + resource_group_name      = "io-p-rg-common"
      + subnet_id                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Network/virtualNetworks/io-p-itn-common-vnet-01/subnets/io-p-itn-pep-snet-01"
      + tags                     = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }

      + private_dns_zone_group {
          + id                   = (known after apply)
          + name                 = "private-dns-zone-group"
          + private_dns_zone_ids = [
              + "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net",
            ]
        }

      + private_service_connection {
          + is_manual_connection           = false
          + name                           = "io-p-weu-assetscdn-blob-pep-01"
          + private_connection_resource_id = (known after apply)
          + private_ip_address             = (known after apply)
          + subresource_names              = [
              + "blob",
            ]
        }
    }

  # module.assets_cdn_weu.module.assets_cdn_itn.azurerm_security_center_storage_defender.this[0] will be created
  + resource "azurerm_security_center_storage_defender" "this" {
      + id                                          = (known after apply)
      + malware_scanning_on_upload_cap_gb_per_month = -1
      + malware_scanning_on_upload_enabled          = false
      + override_subscription_settings_enabled      = false
      + sensitive_data_discovery_enabled            = false
      + storage_account_id                          = (known after apply)
    }

  # module.assets_cdn_weu.module.assets_cdn_itn.azurerm_storage_account.this will be created
  + resource "azurerm_storage_account" "this" {
      + access_tier                        = "Hot"
      + account_kind                       = "StorageV2"
      + account_replication_type           = "ZRS"
      + account_tier                       = "Standard"
      + allow_nested_items_to_be_public    = true
      + cross_tenant_replication_enabled   = true
      + default_to_oauth_authentication    = false
      + dns_endpoint_type                  = "Standard"
      + enable_https_traffic_only          = (known after apply)
      + https_traffic_only_enabled         = (known after apply)
      + id                                 = (known after apply)
      + infrastructure_encryption_enabled  = false
      + is_hns_enabled                     = false
      + large_file_share_enabled           = (known after apply)
      + local_user_enabled                 = true
      + location                           = "westeurope"
      + min_tls_version                    = "TLS1_2"
      + name                               = "iopweuassetscdnst01"
      + nfsv3_enabled                      = false
      + primary_access_key                 = (sensitive value)
      + primary_blob_connection_string     = (sensitive value)
      + primary_blob_endpoint              = (known after apply)
      + primary_blob_host                  = (known after apply)
      + primary_blob_internet_endpoint     = (known after apply)
      + primary_blob_internet_host         = (known after apply)
      + primary_blob_microsoft_endpoint    = (known after apply)
      + primary_blob_microsoft_host        = (known after apply)
      + primary_connection_string          = (sensitive value)
      + primary_dfs_endpoint               = (known after apply)
      + primary_dfs_host                   = (known after apply)
      + primary_dfs_internet_endpoint      = (known after apply)
      + primary_dfs_internet_host          = (known after apply)
      + primary_dfs_microsoft_endpoint     = (known after apply)
      + primary_dfs_microsoft_host         = (known after apply)
      + primary_file_endpoint              = (known after apply)
      + primary_file_host                  = (known after apply)
      + primary_file_internet_endpoint     = (known after apply)
      + primary_file_internet_host         = (known after apply)
      + primary_file_microsoft_endpoint    = (known after apply)
      + primary_file_microsoft_host        = (known after apply)
      + primary_location                   = (known after apply)
      + primary_queue_endpoint             = (known after apply)
      + primary_queue_host                 = (known after apply)
      + primary_queue_microsoft_endpoint   = (known after apply)
      + primary_queue_microsoft_host       = (known after apply)
      + primary_table_endpoint             = (known after apply)
      + primary_table_host                 = (known after apply)
      + primary_table_microsoft_endpoint   = (known after apply)
      + primary_table_microsoft_host       = (known after apply)
      + primary_web_endpoint               = (known after apply)
      + primary_web_host                   = (known after apply)
      + primary_web_internet_endpoint      = (known after apply)
      + primary_web_internet_host          = (known after apply)
      + primary_web_microsoft_endpoint     = (known after apply)
      + primary_web_microsoft_host         = (known after apply)
      + public_network_access_enabled      = true
      + queue_encryption_key_type          = "Service"
      + resource_group_name                = "io-p-rg-common"
      + secondary_access_key               = (sensitive value)
      + secondary_blob_connection_string   = (sensitive value)
      + secondary_blob_endpoint            = (known after apply)
      + secondary_blob_host                = (known after apply)
      + secondary_blob_internet_endpoint   = (known after apply)
      + secondary_blob_internet_host       = (known after apply)
      + secondary_blob_microsoft_endpoint  = (known after apply)
      + secondary_blob_microsoft_host      = (known after apply)
      + secondary_connection_string        = (sensitive value)
      + secondary_dfs_endpoint             = (known after apply)
      + secondary_dfs_host                 = (known after apply)
      + secondary_dfs_internet_endpoint    = (known after apply)
      + secondary_dfs_internet_host        = (known after apply)
      + secondary_dfs_microsoft_endpoint   = (known after apply)
      + secondary_dfs_microsoft_host       = (known after apply)
      + secondary_file_endpoint            = (known after apply)
      + secondary_file_host                = (known after apply)
      + secondary_file_internet_endpoint   = (known after apply)
      + secondary_file_internet_host       = (known after apply)
      + secondary_file_microsoft_endpoint  = (known after apply)
      + secondary_file_microsoft_host      = (known after apply)
      + secondary_location                 = (known after apply)
      + secondary_queue_endpoint           = (known after apply)
      + secondary_queue_host               = (known after apply)
      + secondary_queue_microsoft_endpoint = (known after apply)
      + secondary_queue_microsoft_host     = (known after apply)
      + secondary_table_endpoint           = (known after apply)
      + secondary_table_host               = (known after apply)
      + secondary_table_microsoft_endpoint = (known after apply)
      + secondary_table_microsoft_host     = (known after apply)
      + secondary_web_endpoint             = (known after apply)
      + secondary_web_host                 = (known after apply)
      + secondary_web_internet_endpoint    = (known after apply)
      + secondary_web_internet_host        = (known after apply)
      + secondary_web_microsoft_endpoint   = (known after apply)
      + secondary_web_microsoft_host       = (known after apply)
      + sftp_enabled                       = false
      + shared_access_key_enabled          = true
      + table_encryption_key_type          = "Service"
      + tags                               = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }

      + blob_properties {
          + change_feed_enabled      = false
          + default_service_version  = (known after apply)
          + last_access_time_enabled = false
          + versioning_enabled       = true
        }

      + identity {
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = "SystemAssigned"
        }

      + network_rules (known after apply)

      + queue_properties (known after apply)

      + routing (known after apply)

      + share_properties (known after apply)

      + static_website {
          + error_404_document = "index.html"
          + index_document     = "index.html"
        }
    }

  # module.assets_cdn_weu.module.assets_cdn_itn.azurerm_storage_account_network_rules.network_rules will be created
  + resource "azurerm_storage_account_network_rules" "network_rules" {
      + bypass             = [
          + "AzureServices",
          + "Logging",
          + "Metrics",
        ]
      + default_action     = "Deny"
      + id                 = (known after apply)
      + storage_account_id = (known after apply)
    }

Plan: 5 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app,
  on ../_modules/application_gateway/firewall.tf line 62, in resource "azurerm_web_application_firewall_policy" "api_app":
  62:         disabled_rules = [
  63:           "942100",
  64:           "942120",
  65:           "942190",
  66:           "942200",
  67:           "942210",
  68:           "942240",
  69:           "942250",
  70:           "942260",
  71:           "942330",
  72:           "942340",
  73:           "942370",
  74:           "942380",
  75:           "942430",
  76:           "942440",
  77:           "942450",
  78:         ]

`disabled_rules` will be removed in favour of the `rule` property in version
4.0 of the AzureRM Provider.

(and 50 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.