fixes for synapse

appgateways/appgw-e2e/main.tf

@@ -416,6 +416,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_https
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_443
+    priority                   = 1
   }
 
 
@@ -426,6 +427,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_8443
     backend_address_pool_name  = local.backend_address_pool_qdc
     backend_http_settings_name = local.http_setting_name_8443
+    priority                   = 2
   }
 
   # NPrinting routing rules
@@ -435,6 +437,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4993
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4993
+    priority                   = 3
   }
   request_routing_rule {
     name                       = local.request_routing_rule_4994
@@ -442,6 +445,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4994
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4994
+    priority                   = 4
   }
 
 
@@ -451,6 +455,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4552
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4552
+    priority                   = 5
   }
 
 
@@ -461,6 +466,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4435
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4435
+    priority                   = 6
   }
   
 
@@ -477,6 +483,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     rule_type                   = "Basic"
     http_listener_name          = local.listener_name_http
     redirect_configuration_name = local.redirect_configuration_80
+    priority                    = 7
   }
 
   # Redirect QDC 8080 to 8443
@@ -492,6 +499,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     rule_type                   = "Basic"
     http_listener_name          = local.listener_name_8080
     redirect_configuration_name = local.redirect_configuration_8080
+    priority                    = 8
   }
 
 }

appgateways/appgw-e2e/variables.tf

@@ -24,7 +24,7 @@ variable "app_gw_subnet" {
 }
 
 variable "log_analytics_workspace_id" {
-  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourcegroups/appgw_rg/providers/microsoft.operationalinsights/workspaces/qmi-log-analytics"
+  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourceGroups/appgw_rg/providers/Microsoft.OperationalInsights/workspaces/qmi-log-analytics"
 }
 
 variable "cert_name" {

appgateways/appgw-qdc-qs/main.tf

@@ -357,6 +357,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_https
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_443
+    priority                   = 1
   }
 
 
@@ -367,6 +368,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_8443
     backend_address_pool_name  = local.backend_address_pool_qdc
     backend_http_settings_name = local.http_setting_name_8443
+    priority                   = 2
   }
 
   # NPrinting routing rules
@@ -376,6 +378,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4993
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4993
+    priority                   = 3
   }
   request_routing_rule {
     name                       = local.request_routing_rule_4994
@@ -383,6 +386,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4994
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4994
+    priority                   = 4
   }
 
   # QIB routing rule
@@ -392,6 +396,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4435
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4435
+    priority                   = 5
   }
   
 
@@ -408,6 +413,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     rule_type                   = "Basic"
     http_listener_name          = local.listener_name_http
     redirect_configuration_name = local.redirect_configuration_80
+    priority                   = 6
   }
 
 }

appgateways/appgw-qdc-qs/main.tfold

@@ -1,444 +0,0 @@
-locals {
-    appgw_hostname              = "${var.appgw_hostname}.${var.domain}"
-    appgw_name                  = "qmi-appgw-qdc-qs"
-    
-    # Qlik Sense
-    backend_address_pool_qs     = "${var.appgw_hostname}-qs-bp"
-    http_setting_name_443       = "${var.appgw_hostname}-http-setting"
-    listener_name_http          = "${var.appgw_hostname}-http"
-    listener_name_https         = "${var.appgw_hostname}-https"
-    qs_probe_name               = "${var.appgw_hostname}-probe"
-    request_routing_rule_https  = "${var.appgw_hostname}-https-rule"
-    request_routing_rule_http   = "${var.appgw_hostname}-http-rule"
-    redirect_configuration_80   = "${var.appgw_hostname}-80redirect"
-
-    # NPrinting
-    http_setting_name_4993      = "${var.appgw_hostname}-4993-setting"
-    http_setting_name_4994      = "${var.appgw_hostname}-4994-setting"
-    listener_name_4993          = "${var.appgw_hostname}-4993"
-    listener_name_4994         = "${var.appgw_hostname}-4994"
-    request_routing_rule_4993   = "${var.appgw_hostname}-4993-rule"
-    request_routing_rule_4994   = "${var.appgw_hostname}-4994-rule"
-
-
-    # QIB
-    http_setting_name_4435      = "${var.appgw_hostname}-4435-setting"
-    qs_probe_name_4435          = "${var.appgw_hostname}-probe-4435"
-    listener_name_4435          = "${var.appgw_hostname}-4435"
-    request_routing_rule_4435   = "${var.appgw_hostname}-4435-rule"
-
-
-    # QDC
-    backend_address_pool_qdc    = "${var.appgw_hostname}-qdc-bp"
-    http_setting_name_8443      = "${var.appgw_hostname}-8443-setting"
-    qdc_probe_name              = "${var.appgw_hostname}-qdcprobe"
-    listener_name_8080          = "${var.appgw_hostname}-8080"
-    listener_name_8443          = "${var.appgw_hostname}-8443"
-    request_routing_rule_8443   = "${var.appgw_hostname}-8443-rule"
-    request_routing_rule_8080   = "${var.appgw_hostname}-8080-rule"
-    redirect_configuration_8080 = "${var.appgw_hostname}-8080redirect"
-    
-}
-
-data "azurerm_key_vault_secret" "cert-password" {
-  name         = "star-qmi-qlikpoc-com-password"
-  key_vault_id = var.key_vault_id
-}
-
-
-data "azurerm_key_vault_secret" "cert-data" {
-  name         = "star-qmi-qlikpoc-com-data"
-  key_vault_id = var.key_vault_id
-}
-
-resource "azurerm_public_ip" "appgw-ip" {
-
-  name                = "${local.appgw_name}-ip-${var.provision_id}"
-  resource_group_name = var.app_gw_rg
-  sku                 = "Standard"
-  location            = var.location
-  allocation_method   = "Static"
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-  
-}
-
-resource "azurerm_application_gateway" "qmi-app-gw" {
-
-  name                = "${local.appgw_name}-${var.provision_id}"
-  resource_group_name = var.app_gw_rg
-  location            = var.location
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-
-  sku {
-    name     = "WAF_v2"
-    tier     = "WAF_v2"
-    capacity = 1
-  }
-
-  gateway_ip_configuration {
-    name      = "app-gw-subnet"
-    subnet_id = var.app_gw_subnet
-  }
-
-  waf_configuration {
-    enabled               = true
-    firewall_mode         = "Prevention"
-    rule_set_type         = "OWASP"
-    rule_set_version      = "3.0"
-    file_upload_limit_mb  = "500"
-
-    exclusion {
-      match_variable          = "RequestCookieNames"
-      selector_match_operator = "Equals"
-      selector                = "qvla_invite"
-    }
-
-    exclusion {
-      match_variable          = "RequestCookieNames"
-      selector_match_operator = "Contains"
-      selector                = "parsely"
-    }
-
-    exclusion {
-      match_variable          = "RequestCookieNames"
-      selector_match_operator = "Contains"
-      selector                = "mixpanel"
-    }
-
-    exclusion {
-      match_variable          = "RequestCookieNames"
-      selector_match_operator = "Contains"
-      selector                = "optimizely"
-    }
-
-    exclusion {
-      match_variable          = "RequestArgNames"
-      selector_match_operator = "Equals"
-      selector                = "reloadUri"
-    }
-
-    exclusion {
-      match_variable          = "RequestCookieNames"
-      selector_match_operator = "Contains"
-      selector                = "NPWEBCONSOLE"
-    }
-
-    exclusion {
-      match_variable          = "RequestCookieNames"
-      selector_match_operator = "Contains"
-      selector                = "NPNEWSSTAND"
-    }
-
-    exclusion {
-      match_variable          = "RequestCookieNames"
-      selector_match_operator = "Contains"
-      selector                = "Vizlib"
-    }
-
-    # This is needed for NPrinting
-    /*disabled_rule_group {
-      rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT"
-      rules           = ["920270", "920271"]
-    }*/
-
-  }
-
-  # Qlik Sense fe ports
-  frontend_port {
-    name = "443"
-    port = 443
-  }
-  frontend_port {
-    name = "80"
-    port = 80
-  }
-
-  # NPrinting fe ports
-  frontend_port {
-    name = "4993"
-    port = 4993
-  }
-  frontend_port {
-    name = "4994"
-    port = 4994
-  }
-
-  # QIB fe ports
-  frontend_port {
-    name = "4435"
-    port = 4435
-  }
-
-  # QDC fe ports
-  frontend_port {
-    name = "8443"
-    port = 8443
-  }
-  frontend_port {
-    name = "8080"
-    port = 8080
-  }
-
-  frontend_ip_configuration {
-    name                 = "app-gw-front-end-ip-config"
-    public_ip_address_id = azurerm_public_ip.appgw-ip.id
-  }
-
-  ssl_certificate {
-    name          = var.cert_name
-    password      = data.azurerm_key_vault_secret.cert-password.value
-    data          = data.azurerm_key_vault_secret.cert-data.value
-  }
-
-  ssl_policy {
-    policy_type = "Predefined"
-    policy_name = "AppGwSslPolicy20170401"
-  }
-
-
-  # Backend pool for QS, QIB and NP
-  backend_address_pool {
-    name = local.backend_address_pool_qs
-  }
-
-  # Backend pool for QDC
-  backend_address_pool {
-    name = local.backend_address_pool_qdc
-  }
-
-
-  # Qlik Sense
-  backend_http_settings {
-    name                  = local.http_setting_name_443
-    cookie_based_affinity = "Disabled"
-    port                  = 443
-    protocol              = "Https"
-    request_timeout       = 7600
-    probe_name            = local.qs_probe_name
-  }
-
-  # NPrinting
-  backend_http_settings {
-    name                  = local.http_setting_name_4993
-    cookie_based_affinity = "Disabled"
-    port                  = 4993
-    protocol              = "Https"
-    request_timeout       = 7600
-    probe_name            = local.qs_probe_name
-  }
-  backend_http_settings {
-    name                  = local.http_setting_name_4994
-    cookie_based_affinity = "Disabled"
-    port                  = 4994
-    protocol              = "Https"
-    request_timeout       = 7600
-    probe_name            = local.qs_probe_name
-  }
-
-  # QIB
-  backend_http_settings {
-    name                  = local.http_setting_name_4435
-    cookie_based_affinity = "Disabled"
-    port                  = 4435
-    protocol              = "Https"
-    request_timeout       = 7600
-    probe_name            = local.qs_probe_name_4435
-  }
-
-  # QDC
-  backend_http_settings {
-    name                  = local.http_setting_name_8443
-    cookie_based_affinity = "Disabled"
-    port                  = 8080
-    protocol              = "Http"
-    request_timeout       = 7600
-    probe_name            = local.qdc_probe_name
-  }
-
-  # QS Prob
-  probe {
-    name                = local.qs_probe_name
-    protocol            = "Https"
-    host                = local.appgw_hostname
-    interval            = 30
-    path                = "/"
-    timeout             = 30
-    unhealthy_threshold = 3
-  }
-
-  # QDC Prob
-  probe {
-    name                = local.qdc_probe_name
-    protocol            = "Http"
-    host                = local.appgw_hostname
-    interval            = 30
-    path                = "/qdc"
-    timeout             = 30
-    unhealthy_threshold = 3
-  }
-
-  # QIB Probe
-  probe {
-    name                = local.qs_probe_name_4435
-    protocol            = "Https"
-    host                = local.appgw_hostname
-    interval            = 30
-    path                = "/"
-    timeout             = 30
-    unhealthy_threshold = 3
-
-    match {
-      status_code       = ["200-401"]
-    }
-  }
-
-  # Qlik Sense listener
-  http_listener {
-    name                           = local.listener_name_https
-    host_name                      = local.appgw_hostname
-    ssl_certificate_name           = var.cert_name
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "443"
-    protocol                       = "Https"
-
-  }
-  http_listener {
-    name                           = local.listener_name_http
-    host_name                      = local.appgw_hostname
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "80"
-    protocol                       = "Http"
-  }
-
-  # NPrinting listeners
-  http_listener {
-    name                           = local.listener_name_4993
-    ssl_certificate_name           = var.cert_name
-    host_name                      = local.appgw_hostname
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "4993"
-    protocol                       = "Https"
-  }
-  http_listener {
-    name                           = local.listener_name_4994
-    ssl_certificate_name           = var.cert_name
-    host_name                      = local.appgw_hostname
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "4994"
-    protocol                       = "Https"
-  }
-
-  # QIB listener
-  http_listener {
-    name                           = local.listener_name_4435
-    ssl_certificate_name           = var.cert_name
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "4435"
-    protocol                       = "Https"
-   
-  }
-
-  # QDC listeners
-  http_listener {
-    name                           = local.listener_name_8443
-    ssl_certificate_name           = var.cert_name
-    host_name                      = local.appgw_hostname
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "8443"
-    protocol                       = "Https"
-
-  }
-  http_listener {
-    name                           = local.listener_name_8080
-    host_name                      = local.appgw_hostname
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "8080"
-    protocol                       = "Http"
-  }
-
-  # Qlik Sense routing rules
-  request_routing_rule {
-    name                       = local.request_routing_rule_https
-    rule_type                  = "Basic"
-    http_listener_name         = local.listener_name_https
-    backend_address_pool_name  = local.backend_address_pool_qs
-    backend_http_settings_name = local.http_setting_name_443
-  }
-
-
-  # QDC routing rules
-  request_routing_rule {
-    name                       = local.request_routing_rule_8443
-    rule_type                  = "Basic"
-    http_listener_name         = local.listener_name_8443
-    backend_address_pool_name  = local.backend_address_pool_qdc
-    backend_http_settings_name = local.http_setting_name_8443
-  }
-
-  # NPrinting routing rules
-  request_routing_rule {
-    name                       = local.request_routing_rule_4993
-    rule_type                  = "Basic"
-    http_listener_name         = local.listener_name_4993
-    backend_address_pool_name  = local.backend_address_pool_qs
-    backend_http_settings_name = local.http_setting_name_4993
-  }
-  request_routing_rule {
-    name                       = local.request_routing_rule_4994
-    rule_type                  = "Basic"
-    http_listener_name         = local.listener_name_4994
-    backend_address_pool_name  = local.backend_address_pool_qs
-    backend_http_settings_name = local.http_setting_name_4994
-  }
-
-  # QIB routing rule
-  request_routing_rule {
-    name                       = local.request_routing_rule_4435
-    rule_type                  = "Basic"
-    http_listener_name         = local.listener_name_4435
-    backend_address_pool_name  = local.backend_address_pool_qs
-    backend_http_settings_name = local.http_setting_name_4435
-  }
-  
-
-  # Redirect QS 80 to 443
-  redirect_configuration {
-    name                 = local.redirect_configuration_80
-    target_listener_name = local.listener_name_https
-    redirect_type        = "Permanent"
-    include_path         = true
-    include_query_string = true
-  }
-  request_routing_rule {
-    name                        = local.request_routing_rule_http
-    rule_type                   = "Basic"
-    http_listener_name          = local.listener_name_http
-    redirect_configuration_name = local.redirect_configuration_80
-  }
-
-  # Redirect QDC 8080 to 8443
-  redirect_configuration {
-    name                 = local.redirect_configuration_8080
-    target_listener_name = local.listener_name_8443
-    redirect_type        = "Permanent"
-    include_path         = true
-    include_query_string = true
-  }
-  request_routing_rule {
-    name                        = local.request_routing_rule_8080
-    rule_type                   = "Basic"
-    http_listener_name          = local.listener_name_8080
-    redirect_configuration_name = local.redirect_configuration_8080
-  }
-
-}

appgateways/appgw-qdc-qs/outputs.tf

@@ -11,9 +11,9 @@ output "appgw_public_ip" {
 }
 
 output "appgw_backend_address_pool_0_id" {
-  value = azurerm_application_gateway.qmi-app-gw.backend_address_pool[0].id
+  value = tolist(azurerm_application_gateway.qmi-app-gw.backend_address_pool).0.id
 }
 
 output "appgw_backend_address_pool_1_id" {
-  value = azurerm_application_gateway.qmi-app-gw.backend_address_pool[1].id
+  value = tolist(azurerm_application_gateway.qmi-app-gw.backend_address_pool).1.id
 }

appgateways/appgw-qdc-qs/variables.tf

@@ -24,7 +24,7 @@ variable "app_gw_subnet" {
 }
 
 variable "log_analytics_workspace_id" {
-  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourcegroups/appgw_rg/providers/microsoft.operationalinsights/workspaces/qmi-log-analytics"
+  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourceGroups/appgw_rg/providers/Microsoft.OperationalInsights/workspaces/qmi-log-analytics"
 }
 
 variable "cert_name" {

appgateways/appgw-qdc/main.tf

@@ -127,6 +127,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_8443
     backend_address_pool_name  = local.backend_address_pool_qdc
     backend_http_settings_name = local.http_setting_name_8443
+    priority                   = 1
   }
 
 }

appgateways/appgw-qdc/main.tf_old

@@ -1,167 +0,0 @@
-
-locals {
-    appgw_hostname              = "${var.appgw_hostname}.${var.domain}"
-    appgw_name                  = "qmi-appgw-qdc"
-
-    backend_address_pool_qdc    = "${var.appgw_hostname}-qdc-bp"
-    http_setting_name_8443      = "${var.appgw_hostname}-8443-setting"
-    qdc_probe_name              = "${var.appgw_hostname}-qdcprobe"
-    listener_name_8080          = "${var.appgw_hostname}-8080"
-    listener_name_8443          = "${var.appgw_hostname}-8443"
-    request_routing_rule_https  = "${var.appgw_hostname}-https-rule"
-    request_routing_rule_8443   = "${var.appgw_hostname}-8443-rule"
-    redirect_configuration_8080 = "${var.appgw_hostname}-8080redirect"
-    request_routing_rule_8080   = "${var.appgw_hostname}-8080-rule"
-    
-}
-
-data "azurerm_key_vault_secret" "cert-password" {
-  name         = "star-qmi-qlikpoc-com-password"
-  key_vault_id = var.key_vault_id
-}
-
-
-data "azurerm_key_vault_secret" "cert-data" {
-  name         = "star-qmi-qlikpoc-com-data"
-  key_vault_id = var.key_vault_id
-}
-
-resource "azurerm_public_ip" "appgw-ip" {
-
-  name                = "${local.appgw_name}-ip-${var.provision_id}"
-  resource_group_name = var.app_gw_rg
-  sku                 = "Standard"
-  location            = var.location
-  allocation_method   = "Static"
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-}
-
-resource "azurerm_application_gateway" "qmi-app-gw" {
-
-  name                = "${local.appgw_name}-${var.provision_id}"
-  resource_group_name = var.app_gw_rg
-  location            = var.location
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-
-  sku {
-    name     = "WAF_v2"
-    tier     = "WAF_v2"
-    capacity = 1
-  }
-
-  waf_configuration {
-    enabled          = true
-    firewall_mode    = "Prevention"
-    rule_set_type    = "OWASP"
-    rule_set_version = "3.0"
-
-  }
-
-  gateway_ip_configuration {
-    name      = "app-gw-subnet"
-    subnet_id = var.app_gw_subnet
-  }
-
-  frontend_port {
-    name = "8443"
-    port = 8443
-  }
-
-  frontend_port {
-    name = "8080"
-    port = 8080
-  }
-
-  frontend_ip_configuration {
-    name                 = "app-gw-front-end-ip-config"
-    public_ip_address_id = azurerm_public_ip.appgw-ip.id
-  }
-
-  ssl_certificate {
-    name     = var.cert_name
-    password = data.azurerm_key_vault_secret.cert-password.value
-    data     = data.azurerm_key_vault_secret.cert-data.value
-  }
-
-  ssl_policy {
-    policy_type = "Predefined"
-    policy_name = "AppGwSslPolicy20170401"
-  }
-
-  backend_address_pool {
-    name = local.backend_address_pool_qdc
-  }
-
-  backend_http_settings {
-    name                  = local.http_setting_name_8443
-    cookie_based_affinity = "Disabled"
-    port                  = 8080
-    protocol              = "Http"
-    request_timeout       = 7600
-    probe_name            = local.qdc_probe_name
-  }
-
-  probe {
-    name                = local.qdc_probe_name
-    protocol            = "Http"
-    host                = local.appgw_hostname
-    interval            = 30
-    path                = "/qdc"
-    timeout             = 30
-    unhealthy_threshold = 3
-  }
-
-  http_listener {
-    name                           = local.listener_name_8443
-    ssl_certificate_name           = var.cert_name
-    host_name                      = local.appgw_hostname
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "8443"
-    protocol                       = "Https"
-
-  }
-
-  http_listener {
-    name                           = local.listener_name_8080
-    host_name                      = local.appgw_hostname
-    frontend_ip_configuration_name = "app-gw-front-end-ip-config"
-    frontend_port_name             = "8080"
-    protocol                       = "Http"
-  }
-
-
-  request_routing_rule {
-    name                       = local.request_routing_rule_8443
-    rule_type                  = "Basic"
-    http_listener_name         = local.listener_name_8443
-    backend_address_pool_name  = local.backend_address_pool_qdc
-    backend_http_settings_name = local.http_setting_name_8443
-  }
-
-
-  redirect_configuration {
-    name                 = local.redirect_configuration_8080
-    target_listener_name = local.listener_name_8443
-    redirect_type        = "Permanent"
-    include_path         = true
-    include_query_string = true
-  }
-
-  request_routing_rule {
-    name                        = local.request_routing_rule_8080
-    rule_type                   = "Basic"
-    http_listener_name          = local.listener_name_8080
-    redirect_configuration_name = local.redirect_configuration_8080
-
-  }
-}

appgateways/appgw-qdc/outputs.tf

@@ -11,6 +11,6 @@ output "appgw_public_ip" {
 }
 
 output "appgw_backend_address_pool_0_id" {
-  value = azurerm_application_gateway.qmi-app-gw.backend_address_pool[0].id
+  value = tolist(azurerm_application_gateway.qmi-app-gw.backend_address_pool).0.id
 }
 

appgateways/appgw-qdc/variables.tf

@@ -24,7 +24,7 @@ variable "app_gw_subnet" {
 }
 
 variable "log_analytics_workspace_id" {
-  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourcegroups/appgw_rg/providers/microsoft.operationalinsights/workspaces/qmi-log-analytics"
+  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourceGroups/appgw_rg/providers/Microsoft.OperationalInsights/workspaces/qmi-log-analytics"
 }
 
 variable "cert_name" {

appgateways/appgw-qs/main.tf

@@ -139,10 +139,10 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     }
 
     # This is needed for NPrinting
-    /*disabled_rule_group {
+    disabled_rule_group {
       rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT"
       rules           = ["920270", "920271"]
-    }*/
+    }
 
   }
 
@@ -338,6 +338,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_https
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_443
+    priority                   = 1
   }
 
 
@@ -348,6 +349,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4993
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4993
+    priority                   = 2
   }
   request_routing_rule {
     name                       = local.request_routing_rule_4994
@@ -355,6 +357,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4994
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4994
+    priority                   = 3
   }
 
   # QIB routing rule (needs QIB using qmi.qlik-poc.com certs)
@@ -364,6 +367,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4435
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4435
+    priority                   = 4
   }
 
   # Qlik Alerting routing rule (needs Qlik Alerting using qmi.qlik-poc.com certs)
@@ -373,6 +377,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     http_listener_name         = local.listener_name_4552
     backend_address_pool_name  = local.backend_address_pool_qs
     backend_http_settings_name = local.http_setting_name_4552
+    priority                   = 5
   }
   
 
@@ -389,6 +394,7 @@ resource "azurerm_application_gateway" "qmi-app-gw" {
     rule_type                   = "Basic"
     http_listener_name          = local.listener_name_http
     redirect_configuration_name = local.redirect_configuration_80
+    priority                    = 6
   }
 
 }

appgateways/appgw-qs/outputs.tf

@@ -11,5 +11,5 @@ output "appgw_public_ip" {
 }
 
 output "appgw_backend_address_pool_0_id" {
-  value = azurerm_application_gateway.qmi-app-gw.backend_address_pool[0].id
+  value = tolist(azurerm_application_gateway.qmi-app-gw.backend_address_pool).0.id
 }

appgateways/appgw-qs/variables.tf

@@ -24,7 +24,7 @@ variable "app_gw_subnet" {
 }
 
 variable "log_analytics_workspace_id" {
-  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourcegroups/appgw_rg/providers/microsoft.operationalinsights/workspaces/qmi-log-analytics"
+  default = "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourceGroups/appgw_rg/providers/Microsoft.OperationalInsights/workspaces/qmi-log-analytics"
 }
 
 variable "cert_name" {

archived/vm-fromsnapshot-win/main.tf

@@ -1,169 +0,0 @@
-resource "random_id" "randomMachineId" {
-    keepers = {
-        # Generate a new ID only when a new resource group is defined
-        resource_group = var.resource_group_name
-    }
-    
-    byte_length = 2
-}
-
-resource "random_password" "password" {
-  length = 16
-  special = true
-  override_special = "_!@"
-  upper = true
-  lower = true
-  min_lower = 2
-  min_upper = 2
-  min_special = 2
-}
-
-locals {
-  virtual_machine_name = (var.virtual_machine_name != null)? var.virtual_machine_name :  "${var.prefix}-${random_id.randomMachineId.hex}"
-  admin_username = var.admin_username
-  admin_password = random_password.password.result
-  notrename = (var.notrename != null)? "-NotApply" : ""
-  storage_account_id = var.location == "westeurope"? "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourceGroups/QMI-Machines/providers/Microsoft.Storage/storageAccounts/machinesnapshotsweu" : "/subscriptions/62ebff8f-c40b-41be-9239-252d6c0c8ad9/resourceGroups/QMI-Machines/providers/Microsoft.Storage/storageAccounts/machinesnapshots"
-}
-
-resource "azurerm_managed_disk" "copy" {
-  
-  name                  = "Disk-${var.prefix}-${random_id.randomMachineId.hex}"
-  location              = var.location
-  resource_group_name   = var.resource_group_name
-  storage_account_type  = "Premium_LRS"
-  create_option         = "Import"
-  storage_account_id    = local.storage_account_id
-  source_uri            = var.snapshot_id
-  
-  disk_size_gb          = var.disk_size_gb
-
-  tags = {
-    "Deployment" = "QMI PoC"
-    "Cost Center" = "3100"
-    "QMI_user" = var.user_id != null? var.user_id : null
-  }
-}
-
-module "qmi-nic" {
-  source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//qmi-nic"
-  
-  prefix = local.virtual_machine_name
-  location = var.location
-  subnet_id = var.subnet_id
-  
-  resource_group_name = var.resource_group_name
-  user_id = var.user_id
-}
-
-resource "azurerm_virtual_machine" "vm" {
-  name                  = local.virtual_machine_name
-  location              = var.location
-  resource_group_name   = var.resource_group_name
-  network_interface_ids = [ module.qmi-nic.id ]
-  vm_size               = var.vm_type
-
-
-  storage_os_disk {
-    name              = azurerm_managed_disk.copy.name
-    os_type           = "Windows"
-    managed_disk_id   = azurerm_managed_disk.copy.id
-    managed_disk_type = "Premium_LRS"
-    create_option     = "Attach"
-  }
-
-  os_profile_windows_config {
-    
-    provision_vm_agent        = true
-    enable_automatic_upgrades = false
-
-    winrm {
-      protocol = "http"
-    }
-  }
-
-  identity {
-    type = "SystemAssigned"
-  }
-
-  /*os_profile {
-    computer_name = local.virtual_machine_name
-    admin_username = local.admin_username
-  }*/
-
-  tags = {
-    "Deployment" = "QMI PoC"
-    "Cost Center" = "3100"
-    "ProvId"  = var.provId != null? var.provId : null
-    "QMI_user" = var.user_id != null? var.user_id : null
-    "24x7" = var.is_24x7 == true? "" : null
-    "ShutdownTime": var.is_24x7 == false? var.shutdownTime : null
-    "StartupTime": var.is_24x7 == false? var.startupTime : null
-  }
-
-}
-
-resource "null_resource" "post-vm-fromsnapshot-win" {
-  
-  count = var.initial_password != null? 1 : 0
-
-  depends_on = [
-    azurerm_virtual_machine.vm
-  ]
-
-  provisioner "file" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = local.admin_username
-      password = var.initial_password
-      port     = 5985
-      https    = false
-      timeout  = "10m"
-    }
-    source      = "${path.module}/scripts"
-    destination = "C:/tmp/provision"
-  }
-
-
-  provisioner "remote-exec" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = local.admin_username
-      password = var.initial_password
-      port     = 5985
-      https    = false
-      timeout  = "10m"
-    }
-
-    inline = [
-      "powershell.exe -File C:/tmp/provision/bootstrap.ps1",
-      "powershell.exe -File C:/tmp/provision/password.ps1 -Username ${local.admin_username} -Pass ${local.admin_password}"
-    ]
-  }
-
-  # Rename Computer
-  provisioner "remote-exec" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = local.admin_username
-      password = local.admin_password
-      port     = 5985
-      https    = false
-      timeout  = "10m"
-    }
-
-    inline = [
-      "powershell.exe -File C:/tmp/provision/RenameComputer.ps1 -NewName ${local.virtual_machine_name} ${local.notrename}" 
-    ]
-
-    on_failure = continue
-  }
-
-  provisioner "local-exec" {
-    command = "sleep 30"
-  }
-
-}

archived/vm-fromsnapshot-win/scripts/RenameComputer.ps1

@@ -1,14 +0,0 @@
-
-Param(
-    [string] $NewName,
-    [switch] $NotApply = $False 
-)
-
-
-
-if ($NotApply){
-    Write-Host "Not renaming machine"
-} else {
-    Write-Host "Machine is going to be renamed as $NewName"
-    Rename-Computer -NewName $NewName -PassThru -Force -Restart 
-}

archived/vm-fromsnapshot-win/scripts/password.ps1

@@ -1,12 +0,0 @@
-Param(
-    [string] $Username,
-    [string] $Pass
-)
-
-Import-Module "Carbon"
-
-$secpasswd = ConvertTo-SecureString $Pass -AsPlainText -Force
-$cred = New-Object System.Management.Automation.PSCredential ($Username, $secpasswd)
-
-Install-CUser -Credential $cred 
-Write-Log "Done! Setting new password to user $Username"

archived/vm-fromsnapshot-win/scripts/q-user-setup.ps1

@@ -1,29 +0,0 @@
-Write-Log "Starting q-user-setup.ps1"
-
-Trap {
-	Write-Log -Message $_.Exception.Message -Severity "Error"
-  	Break
-}
-
-### Install Carbon PowerShell Module
-Write-Log -Message "Installing carbon"
-choco install carbon -y | Out-Null
-Import-Module "Carbon"
-
-### create Qlik User
-Write-Log -Message "Creating Qlik account"
-$cred = New-MyCredential -user "Qlik" -pass "Qlik1234"
-Install-CUser -Credential $cred
-
-### Grant Remote Admin Rights to Qlik User
-Write-Log -Message "Granting Qlik account Remote Interactive Logon Right"
-Grant-Privilege -Identity $env:COMPUTERNAME\qlik -Privilege SeRemoteInteractiveLogonRight
-
-Write-Log -Message "Adding Qlik user to Remote Desktop Users"
-Add-GroupMember -Name 'Remote Desktop Users' -Member $env:COMPUTERNAME\qlik
-
-Write-Log -Message "Adding Qlik user to local Administrators"
-Add-GroupMember -Name 'Administrators' -Member $env:COMPUTERNAME\qlik
-
-$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control"
-Set-ItemProperty $regPath -Name "ServicesPipeTimeout" -Type DWord -Value 180000

archived/vm-fromsnapshot-win/scripts/qdc/Restart-ServiceDispatcher.ps1

@@ -1,4 +0,0 @@
-Import-Module Qlik-Cli
-
-Write-Log -Message "Restart Qlik ServiceDistpacher..."
-Restart-Service QlikSenseServiceDispatcher -Force

archived/vm-fromsnapshot-win/scripts/qdc/qdc-scenario-config.ps1

@@ -1,11 +0,0 @@
-# Shared variables here
-Write-Log -Message "Setting shared variables for scenario"
-
-# Dec 2019
-#$PROXY_ARTIFACTS = "https://d7ipctdjxxii4.cloudfront.net/others/qdc/qdc-dec-2019/qdc_proxy_artifacts.zip"
-
-# April 2020
-#$PROXY_ARTIFACTS = "https://da3hntz84uekx.cloudfront.net/QlikDataCatalyst/4.5/0/_MSI/qdc_proxy_artifacts.zip"
-
-# June 2020
-$PROXY_ARTIFACTS = "https://da3hntz84uekx.cloudfront.net/QlikDataCatalyst/4.6/0/_MSI/qdc_proxy_artifacts.zip"

archived/vm-fromsnapshot-win/scripts/qdc/qdc-setup-sept20.ps1

@@ -1,100 +0,0 @@
-Param(
-    [string] $QDC_HOST = "QMI-QDC-SN"
-)
-
-function New-Credential($u,$p) {
-    $secpasswd = ConvertTo-SecureString $p -AsPlainText -Force
-    return New-Object System.Management.Automation.PSCredential ($u, $secpasswd)
-}
-
-Write-Log -Message "Setting up QDC pre-requisites in Qlik Sense"
-
-Import-Module Qlik-Cli
-
-### Connect to the Qlik Sense Repository Service with Qlik-Cli
-do {write-log -Message "Connecting to Qlik Sense Repository..."; start-sleep 15} 
-While( (Connect-Qlik $($env:COMPUTERNAME) -TrustAllCerts -UseDefaultCredentials -ErrorAction SilentlyContinue).length -eq 0 )
-
-### Add the Qlik local user to Qlik Sense
-$json = (@{userId = "qlik-data-catalyst";
-            userDirectory = "QLIK-EXTERNAL-SERVICE";
-            name = "qlik-data-catalyst";
-        } | ConvertTo-Json -Compress -Depth 10 )
-Write-Log -Message "Adding Qlik Service user."
-try {
-    Invoke-QlikPost "/qrs/user" $json | Out-Null
-} catch {
-    Write-Log -Message $_.Exception.Message -Severity "Error"
-}
-try {
-    Write-Log -Message "Set 'qlik-data-catalyst' as AuditAdmin"
-    Update-QlikUser -id $(Get-QlikUser -filter "name eq 'qlik-data-catalyst'").id -roles AuditAdmin | Out-Null
-} catch {
-    Write-Log -Message $_.Exception.Message -Severity "Error"
-}
-
-# C:\QVDs SMB FOLDER
-Write-Log -Message "Creating 'C:\QVDs' folder and set SMB"
-New-Item "C:\QVDs" -type directory | Out-Null
-New-SMBShare -Name "qvds" -Path "C:\QVDs" | Out-Null 
-Grant-SmbShareAccess -Name qvds -AccountName Everyone -AccessRight Change -Force | Out-Null
-
-
-# certs needed for qdc
-Write-Log -Message "SMB Qlik Sense certificates folder" 
-New-SMBShare -Name "certs" -Path "C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates" | Out-Null
-Grant-SmbShareAccess -Name certs -AccountName Everyone -AccessRight Read -Force | Out-Null
-
-
-Write-Log -Message "Creating 'QVD Catalog' tag"
-New-QlikTag -name "QVD Catalog" | Out-Null
-
-
-# create podium user
-Import-Module "Carbon"
-Write-Log -Message "Adding 'podium' user to Windows system"
-$cred = New-Credential "podium" "Qlik1234"
-Install-CUser -Credential $cred | Out-Null
-
-
-Write-Log -Message "Creating Qlik Sense data connection for C:\QVDs"
-# ---- Workaround qlik-cli QS April 2020
-# Qlik CLI New-QlikDataConnection fails with only 1 tag, that's why I create and use FakeTag too.
-New-QlikTag -name "FakeTag" | Out-Null
-$qvdsDC = New-QlikDataConnection -connectionstring "\\$($env:COMPUTERNAME)\qvds" -name "QVDs" -tags "QVD Catalog","FakeTag" -type "folder"
-# ----
-
-Write-Log -Message "Grant access to all user to this connection"
-New-QlikRule -name "QVDs allow to all" -comment "Allow QVDs Connection to all users" -category "Security" -resourceFilter  "DataConnection_$($qvdsDC.id)" -actions 23 -rule '((user.name like "*"))' | Out-Null
-
-
-Write-Log -Message "Setting firewall rules for QDC"
-New-NetFirewallRule -DisplayName "QDC QVD Metadata" -Action allow -LocalPort 7007 -Protocol TCP | Out-Null
-New-NetFirewallRule -DisplayName "pub2qlik" -Action allow -LocalPort 4243,4747 -Protocol TCP | Out-Null
-
-
-Write-Log -Message "Creating 'podium_dist' postgres connection"
-$cred = New-Credential "postgres" "postgres"
-$podiumDistDC = New-QlikDataConnection -connectionstring "'CUSTOM CONNECT TO `"provider=QvOdbcConnectorPackage.exe;driver=postgres;host=$QDC_HOST;port=5432;db=podium_dist;SSLMode=prefer;UseSystemTrustStore=false;ByteaAsLongVarBinary=0;TextAsLongVarchar=0;UseUnicode=1;FetchTSWTZasTimestamp=1;MaxVarcharSize=262144;UseDeclareFetch=1;Fetch=200;EnableTableTypes=1;MoneyAsDecimal=1;QueryTimeout=30;`"" `
- -name podium_dist  -type 'QvOdbcConnectorPackage.exe' -Credential $cred 
-
-Write-Log -Message "Grant access to all user to this connection"
-New-QlikRule -name "Podium_Dist allow to all" -comment "Allow Podium_Dist Connection to all users" -category "Security" -resourceFilter  "DataConnection_$($podiumDistDC.id)" -actions 23 -rule '((user.name like "*"))' | Out-Null
-
-
-Write-Log "Copy Sample QVDs into C:/QVDs folder"
-Copy-Item $PSScriptRoot\*.qvd C:\QVDs
-
-$x=1
-$files = Get-ChildItem C:\QVDs\*.qvd|sort LastWriteTime
-foreach ($file in $files) #{ echo $file }
-{
-
-    if ($x -lt 3) {
-        Set-ItemProperty -Path $file -Name LastWriteTime -Value (get-date) 
-        sleep 2
-    }
-    $x= $x +1
-}
-
-Write-Log "QDC Config Completed."

archived/vm-fromsnapshot-win/scripts/qdc/qdc-setup.ps1

@@ -1,150 +0,0 @@
-Param(
-    [string] $QDC_HOST = "QMI-QDC-SN",
-    [string] $QDC_PUBLIC_HOST
-)
-
-function New-Credential($u,$p) {
-    $secpasswd = ConvertTo-SecureString $p -AsPlainText -Force
-    return New-Object System.Management.Automation.PSCredential ($u, $secpasswd)
-}
-
-Write-Log -Message "Setting up QDC pre-requisites in Qlik Sense"
-
-Import-Module Qlik-Cli
-
-### Connect to the Qlik Sense Repository Service with Qlik-Cli
-do {write-log -Message "Connecting to Qlik Sense Repository..."; start-sleep 15} 
-While( (Connect-Qlik $($env:COMPUTERNAME) -TrustAllCerts -UseDefaultCredentials -ErrorAction SilentlyContinue).length -eq 0 )
-
-#-----------
-
-# Load variables
-. $PSScriptRoot\qdc-scenario-config.ps1
-
-Write-Log -Message "Creating QDC virtual proxy"
-$jwtcert = Get-Content -raw 'C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates\server.pem'
-New-QlikVirtualProxy -description "Qlik Data Catalyst" -sessionCookieHeaderName "X-Qlik-QDC-Session" -authenticationMethod JWT `
-  -prefix qdc -loadBalancingServerNodes $(Get-QlikNode -filter "name eq 'Central'").id `
-  -jwtAttributeUserDirectory "[QLIK-EXTERNAL-SERVICE]" -jwtAttributeUserId "name" -jwtPublicKeyCertificate $jwtcert -websocketCrossOriginWhiteList $QDC_PUBLIC_HOST | Out-Null
-
-Add-QlikProxy -ProxyId $(Get-QlikProxy -filter "serverNodeConfiguration.hostName eq '$($env:COMPUTERNAME)'").id -VirtualProxyId $(Get-QlikVirtualProxy -filter "description eq 'Qlik Data Catalyst'").id | Out-Null
-
-Start-Sleep -s 10
-
-Write-Log -Message "Downloading qdc_proxy_artifacts - This will create 'qlik-data-catalyst' qliksense user"
-Write-Log -Message "PROXY_ARTIFACTS = $PROXY_ARTIFACTS"
-
-$ENV:PATH += ";C:\Program Files\Qlik\Sense\ServiceDispatcher\Node"
-cd $env:TEMP
-(New-Object System.Net.WebClient).DownloadFile($PROXY_ARTIFACTS, "$env:TEMP\qdc_proxy_artifacts.zip")
-#Invoke-WebRequest -UseBasicParsing -OutFile qdc_proxy_artifacts.zip -Uri $PROXY_ARTIFACTS
-Expand-Archive .\qdc_proxy_artifacts.zip .
-cd qs-virtual-proxy
-(Get-Content .\check-proxy.js).replace("ducks-sense1.ad.podiumdata.net", "$($env:COMPUTERNAME)") | Set-Content .\check-proxy.js
-Copy-Item "C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates\qdc.jwt" .
-
-ls
-
-Get-QlikUser
-
-node .\check-proxy.js
-
-Get-QlikUser -filter "name eq 'qlik-data-catalyst'"
-
-Write-Log -Message "Waiting 20 secs"
-Start-Sleep -s 20
-
-Write-Log -Message "Set 'qlik-data-catalyst' as AuditAdmin"
-Update-QlikUser -id $(Get-QlikUser -filter "name eq 'qlik-data-catalyst'").id -roles AuditAdmin | Out-Null
-
-Write-Log -Message "Creating security rule for access by QLIK-EXTERNAL-SERVICE"
-New-QlikRule -Name "Security rule for access by QLIK-EXTERNAL-SERVICE" -resourceFilter "DataConnection_*,App_*" `
--actions 2 -rule '((user.userDirectory="QLIK-EXTERNAL-SERVICE"))' -rulecontext both -category Security | Out-Null
-
-
-Write-Log -Message "Adding qvd-mock to service dispatcher"
-$dir = pwd
-cd  "C:\Program Files\Qlik\Sense"
-Expand-Archive $dir\qvd-mock.zip .
-Copy-Item $dir\qvd-mock.json  "C:\Program Files\Qlik\Sense\BrokerService\service-configs\"
-
-$mock=@"
-
-[qvd-mock]
-Identity=Qlik.qvd-mock
-DisplayName=QVD Mock
-ExePath=Node\node.exe
-Script=..\qvd-mock\server.js        
-"@
-
-Add-Content "C:\Program Files\Qlik\Sense\ServiceDispatcher\services.conf" $mock
-
-Restart-Service QlikSenseServiceDispatcher
-
-Write-Log -Message "Creating 'QVD Catalog' tag"
-New-QlikTag -name "QVD Catalog" | Out-Null
-
-Write-Log -Message "Creating 'c:\QVDs' folder and set SMB"
-New-Item "C:\QVDs" -type directory | Out-Null
-New-SMBShare -Name "qvds" -Path "C:\QVDs" | Out-Null 
-Grant-SmbShareAccess -Name qvds -AccountName Everyone -AccessRight Change -Force | Out-Null
-
-Write-Log -Message "Creating Qlik Sense data connection for C:\QVDs"
-# ---- Workaround qlik-cli QS April 2020
-# Qlik CLI New-QlikDataConnection fails with only 1 tag, that's why I create and use FakeTag too.
-New-QlikTag -name "FakeTag" | Out-Null
-$qvdsDC = New-QlikDataConnection -connectionstring "\\$($env:COMPUTERNAME)\qvds" -name "QVDs" -tags "QVD Catalog","FakeTag" -type "folder"
-# ----
-
-Write-Log -Message "Grant access to all user to this connection"
-New-QlikRule -name "QVDs allow to all" -comment "Allow QVDs Connection to all users" -category "Security" -resourceFilter  "DataConnection_$($qvdsDC.id)" -actions 23 -rule '((user.name like "*"))' | Out-Null
-
-
-Write-Log -Message "Setting firewall rules for QDC"
-New-NetFirewallRule -DisplayName "QDC QVD Metadata" -Action allow -LocalPort 7007 -Protocol TCP | Out-Null
-New-NetFirewallRule -DisplayName "pub2qlik" -Action allow -LocalPort 4243,4747 -Protocol TCP | Out-Null
-
-# certs needed for qdc
-Write-Log -Message "SMB Qlik Sense certificates folder" 
-New-SMBShare -Name "certs" -Path "C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates" | Out-Null
-Grant-SmbShareAccess -Name certs -AccountName Everyone -AccessRight Read -Force | Out-Null
-
-
-# create podium user
-Import-Module "Carbon"
-Write-Log -Message "Adding 'podium' user to Windows system"
-$cred = New-Credential "podium" "Qlik1234"
-Install-CUser -Credential $cred | Out-Null
-
-#gci cert:\CurrentUser\My | where {$_.issuer -eq $cert}  | Connect-Qlik -Username $env:COMPUTERNAME\podium -Computername $env:COMPUTERNAME
-#gci cert:\CurrentUser\My | where {$_.issuer -eq $cert} | Connect-Qlik -Computername $env:COMPUTERNAME
-#Update-QlikUser -id $(Get-QlikUser -filter "name eq 'podium'").id -roles RootAdmin
-
-#gci cert:\CurrentUser\My | where {$_.issuer -eq $cert}  | Connect-Qlik -Username $env:COMPUTERNAME\podium -Computername $env:COMPUTERNAME
-
-Write-Log -Message "Creating 'podium_dist' postgres connection"
-$cred = New-Credential "postgres" "postgres"
-$podiumDistDC = New-QlikDataConnection -connectionstring "'CUSTOM CONNECT TO `"provider=QvOdbcConnectorPackage.exe;driver=postgres;host=$QDC_HOST;port=5432;db=podium_dist;SSLMode=prefer;UseSystemTrustStore=false;ByteaAsLongVarBinary=0;TextAsLongVarchar=0;UseUnicode=1;FetchTSWTZasTimestamp=1;MaxVarcharSize=262144;UseDeclareFetch=1;Fetch=200;EnableTableTypes=1;MoneyAsDecimal=1;QueryTimeout=30;`"" `
- -name podium_dist  -type 'QvOdbcConnectorPackage.exe' -Credential $cred 
-
-Write-Log -Message "Grant access to all user to this connection"
-New-QlikRule -name "Podium_Dist allow to all" -comment "Allow Podium_Dist Connection to all users" -category "Security" -resourceFilter  "DataConnection_$($podiumDistDC.id)" -actions 23 -rule '((user.name like "*"))' | Out-Null
-
-
-
- Write-Log "Copy Sample QVDs into C:/QVDs folder"
-Copy-Item $PSScriptRoot\*.qvd C:\QVDs
-
-$x=1
-$files = Get-ChildItem C:\QVDs\*.qvd|sort LastWriteTime
-foreach ($file in $files) #{ echo $file }
-{
-
-    if ($x -lt 3) {
-        Set-ItemProperty -Path $file -Name LastWriteTime -Value (get-date) 
-        sleep 2
-    }
-    $x= $x +1
-}
-
-Write-Log "QDC Config Completed."

archived/vm-fromsnapshot-win/scripts/qliksense/bootstrap-qs.ps1

@@ -1,131 +0,0 @@
-Param(
-    [string] $ModuleName = "vm-qs"
-)
-
-Write-Log "Resize Partition C to max size"
-$size = Get-PartitionSupportedSize -DriveLetter C
-Resize-Partition -DriveLetter C -Size $size.SizeMax | Out-Null
-
-
-# Helper Functions
-# ----------------
-function New-Credential($u,$p) {
-    $secpasswd = ConvertTo-SecureString $p -AsPlainText -Force
-    return New-Object System.Management.Automation.PSCredential ($u, $secpasswd)
-}
-
-REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
-
-#Write-Log "Deleting old certificates files..."
-#Get-ChildItem "$($env:ProgramData)\Qlik\Sense\Repository\Exported Certificates\" | Remove-Item -Recurse
-
-
-Set-Service -Name "QlikLoggingService" -StartupType Automatic
-Set-Service -Name "QlikSenseServiceDispatcher" -StartupType Automatic
-Set-Service -Name "QlikSenseProxyService" -StartupType Automatic
-Set-Service -Name "QlikSenseEngineService"  -StartupType Automatic
-Set-Service -Name "QlikSensePrintingService"  -StartupType Automatic
-Set-Service -Name "QlikSenseSchedulerService"  -StartupType Automatic
-Set-Service -Name "QlikSenseRepositoryService"  -StartupType Automatic
-Set-Service -Name "QlikSenseRepositoryDatabase"  -StartupType Automatic
-
-
-Write-Log "Starting QlikSenseRepositoryDatabase and QlikSenseServiceDispatcher..."
-Start-Service QlikSenseRepositoryDatabase
-Start-Service QlikSenseServiceDispatcher
-
-#Delete certificates
-Write-Log "Deleting old certificates from keyStore..."
-$Certs = Get-ChildItem cert:"CurrentUser\My"
-$Certs | ForEach-Object{Remove-Item -path $_.PSPath -recurse -Force}
-$Certs = Get-ChildItem cert:"LocalMachine\My"
-$Certs | ForEach-Object{Remove-Item -path $_.PSPath -recurse -Force}
-$Certs = Get-ChildItem cert:"LocalMachine\Root" | Where-Object { $_.Subject -match 'GEN-QS' -or $_.Subject -match 'QMI-QS' -or $_.Subject -match 'QMI-E2E' }
-$Certs | ForEach-Object{Remove-Item -path $_.PSPath -recurse -Force}
-
-Write-Log "Setting new hostname ($($env:computername)) in to Host.cfg file..."
-$enchostname = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("$($env:computername)"))
-Set-Content -Path C:\ProgramData\Qlik\Sense\Host.cfg -Value $enchostname
-
-Write-Log "Bootstraping Qlik Sense ..."
-Write-Log "Executing ... Repository.exe -bootstrap -standalone -restorehostname"
-$waiting=20
-if ( $env:USERNAME -eq "qservice" ) {
-    $waiting=50
-    Write-Log "The user executing this script is already 'qservice'"
-    Start-Process powershell.exe -ArgumentList "Start-Process cmd.exe -Verb runAs -ArgumentList '/k C:\PROGRA~1\Qlik\Sense\Repository\Repository.exe -bootstrap -standalone -restorehostname'"
-
-} else {
-    Write-Log "The user executing this script is NOT 'qservice'"
-    $cred = New-Credential "qservice" "Qlik1234"
-    Start-Process powershell.exe -Credential $cred -ArgumentList "Start-Process cmd.exe -Verb runAs -ArgumentList '/k C:\PROGRA~1\Qlik\Sense\Repository\Repository.exe -bootstrap -standalone -restorehostname'"
-}
-
-$waiting=50
-Write-Log "Waiting $waiting secs ..."
-Start-Sleep -s $waiting
-
-Write-Log "Restarting Service Dispatcher"
-Restart-Service QlikSenseServiceDispatcher -Force
-
-Start-Sleep -s 20
-
-Write-Log "New Certs: CurrentUser\My"
-Get-ChildItem cert:"CurrentUser\My"
-Write-Log "New Certs: LocalMachine\My"
-Get-ChildItem cert:"LocalMachine\My"
-Write-Log "New Certs: LocalMachine\Root"
-Get-ChildItem cert:"LocalMachine\Root" | Where-Object { $_.Subject -match 'QMI' }
-$NewCerts = Get-ChildItem cert:"LocalMachine\Root" | Where-Object { $_.Subject -match 'QMI' }
-
-if ($NewCerts) {
-    Write-Log "Restarting all Qlik Sense services"
-    Restart-Service QlikSenseServiceDispatcher -Force
-    Restart-Service QlikLoggingService -Force
-    Restart-Service QlikSenseRepositoryService -Force
-    Restart-Service QlikSenseProxyService -Force
-    Restart-Service QlikSenseEngineService -Force
-    Restart-Service QlikSenseSchedulerService -Force 
-    Restart-Service QlikSensePrintingService -Force 
-
-    if ( $ModuleName -ne "vm-qs" ) {
-        Start-Sleep -s 20
-        Write-Log "Recovering Qlik Sense users"
-        Start-Process powershell.exe -ArgumentList "Start-Process cmd.exe -Verb runAs -ArgumentList '/c $PSScriptRoot\qs-reset-users.bat'"
-        Restart-Service QlikSenseRepositoryService -Force
-    }
-
-} else {
-    Write-Error "Error: Qlik Sense Certs not recreated!"
-    throw "Error: Qlik Sense Certs not recreated!"
-}
-
-#### Recreate QS desktop shortcuts
-Write-Log "Recreate QS desktop shortcuts"
-$sourcepath="C:\Users\Public\Desktop\Qlik Management Console.lnk"
-$destination="C:\Users\Public\Desktop\Qlik Management Console2.lnk"
-Copy-Item $sourcepath $destination  ## Get the lnk we want to use as a template
-Remove-Item -Path $sourcepath -Force
-$shell = New-Object -COM WScript.Shell
-$shortcut = $shell.CreateShortcut($destination)  ## Open the lnk
-$shortcut.TargetPath = "https://$env:computername/qmc"  ## Make changes
-$shortcut.Save()  ## Save
-Rename-Item -Path $destination -NewName "Qlik Management Console.lnk"
-
-$sourcepath="C:\Users\Public\Desktop\Qlik Sense Hub.lnk"
-$destination="C:\Users\Public\Desktop\Qlik Sense Hub2.lnk"
-Copy-Item $sourcepath $destination  ## Get the lnk we want to use as a template
-Remove-Item -Path $sourcepath -Force
-$shell = New-Object -COM WScript.Shell
-$shortcut = $shell.CreateShortcut($destination)  ## Open the lnk
-$shortcut.TargetPath = "https://$env:computername/hub"  ## Make changes
-$shortcut.Save()  ## Save
-Rename-Item -Path $destination -NewName "Qlik Sense Hub.lnk"
-####
-
-REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f
-
-
-
-
-

archived/vm-fromsnapshot-win/scripts/qliksense/qs-post-cfg.ps1

@@ -1,185 +0,0 @@
-<#
-Module:             qs-post-cfg
-Author:             Clint Carr
-Modified by:        -
-Modification History:
-- Fixed connect as user logic (qlik-cli change)
-- Added logic to accomodate for Professional/Analyzer or User licenses 
-- Added a loop into the Connect-Qlik statement to remove an abort error
-- Added Logging
-- Added comments
-- Error checking
-- Modified service connection for Qlik Sense from endless loop to a set number of attempts.
-- Added a service restart at the end of the Central Node (seems to resolve an issue with April 2018)
-last updated:       10/18/2019
-Intent: Configure the Qlik Sense environment with applications and Security Rules.
-#>
-
-Param(
-    [string] $Hostname,
-    [string] $CertPwd,
-    [string] $QlikUserPwd
-
-)
-
-Import-Module Qlik-Cli
-Import-Module "Carbon"
-
-# Helper Functions
-# ----------------
-function New-Credential($u,$p) {
-    $secpasswd = ConvertTo-SecureString $p -AsPlainText -Force
-    return New-Object System.Management.Automation.PSCredential ($u, $secpasswd)
-}
-
-Write-Log -Message "Creating Qlik account"
-$cred = New-Credential "Qlik" $QlikUserPwd
-Install-CUser -Credential $cred
-
-
-Write-Log -Message "Starting qs-post-cfg.ps1"
-
-### Waiting for Qlik Sense installation to complete
-#-----------
-Function restartQse
-{
-    Write-Log "Checking Engine Service has started..."
-    $qse = get-service QlikSenseEngineService
-    write-log -Message "The engine is currently $($qse.Status)"
-    if ($qse.Status -eq "Stopped") {
-        Write-Log -Message "Starting Qlik Sense Engine and waiting 120 seconds" -Severity "Warn"; 
-        Start-Service QlikSenseEngineService ; 
-        Restart-Service QlikSenseServiceDispatcher; 
-        start-sleep -s 120
-    }
-    write-log -Message "The engine is currently $($qse.Status)"
-}
-
-Function connQSR
-{
-    $i = 1
-    $statusCode = 0
-    while ($statusCode -ne 200 -and $i -le 10) 
-        { 
-            try {$statusCode = (Invoke-WebRequest https://$($env:COMPUTERNAME)/qps/user -UseBasicParsing).statusCode }
-            catch
-                {
-                    $i++
-                    write-log -Message "QSR on $env:COMPUTERNAME not responding attempt $i of 10..." -Severity "Warn"
-                    start-sleep -s 20 
-                }
-        } 
-}
-
-Function restartServices
-{
-    write-log -Message "Restarting Qlik Sense Services on $env:COMPUTERNAME" -Severity "Warn"
-    Restart-Service QlikSenseRepositoryDatabase -Force
-    Restart-Service QlikLoggingService -Force
-    Restart-Service QlikSenseServiceDispatcher -Force
-    Restart-Service QlikSenseRepositoryService -Force
-    Restart-Service QlikSenseProxyService -Force
-    Restart-Service QlikSenseEngineService -Force
-    Restart-Service QlikSensePrintingService -Force
-    Restart-Service QlikSenseSchedulerService -Force
-}
-
-Function qlikSenseUserAccess
-{
-    $userAccessGroup = (@{name = "License Everyone";} | ConvertTo-Json -Compress -Depth 10)
-    $licenseId = Invoke-QlikPost "/qrs/License/UserAccessGroup" $userAccessGroup
-    $systemRuleJson = (@{
-        name = "Grant Everyone a token";
-        category = "License";
-        rule = '((user.name like "*"))';
-        type = "Custom";
-        resourceFilter = "License.UserAccessGroup_" + $licenseId.id;
-        actions = 1;
-        ruleContext = "QlikSenseOnly";
-        disabled = $false;
-        comment = "Rule to set up automatic user access";} | ConvertTo-Json -Compress -Depth 10)
-    Write-Log -Message "Adding user license rule to grant Everyone Tokens."
-    try {
-        Invoke-QlikPost "/qrs/SystemRule" $systemRuleJson | Out-Null
-    } catch {
-        Write-Log -Message $_.Exception.Message -Severity "Error"
-    }
-}
-
-Function qlikSenseProfessionalAccess
-{
-    $professionalAccessGroup = (@{name = "License Everyone";} | ConvertTo-Json -Compress -Depth 10)
-    $licenseId = Invoke-QlikPost "/qrs/License/ProfessionalAccessGroup" $professionalAccessGroup
-    $systemRuleJson = (@{
-        name = "Grant Everyone Professional Access";
-        category = "License";
-        rule = '((user.name like "*"))';
-        type = "Custom";
-        resourceFilter = "License.ProfessionalAccessGroup_" + $licenseId.id;
-        actions = 1;
-        ruleContext = "QlikSenseOnly";
-        disabled = $false;
-        comment = "Rule to set up automatic user access";} | ConvertTo-Json -Compress -Depth 10)
-    Write-Log -Message "Adding user license rule to grant Everyone access as Professional."
-    try {
-        Invoke-QlikPost "/qrs/SystemRule" $systemRuleJson | Out-Null
-    } catch {
-        Write-Log -Message $_.Exception.Message -Severity "Error"
-    }
-}
-
-#-----------
-write-log -Message "Waiting 1 minute for Qlik Sense installation to complete"
-start-sleep -s 60
-
-    
-### wait for Qlik Sense Proxy service to respond with an HTTP 200 status before proceeding
-connQSR
-$statusCode = (Invoke-WebRequest https://$($env:COMPUTERNAME)/qps/user -UseBasicParsing).statusCode
-if ($statusCode -ne 200)
-    { 
-        Write-Log -Message "Waiting 25 seconds before next pass" -Severity "Warn"
-        restartServices
-        Write-Log -Message "Waiting 45 seconds for Services to ensure they are ready" -Severity "Warn"
-        start-sleep -s 45
-        connQSR
-    }
-
-$statusCode = (Invoke-WebRequest https://$($env:COMPUTERNAME)/qps/user -UseBasicParsing).statusCode
-if ($statusCode -ne 200) { 
-        Write-Log -Message "Provisioning failed" -Severity "Error"
-        Exit 
-}
-Write-Log -Message "Qlik Sense Proxy responding on $env:COMPUTERNAME, status code: $statusCode"
-Write-Log -Message "Connecting to Qlik Sense Repository Service on $env:COMPUTERNAME"
-
-restartQse
-
-### Connect to the Qlik Sense Repository Service with Qlik-Cli
-do {write-log -Message "Connecting to Qlik Sense Repository"; start-sleep 15} 
-While( (Connect-Qlik $($env:COMPUTERNAME) -TrustAllCerts -UseDefaultCredentials -ErrorAction SilentlyContinue).length -eq 0 )
-
-
-### Enabling HTTP
-#Write-Log -Message "Enabling HTTP access on Central Node proxy"
-#try {
-#    Get-QlikProxy -filter "serverNodeConfiguration.Name eq 'Central'" | Update-QlikProxy -AllowHttp 1  | Out-Null
-#} catch {
-#    Write-Log -Message $_.Exception.Message -Severity "Error"
-#}
-#Start-Sleep -s 10
-
-### Install qlik-poc_com certificate
-Write-Log -Message "Install 'qmi.qlik-poc.com' certificate, set thumbsprint and whitelist domain in QS central virtual proxy"
-try {
-    $secpasswd = ConvertTo-SecureString $CertPwd -AsPlainText -Force
-    $sslCert=Import-PfxCertificate -FilePath C:/provision/wildcard_qmi_qlik-poc_com.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $secpasswd
-    Update-QlikProxy -SslBrowserCertificateThumbprint $sslCert.Thumbprint -id (Get-QlikProxy).id | Out-Null
-    Start-Sleep -s 10
-    Connect-Qlik $($env:COMPUTERNAME) -TrustAllCerts -UseDefaultCredentials | Out-Null
-    Update-QlikVirtualProxy -id (Get-QlikVirtualProxy -filter "description eq 'Central Proxy (Default)'").id -websocketCrossOriginWhiteList $Hostname | Out-Null
-    Start-Sleep -s 10
-} catch {
-    Write-Log -Message $_.Exception.Message -Severity "Error"
-}
-

archived/vm-fromsnapshot-win/scripts/qliksense/qs-reset-users.bat

@@ -1,10 +0,0 @@
-@echo off
-set host_name=localhost
-set owner_name=postgres 
-set PGPASSWORD=Qlik1234
-
-C: && cd "C:\Program Files\Qlik\Sense\Repository\PostgreSQL\9.6\bin" && psql -p 4432 -U %owner_name% -d QSR --command "UPDATE public.\"Users\" SET \"UserDirectory\" = '%COMPUTERNAME%', \"RolesString\" = 'RootAdmin' WHERE \"UserDirectory\" != 'INTERNAL';"
-psql -p 4432 -U %owner_name% -d QSR --command "SELECT * FROM public.\"Users\" WHERE \"RolesString\" = 'RootAdmin';"
-
-cd "C:\provision"
-@echo off

archived/vm-fromsnapshot-win/scripts/winrm.ps1

@@ -1,30 +0,0 @@
-Write-Host "Delete any existing WinRM listeners"
-winrm delete winrm/config/listener?Address=*+Transport=HTTP  2>$Null
-#winrm delete winrm/config/listener?Address=*+Transport=HTTPS 2>$Null
-
-Write-Host "Create a new WinRM listener and configure"
-winrm create winrm/config/listener?Address=*+Transport=HTTP
-#winrm set winrm/config/winrs "@{MaxMemoryPerShellMB=`"0`"}"
-winrm set winrm/config "@{MaxTimeoutms=`"1800000`"}"
-winrm set winrm/config/service "@{AllowUnencrypted=`"true`"}"
-#winrm set winrm/config/service "@{MaxConcurrentOperationsPerUser=`"12000`"}"
-winrm set winrm/config/service/auth "@{Basic=`"true`"}"
-winrm set winrm/config/client/auth "@{Basic=`"true`"}"
-
-Write-Host "Configure UAC to allow privilege elevation in remote shells"
-$Key = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
-$Setting = 'LocalAccountTokenFilterPolicy'
-Set-ItemProperty -Path $Key -Name $Setting -Value 1 -Force
-
-#Write-Host "turn off PowerShell execution policy restrictions"
-#Set-ExecutionPolicy -ExecutionPolicy Unrestricted
-
-
-Write-Host "Configure and restart the WinRM Service; Enable the required firewall exception"
-net stop winrm
-net start winrm
-#Stop-Service -Name WinRM
-#Set-Service -Name WinRM -StartupType Automatic
-netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" new action=allow localip=any remoteip=any
-#Start-Service -Name WinRM
-

archived/vm-fromsnapshot-win/variables.tf

@@ -1,67 +0,0 @@
-
-variable "prefix" {
-  default = "QMI"
-}
-
-variable "subnet_id" {
-}
-
-variable "location" {
-}
-
-variable "snapshot_id" {
-}
-
-variable "resource_group_name" {
-}
-
-variable "vm_type" {
-  default = "Standard_D4s_v3"
-}
-
-variable "managed_disk_type" {
-  default = "Premium_LRS"
-}
-
-variable "disk_size_gb" {
-  default = "128"
-}
-
-variable "admin_username" {
-  default = "scdemoadmin"
-}
-
-variable "initial_password" {
-  default = null
-}
-
-variable "virtual_machine_name" {
-  default = null
-}
-
-variable "user_id" {
-  default = null
-}
-
-variable "provId" {
-  default = null
-}
-
-variable "is_24x7"{
-  type = bool
-  default = null
-}
-
-variable "shutdownTime"{
-  default = null
-}
-
-variable "startupTime"{
-  default = null
-}
-
-variable "notrename" {
-  default = null
-}
-
-

archived/vm-fromsnapshot/main.tf

@@ -1,148 +0,0 @@
-resource "random_id" "randomMachineId" {
-    keepers = {
-        # Generate a new ID only when a new resource group is defined
-        resource_group = var.resource_group_name
-    }
-    
-    byte_length = 2
-}
-
-resource "random_password" "password" {
-  length = 16
-  special = true
-  override_special = "_!@"
-  upper = true
-  lower = true
-  min_lower = 2
-  min_upper = 2
-  min_special = 2
-}
-
-locals {
-  virtual_machine_name = (var.virtual_machine_name != null)? var.virtual_machine_name :  "${var.prefix}-${random_id.randomMachineId.hex}"
-  admin_username = var.admin_username
-  admin_password = random_password.password.result
-  notrename = (var.notrename != null)? "-NotApply" : ""
-}
-
-resource "azurerm_managed_disk" "copy" {
-  
-  name = "Disk-${var.prefix}-${random_id.randomMachineId.hex}"
-  location = var.location
-  resource_group_name = var.resource_group_name
-  storage_account_type = "Premium_LRS"
-  create_option = "Copy"
-  source_resource_id = var.snapshot_id
-  disk_size_gb = var.disk_size_gb
-
-  tags = {
-    "Deployment" = "QMI PoC"
-    "Cost Center" = "3100"
-    "QMI_user" = var.user_id != null? var.user_id : null
-  }
-}
-
-module "qmi-nic" {
-  source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//qmi-nic"
-  
-  prefix = local.virtual_machine_name
-  location = var.location
-  subnet_id = var.subnet_id
-  
-  resource_group_name = var.resource_group_name
-  user_id = var.user_id
-}
-
-resource "azurerm_virtual_machine" "vm" {
-  name                  = local.virtual_machine_name
-  location              = var.location
-  resource_group_name   = var.resource_group_name
-  network_interface_ids = [ module.qmi-nic.id ]
-  vm_size               = var.vm_type
-
-
-  storage_os_disk {
-    name              = azurerm_managed_disk.copy.name
-    os_type           = "Windows"
-    managed_disk_id   = azurerm_managed_disk.copy.id
-    managed_disk_type = "Premium_LRS"
-    create_option     = "Attach"
-  }
-
-  os_profile_windows_config {
-    
-    provision_vm_agent        = true
-    enable_automatic_upgrades = false
-
-    winrm {
-      protocol = "http"
-    }
-  }
-
-  /*os_profile {
-    computer_name = local.virtual_machine_name
-    admin_username = local.admin_username
-  }*/
-
-  tags = {
-    "Deployment" = "QMI PoC"
-    "Cost Center" = "3100"
-    "ProvId"  = var.provId != null? var.provId : null
-    "QMI_user" = var.user_id != null? var.user_id : null
-    "24x7" = var.is_24x7 == true? "" : null
-    "ShutdownTime": var.is_24x7 == false? var.shutdownTime : null
-    "StartupTime": var.is_24x7 == false? var.startupTime : null
-  }
-  
-  provisioner "file" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = local.admin_username
-      password = var.initial_password
-      port     = 5985
-      https    = false
-      timeout  = "10m"
-    }
-    source      = "${path.module}/scripts"
-    destination = "C:/tmp/provision"
-  }
-
-
-  provisioner "remote-exec" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = local.admin_username
-      password = var.initial_password
-      port     = 5985
-      https    = false
-      timeout  = "10m"
-    }
-
-    inline = [
-      "powershell.exe -File C:/tmp/provision/bootstrap.ps1",
-      "powershell.exe -File C:/tmp/provision/password.ps1 -Username ${local.admin_username} -Pass ${local.admin_password}"
-    ]
-  }
-
-  # Rename Computer
-  provisioner "remote-exec" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = local.admin_username
-      password = local.admin_password
-      port     = 5985
-      https    = false
-      timeout  = "10m"
-    }
-
-    inline = [
-      "powershell.exe -File C:/tmp/provision/RenameComputer.ps1 -NewName ${local.virtual_machine_name} ${local.notrename}" 
-    ]
-
-    on_failure = continue
-  }
-
-}

archived/vm-fromsnapshot/scripts/RenameComputer.ps1

@@ -1,14 +0,0 @@
-
-Param(
-    [string] $NewName,
-    [switch] $NotApply = $False 
-)
-
-
-
-if ($NotApply){
-    Write-Host "Not renaming machine"
-} else {
-    Write-Host "Machine is going to be renamed as $NewName"
-    Rename-Computer -NewName $NewName -Force -Restart
-}

archived/vm-fromsnapshot/scripts/bootstrap.ps1

@@ -1,30 +0,0 @@
-
-New-Item -ItemType directory -Path C:\Windows\System32\WindowsPowerShell\v1.0\Modules\qmiCLI -force | Out-Null
-Copy-Item $PSScriptRoot\qmiCLI.psm1 C:\Windows\System32\WindowsPowerShell\v1.0\Modules\qmiCLI\qmiCLI.psm1 | Out-Null
-Import-Module qmiCLI.psm1 | Out-Null
-
-#Importing Utils module
-New-Item -ItemType directory -Path C:\Windows\System32\WindowsPowerShell\v1.0\Modules\qmiUtils -force | Out-Null
-Copy-Item $PSScriptRoot\qmiUtils.psm1 C:\Windows\System32\WindowsPowerShell\v1.0\Modules\qmiUtils\qmiUtils.psm1 | Out-Null
-Import-Module qmiUtils.psm1 | Out-Null
-
-Write-Log "Scripts locations is: $PSScriptRoot"
-
-#Install Chocolatey
-#Write-Log "Install Chocolatey"
-#Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
-
-### Disable Password policy
-secedit /export /cfg c:\secpol.cfg  | Out-Null
-(Get-Content C:\secpol.cfg).replace("PasswordComplexity = 1", "PasswordComplexity = 0") | Out-File C:\secpol.cfg  | Out-Null
-secedit /configure /db c:\windows\security\local.sdb /cfg c:\secpol.cfg /areas SECURITYPOLICY | Out-Null
-rm -force c:\secpol.cfg -confirm:$false  | Out-Null
-
-#Write-Log "Resize Partition C to max size"
-#$size = Get-PartitionSupportedSize -DriveLetter C
-#Resize-Partition -DriveLetter C -Size $size.SizeMax | Out-Null
-
-
-
-
-

archived/vm-fromsnapshot/scripts/password.ps1

@@ -1,12 +0,0 @@
-Param(
-    [string] $Username,
-    [string] $Pass
-)
-
-Import-Module "Carbon"
-
-$secpasswd = ConvertTo-SecureString $Pass -AsPlainText -Force
-$cred = New-Object System.Management.Automation.PSCredential ($Username, $secpasswd)
-
-Install-CUser -Credential $cred 
-Write-Log "Done! Setting new password to user $Username"

archived/vm-fromsnapshot/scripts/qmiCLI.psm1

@@ -1,189 +0,0 @@
-<#
-Module:             QlikCLI
-Author:             Clint Carr
-                    Byron Ainsworth
-
-Modified by:        -
-last updated:       10/10/2017
-
-Modification History:
- - 
-
-Intent: Provide prepackaged commands to facilitate common QMI activities
-
-Dependencies: 
- - 
-
-#>
-
-function Write-Log
-{
-    param (
-        [Parameter(Mandatory)]
-        [string]$Message,
-        [Parameter()]
-        [ValidateSet('Info','Warn','Error')]
-        [string]$Severity = 'Info'
-    )
-    
-    $line = [pscustomobject]@{
-        'DateTime' = (Get-Date)
-        'Severity' = $Severity
-        'Message' = $Message
-        
-    }
-    Write-Host "$($line.DateTime) [$($line.Severity)]: $($line.Message)"
-    $line | Export-Csv -Path c:\provision\QMIProvision.log -Append -NoTypeInformation
-}
-
-Function Backup-QMIAppsSerial
-{
-  param (
-    [Parameter()]
-    [string]$Source = 'c:\QlikShare\apps\',
-    [Parameter()]
-    [string]$Destination = '\\VBOXSVR\shared-content\apps'
-  )
-
-  Write-Log -Message "Commencing export process for local Qlik Sense Apps repository" -Severity 'Info'
-
-  ### Get Apps
-  Write-Log -Message "Identifying eligible local Qlik Sense Apps" -Severity 'Info'
-  $arrApps = Get-QlikApp | ? {$_.stream.name -ne 'monitoring apps'}
-  Write-Log -Message "Qlik Sense Apps identified: $($arrApps.Count)" -Severity 'Info'
-
-  Foreach($objApp in $arrApps){
-    If($objApp.Published -eq $True){
-        If(Test-Path -Path $($Destination + '\' + $objApp.stream.name)){ 
-        }
-        else{
-          Write-Log -Message "Identified new stream $($objApp.stream.name). Creating central stream repository" -Severity 'Info'
-          New-Item -ItemType Directory -Path $($Destination + '\' + $objApp.stream.name) -Force
-        }
-        $objApp | Export-QlikApp -filename $($Destination + '\' + $($objApp.stream.name) + '\' +$objApp.name + '.qvf')
-        Write-Log -Message "Qlik Sense Apps exported: $($objApp.Name)" -Severity 'Info'
-    }else{
-      $objApp | Export-QlikApp -filename $($Destination + '\' + $objApp.name + '.qvf')
-      Write-Log -Message "Qlik Sense Apps exported: $($objApp.Name)" -Severity 'Info'
-    }
-  }
-
-  Write-Log -Message "Concluding export process for local Qlik Sense Apps repository" -Severity 'Info'
-
-}
-
-Function Backup-QMIApps
-{
-  param (
-    [Parameter()]
-    [string]$Source = 'c:\QlikShare\apps\',
-    [Parameter()]
-    [string]$Destination = '\\VBOXSVR\shared-content\apps'
-  )
-
-  Write-Log -Message "Commencing export process for local Qlik Sense Apps repository" -Severity 'Info'
-
-}
-
-Function Backup-QMIExtensions
-{
-  param (
-    [Parameter()]
-    [string]$Source = 'C:\QlikShare\StaticContent\Extensions\',
-    [Parameter()]
-    [string]$Destination = '\\VBOXSVR\shared-content\extensions'
-  )
-
-  Write-Log -Message "Commencing export process for Extensions to from local $env:computername to central shared-content repository" -Severity 'Info'
-
-  ## Verify source directory exists
-  If (Test-Path $Source){
-    Write-Log -Message "Confirmed local Extensions repository exists" -Severity 'Info'
-
-    Try
-    {
-      $arrExtensions = Get-ChildItem -Path $Source | ? {$_.Name -notlike "idevio*"}
-      foreach($objExtension in $arrExtensions){
-        Compress-Archive -Path $objExtension.FullName -DestinationPath $($Destination + '\' + $objExtension.name + '.zip' ) -CompressionLevel 'Optimal' -Force
-      }
-
-      #$arrObjects | Copy-Item -Destination $Destination -Recurse -Force -Verbose
-      Write-Log -Message "Concluding export process for Extensions repository" -Severity 'Info'
-    }
-    Catch
-    {
-      $_.Exception.Message
-      $_.Exception.ItemName
-      Write-Log -Message "Something went wrong with the file transfer. Confirm shared-content is available at $Destination" -Severity 'Error'
-    }
-
-  }else{
-    Write-Log -Message "Local Extensions repository does not exist. If you have placed your local repository in a location other than $Source you can leverage the Source argument to override" -Severity 'Error'
-    Exit
-  }
-
-}
- 
-Function Backup-QMIReferenceData
-{
-  param (
-    [Parameter()]
-    [string]$Source = 'c:\QlikShare\ReferenceData\',
-    [Parameter()]
-    [string]$Destination = '\\VBOXSVR\shared-content\ReferenceData'
-  )
-
-  Write-Log -Message "Commencing export process for ReferenceData to from local $env:computername to central shared-content repository" -Severity 'Info'
-
-  ## Verify source directory exists
-  If (Test-Path $Source){
-    Write-Log -Message "Confirmed local ReferenceData repository exists" -Severity 'Info'
-
-    Try
-    {
-      $arrObjects = Get-ChildItem -Path $Source
-      $arrObjects | Copy-Item -Destination $Destination -Recurse -Force -Verbose
-      Write-Log -Message "Concluding export process for ReferenceData repository" -Severity 'Info'
-    }
-    Catch
-    {
-      Write-Log -Message "Something went wrong with the file transfer. Confirm shared-content is available at $Destination" -Severity 'Error'
-    }
-
-  }else{
-    Write-Log -Message "Local ReferenceData repository does not exist. If you have placed your local repository in a location other than $Source you can leverage the Source argument to override" -Severity 'Error'
-    Exit
-  }
-}
-
-Function Backup-QMIContentLibraries
-{
-  param (
-    [Parameter()]
-    [string]$Source = 'C:\QlikShare\StaticContent\Content\',
-    [Parameter()]
-    [string]$Destination = '\\VBOXSVR\shared-content\ContentLibrary'
-  )
-
-  Write-Log -Message "Commencing export process for ContentLibraries to from local $env:computername to central shared-content repository" -Severity 'Info'
-
-  ## Verify source directory exists
-  If (Test-Path $Source){
-    Write-Log -Message "Confirmed local ContentLibraries repository exists" -Severity 'Info'
-
-    Try
-    {
-      $arrObjects = Get-ChildItem -Path $Source
-      $arrObjects | Copy-Item -Destination $Destination -Recurse -Force -Verbose
-      Write-Log -Message "Concluding export process for ContentLibraries repository" -Severity 'Info'
-    }
-    Catch
-    {
-      Write-Log -Message "Something went wrong with the file transfer. Confirm shared-content is available at $Destination" -Severity 'Error'
-    }
-    
-  }else{
-    Write-Log -Message "Local ContentLibraries repository does not exist. If you have placed your local repository in a location other than $Source you can leverage the Source argument to override" -Severity 'Error'
-    Exit
-  }
-}

archived/vm-fromsnapshot/scripts/qmiUtils.psm1

@@ -1,92 +0,0 @@
-<#
-Module:             UtilsQMI
-Author:             Manuel Romero
-                    Clint Car
-
-Modified by:        -
-last updated:       11/10/2017
-
-Modification History:
- -
-
-Intent: One place for common functions across modules we don't want in qmiCLI
-
-Dependencies:
- -
-#>
-
-Function New-MyCredential 
-{
-    param (
-        [string] $user,
-        [string] $pass
-    )
-
-    PROCESS {
-        $secpasswd = ConvertTo-SecureString $pass -AsPlainText -Force
-        return New-Object System.Management.Automation.PSCredential ($user, $secpasswd)
-    }
-}
-
-Function CreateOdagLink
-{
-    param (
-        [string]$odagLinkName,
-        [string]$selectionAppName,
-        [string]$detailsAppName,
-        [string]$sheet2OpenName,
-        [string]$odagLinkExpression,
-        [int]$rowsLimit,
-        [int]$appsLimit,
-        [string]$retentionTime,
-        [string]$sheetEmbedName
-    )
-
-
-    PROCESS {
-
-        Trap {
-            Write-Log -Message "Error in function CreateOdagLink" -Severity "Error"
-            Write-Log -Message $_.Exception.Message -Severity "Error"
-            Break
-        }
-
-        Write-Log -Message "Installing NodeJs"
-        cinst nodejs.install --version 6.4.0  | Out-Null
-
-        if ( -Not (Test-Path C:\OdagEnigma) ) {
-            Write-Log -Message "Unzipping Node EnigmaJS"
-            Expand-Archive -LiteralPath C:\installation\EnigmaModule.zip -DestinationPath C:\OdagEnigma -Force  | Out-Null
-        }
-
-        # Create ODAG Link
-        Write-Log -Message "Adding ODAG Link"
-        #$rawOutput = $true
-        $detailApp = $(Get-QlikApp -filter "name eq '$detailsAppName'").id
-        $selectionApp = $(Get-QlikApp -filter "name eq '$selectionAppName'").id
-        $sheetID = $(Invoke-QlikGet "/qrs/app/object" -filter "name eq '$sheet2OpenName' and objectType eq 'sheet'").engineObjectId
-        $data = (@{"name"=$odagLinkName;
-            "templateApp"=$detailApp;
-            "rowEstExpr"=$odagLinkExpression;
-            "properties"=@{
-                "rowEstRange"=@(@{"context"="*";"highBound"=$rowsLimit});
-                "genAppLimit"=@(@{"context"="User_*";"limit"=$appsLimit});
-                "appRetentionTime"=@(@{"context"="User_*";"retentionTime"=$retentionTime});
-                "targetSheet"=@(@{"context"="User_*";"sheetId"=$sheetID})};
-            "selectionApp"=$selectionApp}) | ConvertTo-Json -Compress -Depth 10
-
-        $result = $(Invoke-QlikPost "/api/odag/v1/links" $data)
-        $odagLinkRef = $result.objectDef.id
-
-
-        Write-Log -Message "ODAG link added $odagLinkRef"
-
-        $sheetSelectionID = $(invoke-qlikget "/qrs/app/object" -filter "name eq '$sheetEmbedName' and objectType eq 'sheet'").engineObjectId
-
-
-        # EnigmaJS to attach this link to apps and sheet using APIs
-        C:\OdagEnigma\run.bat $odagLinkRef $odagLinkName $sheetSelectionID $selectionAppName $detailsAppName
-
-        return $odagLinkRef
-    }
-}

archived/vm-fromsnapshot/variables.tf

@@ -1,66 +0,0 @@
-
-variable "prefix" {
-  default = "QMI"
-}
-
-variable "subnet_id" {
-}
-
-variable "location" {
-}
-
-variable "snapshot_id" {
-}
-
-variable "resource_group_name" {
-}
-
-variable "vm_type" {
-  default = "Standard_D4s_v3"
-}
-
-variable "managed_disk_type" {
-  default = "Premium_LRS"
-}
-
-variable "disk_size_gb" {
-  default = "128"
-}
-
-variable "admin_username" {
-  default = "scdemoadmin"
-}
-
-variable "initial_password" {
-}
-
-variable "virtual_machine_name" {
-  default = null
-}
-
-variable "user_id" {
-  default = null
-}
-
-variable "provId" {
-  default = null
-}
-
-variable "is_24x7"{
-  type = bool
-  default = null
-}
-
-variable "shutdownTime"{
-  default = null
-}
-
-variable "startupTime"{
-  default = null
-}
-
-variable "notrename" {
-  default = null
-}
-
-

archived/vm-qs-np/main.tf

@@ -1,154 +0,0 @@
-resource "random_id" "randomMachineId" {
-    keepers = {
-        # Generate a new ID only when a new resource group is defined
-        resource_group = var.resource_group_name
-    }
-    
-    byte_length = 2
-}
-
-resource "random_password" "password" {
-  length = 16
-  special = true
-  override_special = "_!@"
-  upper = true
-  lower = true
-  min_lower = 2
-  min_upper = 2
-  min_special = 2
-}
-
-resource "random_password" "qlikpassword" {
-  length = 16
-  special = true
-  override_special = "_!@"
-  upper = true
-  lower = true
-  min_lower = 2
-  min_upper = 2
-  min_special = 2
-}
-
-locals {
-  virtual_machine_name = "${var.prefix}-${random_id.randomMachineId.hex}"
-  admin_username = var.admin_username
-  admin_password = random_password.password.result
-}
-
-
-data "azurerm_key_vault_secret" "cert-password" {
-  name         = "star-qmi-qlikpoc-com-password"
-  key_vault_id = var.key_vault_id
-}
-
-data "azurerm_key_vault_secret" "sensorsettings" {
-  name         = "carbonblack-sensorsettings"
-  key_vault_id = var.key_vault_id
-}
-
-module "qmi-nic" {
-  source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//qmi-nic"
-  
-  prefix = local.virtual_machine_name
-  location = var.location
-  subnet_id = var.subnet_id
-  
-  resource_group_name = var.resource_group_name
-  user_id = var.user_id
-}
-
-resource "azurerm_virtual_machine" "vm" {
-  name                  = local.virtual_machine_name
-  location              = var.location
-  resource_group_name   = var.resource_group_name
-  network_interface_ids = [module.qmi-nic.id]
-  vm_size               = var.vm_type
-
-  delete_os_disk_on_termination = true
-  delete_data_disks_on_termination = true
-
-  storage_image_reference {
-      id = var.image_reference
-  }
-
-  storage_os_disk {
-    name              = "${local.virtual_machine_name}-osdisk"
-    caching           = "ReadWrite"
-    create_option     = "FromImage"
-    managed_disk_type = var.managed_disk_type
-    disk_size_gb      = var.disk_size_gb
-  }
-
-  os_profile {
-    computer_name  = local.virtual_machine_name
-    admin_username = local.admin_username
-    admin_password = local.admin_password
-  }
-
-  os_profile_windows_config {
-    
-    provision_vm_agent        = true
-    enable_automatic_upgrades = false
-
-    winrm {
-      protocol = "http"
-    }
-  }
-
-  provisioner "file" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = local.admin_username
-      password = local.admin_password
-      port     = 5985
-      https    = false
-      timeout  = "3m"
-    }
-    source      = "${path.module}/scripts"
-    destination = "C:/provision"
-  }
-
-  provisioner "remote-exec" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = "qservice"
-      password = "Qlik1234"
-      port     = 5985
-      https    = false
-      timeout  = "3m"
-    }
-
-    inline = [
-      "powershell.exe -File C:/provision/resethostname.ps1"
-    ]
-  }
-
-  provisioner "remote-exec" {
-    connection {
-      type     = "winrm"
-      host     = module.qmi-nic.private_ip_address
-      user     = "qservice"
-      password = "Qlik1234"
-      port     = 5985
-      https    = false
-      timeout  = "3m"
-    }
-
-    inline = [
-      "powershell.exe -File C:/provision/qs-post-cfg.ps1 -Hostname ${var.resource_group_name}.qmi.qlik-poc.com -CertPwd \"${data.azurerm_key_vault_secret.cert-password.value}\" -QlikUserPwd ${random_password.qlikpassword.result}",
-      "powershell.exe -File C:/provision/np-post.ps1"
-    ]
-  }
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    "ProvId"  = var.provId != null? var.provId : null
-    "QMI_user" = var.user_id != null? var.user_id : null
-    "24x7" = var.is_24x7 == true? "" : null
-    "ShutdownTime": var.is_24x7 == false? var.shutdownTime : null
-    "StartupTime": var.is_24x7 == false? var.startupTime : null
-  }
-}

archived/vm-qs-np/scripts/carbonblack.ps1

@@ -1,16 +0,0 @@
-Param(
-    [string] $SensorSettings
-)
-
-Write-Log -Message "Installing and configuring Carbon Black"
-
-New-Item C:\provision\sensorsettings.ini | Out-Null
-Set-Content C:\provision\sensorsettings.ini $SensorSettings | Out-Null
-(Get-Content C:\provision\sensorsettings.ini) -replace ' ',"`r`n" | Set-Content C:\provision\sensorsettings.ini -Force
-
-C:\provision\CarbonBlackClientSetup.exe /S
-
-Write-Log -Message "Carbon Black is configure!"
-
-
-

archived/vm-qs-np/scripts/np-post.ps1

@@ -1,27 +0,0 @@
-Function restartNPServices
-{
-    write-log -Message "Starting NPrinting Services on $env:COMPUTERNAME"
-
-    Set-Service -Name QlikNPrintingEngine -StartupType Automatic
-    Set-Service -Name QlikNPrintingWebEngine -StartupType Automatic
-    Set-Service -Name QlikNPrintingScheduler -StartupType Automatic
-    Set-Service -Name QlikNPrintingMessagingService  -StartupType Automatic
-    Set-Service -Name QlikNPrintingRepoService  -StartupType Automatic
-    Set-Service -Name QlikNPrintingLicenseService  -StartupType Automatic
-
-    Start-Service -InputObject QlikNPrintingRepoService  -ErrorAction SilentlyContinue
-    Start-Service -InputObject QlikNPrintingMessagingService  -ErrorAction SilentlyContinue
-    Start-Service -InputObject QlikNPrintingWebEngine  -ErrorAction SilentlyContinue
-    Start-Service -InputObject QlikNPrintingEngine  -ErrorAction SilentlyContinue
-    Start-Service -InputObject QlikNPrintingScheduler  -ErrorAction SilentlyContinue
-    Start-Service -InputObject QlikNPrintingLicenseService -ErrorAction SilentlyContinue
-}
-
-Write-Log -Message "Exporting new certificates"
-Export-QlikCertificate -machineNames "localhost" -includeSecretsKey -exportFormat "Windows"
-Export-QlikCertificate -machineNames "localhost" -includeSecretsKey -exportFormat "Pem"
-
-
-Copy-Item "C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\localhost\client.pfx" -Destination "C:\Program Files\NPrintingServer\Settings\SenseCertificates" -Force
-
-restartNPServices

archived/vm-qs-np/scripts/qs-post-cfg.ps1

@@ -1,172 +0,0 @@
-<#
-Module:             qs-post-cfg
-Author:             Clint Carr
-Modified by:        -
-Modification History:
-- Fixed connect as user logic (qlik-cli change)
-- Added logic to accomodate for Professional/Analyzer or User licenses 
-- Added a loop into the Connect-Qlik statement to remove an abort error
-- Added Logging
-- Added comments
-- Error checking
-- Modified service connection for Qlik Sense from endless loop to a set number of attempts.
-- Added a service restart at the end of the Central Node (seems to resolve an issue with April 2018)
-last updated:       10/18/2019
-Intent: Configure the Qlik Sense environment with applications and Security Rules.
-#>
-
-Param(
-    [string] $Hostname,
-    [string] $CertPwd,
-    [string] $QlikUserPwd
-
-)
-
-Import-Module Qlik-Cli
-Import-Module "Carbon"
-
-# Helper Functions
-# ----------------
-function New-Credential($u,$p) {
-    $secpasswd = ConvertTo-SecureString $p -AsPlainText -Force
-    return New-Object System.Management.Automation.PSCredential ($u, $secpasswd)
-}
-
-Write-Log -Message "Creating Qlik account"
-$cred = New-Credential "Qlik" $QlikUserPwd
-Install-CUser -Credential $cred
-
-Write-Log -Message "Starting qs-post-cfg.ps1"
-
-### Waiting for Qlik Sense installation to complete
-#-----------
-Function restartQse
-{
-    Write-Log "Checking Engine Service has started..."
-    $qse = get-service QlikSenseEngineService
-    write-log -Message "The engine is currently $($qse.Status)"
-    if ($qse.Status -eq "Stopped") {
-        Write-Log -Message "Starting Qlik Sense Engine and waiting 120 seconds" -Severity "Warn"; 
-        Start-Service QlikSenseEngineService ; 
-        Restart-Service QlikSenseServiceDispatcher; 
-        start-sleep -s 120
-    }
-    write-log -Message "The engine is currently $($qse.Status)"
-}
-
-Function connQSR
-{
-    $i = 1
-    $statusCode = 0
-    while ($statusCode -ne 200 -and $i -le 10) 
-        { 
-            try {$statusCode = (Invoke-WebRequest https://$($env:COMPUTERNAME)/qps/user -UseBasicParsing).statusCode }
-            catch
-                {
-                    $i++
-                    write-log -Message "QSR on $env:COMPUTERNAME not responding attempt $i of 10..." -Severity "Warn"
-                    start-sleep -s 20 
-                }
-        } 
-}
-
-Function restartServices
-{
-    write-log -Message "Restarting Qlik Sense Services on $env:COMPUTERNAME" -Severity "Warn"
-    Restart-Service QlikSenseRepositoryDatabase -Force
-    Restart-Service QlikLoggingService -Force
-    Restart-Service QlikSenseServiceDispatcher -Force
-    Restart-Service QlikSenseRepositoryService -Force
-    Restart-Service QlikSenseProxyService -Force
-    Restart-Service QlikSenseEngineService -Force
-    Restart-Service QlikSensePrintingService -Force
-    Restart-Service QlikSenseSchedulerService -Force
-}
-
-Function qlikSenseUserAccess
-{
-    $userAccessGroup = (@{name = "License Everyone";} | ConvertTo-Json -Compress -Depth 10)
-    $licenseId = Invoke-QlikPost "/qrs/License/UserAccessGroup" $userAccessGroup
-    $systemRuleJson = (@{
-        name = "Grant Everyone a token";
-        category = "License";
-        rule = '((user.name like "*"))';
-        type = "Custom";
-        resourceFilter = "License.UserAccessGroup_" + $licenseId.id;
-        actions = 1;
-        ruleContext = "QlikSenseOnly";
-        disabled = $false;
-        comment = "Rule to set up automatic user access";} | ConvertTo-Json -Compress -Depth 10)
-    Write-Log -Message "Adding user license rule to grant Everyone Tokens."
-    try {
-        Invoke-QlikPost "/qrs/SystemRule" $systemRuleJson | Out-Null
-    } catch {
-        Write-Log -Message $_.Exception.Message -Severity "Error"
-    }
-}
-
-Function qlikSenseProfessionalAccess
-{
-    $professionalAccessGroup = (@{name = "License Everyone";} | ConvertTo-Json -Compress -Depth 10)
-    $licenseId = Invoke-QlikPost "/qrs/License/ProfessionalAccessGroup" $professionalAccessGroup
-    $systemRuleJson = (@{
-        name = "Grant Everyone Professional Access";
-        category = "License";
-        rule = '((user.name like "*"))';
-        type = "Custom";
-        resourceFilter = "License.ProfessionalAccessGroup_" + $licenseId.id;
-        actions = 1;
-        ruleContext = "QlikSenseOnly";
-        disabled = $false;
-        comment = "Rule to set up automatic user access";} | ConvertTo-Json -Compress -Depth 10)
-    Write-Log -Message "Adding user license rule to grant Everyone access as Professional."
-    try {
-        Invoke-QlikPost "/qrs/SystemRule" $systemRuleJson | Out-Null
-    } catch {
-        Write-Log -Message $_.Exception.Message -Severity "Error"
-    }
-}
-
-#-----------
-write-log -Message "Waiting 1 minute for Qlik Sense installation to complete"
-start-sleep -s 60
-
-    
-### wait for Qlik Sense Proxy service to respond with an HTTP 200 status before proceeding
-connQSR
-$statusCode = (Invoke-WebRequest https://$($env:COMPUTERNAME)/qps/user -UseBasicParsing).statusCode
-if ($statusCode -ne 200)
-    { 
-        Write-Log -Message "Waiting 25 seconds before next pass" -Severity "Warn"
-        restartServices
-        Write-Log -Message "Waiting 45 seconds for Services to ensure they are ready" -Severity "Warn"
-        start-sleep -s 45
-        connQSR
-    }
-
-$statusCode = (Invoke-WebRequest https://$($env:COMPUTERNAME)/qps/user -UseBasicParsing).statusCode
-if ($statusCode -ne 200) { 
-        Write-Log -Message "Provisioning failed" -Severity "Error"
-        Exit 
-}
-Write-Log -Message "Qlik Sense Proxy responding on $env:COMPUTERNAME, status code: $statusCode"
-Write-Log -Message "Connecting to Qlik Sense Repository Service on $env:COMPUTERNAME"
-
-restartQse
-
-### Connect to the Qlik Sense Repository Service with Qlik-Cli
-do {write-log -Message "Connecting to Qlik Sense Repository"; start-sleep 15} 
-While( (Connect-Qlik $($env:COMPUTERNAME) -TrustAllCerts -UseDefaultCredentials -ErrorAction SilentlyContinue).length -eq 0 )
-
-
-### Install qlik-poc_com certificate
-Write-Log -Message "Install qlik-poc_com certificate"
-try {
-    $secpasswd = ConvertTo-SecureString $CertPwd -AsPlainText -Force
-    $sslCert=Import-PfxCertificate -FilePath C:/provision/wildcard_qmi_qlik-poc_com.pfx -CertStoreLocation Cert:\LocalMachine\My -Password $secpasswd
-    Update-QlikProxy -SslBrowserCertificateThumbprint $sslCert.Thumbprint -id (Get-QlikProxy).id | Out-Null
-    Start-Sleep -s 10
-    Update-QlikVirtualProxy -id (Get-QlikVirtualProxy -filter "description eq 'Central Proxy (Default)'").id -websocketCrossOriginWhiteList $Hostname | Out-Null
-} catch {
-    Write-Log -Message $_.Exception.Message -Severity "Error"
-}

archived/vm-qs-np/scripts/resethostname.ps1

@@ -1,97 +0,0 @@
-Write-Log "Resize Partition C to max size"
-$size = Get-PartitionSupportedSize -DriveLetter C
-Resize-Partition -DriveLetter C -Size $size.SizeMax
-
-# Helper Functions
-# ----------------
-function New-Credential($u,$p) {
-    $secpasswd = ConvertTo-SecureString $p -AsPlainText -Force
-    return New-Object System.Management.Automation.PSCredential ($u, $secpasswd)
-}
-$cred = New-Credential "qservice" "Qlik1234"
-#import-module "Carbon"
-
-REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
-
-
-Set-Service -Name "QlikLoggingService" -StartupType Automatic
-Set-Service -Name "QlikSenseServiceDispatcher" -StartupType Automatic
-Set-Service -Name "QlikSenseProxyService" -StartupType Automatic
-Set-Service -Name "QlikSenseEngineService"  -StartupType Automatic
-Set-Service -Name "QlikSensePrintingService"  -StartupType Automatic
-Set-Service -Name "QlikSenseSchedulerService"  -StartupType Automatic
-Set-Service -Name "QlikSenseRepositoryService"  -StartupType Automatic
-Set-Service -Name "QlikSenseRepositoryDatabase"  -StartupType Automatic
-
-
-Write-Log "Starting QlikSenseRepositoryDatabase and QlikSenseServiceDispatcher"
-Start-Service QlikSenseRepositoryDatabase
-Start-Service QlikSenseServiceDispatcher
-
-#Delete certificates
-Write-Log "Deleting old certificates"
-#Get-ChildItem "$($env:ProgramData)\Qlik\Sense\Repository\Exported Certificates\" | Remove-Item -Recurse
-$Certs = Get-ChildItem cert:"CurrentUser\My" | Where-Object { $_.Subject -match 'QlikClient' }
-$Certs | ForEach-Object{Remove-Item -path $_.PSPath -recurse -Force}
-$Certs = Get-ChildItem cert:"LocalMachine\My" | Where-Object { $_.Subject -match 'GEN-QS' -or $_.Subject -match 'QMI-QS' }
-$Certs | ForEach-Object{Remove-Item -path $_.PSPath -recurse -Force}
-$Certs = Get-ChildItem cert:"LocalMachine\Root" | Where-Object { $_.Subject -match 'GEN-QS' -or $_.Subject -match 'QMI-QS' }
-$Certs | ForEach-Object{Remove-Item -path $_.PSPath -recurse -Force}
-
-Write-Log "Setting new hostname to Host.cfg file"
-Write-Log $($env:computername)
-$enchostname = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("$($env:computername)"))
-Set-Content -Path C:\ProgramData\Qlik\Sense\Host.cfg -Value $enchostname
-
-Write-Log "Recreating Qlik Sense certificates"
-# AS if qservice user
-Start-Process powershell.exe -ArgumentList "Start-Process cmd.exe -Verb runAs -ArgumentList '/k C:\PROGRA~1\Qlik\Sense\Repository\Repository.exe -bootstrap -standalone -restorehostname'"
-
-#From PS
-#Start-Process -FilePath "C:\PROGRA~1\Qlik\Sense\Repository\Repository.exe" -ArgumentList "/bootstrap /standalone /restorehostname" -Verb runAs
-
-#qs
-#Start-Process powershell.exe -Credential $cred -ArgumentList "Start-Process cmd.exe -Verb runAs -ArgumentList '/k C:\PROGRA~1\Qlik\Sense\Repository\Repository.exe -bootstrap -standalone -restorehostname'"
-
-$waiting=50
-Write-Log "Waiting $waiting secs ..."
-Start-Sleep -s $waiting
-
-#- Wait 10 seconds
-Write-Log "Restarting Service Dispatcher"
-#- Restart Service Dispacher
-Restart-Service QlikSenseServiceDispatcher -Force
-#- Restart rest of the services
-
-
-Start-Sleep -s 20
-
-Write-Log "New Certs: CurrentUser\My"
-Get-ChildItem cert:"CurrentUser\My"
-Write-Log "New Certs: LocalMachine\My"
-Get-ChildItem cert:"LocalMachine\My"
-Write-Log "New Certs: LocalMachine\Root"
-Get-ChildItem cert:"LocalMachine\Root" | Where-Object { $_.Subject -match 'QMI' }
-$NewCerts = Get-ChildItem cert:"LocalMachine\Root" | Where-Object { $_.Subject -match 'QMI' }
-
-if ($NewCerts) {
-    Write-Log "Restarting all Qlik Sense services"
-    Restart-Service QlikSenseServiceDispatcher -Force
-    Restart-Service QlikLoggingService -Force
-    Restart-Service QlikSenseRepositoryService -Force
-    Restart-Service QlikSenseProxyService -Force
-    Restart-Service QlikSenseEngineService -Force
-    Restart-Service QlikSenseSchedulerService -Force 
-    Restart-Service QlikSensePrintingService -Force 
-
-    Start-Sleep -s 20
-    Write-Log "Recovering Qlik Sense users"
-    Start-Process powershell.exe -ArgumentList "Start-Process cmd.exe -Verb runAs -ArgumentList '/c C:\provision\updatedir.bat'"
-    Restart-Service QlikSenseRepositoryService -Force
-
-} else {
-    Write-Error "Error: Qlik Sense Certs not recreated!"
-    throw "Error: Qlik Sense Certs not recreated!"
-}
-
-REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 5 /f

archived/vm-qs-np/scripts/updatedir.bat

@@ -1,10 +0,0 @@
-@echo off
-set host_name=localhost
-set owner_name=postgres 
-set PGPASSWORD=Qlik1234
-
-C: && cd "C:\Program Files\Qlik\Sense\Repository\PostgreSQL\9.6\bin" && psql -p 4432 -U %owner_name% -d QSR --command "UPDATE public.\"Users\" SET \"UserDirectory\" = '%COMPUTERNAME%', \"RolesString\" = 'RootAdmin' WHERE \"UserDirectory\" != 'INTERNAL';"
-psql -p 4432 -U %owner_name% -d QSR --command "SELECT * FROM public.\"Users\" WHERE \"RolesString\" = 'RootAdmin';"
-
-cd "C:\provision"
-@echo off

compose-install/main.tf

@@ -14,7 +14,8 @@ data "azurerm_key_vault_secret" "cert-password" {
 }
 
 locals {
-  composeLicense = (var.c_version == "c4dw")? data.azurerm_key_vault_secret.c4dw.value : data.azurerm_key_vault_secret.compose-license.value
+  composeLicense = (var.c_version == "c4dw")? nonsensitive(data.azurerm_key_vault_secret.c4dw.value) : nonsensitive(data.azurerm_key_vault_secret.compose-license.value)
+  cert_password = nonsensitive(data.azurerm_key_vault_secret.cert-password.value)
 }
 
 # Install and configure Compose
@@ -50,7 +51,7 @@ resource "null_resource" "install" {
       "powershell.exe -File C:/provision/compose-install/di-compose-getBinary.ps1 -url ${var.download_url}",
       "powershell.exe -File C:/provision/compose-install/di-compose-install.ps1 -url ${var.download_url} -version ${var.c_version}",
       "powershell.exe -File C:/provision/compose-install/di-compose-setlicense.ps1 -composeLicense \"${local.composeLicense}\" -version ${var.c_version}",
-      "powershell.exe -File C:/provision/compose-install/di-compose-installQMICertificate.ps1 -CertPwd \"${data.azurerm_key_vault_secret.cert-password.value}\" -version ${var.c_version}",
+      "powershell.exe -File C:/provision/compose-install/di-compose-installQMICertificate.ps1 -CertPwd \"${local.cert_password}\" -version ${var.c_version}",
     ]
 
   }

databases/aws-kinesis/main.tf

@@ -11,22 +11,6 @@ terraform {
   }
 }
 
-provider "aws" {
-  region  = var.region
-  access_key = var.aws_provider_access_key
-  secret_key = var.aws_provider_access_secret
-}
-
-provider "aws" {
-
-  region     = var.region
-  access_key = var.aws_provider_access_key
-  secret_key = var.aws_provider_access_secret
-
-  alias = "myaws"
-
-}
-
 locals {
   myRegex = "/[^[:alpha:]]/"
   splitLower = split(" ", lower(var.user_id))
@@ -38,10 +22,17 @@ locals {
   
   scnamelower = "${local.container_n1}${local.container_n2}${local.container_n3}"
 
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+    ProvID   = var.provision_id
+    Name     = "qmi-${var.provision_id}"
+  }
+
 }
 
 resource "aws_kinesis_stream" "attrep_apply_exceptions" {
-  provider = aws.myaws
 
   name             = "${local.scnamelower}.attrep_apply_exceptions"
   shard_count      = 1
@@ -50,15 +41,10 @@ resource "aws_kinesis_stream" "attrep_apply_exceptions" {
     stream_mode = "PROVISIONED"
   }*/
 
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
+  tags = local.tags
 }
 
 resource "aws_kinesis_stream" "semployees" {
-  provider = aws.myaws
 
   name             = "${local.scnamelower}.EMPLOYEES"
   shard_count      = 3
@@ -67,15 +53,10 @@ resource "aws_kinesis_stream" "semployees" {
     stream_mode = "PROVISIONED"
   }*/
 
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
+  tags = local.tags
 }
 
 resource "aws_kinesis_stream" "sjobs" {
-  provider = aws.myaws
 
   name             = "${local.scnamelower}.JOBS"
   shard_count      = 3
@@ -84,15 +65,10 @@ resource "aws_kinesis_stream" "sjobs" {
     stream_mode = "PROVISIONED"
   }*/
 
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
+  tags = local.tags
 }
 
 resource "aws_kinesis_stream" "metadata" {
-  provider = aws.myaws
 
   name             = "${local.scnamelower}.metadata"
   shard_count      = 1
@@ -101,19 +77,12 @@ resource "aws_kinesis_stream" "metadata" {
     stream_mode = "PROVISIONED"
   }*/
 
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
+  tags = local.tags
 }
 
 module "iam_user" {
   source  = "terraform-aws-modules/iam/aws//modules/iam-user"
 
-  providers = {
-    aws = aws.myaws
-  }
 
   version = "~> 3.0"
 
@@ -125,18 +94,12 @@ module "iam_user" {
 
   password_reset_required = false
 
-  tags = {
-    Deployment = "QMI"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
+  tags = local.tags
 
 }
 
 resource "aws_iam_user_policy" "kinesis_pol" {
-  
-  provider = aws.myaws
-  
+    
   name = "kinesis_policy_${module.iam_user.this_iam_user_name}"
   user = module.iam_user.this_iam_user_name
 

databases/aws-kinesis/output.tf

@@ -23,5 +23,5 @@ output "iam_access_key" {
 }
 
 output "iam_access_secret" {
-  value = module.iam_user.this_iam_access_key_secret
+  value = nonsensitive(module.iam_user.this_iam_access_key_secret)
 }

databases/aws-kinesis/variables.tf

@@ -1,9 +1,3 @@
-variable "aws_provider_access_key" {
-}
-
-variable "aws_provider_access_secret" {
-}
-
 variable "region" {
   default = "us-east-1"
 }

databases/aws-rds/main.tf

@@ -1,26 +1,15 @@
 terraform {
 
-  required_version = ">= 0.13"
+  required_version = ">= 0.14"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.49.0"
+      version = "3.74.0"
     }
   }
 }
 
-provider "aws" {
-
-  region     = var.region
-  access_key = var.aws_provider_access_key
-  secret_key = var.aws_provider_access_secret
-
-  alias = "myaws"
-
-}
-
-
 locals {
   provid5              = substr(var.provision_id, 0, 5)
   aurora               = (var.engine == "aurora-mysql") ? true : (var.engine == "aurora-postgresql") ? true : false
@@ -33,24 +22,25 @@ locals {
   major_engine_version = (var.engine == "oracle-se2") ? "19" : (var.engine == "postgres") ? "13" : (var.engine == "mysql") ? "8.0" : (var.engine == "aurora-postgresql") ? "12" : (var.engine == "aurora-mysql") ? "5.7" : (var.engine == "sqlserver-ex") ? "15.00" : "10.5"                                                                         #mariaDB
   family               = (var.engine == "oracle-se2") ? "oracle-se2-19" : (var.engine == "postgres") ? "postgres13" : (var.engine == "mysql") ? "mysql8.0" : (var.engine == "aurora-postgresql") ? "aurora-postgresql12" : (var.engine == "aurora-mysql") ? "aurora-mysql5.7" : (var.engine == "sqlserver-ex") ? "sqlserver-ex-15.0" : "mariadb10.5" #mariaDB
   tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
     QMI_user = var.user_id
     ProvID   = var.provision_id
+    Name     = "qmi-${var.provision_id}"
   }
 }
 
 
-module "security_group" {
+module "fw-ips" {
+    source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//databases/firewall_ips"
+}
 
-  count = var.enabled? 1 : 0
+module "security_group" {
   
   # SGs created here as Ports differ per Engine. Only Azure Firewall IPs added for now.
   source  = "terraform-aws-modules/security-group/aws"
   version = "~> 4.3"
 
-  providers = {
-    aws = aws.myaws
-  }
-
   name        = "${var.provision_id}-SG"
   description = "${var.provision_id}-SG"
   vpc_id      = local.vpc_id
@@ -58,45 +48,8 @@ module "security_group" {
 
   # ingress
 
-  ingress_cidr_blocks = [
-    "52.249.189.38/32", 
-    "13.67.39.86/32", 
-    "20.67.110.207/32", 
-    "14.98.59.168/29", 
-    "182.74.33.8/29", 
-    "188.65.156.32/28", 
-    "212.73.252.96/29", 
-    "194.90.96.176/29", 
-    "213.57.84.160/29", 
-    "4.4.97.104/29", 
-    "206.196.17.32/27", 
-    #QCS
-    "18.205.71.36/32", 
-    "18.232.32.199/32", 
-    "34.237.68.254/32", 
-    "34.247.21.179/32", 
-    "52.31.212.214/32", 
-    "54.154.95.18/32", 
-    "13.210.43.241/32", 
-    "13.236.104.42/32", 
-    "13.236.206.172/32",
-    "18.138.163.172/32",
-    "18.142.157.182/32",
-    "54.179.13.251/32",
-    #QAA
-    "54.216.156.88/32",
-    "3.248.156.131/32",
-    "52.213.44.55/32",
-    "18.235.133.252/32",
-    "3.217.244.242/32",
-    "18.214.8.201/32",
-    "54.206.158.27/32",
-    "3.104.137.20/32",
-    "3.24.52.178/32",
-    "54.169.84.213/32",
-    "13.213.173.37/32",
-    "13.213.113.162/32"
-  ]
+  ingress_cidr_blocks = module.fw-ips.cidr_blocks
+  
 
   ingress_with_cidr_blocks = [
     {
@@ -110,45 +63,7 @@ module "security_group" {
 
   # egress
 
-  egress_cidr_blocks = [
-    "52.249.189.38/32", 
-    "13.67.39.86/32", 
-    "20.67.110.207/32", 
-    "14.98.59.168/29", 
-    "182.74.33.8/29", 
-    "188.65.156.32/28", 
-    "212.73.252.96/29", 
-    "194.90.96.176/29", 
-    "213.57.84.160/29", 
-    "4.4.97.104/29", 
-    "206.196.17.32/27", 
-    #QCS
-    "18.205.71.36/32", 
-    "18.232.32.199/32", 
-    "34.237.68.254/32", 
-    "34.247.21.179/32", 
-    "52.31.212.214/32", 
-    "54.154.95.18/32", 
-    "13.210.43.241/32", 
-    "13.236.104.42/32", 
-    "13.236.206.172/32",
-    "18.138.163.172/32",
-    "18.142.157.182/32",
-    "54.179.13.251/32",
-    #QAA
-    "54.216.156.88/32",
-    "3.248.156.131/32",
-    "52.213.44.55/32",
-    "18.235.133.252/32",
-    "3.217.244.242/32",
-    "18.214.8.201/32",
-    "54.206.158.27/32",
-    "3.104.137.20/32",
-    "3.24.52.178/32",
-    "54.169.84.213/32",
-    "13.213.173.37/32",
-    "13.213.113.162/32"
-  ]
+  egress_cidr_blocks = module.fw-ips.cidr_blocks
 
   egress_with_cidr_blocks = [
     {
@@ -167,11 +82,7 @@ module "common_rds_instance" {
   source  = "terraform-aws-modules/rds/aws"
   version = "~> 3.3"
 
-  count = local.aurora? 0 : var.enabled? 1 : 0
-
-  providers = {
-    aws = aws.myaws
-  }
+  count = local.aurora? 0 : 1
 
   identifier = "${var.engine}${var.provision_id}"
 
@@ -192,7 +103,7 @@ module "common_rds_instance" {
 
   multi_az               = false
   subnet_ids             = local.subnet_ids
-  vpc_security_group_ids = [module.security_group[0].security_group_id]
+  vpc_security_group_ids = [module.security_group.security_group_id]
   publicly_accessible    = true
 
   maintenance_window = "Mon:00:00-Mon:03:00"
@@ -210,11 +121,7 @@ module "aurora_rds_instance" {
   source  = "terraform-aws-modules/rds-aurora/aws"
   version = "~> 5.2"
 
-  count = (local.aurora && var.enabled)? 1 : 0
-
-  providers = {
-    aws = aws.myaws
-  }
+  count = local.aurora? 1 : 0
 
   name           = local.name
   engine         = var.engine
@@ -224,7 +131,7 @@ module "aurora_rds_instance" {
   vpc_id                 = local.vpc_id
   subnets                = local.subnet_ids
   create_security_group  = false
-  vpc_security_group_ids = [module.security_group[0].security_group_id]
+  vpc_security_group_ids = [module.security_group.security_group_id]
   port                   = local.port
   publicly_accessible    = true
 

databases/aws-rds/output.tf

@@ -1,25 +1,23 @@
  output "db_username" {
   description = "The master username for the database"
-  value       = (local.aurora && var.enabled)? module.aurora_rds_instance[0].rds_cluster_master_username : var.enabled? module.common_rds_instance[0].db_instance_username : null
-  sensitive   = true
+  value       = (local.aurora)? nonsensitive(module.aurora_rds_instance[0].rds_cluster_master_username) : nonsensitive(module.common_rds_instance[0].db_instance_username)
 } 
 
  output "db_instance_password" {
   description = "The database password (this password may be old, because Terraform doesn't track it after initial creation)"
-  value       = (local.aurora && var.enabled)? module.aurora_rds_instance[0].rds_cluster_master_password : var.enabled? module.common_rds_instance[0].db_instance_password : null
-  sensitive   = true
+  value       = (local.aurora)? nonsensitive(module.aurora_rds_instance[0].rds_cluster_master_password) : nonsensitive(module.common_rds_instance[0].db_instance_password)
 }
 
  output "db_instance_port" {
   description = "The database port"
-  value       = (local.aurora && var.enabled)? module.aurora_rds_instance[0].rds_cluster_port : var.enabled? module.common_rds_instance[0].db_instance_port : null
+  value       = (local.aurora)? module.aurora_rds_instance[0].rds_cluster_port : module.common_rds_instance[0].db_instance_port
 }
 
 output "db_instance_endpoint" {
   description = "The connection endpoint"
-  value       = (local.aurora && var.enabled)? module.aurora_rds_instance[0].rds_cluster_endpoint : var.enabled? module.common_rds_instance[0].db_instance_endpoint : null
+  value       = (local.aurora)? module.aurora_rds_instance[0].rds_cluster_endpoint : module.common_rds_instance[0].db_instance_endpoint
 }
 
 output "db_instance_name" {
-  value       = (var.enabled)? local.name : null
+  value       = local.name
 }

databases/aws-rds/variables.tf

@@ -1,9 +1,3 @@
-variable "aws_provider_access_key" {
-}
-
-variable "aws_provider_access_secret" {
-}
-
 variable "region" {
   default = "us-east-1"
 }
@@ -66,7 +60,3 @@ variable "instance_size" {
 variable "storage" {
   default = "20"
 }
-
-variable "enabled" {
-    default = true
-}

databases/aws-redshift/main.tf

@@ -1,6 +1,6 @@
 terraform {
 
-  required_version = ">= 0.13"
+  required_version = ">= 0.14"
 
   required_providers {
     aws = {
@@ -10,16 +10,6 @@ terraform {
   }
 }
 
-provider "aws" {
-
-  region     = var.region
-  access_key = var.aws_provider_access_key
-  secret_key = var.aws_provider_access_secret
-
-  alias = "myaws"
-
-}
-
 resource "random_password" "password" {
   length = 16
   special = true
@@ -39,20 +29,23 @@ locals {
   subnet_ids           = (var.region == "eu-west-1") ? var.subnet_ids_eu : (var.region == "us-east-1") ? var.subnet_ids_us : var.subnet_ids_ap
   port                 = "5439"
   tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
     QMI_user = var.user_id
     ProvID   = var.provision_id
+    Name     = "qmi-${var.provision_id}"
   }
 }
 
+module "fw-ips" {
+    source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//databases/firewall_ips"
+}
+
 module "security_group" {
   # SGs created here as Ports differ per Engine. Only Azure Firewall IPs added for now.
   source  = "terraform-aws-modules/security-group/aws"
   version = "~> 4.3"
 
-  providers = {
-    aws = aws.myaws
-  }
-
   name        = "${var.provision_id}-SG"
   description = "${var.provision_id}-SG"
   vpc_id      = local.vpc_id
@@ -60,45 +53,7 @@ module "security_group" {
 
   # ingress
 
-  ingress_cidr_blocks = [
-    "52.249.189.38/32", 
-    "13.67.39.86/32", 
-    "20.67.110.207/32", 
-    "14.98.59.168/29", 
-    "182.74.33.8/29", 
-    "188.65.156.32/28", 
-    "212.73.252.96/29", 
-    "194.90.96.176/29", 
-    "213.57.84.160/29", 
-    "4.4.97.104/29", 
-    "206.196.17.32/27", 
-    #QCS
-    "18.205.71.36/32", 
-    "18.232.32.199/32", 
-    "34.237.68.254/32", 
-    "34.247.21.179/32", 
-    "52.31.212.214/32", 
-    "54.154.95.18/32", 
-    "13.210.43.241/32", 
-    "13.236.104.42/32", 
-    "13.236.206.172/32",
-    "18.138.163.172/32",
-    "18.142.157.182/32",
-    "54.179.13.251/32",
-    #QAA
-    "54.216.156.88/32",
-    "3.248.156.131/32",
-    "52.213.44.55/32",
-    "18.235.133.252/32",
-    "3.217.244.242/32",
-    "18.214.8.201/32",
-    "54.206.158.27/32",
-    "3.104.137.20/32",
-    "3.24.52.178/32",
-    "54.169.84.213/32",
-    "13.213.173.37/32",
-    "13.213.113.162/32"
-  ]
+  ingress_cidr_blocks = module.fw-ips.cidr_blocks
 
   ingress_with_cidr_blocks = [
     {
@@ -112,45 +67,7 @@ module "security_group" {
 
   # egress
 
-  egress_cidr_blocks = [
-    "52.249.189.38/32", 
-    "13.67.39.86/32", 
-    "20.67.110.207/32", 
-    "14.98.59.168/29", 
-    "182.74.33.8/29", 
-    "188.65.156.32/28", 
-    "212.73.252.96/29", 
-    "194.90.96.176/29", 
-    "213.57.84.160/29", 
-    "4.4.97.104/29", 
-    "206.196.17.32/27", 
-    #QCS
-    "18.205.71.36/32", 
-    "18.232.32.199/32", 
-    "34.237.68.254/32", 
-    "34.247.21.179/32", 
-    "52.31.212.214/32", 
-    "54.154.95.18/32", 
-    "13.210.43.241/32", 
-    "13.236.104.42/32", 
-    "13.236.206.172/32",
-    "18.138.163.172/32",
-    "18.142.157.182/32",
-    "54.179.13.251/32",
-    #QAA
-    "54.216.156.88/32",
-    "3.248.156.131/32",
-    "52.213.44.55/32",
-    "18.235.133.252/32",
-    "3.217.244.242/32",
-    "18.214.8.201/32",
-    "54.206.158.27/32",
-    "3.104.137.20/32",
-    "3.24.52.178/32",
-    "54.169.84.213/32",
-    "13.213.173.37/32",
-    "13.213.113.162/32"
-  ]
+  egress_cidr_blocks = module.fw-ips.cidr_blocks
 
   
   egress_with_cidr_blocks = [
@@ -168,10 +85,6 @@ module "security_group" {
 
 module "redshift" {
 
-  providers = {
-    aws = aws.myaws
-  }
-
   source  = "terraform-aws-modules/redshift/aws"
   version = "~> 3.0"
 
@@ -199,11 +112,10 @@ module "redshift" {
 }
 
 module "qmi-s3-bucket" {
+
   source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//s3-bucket"
   
   provision_id                  = var.provision_id
   region                        = var.region
-  aws_provider_access_key       = var.aws_provider_access_key
-  aws_provider_access_secret    = var.aws_provider_access_secret
   user_id                       = var.user_id
 }

databases/aws-redshift/outputs.tf

@@ -27,7 +27,7 @@ output "redshift_cluster_master_username" {
 }
 
 output "redshift_cluster_master_password" {
-    value = random_password.password.result
+    value = nonsensitive(random_password.password.result)
 }
 
 output "s3_bucket_name" {

databases/aws-redshift/variables.tf

@@ -1,9 +1,3 @@
-variable "aws_provider_access_key" {
-}
-
-variable "aws_provider_access_secret" {
-}
-
 variable "region" {
   default = "us-east-1"
 }

databases/azure-eventhub/outputs.tf

@@ -1,9 +1,9 @@
 output "default_primary_connection_string" {
-  value = azurerm_eventhub_namespace.ehbnamespace.default_primary_connection_string
+  value = nonsensitive(azurerm_eventhub_namespace.ehbnamespace.default_primary_connection_string)
 }
 
 output "default_primary_key" {
-  value = azurerm_eventhub_namespace.ehbnamespace.default_primary_key
+  value = nonsensitive(azurerm_eventhub_namespace.ehbnamespace.default_primary_key)
 }
 
 output "namespace_name" {

databases/azure-rds-flexmysql/firewall.tf

@@ -0,0 +1,31 @@
+/*resource "azurerm_mysql_flexible_server_firewall_rule" "all-azure-services" {
+  name                = "AllAzureServices"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_flexible_server.mysql-server.name
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "0.0.0.0"
+}*/
+
+resource "azurerm_mysql_flexible_server_firewall_rule" "fw-a-rule1" {
+  name                = "a1"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_flexible_server.mysql-server.name
+  start_ip_address    = "52.249.189.38"
+  end_ip_address      = "52.249.189.38"
+}
+
+resource "azurerm_mysql_flexible_server_firewall_rule" "fw-a-rule2" {
+  name                = "a2"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_flexible_server.mysql-server.name
+  start_ip_address    = "13.67.39.86"
+  end_ip_address      = "13.67.39.86"
+}
+
+resource "azurerm_mysql_flexible_server_firewall_rule" "fw-a-rule3" {
+  name                = "a3"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_flexible_server.mysql-server.name
+  start_ip_address    = "20.67.110.207"
+  end_ip_address      = "20.67.110.207"
+}

databases/azure-rds-flexmysql/main.tf

@@ -0,0 +1,52 @@
+resource "random_password" "password" {
+  length = 16
+  special = true
+  override_special = "_!@"
+  upper = true
+  lower = true
+  min_numeric = 2
+  min_lower = 2
+  min_upper = 2
+  min_special = 2
+}
+
+resource "azurerm_mysql_flexible_server" "mysql-server" {
+  name = "qmi-mysql-${var.provision_id}"
+  location = var.location
+  resource_group_name = var.resource_group_name
+ 
+  administrator_login = var.admin_login
+  administrator_password = random_password.password.result
+
+  storage {
+    size_gb = var.mysql-storage
+  }
+
+  backup_retention_days  = 7
+  sku_name = var.mysql-sku-name
+  version = var.mysql-version
+
+  geo_redundant_backup_enabled = false
+  //public_network_access_enabled = true
+
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+  }
+}
+
+resource "azurerm_mysql_flexible_database" "example" {
+  name                = "QlikDB"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_flexible_server.mysql-server.name
+  charset             = "utf8"
+  collation           = "utf8_unicode_ci"
+}
+
+resource "azurerm_mysql_flexible_server_configuration" "example" {
+  name                = "binlog_row_image"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_flexible_server.mysql-server.name
+  value               = "full"
+}

databases/azure-rds-flexmysql/output.tf

@@ -0,0 +1,11 @@
+output "db_server_fqdn" {
+  value = azurerm_mysql_flexible_server.mysql-server.fqdn
+}
+
+output "root_username" {
+  value = var.admin_login
+}
+
+output "root_username_password" {
+  value = nonsensitive(random_password.password.result)
+}

databases/azure-rds-flexmysql/variables.tf

@@ -0,0 +1,39 @@
+variable "resource_group_name" {
+
+}
+
+variable "provision_id" {
+  type = string
+  description = "(optional) describe your variable"
+}
+
+variable "location" {
+  type = string
+  description = "(optional) describe your variable"
+  default = "EAST US"
+}
+
+variable "user_id" {
+}
+
+variable "admin_login" {
+  type = string
+  description = "Login to authenticate to MySQL Server"
+  default = "qmi"
+}
+
+variable "mysql-version" {
+  type = string
+  description = "MySQL Server version to deploy"
+  default = "5.7"
+}
+variable "mysql-sku-name" {
+  type = string
+  description = "MySQL SKU Name"
+  default = "GP_Standard_D2ds_v4"
+}
+variable "mysql-storage" {
+  type = string
+  description = "MySQL Storage in MB"
+  default = "20"
+  }

databases/azure-rds-flexpostgres/firewall.tf

@@ -0,0 +1,28 @@
+/*resource "azurerm_postgresql_flexible_server_firewall_rule" "all-azure-services" {
+  name                = "AllAzureServices"
+  server_id = azurerm_postgresql_flexible_server.postgresql-server.id
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "0.0.0.0"
+}*/
+
+
+resource "azurerm_postgresql_flexible_server_firewall_rule" "fw-a-rule1" {
+  name                = "a1"
+  server_id = azurerm_postgresql_flexible_server.postgresql-server.id
+  start_ip_address    = "52.249.189.38"
+  end_ip_address      = "52.249.189.38"
+}
+
+resource "azurerm_postgresql_flexible_server_firewall_rule" "fw-a-rule2" {
+  name                = "a2"
+  server_id = azurerm_postgresql_flexible_server.postgresql-server.id
+  start_ip_address    = "13.67.39.86"
+  end_ip_address      = "13.67.39.86"
+}
+
+resource "azurerm_postgresql_flexible_server_firewall_rule" "fw-a-rule3" {
+  name                = "a3"
+  server_id = azurerm_postgresql_flexible_server.postgresql-server.id
+  start_ip_address    = "20.67.110.207"
+  end_ip_address      = "20.67.110.207"
+}

databases/azure-rds-flexpostgres/main.tf

@@ -0,0 +1,53 @@
+resource "random_password" "password" {
+  length = 16
+  special = true
+  override_special = "_!@"
+  upper = true
+  lower = true
+  min_numeric = 2
+  min_lower = 2
+  min_upper = 2
+  min_special = 2
+}
+
+resource "azurerm_postgresql_flexible_server" "postgresql-server" {
+  name = "qmi-postgresql-${var.provision_id}"
+  location = var.location
+  resource_group_name = var.resource_group_name
+
+  version                = var.postgresql-version
+ 
+  administrator_login    = var.admin_login
+  administrator_password = random_password.password.result
+
+  storage_mb = var.postgresql-storage
+  sku_name   = var.postgresql-sku-name
+
+  geo_redundant_backup_enabled = false
+
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+  }
+
+}
+
+resource "azurerm_postgresql_flexible_server_configuration" "conf1" {
+  name      = "wal_level"
+  server_id = azurerm_postgresql_flexible_server.postgresql-server.id
+  value     = "logical"
+}
+
+resource "azurerm_postgresql_flexible_server_configuration" "conf2" {
+  name      = "log_statement"
+  server_id = azurerm_postgresql_flexible_server.postgresql-server.id
+  value     = "all"
+}
+
+resource "azurerm_postgresql_flexible_server_database" "postgresql-db" {
+  name      = "QlikPostgresqlDB"
+  server_id = azurerm_postgresql_flexible_server.postgresql-server.id
+  collation = "en_US.utf8"
+  charset   = "utf8"
+}

databases/azure-rds-flexpostgres/output.tf

@@ -0,0 +1,11 @@
+output "db_server_fqdn" {
+  value = azurerm_postgresql_flexible_server.postgresql-server.fqdn
+}
+
+output "root_username" {
+  value = var.admin_login
+}
+
+output "root_username_password" {
+  value = nonsensitive(random_password.password.result)
+}

databases/azure-rds-flexpostgres/variables.tf

@@ -0,0 +1,41 @@
+variable "resource_group_name" {
+
+}
+
+variable "provision_id" {
+  type = string
+  description = "(optional) describe your variable"
+}
+
+variable "location" {
+  type = string
+  description = "(optional) describe your variable"
+  default = "EAST US"
+}
+
+
+variable "admin_login" {
+  type = string
+  description = "Login to authenticate to PostgreSQL Server"
+  default = "qmi"
+}
+
+variable "postgresql-version" {
+  type        = string
+  description = "PostgreSQL Server version to deploy"
+  default     = "12"
+}
+variable "postgresql-sku-name" {
+  type        = string
+  description = "PostgreSQL SKU Name"
+  default     = "GP_Standard_D2s_v3"
+}
+variable "postgresql-storage" {
+  type        = string
+  description = "PostgreSQL Storage in MB"
+  default     = "32768"
+}
+
+variable "user_id" {
+
+}

databases/azure-rds-mariadb/firewall.tf

@@ -0,0 +1,26 @@
+resource "azurerm_mariadb_virtual_network_rule" "vnetrule" {
+
+  count = var.subnet_id != null? 1 : 0
+
+  name                = "vnet-rule-${var.provision_id}"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mariadb_server.mariadb-server.name
+  subnet_id           = var.subnet_id
+
+}
+
+module "fw-ips" {
+    source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//databases/firewall_ips"
+}
+
+
+resource "azurerm_mariadb_firewall_rule" "fw_rule" {
+  for_each = module.fw-ips.ips
+
+  name                = each.key
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mariadb_server.mariadb-server.name
+  start_ip_address    = each.value.0
+  end_ip_address      = each.value.1
+
+}

databases/azure-rds-mariadb/main.tf

@@ -0,0 +1,47 @@
+resource "random_password" "password" {
+  length = 16
+  special = true
+  override_special = "_!@"
+  upper = true
+  lower = true
+  min_numeric = 2
+  min_lower = 2
+  min_upper = 2
+  min_special = 2
+}
+
+
+resource "azurerm_mariadb_server" "mariadb-server" {
+  name = "qmi-mariadb-${var.provision_id}"
+  location = var.location
+  resource_group_name = var.resource_group_name
+
+  administrator_login = var.admin_login
+  administrator_login_password = random_password.password.result
+
+  sku_name = var.sku-name
+  version = var.db-version
+ 
+  storage_mb = var.storage
+  auto_grow_enabled = true
+
+  
+  backup_retention_days         = 7
+  geo_redundant_backup_enabled  = false
+  public_network_access_enabled = true
+  ssl_enforcement_enabled       = false
+
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+  }
+}
+
+resource "azurerm_mariadb_database" "mariadb-db" {
+  name                = "QlikDB"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mariadb_server.mariadb-server.name
+  charset             = "utf8"
+  collation           = "utf8_unicode_ci"
+}

databases/azure-rds-mariadb/output.tf

@@ -0,0 +1,11 @@
+output "db_server_fqdn" {
+  value = azurerm_mariadb_server.mariadb-server.fqdn
+}
+
+output "root_username" {
+  value = "${var.admin_login}@qmi-mariadb-${var.provision_id}"
+}
+
+output "root_username_password" {
+  value = nonsensitive(random_password.password.result)
+}

databases/azure-rds-mariadb/variables.tf

@@ -0,0 +1,43 @@
+variable "resource_group_name" {
+
+}
+
+variable "provision_id" {
+  type = string
+  description = "(optional) describe your variable"
+}
+
+variable "location" {
+  type = string
+  description = "(optional) describe your variable"
+  default = "EAST US"
+}
+
+variable "subnet_id" {
+  default = null
+}
+
+variable "user_id" {
+}
+
+variable "admin_login" {
+  type = string
+  description = "Login to authenticate to MySQL Server"
+  default = "qmi"
+}
+
+variable "db-version" {
+  type = string
+  description = "MariaDB Server version to deploy"
+  default = "10.2"
+}
+variable "sku-name" {
+  type = string
+  description = "MariaDB SKU Name"
+  default = "GP_Gen5_2"
+}
+variable "storage" {
+  type = string
+  description = "MariaDB Storage in MB"
+  default = "5120"
+  }

databases/azure-rds-mssql/firewall.tf

@@ -0,0 +1,24 @@
+
+resource "azurerm_mssql_virtual_network_rule" "sqlvnetrule" {
+
+  count = var.subnet_id != null? 1 : 0
+  
+  name                = "vnet-rule-${local.provision_id}"
+  server_id           = azurerm_mssql_server.sqlserver.id
+  subnet_id           = var.subnet_id
+}
+
+module "fw-ips" {
+    source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//databases/firewall_ips"
+}
+
+
+resource "azurerm_mssql_firewall_rule" "fw_rule" {
+  for_each = module.fw-ips.ips
+
+  name                = each.key
+  server_id           = azurerm_mssql_server.sqlserver.id
+  start_ip_address    = each.value.0
+  end_ip_address      = each.value.1
+
+}

databases/azure-rds-mssql/main.tf

@@ -0,0 +1,82 @@
+resource "random_id" "randomServerId" {
+    keepers = {
+        # Generate a new ID only when a new resource group is defined
+        resource_group = var.resource_group_name
+    }
+    
+    byte_length = 2
+}
+
+resource "random_password" "password" {
+  length = 16
+  special = true
+  override_special = "_!@"
+  upper = true
+  lower = true
+  min_numeric = 2
+  min_lower = 2
+  min_upper = 2
+  min_special = 2
+}
+
+locals {
+  sql_administrator_login_password = var.sql_administrator_login_password != null? var.sql_administrator_login_password : random_password.password.result
+  provision_id = var.provision_id != null? var.provision_id : random_id.randomServerId.hex
+}
+
+resource "azurerm_mssql_server" "sqlserver" {
+ name                         = "sqlserver-${local.provision_id}"
+  resource_group_name          = var.resource_group_name
+  location                     = var.location
+  version                      = "12.0"
+  administrator_login          = var.sql_administrator_login
+  administrator_login_password = local.sql_administrator_login_password
+  minimum_tls_version          = "1.2"
+
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+  }
+
+  identity {
+    type = "SystemAssigned"
+  }
+}
+
+resource "azurerm_mssql_database" "db" {
+  name           = "demoDB"
+  server_id      = azurerm_mssql_server.sqlserver.id
+  create_mode    = "Default"
+ 
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+  }
+}
+
+# FOR QDI scenario
+resource "azurerm_mssql_database" "dbname_source" {
+  name           = "source"
+  server_id      = azurerm_mssql_server.sqlserver.id
+  create_mode    = "Default"
+ 
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+  }
+}
+
+resource "azurerm_mssql_database" "dbname_target" {
+  name           = "target"
+  server_id      = azurerm_mssql_server.sqlserver.id
+  create_mode    = "Default"
+ 
+  tags = {
+    Deployment = "QMI PoC"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+  }
+}

databases/azure-rds-mssql/outputs.tf

@@ -0,0 +1,29 @@
+output "sqlserver_id" {
+    value = azurerm_mssql_server.sqlserver.id
+}
+
+output "sqlserver_name" {
+    value = azurerm_mssql_server.sqlserver.name
+}
+
+output "sqlserver_fully_qualified_domain_name" {
+    value = azurerm_mssql_server.sqlserver.fully_qualified_domain_name
+}
+
+output "dbname" {
+    value = azurerm_mssql_database.db.name
+}
+
+output "administrator_login" {
+    value = var.sql_administrator_login
+}
+
+output "administrator_login_password" {
+    value = nonsensitive(local.sql_administrator_login_password)
+}
+
+output "principal_id" {
+  value = azurerm_mssql_server.sqlserver.identity.0.principal_id
+}
+
+

databases/azure-rds-mssql/variables.tf

@@ -10,7 +10,7 @@ variable "provision_id" {
 }
 
 variable "subnet_id" {
-
+    default = null
 }
 
 variable "user_id" {

databases/azure-rds-mysql/firewall.tf

@@ -0,0 +1,26 @@
+resource "azurerm_mysql_virtual_network_rule" "vnetrule" {
+
+  count = var.subnet_id != null? 1 : 0
+
+  name                = "vnet-rule-${var.provision_id}"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_server.mysql-server.name
+  subnet_id           = var.subnet_id
+
+}
+
+module "fw-ips" {
+    source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//databases/firewall_ips"
+}
+
+
+resource "azurerm_mysql_firewall_rule" "fw_rule" {
+  for_each = module.fw-ips.ips
+
+  name                = each.key
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_mysql_server.mysql-server.name
+  start_ip_address    = each.value.0
+  end_ip_address      = each.value.1
+
+}

databases/azure-rds-mysql/main.tf

@@ -15,6 +15,7 @@ resource "random_password" "password" {
   override_special = "_!@"
   upper = true
   lower = true
+  min_numeric = 2
   min_lower = 2
   min_upper = 2
   min_special = 2
@@ -38,6 +39,7 @@ resource "azurerm_mysql_server" "mysql-server" {
   geo_redundant_backup_enabled = false
   public_network_access_enabled = true
   ssl_enforcement_enabled = false
+  ssl_minimal_tls_version_enforced  = "TLSEnforcementDisabled"
 
   tags = {
     Deployment = "QMI PoC"
@@ -53,241 +55,4 @@ resource "azurerm_mysql_database" "mysql-db" {
   server_name         = azurerm_mysql_server.mysql-server.name
   charset             = "utf8"
   collation           = "utf8_unicode_ci"
-}
-
-resource "azurerm_mysql_firewall_rule" "all-azure-services" {
-  name                = "AllAzureServices"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "0.0.0.0"
-  end_ip_address      = "0.0.0.0"
-}
-
-resource "azurerm_mysql_firewall_rule" "mysql-fw-ITG-rule1" {
-  name                = "ITG"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "188.65.156.32"
-  end_ip_address      = "188.65.156.47"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-ITG-rule2" {
-  name                = "ITG1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "212.73.252.96"
-  end_ip_address      = "212.73.252.103"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-kfar_saba-rule1" {
-  name                = "Kfar_Saba"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "194.90.96.176"
-  end_ip_address      = "194.90.96.183"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-kfar_saba-rule2" {
-  name                = "Kfar_Saba1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "213.57.84.160"
-  end_ip_address      = "213.57.84.167"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-Peak_10-rule1" {
-  name                = "Peak_10"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "4.4.97.104"
-  end_ip_address      = "4.4.97.111"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-Peak_10-rule2" {
-  name                = "Peak_101"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "206.196.17.32"
-  end_ip_address      = "206.196.17.63"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-Bangalore-rule1" {
-  name                = "Bangalore"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "14.98.59.168"
-  end_ip_address      = "14.98.59.175"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-Bangalore-rule2" {
-  name                = "Bangalore1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "182.74.33.8"
-  end_ip_address      = "182.74.33.15"
-}
-
-# QCS
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSUS1" {
-  name                = "QCSUS1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "18.205.71.36"
-  end_ip_address      = "18.205.71.36"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSUS2" {
-  name                = "QCSUS2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "18.232.32.199"
-  end_ip_address      = "18.232.32.199"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSUS3" {
-  name                = "QCSUS3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "34.237.68.254"
-  end_ip_address      = "34.237.68.254"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSEU1" {
-  name                = "QCSEU1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "34.247.21.179"
-  end_ip_address      = "34.247.21.179"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSEU2" {
-  name                = "QCSEU2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "52.31.212.214"
-  end_ip_address      = "52.31.212.214"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCS3" {
-  name                = "QCSEU3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "54.154.95.18"
-  end_ip_address      = "54.154.95.18"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSAPAC1" {
-  name                = "QCSAPAC1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "13.210.43.241"
-  end_ip_address      = "13.210.43.241"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSAPAC2" {
-  name                = "QCSAPAC2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "13.236.104.42"
-  end_ip_address      = "13.236.104.42"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSAPAC3" {
-  name                = "QCSAPAC3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "13.236.206.172"
-  end_ip_address      = "13.236.206.172"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSSingapore1" {
-  name                = "QCSSingapore1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "18.138.163.172"
-  end_ip_address      = "18.138.163.172"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSSingapore2" {
-  name                = "QCSSingapore2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "18.142.157.182"
-  end_ip_address      = "18.142.157.182"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QCSSingapore3" {
-  name                = "QCSSingapore3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "54.179.13.251"
-  end_ip_address      = "54.179.13.251"
-}
-
-# QAA
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAeu1" {
-  name                = "QAAeu1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "54.216.156.88"
-  end_ip_address      = "54.216.156.88"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAeu2" {
-  name                = "QAAeu2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "3.248.156.131"
-  end_ip_address      = "3.248.156.131"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAeu3" {
-  name                = "QAAeu3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "52.213.44.55"
-  end_ip_address      = "52.213.44.55"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAus1" {
-  name                = "QAAus1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "18.235.133.252"
-  end_ip_address      = "18.235.133.252"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAus2" {
-  name                = "QAAus2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "3.217.244.242"
-  end_ip_address      = "3.217.244.242"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAus3" {
-  name                = "QAAus3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "18.214.8.201"
-  end_ip_address      = "18.214.8.201"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAapac1" {
-  name                = "QAAapac1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "54.206.158.27"
-  end_ip_address      = "54.206.158.27"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAapac2" {
-  name                = "QAAapac2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "3.104.137.20"
-  end_ip_address      = "3.104.137.20"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAapac3" {
-  name                = "QAAapac3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "3.24.52.178"
-  end_ip_address      = "3.24.52.178"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAsing1" {
-  name                = "QAAsing1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "54.169.84.213"
-  end_ip_address      = "54.169.84.213"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAsing2" {
-  name                = "QAAsing2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "13.213.173.37"
-  end_ip_address      = "13.213.173.37"
-}
-resource "azurerm_mysql_firewall_rule" "mysql-fw-QAAsing3" {
-  name                = "QAAsing3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_mysql_server.mysql-server.name
-  start_ip_address    = "13.213.113.162"
-  end_ip_address      = "13.213.113.162"
 }

databases/azure-rds-mysql/output.tf

@@ -7,5 +7,5 @@ output "root_username" {
 }
 
 output "root_username_password" {
-  value = random_password.password.result
+  value = nonsensitive(random_password.password.result)
 }

databases/azure-rds-mysql/variables.tf

@@ -13,6 +13,10 @@ variable "location" {
   default = "EAST US"
 }
 
+variable "subnet_id" {
+  default = null
+}
+
 variable "user_id" {
 }
 

databases/azure-rds-postgres/firewall.tf

@@ -0,0 +1,25 @@
+resource "azurerm_postgresql_virtual_network_rule" "vnetrule" {
+
+  count = var.subnet_id != null? 1 : 0
+
+  name                = "vnet-rule-${var.provision_id}"
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_postgresql_server.postgresql-server.name
+  subnet_id           = var.subnet_id
+}
+
+module "fw-ips" {
+    source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//databases/firewall_ips"
+}
+
+
+resource "azurerm_postgresql_firewall_rule" "fw_rule" {
+  for_each = module.fw-ips.ips
+
+  name                = each.key
+  resource_group_name = var.resource_group_name
+  server_name         = azurerm_postgresql_server.postgresql-server.name
+  start_ip_address    = each.value.0
+  end_ip_address      = each.value.1
+
+}

databases/azure-rds-postgres/main.tf

@@ -4,6 +4,7 @@ resource "random_password" "password" {
   override_special = "_!@"
   upper = true
   lower = true
+  min_numeric = 2
   min_lower = 2
   min_upper = 2
   min_special = 2
@@ -28,6 +29,7 @@ resource "azurerm_postgresql_server" "postgresql-server" {
   geo_redundant_backup_enabled = false
   public_network_access_enabled     = true
   ssl_enforcement_enabled           = false
+  ssl_minimal_tls_version_enforced  = "TLSEnforcementDisabled"
 
     tags = {
     Deployment = "QMI PoC"
@@ -44,242 +46,4 @@ resource "azurerm_postgresql_database" "postgresql-db" {
   server_name         = azurerm_postgresql_server.postgresql-server.name
   charset             = "utf8"
   collation           = "English_United States.1252"
-}
-
-
-resource "azurerm_postgresql_firewall_rule" "all-azure-services" {
-  name                = "AllAzureServices"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "0.0.0.0"
-  end_ip_address      = "0.0.0.0"
-}
-
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-ITG-rule1" {
-  name                = "ITG"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "188.65.156.32"
-  end_ip_address      = "188.65.156.47"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-ITG-rule2" {
-  name                = "ITG1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "212.73.252.96"
-  end_ip_address      = "212.73.252.103"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-kfar_saba-rule1" {
-  name                = "Kfar_Saba"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "194.90.96.176"
-  end_ip_address      = "194.90.96.183"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-kfar_saba-rule2" {
-  name                = "Kfar_Saba1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "213.57.84.160"
-  end_ip_address      = "213.57.84.167"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-Peak_10-rule1" {
-  name                = "Peak_10"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "4.4.97.104"
-  end_ip_address      = "4.4.97.111"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-Peak_10-rule2" {
-  name                = "Peak_101"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "206.196.17.32"
-  end_ip_address      = "206.196.17.63"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-Bangalore-rule1" {
-  name                = "Bangalore"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "14.98.59.168"
-  end_ip_address      = "14.98.59.175"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-Bangalore-rule2" {
-  name                = "Bangalore1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "182.74.33.8"
-  end_ip_address      = "182.74.33.15"
-}
-
-#QCS
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSUS1" {
-  name                = "QCSUS1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "18.205.71.36"
-  end_ip_address      = "18.205.71.36"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSUS2" {
-  name                = "QCSUS2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "18.232.32.199"
-  end_ip_address      = "18.232.32.199"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSUS3" {
-  name                = "QCSUS3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "34.237.68.254"
-  end_ip_address      = "34.237.68.254"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSEU1" {
-  name                = "QCSEU1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "34.247.21.179"
-  end_ip_address      = "34.247.21.179"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSEU2" {
-  name                = "QCSEU2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "52.31.212.214"
-  end_ip_address      = "52.31.212.214"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCS3" {
-  name                = "QCSEU3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "54.154.95.18"
-  end_ip_address      = "54.154.95.18"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSAPAC1" {
-  name                = "QCSAPAC1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "13.210.43.241"
-  end_ip_address      = "13.210.43.241"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSAPAC2" {
-  name                = "QCSAPAC2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "13.236.104.42"
-  end_ip_address      = "13.236.104.42"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSAPAC3" {
-  name                = "QCSAPAC3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "13.236.206.172"
-  end_ip_address      = "13.236.206.172"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSSingapore1" {
-  name                = "QCSSingapore1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "18.138.163.172"
-  end_ip_address      = "18.138.163.172"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSSingapore2" {
-  name                = "QCSSingapore2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "18.142.157.182"
-  end_ip_address      = "18.142.157.182"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QCSSingapore3" {
-  name                = "QCSSingapore3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "54.179.13.251"
-  end_ip_address      = "54.179.13.251"
-}
-
-# QAA
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAeu1" {
-  name                = "QAAeu1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "54.216.156.88"
-  end_ip_address      = "54.216.156.88"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAeu2" {
-  name                = "QAAeu2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "3.248.156.131"
-  end_ip_address      = "3.248.156.131"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAeu3" {
-  name                = "QAAeu3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "52.213.44.55"
-  end_ip_address      = "52.213.44.55"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAus1" {
-  name                = "QAAus1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "18.235.133.252"
-  end_ip_address      = "18.235.133.252"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAus2" {
-  name                = "QAAus2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "3.217.244.242"
-  end_ip_address      = "3.217.244.242"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAus3" {
-  name                = "QAAus3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "18.214.8.201"
-  end_ip_address      = "18.214.8.201"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAapac1" {
-  name                = "QAAapac1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "54.206.158.27"
-  end_ip_address      = "54.206.158.27"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAapac2" {
-  name                = "QAAapac2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "3.104.137.20"
-  end_ip_address      = "3.104.137.20"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAapac3" {
-  name                = "QAAapac3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "3.24.52.178"
-  end_ip_address      = "3.24.52.178"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAsing1" {
-  name                = "QAAsing1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "54.169.84.213"
-  end_ip_address      = "54.169.84.213"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAsing2" {
-  name                = "QAAsing2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "13.213.173.37"
-  end_ip_address      = "13.213.173.37"
-}
-resource "azurerm_postgresql_firewall_rule" "postgresql-fw-QAAsing3" {
-  name                = "QAAsing3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_postgresql_server.postgresql-server.name
-  start_ip_address    = "13.213.113.162"
-  end_ip_address      = "13.213.113.162"
 }

databases/azure-rds-postgres/output.tf

@@ -11,5 +11,5 @@ output "root_username" {
 }
 
 output "root_username_password" {
-  value = random_password.password.result
+  value = nonsensitive(random_password.password.result)
 }

databases/azure-rds-postgres/variables.tf

@@ -13,6 +13,10 @@ variable "location" {
   default = "EAST US"
 }
 
+variable "subnet_id" {
+  default = null
+}
+
 
 variable "admin_login" {
   type = string

databases/azuresql/main.tf

@@ -1,329 +0,0 @@
-resource "random_id" "randomServerId" {
-    keepers = {
-        # Generate a new ID only when a new resource group is defined
-        resource_group = var.resource_group_name
-    }
-    
-    byte_length = 2
-}
-
-resource "random_password" "password" {
-  length = 16
-  special = true
-  override_special = "_!@"
-  upper = true
-  lower = true
-  min_lower = 2
-  min_upper = 2
-  min_special = 2
-}
-
-locals {
-  sql_administrator_login_password = var.sql_administrator_login_password != null? var.sql_administrator_login_password : random_password.password.result
-  provision_id = var.provision_id != null? var.provision_id : random_id.randomServerId.hex
-}
-
-resource "azurerm_sql_server" "sqlserver" {
-  name                         = "sqlserver-${local.provision_id}"
-  resource_group_name          = var.resource_group_name
-  location                     = var.location
-  version                      = "12.0"
-  administrator_login          = var.sql_administrator_login
-  administrator_login_password = local.sql_administrator_login_password
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-
-  identity {
-    type = "SystemAssigned"
-  }
-}
-
-resource "azurerm_sql_firewall_rule" "all-azure-services" {
-  name                = "AllAzureServices"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "0.0.0.0"
-  end_ip_address      = "0.0.0.0"
-}
-
-resource "azurerm_sql_firewall_rule" "azuresql-fw-ITG-rule1" {
-  name                = "ITG"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "188.65.156.32"
-  end_ip_address      = "188.65.156.47"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-ITG-rule2" {
-  name                = "ITG1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "212.73.252.96"
-  end_ip_address      = "212.73.252.103"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-kfar_saba-rule1" {
-  name                = "Kfar_Saba"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "194.90.96.176"
-  end_ip_address      = "194.90.96.183"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-kfar_saba-rule2" {
-  name                = "Kfar_Saba1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "213.57.84.160"
-  end_ip_address      = "213.57.84.167"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-Peak_10-rule1" {
-  name                = "Peak_10"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "4.4.97.104"
-  end_ip_address      = "4.4.97.111"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-Peak_10-rule2" {
-  name                = "Peak_101"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "206.196.17.32"
-  end_ip_address      = "206.196.17.63"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-Bangalore-rule1" {
-  name                = "Bangalore"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "14.98.59.168"
-  end_ip_address      = "14.98.59.175"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-Bangalore-rule2" {
-  name                = "Bangalore1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "182.74.33.8"
-  end_ip_address      = "182.74.33.15"
-}
-
-# QCS
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSUS1" {
-  name                = "QCSUS1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "18.205.71.36"
-  end_ip_address      = "18.205.71.36"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSUS2" {
-  name                = "QCSUS2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "18.232.32.199"
-  end_ip_address      = "18.232.32.199"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSUS3" {
-  name                = "QCSUS3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "34.237.68.254"
-  end_ip_address      = "34.237.68.254"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSEU1" {
-  name                = "QCSEU1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "34.247.21.179"
-  end_ip_address      = "34.247.21.179"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSEU2" {
-  name                = "QCSEU2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "52.31.212.214"
-  end_ip_address      = "52.31.212.214"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCS3" {
-  name                = "QCSEU3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "54.154.95.18"
-  end_ip_address      = "54.154.95.18"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSAPAC1" {
-  name                = "QCSAPAC1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "13.210.43.241"
-  end_ip_address      = "13.210.43.241"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSAPAC2" {
-  name                = "QCSAPAC2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "13.236.104.42"
-  end_ip_address      = "13.236.104.42"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSAPAC3" {
-  name                = "QCSAPAC3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "13.236.206.172"
-  end_ip_address      = "13.236.206.172"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSSingapore1" {
-  name                = "QCSSingapore1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "18.138.163.172"
-  end_ip_address      = "18.138.163.172"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSSingapore2" {
-  name                = "QCSSingapore2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "18.142.157.182"
-  end_ip_address      = "18.142.157.182"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QCSSingapore3" {
-  name                = "QCSSingapore3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "54.179.13.251"
-  end_ip_address      = "54.179.13.251"
-}
-
-resource "azurerm_sql_virtual_network_rule" "sqlvnetrule" {
-  name                = "sql-vnet-rule-${local.provision_id}"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  subnet_id           = var.subnet_id
-}
-
-# QAA
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAeu1" {
-  name                = "QAAeu1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "54.216.156.88"
-  end_ip_address      = "54.216.156.88"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAeu2" {
-  name                = "QAAeu2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "3.248.156.131"
-  end_ip_address      = "3.248.156.131"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAeu3" {
-  name                = "QAAeu3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "52.213.44.55"
-  end_ip_address      = "52.213.44.55"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAus1" {
-  name                = "QAAus1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "18.235.133.252"
-  end_ip_address      = "18.235.133.252"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAus2" {
-  name                = "QAAus2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "3.217.244.242"
-  end_ip_address      = "3.217.244.242"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAus3" {
-  name                = "QAAus3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "18.214.8.201"
-  end_ip_address      = "18.214.8.201"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAapac1" {
-  name                = "QAAapac1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "54.206.158.27"
-  end_ip_address      = "54.206.158.27"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAapac2" {
-  name                = "QAAapac2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "3.104.137.20"
-  end_ip_address      = "3.104.137.20"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAapac3" {
-  name                = "QAAapac3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "3.24.52.178"
-  end_ip_address      = "3.24.52.178"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAsing1" {
-  name                = "QAAsing1"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "54.169.84.213"
-  end_ip_address      = "54.169.84.213"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAsing2" {
-  name                = "QAAsing2"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "13.213.173.37"
-  end_ip_address      = "13.213.173.37"
-}
-resource "azurerm_sql_firewall_rule" "azuresql-fw-QAAsing3" {
-  name                = "QAAsing3"
-  resource_group_name = var.resource_group_name
-  server_name         = azurerm_sql_server.sqlserver.name
-  start_ip_address    = "13.213.113.162"
-  end_ip_address      = "13.213.113.162"
-}
-
-resource "azurerm_sql_database" "db" {
-  name                  = "demoDB"
-  resource_group_name   = var.resource_group_name
-  location              = var.location
-  server_name           = azurerm_sql_server.sqlserver.name
-  create_mode           = "Default"
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-}
-
-# FOR QDI scenario
-resource "azurerm_sql_database" "dbname_source" {
-  name                  = "source"
-  resource_group_name   = var.resource_group_name
-  location              = var.location
-  server_name           = azurerm_sql_server.sqlserver.name
-  create_mode           = "Default"
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-}
-resource "azurerm_sql_database" "dbname_target" {
-  name                  = "target"
-  resource_group_name   = var.resource_group_name
-  location              = var.location
-  server_name           = azurerm_sql_server.sqlserver.name
-  create_mode           = "Default"
-
-  tags = {
-    Deployment = "QMI PoC"
-    "Cost Center" = "3100"
-    QMI_user = var.user_id
-  }
-}

databases/azuresql/outputs.tf

@@ -1,29 +0,0 @@
-output "sqlserver_id" {
-    value = azurerm_sql_server.sqlserver.id
-}
-
-output "sqlserver_name" {
-    value = azurerm_sql_server.sqlserver.name
-}
-
-output "sqlserver_fully_qualified_domain_name" {
-    value = azurerm_sql_server.sqlserver.fully_qualified_domain_name
-}
-
-output "dbname" {
-    value = azurerm_sql_database.db.name
-}
-
-output "administrator_login" {
-    value = var.sql_administrator_login
-}
-
-output "administrator_login_password" {
-    value = local.sql_administrator_login_password
-}
-
-output "principal_id" {
-  value = azurerm_sql_server.sqlserver.identity.0.principal_id
-}
-
-

databases/dbricks/main.tf

@@ -1,10 +1,10 @@
 terraform {
 
-  required_version = ">= 0.13"
+  required_version = ">= 0.14"
 
   required_providers {
     databricks = {
-      source = "databrickslabs/databricks"
+      source = "databricks/databricks"
       version = ">= 0.3.0"
     }
   }
@@ -142,8 +142,8 @@ resource "databricks_cluster" "dbrickscluster" {
   ]
 
   cluster_name  = "cluster-${local.cluster_name}"
-  spark_version = "7.3.x-scala2.12"
-  node_type_id  = "Standard_DS3_v2"
+  spark_version = var.spark_version
+  node_type_id  = var.node_type_id
 
   spark_conf = {
     "spark.hadoop.hive.server2.enable.doAs": false,

databases/dbricks/outputs.tf

@@ -3,7 +3,7 @@ output "databricks_workspace_url" {
 }
 
 output "databricks_token" {
-    value = var.enabled? databricks_token.pat[0].token_value : null
+    value = var.enabled? nonsensitive(databricks_token.pat[0].token_value) : null
 }
 
 output "cluster_name" {

databases/dbricks/varaibles.tf

@@ -33,4 +33,12 @@ variable "enabled" {
 
 variable "create_cluster" {
     default = false
+}
+
+variable "spark_version" {
+    default = "7.3.x-scala2.12"
+}
+
+variable "node_type_id" {
+    default = "Standard_DS3_v2"
 }

databases/firewall_ips/output.tf

@@ -0,0 +1,103 @@
+locals {
+
+  az = {
+      az1          = ["52.249.189.38","52.249.189.38"]
+      az2          = ["13.67.39.86", "13.67.39.86"]
+      az3          = ["20.67.110.207", "20.67.110.207"]
+  }
+
+  q_routes = {
+    ITG         = ["188.65.156.32", "188.65.156.47"]
+    ITG1        = ["212.73.252.96", "212.73.252.103"]
+    kfar_saba   = ["194.90.96.176", "194.90.96.183"]
+    kfar_saba1  = ["213.57.84.160", "213.57.84.167"]
+    peak_10     = ["4.4.97.104", "4.4.97.111"]
+    peak_101    = ["206.196.17.32", "206.196.17.63"]
+    Bangalore   = ["14.98.59.168", "14.98.59.175"]
+    Bangalore1  = ["182.74.33.8", "182.74.33.15"]
+  }
+
+  qcs = {
+      QCS_us1          = ["18.205.71.36", "18.205.71.36"]      
+      QCS_us2          = ["18.232.32.199", "18.232.32.199"]   
+      QCS_us3          = ["34.237.68.254", "34.237.68.254"]   
+      QCS_eu1          = ["34.247.21.179", "34.247.21.179"]  
+      QCS_eu2          = ["52.31.212.214", "52.31.212.214"]  
+      QCS_eu3          = ["54.154.95.18", "54.154.95.18"]  
+      QCS_apac1        = ["13.210.43.241", "13.210.43.241"] 
+      QCS_apac2        = ["13.236.104.42", "13.236.104.42"]  
+      QCS_apac3        = ["13.236.206.172", "13.236.206.172"] 
+      QCS_sing1        = ["18.138.163.172", "18.138.163.172"]
+      QCS_sing2        = ["18.142.157.182", "18.142.157.182"]
+      QCS_sing3        = ["54.179.13.251", "54.179.13.251"]
+  }
+
+  qcs_qaa = {
+      QCS_QAA_eu1     = ["54.216.156.88", "54.216.156.88"]
+      QCS_QAA_eu2     = ["3.248.156.131", "3.248.156.131"]
+      QCS_QAA_eu3     = ["52.213.44.55", "52.213.44.55"]
+      QCS_QAA_us1     = ["18.235.133.252", "18.235.133.252"]
+      QCS_QAA_us2     = ["3.217.244.242", "3.217.244.242"]
+      QCS_QAA_us3     = ["18.214.8.201", "18.214.8.201"]
+      QCS_QAA_apac1     = ["54.206.158.27", "54.206.158.27"]
+      QCS_QAA_apac2     = ["3.104.137.20", "3.104.137.20"]
+      QCS_QAA_apac3     = ["3.24.52.178", "3.24.52.178"]
+      QCS_QAA_sing1     = ["54.169.84.213", "54.169.84.213"]
+      QCS_QAA_sing2     = ["13.213.173.37", "13.213.173.37"]
+      QCS_QAA_sing3     = ["13.213.113.162", "13.213.113.162"]
+  }
+
+ 
+}
+
+output "ips2" {
+  value = merge(local.q_routes, local.qcs)
+}
+
+output "ips" {
+  value = merge(local.az, local.qcs, local.qcs_qaa, local.q_routes)
+}
+
+output "cidr_blocks" {
+  value = [
+    # Azure QMI machines
+    "52.249.189.38/32", 
+    "13.67.39.86/32", 
+    "20.67.110.207/32", 
+    # Qlik network routers
+    "14.98.59.168/29", 
+    "182.74.33.8/29", 
+    "188.65.156.32/28", 
+    "212.73.252.96/29", 
+    "194.90.96.176/29", 
+    "213.57.84.160/29", 
+    "4.4.97.104/29", 
+    "206.196.17.32/27", 
+    # QCS
+    "18.205.71.36/32", 
+    "18.232.32.199/32", 
+    "34.237.68.254/32", 
+    "34.247.21.179/32", 
+    "52.31.212.214/32", 
+    "54.154.95.18/32", 
+    "13.210.43.241/32", 
+    "13.236.104.42/32", 
+    "13.236.206.172/32",
+    "18.138.163.172/32",
+    "18.142.157.182/32",
+    "54.179.13.251/32",
+    # QCS-QAA
+    "54.216.156.88/32",
+    "3.248.156.131/32",
+    "52.213.44.55/32",
+    "18.235.133.252/32",
+    "3.217.244.242/32",
+    "18.214.8.201/32",
+    "54.206.158.27/32",
+    "3.104.137.20/32",
+    "3.24.52.178/32",
+    "54.169.84.213/32",
+    "13.213.173.37/32",
+    "13.213.113.162/32"
+  ]
+}

databases/synapse-ws/firewall.tf

@@ -1,136 +1,49 @@
-resource "azurerm_synapse_firewall_rule" "azureservices" {
+/*resource "azurerm_synapse_firewall_rule" "azureservices" {
   name                 = "AllowAllWindowsAzureIps"
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
   // https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/synapse_firewall_rule
   start_ip_address     = "0.0.0.0"
   end_ip_address       = "0.0.0.0"
-}
+}*/
+
 
 resource "azurerm_synapse_firewall_rule" "fw-a-rule1" {
-  name                = "a1"
+
+  name                = "az1"
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
   start_ip_address    = "52.249.189.38"
   end_ip_address      = "52.249.189.38"
+
 }
 
 resource "azurerm_synapse_firewall_rule" "fw-a-rule2" {
-  name                = "a2"
+
+  name                = "az2"
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
   start_ip_address    = "13.67.39.86"
   end_ip_address      = "13.67.39.86"
+
 }
 
 resource "azurerm_synapse_firewall_rule" "fw-a-rule3" {
-  name                = "a3"
+
+  name                = "az3"
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
   start_ip_address    = "20.67.110.207"
   end_ip_address      = "20.67.110.207"
+
 }
 
-resource "azurerm_synapse_firewall_rule" "fw-ITG-rule1" {
-  name                = "ITG"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "188.65.156.32"
-  end_ip_address      = "188.65.156.47"
-}
-resource "azurerm_synapse_firewall_rule" "fw-ITG-rule2" {
-  name                = "ITG1"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "212.73.252.96"
-  end_ip_address      = "212.73.252.103"
-}
-resource "azurerm_synapse_firewall_rule" "fw-kfar_saba-rule1" {
-  name                = "Kfar_Saba"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "194.90.96.176"
-  end_ip_address      = "194.90.96.183"
-}
-resource "azurerm_synapse_firewall_rule" "fw-kfar_saba-rule2" {
-  name                = "Kfar_Saba1"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "213.57.84.160"
-  end_ip_address      = "213.57.84.167"
-}
-resource "azurerm_synapse_firewall_rule" "fw-Peak_10-rule1" {
-  name                = "Peak_10"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "4.4.97.104"
-  end_ip_address      = "4.4.97.111"
-}
-resource "azurerm_synapse_firewall_rule" "fw-Peak_10-rule2" {
-  name                = "Peak_101"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "206.196.17.32"
-  end_ip_address      = "206.196.17.63"
-}
-resource "azurerm_synapse_firewall_rule" "fw-Bangalore-rule1" {
-  name                = "Bangalore"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "14.98.59.168"
-  end_ip_address      = "14.98.59.175"
-}
-resource "azurerm_synapse_firewall_rule" "fw-Bangalore-rule2" {
-  name                = "Bangalore1"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "182.74.33.8"
-  end_ip_address      = "182.74.33.15"
+module "fw-ips" {
+    source = "git::https://gitlab.com/qmi/qmi-cloud-tf-modules.git//databases/firewall_ips"
 }
 
-# QCS US
-resource "azurerm_synapse_firewall_rule" "qcs_us_1" {
-  name                = "QCS_US_1"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "18.205.71.36"
-  end_ip_address      = "18.205.71.36"
-}
-resource "azurerm_synapse_firewall_rule" "qcs_us_2" {
-  name                = "QCS_US_2"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "18.232.32.199"
-  end_ip_address      = "18.232.32.199"
-}
-resource "azurerm_synapse_firewall_rule" "qcs_us_3" {
-  name                = "QCS_US_3"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "34.237.68.254"
-  end_ip_address      = "34.237.68.254"
-}
+resource "azurerm_synapse_firewall_rule" "fw_rule" {
+  for_each = module.fw-ips.ips2
 
-# QCS EU
-resource "azurerm_synapse_firewall_rule" "qcs_eu_1" {
-  name                = "QCS_EU_1"
+  name                = each.key
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "34.247.21.179"
-  end_ip_address      = "34.247.21.179"
-}
-resource "azurerm_synapse_firewall_rule" "qcs_eu_2" {
-  name                = "QCS_EU_2"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "52.31.212.214"
-  end_ip_address      = "52.31.212.214"
-}
-resource "azurerm_synapse_firewall_rule" "qcs_eu_3" {
-  name                = "QCS_EU_3"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "54.154.95.18"
-  end_ip_address      = "54.154.95.18"
-}
-# QCS AP
-resource "azurerm_synapse_firewall_rule" "qcs_ap_1" {
-  name                = "QCS_AP_1"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "13.210.43.241"
-  end_ip_address      = "13.210.43.241"
-}
-resource "azurerm_synapse_firewall_rule" "qcs_ap_2" {
-  name                = "QCS_AP_2"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "13.236.104.42"
-  end_ip_address      = "13.236.104.42"
-}
-resource "azurerm_synapse_firewall_rule" "qcs_ap_3" {
-  name                = "QCS_AP_3"
-  synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
-  start_ip_address    = "13.236.206.172"
-  end_ip_address      = "13.236.206.172"
+  start_ip_address    = each.value.0
+  end_ip_address      = each.value.1
+
 }

databases/synapse-ws/main.tf

@@ -33,6 +33,12 @@ resource "azurerm_synapse_workspace" "synapsews" {
   sql_administrator_login              = var.sql_administrator_login
   sql_administrator_login_password     = var.sql_administrator_login_password
 
+  managed_virtual_network_enabled      = true
+
+  identity {
+    type = "SystemAssigned"
+  }
+
   tags = {
     Deployment = "QMI PoC"
     "Cost Center" = "3100"
@@ -47,6 +53,7 @@ resource "azurerm_synapse_sql_pool" "db" {
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
   sku_name             = var.pool_sku_name
   create_mode          = "Default"
+  
 
   tags = {
     Deployment = "QMI PoC"
@@ -60,19 +67,11 @@ resource "azurerm_synapse_sql_pool" "db" {
 resource "azurerm_synapse_role_assignment" "sqladministrator_aor" {
   
   depends_on = [
-      azurerm_synapse_firewall_rule.azureservices
-      /*,
+      //azurerm_synapse_firewall_rule.azureservices,
+      
       azurerm_synapse_firewall_rule.fw-a-rule1,
       azurerm_synapse_firewall_rule.fw-a-rule2,
-      azurerm_synapse_firewall_rule.fw-a-rule3,
-      azurerm_synapse_firewall_rule.fw-ITG-rule1,
-      azurerm_synapse_firewall_rule.fw-ITG-rule2,
-      azurerm_synapse_firewall_rule.fw-kfar_saba-rule1,
-      azurerm_synapse_firewall_rule.fw-kfar_saba-rule2,
-      azurerm_synapse_firewall_rule.fw-Peak_10-rule1,
-      azurerm_synapse_firewall_rule.fw-Peak_10-rule2,
-      azurerm_synapse_firewall_rule.fw-Bangalore-rule1,
-      azurerm_synapse_firewall_rule.fw-Bangalore-rule2*/
+      azurerm_synapse_firewall_rule.fw-a-rule3
   ]
 
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id
@@ -86,18 +85,11 @@ resource "azurerm_synapse_role_assignment" "sqladministrator" {
   count = (var.user_oid != null && var.user_oid != "c583b5aa-2844-4baf-b8bf-b6a1ae0b1520") ? 1 : 0
 
   depends_on = [
-      azurerm_synapse_firewall_rule.azureservices/*,
+      //azurerm_synapse_firewall_rule.azureservices,
+      
       azurerm_synapse_firewall_rule.fw-a-rule1,
       azurerm_synapse_firewall_rule.fw-a-rule2,
-      azurerm_synapse_firewall_rule.fw-a-rule3,
-      azurerm_synapse_firewall_rule.fw-ITG-rule1,
-      azurerm_synapse_firewall_rule.fw-ITG-rule2,
-      azurerm_synapse_firewall_rule.fw-kfar_saba-rule1,
-      azurerm_synapse_firewall_rule.fw-kfar_saba-rule2,
-      azurerm_synapse_firewall_rule.fw-Peak_10-rule1,
-      azurerm_synapse_firewall_rule.fw-Peak_10-rule2,
-      azurerm_synapse_firewall_rule.fw-Bangalore-rule1,
-      azurerm_synapse_firewall_rule.fw-Bangalore-rule2*/
+      azurerm_synapse_firewall_rule.fw-a-rule3
   ]
 
   synapse_workspace_id = azurerm_synapse_workspace.synapsews.id

databases/synapse-ws/outputs.tf

@@ -23,7 +23,7 @@ output "administrator_login" {
 }
 
 output "administrator_login_password" {
-    value = var.sql_administrator_login_password
+    value = nonsensitive(var.sql_administrator_login_password)
 }
 
 output "principal_id" {

linux-common/centos/common/falcon.sh

@@ -2,10 +2,19 @@
 
 BASEDIR=$(dirname "$0")
 
+
+centos_ver=`rpm --eval %{centos_ver}`
+binary='falcon-sensor-5.29.0-9403.el7.x86_64.rpm'
+if [ $centos_ver -eq '8' ]; then
+    binary='falcon-sensor-5.27.0-9104.el8.x86_64.rpm'
+fi
+echo $binary
+
+
 echo "Installing CrowdStrike falcon agent"
 echo "CID=$1"
 if ! rpm -qa | grep -qw falcon-sensor; then
-    sudo yum install $BASEDIR/falcon-sensor-5.29.0-9403.el7.x86_64.rpm -y
+    sudo yum install $BASEDIR/$binary -y
 fi
 sudo /opt/CrowdStrike/falconctl -s -f --cid=$1
 sudo systemctl start falcon-sensor 

linux-common/centos/common/tenable.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+BASEDIR=$(dirname "$0")
+
+echo "Installing Tenable Nessus Agent..."
+KEY=$1
+echo "KEY=$KEY"
+
+sudo yum install $BASEDIR/NessusAgent-10.2.0-es7.x86_64.rpm -y
+
+echo "Linking Tenable Nessus Agent..."
+sudo /bin/systemctl start nessusagent.service
+sudo /opt/nessus_agent/sbin/nessuscli agent link --key=$KEY --groups="Qlik IT Cloud Agents" --host=cloud.tenable.com --port=443
+
+sudo /opt/nessus_agent/sbin/nessuscli agent status

linux-common/main.tf

@@ -3,7 +3,17 @@ data "azurerm_key_vault_secret" "cid" {
   key_vault_id = var.key_vault_id
 }
 
-resource "null_resource" "post-centos-vm" {
+data "azurerm_key_vault_secret" "tenable-key" {
+  name         = "tenable-key"
+  key_vault_id = var.key_vault_id
+}
+
+locals {
+  falcon_id     = nonsensitive(data.azurerm_key_vault_secret.cid.value)
+  tenable_key   = nonsensitive(data.azurerm_key_vault_secret.tenable-key.value)
+}
+
+resource "null_resource" "post-linux-vm" {
     
     provisioner "file" {
         connection {
@@ -15,7 +25,7 @@ resource "null_resource" "post-centos-vm" {
             #private_key = "${file("~/.ssh/id_rsa")}"   
         }
         source      = "${path.module}/${var.os_type}/common"
-        destination = "~"
+        destination = "/home/${var.admin_username}"
     }
 
     provisioner "remote-exec" {
@@ -30,8 +40,9 @@ resource "null_resource" "post-centos-vm" {
 
         inline = [
             "echo ${var.admin_password} | sudo -S chmod u+x /home/${var.admin_username}/common/*.sh",
-            "sudo /home/${var.admin_username}/common/falcon.sh '${data.azurerm_key_vault_secret.cid.value}'",
-            "sudo /home/${var.admin_username}/common/resizedisk.sh"
+            "sudo /home/${var.admin_username}/common/falcon.sh '${local.falcon_id}'",
+            "sudo /home/${var.admin_username}/common/resizedisk.sh",
+            "sudo /home/${var.admin_username}/common/tenable.sh '${local.tenable_key}'",
         ]
     }
 }

linux-common/ubuntu/common/tenable.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+BASEDIR=$(dirname "$0")
+
+echo "Installing Tenable Nessus Agent..."
+KEY=$1
+echo "KEY=$KEY"
+
+sudo dpkg -i $BASEDIR/NessusAgent-10.2.0-ubuntu1110_amd64.deb
+
+echo "Linking Tenable Nessus Agent..."
+sudo /bin/systemctl start nessusagent.service
+sudo /opt/nessus_agent/sbin/nessuscli agent link --key=$KEY --groups="Qlik IT Cloud Agents" --host=cloud.tenable.com --port=443
+
+sudo /opt/nessus_agent/sbin/nessuscli agent status

replicate-install/main.tf

@@ -5,6 +5,7 @@ data "azurerm_key_vault_secret" "cert-password" {
 
 locals {
   domain = var.domain != null? var.domain : "qem.qmi"
+  cert_password = nonsensitive(data.azurerm_key_vault_secret.cert-password.value)
 }
 
 resource "null_resource" "prep" {
@@ -61,7 +62,7 @@ resource "null_resource" "install" {
     inline = [
       "powershell.exe -File C:/provision/replicate-install/di-replicate-getBinary.ps1 -url ${var.download_url}",
       "powershell.exe -File C:/provision/replicate-install/di-replicate-install.ps1 -url ${var.download_url}",
-      "powershell.exe -File C:/provision/replicate-install/di-replicate-installQMICertificate.ps1 -CertPwd \"${data.azurerm_key_vault_secret.cert-password.value}\"",
+      "powershell.exe -File C:/provision/replicate-install/di-replicate-installQMICertificate.ps1 -CertPwd \"${local.cert_password}\"",
       "powershell.exe -File C:/provision/replicate-install/di-em-register-replicate.ps1 -user ${var.vm_admin_username} -pass ${var.vm_admin_password} -domain ${local.domain}",
     ]
 

s3-bucket-sftp/main.tf

@@ -0,0 +1,351 @@
+terraform {
+
+  required_version = ">= 0.13"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 3.74.1"
+    }
+  }
+}
+
+resource "tls_private_key" "sftp-key" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "aws_key_pair" "generated_key" {    
+  key_name   = "key-${var.provision_id}"
+  public_key = tls_private_key.sftp-key.public_key_openssh
+}
+
+## Public_secret
+
+resource "aws_secretsmanager_secret" "public_key" {
+  name = "pub-${var.provision_id}"
+}
+
+resource "aws_secretsmanager_secret_version" "public_key" {
+  secret_id = aws_secretsmanager_secret.public_key.id
+  secret_string = aws_key_pair.generated_key.public_key
+}
+
+## Private Secret
+
+resource "aws_secretsmanager_secret" "private_key" {
+  name = "priv-${var.provision_id}"
+}
+
+resource "aws_secretsmanager_secret_version" "private_key" {
+  secret_id = aws_secretsmanager_secret.private_key.id
+  secret_string = nonsensitive(tls_private_key.sftp-key.private_key_pem)
+}
+
+
+module "s3_bucket" {
+  source = "terraform-aws-modules/s3-bucket/aws"
+
+  version = "~> 2.1.0"
+
+  bucket = "sftp-${var.provision_id}"
+  acl    = "private"
+
+  versioning = {
+    enabled = false
+  }
+
+  force_destroy = true
+
+  tags = {
+    Deployment = "QMI"
+    "Cost Center" = "3100"
+    #QMI_user = var.user_id
+    ProvID   = var.provision_id
+    Name     = "sftp-${var.provision_id}"
+  }
+
+}
+
+###
+
+resource "aws_s3_bucket_public_access_block" "sftp-block" {
+  bucket = module.s3_bucket.s3_bucket_id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+###
+
+resource "aws_iam_role" "logging" {
+  name               = "${var.provision_id}-transfer-logging"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "transfer.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "logging" {
+  name   = "${var.provision_id}-transfer-logging"
+  role   = aws_iam_role.logging.id
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogStream",
+        "logs:DescribeLogStreams",
+        "logs:CreateLogGroup",
+        "logs:PutLogEvents"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+POLICY
+}
+
+resource "aws_transfer_server" "sftp" {
+  endpoint_type          = "VPC"
+  protocols              = ["SFTP"]
+  identity_provider_type = "SERVICE_MANAGED"
+  logging_role           = aws_iam_role.logging.arn
+  force_destroy          = var.force_destroy
+  security_policy_name   = var.security_policy_name
+  endpoint_details {
+    vpc_id             = var.vpc_id
+    subnet_ids         = var.subnet_ids
+    security_group_ids = [module.security_group.security_group_id]
+  }
+  tags = {
+    Deployment = "QMI"
+    "Cost Center" = "3100"
+    QMI_user = var.user_id
+    ProvID   = var.provision_id
+    Name     = "sftp-${var.provision_id}"
+  }
+}
+
+module "security_group" {
+  
+  # SGs created here as Ports differ per Engine. Only Azure Firewall IPs added for now.
+  source  = "terraform-aws-modules/security-group/aws"
+  version = "~> 4.3"
+
+  name        = "${var.provision_id}-SG"
+  description = "${var.provision_id}-SG-SFTP"
+  vpc_id      = var.vpc_id
+
+
+  # ingress
+
+  ingress_cidr_blocks = [
+    "52.249.189.38/32", 
+    "13.67.39.86/32", 
+    "20.67.110.207/32", 
+    "14.98.59.168/29", 
+    "182.74.33.8/29", 
+    "188.65.156.32/28", 
+    "212.73.252.96/29", 
+    "194.90.96.176/29", 
+    "213.57.84.160/29", 
+    "4.4.97.104/29", 
+    "206.196.17.32/27", 
+    #QCS
+    "18.205.71.36/32", 
+    "18.232.32.199/32", 
+    "34.237.68.254/32", 
+    "34.247.21.179/32", 
+    "52.31.212.214/32", 
+    "54.154.95.18/32", 
+    "13.210.43.241/32", 
+    "13.236.104.42/32", 
+    "13.236.206.172/32",
+    "18.138.163.172/32",
+    "18.142.157.182/32",
+    "54.179.13.251/32",
+    #QAA
+    "54.216.156.88/32",
+    "3.248.156.131/32",
+    "52.213.44.55/32",
+    "18.235.133.252/32",
+    "3.217.244.242/32",
+    "18.214.8.201/32",
+    "54.206.158.27/32",
+    "3.104.137.20/32",
+    "3.24.52.178/32",
+    "54.169.84.213/32",
+    "13.213.173.37/32",
+    "13.213.113.162/32"
+  ]
+
+  ingress_with_cidr_blocks = [
+    {
+      from_port   = 22
+      to_port     = 22
+      protocol    = "tcp"
+      description = "Allow SFTP Inbound"
+
+    },
+  ]
+
+  # egress
+
+  egress_cidr_blocks = [
+    "52.249.189.38/32", 
+    "13.67.39.86/32", 
+    "20.67.110.207/32", 
+    "14.98.59.168/29", 
+    "182.74.33.8/29", 
+    "188.65.156.32/28", 
+    "212.73.252.96/29", 
+    "194.90.96.176/29", 
+    "213.57.84.160/29", 
+    "4.4.97.104/29", 
+    "206.196.17.32/27", 
+    #QCS
+    "18.205.71.36/32", 
+    "18.232.32.199/32", 
+    "34.237.68.254/32", 
+    "34.247.21.179/32", 
+    "52.31.212.214/32", 
+    "54.154.95.18/32", 
+    "13.210.43.241/32", 
+    "13.236.104.42/32", 
+    "13.236.206.172/32",
+    "18.138.163.172/32",
+    "18.142.157.182/32",
+    "54.179.13.251/32",
+    #QAA
+    "54.216.156.88/32",
+    "3.248.156.131/32",
+    "52.213.44.55/32",
+    "18.235.133.252/32",
+    "3.217.244.242/32",
+    "18.214.8.201/32",
+    "54.206.158.27/32",
+    "3.104.137.20/32",
+    "3.24.52.178/32",
+    "54.169.84.213/32",
+    "13.213.173.37/32",
+    "13.213.113.162/32"
+  ]
+
+  egress_with_cidr_blocks = [
+    {
+      from_port   = 22
+      to_port     = 22
+      protocol    = "tcp"
+      description = "Allow SFTP outbound"
+
+    },
+  ]
+
+  tags = {
+    Deployment = "QMI"
+    "Cost Center" = "3100"
+    #QMI_user = var.user_id
+    ProvID   = var.provision_id
+    Name     = "sftp-${var.provision_id}"
+  }
+  
+}
+
+
+resource "aws_iam_role" "user" {
+  for_each           = var.sftp_users
+  name               = "${var.provision_id}-sftp-user-${each.key}"
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "transfer.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "user" {
+  for_each = var.sftp_users
+  name     = "${var.provision_id}-sftp-user-${each.key}"
+  role     = aws_iam_role.user[each.key].id
+
+  policy = <<POLICY
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowListingOfUserFolder",
+      "Action": [
+        "s3:ListBucket",
+        "s3:GetBucketLocation"
+      ],
+      "Effect": "Allow",
+      "Resource": [
+       "${join("", ["arn:aws:s3:::", module.s3_bucket.s3_bucket_id])}"
+      ]
+    },
+    {
+      "Sid": "HomeDirObjectAccess",
+      "Effect": "Allow",
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:DeleteObjectVersion",
+        "s3:DeleteObject",
+        "s3:GetObjectVersion"
+      ],
+      "Resource": "${join("", ["arn:aws:s3:::", module.s3_bucket.s3_bucket_id, "/", each.value, "/*"])}"
+    }
+  ]
+}
+POLICY
+}
+
+resource "aws_transfer_user" "this" {
+  for_each       = var.sftp_users
+  server_id      = aws_transfer_server.sftp.id
+  user_name      = each.key
+  home_directory = "/${module.s3_bucket.s3_bucket_id}/${each.value}"
+  role           = aws_iam_role.user[each.key].arn
+}
+
+resource "aws_transfer_ssh_key" "this" {
+  for_each   = { "sftpusr" = aws_secretsmanager_secret_version.public_key.secret_string }
+  server_id  = aws_transfer_server.sftp.id
+  user_name  = each.key
+  body       = each.value
+  depends_on = [aws_transfer_user.this]
+}
+
+/*resource "null_resource" "get-endpoint-dns" {
+  provisioner "local-exec" {
+    command = "aws ec2 describe-vpc-endpoints --vpc-endpoint-ids ${aws_transfer_server.sftp.endpoint_details[0].vpc_endpoint_id} --query 'VpcEndpoints[*].DnsEntries[0].DnsName'> dns.txt"
+  }
+}
+
+data "local_file" "endpoint-dns" {
+  filename   = "dns.txt"
+  depends_on = [null_resource.get-endpoint-dns]
+}*/

s3-bucket-sftp/outputs.tf

@@ -0,0 +1,28 @@
+output "vpc_endpoint" {
+  value       = aws_transfer_server.sftp.endpoint_details[0].vpc_endpoint_id
+  description = "VPC Endpoint of transfer server"
+}
+
+output "id" {
+  value       = aws_transfer_server.sftp.id
+  description = "ID of transfer server"
+}
+
+output "endpoint" {
+  value       = aws_transfer_server.sftp.endpoint
+  description = "Endpoint of transfer server"
+}
+
+output "endpoint-dns" {
+  value = "" #data.local_file.endpoint-dns.content    
+}
+
+
+output "sftp-private" {
+  value = nonsensitive(aws_secretsmanager_secret_version.private_key.secret_string)
+}
+
+output "username" {
+  value = "sftpusr"
+}
+