Repository files navigation

Azure Database for PostgreSQL Single Server is a fully managed database service with minimal requirements for customizations of database. The single server platform is designed to handle most of the database management functions such as patching, backups, high availability, security with minimal user configuration and control. The architecture is optimized for built-in high availability with 99.99% availability on single availability zone. It supports community version of PostgreSQL 9.5, 9,6, 10, and 11.

• PostgreSQL Server
• PostgreSQL Database
• PostgreSQL Configuration
• PostgreSQL Firewall Rules
• PostgreSQL Active Directory Administrator
• PostgreSQL Customer Managed Key
• PostgreSQL Virtual Network Rule
• PostgreSQL Diagnostics
• Private Endpoints
• Private DNS zone forprivatelink A records

module"postgresql-db" {source="kumarvna/postgresql-db/azurerm"version="1.1.0"# By default, this module will create a resource group# proivde a name to use an existing resource group and set the argument# to `create_resource_group = false` if you want to existing resoruce group.# If you use existing resrouce group location will be the same as existing RG.create_resource_group=falseresource_group_name="rg-shared-westeurope-01"location="westeurope"# PostgreSQL Server and Database settingspostgresql_server_name="mypostgresdbsrv01"postgresql_server_settings={    sku_name="GP_Gen5_8"    storage_mb=640000    version="9.6"# default admin user `postgresadmin` and can be specified as per the choice here# by default random password created by this module. required password can be specified here    admin_username="postgresadmin"    admin_password="H@Sh1CoR3!"# Database name, charset and collection arguments    database_name="demo-postgres-db"    charset="UTF8"    collation="English_United States.1252"# Storage Profile and other optional arguments    auto_grow_enabled=true    backup_retention_days=7    geo_redundant_backup_enabled=true    public_network_access_enabled=true    ssl_enforcement_enabled=true    ssl_minimal_tls_version_enforced="TLS1_2"  }# PostgreSQL Server Parameters# For more information: https://bit.ly/3dbYTtBpostgresql_configuration={    backslash_quote="on"  }# Use Virtual Network service endpoints and rules for Azure Database for PostgreSQLsubnet_id=var.subnet_id# The URL to a Key Vault custom managed keykey_vault_key_id=var.key_vault_key_id# To enable Azure Defender for database set `enable_threat_detection_policy` to trueenable_threat_detection_policy=truelog_retention_days=30email_addresses_for_alerts=["user@example.com","firstname.lastname@example.com"]# AD administrator for an Azure database for PostgreSQL# Allows you to set a user or group as the AD administrator for PostgreSQL serverad_admin_login_name="firstname.lastname@example.com"# (Optional) To enable Azure Monitoring for Azure PostgreSQL database# (Optional) Specify `storage_account_name` to save monitoring logs to storage.log_analytics_workspace_name="loganalytics-we-sharedtest2"# Creating Private Endpoint requires, VNet name and address prefix to create a subnet# By default this will create a `privatelink.mysql.database.azure.com` DNS zone.# To use existing private DNS zone specify `existing_private_dns_zone` with valid zone nameenable_private_endpoint=truevirtual_network_name="vnet-shared-hub-westeurope-001"private_subnet_address_prefix=["10.1.5.0/29"]#  existing_private_dns_zone     = "demo.example.com"# Firewall Rules to allow azure and external clients and specific Ip address/ranges.firewall_rules={    access-to-azure= {      start_ip_address="0.0.0.0"      end_ip_address="0.0.0.0"    },    desktop-ip= {      start_ip_address="49.204.228.223"      end_ip_address="49.204.228.223"    }  }# Tags for Azure Resourcestags={    Terraform="true"    Environment="dev"    Owner="test-user"  }}

This module utilizespostgresadmin as a local administrator on PostgreSQL server. If you want to you use custom username, then specify the same by setting up the argumentadmin_username with a valid user string.

By default, this module generates a strong password for PostgreSQL server also allows you to change the length of the random password (currently 24) using therandom_password_length variable. If you want to set the custom password, specify the argumentadmin_password with a valid string.

This object helps you setup desired PostgreSQL server and support following arguments.

The PostgreSQL server maintains many system variables that configure its operation. Each system variable has a default value. System variables can be set at server startup using options on the command line or in an option file. Most of them can be changed dynamically at runtime using the SET statement, which enables you to modify operation of the server without having to stop and restart it. You can also use system variable values in expressions.

A few Supported parameters are here for your reference. you can find all theseServer Paramter section in PostgreSQL server. Also checkPostgreSQL website for more details.

A virtual network rule for your Azure Database for PostgreSQL server is a subnet that is listed in the access control list (ACL) of your Azure Database for PostgreSQL server. To be in the ACL for your Azure Database for PostgreSQL server, the subnet must contain theMicrosoft.Sql type name. To enable this feature, add asubnet_id with valid resource id.

This feature is available in all regions of Azure public cloud where Azure Database for PostgreSQL is deployed for General Purpose and Memory Optimized servers. In case of VNet peering, if traffic is flowing through a common VNet Gateway with service endpoints and is supposed to flow to the peer, please create an ACL/VNet rule to allow Azure Virtual Machines in the Gateway VNet to access the Azure Database for PostgreSQL server.

Data encryption with customer-managed keys for Azure Database for PostgreSQL enables you to bring your own key (BYOK) for data protection at rest. It also allows organizations to implement separation of duties in the management of keys and data.

Data encryption is set at the server-level. The customer-managed key is an asymmetric key stored in a customer-owned and customer-managed AzureKey Vault instance. To add you own key from key valut use variablekey_vault_key_id with valid key URL.

Firewalls prevent all access to your database server until you specify which computers have permission. To configure a firewall, create firewall rules that specify ranges of acceptable IP addresses.

By default, no external access to your PostgreSQL Database will be allowed until you explicitly assign permission by creating a firewall rule. To add the firewall rules to the PostgreSQL database, specify the list offirewall_rules with valid IP addresses.

Azure Active Directory authentication is a mechanism of connecting to Microsoft Azure database for PostgreSQL by using identities in Azure Active Directory (Azure AD). This module adds the provided Azure Active Directory user/group to PostgreSQL Database as an administrator so that the user can login to this database with Azure AD authentication.

By default, this feature not enabled on this module. To add the Active Directory Administrator, set the argumentad_admin_login_name with a valid Azure AD user/group login name.

Advanced Threat Detection for Azure Database for PostgreSQL server detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases and it can trigger the following alerts:

• Access from unusual location
• Access from unusual Azure data center
• Access from unfamiliar principal
• Access from a potentially harmful application
• Brute force login credentials

By default, this feature not enabled on this module. Enable threat detection policy setting up the variablesenable_threat_detection_policy,log_retention_days andemail_addresses_for_alerts with valid values.

Note: Enablingthreat_detection_policy features on SQL servers and database going to create a storage account to keep all audit logs by this module. Log retention policy to be configured to keep the size within limits for this storage account. Note that this module creates resources that can cost money.

Applying tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair. For example, you can apply the nameEnvironment and the valueProduction to all the resources in production.For recommendations on how to implement a tagging strategy, see Resource naming and tagging decision guide.

Important :Tag names are case-insensitive for operations. A tag with a tag name, regardless of the casing, is updated or retrieved. However, the resource provider might keep the casing you provide for the tag name. You'll see that casing in cost reports.Tag values are case-sensitive.

An effective naming convention assembles resource names by using important resource information as parts of a resource's name. For example, using theserecommended naming conventions, a public IP resource for a production SharePoint workload is named like this:pip-sharepoint-prod-westus-001.

Originally created byKumaraswamy Vithanala

• Azure database for PostgreSQL
• Terraform AzureRM Provider Documentation