feat: secure Terraform plan hand-off with Blob Storage - #51
Open
Git-PrinceNagar wants to merge 2 commits into
Open
feat: secure Terraform plan hand-off with Blob Storage#51Git-PrinceNagar wants to merge 2 commits into
Git-PrinceNagar wants to merge 2 commits into
Conversation
Ports the GitHub production repo's secure plan-storage design (commits dd24dec/12ea394 on the sibling GitHub bootstrap repo) to the Azure DevOps pipelines, closing Azure/Azure-Landing-Zones#4174 for the Azure DevOps bootstrap module. Terraform: - variables.cicd.tf: plan_storage_retention_days, show_plan_in_pipeline_logs, use_storage_account_for_plan. - locals.cicd.tf: plan_storage_container_names plus backend collision/duplicate-name validation lists. - main.azure.storage.tf: plan-container validation resource, merge plan containers into the storage account, add a lifecycle rule for plan blob retention. Also fixes a pre-existing bug where the state container's role_assignments did not filter disabled identities. - main.azuredevops.variable.groups.tf: publish USE_STORAGE_ACCOUNT_FOR_PLAN, SHOW_PLAN_IN_PIPELINE_LOGS, and (conditionally) PLAN_STORAGE_CONTAINER_NAME per environment. - variables.environments.tf: bundled-CD identity validation. Pipelines: - New helpers/terraform-plan-{workspace,upload,download,delete, cleanup}.yaml isolate the plan blob lifecycle. - terraform-plan.yaml / terraform-apply.yaml keep the existing OIDC auth blocks and route the plan file through Agent.TempDirectory instead of the sources directory. - cd-template.yaml / ci-template.yaml gate log/artifact exposure on the two feature flags, drop tfplan/tfplan.json from the published artifact, and fix a pre-existing Build.ArtifactsStagingDirectory typo (missing 's'). Docs/tests: - _header.md documents the new secure plan hand-off behavior. - tests/contract/Test-PipelinePlanStorage.ps1: 66-assertion static contract test adapted for Azure Pipelines YAML (raw-text regex rather than object-model navigation, since ADO's "each" template expression syntax isn't a standard YAML construct). - .github/workflows/plan-storage-contract.yml wires the contract test into CI. - README.md regenerated via avm pre-commit. use_storage_account_for_plan defaults to true (secure by default); show_plan_in_pipeline_logs defaults to false. Storage account module pin (avm-res-storage-storageaccount 0.6.8) unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Explain that retention must exceed the expected plan-to-apply approval wait and that expired plans should be regenerated. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Moves Terraform plan hand-off between Azure Pipelines plan and apply stages from downloadable pipeline artifacts to a dedicated container in the private Azure Storage account used for Terraform state.
Related to Azure/Azure-Landing-Zones#4174.
Companion PRs:
Security and compatibility
use_storage_account_for_plan = trueenables the secure path by default.show_plan_in_pipeline_logs = falsehides full plan output by default, including failed-plan output redaction.runs/$(Build.BuildId)/tfplanblob using Microsoft Entra ID; no storage keys, blob listing, or mutablelatestalias are used.$(Agent.TempDirectory)and are excluded from the published module artifact.plan_storage_retention_daysdefaults to 7 and is configurable for longer approval windows.use_storage_account_for_plan = falsepreserves the legacy artifact hand-off.avm-res-storage-storageaccountdependency remains pinned at0.6.8.Implementation
$(Build.ArtifactsStagingDirectory)artifact-path typo.Testing evidence
avm pre-commit: sync, convention, transform, format, and docs pass.terraform init -backend=falseandterraform validatepass; only existing provider deprecation warnings are emitted.tests/contract/Test-PipelinePlanStorage.ps1: 66 passed, 0 failed.Known limitations
mock_providerrejects its ephemeralazapi_resource_action(Test framework: add ephemeral resource support tomock_providerhashicorp/terraform#38608). The 66-assertion contract suite, live accelerator validation, plan inspection, and Azure read-back provide compensating coverage.Type of Change
Checklist
The managed AVM workflow is disabled for fork PRs by repository policy; it can run through the upstream release-branch process if maintainers require it.