Activate Terraform environment releases#1998
Draft
gunzip wants to merge 2 commits into
Draft
Conversation
Wire released environment metadata into release-v2 and opt dev/prod resources into the approval-gated Nx release path while retaining manual legacy workflows for recovery. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
gunzip
temporarily deployed
to
bootstrapper-dev-ci
July 16, 2026 18:40 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
gunzip
temporarily deployed
to
bootstrapper-prod-ci
July 16, 2026 18:40 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
Pin setup-node to the upstream fix that retries provisioning and verifies the requested Node version, preventing jobs from continuing with the runner-baked runtime. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
gunzip
temporarily deployed
to
bootstrapper-prod-ci
July 16, 2026 19:34 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
gunzip
temporarily deployed
to
bootstrapper-dev-ci
July 16, 2026 19:34 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
📋 Pre-commit Output LogGenerated on Thu Jul 16 19:35:51 UTC 2026 |
Contributor
|
Tip ✅ All Terraform module locks are up to dateNo module changes detected - everything is in sync! 📋 Pre-commit Output LogGenerated on Thu Jul 16 19:36:31 UTC 2026 |
Contributor
|
Tip ✅ All Terraform module locks are up to dateNo module changes detected - everything is in sync! 📋 Pre-commit Output LogGenerated on Thu Jul 16 19:36:36 UTC 2026 |
Contributor
Code Review ReportTerraform Plan:
|
Contributor
📖 Terraform Plan (infra/resources/prod) - successShow Plan # module.metrics_portal.module.container_app.azurerm_container_app.this has changed
~ resource "azurerm_container_app" "this" {
id = "/subscriptions/02a23258-2e41-433c-8e9a-465b99e77bca/resourceGroups/dx-p-itn-common-rg-01/providers/Microsoft.App/containerApps/dx-p-itn-metrics-portal-ca-01"
~ latest_revision_fqdn = "dx-p-itn-metrics-portal-ca-01--8peu.gentlesmoke-9b3e8724.italynorth.azurecontainerapps.io" -> "dx-p-itn-metrics-portal-ca-01--ji90.gentlesmoke-9b3e8724.italynorth.azurecontainerapps.io"
name = "dx-p-itn-metrics-portal-ca-01"
tags = {
"CostCenter" = "TS000 - Tecnologia e Servizi"
"CreatedBy" = "Terraform"
"Environment" = "Prod"
"ManagementTeam" = "Developer Experience"
"ModuleName" = "azure_container_app"
"ModuleSource" = "DX"
"ModuleVersion" = "4.2.0"
"Owner" = "DevEx"
"Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/prod"
}
# (9 unchanged attributes hidden)
# (5 unchanged blocks hidden)
}
Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.
─────────────────────────────────────────────────────────────────────────────
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# module.mcp_server.aws_s3_bucket_server_side_encryption_configuration.mcp_knowledge_base will be updated in-place
~ resource "aws_s3_bucket_server_side_encryption_configuration" "mcp_knowledge_base" {
id = "dx-p-euc1-docs-kb-s3-01"
# (3 unchanged attributes hidden)
- rule {
- blocked_encryption_types = [
- "SSE-C",
] -> null
- bucket_key_enabled = false -> null
- apply_server_side_encryption_by_default {
- sse_algorithm = "AES256" -> null
# (1 unchanged attribute hidden)
}
}
+ rule {
+ blocked_encryption_types = []
+ apply_server_side_encryption_by_default {
+ sse_algorithm = "AES256"
# (1 unchanged attribute hidden)
}
}
}
# module.metrics_portal.azurerm_container_app_job.import will be updated in-place
~ resource "azurerm_container_app_job" "import" {
id = "/subscriptions/02a23258-2e41-433c-8e9a-465b99e77bca/resourceGroups/dx-p-itn-common-rg-01/providers/Microsoft.App/jobs/dx-p-itn-metrics-portal-caj-01"
name = "dx-p-itn-metrics-portal-caj-01"
tags = {
"CostCenter" = "TS000 - Tecnologia e Servizi"
"CreatedBy" = "Terraform"
"Environment" = "Prod"
"ManagementTeam" = "Developer Experience"
"Owner" = "DevEx"
"Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/prod"
}
# (8 unchanged attributes hidden)
- secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
- secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
- secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
- secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
+ secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
+ secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
+ secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
+ secret {
# At least one attribute in this block is (or was) sensitive,
# so its contents will not be displayed.
}
# (3 unchanged blocks hidden)
}
# module.metrics_portal.azurerm_key_vault_secret.github_app_private_key will be updated in-place
~ resource "azurerm_key_vault_secret" "github_app_private_key" {
id = "https://dx-p-itn-common-kv-01.vault.azure.net/secrets/dx-metrics-github-app-private-key/23abb2ec910b4ca28c4d43b558a9c7b1"
name = "dx-metrics-github-app-private-key"
~ tags = {
- "file-encoding" = "utf-8" -> null
}
# (11 unchanged attributes hidden)
}
# module.metrics_portal.module.container_app.azapi_resource.managed_certificate[0] will be updated in-place
~ resource "azapi_resource" "managed_certificate" {
id = "/subscriptions/02a23258-2e41-433c-8e9a-465b99e77bca/resourceGroups/dx-p-itn-common-rg-01/providers/Microsoft.App/managedEnvironments/dx-p-itn-common-cae-01/managedCertificates/cert-metrics-dx-pagopa-it"
name = "cert-metrics-dx-pagopa-it"
~ output = {
- id = "/subscriptions/02a23258-2e41-433c-8e9a-465b99e77bca/resourceGroups/dx-p-itn-common-rg-01/providers/Microsoft.App/managedEnvironments/dx-p-itn-common-cae-01/managedCertificates/cert-metrics-dx-pagopa-it"
- properties = {
- provisioningState = "Succeeded"
}
- type = "Microsoft.App/managedEnvironments/managedCertificates"
} -> (known after apply)
+ tags = {
+ "CostCenter" = "TS000 - Tecnologia e Servizi"
+ "CreatedBy" = "Terraform"
+ "Environment" = "Prod"
+ "ManagementTeam" = "Developer Experience"
+ "ModuleName" = "azure_container_app"
+ "ModuleSource" = "DX"
+ "ModuleVersion" = "4.2.2"
+ "Owner" = "DevEx"
+ "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/prod"
}
# (9 unchanged attributes hidden)
}
# module.metrics_portal.module.container_app.azurerm_container_app.this will be updated in-place
~ resource "azurerm_container_app" "this" {
id = "/subscriptions/02a23258-2e41-433c-8e9a-465b99e77bca/resourceGroups/dx-p-itn-common-rg-01/providers/Microsoft.App/containerApps/dx-p-itn-metrics-portal-ca-01"
name = "dx-p-itn-metrics-portal-ca-01"
~ tags = {
"CostCenter" = "TS000 - Tecnologia e Servizi"
"CreatedBy" = "Terraform"
"Environment" = "Prod"
"ManagementTeam" = "Developer Experience"
"ModuleName" = "azure_container_app"
"ModuleSource" = "DX"
~ "ModuleVersion" = "4.2.0" -> "4.2.2"
"Owner" = "DevEx"
"Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/prod"
}
# (10 unchanged attributes hidden)
# (5 unchanged blocks hidden)
}
# module.metrics_portal.module.container_app.azurerm_dns_cname_record.this[0] will be updated in-place
~ resource "azurerm_dns_cname_record" "this" {
id = "/subscriptions/02a23258-2e41-433c-8e9a-465b99e77bca/resourceGroups/dx-p-itn-network-rg-01/providers/Microsoft.Network/dnsZones/dx.pagopa.it/CNAME/metrics"
name = "metrics"
~ tags = {
"CostCenter" = "TS000 - Tecnologia e Servizi"
"CreatedBy" = "Terraform"
"Environment" = "Prod"
"ManagementTeam" = "Developer Experience"
"ModuleName" = "azure_container_app"
"ModuleSource" = "DX"
~ "ModuleVersion" = "4.2.0" -> "4.2.2"
"Owner" = "DevEx"
"Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/prod"
}
# (6 unchanged attributes hidden)
}
# module.metrics_portal.module.container_app.azurerm_dns_txt_record.validation[0] will be updated in-place
~ resource "azurerm_dns_txt_record" "validation" {
id = "/subscriptions/02a23258-2e41-433c-8e9a-465b99e77bca/resourceGroups/dx-p-itn-network-rg-01/providers/Microsoft.Network/dnsZones/dx.pagopa.it/TXT/asuid.metrics"
name = "asuid.metrics"
~ tags = {
"CostCenter" = "TS000 - Tecnologia e Servizi"
"CreatedBy" = "Terraform"
"Environment" = "Prod"
"ManagementTeam" = "Developer Experience"
"ModuleName" = "azure_container_app"
"ModuleSource" = "DX"
~ "ModuleVersion" = "4.2.0" -> "4.2.2"
"Owner" = "DevEx"
"Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/prod"
}
# (4 unchanged attributes hidden)
# (1 unchanged block hidden)
}
Plan: 0 to add, 7 to change, 0 to destroy.
Warning: Argument is deprecated
with module.container_app_infra.azurerm_monitor_diagnostic_setting.container_app_environment,
on .terraform/modules/container_app_infra/monitoring.tf line 3, in resource "azurerm_monitor_diagnostic_setting" "container_app_environment":
3: resource "azurerm_monitor_diagnostic_setting" "container_app_environment" {
`metric` has been deprecated in favour of the `enabled_metric` property and
will be removed in v5.0 of the AzureRM provider |
Contributor
📖 Terraform Plan (infra/resources/dev) - successShow Plan # module.ai_foundry.azurerm_cognitive_account.this will be destroyed
# (because azurerm_cognitive_account.this is not in configuration)
- resource "azurerm_cognitive_account" "this" {
- custom_subdomain_name = "dx-d-itn-aif-01" -> null
- dynamic_throttling_enabled = false -> null
- endpoint = "https://dx-d-itn-aif-01.cognitiveservices.azure.com/" -> null
- fqdns = [] -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01" -> null
- kind = "AIServices" -> null
- local_auth_enabled = false -> null
- location = "italynorth" -> null
- name = "dx-d-itn-aif-01" -> null
- outbound_network_access_restricted = false -> null
- project_management_enabled = true -> null
- public_network_access_enabled = false -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- sku_name = "S0" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
# (6 unchanged attributes hidden)
- identity {
- identity_ids = [] -> null
- principal_id = "e39e5ffa-ddbe-4180-b130-b7cd00e36ce8" -> null
- tenant_id = "7788edaf-0346-4068-9d79-c868aed15b3d" -> null
- type = "SystemAssigned" -> null
}
- network_acls {
- bypass = "AzureServices" -> null
- default_action = "Deny" -> null
- ip_rules = [] -> null
}
- storage {
- storage_account_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.Storage/storageAccounts/dxditnaist01" -> null
# (1 unchanged attribute hidden)
}
}
# module.ai_foundry.azurerm_cognitive_account_project.terraform_ci will be destroyed
# (because azurerm_cognitive_account_project.terraform_ci is not in configuration)
- resource "azurerm_cognitive_account_project" "terraform_ci" {
- cognitive_account_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01" -> null
- default = true -> null
- description = "Enforce rules at CI stage" -> null
- display_name = "Terraform CI" -> null
- endpoints = {
- "AI Foundry API" = "https://dx-d-itn-aif-01.services.ai.azure.com/api/projects/dx-d-itn-terraformci-proj-01"
} -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01/projects/dx-d-itn-terraformci-proj-01" -> null
- location = "italynorth" -> null
- name = "dx-d-itn-terraformci-proj-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- identity {
- identity_ids = [] -> null
- principal_id = "14b8bbb1-959a-4909-a2dc-7efb7a4853ca" -> null
- tenant_id = "7788edaf-0346-4068-9d79-c868aed15b3d" -> null
- type = "SystemAssigned" -> null
}
}
# module.ai_foundry.azurerm_cognitive_deployment.this will be destroyed
# (because azurerm_cognitive_deployment.this is not in configuration)
- resource "azurerm_cognitive_deployment" "this" {
- cognitive_account_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01" -> null
- dynamic_throttling_enabled = false -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01/deployments/gpt-5-5" -> null
- name = "gpt-5-5" -> null
- version_upgrade_option = "OnceNewDefaultVersionAvailable" -> null
# (1 unchanged attribute hidden)
- model {
- format = "OpenAI" -> null
- name = "gpt-5.5" -> null
- version = "2026-04-24" -> null
}
- sku {
- capacity = 100 -> null
- name = "GlobalStandard" -> null
# (3 unchanged attributes hidden)
}
}
# module.ai_foundry.azurerm_private_dns_zone.foundry["cognitive_services"] will be destroyed
# (because azurerm_private_dns_zone.foundry is not in configuration)
- resource "azurerm_private_dns_zone" "foundry" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.cognitiveservices.azure.com" -> null
- max_number_of_record_sets = 25000 -> null
- max_number_of_virtual_network_links = 1000 -> null
- max_number_of_virtual_network_links_with_registration = 100 -> null
- name = "privatelink.cognitiveservices.azure.com" -> null
- number_of_record_sets = 2 -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- soa_record {
- email = "azureprivatedns-host.microsoft.com" -> null
- expire_time = 2419200 -> null
- fqdn = "privatelink.cognitiveservices.azure.com." -> null
- host_name = "azureprivatedns.net" -> null
- minimum_ttl = 10 -> null
- refresh_time = 3600 -> null
- retry_time = 300 -> null
- serial_number = 1 -> null
- tags = {} -> null
- ttl = 3600 -> null
}
}
# module.ai_foundry.azurerm_private_dns_zone.foundry["openai"] will be destroyed
# (because azurerm_private_dns_zone.foundry is not in configuration)
- resource "azurerm_private_dns_zone" "foundry" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.openai.azure.com" -> null
- max_number_of_record_sets = 25000 -> null
- max_number_of_virtual_network_links = 1000 -> null
- max_number_of_virtual_network_links_with_registration = 100 -> null
- name = "privatelink.openai.azure.com" -> null
- number_of_record_sets = 2 -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- soa_record {
- email = "azureprivatedns-host.microsoft.com" -> null
- expire_time = 2419200 -> null
- fqdn = "privatelink.openai.azure.com." -> null
- host_name = "azureprivatedns.net" -> null
- minimum_ttl = 10 -> null
- refresh_time = 3600 -> null
- retry_time = 300 -> null
- serial_number = 1 -> null
- tags = {} -> null
- ttl = 3600 -> null
}
}
# module.ai_foundry.azurerm_private_dns_zone.foundry["services_ai"] will be destroyed
# (because azurerm_private_dns_zone.foundry is not in configuration)
- resource "azurerm_private_dns_zone" "foundry" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.services.ai.azure.com" -> null
- max_number_of_record_sets = 25000 -> null
- max_number_of_virtual_network_links = 1000 -> null
- max_number_of_virtual_network_links_with_registration = 100 -> null
- name = "privatelink.services.ai.azure.com" -> null
- number_of_record_sets = 2 -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- soa_record {
- email = "azureprivatedns-host.microsoft.com" -> null
- expire_time = 2419200 -> null
- fqdn = "privatelink.services.ai.azure.com." -> null
- host_name = "azureprivatedns.net" -> null
- minimum_ttl = 10 -> null
- refresh_time = 3600 -> null
- retry_time = 300 -> null
- serial_number = 1 -> null
- tags = {} -> null
- ttl = 3600 -> null
}
}
# module.ai_foundry.azurerm_private_dns_zone_virtual_network_link.foundry["cognitive_services"] will be destroyed
# (because azurerm_private_dns_zone_virtual_network_link.foundry is not in configuration)
- resource "azurerm_private_dns_zone_virtual_network_link" "foundry" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.cognitiveservices.azure.com/virtualNetworkLinks/dx-d-itn-common-vnet-01" -> null
- name = "dx-d-itn-common-vnet-01" -> null
- private_dns_zone_name = "privatelink.cognitiveservices.azure.com" -> null
- registration_enabled = false -> null
- resolution_policy = "Default" -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- virtual_network_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01" -> null
}
# module.ai_foundry.azurerm_private_dns_zone_virtual_network_link.foundry["openai"] will be destroyed
# (because azurerm_private_dns_zone_virtual_network_link.foundry is not in configuration)
- resource "azurerm_private_dns_zone_virtual_network_link" "foundry" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.openai.azure.com/virtualNetworkLinks/dx-d-itn-common-vnet-01" -> null
- name = "dx-d-itn-common-vnet-01" -> null
- private_dns_zone_name = "privatelink.openai.azure.com" -> null
- registration_enabled = false -> null
- resolution_policy = "Default" -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- virtual_network_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01" -> null
}
# module.ai_foundry.azurerm_private_dns_zone_virtual_network_link.foundry["services_ai"] will be destroyed
# (because azurerm_private_dns_zone_virtual_network_link.foundry is not in configuration)
- resource "azurerm_private_dns_zone_virtual_network_link" "foundry" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.services.ai.azure.com/virtualNetworkLinks/dx-d-itn-common-vnet-01" -> null
- name = "dx-d-itn-common-vnet-01" -> null
- private_dns_zone_name = "privatelink.services.ai.azure.com" -> null
- registration_enabled = false -> null
- resolution_policy = "Default" -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- virtual_network_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01" -> null
}
# module.ai_foundry.azurerm_private_endpoint.foundry will be destroyed
# (because azurerm_private_endpoint.foundry is not in configuration)
- resource "azurerm_private_endpoint" "foundry" {
- custom_dns_configs = [] -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.Network/privateEndpoints/dx-d-itn-foundry-pep-01" -> null
- location = "italynorth" -> null
- name = "dx-d-itn-foundry-pep-01" -> null
- network_interface = [
- {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.Network/networkInterfaces/dx-d-itn-foundry-pep-01.nic.569264c2-1f79-4625-85f7-80158abb4ba2"
- name = "dx-d-itn-foundry-pep-01.nic.569264c2-1f79-4625-85f7-80158abb4ba2"
},
] -> null
- private_dns_zone_configs = [
- {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.Network/privateEndpoints/dx-d-itn-foundry-pep-01/privateDnsZoneGroups/private-dns-zone-group/privateDnsZoneConfigs/privatelink.cognitiveservices.azure.com"
- name = "privatelink.cognitiveservices.azure.com"
- private_dns_zone_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.cognitiveservices.azure.com"
- record_sets = [
- {
- fqdn = "dx-d-itn-aif-01.privatelink.cognitiveservices.azure.com"
- ip_addresses = [
- "10.51.0.10",
]
- name = "dx-d-itn-aif-01"
- ttl = 10
- type = "A"
},
]
},
- {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.Network/privateEndpoints/dx-d-itn-foundry-pep-01/privateDnsZoneGroups/private-dns-zone-group/privateDnsZoneConfigs/privatelink.openai.azure.com"
- name = "privatelink.openai.azure.com"
- private_dns_zone_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.openai.azure.com"
- record_sets = [
- {
- fqdn = "dx-d-itn-aif-01.privatelink.openai.azure.com"
- ip_addresses = [
- "10.51.0.11",
]
- name = "dx-d-itn-aif-01"
- ttl = 10
- type = "A"
},
]
},
- {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.Network/privateEndpoints/dx-d-itn-foundry-pep-01/privateDnsZoneGroups/private-dns-zone-group/privateDnsZoneConfigs/privatelink.services.ai.azure.com"
- name = "privatelink.services.ai.azure.com"
- private_dns_zone_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.services.ai.azure.com"
- record_sets = [
- {
- fqdn = "dx-d-itn-aif-01.privatelink.services.ai.azure.com"
- ip_addresses = [
- "10.51.0.12",
]
- name = "dx-d-itn-aif-01"
- ttl = 10
- type = "A"
},
]
},
] -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- subnet_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01/subnets/dx-d-itn-pep-snet-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
# (1 unchanged attribute hidden)
- private_dns_zone_group {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.Network/privateEndpoints/dx-d-itn-foundry-pep-01/privateDnsZoneGroups/private-dns-zone-group" -> null
- name = "private-dns-zone-group" -> null
- private_dns_zone_ids = [
- "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.cognitiveservices.azure.com",
- "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.openai.azure.com",
- "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/privatelink.services.ai.azure.com",
] -> null
}
- private_service_connection {
- is_manual_connection = false -> null
- name = "dx-d-itn-foundry-pep-01" -> null
- private_connection_resource_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01" -> null
- private_ip_address = "10.51.0.10" -> null
- subresource_names = [
- "account",
] -> null
# (2 unchanged attributes hidden)
}
}
# module.ai_gateway.azurerm_api_management_api.foundry will be destroyed
# (because azurerm_api_management_api.foundry is not in configuration)
- resource "azurerm_api_management_api" "foundry" {
- api_management_name = "dx-d-itn-ai-apim-01" -> null
- api_type = "http" -> null
- display_name = "AI Foundry" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/apis/ai-foundry;rev=1" -> null
- is_current = true -> null
- is_online = false -> null
- name = "ai-foundry" -> null
- path = "ai" -> null
- protocols = [
- "https",
] -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- revision = "1" -> null
- subscription_required = false -> null
- version = "v1" -> null
- version_set_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/apiVersionSets/ai-foundry" -> null
# (5 unchanged attributes hidden)
- subscription_key_parameter_names {
- header = "Ocp-Apim-Subscription-Key" -> null
- query = "subscription-key" -> null
}
}
# module.ai_gateway.azurerm_api_management_api_operation.responses will be destroyed
# (because azurerm_api_management_api_operation.responses is not in configuration)
- resource "azurerm_api_management_api_operation" "responses" {
- api_management_name = "dx-d-itn-ai-apim-01" -> null
- api_name = "ai-foundry" -> null
- display_name = "Create response" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/apis/ai-foundry/operations/create-response" -> null
- method = "POST" -> null
- operation_id = "create-response" -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- url_template = "/responses" -> null
# (1 unchanged attribute hidden)
- request {
# (1 unchanged attribute hidden)
}
}
# module.ai_gateway.azurerm_api_management_api_operation_tag.responses will be destroyed
# (because azurerm_api_management_api_operation_tag.responses is not in configuration)
- resource "azurerm_api_management_api_operation_tag" "responses" {
- api_operation_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/apis/ai-foundry/operations/create-response" -> null
- display_name = "Terraform Permission Check" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/apis/ai-foundry/operations/create-response/tags/terraform-permission-check" -> null
- name = "terraform-permission-check" -> null
}
# module.ai_gateway.azurerm_api_management_api_policy.foundry will be destroyed
# (because azurerm_api_management_api_policy.foundry is not in configuration)
- resource "azurerm_api_management_api_policy" "foundry" {
- api_management_name = "dx-d-itn-ai-apim-01" -> null
- api_name = "ai-foundry" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/apis/ai-foundry" -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- xml_content = <<-EOT
<policies>
<inbound>
<base />
<set-backend-service backend-id="foundry" />
<rewrite-uri template="/openai/v1/responses" copy-unmatched-params="true" />
<authentication-managed-identity resource="https://ai.azure.com" />
<llm-emit-token-metric>
<dimension name="Operation ID" />
</llm-emit-token-metric>
<llm-token-limit remaining-quota-tokens-header-name="remaining-tokens" remaining-tokens-header-name="remaining-tokens" tokens-per-minute="100000" token-quota="10000000" token-quota-period="Daily" counter-key="@(context.Subscription.Id)" estimate-prompt-tokens="false" tokens-consumed-header-name="consumed-tokens" />
<!--TODO: add cache-->
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
</outbound>
<on-error>
<base />
</on-error>
</policies>
EOT -> null
# (1 unchanged attribute hidden)
}
# module.ai_gateway.azurerm_api_management_api_version_set.foundry will be destroyed
# (because azurerm_api_management_api_version_set.foundry is not in configuration)
- resource "azurerm_api_management_api_version_set" "foundry" {
- api_management_name = "dx-d-itn-ai-apim-01" -> null
- display_name = "AI Foundry" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/apiVersionSets/ai-foundry" -> null
- name = "ai-foundry" -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- versioning_scheme = "Segment" -> null
# (3 unchanged attributes hidden)
}
# module.ai_gateway.azurerm_api_management_backend.foundry will be destroyed
# (because azurerm_api_management_backend.foundry is not in configuration)
- resource "azurerm_api_management_backend" "foundry" {
- api_management_name = "dx-d-itn-ai-apim-01" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/backends/foundry" -> null
- name = "foundry" -> null
- protocol = "http" -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- url = "https://dx-d-itn-aif-01.services.ai.azure.com/api/projects/dx-d-itn-terraformci-proj-01" -> null
# (3 unchanged attributes hidden)
- circuit_breaker_rule {
- accept_retry_after_enabled = false -> null
- name = "default" -> null
- trip_duration = "PT30S" -> null
- failure_condition {
- count = 5 -> null
- error_reasons = [] -> null
- interval_duration = "PT1M" -> null
- percentage = 0 -> null
- status_code_range {
- max = 599 -> null
- min = 500 -> null
}
}
}
}
# module.ai_gateway.azurerm_role_assignment.apim_foundry will be destroyed
# (because azurerm_role_assignment.apim_foundry is not in configuration)
- resource "azurerm_role_assignment" "apim_foundry" {
- description = "Allow the AI gateway (APIM) managed identity to invoke Foundry project models via Entra ID" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01/projects/dx-d-itn-terraformci-proj-01/providers/Microsoft.Authorization/roleAssignments/0eecae28-9ac1-a5d1-fb78-619be93b8403" -> null
- name = "0eecae28-9ac1-a5d1-fb78-619be93b8403" -> null
- principal_id = "f8d3d56e-88bd-417e-a127-7ec19e3d62d2" -> null
- principal_type = "ServicePrincipal" -> null
- role_definition_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/providers/Microsoft.Authorization/roleDefinitions/53ca6127-db72-4b80-b1b0-d745d6d5456d" -> null
- role_definition_name = "Foundry User" -> null
- scope = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.CognitiveServices/accounts/dx-d-itn-aif-01/projects/dx-d-itn-terraformci-proj-01" -> null
# (3 unchanged attributes hidden)
}
# module.ai_gateway.azurerm_subnet.apim will be destroyed
# (because azurerm_subnet.apim is not in configuration)
- resource "azurerm_subnet" "apim" {
- address_prefixes = [
- "10.51.5.32/27",
] -> null
- default_outbound_access_enabled = true -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01/subnets/dx-d-itn-ai-apim-snet-01" -> null
- name = "dx-d-itn-ai-apim-snet-01" -> null
- private_endpoint_network_policies = "Disabled" -> null
- private_link_service_network_policies_enabled = true -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- service_endpoint_policy_ids = [] -> null
- service_endpoints = [] -> null
- virtual_network_name = "dx-d-itn-common-vnet-01" -> null
# (1 unchanged attribute hidden)
}
# module.ai_gateway.dx_available_subnet_cidr.apim will be destroyed
# (because dx_available_subnet_cidr.apim is not in configuration)
- resource "dx_available_subnet_cidr" "apim" {
- cidr_block = "10.51.5.32/27" -> null
- id = "_subscriptions_35e6e3b2-4388-470e-a1b9-ad3bc34326d1_resourceGroups_dx-d-itn-network-rg-01_providers_Microsoft.Network_virtualNetworks_dx-d-itn-common-vnet-01_27_10.51.5.32_27" -> null
- prefix_length = 27 -> null
- virtual_network_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01" -> null
}
# module.mcp_server.aws_s3_bucket_server_side_encryption_configuration.mcp_knowledge_base will be updated in-place
~ resource "aws_s3_bucket_server_side_encryption_configuration" "mcp_knowledge_base" {
id = "dx-d-euc1-docs-kb-s3-01"
# (3 unchanged attributes hidden)
- rule {
- blocked_encryption_types = [
- "SSE-C",
] -> null
- bucket_key_enabled = false -> null
- apply_server_side_encryption_by_default {
- sse_algorithm = "AES256" -> null
# (1 unchanged attribute hidden)
}
}
+ rule {
+ blocked_encryption_types = []
+ apply_server_side_encryption_by_default {
+ sse_algorithm = "AES256"
# (1 unchanged attribute hidden)
}
}
}
# module.ai_gateway.module.apim.azurerm_api_management.this will be destroyed
# (because azurerm_api_management.this is not in configuration)
- resource "azurerm_api_management" "this" {
- client_certificate_enabled = false -> null
- developer_portal_url = "https://dx-d-itn-ai-apim-01.developer.azure-api.net" -> null
- gateway_disabled = false -> null
- gateway_regional_url = "https://dx-d-itn-ai-apim-01-italynorth-01.regional.azure-api.net" -> null
- gateway_url = "https://dx-d-itn-ai-apim-01.azure-api.net" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01" -> null
- location = "italynorth" -> null
- management_api_url = "https://dx-d-itn-ai-apim-01.management.azure-api.net" -> null
- min_api_version = "2021-08-01" -> null
- name = "dx-d-itn-ai-apim-01" -> null
- notification_sender_email = "apimgmt-noreply@mail.windowsazure.com" -> null
- private_ip_addresses = [
- "10.51.5.36",
] -> null
- public_ip_addresses = [
- "72.146.240.161",
] -> null
- public_network_access_enabled = true -> null
- publisher_email = "team-devex@pagopa.it" -> null
- publisher_name = "PagoPA S.p.A." -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- scm_url = "https://dx-d-itn-ai-apim-01.scm.azure-api.net" -> null
- sku_name = "Developer_1" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "ModuleName" = "azure_api_management"
- "ModuleSource" = "DX"
- "ModuleVersion" = "2.2.3"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- virtual_network_type = "Internal" -> null
- zones = [] -> null
# (2 unchanged attributes hidden)
- delegation {
- subscriptions_enabled = false -> null
- user_registration_enabled = false -> null
# (2 unchanged attributes hidden)
}
- hostname_configuration {
- proxy {
- certificate_source = "BuiltIn" -> null
- default_ssl_binding = true -> null
- host_name = "dx-d-itn-ai-apim-01.azure-api.net" -> null
- negotiate_client_certificate = false -> null
# (9 unchanged attributes hidden)
}
}
- identity {
- identity_ids = [] -> null
- principal_id = "f8d3d56e-88bd-417e-a127-7ec19e3d62d2" -> null
- tenant_id = "7788edaf-0346-4068-9d79-c868aed15b3d" -> null
- type = "SystemAssigned" -> null
}
- protocols {
- enable_http2 = false -> null
- http2_enabled = false -> null
}
- security {
- backend_ssl30_enabled = false -> null
- backend_tls10_enabled = false -> null
- backend_tls11_enabled = false -> null
- enable_backend_ssl30 = false -> null
- enable_backend_tls10 = false -> null
- enable_backend_tls11 = false -> null
- enable_frontend_ssl30 = false -> null
- enable_frontend_tls10 = false -> null
- enable_frontend_tls11 = false -> null
- frontend_ssl30_enabled = false -> null
- frontend_tls10_enabled = false -> null
- frontend_tls11_enabled = false -> null
- tls_ecdhe_ecdsa_with_aes128_cbc_sha_ciphers_enabled = false -> null
- tls_ecdhe_ecdsa_with_aes256_cbc_sha_ciphers_enabled = false -> null
- tls_ecdhe_rsa_with_aes128_cbc_sha_ciphers_enabled = false -> null
- tls_ecdhe_rsa_with_aes256_cbc_sha_ciphers_enabled = false -> null
- tls_rsa_with_aes128_cbc_sha256_ciphers_enabled = false -> null
- tls_rsa_with_aes128_cbc_sha_ciphers_enabled = false -> null
- tls_rsa_with_aes128_gcm_sha256_ciphers_enabled = false -> null
- tls_rsa_with_aes256_cbc_sha256_ciphers_enabled = false -> null
- tls_rsa_with_aes256_cbc_sha_ciphers_enabled = false -> null
- tls_rsa_with_aes256_gcm_sha384_ciphers_enabled = false -> null
- triple_des_ciphers_enabled = false -> null
}
- sign_in {
- enabled = false -> null
}
- sign_up {
- enabled = false -> null
- terms_of_service {
- consent_required = false -> null
- enabled = false -> null
# (1 unchanged attribute hidden)
}
}
- tenant_access {
- enabled = false -> null
- primary_key = (sensitive value) -> null
- secondary_key = (sensitive value) -> null
- tenant_id = "/tenant/access" -> null
}
- virtual_network_configuration {
- subnet_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01/subnets/dx-d-itn-ai-apim-snet-01" -> null
}
}
# module.ai_gateway.module.apim.azurerm_api_management_diagnostic.applicationinsights[0] will be destroyed
# (because azurerm_api_management_diagnostic.applicationinsights is not in configuration)
- resource "azurerm_api_management_diagnostic" "applicationinsights" {
- always_log_errors = true -> null
- api_management_logger_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/loggers/dx-d-itn-ai-apim-01-logger" -> null
- api_management_name = "dx-d-itn-ai-apim-01" -> null
- http_correlation_protocol = "W3C" -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/diagnostics/applicationinsights" -> null
- identifier = "applicationinsights" -> null
- log_client_ip = true -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- sampling_percentage = 100 -> null
- verbosity = "information" -> null
# (1 unchanged attribute hidden)
- backend_request {
- body_bytes = 0 -> null
- headers_to_log = [] -> null
- data_masking {
- query_params {
- mode = "Hide" -> null
- value = "*" -> null
}
}
}
- frontend_request {
- body_bytes = 0 -> null
- headers_to_log = [] -> null
- data_masking {
- query_params {
- mode = "Hide" -> null
- value = "*" -> null
}
}
}
}
# module.ai_gateway.module.apim.azurerm_api_management_logger.this[0] will be destroyed
# (because azurerm_api_management_logger.this is not in configuration)
- resource "azurerm_api_management_logger" "this" {
- api_management_name = "dx-d-itn-ai-apim-01" -> null
- buffered = true -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-ai-rg-01/providers/Microsoft.ApiManagement/service/dx-d-itn-ai-apim-01/loggers/dx-d-itn-ai-apim-01-logger" -> null
- name = "dx-d-itn-ai-apim-01-logger" -> null
- resource_group_name = "dx-d-itn-ai-rg-01" -> null
- resource_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-common-rg-01/providers/Microsoft.Insights/components/dx-d-itn-common-appi-01" -> null
# (1 unchanged attribute hidden)
- application_insights {
- connection_string = (sensitive value) -> null
# (1 unchanged attribute hidden)
}
}
# module.ai_gateway.module.apim.azurerm_network_security_group.nsg_apim will be destroyed
# (because azurerm_network_security_group.nsg_apim is not in configuration)
- resource "azurerm_network_security_group" "nsg_apim" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/networkSecurityGroups/dx-d-itn-ai-apim-nsg-01" -> null
- location = "italynorth" -> null
- name = "dx-d-itn-ai-apim-nsg-01" -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- security_rule = [
- {
- access = "Allow"
- description = "Access to Azure Key Vault for core service functionality"
- destination_address_prefix = "AzureKeyVault"
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_range = "443"
- destination_port_ranges = []
- direction = "Outbound"
- name = "azure-keyvault"
- priority = 202
- protocol = "Tcp"
- source_address_prefix = "VirtualNetwork"
- source_address_prefixes = []
- source_application_security_group_ids = []
- source_port_range = "*"
- source_port_ranges = []
},
- {
- access = "Allow"
- description = "Access to Azure SQL endpoints for core service functionality"
- destination_address_prefix = "SQL"
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_range = "1433"
- destination_port_ranges = []
- direction = "Outbound"
- name = "sql"
- priority = 201
- protocol = "Tcp"
- source_address_prefix = "VirtualNetwork"
- source_address_prefixes = []
- source_application_security_group_ids = []
- source_port_range = "*"
- source_port_ranges = []
},
- {
- access = "Allow"
- description = "Azure Infrastructure Load Balancer"
- destination_address_prefix = "VirtualNetwork"
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_range = "6390"
- destination_port_ranges = []
- direction = "Inbound"
- name = "azure-load-balancer"
- priority = 201
- protocol = "Tcp"
- source_address_prefix = "AzureLoadBalancer"
- source_address_prefixes = []
- source_application_security_group_ids = []
- source_port_range = "*"
- source_port_ranges = []
},
- {
- access = "Allow"
- description = "Dependency on Azure Storage for core service functionality"
- destination_address_prefix = "Storage"
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_range = "443"
- destination_port_ranges = []
- direction = "Outbound"
- name = "storage"
- priority = 200
- protocol = "Tcp"
- source_address_prefix = "VirtualNetwork"
- source_address_prefixes = []
- source_application_security_group_ids = []
- source_port_range = "*"
- source_port_ranges = []
},
- {
- access = "Allow"
- description = "Management endpoint for Azure portal and PowerShell"
- destination_address_prefix = "VirtualNetwork"
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_range = "3443"
- destination_port_ranges = []
- direction = "Inbound"
- name = "apim-management"
- priority = 200
- protocol = "Tcp"
- source_address_prefix = "ApiManagement"
- source_address_prefixes = []
- source_application_security_group_ids = []
- source_port_range = "*"
- source_port_ranges = []
},
- {
- access = "Allow"
- description = "Publish Diagnostics Logs and Metrics, Resource Health, and Application Insights"
- destination_address_prefix = "AzureMonitor"
- destination_address_prefixes = []
- destination_application_security_group_ids = []
- destination_port_ranges = [
- "1886",
- "443",
]
- direction = "Outbound"
- name = "azure-monitor"
- priority = 203
- protocol = "Tcp"
- source_address_prefix = "VirtualNetwork"
- source_address_prefixes = []
- source_application_security_group_ids = []
- source_port_range = "*"
- source_port_ranges = []
# (1 unchanged attribute hidden)
},
] -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "ModuleName" = "azure_api_management"
- "ModuleSource" = "DX"
- "ModuleVersion" = "2.2.3"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
}
# module.ai_gateway.module.apim.azurerm_private_dns_a_record.apim_azure_api_net[0] will be destroyed
# (because azurerm_private_dns_a_record.apim_azure_api_net is not in configuration)
- resource "azurerm_private_dns_a_record" "apim_azure_api_net" {
- fqdn = "dx-d-itn-ai-apim-01.azure-api.net." -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/azure-api.net/A/dx-d-itn-ai-apim-01" -> null
- name = "dx-d-itn-ai-apim-01" -> null
- records = [
- "10.51.5.36",
] -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "ModuleName" = "azure_api_management"
- "ModuleSource" = "DX"
- "ModuleVersion" = "2.2.3"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- ttl = 3600 -> null
- zone_name = "azure-api.net" -> null
}
# module.ai_gateway.module.apim.azurerm_private_dns_a_record.apim_management_azure_api_net[0] will be destroyed
# (because azurerm_private_dns_a_record.apim_management_azure_api_net is not in configuration)
- resource "azurerm_private_dns_a_record" "apim_management_azure_api_net" {
- fqdn = "dx-d-itn-ai-apim-01.management.azure-api.net." -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/management.azure-api.net/A/dx-d-itn-ai-apim-01" -> null
- name = "dx-d-itn-ai-apim-01" -> null
- records = [
- "10.51.5.36",
] -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "ModuleName" = "azure_api_management"
- "ModuleSource" = "DX"
- "ModuleVersion" = "2.2.3"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- ttl = 3600 -> null
- zone_name = "management.azure-api.net" -> null
}
# module.ai_gateway.module.apim.azurerm_private_dns_a_record.apim_scm_azure_api_net[0] will be destroyed
# (because azurerm_private_dns_a_record.apim_scm_azure_api_net is not in configuration)
- resource "azurerm_private_dns_a_record" "apim_scm_azure_api_net" {
- fqdn = "dx-d-itn-ai-apim-01.scm.azure-api.net." -> null
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/privateDnsZones/scm.azure-api.net/A/dx-d-itn-ai-apim-01" -> null
- name = "dx-d-itn-ai-apim-01" -> null
- records = [
- "10.51.5.36",
] -> null
- resource_group_name = "dx-d-itn-network-rg-01" -> null
- tags = {
- "BusinessUnit" = "DevEx"
- "CostCenter" = "TS000 - Tecnologia e Servizi"
- "CreatedBy" = "Terraform"
- "Environment" = "Dev"
- "ManagementTeam" = "Developer Experience"
- "ModuleName" = "azure_api_management"
- "ModuleSource" = "DX"
- "ModuleVersion" = "2.2.3"
- "Source" = "https://github.com/pagopa/dx/blob/main/infra/resources/dev"
} -> null
- ttl = 3600 -> null
- zone_name = "scm.azure-api.net" -> null
}
# module.ai_gateway.module.apim.azurerm_subnet_network_security_group_association.snet_nsg will be destroyed
# (because azurerm_subnet_network_security_group_association.snet_nsg is not in configuration)
- resource "azurerm_subnet_network_security_group_association" "snet_nsg" {
- id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01/subnets/dx-d-itn-ai-apim-snet-01" -> null
- network_security_group_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/networkSecurityGroups/dx-d-itn-ai-apim-nsg-01" -> null
- subnet_id = "/subscriptions/35e6e3b2-4388-470e-a1b9-ad3bc34326d1/resourceGroups/dx-d-itn-network-rg-01/providers/Microsoft.Network/virtualNetworks/dx-d-itn-common-vnet-01/subnets/dx-d-itn-ai-apim-snet-01" -> null
}
Plan: 0 to add, 1 to change, 27 to destroy.
Warning: Reference to undefined provider
on aws.tf line 12, in module "mcp_server":
12: aws.us_east_1 = aws.us-east-1
There is no explicit declaration for local provider name "aws.us_east_1" in
module.mcp_server, so Terraform is assuming you mean to pass a configuration
for "hashicorp/aws".
If you also control the child module, add a required_providers entry named
"aws.us_east_1" with the source address "hashicorp/aws". |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR activates the new Nx Release–driven Terraform environment deployment path for the DX repo’s dev and prod infrastructure resources, enabling release-time dispatch of per-environment plan/approval/apply workflows while keeping legacy apply workflows available for manual recovery. It also updates documentation and permissions to reflect the new end-to-end flow.
Changes:
- Include
infra/resources/*in Nx Release projects and add initialenvironment.jsonmanifests fordev/prod. - Extend
release-v2.yamlto dispatch an independent Terraform environment release workflow per released environment (without blocking package publishing). - Remove
pushtriggers from legacy dev/prod apply workflows and document the updated release/deploy process (including required permissions and secrets).
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
nx.json |
Adds infra/resources/* to Nx Release project discovery so environment projects can be released. |
infra/resources/prod/environment.json |
Introduces versioned environment manifest for prod resources (enables environment release metadata). |
infra/resources/dev/environment.json |
Introduces versioned environment manifest for dev resources (enables environment release metadata). |
apps/website/docs/pipelines/nx-release.md |
Updates public docs to cover deployment dispatch, required permissions, inputs, and secrets. |
actions/nx-release/README.md |
Documents the new released-environment-matrix consumption behavior (dispatch-per-environment). |
.nx/version-plans/version-plan-1784227146305.md |
Adds version plan entries to release resources-dev and resources-prod. |
.github/workflows/release-v2.yaml |
Adds workflow input and a dispatch job that triggers per-environment deployment workflows from the Nx Release outputs. |
.github/workflows/_release-terraform-apply-prod-resources.yaml |
Removes automatic push trigger, leaving manual workflow_dispatch for recovery. |
.github/workflows/_release-terraform-apply-dev-resources.yaml |
Removes automatic push trigger, leaving manual workflow_dispatch for recovery. |
.github/workflows/_release-changesets-pull-request.yaml |
Grants actions: write so the caller can dispatch the environment deployment workflows. |
.github/actions/node-setup/action.yaml |
Updates actions/setup-node pin to a SHA that includes the referenced upstream fix. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The generic storage, execution, manifest, release metadata, and secure workflow layers are now isolated in prerequisite PRs. This final change opts the DX dev/prod environments into the new path.
What changed
nx-release.environment.jsonmanifests for dev and prod resources.infra/resources/*in Nx Release.This is the only PR in the stack that changes active deployment behavior.
Validation
NX_DAEMON=false pnpm nx show project resources-dev --jsonNX_DAEMON=false pnpm nx show project resources-prod --jsonpnpm nx format:check --uncommittedDepends on #1997.
Extracted from #1926.