Repository: pagopa/io-infra
Pull request #1484: Update modules in `common` with terraform v4
Author: login: mamu0
Created: 2025-03-24T11:17:33Z | Merged: 2025-03-25T11:44:10Z

### Motivation and Context

<!--- Why is this change required? What problem does it solve? -->
To prepare the configuration for DX modules you need to update your terraform version to v4

### Major Changes

<!--- Describe the major changes introduced by this PR -->

- Terraform Modules Update in common: Migrated all modules to Terraform version 4 to leverage the latest features and improvements.

### Dependencies

<!--- If this PR depends on or is related to other PRs, 
list them here using the GitHub syntax: `depends on #123` -->

### Testing

<!--- Describe the testing steps you have performed -->
<!--- and/or if this PR is already (partially) applied and why -->

### Documentation

<!--- Are there any updates to the documentation? -->

### Other Considerations

<!--- Any additional context, such as breaking changes, security concerns, etc. -->
Resolves: CES-634



Diff:
diff --git a/src/common/_modules/apim/main.tf b/src/common/_modules/apim/main.tf
index 00356b1cb..2895854de 100644
--- a/src/common/_modules/apim/main.tf
+++ b/src/common/_modules/apim/main.tf
@@ -1,5 +1,5 @@
 module "apim_v2" {
-  source = "github.com/pagopa/terraform-azurerm-v3//api_management?ref=v8.85.0"
+  source = "github.com/pagopa/terraform-azurerm-v4//api_management?ref=v1.23.3"
 
   subnet_id                 = azurerm_subnet.apim.id
   location                  = var.location
@@ -151,4 +151,4 @@ module "apim_v2" {
   }
 
   tags = var.tags
-}
+}
\ No newline at end of file
diff --git a/src/common/_modules/apim/variables.tf b/src/common/_modules/apim/variables.tf
index 99b096599..9b4dec0f5 100644
--- a/src/common/_modules/apim/variables.tf
+++ b/src/common/_modules/apim/variables.tf
@@ -61,7 +61,6 @@ variable "action_group_id" {
 variable "ai_instrumentation_key" {
   type = string
 }
-
 variable "key_vault" {
   type = object({
     id                  = string
diff --git a/src/common/_modules/app_backend/main.tf b/src/common/_modules/app_backend/main.tf
index 406dad9a4..f77b0466c 100644
--- a/src/common/_modules/app_backend/main.tf
+++ b/src/common/_modules/app_backend/main.tf
@@ -1,10 +1,11 @@
 module "appservice_app_backend" {
-  source = "github.com/pagopa/terraform-azurerm-v3//app_service?ref=v8.31.0"
+  source = "github.com/pagopa/terraform-azurerm-v4//app_service?ref=v1.23.3"
 
   # App service plan
-  plan_type = "internal"
-  plan_name = try(local.nonstandard[var.location_short].asp, "${var.project}-appbe-${var.name}-asp-01")
-  sku_name  = var.plan_sku
+  plan_type                       = "internal"
+  plan_name                       = try(local.nonstandard[var.location_short].asp, "${var.project}-appbe-${var.name}-asp-01")
+  sku_name                        = var.plan_sku
+  premium_plan_auto_scale_enabled = var.enable_premium_plan_autoscale
 
   # App service
   name                = try(local.nonstandard[var.location_short].app, "${var.project}-appbe-${var.name}-app-01")
@@ -45,7 +46,7 @@ module "appservice_app_backend" {
 }
 
 module "appservice_app_backend_slot_staging" {
-  source = "github.com/pagopa/terraform-azurerm-v3//app_service_slot?ref=v8.31.0"
+  source = "github.com/pagopa/terraform-azurerm-v4//app_service_slot?ref=v1.23.3"
 
   # App service plan
   app_service_id   = module.appservice_app_backend.id
@@ -56,10 +57,11 @@ module "appservice_app_backend_slot_staging" {
   resource_group_name = var.resource_group_linux
   location            = var.location
 
-  always_on         = true
-  node_version      = "20-lts"
-  app_command_line  = local.app_command_line
-  health_check_path = "/ping"
+  always_on                    = true
+  node_version                 = "20-lts"
+  app_command_line             = local.app_command_line
+  health_check_path            = "/ping"
+  health_check_maxpingfailures = 2
 
   auto_heal_enabled = var.is_li ? false : true # for li is disabled
   auto_heal_settings = var.is_li ? null : {
diff --git a/src/common/_modules/app_backend/variables.tf b/src/common/_modules/app_backend/variables.tf
index 5ca202816..98f92693b 100644
--- a/src/common/_modules/app_backend/variables.tf
+++ b/src/common/_modules/app_backend/variables.tf
@@ -228,3 +228,10 @@ variable "azure_adgroup_bonus_admins_object_id" {
   type        = string
   description = "Object Id of the Entra group for subscription admins"
 }
+
+variable "enable_premium_plan_autoscale" {
+  type        = bool
+  description = "Enable autoscale for premium plan"
+  default     = false
+
+}
\ No newline at end of file
diff --git a/src/common/_modules/application_gateway/firewall.tf b/src/common/_modules/application_gateway/firewall.tf
index 173bf8676..2748bda70 100644
--- a/src/common/_modules/application_gateway/firewall.tf
+++ b/src/common/_modules/application_gateway/firewall.tf
@@ -19,63 +19,126 @@ resource "azurerm_web_application_firewall_policy" "api_app" {
 
       rule_group_override {
         rule_group_name = "REQUEST-913-SCANNER-DETECTION"
-        disabled_rules = [
-          "913100",
-          "913101",
-          "913102",
-          "913110",
-          "913120",
-        ]
+        rule {
+          id      = "913100"
+          enabled = false
+        }
+        rule {
+          id      = "913101"
+          enabled = false
+        }
+        rule {
+          id      = "913102"
+          enabled = false
+        }
+        rule {
+          id      = "913110"
+          enabled = false
+        }
+        rule {
+          id      = "913120"
+          enabled = false
+        }
       }
 
       rule_group_override {
         rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT"
-        disabled_rules = [
-          "920300",
-          "920320",
-        ]
+        rule {
+          id      = "920300"
+          enabled = false
+        }
+        rule {
+          id      = "920320"
+          enabled = false
+        }
       }
 
       rule_group_override {
         rule_group_name = "REQUEST-930-APPLICATION-ATTACK-LFI"
-        disabled_rules = [
-          "930120",
-        ]
+        rule {
+          id      = "930120"
+          enabled = false
+        }
       }
 
       rule_group_override {
         rule_group_name = "REQUEST-932-APPLICATION-ATTACK-RCE"
-        disabled_rules = [
-          "932150",
-        ]
+        rule {
+          id      = "932150"
+          enabled = false
+        }
       }
 
       rule_group_override {
         rule_group_name = "REQUEST-941-APPLICATION-ATTACK-XSS"
-        disabled_rules = [
-          "941130",
-        ]
+        rule {
+          id      = "941130"
+          enabled = false
+        }
       }
 
       rule_group_override {
         rule_group_name = "REQUEST-942-APPLICATION-ATTACK-SQLI"
-        disabled_rules = [
-          "942100",
-          "942120",
-          "942190",
-          "942200",
-          "942210",
-          "942240",
-          "942250",
-          "942260",
-          "942330",
-          "942340",
-          "942370",
-          "942380",
-          "942430",
-          "942440",
-          "942450",
-        ]
+        rule {
+          id      = "942100"
+          enabled = false
+        }
+        rule {
+          id      = "942120"
+          enabled = false
+        }
+        rule {
+          id      = "942190"
+          enabled = false
+        }
+        rule {
+          id      = "942200"
+          enabled = false
+        }
+        rule {
+          id      = "942210"
+          enabled = false
+        }
+        rule {
+          id      = "942240"
+          enabled = false
+        }
+        rule {
+          id      = "942250"
+          enabled = false
+        }
+        rule {
+          id      = "942260"
+          enabled = false
+        }
+        rule {
+          id      = "942330"
+          enabled = false
+        }
+        rule {
+          id      = "942340"
+          enabled = false
+        }
+        rule {
+          id      = "942370"
+          enabled = false
+        }
+        rule {
+          id      = "942380"
+          enabled = false
+        }
+        rule {
+          id      = "942430"
+          enabled = false
+        }
+        rule {
+          id      = "942440"
+          enabled = false
+        }
+        rule {
+          id      = "942450"
+          enabled = false
+        }
       }
 
     }
diff --git a/src/common/_modules/application_gateway/main.tf b/src/common/_modules/application_gateway/main.tf
index fc20159e3..ed4eb3b99 100644
--- a/src/common/_modules/application_gateway/main.tf
+++ b/src/common/_modules/application_gateway/main.tf
@@ -1,6 +1,6 @@
 ## Application gateway ##
 module "app_gw" {
-  source = "github.com/pagopa/terraform-azurerm-v3//app_gateway?ref=v8.31.0"
+  source = "github.com/pagopa/terraform-azurerm-v4//app_gateway?ref=v1.23.3"
 
   resource_group_name = var.resource_group_external
   location            = var.location
diff --git a/src/common/_modules/assets_cdn/main.tf b/src/common/_modules/assets_cdn/main.tf
index f4d598178..2212293d1 100644
--- a/src/common/_modules/assets_cdn/main.tf
+++ b/src/common/_modules/assets_cdn/main.tf
@@ -1,5 +1,5 @@
 module "assets_cdn" {
-  source = "github.com/pagopa/terraform-azurerm-v3//storage_account?ref=v8.27.0"
+  source = "github.com/pagopa/terraform-azurerm-v4//storage_account?ref=v1.23.3"
 
   name                            = replace(try(local.nonstandard[var.location_short].st, "${var.project}-assets-st-01"), "-", "")
   account_kind                    = "StorageV2"
diff --git a/src/common/_modules/cosmos_api/cosmos_account.tf b/src/common/_modules/cosmos_api/cosmos_account.tf
index 9b2b8f3a0..0ecc9227b 100644
--- a/src/common/_modules/cosmos_api/cosmos_account.tf
+++ b/src/common/_modules/cosmos_api/cosmos_account.tf
@@ -3,11 +3,12 @@ resource "azurerm_cosmosdb_account" "this" {
   resource_group_name = var.resource_group_internal
   location            = "westeurope"
 
-  offer_type        = "Standard"
-  free_tier_enabled = false
+  offer_type          = "Standard"
+  free_tier_enabled   = false
+  minimal_tls_version = "Tls"
 
   automatic_failover_enabled = false
-  ip_range_filter            = join(",", local.ip_range_filter)
+  ip_range_filter            = local.ip_range_filter
 
   geo_location {
     location          = "italynorth"
diff --git a/src/common/_modules/cosmos_api/cosmos_containers.tf b/src/common/_modules/cosmos_api/cosmos_containers.tf
index 323eb8afb..1dd456b06 100644
--- a/src/common/_modules/cosmos_api/cosmos_containers.tf
+++ b/src/common/_modules/cosmos_api/cosmos_containers.tf
@@ -7,7 +7,7 @@ resource "azurerm_cosmosdb_sql_container" "these" {
   account_name  = azurerm_cosmosdb_account.this.name
   database_name = azurerm_cosmosdb_sql_database.db.name
 
-  partition_key_path    = each.value.partition_key_path
+  partition_key_paths   = [each.value.partition_key_path]
   partition_key_version = lookup(each.value, "partition_key_version", 2)
   throughput            = lookup(each.value, "throughput", null)
   default_ttl           = lookup(each.value, "default_ttl", null)
diff --git a/src/common/_modules/cosmos_api/locals.tf b/src/common/_modules/cosmos_api/locals.tf
index bb1e48117..7986e11f0 100644
--- a/src/common/_modules/cosmos_api/locals.tf
+++ b/src/common/_modules/cosmos_api/locals.tf
@@ -1,5 +1,5 @@
 locals {
-  ip_range_filter = ["52.174.88.118", "40.91.208.65", "13.69.64.208/28", "13.69.71.192/27", "13.93.36.78", "20.86.93.32/27", "20.86.93.64/28", "20.126.243.151", "20.126.241.238", "20.103.132.139", "20.103.131.1"]
+  ip_range_filter = toset(["52.174.88.118", "40.91.208.65", "13.69.64.208/28", "13.69.71.192/27", "13.93.36.78", "20.86.93.32/27", "20.86.93.64/28", "20.126.243.151", "20.126.241.238", "20.103.132.139", "20.103.131.1"])
   cosmosdb_containers = [
     {
       name                  = "activations"
diff --git a/src/common/_modules/event_hubs/main.tf b/src/common/_modules/event_hubs/main.tf
index ff2ff1db1..b73bdad8c 100644
--- a/src/common/_modules/event_hubs/main.tf
+++ b/src/common/_modules/event_hubs/main.tf
@@ -6,17 +6,16 @@ resource "azurerm_resource_group" "event_rg" {
 }
 
 module "eventhub_snet" {
-  source                                    = "github.com/pagopa/terraform-azurerm-v3//subnet?ref=v8.35.0"
-  name                                      = try(local.nonstandard[var.location_short].evh-snet, "${var.project}-evh-snet-01")
-  address_prefixes                          = var.cidr_subnet
-  resource_group_name                       = var.resource_group_common
-  virtual_network_name                      = var.vnet_common.name
-  service_endpoints                         = ["Microsoft.EventHub"]
-  private_endpoint_network_policies_enabled = false
+  source               = "github.com/pagopa/terraform-azurerm-v4//subnet?ref=v1.23.3"
+  name                 = try(local.nonstandard[var.location_short].evh-snet, "${var.project}-evh-snet-01")
+  address_prefixes     = var.cidr_subnet
+  resource_group_name  = var.resource_group_common
+  virtual_network_name = var.vnet_common.name
+  service_endpoints    = ["Microsoft.EventHub"]
 }
 
 module "event_hub" {
-  source              = "github.com/pagopa/terraform-azurerm-v3//eventhub?ref=v8.35.0"
+  source              = "github.com/pagopa/terraform-azurerm-v4//eventhub?ref=v1.23.3"
   name                = try(local.nonstandard[var.location_short].evh-ns, "${var.project}-evhns-01")
   location            = var.location
   resource_group_name = azurerm_resource_group.event_rg.name
@@ -26,7 +25,6 @@ module "event_hub" {
   sku                      = var.sku_name
   capacity                 = var.capacity
   maximum_throughput_units = var.maximum_throughput_units
-  zone_redundant           = var.zone_redundant
   private_endpoint_created = false
 
   virtual_network_ids = [var.vnet_common.id]
diff --git a/src/common/_modules/event_hubs/variables.tf b/src/common/_modules/event_hubs/variables.tf
index 2ea828f5d..1115d2ea9 100644
--- a/src/common/_modules/event_hubs/variables.tf
+++ b/src/common/_modules/event_hubs/variables.tf
@@ -86,12 +86,6 @@ variable "auto_inflate_enabled" {
   default     = true
 }
 
-variable "zone_redundant" {
-  type        = bool
-  description = "Specifies if the EventHub Namespace should be Zone Redundant (created across Availability Zones)."
-  default     = true
-}
-
 variable "eventhubs" {
   description = "A list of event hubs to add to namespace."
   type = list(object({
diff --git a/src/common/_modules/monitoring/appi.tf b/src/common/_modules/monitoring/appi.tf
index d003db622..5fcc232ac 100644
--- a/src/common/_modules/monitoring/appi.tf
+++ b/src/common/_modules/monitoring/appi.tf
@@ -1,9 +1,10 @@
 resource "azurerm_application_insights" "appi" {
-  name                = try(local.nonstandard[var.location_short].appi, "${var.project}-appi-01")
-  location            = var.location
-  resource_group_name = var.resource_group_common
-  disable_ip_masking  = true
-  application_type    = "other"
+  name                 = try(local.nonstandard[var.location_short].appi, "${var.project}-appi-01")
+  location             = var.location
+  resource_group_name  = var.resource_group_common
+  disable_ip_masking   = true
+  application_type     = "other"
+  daily_data_cap_in_gb = 300
 
   workspace_id = azurerm_log_analytics_workspace.log.id
 
diff --git a/src/common/_modules/redis/storage_account.tf b/src/common/_modules/redis/storage_account.tf
index e6f78aa91..0aa7a4a4e 100644
--- a/src/common/_modules/redis/storage_account.tf
+++ b/src/common/_modules/redis/storage_account.tf
@@ -1,5 +1,5 @@
 module "redis_common_backup_zrs" {
-  source = "github.com/pagopa/terraform-azurerm-v3//storage_account?ref=v8.27.0"
+  source = "github.com/pagopa/terraform-azurerm-v4//storage_account?ref=v1.23.3"
 
   name                            = try(local.nonstandard[var.location_short].storage_account, "${var.project}-redis-common-st-01")
   account_kind                    = "StorageV2"
diff --git a/src/common/prod/.terraform.lock.hcl b/src/common/prod/.terraform.lock.hcl
index 4b1e9bfe7..b9a0a87bc 100644
--- a/src/common/prod/.terraform.lock.hcl
+++ b/src/common/prod/.terraform.lock.hcl
@@ -2,47 +2,47 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/azuread" {
-  version = "3.1.0"
+  version = "3.2.0"
   hashes = [
-    "h1:QY/V8YuAw2phme+ryKEbZ/9B+Xi7SfXAOVr4uBoRqpk=",
-    "h1:UmSL7MD8ULg/WlRgwisD5lHsjcg9l8AO7AeO0XN96dU=",
-    "h1:sBGDtSwT8Cz4NLBdR+LPPZW0L7kEIzOyvPDjv31COMw=",
-    "h1:ukyPZG2fnTkWoeOizY2c5s5OyOKIwNkkNdBtgnK9W60=",
-    "zh:01b796cf12e93cc811cb15c8465605e75de170802060f9e2fe114835968960dd",
-    "zh:12005fbffb84467ff1d4ce9317370834d1279743bc201d3db95f36315cdf8157",
+    "h1:35w1gIXyoEkMb2iBNOpI0gJPkQlReEBfaNTEJo3BACI=",
+    "h1:DciAAiQWGJK0FR+2Qe/O/NwukMs6nLtVqv19BQY6hU4=",
+    "h1:u/P26g3e4j5QM2i6VkYLFbmMhHlj76kvGfhJQ23BT9Q=",
+    "h1:wvXGU1TWdZFvPy6fJTjJEDwRe13a496hZouLsUkt5po=",
+    "zh:063897b38fd6231577c21a751ccd955716bca0e3abcf800a90dd1dd50fb24875",
+    "zh:19704c38c0cf229dc663e36a3ea53649780b7b5ec3953febbc95d7cb5e1cde27",
     "zh:1c3e89cf19118fc07d7b04257251fc9897e722c16e0a0df7b07fcd261f8c12e7",
-    "zh:1daf7d4ade44e69593488c1f6571b4fbdaf01ec41538207de1f12609b3830907",
-    "zh:386965c0529ed083b94968c25441385378d8643a5748591b221e6d6d3cea4dbc",
-    "zh:46ede0628c300c6d584135daa93733400b9ce968d8aebb3f925d904b3fcfa781",
-    "zh:7af453bf5217e1818ca5c2126edb8fe573c85f17a0557415a3bc7ae92a8652f5",
-    "zh:b6014600409715ca37aa85ddb066698f592b7d104f09c12a68d45c5b00404272",
-    "zh:bca84d10cd1e805e6d31a888eb6737a96aee14e1b5b919dee73d2a5a8ff85beb",
-    "zh:bd7d6e6c2a086bafdeeb33d5d4f919a8789ef3acf1a0baf2b8ea43996b96c213",
-    "zh:e5b7840b1b9d90c3f6be9a59400b7d0580376415a79aa740eba7f97bf35c25ef",
-    "zh:e94e114b205de36d60bc17a3758f9c4bfc6b01e63be81ae1d9699f9bf9650362",
+    "zh:463c9351c86d161b6c81efd3109d45acec45f4269bf0180a589073eb5ab6b3e1",
+    "zh:54a1962e9f998f3725d801274fb8e0a1a6ad194e50f599d586aca265ed193934",
+    "zh:64fafb076204728168a3c369b9412a0c58ee44ac3175d79611626725e812e73a",
+    "zh:7283c00ca13c7e1a5d2976884a314daed6dea7e5e99e33d8f99eda28b277c12a",
+    "zh:95a564a55d2ed8cac1299577f7b1671e0f9d13c0429f5e321deabadb0740efed",
+    "zh:a325b5c5ea1a8188ad51c4d3ffea76362895bc4749c613e2ec5ac807b3ede902",
+    "zh:b3d58bb47fdb747734fdefef8bb7d08ae45fd8634792d839043ae326f333b33e",
+    "zh:da1b6043e5615f767b9685ab4cfdffc04e1b5ca808c7c004d83bac75cbc8f465",
+    "zh:fd5eb49039b7787a1133cbb9f2ba6b0183de10e7ba95aaaaebdee7b50e40c6d9",
   ]
 }
 
 provider "registry.terraform.io/hashicorp/azurerm" {
-  version     = "3.116.0"
-  constraints = "~> 3.30, ~> 3.33, ~> 3.76, ~> 3.95, != 3.97.0, != 3.97.1, >= 3.110.0, <= 3.116.0, < 5.0.0"
+  version     = "4.24.0"
+  constraints = ">= 3.110.0, ~> 4.0, >= 4.1.0, < 5.0.0"
   hashes = [
-    "h1:2QbjtN4oMXzdA++Nvrj/wSmWZTPgXKOSFGGQCLEMrb4=",
-    "h1:BCR3NIorFSvGG3v/+JOiiw3VM4PkChLO4m84wzD9NDo=",
-    "h1:SJM/KQDW9blKFmLMaupsZVYtcZ0fYpjLHEriMgCBGCY=",
-    "h1:jwwbQ09fH1RdcNsknt1AkvfSUbULsl7nZQn6S8fabFI=",
-    "zh:02b6606aff025fc2a962b3e568e000300abe959adac987183c24dac8eb057f4d",
-    "zh:2a23a8ce24ff9e885925ffee0c3ea7eadba7a702541d05869275778aa47bdea7",
-    "zh:57d10746384baeca4d5c56e88872727cdc150f437b8c5e14f0542127f7475e24",
-    "zh:59e3ebde1a2e1e094c671e179f231ead60684390dbf02d2b1b7fe67a228daa1a",
-    "zh:5f1f5c7d09efa2ee8ddf21bd9efbbf8286f6e90047556bef305c062fa0ac5880",
-    "zh:a40646aee3c9907276dab926e6123a8d70b1e56174836d4c59a9992034f88d70",
-    "zh:c21d40461bc5836cf56ad3d93d2fc47f61138574a55e972ad5ff1cb73bab66dc",
-    "zh:c56fb91a5ae66153ba0f737a26da1b3d4f88fdef7d41c63e06c5772d93b26953",
-    "zh:d1e60e85f51d12fc150aeab8e31d3f18f859c32f927f99deb5b74cb1e10087aa",
-    "zh:ed35e727e7d79e687cd3d148f52b442961ede286e7c5b4da1dcd9f0128009466",
+    "h1:3DzTW6k/otWNhyqEt3I5CnyOfu4VY96k//Ri2rJmtsw=",
+    "h1:HPGpRzmaAhrguNcDn25r1RAu4h0d4b2lq6MTIxiTw6w=",
+    "h1:N2nB3s9xiZ93Wb5XVJZmv8dfv6oBUpJyk+gKYugt+os=",
+    "h1:QKLE+6C8K98qAoah9gY6H6twDjpFmujoJsw/uMAGp5Y=",
+    "zh:26cebd201fad0c361e757d8552208106b70fd8dbca3668229ae4eb92fcd69d20",
+    "zh:33e8929ef07dd515a93027d35b77ad28b9a9fa915d824c028e0df75bcd7ad18a",
+    "zh:3de012cfbb0e993826a4715a9b94908ab87e48f45a72b2ae87dc770bba1a38bc",
+    "zh:4d3fd7c389a1768e15ef0ad78fbf2c560d35284fcfb8196d775466bffe4aa8ca",
+    "zh:88b8979d73ea7f2361df4ae26b64202fac44c0bc1291d8cd4ffb9a605f99d35b",
+    "zh:95ebe18507cf32fe7cdbc3b8c69f78541be9511070a60d3d925e3ef4df7d7b20",
+    "zh:9ad4bd9262be7e6ea933ae3ce4696c86129be6b44c44a605e748ef95c897ea76",
+    "zh:a54609ff7eddf2b0eed9ae67e33c5fcdf94aa838a49d06052bbe632ed5453a91",
+    "zh:a6bdff023a0d9bc15fadda37b23202ec0f5d6fbb66013dcb70a9ad0f162a86f5",
+    "zh:cc4c82f23b2fe55126b06c719a8285ecf2cb9dd10b89c7a22af047f940c262e5",
+    "zh:ed32a4e66aaabb7fa919800a3fdb27bc3181844765f1109824af3a542b84bbf7",
     "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-    "zh:f6d2a4e7c58f44e7d04a4a9c73f35ed452f412c97c85def68c4b52814cbe03ab",
   ]
 }
 
diff --git a/src/common/prod/README.md b/src/common/prod/README.md
index 351424d43..ffb74d79e 100644
--- a/src/common/prod/README.md
+++ b/src/common/prod/README.md
@@ -4,14 +4,14 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | <= 3.116.0 |
+| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~> 4.1 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 3.1.0 |
-| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 3.116.0 |
+| <a name="provider_azuread"></a> [azuread](#provider\_azuread) | 3.2.0 |
+| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | 4.24.0 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
diff --git a/src/common/prod/main.tf b/src/common/prod/main.tf
index 0d1bd5e29..9865ad577 100644
--- a/src/common/prod/main.tf
+++ b/src/common/prod/main.tf
@@ -11,7 +11,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "<= 3.116.0"
+      version = "~> 4.1"
     }
   }
 }
@@ -19,9 +19,4 @@ terraform {
 provider "azurerm" {
   features {}
   storage_use_azuread = true
-}
-
-import {
-  to = module.storage_accounts.azurerm_storage_account.exportdata_weu_01
-  id = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-operations/providers/Microsoft.Storage/storageAccounts/iopstexportdata"
-}
+}
\ No newline at end of file
diff --git a/src/common/prod/tfmodules.lock.json b/src/common/prod/tfmodules.lock.json
index 1670bcf36..617fd6d53 100644
--- a/src/common/prod/tfmodules.lock.json
+++ b/src/common/prod/tfmodules.lock.json
@@ -14,6 +14,6 @@
   "cosmos_api_weu.cosno_api_svc_admins": "52ca57b72bdf639846a472014cb2113d519bdc00dc4a642e925b97ad6b99d25c",
   "cosmos_api_weu.cosno_api_svc_devs": "52ca57b72bdf639846a472014cb2113d519bdc00dc4a642e925b97ad6b99d25c",
   "assets_cdn_weu.roles_svc_devs": "52ca57b72bdf639846a472014cb2113d519bdc00dc4a642e925b97ad6b99d25c",
-  "github_runner_itn.container_app_github_runner": "3014cb4eada2f01f26c3cc513ab02b0fad36f73bdcea3198db51453b44f1fa67",
+  "github_runner_itn.container_app_github_runner": "55bb10f7c1f708ebfaeb0b9e8e5b550c9b29d62164bb81a189adebd0d0cb25c1",
   "github_runner_itn.container_app_github_runner.naming_convention": "5b1d21788783dcf33e17a9842f9f7c874c8c5f736c82e70979eb9c8785a74ce4"
 }
diff --git a/src/common/prod/westeurope.tf b/src/common/prod/westeurope.tf
index e607a856e..16d9185d9 100644
--- a/src/common/prod/westeurope.tf
+++ b/src/common/prod/westeurope.tf
@@ -426,14 +426,15 @@ module "app_backend_weu" {
   name  = "l${each.key}"
   index = each.key
 
-  vnet_common                = local.core.networking.weu.vnet_common
-  cidr_subnet                = each.value.cidr_subnet
-  nat_gateways               = local.core.networking.weu.nat_gateways
-  allowed_subnets            = concat(data.azurerm_subnet.services_snet.*.id, [module.application_gateway_weu.snet.id, module.apim_itn.snet.id])
-  slot_allowed_subnets       = concat([local.azdoa_snet_id["weu"]], data.azurerm_subnet.services_snet.*.id, [module.application_gateway_weu.snet.id, module.apim_itn.snet.id, module.github_runner_itn.subnet.id])
-  allowed_ips                = module.monitoring_weu.appi.reserved_ips
-  slot_allowed_ips           = module.monitoring_weu.appi.reserved_ips
-  apim_snet_address_prefixes = module.apim_itn.snet.address_prefixes
+  vnet_common                   = local.core.networking.weu.vnet_common
+  cidr_subnet                   = each.value.cidr_subnet
+  nat_gateways                  = local.core.networking.weu.nat_gateways
+  allowed_subnets               = concat(data.azurerm_subnet.services_snet.*.id, [module.application_gateway_weu.snet.id, module.apim_itn.snet.id])
+  slot_allowed_subnets          = concat([local.azdoa_snet_id["weu"]], data.azurerm_subnet.services_snet.*.id, [module.application_gateway_weu.snet.id, module.apim_itn.snet.id, module.github_runner_itn.subnet.id])
+  allowed_ips                   = module.monitoring_weu.appi.reserved_ips
+  slot_allowed_ips              = module.monitoring_weu.appi.reserved_ips
+  apim_snet_address_prefixes    = module.apim_itn.snet.address_prefixes
+  enable_premium_plan_autoscale = true
 
   backend_hostnames = local.backend_hostnames
 


Reviews:
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T14:20:31Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T14:20:44Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T14:20:54Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T14:21:29Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T14:21:42Z
user: login: mamu0
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T14:32:21Z
user: login: christian-calabrese
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T11:33:34Z

Review comments:
diff_hunk: @@ -6,17 +6,17 @@ resource "azurerm_resource_group" "event_rg" {
 }
 
 module "eventhub_snet" {
-  source                                    = "github.com/pagopa/terraform-azurerm-v3//subnet?ref=v8.35.0"
-  name                                      = try(local.nonstandard[var.location_short].evh-snet, "${var.project}-evh-snet-01")
-  address_prefixes                          = var.cidr_subnet
-  resource_group_name                       = var.resource_group_common
-  virtual_network_name                      = var.vnet_common.name
-  service_endpoints                         = ["Microsoft.EventHub"]
-  private_endpoint_network_policies_enabled = false
+  source               = "github.com/pagopa/terraform-azurerm-v4//subnet?ref=v1.23.0" # "github.com/pagopa/terraform-azurerm-v3//subnet?ref=v8.35.0"
path: src/common/_modules/event_hubs/main.tf
user: login: Krusty93
body: ```suggestion
  source               = "github.com/pagopa/terraform-azurerm-v4//subnet?ref=v1.23.0"
```
created_at: 2025-03-24T14:20:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -6,17 +6,17 @@ resource "azurerm_resource_group" "event_rg" {
 }
 
 module "eventhub_snet" {
-  source                                    = "github.com/pagopa/terraform-azurerm-v3//subnet?ref=v8.35.0"
-  name                                      = try(local.nonstandard[var.location_short].evh-snet, "${var.project}-evh-snet-01")
-  address_prefixes                          = var.cidr_subnet
-  resource_group_name                       = var.resource_group_common
-  virtual_network_name                      = var.vnet_common.name
-  service_endpoints                         = ["Microsoft.EventHub"]
-  private_endpoint_network_policies_enabled = false
+  source               = "github.com/pagopa/terraform-azurerm-v4//subnet?ref=v1.23.0" # "github.com/pagopa/terraform-azurerm-v3//subnet?ref=v8.35.0"
+  name                 = try(local.nonstandard[var.location_short].evh-snet, "${var.project}-evh-snet-01")
+  address_prefixes     = var.cidr_subnet
+  resource_group_name  = var.resource_group_common
+  virtual_network_name = var.vnet_common.name
+  service_endpoints    = ["Microsoft.EventHub"]
+  # private_endpoint_network_policies_enabled = false
path: src/common/_modules/event_hubs/main.tf
user: login: Krusty93
body: ```suggestion
```
created_at: 2025-03-24T14:20:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -26,7 +26,7 @@ module "event_hub" {
   sku                      = var.sku_name
   capacity                 = var.capacity
   maximum_throughput_units = var.maximum_throughput_units
-  zone_redundant           = var.zone_redundant
+  # zone_redundant           = var.zone_redundant
path: src/common/_modules/event_hubs/main.tf
user: login: Krusty93
body: ```suggestion
```
created_at: 2025-03-24T14:20:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -11,7 +11,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "<= 3.116.0"
+      version = ">= 4.1.0, < 5.0.0"
path: src/common/prod/main.tf
user: login: Krusty93
body: ```suggestion
      version = "~> 4.1"
```
created_at: 2025-03-24T14:21:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -24,4 +24,4 @@ provider "azurerm" {
 import {
path: src/common/prod/main.tf
user: login: Krusty93
body: **question**: Can be removed?
created_at: 2025-03-24T14:21:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -24,4 +24,4 @@ provider "azurerm" {
 import {
path: src/common/prod/main.tf
user: login: mamu0
body: I think so
created_at: 2025-03-24T14:32:21Z
author_association: CONTRIBUTOR

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-03-25T10:30:45Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=pagopa_io-infra&pullRequest=1484) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=pagopa_io-infra&pullRequest=1484&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=pagopa_io-infra&pullRequest=1484&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=pagopa_io-infra&pullRequest=1484&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=pagopa_io-infra&pullRequest=1484&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=pagopa_io-infra&pullRequest=1484&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=pagopa_io-infra&pullRequest=1484)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-25T10:31:06Z
body: #### 📖 Terraform Plan ('src/common/dev') - success
<details>
<summary>Terraform Plan</summary>

```hcl

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.
```

</details>

author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-25T10:34:05Z
body: #### 📖 Terraform Plan ('src/common/prod') - success
<details>
<summary>Terraform Plan</summary>

```hcl
module.apim_itn.data.azurerm_linux_web_app.cgn_pe_backend_app_01: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile: Still reading... [10s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [10s elapsed]
data.azurerm_linux_function_app.com_citizen_func: Still reading... [10s elapsed]
module.apim_itn.data.azurerm_linux_web_app.cgn_pe_backend_app_01: Still reading... [20s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [20s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [20s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [20s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_fims_user: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_licences_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_practices_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_payments_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [10s elapsed]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app will be updated in-place
  ~ resource "azurerm_web_application_firewall_policy" "api_app" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-external/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/io-p-waf-appgateway-api-app-policy"
        name                = "io-p-waf-appgateway-api-app-policy"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (4 unchanged attributes hidden)

      ~ policy_settings {
          ~ request_body_enforcement                  = false -> true
          ~ request_body_inspect_limit_in_kb          = 0 -> 128
            # (7 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.apim_itn.module.apim_v2.azurerm_api_management_diagnostic.this[0] will be updated in-place
  ~ resource "azurerm_api_management_diagnostic" "this" {
        id                        = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/diagnostics/applicationinsights"
      - operation_name_format     = "Name" -> null
        # (9 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.assets_cdn_weu.module.assets_cdn.azurerm_storage_account.this,
  on .terraform/modules/assets_cdn_weu.assets_cdn/storage_account/main.tf line 2, in resource "azurerm_storage_account" "this":
   2: resource "azurerm_storage_account" "this" {

this block has been deprecated and superseded by the
`azurerm_storage_account_static_website` resource and will be removed in v5.0
of the AzureRM provider

(and 18 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.
```

</details>

author_association: NONE