[CES-208] - Create iopcgnlegalbackupstorage replica in itn

[christian-calabrese]

Motivation and Context

Storage accounts must be replicated to italy north in view of the infrastructure migration

Major Changes

Create replication of iopcgnlegalbackupstorage in italy north

Dependencies

Testing

Documentation

Other Considerations

[github-actions]

Terraform Plan ('src/domains/cgn/prod') 📖

Terraform Plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.cosmos.module.cgn_cosmosdb_containers["user-cgns"].azurerm_cosmosdb_sql_container.this will be updated in-place
  ~ resource "azurerm_cosmosdb_sql_container" "this" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-cgn/providers/Microsoft.DocumentDB/databaseAccounts/io-p-cosmos-cgn/sqlDatabases/db/containers/user-cgns"
        name                = "user-cgns"
        # (5 unchanged attributes hidden)

      ~ autoscale_settings {
          ~ max_throughput = 4000 -> 2000
        }

        # (2 unchanged blocks hidden)
    }

  # module.functions.module.function_cgn.azurerm_linux_function_app.this will be updated in-place
  ~ resource "azurerm_linux_function_app" "this" {
      ~ app_settings                                   = {
          ~ "AzureWebJobs.UpdateExpiredCgn.Disabled"          = "1" -> "0"
          ~ "AzureWebJobs.UpdateExpiredEyca.Disabled"         = "1" -> "0"
            # (40 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-cgn-be-rg/providers/Microsoft.Web/sites/io-p-cgn-fn"
        name                                           = "io-p-cgn-fn"
        tags                                           = {
            "CostCenter"                                     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"                                      = "Terraform"
            "Environment"                                    = "Prod"
            "ManagementTeam"                                 = "IO Enti & Servizi"
            "Owner"                                          = "IO"
            "Source"                                         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod"
        }
        # (31 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.functions.module.function_cgn_merchant.azurerm_linux_function_app.this will be updated in-place
  ~ resource "azurerm_linux_function_app" "this" {
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-cgn-be-rg/providers/Microsoft.Web/sites/io-p-cgn-merchant-fn"
        name                                           = "io-p-cgn-merchant-fn"
        tags                                           = {
            "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Enti & Servizi"
            "Owner"          = "IO"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod"
        }
        # (32 unchanged attributes hidden)

      ~ site_config {
          ~ health_check_eviction_time_in_min             = 0 -> 2
            # (30 unchanged attributes hidden)

            # (3 unchanged blocks hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.functions.module.function_cgn_merchant_staging_slot.azurerm_linux_function_app_slot.this will be updated in-place
  ~ resource "azurerm_linux_function_app_slot" "this" {
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-cgn-be-rg/providers/Microsoft.Web/sites/io-p-cgn-merchant-fn/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Enti & Servizi"
            "Owner"          = "IO"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod"
        }
        # (30 unchanged attributes hidden)

      ~ site_config {
          ~ health_check_eviction_time_in_min             = 0 -> 2
            # (31 unchanged attributes hidden)

            # (4 unchanged blocks hidden)
        }
    }

  # module.redis.module.redis_cgn.azurerm_redis_cache.this will be updated in-place
  ~ resource "azurerm_redis_cache" "this" {
        id                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-cgn/providers/Microsoft.Cache/redis/io-p-redis-cgn-std"
        name                          = "io-p-redis-cgn-std"
        tags                          = {
            "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Enti & Servizi"
            "Owner"          = "IO"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod"
        }
        # (23 unchanged attributes hidden)

      ~ redis_configuration {
          + data_persistence_authentication_method  = "SAS"
            # (16 unchanged attributes hidden)
        }

        # (5 unchanged blocks hidden)
    }

  # module.storage_accounts.module.azure_storage_account.azurerm_monitor_metric_alert.storage_account_health_check[0] will be created
  + resource "azurerm_monitor_metric_alert" "storage_account_health_check" {
      + auto_mitigate            = false
      + description              = "The average availability is less than 99.8%. Runbook: not needed."
      + enabled                  = true
      + frequency                = "PT5M"
      + id                       = (known after apply)
      + name                     = "[iopitncgnlegalbackupst01] Low Availability"
      + resource_group_name      = "io-p-rg-cgn"
      + scopes                   = (known after apply)
      + severity                 = 0
      + tags                     = {
          + "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"      = "Terraform"
          + "Environment"    = "Prod"
          + "ManagementTeam" = "IO Enti & Servizi"
          + "Owner"          = "IO"
          + "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod"
        }
      + target_resource_location = (known after apply)
      + target_resource_type     = (known after apply)
      + window_size              = "PT5M"

      + criteria {
          + aggregation            = "Average"
          + metric_name            = "Availability"
          + metric_namespace       = "Microsoft.Storage/storageAccounts"
          + operator               = "LessThan"
          + skip_metric_validation = false
          + threshold              = 99.8
        }
    }

  # module.storage_accounts.module.azure_storage_account.azurerm_private_endpoint.this["blob"] will be created
  + resource "azurerm_private_endpoint" "this" {
      + custom_dns_configs       = (known after apply)
      + id                       = (known after apply)
      + location                 = "italynorth"
      + name                     = "io-p-itn-cgn-legalbackup-blob-pep-01"
      + network_interface        = (known after apply)
      + private_dns_zone_configs = (known after apply)
      + resource_group_name      = "io-p-rg-cgn"
      + subnet_id                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/virtualNetworks/io-p-vnet-common/subnets/pendpoints"
      + tags                     = {
          + "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"      = "Terraform"
          + "Environment"    = "Prod"
          + "ManagementTeam" = "IO Enti & Servizi"
          + "Owner"          = "IO"
          + "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod"
        }

      + private_dns_zone_group {
          + id                   = (known after apply)
          + name                 = "private-dns-zone-group"
          + private_dns_zone_ids = [
              + "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net",
            ]
        }

      + private_service_connection {
          + is_manual_connection           = false
          + name                           = "io-p-itn-cgn-legalbackup-blob-pep-01"
          + private_connection_resource_id = (known after apply)
          + private_ip_address             = (known after apply)
          + subresource_names              = [
              + "blob",
            ]
        }
    }

  # module.storage_accounts.module.azure_storage_account.azurerm_security_center_storage_defender.this[0] will be created
  + resource "azurerm_security_center_storage_defender" "this" {
      + id                                          = (known after apply)
      + malware_scanning_on_upload_cap_gb_per_month = -1
      + malware_scanning_on_upload_enabled          = false
      + override_subscription_settings_enabled      = false
      + sensitive_data_discovery_enabled            = false
      + storage_account_id                          = (known after apply)
    }

  # module.storage_accounts.module.azure_storage_account.azurerm_storage_account.this will be created
  + resource "azurerm_storage_account" "this" {
      + access_tier                        = "Hot"
      + account_kind                       = "StorageV2"
      + account_replication_type           = "ZRS"
      + account_tier                       = "Standard"
      + allow_nested_items_to_be_public    = true
      + cross_tenant_replication_enabled   = true
      + default_to_oauth_authentication    = false
      + enable_https_traffic_only          = true
      + id                                 = (known after apply)
      + infrastructure_encryption_enabled  = false
      + is_hns_enabled                     = false
      + large_file_share_enabled           = (known after apply)
      + local_user_enabled                 = true
      + location                           = "italynorth"
      + min_tls_version                    = "TLS1_2"
      + name                               = "iopitncgnlegalbackupst01"
      + nfsv3_enabled                      = false
      + primary_access_key                 = (sensitive value)
      + primary_blob_connection_string     = (sensitive value)
      + primary_blob_endpoint              = (known after apply)
      + primary_blob_host                  = (known after apply)
      + primary_blob_internet_endpoint     = (known after apply)
      + primary_blob_internet_host         = (known after apply)
      + primary_blob_microsoft_endpoint    = (known after apply)
      + primary_blob_microsoft_host        = (known after apply)
      + primary_connection_string          = (sensitive value)
      + primary_dfs_endpoint               = (known after apply)
      + primary_dfs_host                   = (known after apply)
      + primary_dfs_internet_endpoint      = (known after apply)
      + primary_dfs_internet_host          = (known after apply)
      + primary_dfs_microsoft_endpoint     = (known after apply)
      + primary_dfs_microsoft_host         = (known after apply)
      + primary_file_endpoint              = (known after apply)
      + primary_file_host                  = (known after apply)
      + primary_file_internet_endpoint     = (known after apply)
      + primary_file_internet_host         = (known after apply)
      + primary_file_microsoft_endpoint    = (known after apply)
      + primary_file_microsoft_host        = (known after apply)
      + primary_location                   = (known after apply)
      + primary_queue_endpoint             = (known after apply)
      + primary_queue_host                 = (known after apply)
      + primary_queue_microsoft_endpoint   = (known after apply)
      + primary_queue_microsoft_host       = (known after apply)
      + primary_table_endpoint             = (known after apply)
      + primary_table_host                 = (known after apply)
      + primary_table_microsoft_endpoint   = (known after apply)
      + primary_table_microsoft_host       = (known after apply)
      + primary_web_endpoint               = (known after apply)
      + primary_web_host                   = (known after apply)
      + primary_web_internet_endpoint      = (known after apply)
      + primary_web_internet_host          = (known after apply)
      + primary_web_microsoft_endpoint     = (known after apply)
      + primary_web_microsoft_host         = (known after apply)
      + public_network_access_enabled      = true
      + queue_encryption_key_type          = "Service"
      + resource_group_name                = "io-p-rg-cgn"
      + secondary_access_key               = (sensitive value)
      + secondary_blob_connection_string   = (sensitive value)
      + secondary_blob_endpoint            = (known after apply)
      + secondary_blob_host                = (known after apply)
      + secondary_blob_internet_endpoint   = (known after apply)
      + secondary_blob_internet_host       = (known after apply)
      + secondary_blob_microsoft_endpoint  = (known after apply)
      + secondary_blob_microsoft_host      = (known after apply)
      + secondary_connection_string        = (sensitive value)
      + secondary_dfs_endpoint             = (known after apply)
      + secondary_dfs_host                 = (known after apply)
      + secondary_dfs_internet_endpoint    = (known after apply)
      + secondary_dfs_internet_host        = (known after apply)
      + secondary_dfs_microsoft_endpoint   = (known after apply)
      + secondary_dfs_microsoft_host       = (known after apply)
      + secondary_file_endpoint            = (known after apply)
      + secondary_file_host                = (known after apply)
      + secondary_file_internet_endpoint   = (known after apply)
      + secondary_file_internet_host       = (known after apply)
      + secondary_file_microsoft_endpoint  = (known after apply)
      + secondary_file_microsoft_host      = (known after apply)
      + secondary_location                 = (known after apply)
      + secondary_queue_endpoint           = (known after apply)
      + secondary_queue_host               = (known after apply)
      + secondary_queue_microsoft_endpoint = (known after apply)
      + secondary_queue_microsoft_host     = (known after apply)
      + secondary_table_endpoint           = (known after apply)
      + secondary_table_host               = (known after apply)
      + secondary_table_microsoft_endpoint = (known after apply)
      + secondary_table_microsoft_host     = (known after apply)
      + secondary_web_endpoint             = (known after apply)
      + secondary_web_host                 = (known after apply)
      + secondary_web_internet_endpoint    = (known after apply)
      + secondary_web_internet_host        = (known after apply)
      + secondary_web_microsoft_endpoint   = (known after apply)
      + secondary_web_microsoft_host       = (known after apply)
      + sftp_enabled                       = false
      + shared_access_key_enabled          = true
      + table_encryption_key_type          = "Service"
      + tags                               = {
          + "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"      = "Terraform"
          + "Environment"    = "Prod"
          + "ManagementTeam" = "IO Enti & Servizi"
          + "Owner"          = "IO"
          + "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/domains/cgn/prod"
        }

      + blob_properties {
          + change_feed_enabled      = false
          + default_service_version  = (known after apply)
          + last_access_time_enabled = false
          + versioning_enabled       = false
        }

      + identity {
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = "SystemAssigned"
        }

      + network_rules (known after apply)

      + queue_properties (known after apply)

      + routing (known after apply)

      + share_properties (known after apply)
    }

  # module.storage_accounts.module.azure_storage_account.azurerm_storage_account_network_rules.network_rules will be created
  + resource "azurerm_storage_account_network_rules" "network_rules" {
      + bypass                     = [
          + "AzureServices",
          + "Logging",
          + "Metrics",
        ]
      + default_action             = "Deny"
      + id                         = (known after apply)
      + ip_rules                   = (known after apply)
      + storage_account_id         = (known after apply)
      + virtual_network_subnet_ids = (known after apply)
    }

Plan: 5 to add, 5 to change, 0 to destroy.

Warning: Deprecated Resource

  with module.functions.azurerm_app_service_plan.app_service_plan_cgn_common,
  on ../_modules/functions_apps/app_service_plan_cgn_common.tf line 1, in resource "azurerm_app_service_plan" "app_service_plan_cgn_common":
   1: resource "azurerm_app_service_plan" "app_service_plan_cgn_common" {

The `azurerm_app_service_plan` resource has been superseded by the
`azurerm_service_plan` resource. Whilst this resource will continue to be
available in the 2.x and 3.x releases it is feature-frozen for compatibility
purposes, will no longer receive any updates and will be removed in a future
major release of the Azure Provider.

(and one more similar warning elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud