Skip to content

Azure SQL Database configuration parameters and module #273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ramirezmorac2 wants to merge 1 commit into from
Closed

Azure SQL Database configuration parameters and module #273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 40 additions & 4 deletions infra/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -406,9 +406,27 @@ var dbAccountName = !empty(azureDbAccountName) ? azureDbAccountName : 'dbgpt0-${
@description('Cosmos DB Database Name. Use your own name convention or leave as it is to generate a random name.')
param azureDbDatabaseName string = ''
var dbDatabaseName = !empty(azureDbDatabaseName) ? azureDbDatabaseName : 'db0-${resourceToken}'
@description('Azure SQL Server Name.')
param azureSqlServerName string = ''
var sqlServerName = !empty(azureSqlServerName) ? azureSqlServerName : 'sqlgpt0-${resourceToken}'
@description('Azure SQL Database Name.')
param azureSqlDatabaseName string = ''
var sqlDatabaseName = !empty(azureSqlDatabaseName) ? azureSqlDatabaseName : 'sqldb0-${resourceToken}'
@description('Azure SQL administrator login name.')
param azureSqlAdministratorLogin string = 'sqladmin'
@description('Azure SQL administrator password.')
@secure()
param azureSqlAdministratorPassword string
@description('Key Vault secret name to store the Azure SQL administrator password.')
param azureSqlAdminSecretName string = 'sqlAdminPassword'
@description('Public network access setting for Azure SQL Server.')
@allowed(['Enabled', 'Disabled'])
param azureSqlPublicNetworkAccess string = 'Enabled'
@description('Log Analytics Workspace Name. Use your own name convention or leave as it is to generate a random name.')
param azureLogAnalyticsWorkspaceName string = ''
var logAnalyticsWorkspaceName = !empty(azureLogAnalyticsWorkspaceName) ? azureLogAnalyticsWorkspaceName : 'law0-${resourceToken}'
var logAnalyticsWorkspaceName = !empty(azureLogAnalyticsWorkspaceName)
? azureLogAnalyticsWorkspaceName
: 'law0-${resourceToken}'
@description('Enable PartitionKeyRUConsumption logs for multi-tenant billing')
param enablePartitionKeyRUConsumption bool = true
@description('Key Vault Name. Use your own name convention or leave as it is to generate a random name.')
Expand Down Expand Up @@ -954,6 +972,22 @@ module keyVault './core/security/keyvault.bicep' = {
}
}

module sqlServer './core/db/sqlserver.bicep' = {
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description still contains placeholders (e.g., "[Describe your changes here]") and the checklist isn’t filled out. Please update the description with the intended behavior/rollout notes and confirm test/validation steps for the new Azure SQL deployment.

Copilot uses AI. Check for mistakes.
name: 'sqlserver'
scope: resourceGroup
params: {
name: sqlServerName
location: location
tags: tags
administratorLogin: azureSqlAdministratorLogin
administratorLoginPassword: azureSqlAdministratorPassword
databaseName: sqlDatabaseName
keyVaultName: keyVault.outputs.name
publicNetworkAccess: azureSqlPublicNetworkAccess
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

networkIsolation is used elsewhere to disable public access and configure private endpoints, but the new SQL module is always deployed and doesn’t follow that pattern (no conditional public access / private endpoint wiring here). In a network-isolated deployment this can undermine isolation if public access stays enabled, or break connectivity if it’s disabled without private link. Consider aligning SQL with the existing networkIsolation approach or making SQL deployment conditional based on networkIsolation.

Suggested change
publicNetworkAccess: azureSqlPublicNetworkAccess
publicNetworkAccess: networkIsolation ? 'Disabled' : azureSqlPublicNetworkAccess

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new sqlServer module invocation here deploys ./core/db/sqlserver.bicep, which defines a Microsoft.Sql/servers/firewallRules resource named AllowAllAzureServices with startIpAddress set to 0.0.0.0 and endIpAddress set to 255.255.255.255. Combined with publicNetworkAccess defaulting to Enabled both here (azureSqlPublicNetworkAccess) and in the module, this effectively exposes the Azure SQL Server to all IPv4 addresses on the public internet, significantly increasing the risk of unauthorized access or brute-force attacks against the administratorLogin. To mitigate this, tighten the SQL firewall to only trusted IP ranges or disable publicNetworkAccess and use private endpoints/network isolation, and remove or replace the "allow all" firewall rule in sqlserver.bicep with a more restrictive configuration.

Suggested change
publicNetworkAccess: azureSqlPublicNetworkAccess
publicNetworkAccess: 'Disabled'

Copilot uses AI. Check for mistakes.
secretName: azureSqlAdminSecretName
}
}

module keyvaultpe './core/network/private-endpoint.bicep' = if (networkIsolation) {
name: 'keyvaultpe'
scope: resourceGroup
Expand Down Expand Up @@ -1523,7 +1557,7 @@ module frontEnd 'core/host/appservice.bicep' = {
{
name: 'USER_FEEDBACK_URL'
value: userFeedbackUrl
}
}
{
name: 'ANTHROPIC_API_KEY'
value: orchestratorAnthropicApiKeyVar
Expand Down Expand Up @@ -1649,7 +1683,7 @@ module dataIngestion './core/host/functions.bicep' = {
value: 'text-embedding-3-small'
}
{
name:'FORM_REC_API_VERSION'
name: 'FORM_REC_API_VERSION'
value: '2024-11-30'
}
{
Expand Down Expand Up @@ -1685,7 +1719,7 @@ module dataIngestion './core/host/functions.bicep' = {
value: 'INFO'
}
{
name:'COGNITIVE_SERVICES_KEY'
name: 'COGNITIVE_SERVICES_KEY'
value: cognitiveServices.outputs.key
}
{
Expand Down Expand Up @@ -2118,6 +2152,8 @@ output AZURE_RESOURCE_GROUP_NAME string = azureResourceGroupName
output AZURE_NETWORK_ISOLATION bool = networkIsolation
output AZURE_DB_ACCOUNT_NAME string = azureDbAccountName
output AZURE_DB_DATABASE_NAME string = azureDbDatabaseName
output AZURE_SQL_SERVER_NAME string = sqlServerName
output AZURE_SQL_DATABASE_NAME string = sqlDatabaseName
output AZURE_STORAGE_ACCOUNT_NAME string = storageAccountName
output AZURE_COGNITIVE_SERVICE_NAME string = azureCognitiveServiceName
output AZURE_APP_SERVICE_PLAN_NAME string = azureAppServicePlanName
Expand Down
18 changes: 18 additions & 0 deletions infra/main.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,24 @@
"azureDbDatabaseName": {
"value": "${AZURE_DB_DATABASE_NAME}"
},
"azureSqlServerName": {
"value": ""
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

azureSqlServerName is hard-coded to an empty string. This is inconsistent with other resource name parameters (which are populated from env vars) and prevents persisting the SQL server name across azd env refresh / redeploys. Consider mapping this to an env var (e.g., AZURE_SQL_SERVER_NAME, optionally with an empty default).

Suggested change
"value": ""
"value": "${AZURE_SQL_SERVER_NAME}"

Copilot uses AI. Check for mistakes.
},
"azureSqlDatabaseName": {
"value": ""
Comment on lines +54 to +57
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

azureSqlDatabaseName is hard-coded to an empty string. Like azureSqlServerName, this should likely be mapped from an env var (e.g., AZURE_SQL_DATABASE_NAME) so the chosen/generated name is stable across refresh/redeploys.

Suggested change
"value": ""
},
"azureSqlDatabaseName": {
"value": ""
"value": "${AZURE_SQL_SERVER_NAME}"
},
"azureSqlDatabaseName": {
"value": "${AZURE_SQL_DATABASE_NAME}"

Copilot uses AI. Check for mistakes.
},
"azureSqlAdministratorLogin": {
"value": "${AZURE_SQL_ADMIN_LOGIN=sqladmin}"
},
"azureSqlAdministratorPassword": {
"value": "$(secretOrRandomPassword ${AZURE_KEY_VAULT_NAME} ${AZURE_SQL_ADMIN_SECRET_NAME=sqlAdminPassword})"
},
"azureSqlAdminSecretName": {
"value": "${AZURE_SQL_ADMIN_SECRET_NAME=sqlAdminPassword}"
},
"azureSqlPublicNetworkAccess": {
"value": "${AZURE_SQL_PUBLIC_NETWORK_ACCESS=Enabled}"
},
"azureLogAnalyticsWorkspaceName": {
"value": "${AZURE_LOG_ANALYTICS_WORKSPACE_NAME}"
},
Expand Down