terraform-azurerm-avm-res-web-site

Breaking Change(s)

• migration to version 0.1.0 of avm-res-web-serverfarm from azurerm_service_plan
• removed certain outputs regarding service_plan

Feature(s)

• added addtitional support for avm-res-storage-storageaccount inputs
• added additional support for new_service_plan variable

Update(s)

• module now uses version 0.2.4 of avm-res-storage-storageaccount
• x_fd_health_probe to properly work when using ip_restriction/scm_ip_restriction and Azure Front Door
• module is now configured to zone redundant by default
  • worker_count defaults to 3
  • zone_balancing_enabled defaults to true
  • sku_name defaults to P1v2

Breaking Change(s)

None

Feature(s)

None

Update(s)

• updates for github policies and workflows
• removed providers from yml templates and markdown documentation
• removed examples for:
  • linux_function_app
  • linux_web_app
  • windows_function_app
  • windows_web_app
• created examples for:
  • function_app
  • web_app

Breaking Change(s)

• changes to key references of dynamic blocks application_logs and http_logs for logs via Issue #106

Feature(s)

None

Update(s)

• corrected azure_blob_storage block to reference azure_blob_storage_http instead of azure_blob_storage for http_logs
• added examples/logs

Breaking Change(s)

None

Feature(s)

• azurerm_app_service_slot_custom_hostname_binding now supports azurerm_[windows|linux]_web_app_slot

Previous Logic:

app_service_slot_id = var.os_type == "Windows" ? azurerm_windows_function_app_slot.this[each.value.app_service_slot_key].id : azurerm_linux_function_app_slot.this[each.value.app_service_slot_key].id

Current Logic:

app_service_slot_id = var.kind == "functionapp" ? (var.os_type == "Windows" ? azurerm_windows_function_app_slot.this[each.value.app_service_slot_key].id : azurerm_linux_function_app_slot.this[each.value.app_service_slot_key].id) : (var.os_type == "Windows" ? azurerm_windows_web_app_slot.this[each.value.app_service_slot_key].id : azurerm_linux_web_app_slot.this[each.value.app_service_slot_key].id)

• thumbprint can now reference existing thumbprint value with thumbprint_value

Previous Logic:

thumbprint          = azurerm_app_service_certificate.this[each.value.thumbprint_key].thumbprint

Current Logic:

  thumbprint          = each.value.thumbprint_key != null ? azurerm_app_service_certificate.this[each.value.thumbprint_key].thumbprint : each.value.thumbprint_value

Update(s)

• thumbprints as new output
• cleaning exmples/cusom_domain/main.tf file

Breaking Change(s)

• new mapping for azurerm_app_service_custom_hostname_binding

will likely affect any configurations with existing custom domains managed by terraform

Feature(s)

• functionality for custom domains for deployment slots using azurerm_app_service_slot_custom_hostname_binding resource via Issue #101.

uses slot_as_target in custom_domains as toggle to differentiate between azurerm_app_service_custom_hostname_binding and azurerm_app_service_slot_custom_hostname_binding

• azurerm_app_service_certificate to accept key_vault_id argument via Issue #102

Update(s)

• additional outputs added for:
  • function_app_active_slot
  • function_app_deployment_slots
  • kind
  • os_type

Breaking Change(s):

None

Feature(s):

• new telemetry
  • transition to use of modtm provider (view here)
  • removed locals.telemetry.tf
  • removed locals.telemetry.tf.json

Update(s):

• added examples / storage_uses_managed_identity
• fixed logic for storage_uses_managed_identity for azurerm_(windows | linux)_function_app via Issue #96

Previous:

storage_uses_managed_identity                  = var.function_app_storage_uses_managed_identity == true && var.function_app_storage_account_access_key == null && var.function_app_storage_account == null ? var.function_app_storage_uses_managed_identity : null

Current:

storage_uses_managed_identity                  = var.function_app_storage_uses_managed_identity == true && var.function_app_storage_account_access_key == null ? var.function_app_storage_uses_managed_identity : null

• updated logic for azurerm_linux_function_app and azurerm_linux_function_app_slot to account for created storage account's access key

storage_account_access_key                     = var.function_app_storage_account_access_key != null && var.function_app_storage_uses_managed_identity != true && var.function_app_create_storage_account != true ? var.function_app_storage_account_access_key : var.function_app_storage_account_access_key == null && var.function_app_storage_uses_managed_identity != true && var.function_app_create_storage_account ? module.avm_res_storage_storageaccount[0].resource.primary_access_key : null

Breaking Change(s)

None

Feature(s)

• lock functionality for function_app_storage_account
• lock functionality for deployment_slots
• deployment_slots_inherit_lock defaults to true
• function_app_storage_account_inherit_lock defaults to true

Update(s)

• output for the following:
  • deployment_slot_locks
  • private_endpoint_locks
  • resource_lock
  • storage_account_lock

Breaking Change(s)

None

Feature(s)

• output for system_assigned_mi_principal_id via RMFR7
• private_endpoints functionality with deployment_slots via Issue #88
• role_assignments functionality with deployment_slots
• lock functionality with function_app_storage_account

Update(s)

• added examples/deployment_slot
• added examples/deployment_slot_with_interfaces
• added examples/ip_restriction via Issue #85

Breaking Change(s)

• terraform required version set to ~>1.6
• variable client_certificate_mode now defaults to Required to match azurerm resource provider (previously Optional)

Features

• Deployment Slots via #64
• outputs for web_app_deployment_slots and web_app_active_slot
• outputs for identity_principal_id via #84

Update(s)

• added validation for auto_heal_enabled
  • only set auto_heal_enabled to true if configuring auto_heal_setting block

validation {
    condition     = var.site_config.auto_heal_enabled != null && var.site_config.auto_heal_enabled != true ? contains([true, null], var.site_config.auto_heal_enabled) : true
    error_message = "The value of `auto_heal_enabled` can only be set to `true` or `null`."
  }

Only set auto_heal_setting if auto_heal_enabled is set to true or configuration will result in provider issue

• added examples / auto_heal_enabled via #77
• added examples / slot
• module call for avm_res_storage_storageaccount uses enable_telemetry as toggle
• configured conditional output for managed and unmanaged private dns zone groups regarding azurerm_private_endpoints (output)

var.private_endpoints_manage_dns_zone_group ? azurerm_private_endpoint.this : azurerm_private_endpoint.this_unmanaged_dns_zone_groups

• addressing module/provider issue where if auto_heal_enabled was set to true or false, user was still expected to populate auto_heal_setting via Issue #77
  • terraform provider requires user to specify auto_heal_setting if auto_heal_enabled is not set to null in configuration.
  • added conditional that if auto_heal-enabled is not set to true, resolves to null to avoid provider error.
• bug fixes regarding functionality for dynamic action in auto_heal_setting

bug:

action_type = auto_heal_setting.value.action_type
minimum_process_execution_time = auto_heal_setting.value.minimum_process_execution_time

solution:

action_type                    = auto_heal_setting.value.action.action_type
minimum_process_execution_time = auto_heal_setting.value.action.minimum_process_execution_time

• addressing fix for backup where argument incorrectly referenced as retention_period_in_days instead of retention_in_days

• fixes logic for ftps_state affecting ftp_publish_basic_authentication_enabled and webdeploy_publish_basic_authentication_enabled for azurerm_windows_function_app, azurerm_linux_web_app, and azurerm_windows_web_app
• adds logic for storage_account_name concerning linux function app

storage_account_name                     = var.function_app_create_storage_account ? module.avm_res_storage_storageaccount[0].name : var.function_app_storage_account_name`

• added example \ basic_auth for basic authentication

• Module to reference v0.1.2 of avm_res_storage_storageaccount module (source) via Issue #67
  • added optional argument for location for function_app_storage_account variable
  • location will resolve to the location of the function app if not supplied in function_app_storage_account object
• addressed logic for webdeploy_publish_basic_authentication_enabled that only allowed for configuration if ftps_state was set to "AllAllowed" via Issue #71

Initial condition:

webdeploy_publish_basic_authentication_enabled = var.site_config.ftps_state == "AllAllowed" ? var.webdeploy_publish_basic_authentication_enabled : false

Current condition:

webdeploy_publish_basic_authentication_enabled = var.site_config.ftps_state == "Disabled" ? false : var.webdeploy_publish_basic_authentication_enabled

• addressing bug where dynamic custom_oidc_v2 blocks reference authorisation_endpoint but custom_oidc_v2 object had authorization_endpoint instead via Issue #66
• addressing bug where optional arguments within auth_settings_v2 were resolving to null instead of empty maps / objects, which caused errors via Issue #69
  • active_directory_v2
  • apple_v2
  • azure_static_web_app_v2
  • custom_oidc_v2
  • facebook_v2
  • github_v2
  • google_v2
  • twitter_v2

• virtual_application default supported in site_config for azurerm_windows_web_app:
  • This is to address the following issues:
    • Issue #52
    • Provider Issue where always_on is toggled off but provider attempts to add default virtual_application on plan/apply after initial apply.
• headers to type map(object) instead of object
  • Addresses Issue #53
• removal of logic for "APPLICATIONINSIGHTS_CONNECTION_STRING" and "APPINSIGHTS_INSTRUMENTATIONKEY" in app_settings for azurerm_(windows|linux)_function_app
  • Addresses Issue #55 / Issue #56
  • use arguments application_insights_connection_string and application_insights_key in site_config variable as provider will set "APPLICATIONINSIGHTS_CONNECTION_STRING" and "APPINSIGHTS_INSTRUMENTATIONKEY" keys in app_settings accordingly

• fixing bug where module references to undeclared resource:
  • ip_restriction dynamic block that wrongly references scm_ip_restriction instead of ip_restriction
• addresses addition feature capabilities for new_service_plan:
  • maximum_elastic_worker_count
  • per_site_scaling_enabled
  • worker_count
  • zone_balancing_enabled

• APRL recommendation:
  • Application Insights enabled by default (via enable_application_insights)
• Linting fixes for interfaces:
  • managed_identites:
    • nullable set to false
  • private_endpoints:
    • removed inherit_lock argument
    • removed inherit_tags argument
    • nullable set to false
  • lock:
    • kind is required argument
    • default set to null instead of {}
    • removed None as valid values for kind
  • role_assignments:
    • nullable set to false
  • tags:
    • type set to map(string) instead of map(any)
    • default set to null instead of {}
• Deprecated variables/arguments:
  • inherit_lock argument in private_endpoints
  • inherit_tags argument in private_endpoints
• New variables:
  • all_child_resources_inherit_tags
  • all_child_resources_inherit_lock
  • private_endpoints_inherit_lock
  • private_endpoints_manage_dns_zone_group

Addition outputs:

• application_insights
• service_plan
• storage_account

• feat: functionality to deploy web apps
• kind variable to determine functionapp or webapp
• feat: functionality to create new storage account within module
• feat: functionality to create new service plan within module
• feat: functionality to reference app service environment

• doc fixes
• update locals.version.tf.json
• update examples to reference 0.1.2

• doc fixes
• feat: custom domain
• feat: application insights