[PE-703] Private Endpoint Common module and CGN configuration

[mamu0]

List of changes

Added private_endpoint module into common folder.
Configured CGN PROD pep for postgres in itn.

Motivation and context

To configure the CGN pep it was necessary also to add a general module that create al private endpoint when necessary.

Type of changes

• Add new resources
• Update configuration to existing resources
• Remove existing resources

Env to apply

• DEV
• UAT
• PROD

Does this introduce a change to production resources with possible user impact?

• Yes, users may be impacted applying this change
• No

Does this introduce an unwanted change on infrastructure? Check terraform plan execution result

• Yes
• No

Other information

---

If PR is partially applied, why? (reserved to mantainers)

How to apply

After PR is approved

1. run deploy pipeline from Azure DevOps io-platform-iac-projects
2. select PR branch
3. wait for approval

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[github-actions]

📖 Terraform Plan ('src/common/prod') - success

Terraform Plan

data.azurerm_linux_function_app.function_cgn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_app[0]: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_app[1]: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager: Still reading... [10s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [10s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [20s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [10s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [10s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [10s elapsed]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app will be updated in-place
  ~ resource "azurerm_web_application_firewall_policy" "api_app" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-external/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/io-p-waf-appgateway-api-app-policy"
        name                = "io-p-waf-appgateway-api-app-policy"
        tags                = {
            "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"   = "Terraform"
            "Environment" = "Prod"
            "Owner"       = "IO"
            "Source"      = "https://github.com/pagopa/io-infra"
        }
        # (4 unchanged attributes hidden)

      ~ policy_settings {
          ~ request_body_inspect_limit_in_kb          = 0 -> 128
            # (6 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.private_endpoints.azurerm_private_endpoint.this["cgn-psql-pep-01"] will be created
  + resource "azurerm_private_endpoint" "this" {
      + custom_dns_configs       = (known after apply)
      + id                       = (known after apply)
      + location                 = "italynorth"
      + name                     = "io-p-itn-cgn-psql-pep-01"
      + network_interface        = (known after apply)
      + private_dns_zone_configs = (known after apply)
      + resource_group_name      = "io-p-itn-common-rg-01"
      + subnet_id                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Network/virtualNetworks/io-p-itn-common-vnet-01/subnets/io-p-itn-pep-snet-01"
      + tags                     = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }

      + private_dns_zone_group {
          + id                   = (known after apply)
          + name                 = "private-dns-zone-group"
          + private_dns_zone_ids = [
              + "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/privateDnsZones/privatelink.postgres.database.azure.com",
            ]
        }

      + private_service_connection {
          + is_manual_connection           = false
          + name                           = "io-p-itn-cgn-psql-pep-01-pep-01"
          + private_connection_resource_id = "/subscriptions/74da48a3-b0e7-489d-8172-da79801086ed/resourceGroups/cgnonboardingportal-p-db-rg/providers/Microsoft.DBforPostgreSQL/servers/cgnonboardingportal-p-db-postgresql"
          + private_ip_address             = (known after apply)
          + subresource_names              = [
              + "postgresqlServer",
            ]
        }
    }

  # module.app_backend_li_weu.module.appservice_app_backend.azurerm_linux_web_app.this will be updated in-place
  ~ resource "azurerm_linux_web_app" "this" {
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-linux/providers/Microsoft.Web/sites/io-p-app-appbackendli"
        name                                           = "io-p-app-appbackendli"
        tags                                           = {
            "CostCenter"                                     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"                                      = "Terraform"
            "Environment"                                    = "Prod"
            "Owner"                                          = "IO"
            "Source"                                         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (22 unchanged attributes hidden)

      ~ site_config {
          ~ health_check_eviction_time_in_min       = 3 -> 2
            # (24 unchanged attributes hidden)

            # (21 unchanged blocks hidden)
        }

        # (1 unchanged block hidden)
    }

Plan: 1 to add, 2 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app,
  on ../_modules/application_gateway/firewall.tf line 62, in resource "azurerm_web_application_firewall_policy" "api_app":
  62:         disabled_rules = [
  63:           "942100",
  64:           "942120",
  65:           "942190",
  66:           "942200",
  67:           "942210",
  68:           "942240",
  69:           "942250",
  70:           "942260",
  71:           "942330",
  72:           "942340",
  73:           "942370",
  74:           "942380",
  75:           "942430",
  76:           "942440",
  77:           "942450",
  78:         ]

`disabled_rules` will be removed in favour of the `rule` property in version
4.0 of the AzureRM Provider.

(and 50 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.