Skip to content

azurermMssqlServerMicrosoftSupportAuditingPolicy

Manages a MS SQL Server Microsoft Support Auditing Policy.

Example Usage

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as azurerm from "./.gen/providers/azurerm";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: azurerm.
For a more precise conversion please use the --provider flag in convert.*/
new azurerm.provider.AzurermProvider(this, "azurerm", {
  features: [{}],
});
const azurermResourceGroupExample = new azurerm.resourceGroup.ResourceGroup(
  this,
  "example",
  {
    location: "West Europe",
    name: "example-resources",
  }
);
const azurermStorageAccountExample = new azurerm.storageAccount.StorageAccount(
  this,
  "example_2",
  {
    account_replication_type: "LRS",
    account_tier: "Standard",
    location: azurermResourceGroupExample.location,
    name: "examplesa",
    resource_group_name: azurermResourceGroupExample.name,
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermStorageAccountExample.overrideLogicalId("example");
const azurermMssqlServerExample = new azurerm.mssqlServer.MssqlServer(
  this,
  "example_3",
  {
    administrator_login: "missadministrator",
    administrator_login_password: "AdminPassword123!",
    location: azurermResourceGroupExample.location,
    name: "example-sqlserver",
    resource_group_name: azurermResourceGroupExample.name,
    version: "12.0",
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermMssqlServerExample.overrideLogicalId("example");
const azurermMssqlServerMicrosoftSupportAuditingPolicyExample =
  new azurerm.mssqlServerMicrosoftSupportAuditingPolicy.MssqlServerMicrosoftSupportAuditingPolicy(
    this,
    "example_4",
    {
      blob_storage_endpoint: azurermStorageAccountExample.primaryBlobEndpoint,
      server_id: azurermMssqlServerExample.id,
      storage_account_access_key: azurermStorageAccountExample.primaryAccessKey,
    }
  );
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermMssqlServerMicrosoftSupportAuditingPolicyExample.overrideLogicalId(
  "example"
);

Example Usage with storage account behind VNet and firewall

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as azurerm from "./.gen/providers/azurerm";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: azurerm.
For a more precise conversion please use the --provider flag in convert.*/
new azurerm.provider.AzurermProvider(this, "azurerm", {
  features: [{}],
});
const azurermResourceGroupExample = new azurerm.resourceGroup.ResourceGroup(
  this,
  "example",
  {
    location: "West Europe",
    name: "example",
  }
);
const azurermVirtualNetworkExample = new azurerm.virtualNetwork.VirtualNetwork(
  this,
  "example_2",
  {
    address_space: ["10.0.0.0/16"],
    location: azurermResourceGroupExample.location,
    name: "virtnetname-1",
    resource_group_name: azurermResourceGroupExample.name,
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermVirtualNetworkExample.overrideLogicalId("example");
const dataAzurermClientConfigExample =
  new azurerm.dataAzurermClientConfig.DataAzurermClientConfig(
    this,
    "example_3",
    {}
  );
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
dataAzurermClientConfigExample.overrideLogicalId("example");
const dataAzurermSubscriptionPrimary =
  new azurerm.dataAzurermSubscription.DataAzurermSubscription(
    this,
    "primary",
    {}
  );
const azurermMssqlServerExample = new azurerm.mssqlServer.MssqlServer(
  this,
  "example_5",
  {
    administrator_login: "missadministrator",
    administrator_login_password: "AdminPassword123!",
    identity: [
      {
        type: "SystemAssigned",
      },
    ],
    location: azurermResourceGroupExample.location,
    minimum_tls_version: "1.2",
    name: "example-sqlserver",
    resource_group_name: azurermResourceGroupExample.name,
    version: "12.0",
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermMssqlServerExample.overrideLogicalId("example");
const azurermRoleAssignmentExample = new azurerm.roleAssignment.RoleAssignment(
  this,
  "example_6",
  {
    principal_id: `\${${azurermMssqlServerExample.identity}.0.principal_id}`,
    role_definition_name: "Storage Blob Data Contributor",
    scope: dataAzurermSubscriptionPrimary.id,
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermRoleAssignmentExample.overrideLogicalId("example");
const azurermSqlFirewallRuleExample =
  new azurerm.sqlFirewallRule.SqlFirewallRule(this, "example_7", {
    end_ip_address: "0.0.0.0",
    name: "FirewallRule1",
    resource_group_name: azurermResourceGroupExample.name,
    server_name: azurermMssqlServerExample.name,
    start_ip_address: "0.0.0.0",
  });
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermSqlFirewallRuleExample.overrideLogicalId("example");
const azurermSubnetExample = new azurerm.subnet.Subnet(this, "example_8", {
  address_prefixes: ["10.0.2.0/24"],
  enforce_private_link_endpoint_network_policies: true,
  name: "subnetname-1",
  resource_group_name: azurermResourceGroupExample.name,
  service_endpoints: ["Microsoft.Sql", "Microsoft.Storage"],
  virtual_network_name: azurermVirtualNetworkExample.name,
});
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermSubnetExample.overrideLogicalId("example");
new azurerm.sqlVirtualNetworkRule.SqlVirtualNetworkRule(this, "sqlvnetrule", {
  name: "sql-vnet-rule",
  resource_group_name: azurermResourceGroupExample.name,
  server_name: azurermMssqlServerExample.name,
  subnet_id: azurermSubnetExample.id,
});
const azurermStorageAccountExample = new azurerm.storageAccount.StorageAccount(
  this,
  "example_10",
  {
    account_kind: "StorageV2",
    account_replication_type: "LRS",
    account_tier: "Standard",
    allow_nested_items_to_be_public: false,
    identity: [
      {
        type: "SystemAssigned",
      },
    ],
    location: azurermResourceGroupExample.location,
    name: "examplesa",
    network_rules: [
      {
        bypass: ["AzureServices"],
        default_action: "Deny",
        ip_rules: ["127.0.0.1"],
        virtual_network_subnet_ids: [azurermSubnetExample.id],
      },
    ],
    resource_group_name: azurermResourceGroupExample.name,
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermStorageAccountExample.overrideLogicalId("example");
const azurermMssqlServerMicrosoftSupportAuditingPolicyExample =
  new azurerm.mssqlServerMicrosoftSupportAuditingPolicy.MssqlServerMicrosoftSupportAuditingPolicy(
    this,
    "example_11",
    {
      blob_storage_endpoint: azurermStorageAccountExample.primaryBlobEndpoint,
      depends_on: [
        `\${${azurermRoleAssignmentExample.fqn}}`,
        `\${${azurermStorageAccountExample.fqn}}`,
      ],
      log_monitoring_enabled: false,
      server_id: azurermMssqlServerExample.id,
      storage_account_subscription_id:
        "${azurerm_subscription.primary.subscription_id}",
    }
  );
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermMssqlServerMicrosoftSupportAuditingPolicyExample.overrideLogicalId(
  "example"
);

Arguments Reference

The following arguments are supported:

  • serverId - (Required) The ID of the SQL Server to set the extended auditing policy. Changing this forces a new resource to be created.

  • enabled - (Optional) Whether to enable the extended auditing policy. Possible values are true and false. Defaults to true.

->NOTE: If enabled is true, blobStorageEndpoint or logMonitoringEnabled are required.

  • blobStorageEndpoint - (Optional) The blob storage endpoint (e.g. https://example.blob.core.windows.net). This blob storage will hold all Microsoft support auditing logs.

  • storageAccountAccessKey - (Optional) The access key to use for the auditing storage account.

  • logMonitoringEnabled - (Optional) Enable audit events to Azure Monitor? To enable server audit events to Azure Monitor, please enable its main database audit events to Azure Monitor. Defaults to true.

  • storageAccountSubscriptionId - (Optional) The ID of the Subscription containing the Storage Account.

Attributes Reference

In addition to the Arguments listed above - the following Attributes are exported:

  • id - The ID of the MS SQL Server Microsoft Support Auditing Policy.

Timeouts

The timeouts block allows you to specify timeouts for certain actions:

  • create - (Defaults to 30 minutes) Used when creating the MS SQL Server Microsoft Support Auditing Policy.
  • read - (Defaults to 5 minutes) Used when retrieving the MS SQL Server Microsoft Support Auditing Policy.
  • update - (Defaults to 30 minutes) Used when updating the MS SQL Server Microsoft Support Auditing Policy.
  • delete - (Defaults to 30 minutes) Used when deleting the MS SQL Server Microsoft Support Auditing Policy.

Import

MS SQL Server Microsoft Support Auditing Policies can be imported using the resourceId, e.g.

terraform import azurerm_mssql_server_microsoft_support_auditing_policy.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.Sql/servers/sqlServer1/devOpsAuditingSettings/default