TES-309: Support for loading GraphDB license in VMSS #4
Conversation
mihailradkov
force-pushed
the
TES-309-loading-license-secret
branch
from
a9acbb5 to
05b8558
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| module "configuration" { | ||
| source = "./modules/configuration" | ||
|
|
||
| resource_group_name = azurerm_resource_group.graphdb.name | ||
|
|
||
| identity_name = module.identity.identity_name | ||
| graphdb_license_path = var.graphdb_license_path | ||
| key_vault_name = module.vault.key_vault_name | ||
|
|
||
| tags = local.tags | ||
|
|
||
| depends_on = [ | ||
| azurerm_resource_group.graphdb, | ||
| # Wait for complete module creation | ||
| module.vault | ||
| ] | ||
| } |
Check notice
Code scanning / defsec
Key vault Secret should have a content type set Note
| module "configuration" { | ||
| source = "./modules/configuration" | ||
|
|
||
| resource_group_name = azurerm_resource_group.graphdb.name | ||
|
|
||
| identity_name = module.identity.identity_name | ||
| graphdb_license_path = var.graphdb_license_path | ||
| key_vault_name = module.vault.key_vault_name | ||
|
|
||
| tags = local.tags | ||
|
|
||
| depends_on = [ | ||
| azurerm_resource_group.graphdb, | ||
| # Wait for complete module creation | ||
| module.vault | ||
| ] | ||
| } |
Check notice
Code scanning / defsec
Key Vault Secret should have an expiration date set Note
| module "vault" { | ||
| source = "./modules/vault" | ||
|
|
||
| resource_name_prefix = var.resource_name_prefix | ||
| resource_group_name = azurerm_resource_group.graphdb.name | ||
|
|
||
| tags = local.tags | ||
|
|
||
| depends_on = [azurerm_resource_group.graphdb] | ||
| } |
Check warning
Code scanning / defsec
Key vault should have purge protection enabled Warning
| module "vault" { | ||
| source = "./modules/vault" | ||
|
|
||
| resource_name_prefix = var.resource_name_prefix | ||
| resource_group_name = azurerm_resource_group.graphdb.name | ||
|
|
||
| tags = local.tags | ||
|
|
||
| depends_on = [azurerm_resource_group.graphdb] | ||
| } |
Check failure
Code scanning / defsec
Key vault should have the network acl block specified Error
There was a problem hiding this comment.
Security issues will be address in another PR
Added new TF modules: - configuration - takes care of handling GraphDB configurations and secrets - identity - responsible for creating and managing a user assigned identity - vault - creates a key vault for storing sensitive configurations Updated the user data script to authenticate in Azure CLI and download the license.
mihailradkov
force-pushed
the
TES-309-loading-license-secret
branch
from
d95749e to
dd1cfe4
Compare
Changes
Updated the user data script to authenticate in Azure CLI and download the license.
Added new TF modules: