Provisioning Azure Data Factory with Managed private endpoints using Terraform? - azure

Question

I am developing a Terraform Script to provision the Azure Data Factory that reads the data from the storage account and updates the Azure SQL Server. It works.
I have created the Private Endpoints for both the Storage account and Azure SQL Server
Storage Account Private Endpoint
SQL Server Private Endpoint
Now, I want to update the Azure Data factory to use these private endpoints. I do understand that I need to setup the IR & managed private endpoints in the Azure Data Factory.
How do I achieve this using Terraform? Below is my script so far
# Create a Data Factory
resource "azurerm_data_factory" "terraform-demo-factory" {
name = "tf-demo-factory"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
github_configuration {
account_name = "kavija"
branch_name = "main"
git_url = "https://github.com/kavija/azure-data-factory-etl-demo"
repository_name = "azure-data-factory-etl-demo"
root_folder = "/"
}
tags = {
creator = "Terraform"
project = "terraform-demo"
}
identity {
type = "UserAssigned"
identity_ids = [azurerm_user_assigned_identity.uai_adf.id]
}
}
# Assign role to ADF Service Principal
resource "azurerm_role_assignment" "uai_adf_storage_access_reader" {
scope = module.storage_account.storage_account_id
role_definition_name = "Storage Account Reader"
principal_id = azurerm_user_assigned_identity.uai_adf.principal_id
}
resource "azurerm_role_assignment" "uai_adf_storage_access_blob_contributor" {
scope = module.storage_account.storage_account_id
role_definition_name = "Storage Blob Data Contributor"
principal_id = azurerm_user_assigned_identity.uai_adf.principal_id
}
Also, Is there a way to create a Private Endpoint for Azure Data Factory itself? so that it will be with in my VNET.

Answer 1

I was able to setup using the below terraform code
resource "azurerm_virtual_machine" "selfhostvm" {
name = "${var.prefix}-VM"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
network_interface_ids = [azurerm_network_interface.example.id]
vm_size = "Standard_B1s"
storage_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter"
version = "latest"
}
storage_os_disk {
name = "myosdisk1"
caching = "ReadWrite"
create_option = "FromImage"
managed_disk_type = "Standard_LRS"
}
os_profile {
computer_name = "${var.prefix}-VM"
admin_username = "testadmin"
admin_password = "Password1234!"
}
os_profile_windows_config {
timezone = "Pacific Standard Time"
provision_vm_agent = true
}
}
resource "azurerm_data_factory_integration_runtime_self_hosted" "host" {
name = "${var.prefix}IntegrationRuntimeHOST"
data_factory_id = azurerm_data_factory.host.id
}
resource "azurerm_virtual_machine_extension" "test" {
name = "${var.prefix}-EXT"
virtual_machine_id = azurerm_virtual_machine.selfhostvm.id
publisher = "Microsoft.Compute"
type = "CustomScriptExtension"
type_handler_version = "1.10"
settings = jsonencode({
"fileUris" = ["https://raw.githubusercontent.com/kvija85/install-df-agent/main/gatewayInstall.ps1"],
"commandToExecute" = "powershell -ExecutionPolicy Unrestricted -File gatewayInstall.ps1 ${azurerm_data_factory_integration_runtime_self_hosted.host.primary_authorization_key} && timeout /t 120"
})
}