Support for configuring public access for mysql_flexible_server

[JBodkin-Amphora]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Currently public_network_access_enabled is set to computed, hence the value cannot be configured. This value can be configured when using public access connectivity method, to disable public access and use private link instead.

I think these are the required changes but I can't run the acceptance tests to check.
JBodkin-Amphora@41bc37d

New or Affected Resource(s)/Data Source(s)

azurerm_mysql_flexible_server

Potential Terraform Configuration

resource "mysql_flexible_server" "this" {
  public_network_access_enabled = false
}

References

No response

[serbezki]

Also facing this problem. And I also can't find a workaround? We have to manually go and disable that.

[JoshHester]

@serbezki Hello! 🙋‍♂️ This is certainly not ideal, but a quick work-around I've been using while figuring out this resource is using a null_resource{} with a local-exec provisioner to just run the Azure CLI command needed to toggle this setting.

For example, at the end of my main.tf, I have a block that looks like this:

resource "null_resource" "disable_public_access" {
  depends_on = [azurerm_mysql_flexible_server.mysql_server]

  provisioner "local-exec" {
    command = "az mysql flexible-server update --name ${azurerm_mysql_flexible_server.mysql_server.name} --resource-group ${azurerm_mysql_flexible_server.mysql_server.resource_group_name} --public-access Disabled"
  }

When it all gets done running, the Flexible server is there, and Public Access is disabled as expected.

I understand that doing any local-exec stuff isn't usually recommended for security and other reasons, but my configuration is pretty simple and low-stakes presently; so, it's fine for now. 🤷‍♂️

Hopefully they'll get this baked into the module proper, but until then, hopefully this helps!

[clowa]

+1

There are ways to set the checkbox of Allow public access from any Azure service within Azure to this server via azurerm_mysql_flexible_server_firewall_rule (see #21832). However, there is no known option to disable Allow public access to this resource through the internet using a public IP address checkbox.

[clowa]

@JBodkin-Amphora I found a method by using the Azure/azapi provider, that could help as a temporary workaround as long as the azurerm provider doesn't support this directly.

resource "azapi_resource_action" "allow_public_network_access" {
  type        = "Microsoft.DBforMySQL/flexibleServers@2023-06-30"
  resource_id = azurerm_mysql_flexible_server.this.id
  method      = "PATCH"

  body = {
    properties = {
      network = {
        publicNetworkAccess = var.allow_public_network_access ? "Enabled" : "Disabled"
      }
    }
  }
}

[JBodkin-Amphora]

We have a Azure Policy (from caf-enterprise-scale) in-place to prevent the creation of resources with public access, hence why I would like the ability to configure this in azurerm_mysql_flexible_server. At the moment, we temporarily disable the policy whilst setting up the resource for the first time.

[github-actions]

This functionality has been released in v3.105.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[kingsleyadam]

Fyi @tombuildsstuff, this doesn't seem to be completed. This seems to have been added to azurerm_postgresql_flexible_server but not azurerm_mysql_flexible_server, can this be re-opened?

[kingsleyadam]

Reopened with new issue #26156