Skip to content

Commit e89cb84

Browse files
jaredfholgatejaredfholgate
authored
feat: storage account soft delete (#108)
1 parent 0820089 commit e89cb84

8 files changed

Lines changed: 149 additions & 18 deletions

File tree

‎alz/azuredevops/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,11 @@ module "azure" {
7070
container_registry_dockerfile_repository_folder_url = local.agent_container_instance_dockerfile_url
7171
custom_role_definitions = var.iac_type == "terraform" ? local.custom_role_definitions_terraform : local.custom_role_definitions_bicep
7272
role_assignments = var.iac_type == "terraform" ? var.role_assignments_terraform : var.role_assignments_bicep
73+
storage_account_blob_soft_delete_enabled = var.storage_account_blob_soft_delete_enabled
74+
storage_account_blob_soft_delete_retention_days = var.storage_account_blob_soft_delete_retention_days
75+
storage_account_blob_versioning_enabled = var.storage_account_blob_versioning_enabled
76+
storage_account_container_soft_delete_enabled = var.storage_account_container_soft_delete_enabled
77+
storage_account_container_soft_delete_retention_days = var.storage_account_container_soft_delete_retention_days
7378
}
7479

7580
module "azure_devops" {

‎alz/azuredevops/variables.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -645,3 +645,28 @@ variable "apply_alz_archetypes_via_architecture_definition_template" {
645645
default = true
646646
description = "Toggles assignment of ALZ policies. True to deploy, otherwise false. (e.g true)"
647647
}
648+
649+
variable "storage_account_blob_soft_delete_retention_days" {
650+
type = number
651+
default = 7
652+
}
653+
654+
variable "storage_account_blob_soft_delete_enabled" {
655+
type = bool
656+
default = true
657+
}
658+
659+
variable "storage_account_container_soft_delete_retention_days" {
660+
type = number
661+
default = 7
662+
}
663+
664+
variable "storage_account_container_soft_delete_enabled" {
665+
type = bool
666+
default = true
667+
}
668+
669+
variable "storage_account_blob_versioning_enabled" {
670+
type = bool
671+
default = true
672+
}

‎alz/github/main.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,11 @@ module "azure" {
7171
container_registry_dockerfile_repository_folder_url = local.runner_container_instance_dockerfile_url
7272
custom_role_definitions = var.iac_type == "terraform" ? local.custom_role_definitions_terraform : local.custom_role_definitions_bicep
7373
role_assignments = var.iac_type == "terraform" ? var.role_assignments_terraform : var.role_assignments_bicep
74+
storage_account_blob_soft_delete_enabled = var.storage_account_blob_soft_delete_enabled
75+
storage_account_blob_soft_delete_retention_days = var.storage_account_blob_soft_delete_retention_days
76+
storage_account_blob_versioning_enabled = var.storage_account_blob_versioning_enabled
77+
storage_account_container_soft_delete_enabled = var.storage_account_container_soft_delete_enabled
78+
storage_account_container_soft_delete_retention_days = var.storage_account_container_soft_delete_retention_days
7479
}
7580

7681
module "github" {

‎alz/github/variables.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -680,3 +680,28 @@ variable "apply_alz_archetypes_via_architecture_definition_template" {
680680
default = true
681681
description = "Toggles assignment of ALZ policies. True to deploy, otherwise false. (e.g true)"
682682
}
683+
684+
variable "storage_account_blob_soft_delete_retention_days" {
685+
type = number
686+
default = 7
687+
}
688+
689+
variable "storage_account_blob_soft_delete_enabled" {
690+
type = bool
691+
default = true
692+
}
693+
694+
variable "storage_account_container_soft_delete_retention_days" {
695+
type = number
696+
default = 7
697+
}
698+
699+
variable "storage_account_container_soft_delete_enabled" {
700+
type = bool
701+
default = true
702+
}
703+
704+
variable "storage_account_blob_versioning_enabled" {
705+
type = bool
706+
default = true
707+
}

‎alz/local/main.tf‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -33,24 +33,29 @@ module "files" {
3333
}
3434

3535
module "azure" {
36-
source = "../../modules/azure"
37-
count = var.create_bootstrap_resources_in_azure ? 1 : 0
38-
user_assigned_managed_identities = local.managed_identities
39-
federated_credentials = local.federated_credentials
40-
resource_group_identity_name = local.resource_names.resource_group_identity
41-
resource_group_state_name = local.resource_names.resource_group_state
42-
create_storage_account = var.iac_type == local.iac_terraform
43-
storage_account_name = local.resource_names.storage_account
44-
storage_container_name = local.resource_names.storage_container
45-
azure_location = var.bootstrap_location
46-
target_subscriptions = local.target_subscriptions
47-
root_parent_management_group_id = local.root_parent_management_group_id
48-
storage_account_replication_type = var.storage_account_replication_type
49-
use_self_hosted_agents = false
50-
use_private_networking = false
51-
custom_role_definitions = var.iac_type == "terraform" ? local.custom_role_definitions_terraform : local.custom_role_definitions_bicep
52-
role_assignments = var.iac_type == "terraform" ? var.role_assignments_terraform : var.role_assignments_bicep
53-
additional_role_assignment_principal_ids = var.grant_permissions_to_current_user ? { current_user = data.azurerm_client_config.current.object_id } : {}
36+
source = "../../modules/azure"
37+
count = var.create_bootstrap_resources_in_azure ? 1 : 0
38+
user_assigned_managed_identities = local.managed_identities
39+
federated_credentials = local.federated_credentials
40+
resource_group_identity_name = local.resource_names.resource_group_identity
41+
resource_group_state_name = local.resource_names.resource_group_state
42+
create_storage_account = var.iac_type == local.iac_terraform
43+
storage_account_name = local.resource_names.storage_account
44+
storage_container_name = local.resource_names.storage_container
45+
azure_location = var.bootstrap_location
46+
target_subscriptions = local.target_subscriptions
47+
root_parent_management_group_id = local.root_parent_management_group_id
48+
storage_account_replication_type = var.storage_account_replication_type
49+
use_self_hosted_agents = false
50+
use_private_networking = false
51+
custom_role_definitions = var.iac_type == "terraform" ? local.custom_role_definitions_terraform : local.custom_role_definitions_bicep
52+
role_assignments = var.iac_type == "terraform" ? var.role_assignments_terraform : var.role_assignments_bicep
53+
additional_role_assignment_principal_ids = var.grant_permissions_to_current_user ? { current_user = data.azurerm_client_config.current.object_id } : {}
54+
storage_account_blob_soft_delete_enabled = var.storage_account_blob_soft_delete_enabled
55+
storage_account_blob_soft_delete_retention_days = var.storage_account_blob_soft_delete_retention_days
56+
storage_account_blob_versioning_enabled = var.storage_account_blob_versioning_enabled
57+
storage_account_container_soft_delete_enabled = var.storage_account_container_soft_delete_enabled
58+
storage_account_container_soft_delete_retention_days = var.storage_account_container_soft_delete_retention_days
5459
}
5560

5661
resource "local_file" "alz" {

‎alz/local/variables.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -486,3 +486,28 @@ variable "apply_alz_archetypes_via_architecture_definition_template" {
486486
default = true
487487
description = "Toggles assignment of ALZ policies. True to deploy, otherwise false. (e.g true)"
488488
}
489+
490+
variable "storage_account_blob_soft_delete_retention_days" {
491+
type = number
492+
default = 7
493+
}
494+
495+
variable "storage_account_blob_soft_delete_enabled" {
496+
type = bool
497+
default = true
498+
}
499+
500+
variable "storage_account_container_soft_delete_retention_days" {
501+
type = number
502+
default = 7
503+
}
504+
505+
variable "storage_account_container_soft_delete_enabled" {
506+
type = bool
507+
default = true
508+
}
509+
510+
variable "storage_account_blob_versioning_enabled" {
511+
type = bool
512+
default = true
513+
}

‎modules/azure/storage.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,22 @@ resource "azurerm_storage_account" "alz" {
88
allow_nested_items_to_be_public = false
99
shared_access_key_enabled = false
1010
public_network_access_enabled = var.use_private_networking && var.use_self_hosted_agents && !var.allow_storage_access_from_my_ip ? false : true
11+
blob_properties {
12+
dynamic "delete_retention_policy" {
13+
for_each = var.storage_account_blob_soft_delete_enabled ? [1] : []
14+
content {
15+
days = var.storage_account_blob_soft_delete_retention_days
16+
}
17+
}
18+
versioning_enabled = var.storage_account_blob_versioning_enabled
19+
20+
dynamic "container_delete_retention_policy" {
21+
for_each = var.storage_account_container_soft_delete_enabled ? [1] : []
22+
content {
23+
days = var.storage_account_container_soft_delete_retention_days
24+
}
25+
}
26+
}
1127
lifecycle {
1228
ignore_changes = [queue_properties, static_website]
1329
}

‎modules/azure/variables.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,3 +280,28 @@ variable "additional_role_assignment_principal_ids" {
280280
type = map(string)
281281
default = {}
282282
}
283+
284+
variable "storage_account_blob_soft_delete_retention_days" {
285+
type = number
286+
default = 7
287+
}
288+
289+
variable "storage_account_blob_soft_delete_enabled" {
290+
type = bool
291+
default = true
292+
}
293+
294+
variable "storage_account_container_soft_delete_retention_days" {
295+
type = number
296+
default = 7
297+
}
298+
299+
variable "storage_account_container_soft_delete_enabled" {
300+
type = bool
301+
default = true
302+
}
303+
304+
variable "storage_account_blob_versioning_enabled" {
305+
type = bool
306+
default = true
307+
}

0 commit comments

Comments
 (0)