added blueprint-common

src/domains/blueprint-common/00_azuread.tf

@@ -0,0 +1,16 @@
+# Azure AD
+data "azuread_group" "adgroup_admin" {
+  display_name = "${local.product}-adgroup-admin"
+}
+
+data "azuread_group" "adgroup_developers" {
+  display_name = "${local.product}-adgroup-developers"
+}
+
+data "azuread_group" "adgroup_externals" {
+  display_name = "${local.product}-adgroup-externals"
+}
+
+data "azuread_group" "adgroup_security" {
+  display_name = "${local.product}-adgroup-security"
+}

src/domains/blueprint-common/00_monitor.tf

@@ -0,0 +1,23 @@
+data "azurerm_resource_group" "monitor_rg" {
+  name = var.monitor_resource_group_name
+}
+
+data "azurerm_log_analytics_workspace" "log_analytics" {
+  name                = var.log_analytics_workspace_name
+  resource_group_name = var.log_analytics_workspace_resource_group_name
+}
+
+data "azurerm_application_insights" "application_insights" {
+  name                = local.monitor_appinsights_name
+  resource_group_name = data.azurerm_resource_group.monitor_rg.name
+}
+
+data "azurerm_monitor_action_group" "slack" {
+  resource_group_name = var.monitor_resource_group_name
+  name                = local.monitor_action_group_slack_name
+}
+
+data "azurerm_monitor_action_group" "email" {
+  resource_group_name = var.monitor_resource_group_name
+  name                = local.monitor_action_group_email_name
+}

src/domains/blueprint-common/00_network.tf

@@ -0,0 +1,13 @@
+data "azurerm_virtual_network" "vnet_core" {
+  name                = local.vnet_core_name
+  resource_group_name = local.vnet_core_resource_group_name
+}
+
+data "azurerm_resource_group" "rg_vnet_core" {
+  name = local.vnet_core_resource_group_name
+}
+
+data "azurerm_dns_zone" "public" {
+  name                = local.dns_zone_public_name
+  resource_group_name = local.vnet_core_resource_group_name
+}

src/domains/blueprint-common/01_keyvault_0.tf

@@ -0,0 +1,106 @@
+resource "azurerm_resource_group" "sec_rg_domain" {
+  name     = "${local.product}-${var.domain}-sec-rg"
+  location = var.location
+
+  tags = var.tags
+}
+
+module "key_vault_domain" {
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault?ref=v7.7.0"
+
+  name                       = "${local.product}-${var.domain}-kv"
+  location                   = azurerm_resource_group.sec_rg_domain.location
+  resource_group_name        = azurerm_resource_group.sec_rg_domain.name
+  tenant_id                  = data.azurerm_client_config.current.tenant_id
+  soft_delete_retention_days = 90
+  sku_name                   = "premium"
+
+  lock_enable = true
+
+  tags = var.tags
+}
+
+## ad group policy ##
+resource "azurerm_key_vault_access_policy" "ad_admin_group_policy" {
+  key_vault_id = module.key_vault_domain.id
+
+  tenant_id = data.azurerm_client_config.current.tenant_id
+  object_id = data.azuread_group.adgroup_admin.object_id
+
+  key_permissions         = ["Get", "List", "Update", "Create", "Import", "Delete", ]
+  secret_permissions      = ["Get", "List", "Set", "Delete", ]
+  storage_permissions     = []
+  certificate_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Restore", "Purge", "Recover", ]
+}
+
+#
+# policy developers
+#
+resource "azurerm_key_vault_access_policy" "adgroup_developers_policy" {
+
+  key_vault_id = module.key_vault_domain.id
+
+  tenant_id = data.azurerm_client_config.current.tenant_id
+  object_id = data.azuread_group.adgroup_developers.object_id
+
+  key_permissions         = var.env_short == "d" ? ["Get", "List", "Update", "Create", "Import", "Delete", ] : ["Get", "List", "Update", "Create", "Import", ]
+  secret_permissions      = var.env_short == "d" ? ["Get", "List", "Set", "Delete", ] : ["Get", "List", "Set", ]
+  storage_permissions     = []
+  certificate_permissions = var.env_short == "d" ? ["Get", "List", "Update", "Create", "Import", "Delete", "Restore", "Purge", "Recover", "ManageContacts", ] : ["Get", "List", "Update", "Create", "Import", "Restore", "Recover", ]
+}
+
+#
+# policy externals
+#
+
+resource "azurerm_key_vault_access_policy" "adgroup_externals_policy" {
+  count = var.env_short == "d" ? 1 : 0
+
+  key_vault_id = module.key_vault_domain.id
+
+  tenant_id = data.azurerm_client_config.current.tenant_id
+  object_id = data.azuread_group.adgroup_developers.object_id
+
+  key_permissions         = ["Get", "List", "Update", "Create", "Import", "Delete", ]
+  secret_permissions      = ["Get", "List", "Set", "Delete", ]
+  storage_permissions     = []
+  certificate_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Restore", "Purge", "Recover", "ManageContacts", ]
+}
+
+#
+# IaC
+#
+
+#pagopaspa-dvopla-platform-iac-projects-{subscription}
+data "azuread_service_principal" "platform_iac_sp" {
+  display_name = "pagopaspa-devops-platform-iac-projects-${data.azurerm_subscription.current.subscription_id}"
+}
+
+resource "azurerm_key_vault_access_policy" "azdevops_platform_iac_policy" {
+  key_vault_id = module.key_vault_domain.id
+  tenant_id    = data.azurerm_client_config.current.tenant_id
+  object_id    = data.azuread_service_principal.platform_iac_sp.object_id
+
+  secret_permissions = ["Get", "List", "Set", ]
+
+  certificate_permissions = ["SetIssuers", "DeleteIssuers", "Purge", "List", "Get", ]
+
+  storage_permissions = []
+}
+
+#azdo-sp-plan-devopslab-<env>
+data "azuread_service_principal" "iac_sp_plan" {
+  display_name = "azdo-sp-plan-devopslab-${var.env}"
+}
+
+resource "azurerm_key_vault_access_policy" "iac_sp_plan_policy" {
+  key_vault_id = module.key_vault_domain.id
+  tenant_id    = data.azurerm_client_config.current.tenant_id
+  object_id    = data.azuread_service_principal.iac_sp_plan.object_id
+
+  secret_permissions = ["Get", "List", "Set", ]
+
+  certificate_permissions = ["SetIssuers", "DeleteIssuers", "Purge", "List", "Get", "Import"]
+
+  storage_permissions = []
+}

src/domains/blueprint-common/99_main.tf

@@ -0,0 +1,45 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "<= 3.71.0"
+    }
+    azuread = {
+      source  = "hashicorp/azuread"
+      version = "= 2.21.0"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "= 3.1.1"
+    }
+    pkcs12 = {
+      source  = "chilicat/pkcs12"
+      version = "0.0.7"
+    }
+  }
+
+  backend "azurerm" {}
+}
+
+provider "azurerm" {
+  features {
+    key_vault {
+      purge_soft_delete_on_destroy = false
+    }
+  }
+}
+
+data "azurerm_subscription" "current" {}
+
+data "azurerm_client_config" "current" {}
+
+data "terraform_remote_state" "core" {
+  backend = "azurerm"
+
+  config = {
+    resource_group_name  = var.terraform_remote_state_core.resource_group_name
+    storage_account_name = var.terraform_remote_state_core.storage_account_name
+    container_name       = var.terraform_remote_state_core.container_name
+    key                  = var.terraform_remote_state_core.key
+  }
+}

src/domains/blueprint-common/99_main.tf.ci

@@ -0,0 +1,44 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "<= 3.71.0"
+    }
+    azuread = {
+      source  = "hashicorp/azuread"
+      version = "= 2.21.0"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "= 3.1.1"
+    }
+    pkcs12 = {
+      source  = "chilicat/pkcs12"
+      version = "0.0.7"
+    }
+  }
+
+}
+
+provider "azurerm" {
+  features {
+    key_vault {
+      purge_soft_delete_on_destroy = false
+    }
+  }
+}
+
+data "azurerm_subscription" "current" {}
+
+data "azurerm_client_config" "current" {}
+
+data "terraform_remote_state" "core" {
+  backend = "azurerm"
+
+  config = {
+    resource_group_name  = var.terraform_remote_state_core.resource_group_name
+    storage_account_name = var.terraform_remote_state_core.storage_account_name
+    container_name       = var.terraform_remote_state_core.container_name
+    key                  = var.terraform_remote_state_core.key
+  }
+}