From 55993f1e68da0de16ba67aab41efb4d1ca6c76de Mon Sep 17 00:00:00 2001 From: Nate Arnold Date: Sun, 2 Feb 2025 13:26:05 -0700 Subject: [PATCH] fix: Added depends on to advanced threat protection (#4363) ## Description Added depends on to advanced threat protection. Added parameter to toggle on or off advanced threat protection. Closes #4289 ## Pipeline Reference | Pipeline | | -------- | | [![avm.res.db-for-postgre-sql.flexible-server](https://github.com/arnoldna/bicep-registry-modules/actions/workflows/avm.res.db-for-postgre-sql.flexible-server.yml/badge.svg?branch=avm%2Fres%2Fdb-for-postgre-sql%2Fflexible-serve)](https://github.com/arnoldna/bicep-registry-modules/actions/workflows/avm.res.db-for-postgre-sql.flexible-server.yml) | ## Type of Change - [ ] Update to CI Environment or utilities (Non-module affecting changes) - [ X] Azure Verified Module updates: - [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in `version.json`: - [X ] Someone has opened a bug report issue, and I have included "Closes #{bug_report_issue_number}" in the PR description. - [ ] The bug was found by the module author, and no one has opened an issue to report it yet. - [ ] Feature update backwards compatible feature updates, and I have bumped the MINOR version in `version.json`. - [ ] Breaking changes and I have bumped the MAJOR version in `version.json`. - [ X] Update to documentation ## Checklist - [X ] I'm sure there are no other open Pull Requests for the same update/change - [ X] I have run `Set-AVMModule` locally to generate the supporting module files. - [X ] My corresponding pipelines / checks run clean and green without any errors or warnings --- .../db-for-postgre-sql/flexible-server/README.md | 11 +++++++++++ .../flexible-server/administrator/main.json | 4 ++-- .../advanced-threat-protection/main.json | 4 ++-- .../flexible-server/configuration/main.json | 4 ++-- .../flexible-server/database/main.json | 4 ++-- .../flexible-server/firewall-rule/main.json | 4 ++-- .../db-for-postgre-sql/flexible-server/main.bicep | 10 ++++++++-- .../db-for-postgre-sql/flexible-server/main.json | 15 ++++++++++++--- .../flexible-server/version.json | 4 ++-- 9 files changed, 43 insertions(+), 17 deletions(-) diff --git a/avm/res/db-for-postgre-sql/flexible-server/README.md b/avm/res/db-for-postgre-sql/flexible-server/README.md index 5c6d0cc7d6..c4b73fcbce 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/README.md +++ b/avm/res/db-for-postgre-sql/flexible-server/README.md @@ -1345,6 +1345,7 @@ param tags = { | [`databases`](#parameter-databases) | array | The databases to create in the server. | | [`delegatedSubnetResourceId`](#parameter-delegatedsubnetresourceid) | string | Delegated subnet arm resource ID. Used when the desired connectivity mode is 'Private Access' - virtual network integration. | | [`diagnosticSettings`](#parameter-diagnosticsettings) | array | The diagnostic settings of the service. | +| [`enableAdvancedThreatProtection`](#parameter-enableadvancedthreatprotection) | bool | Enable/Disable advanced threat protection. | | [`enableTelemetry`](#parameter-enabletelemetry) | bool | Enable/Disable usage telemetry for module. | | [`firewallRules`](#parameter-firewallrules) | array | The firewall rules to create in the PostgreSQL flexible server. | | [`geoRedundantBackup`](#parameter-georedundantbackup) | string | A value indicating whether Geo-Redundant backup is enabled on the server. Should be disabled if 'cMKKeyName' is not empty. | @@ -1777,6 +1778,16 @@ Resource ID of the diagnostic log analytics workspace. For security reasons, it - MinValue: 7 - MaxValue: 35 +### Parameter: `enableAdvancedThreatProtection` + +Enable/Disable advanced threat protection. + +- Required: No +- Type: bool +- Default: `True` +- MinValue: 7 +- MaxValue: 35 + ### Parameter: `enableTelemetry` Enable/Disable usage telemetry for module. diff --git a/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json b/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json index 94213b4bf8..2990c88822 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json +++ b/avm/res/db-for-postgre-sql/flexible-server/administrator/main.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.32.4.45862", - "templateHash": "16643531997327278217" + "version": "0.33.13.18514", + "templateHash": "9438694500506305843" }, "name": "DBforPostgreSQL Flexible Server Administrators", "description": "This module deploys a DBforPostgreSQL Flexible Server Administrator." diff --git a/avm/res/db-for-postgre-sql/flexible-server/advanced-threat-protection/main.json b/avm/res/db-for-postgre-sql/flexible-server/advanced-threat-protection/main.json index 0ae8925645..f8f5d9ad49 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/advanced-threat-protection/main.json +++ b/avm/res/db-for-postgre-sql/flexible-server/advanced-threat-protection/main.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.32.4.45862", - "templateHash": "6141187485193116497" + "version": "0.33.13.18514", + "templateHash": "17600786812294347393" }, "name": "DBforPostgreSQL Flexible Server Advanced Threat Protection", "description": "This module deploys a DBforPostgreSQL Advanced Threat Protection." diff --git a/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json b/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json index b99b9c8c4f..8dae49f87f 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json +++ b/avm/res/db-for-postgre-sql/flexible-server/configuration/main.json @@ -5,8 +5,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.32.4.45862", - "templateHash": "17791142604055425268" + "version": "0.33.13.18514", + "templateHash": "14381841795302215842" }, "name": "DBforPostgreSQL Flexible Server Configurations", "description": "This module deploys a DBforPostgreSQL Flexible Server Configuration." diff --git a/avm/res/db-for-postgre-sql/flexible-server/database/main.json b/avm/res/db-for-postgre-sql/flexible-server/database/main.json index b5546138c5..ef10f4396c 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/database/main.json +++ b/avm/res/db-for-postgre-sql/flexible-server/database/main.json @@ -5,8 +5,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.32.4.45862", - "templateHash": "15358721384580155368" + "version": "0.33.13.18514", + "templateHash": "12559382321541199726" }, "name": "DBforPostgreSQL Flexible Server Databases", "description": "This module deploys a DBforPostgreSQL Flexible Server Database." diff --git a/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json b/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json index bd6de36b05..001cbab662 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json +++ b/avm/res/db-for-postgre-sql/flexible-server/firewall-rule/main.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.32.4.45862", - "templateHash": "1547810610444554016" + "version": "0.33.13.18514", + "templateHash": "533163168353951900" }, "name": "DBforPostgreSQL Flexible Server Firewall Rules", "description": "This module deploys a DBforPostgreSQL Flexible Server Firewall Rule." diff --git a/avm/res/db-for-postgre-sql/flexible-server/main.bicep b/avm/res/db-for-postgre-sql/flexible-server/main.bicep index ff5ddb9cb6..08a780886b 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/main.bicep +++ b/avm/res/db-for-postgre-sql/flexible-server/main.bicep @@ -162,6 +162,9 @@ param lock lockType? @description('Optional. The replication settings for the server. Can only be set on existing flexible servers.') param replica replicaType? +@description('Optional. Enable/Disable advanced threat protection.') +param enableAdvancedThreatProtection bool = true + import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5.1' @description('Optional. Array of role assignments to create.') param roleAssignments roleAssignmentType[]? @@ -283,7 +286,7 @@ resource flexibleServer 'Microsoft.DBforPostgreSQL/flexibleServers@2024-08-01' = dataEncryption: !empty(customerManagedKey) ? { primaryKeyURI: !empty(customerManagedKey.?keyVersion ?? '') - ? '${cMKKeyVault::cMKKey.properties.keyUri}/${customerManagedKey!.keyVersion}' + ? '${cMKKeyVault::cMKKey.properties.keyUri}/${customerManagedKey!.?keyVersion}' : cMKKeyVault::cMKKey.properties.keyUriWithVersion primaryUserAssignedIdentityId: cMKUserAssignedIdentity.id type: 'AzureKeyVault' @@ -407,12 +410,15 @@ module flexibleServer_administrators 'administrator/main.bicep' = [ } ] -module flexibleServer_advancedThreatProtection 'advanced-threat-protection/main.bicep' = { +module flexibleServer_advancedThreatProtection 'advanced-threat-protection/main.bicep' = if (enableAdvancedThreatProtection) { name: '${uniqueString(deployment().name, location)}-PostgreSQL-Threat' params: { serverThreatProtection: serverThreatProtection flexibleServerName: flexibleServer.name } + dependsOn: [ + flexibleServer_administrators + ] } resource flexibleServer_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [ diff --git a/avm/res/db-for-postgre-sql/flexible-server/main.json b/avm/res/db-for-postgre-sql/flexible-server/main.json index 754dac6128..111ad605cf 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/main.json +++ b/avm/res/db-for-postgre-sql/flexible-server/main.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.33.13.18514", - "templateHash": "12436555269178944742" + "templateHash": "8102121291373013517" }, "name": "DBforPostgreSQL Flexible Servers", "description": "This module deploys a DBforPostgreSQL Flexible Server." @@ -927,6 +927,13 @@ "description": "Optional. The replication settings for the server. Can only be set on existing flexible servers." } }, + "enableAdvancedThreatProtection": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable advanced threat protection." + } + }, "roleAssignments": { "type": "array", "items": { @@ -1063,7 +1070,7 @@ "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "createMode": "[parameters('createMode')]", - "dataEncryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('primaryKeyURI', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), reference('cMKKeyVault::cMKKey').keyUriWithVersion), 'primaryUserAssignedIdentityId', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2], split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))), 'type', 'AzureKeyVault'), null())]", + "dataEncryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('primaryKeyURI', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, tryGet(parameters('customerManagedKey'), 'keyVersion')), reference('cMKKeyVault::cMKKey').keyUriWithVersion), 'primaryUserAssignedIdentityId', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '//'), '/')[2], split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '////'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), 'dummyMsi'), '/'))), 'type', 'AzureKeyVault'), null())]", "highAvailability": { "mode": "[parameters('highAvailability')]", "standbyAvailabilityZone": "[if(equals(parameters('highAvailability'), 'SameZone'), parameters('availabilityZone'), null())]" @@ -1621,6 +1628,7 @@ ] }, "flexibleServer_advancedThreatProtection": { + "condition": "[parameters('enableAdvancedThreatProtection')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2022-09-01", "name": "[format('{0}-PostgreSQL-Threat', uniqueString(deployment().name, parameters('location')))]", @@ -1710,7 +1718,8 @@ } }, "dependsOn": [ - "flexibleServer" + "flexibleServer", + "flexibleServer_administrators" ] }, "server_privateEndpoints": { diff --git a/avm/res/db-for-postgre-sql/flexible-server/version.json b/avm/res/db-for-postgre-sql/flexible-server/version.json index 9a9a06e897..b39a201436 100644 --- a/avm/res/db-for-postgre-sql/flexible-server/version.json +++ b/avm/res/db-for-postgre-sql/flexible-server/version.json @@ -1,7 +1,7 @@ { "$schema": "https://aka.ms/bicep-registry-module-version-file-schema#", - "version": "0.8", + "version": "0.9", "pathFilters": [ "./main.json" ] -} \ No newline at end of file +}