☁️ Azure NetApp Volume Group (Oracle) Terraform Module

volume = [
  { volume_spec_name = "ora-data1",  /* ... */ },
  { volume_spec_name = "ora-log",    /* ... */ },
  { volume_spec_name = "ora-binary", /* ... */ },
  { volume_spec_name = "ora-backup", /* ... */ },
]

volume = concat(
  [for i in range(1, 9) : {
    volume_spec_name    = "ora-data${i}"
    name                = "vg-oracle-or1-data${i}"
    volume_path         = "oracle-or1-data${i}"
    capacity_pool_id    = module.pool_ultra.id
    subnet_id           = module.anf_vnet.subnet_ids["anf"]
    service_level       = "Ultra"
    storage_quota_in_gb = 1024
    throughput_in_mibps = 400
    protocols           = ["NFSv4.1"]
    security_style      = "unix"
    snapshot_directory_visible = true
    proximity_placement_group_id = var.oracle_ppg_id
    export_policy_rule = [{
      rule_index = 1, allowed_clients = ["10.40.2.0/24"]
      nfsv3_enabled = false, nfsv41_enabled = true, unix_read_write = true
    }]
  }],
  [ /* ora-log, ora-log-mirror, ora-binary, ora-backup */ ],
)

{
  volume_spec_name             = "ora-data1"
  proximity_placement_group_id = var.oracle_ppg_id
  zone                         = "1" # ❌
}

{ volume_spec_name = "ora-data1", protocols = ["NFSv3"] }   # ✅ legal
{ volume_spec_name = "ora-data1", protocols = ["NFSv4.1"] } # ✅ also legal

network_features = "Standard_Basic" # legal here; rejected by the SAP HANA volume group

proximity_placement_group_id = var.oracle_ppg_id

output "latency_risk" {
  value = module.oracle_volumes.volumes_without_proximity_placement_group # expect []
}

storage_quota_in_gb = 2048 # was 1024

export_policy_rule = [{
  rule_index      = 1
  allowed_clients = ["10.40.2.0/24"]
  nfsv3_enabled   = false
  nfsv41_enabled  = true   # ← booleans here
  unix_read_write = true
}]

allowed_clients = ["0.0.0.0/0"] # ❌

nfsv3_enabled = false
nfsv41_enabled = false          # ❌

root_access_enabled = true # ⚠️ deliberate

output "root_access_review" {
  value = module.oracle_volumes.volumes_granting_root_access # expect []
}

volume = [
  { volume_spec_name = "ora-data1",  capacity_pool_id = module.pool_ultra.id,    service_level = "Ultra",    /* ... */ },
  { volume_spec_name = "ora-log",    capacity_pool_id = module.pool_ultra.id,    service_level = "Ultra",    /* ... */ },
  { volume_spec_name = "ora-backup", capacity_pool_id = module.pool_standard.id, service_level = "Standard", /* ... */ },
]

output "oracle_mounts" {
  value = module.oracle_volumes.volume_mount_ip_addresses
}

# ❌ None of these exist inside a volume-group `volume` block:
# data_protection_backup_policy = { ... }
# cool_access                   = { ... }
# data_protection_advanced_ransomware = { ... }
# quota_rules / buckets

timeouts = {
  create = "4h"
  delete = "4h"
}

provider "azurerm" {
  features {}
}

# 1 · The resource group.
module "anf_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-oracle-eastus2"
  location = "eastus2"
}

# 2 · The delegated subnet.
module "anf_vnet" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-virtual-network.git?ref=v1.0.0"

  name                = "vnet-oracle-eastus2"
  resource_group_name = module.anf_rg.name
  location            = module.anf_rg.location
  address_space       = ["10.40.0.0/16"]

  subnets = {
    anf = {
      address_prefixes = ["10.40.1.0/24"]
      delegations = [{
        name = "netapp"
        service_delegation = {
          name    = "Microsoft.NetApp/volumes"
          actions = ["Microsoft.Network/networkinterfaces/*", "Microsoft.Network/virtualNetworks/subnets/join/action"]
        }
      }]
    }
  }
}

# 3 · The account and two pools, so data/log and backup can sit on different tiers.
module "anf_account" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-account.git?ref=v1.0.0"

  name                = "anf-oracle-eastus2"
  resource_group_name = module.anf_rg.name
  location            = module.anf_rg.location
}

module "pool_ultra" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-pool.git?ref=v1.0.0"

  name                = "pool-oracle-ultra"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  location            = module.anf_rg.location
  service_level       = "Ultra"
  size_in_tb          = 8
}

module "pool_standard" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-pool.git?ref=v1.0.0"

  name                = "pool-oracle-standard"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  location            = module.anf_rg.location
  service_level       = "Standard"
  size_in_tb          = 4
}

# 4 · A snapshot policy for the data and log volumes.
module "anf_snapshot_policy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-snapshot-policy.git?ref=v1.0.0"

  name                = "sp-oracle-critical"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  location            = module.anf_rg.location

  hourly_schedule = { minute = 0, snapshots_to_keep = 12 }
  daily_schedule  = { hour = 3, minute = 0, snapshots_to_keep = 7 }
}

# 5 · The volume group — this module. PPG on every volume, NO zone anywhere (they are
#     mutually exclusive), mixed tiers, snapshot policy on the critical volumes.
module "oracle_volumes" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-volume-group-oracle.git?ref=v1.0.0"

  name                   = "vg-oracle-or1"
  resource_group_name    = module.anf_rg.name
  account_name           = module.anf_account.name
  location               = module.anf_rg.location
  application_identifier = "OR1"
  group_description      = "Oracle OR1 production volumes"

  volume = [
    {
      volume_spec_name           = "ora-data1"
      name                       = "vg-oracle-or1-data1"
      volume_path                = "oracle-or1-data1"
      capacity_pool_id           = module.pool_ultra.id
      subnet_id                  = module.anf_vnet.subnet_ids["anf"]
      service_level              = "Ultra"
      storage_quota_in_gb        = 2048
      throughput_in_mibps        = 500
      protocols                  = ["NFSv4.1"]
      security_style             = "unix"
      snapshot_directory_visible = true
      network_features           = "Standard"

      # PPG, and therefore NO zone — the two are mutually exclusive.
      proximity_placement_group_id = var.oracle_ppg_id

      export_policy_rule = [{
        rule_index      = 1
        allowed_clients = ["10.40.2.0/24"]
        nfsv3_enabled   = false
        nfsv41_enabled  = true
        unix_read_write = true
      }]

      data_protection_snapshot_policy = { snapshot_policy_id = module.anf_snapshot_policy.id }
    },
    {
      volume_spec_name           = "ora-log"
      name                       = "vg-oracle-or1-log"
      volume_path                = "oracle-or1-log"
      capacity_pool_id           = module.pool_ultra.id
      subnet_id                  = module.anf_vnet.subnet_ids["anf"]
      service_level              = "Ultra"
      storage_quota_in_gb        = 512
      throughput_in_mibps        = 300
      protocols                  = ["NFSv4.1"]
      security_style             = "unix"
      snapshot_directory_visible = true
      network_features           = "Standard"

      proximity_placement_group_id = var.oracle_ppg_id

      export_policy_rule = [{
        rule_index      = 1
        allowed_clients = ["10.40.2.0/24"]
        nfsv3_enabled   = false
        nfsv41_enabled  = true
        unix_read_write = true
      }]

      data_protection_snapshot_policy = { snapshot_policy_id = module.anf_snapshot_policy.id }
    },
    {
      volume_spec_name           = "ora-backup"
      name                       = "vg-oracle-or1-backup"
      volume_path                = "oracle-or1-backup"
      capacity_pool_id           = module.pool_standard.id # cheaper tier
      subnet_id                  = module.anf_vnet.subnet_ids["anf"]
      service_level              = "Standard"
      storage_quota_in_gb        = 4096
      throughput_in_mibps        = 100
      protocols                  = ["NFSv3"] # legal on ANY role in an Oracle group
      security_style             = "unix"
      snapshot_directory_visible = false
      network_features           = "Standard"

      proximity_placement_group_id = var.oracle_ppg_id

      export_policy_rule = [{
        rule_index      = 1
        allowed_clients = ["10.40.2.0/24"]
        nfsv3_enabled   = true
        nfsv41_enabled  = false
        unix_read_write = true
      }]
    },
  ]

  timeouts = { create = "4h", delete = "4h" }
}

output "oracle_storage" {
  description = "Mount targets by role, plus the two reviews that matter."
  value = {
    mounts      = module.oracle_volumes.volume_mount_ip_addresses
    paths       = module.oracle_volumes.volume_paths
    protocols   = module.oracle_volumes.volume_protocols
    root_access = module.oracle_volumes.volumes_granting_root_access              # expect []
    no_ppg      = module.oracle_volumes.volumes_without_proximity_placement_group # expect []
  }
}

variable "name"                   { type = string } # ⚠️ force-new AND DATA IS LOST
variable "resource_group_name"    { type = string } # ⚠️ same
variable "account_name"           { type = string } # ⚠️ same; the NAME, not the Resource ID
variable "location"               { type = string } # ⚠️ same

variable "application_identifier" {
  # The Oracle SID. VALIDATED non-empty only — the 3-character limit the provider documents for
  # SAP HANA volume groups is NOT documented for Oracle, so this module does not invent one.
  type = string
}

variable "group_description" { type = string } # required by the provider; also force-new

variable "volume" {
  # A LIST of 2-12 — more than SAP HANA's 5, because Oracle allows eight data volumes. A list,
  # matching the provider's own collection type: a volume group is ONE service-side object whose
  # members are submitted together, and `volume_spec_name` already carries each volume's role.
  # The OUTPUTS are keyed by volume_spec_name instead.
  #
  # ⚠️ EVERY field below is immutable — changing any of them forces a new volume group and loses
  #    the data on ALL of its volumes.
  #
  # VALIDATED: the 2-12 count; the twelve-member volume_spec_name value set AND uniqueness;
  # **the PPG-versus-zone mutual exclusion**; single-protocol only; security_style, service_level,
  # the FOUR-value network_features set, and zone value sets; positive quota and throughput;
  # 1-5 export rules with unique in-range rule_index; non-empty allowed_clients; the 0.0.0.0/0
  # refusal; a rule must cover at least one protocol; the CMK pairing both ways; and the
  # replication frequency enum.
  #
  # NOTE: unlike the SAP HANA group, there is NO protocol restriction by role here.
  type = list(object({
    volume_spec_name           = string # ora-data1..ora-data8 | ora-log | ora-log-mirror |
                                        # ora-binary | ora-backup
    name                       = string
    volume_path                = string
    capacity_pool_id           = string # the pool's ID — NOT its name
    subnet_id                  = string # must carry the Microsoft.NetApp/volumes delegation
    service_level              = string
    storage_quota_in_gb        = number
    throughput_in_mibps        = number # REQUIRED here, optional on a standalone volume
    protocols                  = list(string) # exactly one
    security_style             = string # REQUIRED here
    snapshot_directory_visible = bool   # REQUIRED here

    proximity_placement_group_id = optional(string) # effectively required; EXCLUDES zone
    zone                         = optional(string) # EXCLUDES proximity_placement_group_id
    network_features             = optional(string) # Basic | Basic_Standard | Standard |
                                                    # Standard_Basic — required with a CMK
    encryption_key_source         = optional(string)
    key_vault_private_endpoint_id = optional(string)
    tags                          = optional(map(string))

    export_policy_rule = list(object({
      rule_index          = number
      allowed_clients     = set(string) # 🔒 the access control; 0.0.0.0/0 REFUSED
      nfsv3_enabled       = bool        # ⚠️ booleans, NOT the standalone volume's protocol list
      nfsv41_enabled      = bool
      unix_read_only      = optional(bool)
      unix_read_write     = optional(bool)
      root_access_enabled = optional(bool, false) # 🔒 opt-in
    }))

    data_protection_replication     = optional(object({ /* ... */ }))
    data_protection_snapshot_policy = optional(object({ snapshot_policy_id = string }))
  }))
}

variable "timeouts" {
  # Up to twelve volumes in one operation — the slowest resource in the family.
  type    = object({ create = optional(string), read = optional(string), update = optional(string), delete = optional(string) })
  default = null
}

# NOTE: the group has no `tags` of its own. Per-volume tags are inside the `volume` object.
# NOTE: a volume-group volume supports NO backup policy, cool access, ARP, quota rules, or buckets.