Repository: pagopa/io-infra
Pull request #1481: Change APIM with DX module
Author: login: mamu0
Created: 2025-03-24T09:49:06Z | Merged: 2025-03-26T08:42:59Z

### Motivation and Context

<!--- Why is this change required? What problem does it solve? -->

- Enhanced Maintainability: The new APIM module structure provides better organization and clearer separation of concerns.
- Simplified Configuration: Reduced complexity in configuration files with more intuitive parameter naming and defaults.
- Standardization: Aligned with organizational best practices by using the DX team module.

### Major Changes

<!--- Describe the major changes introduced by this PR -->

- APIM Module Replacement: Replaced the existing API Management module with the one developed by the DX team.

### Dependencies

<!--- If this PR depends on or is related to other PRs, 
list them here using the GitHub syntax: `depends on #123` -->
depends on #1484 

### Testing

<!--- Describe the testing steps you have performed -->
<!--- and/or if this PR is already (partially) applied and why -->

### Documentation

<!--- Are there any updates to the documentation? -->

### Other Considerations

<!--- Any additional context, such as breaking changes, security concerns, etc. -->
Resolves: CES-744



Diff:
diff --git a/src/common/_modules/apim/data.tf b/src/common/_modules/apim/data.tf
index 8eb4d346d..153e9ee8e 100644
--- a/src/common/_modules/apim/data.tf
+++ b/src/common/_modules/apim/data.tf
@@ -13,21 +13,6 @@ data "azurerm_key_vault_certificate" "api_app_internal_io_pagopa_it" {
   key_vault_id = var.key_vault.id
 }
 
-data "azurerm_private_dns_zone" "azure_api_net" {
-  name                = "azure-api.net"
-  resource_group_name = "io-p-rg-common"
-}
-
-data "azurerm_private_dns_zone" "management_azure_api_net" {
-  name                = "management.azure-api.net"
-  resource_group_name = "io-p-rg-common"
-}
-
-data "azurerm_private_dns_zone" "scm_azure_api_net" {
-  name                = "scm.azure-api.net"
-  resource_group_name = "io-p-rg-common"
-}
-
 data "azurerm_linux_web_app" "cgn_pe_backend_app_01" {
   provider = azurerm.prod-cgn
 
diff --git a/src/common/_modules/apim/locals.tf b/src/common/_modules/apim/locals.tf
index 7e8b19a25..edf121f02 100644
--- a/src/common/_modules/apim/locals.tf
+++ b/src/common/_modules/apim/locals.tf
@@ -1,13 +1,4 @@
 locals {
-  nonstandard = {
-    weu = {
-      snet_name = "apimv2api"
-      nsg_name  = "${var.project}-apim-v2-nsg"
-      pip_name  = "${var.project}-apim-v2-public-ip"
-      apim_name = "${var.project}-apim-v2-api"
-    }
-  }
-
   apim_hostname_api_internal     = "api-internal.io.italia.it"
   apim_hostname_api_app_internal = "api-app.internal.io.pagopa.it"
 }
diff --git a/src/common/_modules/apim/main.tf b/src/common/_modules/apim/main.tf
index 2895854de..bf06657a8 100644
--- a/src/common/_modules/apim/main.tf
+++ b/src/common/_modules/apim/main.tf
@@ -1,20 +1,35 @@
-module "apim_v2" {
-  source = "github.com/pagopa/terraform-azurerm-v4//api_management?ref=v1.23.3"
+module "apim" {
+  source  = "pagopa-dx/azure-api-management/azurerm"
+  version = "~> 1.1"
+
+  environment = {
+    prefix          = var.prefix
+    env_short       = "p"
+    location        = var.location
+    app_name        = "apim"
+    instance_number = "01"
+  }
+
+  resource_group_name = var.resource_group_internal
+  tier                = "l"
 
-  subnet_id                 = azurerm_subnet.apim.id
-  location                  = var.location
-  name                      = try(local.nonstandard[var.location_short].apim_name, "${var.project}-apim-01")
-  resource_group_name       = var.resource_group_internal
-  publisher_name            = "IO"
   publisher_email           = data.azurerm_key_vault_secret.apim_publisher_email.value
+  publisher_name            = "IO"
   notification_sender_email = data.azurerm_key_vault_secret.apim_publisher_email.value
-  sku_name                  = "Premium_2"
-  virtual_network_type      = "Internal"
-  zones                     = ["1", "2"]
-  min_api_version           = var.min_api_version
 
-  redis_cache_id       = null
-  public_ip_address_id = azurerm_public_ip.apim.id
+  public_ip_address_id         = azurerm_public_ip.apim.id
+  enable_public_network_access = true
+
+  virtual_network = {
+    name                = var.vnet_common.name
+    resource_group_name = var.vnet_common.resource_group_name
+  }
+  private_dns_zone_resource_group_name = "io-p-rg-common"
+
+  subnet_id                     = azurerm_subnet.apim.id
+  virtual_network_type_internal = true
+
+  action_group_id = var.action_group_id
 
   hostname_configuration = {
     proxy = [
@@ -50,10 +65,11 @@ module "apim_v2" {
     portal           = null
   }
 
-  management_logger_applicaiton_insight_enabled = true
   application_insights = {
     enabled             = true
-    instrumentation_key = var.ai_instrumentation_key
+    connection_string   = var.ai_connection_string
+    sampling_percentage = 5.0
+    verbosity           = "error"
   }
 
   autoscale = {
@@ -71,13 +87,6 @@ module "apim_v2" {
     scale_in_cooldown             = "PT5M"
   }
 
-  action = [
-    {
-      action_group_id    = var.action_group_id
-      webhook_properties = null
-    }
-  ]
-
   # https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/metrics-supported#microsoftapimanagementservice
   metric_alerts = {
     capacity = {
diff --git a/src/common/_modules/apim/networking.tf b/src/common/_modules/apim/networking.tf
index a88a96478..90e8321e5 100644
--- a/src/common/_modules/apim/networking.tf
+++ b/src/common/_modules/apim/networking.tf
@@ -1,5 +1,5 @@
 resource "azurerm_subnet" "apim" {
-  name                 = try(local.nonstandard[var.location_short].snet_name, "${var.project}-apim-snet-01")
+  name                 = "${var.project}-apim-snet-01"
   resource_group_name  = var.vnet_common.resource_group_name
   virtual_network_name = var.vnet_common.name
   address_prefixes     = [var.cidr_subnet]
@@ -11,33 +11,8 @@ resource "azurerm_subnet" "apim" {
   ]
 }
 
-resource "azurerm_network_security_group" "apim" {
-  name                = try(local.nonstandard[var.location_short].nsg_name, "${var.project}-apim-nsg-01")
-  resource_group_name = var.resource_group_common
-  location            = var.location
-
-  security_rule {
-    name                       = "managementapim"
-    priority                   = 100
-    direction                  = "Inbound"
-    access                     = "Allow"
-    protocol                   = "Tcp"
-    source_port_range          = "*"
-    destination_port_range     = "3443"
-    source_address_prefix      = "ApiManagement"
-    destination_address_prefix = "VirtualNetwork"
-  }
-
-  tags = var.tags
-}
-
-resource "azurerm_subnet_network_security_group_association" "apim" {
-  subnet_id                 = azurerm_subnet.apim.id
-  network_security_group_id = azurerm_network_security_group.apim.id
-}
-
 resource "azurerm_public_ip" "apim" {
-  name                = try(local.nonstandard[var.location_short].pip_name, "${var.project}-apim-pip-01")
+  name                = "${var.project}-apim-pip-01"
   resource_group_name = var.resource_group_common
   location            = var.location
   allocation_method   = "Static"
@@ -45,37 +20,5 @@ resource "azurerm_public_ip" "apim" {
   domain_name_label   = "apimio"
   zones               = ["1", "2", "3"]
 
-  tags = var.tags
-}
-
-# Define the A Records for APIM ITN
-
-resource "azurerm_private_dns_a_record" "apim_azure_api_net" {
-  name                = module.apim_v2.name
-  zone_name           = data.azurerm_private_dns_zone.azure_api_net.name
-  resource_group_name = "io-p-rg-common"
-  ttl                 = 3600
-  records             = module.apim_v2.private_ip_addresses
-
-  tags = var.tags
-}
-
-resource "azurerm_private_dns_a_record" "apim_management_azure_api_net" {
-  name                = module.apim_v2.name
-  zone_name           = data.azurerm_private_dns_zone.management_azure_api_net.name
-  resource_group_name = "io-p-rg-common"
-  ttl                 = 3600
-  records             = module.apim_v2.private_ip_addresses
-
-  tags = var.tags
-}
-
-resource "azurerm_private_dns_a_record" "apim_scm_azure_api_net" {
-  name                = module.apim_v2.name
-  zone_name           = data.azurerm_private_dns_zone.scm_azure_api_net.name
-  resource_group_name = "io-p-rg-common"
-  ttl                 = 3600
-  records             = module.apim_v2.private_ip_addresses
-
   tags = var.tags
 }
\ No newline at end of file
diff --git a/src/common/_modules/apim/outputs.tf b/src/common/_modules/apim/outputs.tf
index f850ad6ef..b6119b1df 100644
--- a/src/common/_modules/apim/outputs.tf
+++ b/src/common/_modules/apim/outputs.tf
@@ -16,9 +16,9 @@ output "public_ip" {
 }
 
 output "private_ips" {
-  value = module.apim_v2.private_ip_addresses
+  value = module.apim.private_ip_addresses
 }
 
 output "id" {
-  value = module.apim_v2.id
+  value = module.apim.id
 }
\ No newline at end of file
diff --git a/src/common/_modules/apim/rbac.tf b/src/common/_modules/apim/rbac.tf
index dd78c082f..33c56b7c6 100644
--- a/src/common/_modules/apim/rbac.tf
+++ b/src/common/_modules/apim/rbac.tf
@@ -1,7 +1,7 @@
-resource "azurerm_key_vault_access_policy" "apim_v2_kv_policy" {
+resource "azurerm_key_vault_access_policy" "apim_kv_policy" {
   key_vault_id = var.key_vault.id
   tenant_id    = var.datasources.azurerm_client_config.tenant_id
-  object_id    = module.apim_v2.principal_id
+  object_id    = module.apim.principal_id
 
   key_permissions         = []
   secret_permissions      = ["Get", "List"]
@@ -9,10 +9,10 @@ resource "azurerm_key_vault_access_policy" "apim_v2_kv_policy" {
   storage_permissions     = []
 }
 
-resource "azurerm_key_vault_access_policy" "v2_common" {
+resource "azurerm_key_vault_access_policy" "common" {
   key_vault_id = var.key_vault_common.id
   tenant_id    = var.datasources.azurerm_client_config.tenant_id
-  object_id    = module.apim_v2.principal_id
+  object_id    = module.apim.principal_id
 
   key_permissions         = []
   secret_permissions      = ["Get", "List"]
@@ -28,8 +28,8 @@ module "iam_adgroup_wallet_admins" {
 
   apim = [
     {
-      name                = module.apim_v2.name
-      resource_group_name = module.apim_v2.resource_group_name
+      name                = module.apim.name
+      resource_group_name = module.apim.resource_group_name
       role                = "owner"
     }
   ]
@@ -43,8 +43,8 @@ module "iam_adgroup_com_admins" {
 
   apim = [
     {
-      name                = module.apim_v2.name
-      resource_group_name = module.apim_v2.resource_group_name
+      name                = module.apim.name
+      resource_group_name = module.apim.resource_group_name
       role                = "owner"
     }
   ]
@@ -58,8 +58,8 @@ module "iam_adgroup_svc_admins" {
 
   apim = [
     {
-      name                = module.apim_v2.name
-      resource_group_name = module.apim_v2.resource_group_name
+      name                = module.apim.name
+      resource_group_name = module.apim.resource_group_name
       role                = "owner"
     }
   ]
@@ -73,8 +73,8 @@ module "iam_adgroup_auth_admins" {
 
   apim = [
     {
-      name                = module.apim_v2.name
-      resource_group_name = module.apim_v2.resource_group_name
+      name                = module.apim.name
+      resource_group_name = module.apim.resource_group_name
       role                = "owner"
     }
   ]
@@ -88,8 +88,8 @@ module "iam_adgroup_bonus_admins" {
 
   apim = [
     {
-      name                = module.apim_v2.name
-      resource_group_name = module.apim_v2.resource_group_name
+      name                = module.apim.name
+      resource_group_name = module.apim.resource_group_name
       role                = "owner"
     }
   ]
@@ -103,8 +103,8 @@ module "iam_cgn_pe_backend_app_01" {
 
   apim = [
     {
-      name                = module.apim_v2.name
-      resource_group_name = module.apim_v2.resource_group_name
+      name                = module.apim.name
+      resource_group_name = module.apim.resource_group_name
       role                = "owner"
     }
   ]
diff --git a/src/common/_modules/apim/variables.tf b/src/common/_modules/apim/variables.tf
index 9b4dec0f5..2d9f623fe 100644
--- a/src/common/_modules/apim/variables.tf
+++ b/src/common/_modules/apim/variables.tf
@@ -58,7 +58,7 @@ variable "action_group_id" {
   type = string
 }
 
-variable "ai_instrumentation_key" {
+variable "ai_connection_string" {
   type = string
 }
 variable "key_vault" {
@@ -84,12 +84,6 @@ variable "datasources" {
   description = "Common datasources"
 }
 
-variable "migration" {
-  type        = bool
-  default     = false
-  description = "Specify if it is a migration"
-}
-
 variable "azure_adgroup_wallet_admins_object_id" {
   type        = string
   description = "Object Id of the Entra group for subscription admins"
@@ -113,10 +107,4 @@ variable "azure_adgroup_auth_admins_object_id" {
 variable "azure_adgroup_bonus_admins_object_id" {
   type        = string
   description = "Object Id of the Entra group for subscription admins"
-}
-
-variable "min_api_version" {
-  type        = string
-  description = "(Optional) Minimum API version"
-  default     = null
 }
\ No newline at end of file
diff --git a/src/common/prod/italynorth.tf b/src/common/prod/italynorth.tf
index 51f3d3448..a5bb0bfb3 100644
--- a/src/common/prod/italynorth.tf
+++ b/src/common/prod/italynorth.tf
@@ -44,14 +44,12 @@ module "private_endpoints" {
 module "apim_itn" {
   source = "../_modules/apim"
 
-  migration               = true
   location                = "italynorth"
   location_short          = local.core.resource_groups.italynorth.location_short
   project                 = local.project_itn
   prefix                  = local.prefix
   resource_group_common   = local.resource_groups.itn.common
   resource_group_internal = local.resource_groups.itn.internal
-  min_api_version         = "2021-08-01"
 
   vnet_common = local.core.networking.itn.vnet_common
   cidr_subnet = "10.20.100.0/24"
@@ -63,8 +61,8 @@ module "apim_itn" {
   key_vault        = local.core.key_vault.weu.kv
   key_vault_common = local.core.key_vault.weu.kv_common
 
-  action_group_id        = module.monitoring_weu.action_groups.error
-  ai_instrumentation_key = module.monitoring_weu.appi_instrumentation_key
+  action_group_id      = module.monitoring_weu.action_groups.error
+  ai_connection_string = module.monitoring_weu.appi_connection_string
 
   azure_adgroup_wallet_admins_object_id = data.azuread_group.wallet_admins.object_id
   azure_adgroup_com_admins_object_id    = data.azuread_group.com_admins.object_id
diff --git a/src/common/prod/main.tf b/src/common/prod/main.tf
index 9865ad577..b4ccea0a0 100644
--- a/src/common/prod/main.tf
+++ b/src/common/prod/main.tf
@@ -19,4 +19,48 @@ terraform {
 provider "azurerm" {
   features {}
   storage_use_azuread = true
+}
+
+moved {
+  from = module.apim_itn.azurerm_network_security_group.apim
+  to   = module.apim_itn.module.apim.azurerm_network_security_group.nsg_apim
+}
+
+moved {
+  from = module.apim_itn.azurerm_subnet_network_security_group_association.apim
+  to   = module.apim_itn.module.apim.azurerm_subnet_network_security_group_association.snet_nsg
+}
+moved {
+  from = module.apim_itn.azurerm_private_dns_a_record.apim_azure_api_net
+  to   = module.apim_itn.module.apim.azurerm_private_dns_a_record.apim_azure_api_net
+}
+
+moved {
+  from = module.apim_itn.azurerm_private_dns_a_record.apim_management_azure_api_net
+  to   = module.apim_itn.module.apim.azurerm_private_dns_a_record.apim_management_azure_api_net
+}
+
+moved {
+  from = module.apim_itn.azurerm_private_dns_a_record.apim_scm_azure_api_net
+  to   = module.apim_itn.module.apim.azurerm_private_dns_a_record.apim_scm_azure_api_net
+}
+
+moved {
+  from = module.apim_itn.azurerm_key_vault_access_policy.apim_v2_kv_policy
+  to   = module.apim_itn.azurerm_key_vault_access_policy.apim_kv_policy
+}
+
+moved {
+  from = module.apim_itn.azurerm_key_vault_access_policy.v2_common
+  to   = module.apim_itn.azurerm_key_vault_access_policy.common
+}
+
+moved {
+  from = module.apim_itn.module.apim_v2
+  to   = module.apim_itn.module.apim
+}
+
+moved {
+  from = module.apim_itn.module.apim.azurerm_api_management_diagnostic.this[0]
+  to   = module.apim_itn.module.apim.azurerm_api_management_diagnostic.applicationinsights[0]
 }
\ No newline at end of file
diff --git a/src/common/prod/tfmodules.lock.json b/src/common/prod/tfmodules.lock.json
index 617fd6d53..28f2511a2 100644
--- a/src/common/prod/tfmodules.lock.json
+++ b/src/common/prod/tfmodules.lock.json
@@ -15,5 +15,7 @@
   "cosmos_api_weu.cosno_api_svc_devs": "52ca57b72bdf639846a472014cb2113d519bdc00dc4a642e925b97ad6b99d25c",
   "assets_cdn_weu.roles_svc_devs": "52ca57b72bdf639846a472014cb2113d519bdc00dc4a642e925b97ad6b99d25c",
   "github_runner_itn.container_app_github_runner": "55bb10f7c1f708ebfaeb0b9e8e5b550c9b29d62164bb81a189adebd0d0cb25c1",
-  "github_runner_itn.container_app_github_runner.naming_convention": "5b1d21788783dcf33e17a9842f9f7c874c8c5f736c82e70979eb9c8785a74ce4"
+  "github_runner_itn.container_app_github_runner.naming_convention": "5b1d21788783dcf33e17a9842f9f7c874c8c5f736c82e70979eb9c8785a74ce4",
+  "apim_itn.apim": "303103dc823c88aef01f89e4c1000d6c170c7cc1aa4b0adb1290eed11410216a",
+  "apim_itn.apim.naming_convention": "5b1d21788783dcf33e17a9842f9f7c874c8c5f736c82e70979eb9c8785a74ce4"
 }


Reviews:
user: login: Krusty93
body: **suggestion**: I strongly suggest to create two different PRs
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T10:25:28Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T15:28:46Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T15:29:58Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T15:30:25Z
user: login: Krusty93
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T15:32:20Z
user: login: mamu0
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T17:06:10Z
user: login: christian-calabrese
body: LGTM!
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T17:12:14Z

Review comments:
diff_hunk: @@ -1,20 +1,35 @@
 module "apim_v2" {
-  source = "github.com/pagopa/terraform-azurerm-v4//api_management?ref=v1.23.3"
+  source  = "pagopa-dx/azure-api-management/azurerm"
+  version = "~> 1.1"
+
+  environment = {
+    prefix          = var.prefix
+    env_short       = "p"
+    location        = var.location
+    app_name        = "apim"
+    instance_number = "01"
+  }
+
+  resource_group_name = var.resource_group_internal
+  tier                = "l"
 
-  subnet_id                 = azurerm_subnet.apim.id
-  location                  = var.location
-  name                      = try(local.nonstandard[var.location_short].apim_name, "${var.project}-apim-01")
-  resource_group_name       = var.resource_group_internal
-  publisher_name            = "IO"
   publisher_email           = data.azurerm_key_vault_secret.apim_publisher_email.value
+  publisher_name            = "IO"
   notification_sender_email = data.azurerm_key_vault_secret.apim_publisher_email.value
-  sku_name                  = "Premium_2"
-  virtual_network_type      = "Internal"
-  zones                     = ["1", "2"]
-  min_api_version           = var.min_api_version
path: src/common/_modules/apim/main.tf
user: login: Krusty93
body: variable `min_api_version` can be removed from this submodule
created_at: 2025-03-25T15:28:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -12,7 +12,7 @@ resource "azurerm_subnet" "apim" {
 }
 
 resource "azurerm_network_security_group" "apim" {
path: src/common/_modules/apim/networking.tf
user: login: Krusty93
body: Isn't this available in the [module](https://github.com/pagopa/dx/blob/2e0a35f3a2c23218fb85c8e9b1b9d19d345c5870/infra/modules/azure_api_management/network.tf#L34)?
created_at: 2025-03-25T15:29:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,20 +1,35 @@
 module "apim_v2" {
-  source = "github.com/pagopa/terraform-azurerm-v4//api_management?ref=v1.23.3"
+  source  = "pagopa-dx/azure-api-management/azurerm"
+  version = "~> 1.1"
+
+  environment = {
+    prefix          = var.prefix
+    env_short       = "p"
+    location        = var.location
+    app_name        = "apim"
+    instance_number = "01"
+  }
+
+  resource_group_name = var.resource_group_internal
+  tier                = "l"
 
-  subnet_id                 = azurerm_subnet.apim.id
-  location                  = var.location
-  name                      = try(local.nonstandard[var.location_short].apim_name, "${var.project}-apim-01")
-  resource_group_name       = var.resource_group_internal
-  publisher_name            = "IO"
   publisher_email           = data.azurerm_key_vault_secret.apim_publisher_email.value
+  publisher_name            = "IO"
   notification_sender_email = data.azurerm_key_vault_secret.apim_publisher_email.value
-  sku_name                  = "Premium_2"
-  virtual_network_type      = "Internal"
-  zones                     = ["1", "2"]
-  min_api_version           = var.min_api_version
path: src/common/_modules/apim/main.tf
user: login: Krusty93
body: Also `migration`
created_at: 2025-03-25T15:30:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,20 +1,35 @@
 module "apim_v2" {
path: src/common/_modules/apim/main.tf
user: login: Krusty93
body: **suggestion**: update the module name as `v2` lost meaningfulness
created_at: 2025-03-25T15:32:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,20 +1,35 @@
 module "apim_v2" {
path: src/common/_modules/apim/main.tf
user: login: mamu0
body: Done 🚀 [commit](https://github.com/pagopa/io-infra/pull/1481/commits/8aa7b636378eac2ec112d52b84b5f0a408b49b2b)
created_at: 2025-03-25T17:06:10Z
author_association: CONTRIBUTOR

PR comments:
user: login: mamu0
created_at: 2025-03-24T11:20:25Z
body: > **suggestion**: I strongly suggest to create two different PRs

This PR should be reviewed after PR #1484 , which only updates the modules to v4

author_association: CONTRIBUTOR
user: login: Krusty93
created_at: 2025-03-24T14:23:21Z
body: Depends on #1484 ?
author_association: CONTRIBUTOR
user: login: dpulls[bot]
created_at: 2025-03-25T11:44:13Z
body: :tada: All dependencies have been resolved !
author_association: NONE
user: login: sonarqubecloud[bot]
created_at: 2025-03-25T16:58:19Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=pagopa_io-infra&pullRequest=1481) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=pagopa_io-infra&pullRequest=1481&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=pagopa_io-infra&pullRequest=1481&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=pagopa_io-infra&pullRequest=1481&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=pagopa_io-infra&pullRequest=1481&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=pagopa_io-infra&pullRequest=1481&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=pagopa_io-infra&pullRequest=1481)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-25T16:58:59Z
body: #### 📖 Terraform Plan ('src/common/dev') - success
<details>
<summary>Terraform Plan</summary>

```hcl

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.
```

</details>

author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-25T17:01:31Z
body: #### 📖 Terraform Plan ('src/common/prod') - success
<details>
<summary>Terraform Plan</summary>

```hcl
data.azurerm_linux_function_app.function_profile: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [10s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [10s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [10s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [10s elapsed]
data.azurerm_linux_function_app.com_citizen_func: Still reading... [10s elapsed]
data.azurerm_linux_function_app.io_fims_user: Still reading... [10s elapsed]
data.azurerm_linux_function_app.function_profile: Still reading... [20s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [20s elapsed]
data.azurerm_linux_web_app.firmaconio_selfcare_web_app: Still reading... [20s elapsed]
data.azurerm_linux_function_app.eucovidcert: Still reading... [20s elapsed]
data.azurerm_linux_function_app.function_assets_cdn: Still reading... [20s elapsed]
data.azurerm_linux_function_app.wallet_user: Still reading... [20s elapsed]
data.azurerm_linux_function_app.lollipop_function: Still reading... [20s elapsed]
data.azurerm_linux_function_app.services_app_backend_function_app: Still reading... [20s elapsed]
data.azurerm_linux_function_app.com_citizen_func: Still reading... [20s elapsed]
data.azurerm_linux_function_app.io_fims_user: Still reading... [20s elapsed]
data.azurerm_linux_function_app.io_sign_user: Still reading... [30s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_payments_app_itn: Still reading... [11s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_licences_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.fims_op_app: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_practices_app_itn: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.session_manager_03: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.cms_backoffice_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_devportal_be: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_payments_app_itn: Still reading... [21s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_vehicles_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.ipatente_licences_app_itn: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [20s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_continua: Still reading... [20s elapsed]
module.apim_itn.data.azurerm_linux_web_app.cgn_pe_backend_app_01: Still reading... [10s elapsed]
module.application_gateway_weu.data.azurerm_linux_web_app.appservice_selfcare_be: Still reading... [30s elapsed]
module.apim_itn.data.azurerm_linux_web_app.cgn_pe_backend_app_01: Still reading... [20s elapsed]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.apim_itn.azurerm_key_vault_access_policy.apim_v2_kv_policy has moved to module.apim_itn.azurerm_key_vault_access_policy.apim_kv_policy
    resource "azurerm_key_vault_access_policy" "apim_kv_policy" {
        id                      = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-sec-rg/providers/Microsoft.KeyVault/vaults/io-p-kv/objectId/bef9fb72-7a41-44d1-9819-2f0b5020bad6"
        # (8 unchanged attributes hidden)
    }

  # module.apim_itn.azurerm_key_vault_access_policy.v2_common has moved to module.apim_itn.azurerm_key_vault_access_policy.common
    resource "azurerm_key_vault_access_policy" "common" {
        id                      = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.KeyVault/vaults/io-p-kv-common/objectId/bef9fb72-7a41-44d1-9819-2f0b5020bad6"
        # (8 unchanged attributes hidden)
    }

  # module.application_gateway_weu.azurerm_web_application_firewall_policy.api_app will be updated in-place
  ~ resource "azurerm_web_application_firewall_policy" "api_app" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-external/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/io-p-waf-appgateway-api-app-policy"
        name                = "io-p-waf-appgateway-api-app-policy"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (4 unchanged attributes hidden)

      ~ policy_settings {
          ~ request_body_enforcement                  = false -> true
          ~ request_body_inspect_limit_in_kb          = 0 -> 128
            # (7 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.apim_itn.module.apim_v2.azurerm_api_management.this has moved to module.apim_itn.module.apim.azurerm_api_management.this
    resource "azurerm_api_management" "this" {
        id                            = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01"
        name                          = "io-p-itn-apim-01"
        tags                          = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (21 unchanged attributes hidden)

        # (9 unchanged blocks hidden)
    }

  # module.apim_itn.module.apim_v2.azurerm_api_management_diagnostic.this[0] has moved to module.apim_itn.module.apim.azurerm_api_management_diagnostic.applicationinsights[0]
    resource "azurerm_api_management_diagnostic" "applicationinsights" {
        id                        = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/diagnostics/applicationinsights"
        # (10 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.apim_itn.module.apim.azurerm_api_management_logger.this[0] will be updated in-place
  # (moved from module.apim_itn.module.apim_v2.azurerm_api_management_logger.this[0])
  ~ resource "azurerm_api_management_logger" "this" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/loggers/io-p-itn-apim-01-logger"
        name                = "io-p-itn-apim-01-logger"
        # (5 unchanged attributes hidden)

      ~ application_insights {
          + connection_string   = (sensitive value)
          - instrumentation_key = (sensitive value) -> null
        }
    }

  # module.apim_itn.module.apim.azurerm_monitor_autoscale_setting.this[0] must be replaced
  # (moved from module.apim_itn.module.apim_v2.azurerm_monitor_autoscale_setting.this[0])
-/+ resource "azurerm_monitor_autoscale_setting" "this" {
      ~ id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Insights/autoScaleSettings/io-p-itn-apim-01-autoscale" -> (known after apply)
      ~ name                = "io-p-itn-apim-01-autoscale" -> "io-p-itn-apim-as-01" # forces replacement
      - tags                = {} -> null
        # (4 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.apim_itn.module.apim_v2.azurerm_monitor_metric_alert.this["capacity"] has moved to module.apim_itn.module.apim.azurerm_monitor_metric_alert.this["capacity"]
    resource "azurerm_monitor_metric_alert" "this" {
        id                       = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Insights/metricAlerts/io-p-itn-apim-01-CAPACITY"
        name                     = "io-p-itn-apim-01-CAPACITY"
        tags                     = {}
        # (10 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.apim_itn.module.apim_v2.azurerm_monitor_metric_alert.this["duration"] has moved to module.apim_itn.module.apim.azurerm_monitor_metric_alert.this["duration"]
    resource "azurerm_monitor_metric_alert" "this" {
        id                       = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Insights/metricAlerts/io-p-itn-apim-01-DURATION"
        name                     = "io-p-itn-apim-01-DURATION"
        tags                     = {}
        # (10 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.apim_itn.module.apim_v2.azurerm_monitor_metric_alert.this["requests_failed"] has moved to module.apim_itn.module.apim.azurerm_monitor_metric_alert.this["requests_failed"]
    resource "azurerm_monitor_metric_alert" "this" {
        id                       = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Insights/metricAlerts/io-p-itn-apim-01-REQUESTS_FAILED"
        name                     = "io-p-itn-apim-01-REQUESTS_FAILED"
        tags                     = {}
        # (10 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.apim_itn.azurerm_network_security_group.apim has moved to module.apim_itn.module.apim.azurerm_network_security_group.nsg_apim
    resource "azurerm_network_security_group" "nsg_apim" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Network/networkSecurityGroups/io-p-itn-apim-nsg-01"
        name                = "io-p-itn-apim-nsg-01"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (3 unchanged attributes hidden)
    }

  # module.apim_itn.azurerm_private_dns_a_record.apim_azure_api_net has moved to module.apim_itn.module.apim.azurerm_private_dns_a_record.apim_azure_api_net
    resource "azurerm_private_dns_a_record" "apim_azure_api_net" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/privateDnsZones/azure-api.net/A/io-p-itn-apim-01"
        name                = "io-p-itn-apim-01"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (5 unchanged attributes hidden)
    }

  # module.apim_itn.azurerm_private_dns_a_record.apim_management_azure_api_net has moved to module.apim_itn.module.apim.azurerm_private_dns_a_record.apim_management_azure_api_net
    resource "azurerm_private_dns_a_record" "apim_management_azure_api_net" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/privateDnsZones/management.azure-api.net/A/io-p-itn-apim-01"
        name                = "io-p-itn-apim-01"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (5 unchanged attributes hidden)
    }

  # module.apim_itn.azurerm_private_dns_a_record.apim_scm_azure_api_net has moved to module.apim_itn.module.apim.azurerm_private_dns_a_record.apim_scm_azure_api_net
    resource "azurerm_private_dns_a_record" "apim_scm_azure_api_net" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/privateDnsZones/scm.azure-api.net/A/io-p-itn-apim-01"
        name                = "io-p-itn-apim-01"
        tags                = {
            "BusinessUnit"   = "App IO"
            "CostCenter"     = "TS000 - Tecnologia e Servizi"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Platform"
            "Source"         = "https://github.com/pagopa/io-infra/blob/main/src/common/prod"
        }
        # (5 unchanged attributes hidden)
    }

  # module.apim_itn.azurerm_subnet_network_security_group_association.apim has moved to module.apim_itn.module.apim.azurerm_subnet_network_security_group_association.snet_nsg
    resource "azurerm_subnet_network_security_group_association" "snet_nsg" {
        id                        = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.Network/virtualNetworks/io-p-itn-common-vnet-01/subnets/io-p-itn-apim-snet-01"
        # (2 unchanged attributes hidden)
    }

Plan: 1 to add, 2 to change, 1 to destroy.

Warning: Argument is deprecated

  with module.assets_cdn_weu.module.assets_cdn.azurerm_storage_account.this,
  on .terraform/modules/assets_cdn_weu.assets_cdn/storage_account/main.tf line 2, in resource "azurerm_storage_account" "this":
   2: resource "azurerm_storage_account" "this" {

this block has been deprecated and superseded by the
`azurerm_storage_account_static_website` resource and will be removed in v5.0
of the AzureRM provider

(and 18 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.
```

</details>

author_association: NONE
user: login: christian-calabrese
created_at: 2025-03-25T17:10:53Z
body: Amazing 🚀
author_association: CONTRIBUTOR