Add Teraform resource lock and harden storage

frasermolyneux · Dec 9, 2023 · d8d3587 · d8d3587
1 parent b46ab0e
commit d8d3587
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 1 deletion.
diff --git a/terraform/app_data_storage.tf b/terraform/app_data_storage.tf
@@ -8,8 +8,15 @@ resource "azurerm_storage_account" "app_data_storage" {
   account_kind             = "StorageV2"
   access_tier              = "Hot"
 
-  enable_https_traffic_only = true
   min_tls_version           = "TLS1_2"
+  enable_https_traffic_only = true
+
+  public_network_access_enabled = false
+
+  network_rules {
+    default_action = "Deny"
+    bypass         = ["AzureServices"]
+  }
 
   tags = var.tags
 }

diff --git a/terraform/common.tf b/terraform/common.tf
@@ -4,3 +4,10 @@ resource "azurerm_resource_group" "rg" {
 
   tags = var.tags
 }
+
+resource "azurerm_management_lock" "rg_lock" {
+  name       = "Terraform (ReadOnly) - ${random_id.lock.hex}"
+  scope      = azurerm_resource_group.rg.id
+  lock_level = "ReadOnly"
+  notes      = "ReadOnly Lock managed by Terraform to prevent manual or accidental modification of resource group and resources"
+}
diff --git a/terraform/main.tf b/terraform/main.tf
@@ -43,3 +43,10 @@ resource "random_id" "environment_id" {
 resource "time_rotating" "thirty_days" {
   rotation_days = 30
 }
+
+resource "random_id" "lock" {
+  keepers = {
+    id = "${timestamp()}"
+  }
+  byte_length = 8
+}