Skip to content

Dtspo 22339 enable asset caching and compression in front door #2313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 39 commits into
base: master
Choose a base branch
from

Conversation

NickAzureDevops
Copy link
Contributor

@NickAzureDevops NickAzureDevops commented Nov 14, 2024

Jira link

See DTSPO-22339

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context. List any dependencies that are required for this change.

Enable caching and compression on Front Door in the staging environment by configuring the caching_compression in the cache block. other cache attributes are made optional.

Fixes # (issue)

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration.

Will be Testing this in sandbox before doing it in perfest

Issues Found

Please list any issues found during testing and how they were resolved:

There were some TF issues on code but it is all resolved

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • Any dependent changes have been merged and published in downstream modules

Deployment Steps

Please provide the steps required to deploy these changes to Azure.

Not required

Additional Information

Please add any other information that is important to this PR, such as screenshots, logs, or links to other related PRs.

FrontDoor Module PR : hmcts/terraform-module-frontdoor#59

Pipeline: https://dev.azure.com/hmcts/PlatformOperations/_build/results?buildId=692204&view=logs&j=fc72dc6b-e2a2-56c3-f0a3-e38bccfb201a&t=139e1e77-8bc1-5e06-a2fe-4f95f481c778

🤖AEP PR SUMMARY🤖

  • components/global/main.tf 🔄

    • Changed the source URL for the premium_front_door module to include the reference "DTSPO-22339-Enable-asset-caching-and-compression-in-front-door".
  • environments/sbox/sbox.tfvars

    • Added configuration for asset caching and compression in the frontends section.
  • environments/variables.tf 🔄

    • Added a new variable "frontends" with an empty default value.

@NickAzureDevops NickAzureDevops requested a review from a team as a code owner November 14, 2024 10:27
Copy link

Code Review Suggestions

  1. Reference by Tag, not Branch: For module sources, refer to a specific tag or commit instead of a branch like DTSPO-22339-Enable-asset-caching-and-compression-in-front-door. This ensures the module version used is immutable, leading to more predictable and reliable deployments.

    Example:
    hcl
    source = "git::https://github.com/hmcts/terraform-module-frontdoor.git?ref=tags/"

    
    
  2. Type Specification for caching_compression: The caching_compression variable is missing a type specification. Specifying variable types enhances readability and validation. Consider defining it as a boolean, similar to enable_cache, if it's intended to be a boolean flag.

    Example:

    variable \"caching_compression\" {
      type    = bool
      default = false
    }
  3. Explicit caching_compression Default Value: While adding the new variable, it's a good practice to provide an explicit default value, ensuring that the module behaves predictably in environments where it might not be set.

  4. Security Concern of Hardcoding Subscriptions IDs: Ensure that hardcoded subscription IDs in environments/sbox/sbox.tfvars do not lead to security risks. Consider fetching such sensitive information dynamically if possible or ensuring they are protected appropriately if they have to be hardcoded.

  5. New Line at the End of the File: The diff shows there's no newline at the end of variables.tf file, which can lead to issues with some tools and is often considered a bad practice. It's recommended to end files with a newline.

    Correction:
    Add a newline at the end of the environments/variables.tf file.

  6. Documentation for New Variables: Add comments or documentation entries for the newly introduced variables enable_cache and caching_compression. This facilitates easier understanding and usage of the module by other developers.

    Example:

    variable \"enable_cache\" {
      type    = bool
      default = false
      description = \"Enables caching when set to true.\"
    }
    
    variable \"caching_compression\" {
      type    = bool
      default = false
      description = \"Enables compression for cached assets.\"
    }

Cost and Carbon Usage Impact:

  • The introduction of caching and compression is aimed at improving performance, which could potentially lead to cost savings by reducing the bandwidth usage and improving user experience, leading to optimized resource utilization.
  • It's hard to estimate precise cost changes without specific usage patterns and pricing details, but efficiently serving assets can reduce compute and network costs.
  • From a carbon usage perspective, optimizing asset delivery generally reduces energy consumption by serving content faster and more efficiently, thereby potentially lowering the associated carbon footprint.

Summary:

The proposed modifications aim to improve code quality, readability, and maintainability while also considering cost and carbon usage efficiency. Providing default values and types for variables enhances predictability, and optimizing content delivery can lead to both cost savings and reduced environmental impact.

@hmcts-platform-operations

Plan Result (sbox_frontendappgateway - TerraformPlanApply)

Plan: 0 to add, 2 to change, 0 to destroy.
  • Update
    • module.frontendappgateway.azurerm_application_gateway.ag[0]
    • module.frontendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0]
Change Result (Click me)
  # module.frontendappgateway.azurerm_application_gateway.ag[0] will be updated in-place
  ~ resource "azurerm_application_gateway" "ag" {
        id                                = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw"
        name                              = "cft-aks-fe-00-sbox-agw"
        tags                              = {
            "application"  = "core"
            "autoShutdown" = "true"
            "builtFrom"    = "hmcts/azure-platform-terraform"
            "businessArea" = "CFT"
            "criticality"  = "Low"
            "environment"  = "sandbox"
            "expiresAfter" = "3000-01-01"
            "startupMode"  = "always"
        }
        # (8 unchanged attributes hidden)

      - probe {
          - host                                      = "cft-api-mgmt.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/cft-api-mgmt" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "cft-api-mgmt" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "frontdoor.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/plumclassic" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "plumclassic" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "hmcts-access.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/hmcts-access" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "hmcts-access" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "hmi-apim.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/hmi-apim" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "hmi-apim" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-user-dashboard.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/idam-user-dashboard" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-user-dashboard" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-web-public.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/idam-web-public" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-web-public" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "labs-apps-njs.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/labs-apps-njs" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "labs-apps-njs" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "labs-endakelly-nodejs.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/labs-endakelly-nodejs" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "labs-endakelly-nodejs" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "labs-goldenpath-khaled.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/labs-goldenpath-khaled" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "labs-goldenpath-khaled" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "labs-rhodrif-nodejs.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/labs-rhodrif-nodejs" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "labs-rhodrif-nodejs" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "plum.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/plum" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "plum" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "reformscan.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/reformscan" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "reformscan" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      + probe {
          + host                                      = "cft-api-mgmt.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "cft-api-mgmt"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "frontdoor.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "plumclassic"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "hmcts-access.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "hmcts-access"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "hmi-apim.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "hmi-apim"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-user-dashboard.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-user-dashboard"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-web-public.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-web-public"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-apps-njs.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-apps-njs"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-endakelly-nodejs.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-endakelly-nodejs"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-goldenpath-khaled.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-goldenpath-khaled"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-rhodrif-nodejs.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-rhodrif-nodejs"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "plum.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "plum"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "reformscan.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "reformscan"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }

        # (56 unchanged blocks hidden)
    }

  # module.frontendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostics_access_logs_sa" {
        id                             = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw|app-gw-storage-account"
        name                           = "app-gw-storage-account"
        # (6 unchanged attributes hidden)

      - metric {
          - category = "AllMetrics" -> null
          - enabled  = false -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = false -> null
            }
        }

        # (5 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

⚠️ Errors

@hmcts-platform-operations
Copy link

hmcts-platform-operations commented Nov 14, 2024

Plan Result (sbox_shutter_webapp - TerraformPlanApply)

No changes. Your infrastructure matches the configuration.

⚠️ Errors

@hmcts-platform-operations

Plan Result (sbox_private_dns - TerraformPlanApply)

No changes. Your infrastructure matches the configuration.

@hmcts-platform-operations

Plan Result (sbox_backendappgateway - TerraformPlanApply)

Plan: 0 to add, 2 to change, 0 to destroy.
  • Update
    • module.backendappgateway.azurerm_application_gateway.ag[0]
    • module.backendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0]
Change Result (Click me)
  # module.backendappgateway.azurerm_application_gateway.ag[0] will be updated in-place
  ~ resource "azurerm_application_gateway" "ag" {
        id                                = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw"
        name                              = "cft-aks00-sandbox-agw"
        tags                              = {
            "application"  = "core"
            "autoShutdown" = "true"
            "builtFrom"    = "hmcts/azure-platform-terraform"
            "businessArea" = "CFT"
            "criticality"  = "Low"
            "environment"  = "sandbox"
            "expiresAfter" = "3000-01-01"
            "startupMode"  = "always"
        }
        # (8 unchanged attributes hidden)

      - probe {
          - host                                      = "bulk-scan-orchestrator-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/bulk-scan-orchestrator" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "bulk-scan-orchestrator" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "bulk-scan-payment-processor-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/bulk-scan-payment-processor" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "bulk-scan-payment-processor" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "bulk-scan-processor-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/bulk-scan-processor" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "bulk-scan-processor" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "bulk-scan-sample-app-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/bulk-scan-sample-app" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "bulk-scan-sample-app" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "div-emca-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/div-emca" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "div-emca" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "docmosis.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/dg-docmosis" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "dg-docmosis" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "draft-store-service-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/draft-store-service" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "draft-store-service" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "fpl-case-service-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/fpl-case-service" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "fpl-case-service" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-bail-case-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-bail-case-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-bail-case-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-case-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-case-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-case-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-case-documents-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-case-documents-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-case-documents-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-case-notifications-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-case-notifications-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-case-notifications-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-hearings-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-hearings-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-hearings-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-api-sprod.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/idam-api-sprod" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-api-sprod" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-api.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/idam-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-hmcts-access.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/idam-hmcts-access" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-hmcts-access" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold  

# ...
# ... The maximum length of GitHub Comment is 65536, so the content is omitted by tfcmt.
# ...

        + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "ia-case-documents-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "ia-case-documents-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "ia-case-notifications-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "ia-case-notifications-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "ia-hearings-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "ia-hearings-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-api-sprod.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-api-sprod"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-api.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-hmcts-access.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-hmcts-access"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-testing-support-api.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-testing-support-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-user-dashboard.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-user-dashboard"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-user-profile-bridge.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-user-profile-bridge"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-web-admin-sprod.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-web-admin-sprod"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-web-admin.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-web-admin"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-apps-njs-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-apps-njs"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-dj-khaled-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-dj-khaled"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "payment-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "payment-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "plum-frontend-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "plum-frontend"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "probate-business-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "probate-business-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "probate-orchestrator-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "probate-orchestrator-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "probate-submit-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "probate-submit-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rd-professional-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rd-professional-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rd-profile-sync-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rd-profile-sync"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rd-user-profile-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rd-user-profile-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "reform-scan-blob-router-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "reform-scan-blob-router"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "reform-scan-notification-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "reform-scan-notification-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rpe-send-letter-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rpe-send-letter-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "sscs-evidence-share-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "sscs-evidence-share"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "sscs-tribunals-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "sscs-tribunals-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }

        # (193 unchanged blocks hidden)
    }

  # module.backendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostics_access_logs_sa" {
        id                             = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw|app-gw-storage-account"
        name                           = "app-gw-storage-account"
        # (6 unchanged attributes hidden)

      - metric {
          - category = "AllMetrics" -> null
          - enabled  = false -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = false -> null
            }
        }

        # (5 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

⚠️ Errors

@hmcts-platform-operations

Plan Result (sbox_apim_appgw - TerraformPlanApply)

Plan: 0 to add, 2 to change, 0 to destroy.
  • Update
    • module.app-gw.azurerm_application_gateway.ag[0]
    • module.app-gw.azurerm_monitor_diagnostic_setting.diagnostic_settings[0]
Change Result (Click me)
  # module.app-gw.data.azurerm_monitor_diagnostic_categories.diagnostic_categories will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "azurerm_monitor_diagnostic_categories" "diagnostic_categories" {
      + id                  = (known after apply)
      + log_category_groups = (known after apply)
      + log_category_types  = (known after apply)
      + logs                = (known after apply)
      + metrics             = (known after apply)
      + resource_id         = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw"
    }

  # module.app-gw.azurerm_application_gateway.ag[0] will be updated in-place
  ~ resource "azurerm_application_gateway" "ag" {
        id                                = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw"
        name                              = "cft-apim00-sandbox-agw"
        tags                              = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-platform-terraform"
            "businessArea" = "CFT"
            "criticality"  = "Low"
            "environment"  = "sandbox"
            "expiresAfter" = "3000-01-01"
            "startupMode"  = "always"
        }
        # (8 unchanged attributes hidden)

      - probe {
          - host                                      = "cft-api-mgmt-appgw.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw/probes/cft-api-mgmt-appgw-probe" -> null
          - interval                                  = 10 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "cft-api-mgmt-appgw-probe" -> null
          - path                                      = "/status-0123456789abcdef" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      + probe {
          + host                                      = "cft-api-mgmt-appgw.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 10
          + minimum_servers                           = 0
          + name                                      = "cft-api-mgmt-appgw-probe"
          + path                                      = "/status-0123456789abcdef"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }

        # (15 unchanged blocks hidden)
    }

  # module.app-gw.azurerm_monitor_diagnostic_setting.diagnostic_settings[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostic_settings" {
        id                             = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw|AppGw"
        name                           = "AppGw"
        # (5 unchanged attributes hidden)

      ~ metric (known after apply)
      - metric {
          - category = "AllMetrics" -> null
          - enabled  = true -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = true -> null
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

@hmcts-platform-operations

Plan Result (sbox_apim - TerraformPlanApply)

No changes. Your infrastructure matches the configuration.

@hmcts-platform-operations
Copy link

hmcts-platform-operations commented Nov 14, 2024

Plan Result (sbox_global - TerraformPlanApply)

Plan: 0 to add, 3 to change, 0 to destroy.
  • Update
    • module.premium_front_door.azurerm_cdn_frontdoor_route.routing_rule_A["idam-web-public"]
    • module.premium_front_door.azurerm_cdn_frontdoor_route.routing_rule_B["idam-web-public"]
    • module.premium_front_door.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0]
Change Result (Click me)
  # module.premium_front_door.azurerm_cdn_frontdoor_route.routing_rule_A["idam-web-public"] will be updated in-place
  ~ resource "azurerm_cdn_frontdoor_route" "routing_rule_A" {
        id                              = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/lz-sbox-rg/providers/Microsoft.Cdn/profiles/hmcts-sbox/afdEndpoints/hmcts-sbox/routes/idam-web-public"
        name                            = "idam-web-public"
        # (12 unchanged attributes hidden)

      + cache {
          + compression_enabled           = true
          + content_types_to_compress     = []
          + query_string_caching_behavior = "UseQueryString"
          + query_strings                 = []
        }
    }

  # module.premium_front_door.azurerm_cdn_frontdoor_route.routing_rule_B["idam-web-public"] will be updated in-place
  ~ resource "azurerm_cdn_frontdoor_route" "routing_rule_B" {
        id                              = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/lz-sbox-rg/providers/Microsoft.Cdn/profiles/hmcts-sbox/afdEndpoints/hmcts-sbox/routes/idam-web-publicHttpsRedirect"
        name                            = "idam-web-publicHttpsRedirect"
        # (12 unchanged attributes hidden)

      + cache {
          + compression_enabled           = true
          + content_types_to_compress     = []
          + query_string_caching_behavior = "UseQueryString"
          + query_strings                 = []
        }
    }

  # module.premium_front_door.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostics_access_logs_sa" {
        id                             = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/lz-sbox-rg/providers/Microsoft.Cdn/profiles/hmcts-sbox|fd-log-analytics-logs-sa"
        name                           = "fd-log-analytics-logs-sa"
        # (6 unchanged attributes hidden)

      - metric {
          - category = "AllMetrics" -> null
          - enabled  = false -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = false -> null
            }
        }

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

@hmcts-platform-operations
Copy link

hmcts-platform-operations commented Nov 14, 2024

Plan Result (prod_shutter_webapp - TerraformPlanApply)

Plan: 0 to add, 6 to change, 0 to destroy.
  • Update
    • module.static_webapp.azurerm_dns_txt_record.zone_validate["adoption"]
    • module.static_webapp.azurerm_dns_txt_record.zone_validate["cui-ra"]
    • module.static_webapp.azurerm_dns_txt_record.zone_validate["et-staff-pet"]
    • module.static_webapp.azurerm_dns_txt_record.zone_validate["et-syr"]
    • module.static_webapp.azurerm_dns_txt_record.zone_validate["private-law"]
    • module.static_webapp.azurerm_dns_txt_record.zone_validate["sscs-ibca"]
Change Result (Click me)
  # module.static_webapp.azurerm_dns_txt_record.zone_validate["adoption"] will be updated in-place
  ~ resource "azurerm_dns_txt_record" "zone_validate" {
        id                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/platform.hmcts.net/TXT/_dnsauth.apply-for-adoption"
        name                = "_dnsauth.apply-for-adoption"
        tags                = {}
        # (4 unchanged attributes hidden)

      - record {
          - value = "n3zyn06dl4jk9flktv4d018rxhrrjfm7" -> null
        }
      + record {
          + value = "validated"
        }
    }

  # module.static_webapp.azurerm_dns_txt_record.zone_validate["cui-ra"] will be updated in-place
  ~ resource "azurerm_dns_txt_record" "zone_validate" {
        id                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/manage-your-support-for-hmcts-services.service.gov.uk/TXT/_dnsauth"
        name                = "_dnsauth"
        tags                = {}
        # (4 unchanged attributes hidden)

      - record {
          - value = "_b0yl28i2r5fnud7easfnlecl30qx1c8" -> null
        }
      + record {
          + value = "validated"
        }
    }

  # module.static_webapp.azurerm_dns_txt_record.zone_validate["et-staff-pet"] will be updated in-place
  ~ resource "azurerm_dns_txt_record" "zone_validate" {
        id                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/employmenttribunals.service.gov.uk/TXT/_dnsauth.admin"
        name                = "_dnsauth.admin"
        tags                = {}
        # (4 unchanged attributes hidden)

      - record {
          - value = "z51qchxt096p5249j1mxrl120fzf9r0q" -> null
        }
      + record {
          + value = "validated"
        }
    }

  # module.static_webapp.azurerm_dns_txt_record.zone_validate["et-syr"] will be updated in-place
  ~ resource "azurerm_dns_txt_record" "zone_validate" {
        id                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/respond-employment-tribunals.service.gov.uk/TXT/_dnsauth.www"
        name                = "_dnsauth.www"
        tags                = {}
        # (4 unchanged attributes hidden)

      - record {
          - value = "_14224mgrkc7hcu22ch6szfm8ta3z1aa" -> null
        }
      + record {
          + value = "validated"
        }
    }

  # module.static_webapp.azurerm_dns_txt_record.zone_validate["private-law"] will be updated in-place
  ~ resource "azurerm_dns_txt_record" "zone_validate" {
        id                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/apply-to-court-about-child-arrangements-c100.service.gov.uk/TXT/_dnsauth.www"
        name                = "_dnsauth.www"
        tags                = {}
        # (4 unchanged attributes hidden)

      - record {
          - value = "_j2gxx1py0szri6b26hf4p8l5qvr0w30" -> null
        }
      + record {
          + value = "validated"
        }
    }

  # module.static_webapp.azurerm_dns_txt_record.zone_validate["sscs-ibca"] will be updated in-place
  ~ resource "azurerm_dns_txt_record" "zone_validate" {
        id                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/appeal-infected-blood-compensation-decision.service.gov.uk/TXT/_dnsauth"
        name                = "_dnsauth"
        tags                = {}
        # (4 unchanged attributes hidden)

      - record {
          - value = "_hhaakt936xe29qoq5dv29o5aekkxwph" -> null
        }
      + record {
          + value = "validated"
        }
    }

Plan: 0 to add, 6 to change, 0 to destroy.

⚠️ Errors

@hmcts-platform-operations

Plan Result (ithc_global - TerraformPlanApply)

Plan: 0 to add, 1 to change, 0 to destroy.
  • Update
    • module.premium_front_door.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0]
Change Result (Click me)
  # module.premium_front_door.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostics_access_logs_sa" {
        id                             = "/subscriptions/62864d44-5da9-4ae9-89e7-0cf33942fa09/resourceGroups/lz-ithc-rg/providers/Microsoft.Cdn/profiles/hmcts-ithc|fd-log-analytics-logs-sa"
        name                           = "fd-log-analytics-logs-sa"
        # (6 unchanged attributes hidden)

      - metric {
          - category = "AllMetrics" -> null
          - enabled  = false -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = false -> null
            }
        }

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

@NickAzureDevops NickAzureDevops force-pushed the DTSPO-22339-Enable-asset-caching-and-compression-in-front-door branch from d0d50c4 to 2a29609 Compare November 15, 2024 16:03
Copy link

Code Review Feedback

Terraform Module Source

  • Improvement: Pin the module source to a specific version instead of a branch or tag. Using a specific release version ensures stability and predictability because branch or tag contents can change over time whereas release versions do not.
    • Example Improvement: Change the source reference from ?ref=DTSPO-22339-Enable-asset-caching-and-compression-in-front-door to a fixed version like ?ref=v1.2.3.

Newline at End of File

  • Improvement: Always ensure there's a newline at the end of the file. This is a POSIX standard and helps with file concatenation and processing tools.
    • Example Improvement: Add a newline at the end of environments/sbox/sbox.tfvars to comply with this standard.

Use of Common Tags

  • Best Practice: Verify that module.ctags.common_tags includes all necessary and appropriate tags for resource identification, cost allocation, and compliance. It's essential to have a comprehensive tagging strategy for resources.
    • Specific recommendations cannot be given without seeing the actual tags, but ensure that they include at least Environment, Project, Owner.

Cache Configuration

  • Security/Best Practice: Review and ensure that sensitive or dynamic content is not being cached inadvertently due to the broad caching rules. For instance, query_string_caching_behavior set to "IgnoreSpecifiedQueryStrings" can lead to caching content you might have intended to keep dynamic.
    • Example Improvement: Depending on the application, consider using \"BypassCaching\" for sensitive or personalized content areas or specifying a more restrictive set of query strings and content types.

Compression Settings

  • Performance/Best Practice: While enabling compression for certain content types is good for performance, ensure the list of content_types_to_compress is comprehensive and matches the content served by your application.
    • Example Improvement: If applicable, add additional content types such as application/javascript and application/json depending on the assets served by your front door.

Cost and Carbon Usage Evaluation

  • Enabling asset caching and compression can lead to reduced data transfer costs and decreased load times, which, in turn, might slightly decrease the overall carbon footprint due to decreased energy use by the client devices and network infrastructure.
  • Estimated Cost Impact: This typically results in cost savings; however, the exact savings depend on the volume of traffic and the size of the assets served. Given the data transfer out cost savings from caching, for a medium-sized application, you might see savings in the range of tens to hundreds of GBP per month.
  • Carbon Usage: Improved efficiency leads to a net reduction in energy consumption, though quantifying this requires specific insights into traffic patterns and data sizes.

Please review these suggestions considering the context and specifics of your project requirements.

Copy link

Code Review

Best Practices and Code Quality

Terraform Source Reference

  • Current Approach: The Terraform source references a specific branch of a git repository.
  • Recommended Improvement: It's common practice to reference a tagged version instead of a branch to ensure the stability and reproducibility of your infrastructure. Utilizing tagged versions helps in avoiding unexpected changes that might occur when directly pointing to a branch where active development happens.
    • Example: Replace ref=DTSPO-22339-Enable-asset-caching-and-compression-in-front-door with a stable tagged version, e.g., ref=v1.0.0.

Use of Newline at EOF

  • Current Approach: The newline at the end of environments/sbox/sbox.tfvars is missing.
  • Recommended Improvement: It's a best practice to include a newline at the end of the file. This is conventional in programming, ensuring that files adhere to POSIX standards, improving compatibility across different text editors, tools, and systems.
    • Example: Simply add a newline at the end of the sbox.tfvars file to resolve this minor issue.

Security and Cost Implications

Considering the changes involve enabling caching and compression in the front-door configuration and there are no direct security implications highlighted in the provided diff, it’s still critical to ensure:

  • Caching sensitive information: If any sensitive information gets accidentally cached due to misconfiguration, it can lead to security risks. Ensure that the caching rules exclude sensitive data.
  • Compression and Performance: While enabling compression reduces the bandwidth usage and can improve load times, critically evaluate the content types you choose to compress. Not all content types benefit equally from compression, and it can add unnecessary processing overhead in some cases.

Cost Implications

  • Cache and Compression Enablement: Enabling these features is generally positive, leading to a better user experience and potentially reducing costs associated with data transfer out rates. The exact cost impact would depend on the Azure pricing for Front Door services and how much the data transfer is reduced due to these optimizations.
    • Estimated Change: The cost can vary significantly based on usage patterns. If caching effectively reduces the amount of data transferred from the origin, you might see a decrease in costs. The savings might be more pronounced for high-traffic environments where the same assets are requested frequently. It's recommended to monitor the usage and adjust caching strategies accordingly.

Carbon Usage

  • Reducing Data Transfer: By enabling caching and compression, the data transferred over the network is reduced, which can contribute to lower carbon emissions. Data centers and network infrastructure consume energy; by optimizing the data transfer, you're indirectly contributing to less energy requirement for data transit.
  • Optimized Content Delivery: Efficiently serving content not only has the potential to reduce costs but also contributes towards lower energy consumption, as fewer resources are used to process and deliver data to end-users.

Recommendations for Carbon Usage Optimization

  • Content Types to Compress: Consider specifying which content types to compress. Efficient compression strategies can lead to significant reductions in data transfer, benefiting both performance and carbon footprint.
  • Monitor and Analyze: Use Azure's built-in tools to monitor the performance and efficiency of your caching and compression settings. Adjusting these configurations based on actual usage patterns can lead to further optimizations.

Copy link

Terraform Module Source Versioning

  • Issue: The change moves the module source to a specific branch ref. While specifying a branch can be useful for short-term fixes or testing, it's prone to breaking changes if the branch is updated or deleted.
  • Improvement: It's best practice to use a tag or a fixed commit hash for module sources in Terraform to ensure the infrastructure is consistent and stable. Example:
    hcl
    source = "git::https://github.com/hmcts/terraform-module-frontdoor.git?ref=tags/v1.2.3\"
or 
```hcl
source = \"git::https://github.com/hmcts/terraform-module-frontdoor.git?ref=c0a5f45e\"

Security and Performance

  • Issue: Enabling cache and compression is a significant change that can affect both security and performance. If not properly managed, cached sensitive data could lead to information leakage, and compression can make your application susceptible to attacks like BREACH.
  • Improvement: Ensure you have a way to invalidate the cache for sensitive data or paths that should not be cached. It would also be beneficial to perform a risk assessment or security review on the impact of enabling compression, considering your specific application's context.

Configuration for Environments

  • Issue: Adding configurations directly in the .tfvars file for sandbox might quickly lead to discrepancies between environments if similar changes are needed or beneficial in other environments but are forgotten to be applied there.
  • Improvement: Consider using a more centralized approach for configurations that are common across environments but might have environment-specific values. Modularize your configurations and use a hierarchical approach for managing environment-specific values.

Code Consistency

  • Issue: Missing a newline at the end of the file can be seen as a minor issue but maintaining consistency in code formatting is crucial for readability and to avoid unnecessary git diff noise in the future.
  • Improvement: Ensure your files end with a newline. This could be enforced with editor configurations or pre-commit hooks that automatically format your code or check for such issues.

Documentation and Comments

  • Although not directly shown in the diff, ensuring that these changes are well-documented within the code or project documentation can save time and confusion in the future. Specifically:
    • Add comments explaining why caching and compression are enabled for this environment, including any potential impacts.
    • Document any new variables or configurations introduced, particularly around cache_enabled and global_exclusions, to ensure clarity on their purpose and usage.

Summary and Cost Implications

While the changes are geared towards performance improvements, be mindful of the potential cost implications:

  • Enabling caching could reduce the load on backend services, potentially decreasing compute and network costs. However, if not carefully managed, it could lead to additional costs due to increased storage requirements for the cached content.
  • Compression reduces bandwidth usage which might lower the data transfer costs, but also slightly increases CPU usage.
  • It's challenging to precisely estimate cost changes without detailed usage patterns, but generally, optimizing for performance often correlates with cost-efficiency. Be prepared to monitor the changes closely after implementation to adjust as needed.

@NickAzureDevops NickAzureDevops force-pushed the DTSPO-22339-Enable-asset-caching-and-compression-in-front-door branch from 04b8e43 to 79df222 Compare November 15, 2024 16:27
Copy link

Code Review Recommendations

  1. Version Pinning for Terraform Modules:
    Switching from the master branch to a specific feature branch DTSPO-22339-Enable-asset-caching-and-compression-in-front-door is a positive step towards better version control and reproducibility. However, it's advisable to use tagged versions instead of branch names whenever possible. Tagged versions help ensure that the infrastructure does not inadvertently change if updates are made to the branch.

    Example:
    diff

    
    
  2. Caching Configuration Defaults and Specificity:
    The newly added cache configuration lacks specificity in terms of what to cache and what to compress. Defining empty arrays for query_string_caching_behavior, query_strings, and content_types_to_compress may lead to unoptimized caching and compression behavior. Provide reasonable defaults or specific values based on anticipated traffic patterns and content types.

    Example:

    cache_enabled = {
      enabled = true
      compression_enabled = true
      query_string_caching_behavior = [\"IgnoreQueryString\"]
      query_strings = [\"sessionId\", \"authToken\"]
      content_types_to_compress = [\"text/html\", \"application/javascript\", \"text/css\"]
    }
  3. Security and Best Practice:
    a. Sensitive Data Exposure: Ensure any sensitive information (e.g., backend_domain, certificate_name) in sbox.tfvars is not exposed, especially when working in public repositories. Consider using environment variables or secure secrets management practices.

    b. Ensure there's a newline at the end of sbox.tfvars: It's a good practice to include a newline at the end of files to ensure compatibility across different systems and software.

  4. Cost Considerations: Enabling asset caching and compression can reduce data transfer costs and improve response times for end-users. Precise cost savings depend on the volume of traffic and the ratio of cache hits. Consider monitoring these metrics to refine caching rules and achieve optimal cost-efficiency.

  5. Carbon Usage: By enabling asset caching and compression, you're likely to reduce carbon usage due to decreased data transfer over the network and reduced load on servers. This efficiency is more pronounced for high-traffic services. It's a step in the right direction towards greener infrastructure.

  6. Documentation and Comments: Adding comments or documentation within the Terraform configuration that outlines the rationale behind enabling caching and specifying the chosen caching and compression settings could be beneficial for future maintenance and understanding the infrastructure setup.

Summary

The modifications introduced aim at enabling asset caching and compression which is commendable for performance and cost optimization. Ensuring the use of specific, tagged versions of Terraform modules, providing sensible defaults for caching and compression settings, safeguarding sensitive data, and adhering to best practices for file formatting are crucial for maintaining a secure, efficient, and highly maintainable infrastructure.

Copy link

Review of Git Diff

Terraform Module Reference

  • Update Reference for Stability: Referencing a specific branch (DTSPO-22339-Enable-asset-caching-and-compression-in-front-door) in the Terraform module source can be less stable than using a tagged version. If possible, recommending the use of version tags ensures the source code is stable and not subject to changes that could break your infrastructure unexpectedly. For example:

    hcl
    source = "git::https://github.com/hmcts/terraform-module-frontdoor.git?ref=v1.0.0\"

    
    
  • Cost & Carbon Usage: Enabling cache and compression could potentially reduce data transfer costs and improve performance, thereby potentially lowering costs and carbon usage due to reduced computation and transmission energy. However, actual savings would depend on the existing traffic patterns and the size of the assets being served. If the costs prior to this change and subsequent costs after deployment are analyzed, a more accurate estimate could be provided.

Terraform Variable Management

  • Unresolved TODO: The shutter_storage variable comment indicates that it is a "TODO". This should either be addressed by providing a default value that makes sense or by documenting why it's left as "TODO" and any intended future plans for it. Neglecting such placeholders can lead to confusion or future errors.

    variable \"shutter_storage\" {
      default = \"defaultStorageAccountName\" // Update with an appropriate default value or remove if unused
    }
  • Consistency in Terraform Variables: Adding complex configurations such as cache_enabled directly into the sbox.tfvars file improves flexibility but might sacrifice readability and manageability, especially as configurations grow. Consider structuring complex configurations using separate files or modules, making it easier to maintain and understand.

Best Practices & Security

  • No newline at end of file: The removal of the newline at the end of the sbox.tfvars file is generally discouraged as it can lead to unexpected behaviors or issues when concatenating or processing files. Ensuring proper file formatting, including ending with a newline, is a minor but good practice to follow.

Additional Improvements

  • Documentation: Adding comments or documentation regarding the enablement of caching and compression, and their expected benefits, can help future maintainers understand the reasons behind these choices.

  • Monitoring and Logging: To ensure that the changes have the desired effect, it would be beneficial to enhance monitoring and logging capabilities to track the performance benefits and any potential issues introduced by enabling these features.

Conclusion

While the changes introduced in this diff aim at improving performance through caching and compression, attention should be paid to best practices such as version pinning in Terraform modules, addressing TODOs meaningfully, adhering to good file format practices, and ensuring the infrastructure's changes are well documented and monitored. These improvements not only aid in maintainability but can also contribute to cost optimizations and reductions in carbon usage over time.

@NickAzureDevops NickAzureDevops force-pushed the DTSPO-22339-Enable-asset-caching-and-compression-in-front-door branch from 3b0dd6c to 50dcd55 Compare November 15, 2024 17:13
Copy link

Code Review Recommendations

Terraform Module Source Pinning

Secure Terraform Practices

  • Concern: Sensitive data management isn't addressed.
  • Recommendation: Ensure that no sensitive data (e.g., certificate_name) is hard-coded. Use secure storage (e.g., AWS Secrets Manager, Azure Key Vault) and reference these secrets safely.
    + variable \"certificate_name_secret_id\" {}
    + data \"azuread_application_password\" \"example\" {
    +     key_id = var.certificate_name_secret_id
    + }
    - certificate_name = \"wildcard-sandbox-platform-hmcts-net\"
    + certificate_name = data.azuread_application_password.example.value

Sustainability Considerations

  • Current: cache_enabled is updated to true, which is generally positive for reducing compute load and improving efficiency.
  • Additional Consideration: Besides enabling caching, assess the cache duration and content type to ensure optimal performance and minimal unnecessary data transfer. Fine-tune the caching rules further if possible.

Code Quality and Maintenance

  • Current: The "TODO" comment was not resolved.
  • Recommendation: Either complete the task associated with the TODO or remove it if it's no longer relevant.
    - default = \"TODO\" // Is this even used?
    + default = \"\" # Ensure this variable is either implemented correctly or removed if obsolete.

Versioning and Compatibility

  • Ensure compatibility with your Terraform version and the provider versions used in the project. Pinning specific versions for Terraform and providers ensures stability and predictability.
    terraform {
      required_version = \">= 0.12, < 0.14\"
      required_providers {
        azuread = {
          version = \"~> 1.0\"
        }
      }
    }

Missing New Line at EOF

  • Current: The sbox.tfvars file does not end with a newline.
  • Recommendation: POSIX standards suggest files should end with a newline. It ensures that tools like cat, sed, or awk work as expected when processing the file.
    -]
    +]
    + 

These recommendations are not exhaustive but are aimed at improving the security, maintainability, and sustainability of the codebase.

@NickAzureDevops NickAzureDevops force-pushed the DTSPO-22339-Enable-asset-caching-and-compression-in-front-door branch from e1e71d8 to c6fb0e6 Compare November 15, 2024 17:32
Copy link

Terraform Code Review Recommendations

General Practices

  1. Version Pinning for Terraform Modules: The update in the source of module \"premium_front_door\" moves from master to a specific ref. This is good practice as it ensures repeatability of your deployments. However, ensure that you periodically review and update the reference to include the latest changes and security patches.

    Example:
    hcl
    source = "git::https://github.com/hmcts/terraform-module-frontdoor.git?ref=v1.0.1\"

    
    
  2. Use of optional Keyword in Variables: You have made good use of the optional keyword in frontends variable definition. This is a great method for creating flexible module interfaces. Ensure consistent usage across other variables where it makes sense, enhancing module usability and configuration flexibility.

  3. End of File (EOF) Newline Consistency: Your diff indicates the removal of a newline at EOF in sbox.tfvars. It's a good practice to ensure all files end with a newline for POSIX compliance, and for cleaner diffs in future changes.

    Action: Re-add a newline at the end of sbox.tfvars.

  4. Placeholder Use: The placeholder \"TODO\" within variable \"shutter_storage\" stands out. Ensure that this is addressed before production use. Consider implementing a mechanism to ensure that such placeholders are resolved during development cycles, possibly through code comments or documentation.

    Suggestion:

    // TODO: Define the purpose and intended values for \"shutter_storage\"

Security and Cost Considerations

  1. Enable Asset Caching and Compression: Enabling cache and compression as seen in the sbox.tfvars is beneficial from a performance perspective but requires careful management to avoid serving stale content. Ensure your cache invalidation policies and compression configurations are aligned with your application behavior.

    Note: While there isn't a direct cost or security concern visible in the diff provided, the changes could indirectly affect both through improved site efficiency (potentially lowering costs on bandwidth) and ensuring correct content delivery.

  2. Validation of Configuration Inputs: Especially for the frontends variable now accepting a complex object, consider implementing validation rules to ensure the configurations passed comply with expected formats or value ranges. This is crucial for maintaining security and operational integrity by preventing misconfigurations.

    Example validation for certificate_name:

    validation {
      condition     = can(regex(\"^[a-zA-Z0-9-]+.[a-zA-Z]+\", var.certificate_name))
      error_message = \"The certificate name must be a valid domain name.\"
    }
  3. Review Compression for Sensitive Content: If content_types_to_compress includes types that could be sensitive, ensure that the benefits of compression do not introduce security vulnerabilities, e.g., BREACH attacks. Adjust your configuration accordingly or implement additional security measures like CSRF tokens.

  4. Cost Estimation and Optimization: The changes indicate an implementation towards better performance (caching, compression). Improved performance might reduce the load on your origin server, potentially saving costs. However, use Terraform cost estimation tools or cloud provider price calculators to approximate these changes. Remember, enabling features like cache and compression might incur additional costs at the CDN level depending on provider pricing models.

Carbon Footprint Consideration

  • Improved performance from caching and compression may contribute to lower energy consumption due to reduced data transmission and server load. While this is generally positive from a carbon footprint perspective, the exact impact is intricate to calculate without specific data on traffic patterns and server energy efficiency.

    Consider using sustainable cloud initiatives, optimizing server utilization, and choosing efficient data centers (e.g., with renewable energy) to further reduce carbon usage.

Copy link

Code Review Feedback

Terraform Module Source Pinning

  • Issue: The module premium_front_door source has been updated to point to a specific branch (DTSPO-22339-Enable-asset-caching-and-compression-in-front-door). Using branches can lead to unstable builds since the branch head can change.
  • Recommendation: Pin the module to a specific tag or release version to ensure stability and predictability of builds.
  • Example:
    hcl
    source = "git::https://github.com/hmcts/terraform-module-frontdoor.git?ref=v1.0.0\"
    
    

Variable Type Specification for Clarity

  • Issue: The new frontends variable type is deeply nested and includes optional structures, which adds complexity.
  • Recommendation: For complex object types, especially with optional values, ensure documentation within the variables.tf is clear on each parameter's purpose. This aids in maintainability and usability of the module.
  • Example: In the frontends variable definition, add comments for each attribute:
    variable \"frontends\" {
      description = \"List of frontend configurations.\"
      type = list(object({
        name = string // Name of the frontend.
        custom_domain = string // Custom domain for the frontend.
        dns_zone_name = string // DNS zone for the custom domain.
        shutter_app = bool // Indicates if the shutter app feature is enabled.
        backend_domain = list(string) // List of backend domains.
        certificate_name = string // Name of the SSL certificate.
        cache_enabled = optional(object({
          enabled = bool // Indicates if caching is enabled.
          compression_enabled = bool // Indicates if compression is enabled.
          query_string_caching_behavior = optional(string) // Caching behavior for query strings.
          query_strings = optional(list(string)) // Specific query strings to cache.
          content_types_to_compress = optional(list(string)) // Content types eligible for compression.
        }), null)
      }))
      default = []
    }

Handling Optional Values

  • Issue: The cache_enabled structure within frontends variable includes several optional attributes without default values specified.
  • Recommendation: Define clear defaults for optional attributes to ensure predictable behavior even if these attributes aren't specified by the user.
  • Example:
    variable \"frontends\" {
      # Existing attributes...
      cache_enabled = optional(object({
        enabled = bool
        compression_enabled = bool
        query_string_caching_behavior = optional(string, \"NotSet\")
        query_strings = optional(list(string), [])
        content_types_to_compress = optional(list(string), [])
      }), null)
    }

Newline at End of File

  • Issue: The new change in sbox.tfvars removes the newline at the end of the file.
  • Recommendation: Always ensure there's a newline at the end of the file to conform with Unix text file conventions. This can avoid issues with version control systems and tools that process text files.
  • Example: Simply add a newline at the end of sbox.tfvars.

Variable \"shutter_storage\" Clarification

  • Issue: shutter_storage is introduced with a default of "TODO" but it's unclear how it's used or if it's necessary.
  • Recommendation: Clarify the usage of this variable. If it's unnecessary or pending implementation, document its intended use or remove it until it's required.

Summary

The updates aim at improving the stability, maintainability, and clarity of the Terraform configurations. No direct cost changes or significant carbon usage implications are identified with these recommendations, as they predominantly pertain to code quality and best practices.

Copy link

Code Review Feedback

Terraform module version reference

  • Issue: Pinning the Terraform module to a specific Git branch (DTSPO-22339-Enable-asset-caching-and-compression-in-front-door) can be risky as the branch might get deleted or updated with breaking changes.
  • Improvement: Use a tagged version instead of a branch name for more stability and predictability in deployments. For example, after testing, tag the commit in the repository and reference it like ?ref=v1.0.0.

Terraform shutter_storage variable comment

  • Issue: The comment // Is this even used? regarding the shutter_storage variable suggests uncertainty about the usage of this variable.
  • Improvement: Verify if the shutter_storage variable is in use. If not, it should be removed to clean up the codebase. If it is used, update the comment to reflect its purpose and remove the ambiguity.

No newline at the end of file

  • Issue: The lack of a newline at the end of the environments/sbox/sbox.tfvars file.
  • Improvement: It's a common practice to end files with a newline to conform to POSIX standards and to avoid potential issues with tools that process text files. Adding a newline at the end of the file can avoid unnecessary diff lines in future changes.

Hardcoded domain in sbox.tfvars

  • Issue: The domain firewall-sbox-int-palo-sbox.uksouth.cloudapp.azure.com is hardcoded.
  • Improvement: Consider parameterizing the domain or moving it to a configuration file that doesn't get tracked by Git. This increases flexibility and reduces the risk of exposing environment-specific details in your version control system.

Terraform Formatting

  • Best Practice: Ensure Terraform files are formatted with terraform fmt. This command automatically updates configurations in the current directory for readability and consistency.

Terraform variable \"TODO\" usage

  • Issue: The default value of the \"shutter_storage\" variable is set to \"TODO\".
  • Improvement: Replace \"TODO\" with an actual default value or if the variable is mandatory, remove the default value to enforce the user to provide it. This helps in self-documenting the code and avoiding deployment with placeholder values.

Cost and Carbon Usage

  • Without specific costs associated with the services being modified (front_door, cache_enabled, query_string_caching_behavior, etc.), it's difficult to provide a precise cost or carbon usage impact. Adding caching and compression usually improves performance and can reduce bandwidth costs. However, it's good practice to monitor your cloud bill to track changes related to this feature enablement. Cost optimization tools or cloud provider billing alerts can help identify unexpected increases.

Remember, changes in infrastructure as code should always be reviewed with an understanding of the infrastructure cost and potential environmental impact, but specific details require access to pricing models and usage patterns.

Copy link

Code Review Feedback

1. Terraform Module Source Pinning

  • Improvement: Although the switch from master to a specific branch DTSPO-22339-Enable-asset-caching-and-compression-in-front-door in components/global/main.tf adds specificity, it's better practice to pin to a specific release or commit for even more stability and predictability in deployments.
  • Example:
    hcl
    source = "git::https://github.com/hmcts/terraform-module-frontdoor.git?ref=v1.2.3\"
  • Benefit: This prevents unexpected changes from affecting your infrastructure and improves the reliability of the deployment process.

2. Clear Definition of Variables and Defaults

  • Improvement: The addition of complex variable structures like caching in environments/sbox/sbox.tfvars suggests that these variables should be clearly defined in environments/variables.tf with proper types and descriptions. This ensures clarity and validation of input values.
  • Example:
    variable \"caching\" {
      description = \"Configuration for caching behavior and compression settings.\"
      type = object({
        compression_enabled                = bool
        query_string_caching_behavior      = string
        query_strings                      = list(string)
        content_types_to_compress          = list(string)
      })
      default = {}
    }

3. shutter_storage Default Value and Comment

  • Improvement: The default = \"TODO\" for shutter_storage in environments/variables.tf indicates an unfinished piece of work. If the variable is not in use, it should either be implemented properly or removed to avoid confusion.
  • Action Required: Clarify the usage of shutter_storage. If necessary, update the default value to a sensible default or remove the variable if it's unused.

4. Security and Best Practices in Configuration

  • For variables like content_types_to_compress in caching settings, provide a secure and optimized default list based on the application's requirements to ensure efficient use of resources and enhanced performance.
  • Example:
    content_types_to_compress = [\"text/html\", \"text/css\", \"application/javascript\"]
  • Benefit: Setting sensible defaults can lead to improved performance and costs by ensuring that only suitable content types are compressed.

Cost and Carbon Usage Implications

  • Compression and Caching: Enabling compression and caching can lead to cost savings and reduced carbon footprint by decreasing the amount of data transferred over the network and reducing the load on the server. Specific cost savings would depend on the amount of data and the traffic patterns, but optimizing transfer size always contributes to better resource utilization.

    Enabling these features can significantly enhance user experience and reduce costs associated with data transfer, especially for high-traffic environments. Depending on your cloud provider's pricing model, savings could range from negligible to substantial. A specific GBP estimation would require data on current usage and traffic patterns.

Recommendations Summary

  • Pin Terraform module sources to specific releases or commits.
  • Clearly define complex input variables with proper types and defaults.
  • Address any "TODO" items or unclear default values in your Terraform configurations.
  • Set secure and optimized defaults for variables that impact performance and cost.
  • Evaluate the implementation of compression and caching on a cost-benefit and environmental impact basis.

Copy link

Assessment and Recommendations

Components Global Main Terraform File

Environments Sbox TFVars

  • Asset Caching and Compression: Enabling compression and specific caching behaviors can greatly improve user experience and reduce load times, which is excellent. However, specifying empty arrays for query_strings and content_types_to_compress might not utilize the feature to its fullest potential. Consider including common static asset content types that are safe to compress, like text/html, text/css, application/javascript, etc.

    + content_types_to_compress = [\"text/html\", \"text/css\", \"application/javascript\"]
  • Cost and Carbon Usage: Enabling asset caching can lead to a reduction in data transfer costs, especially for frequently accessed resources, potentially lowering the overall cost. Also, efficient asset handling can marginally reduce carbon footprint by decreasing the amount of data transferred over the network.

Environment Variables Terraform File

  • Review and Confirm Placeholder Items: For the shutter_storage variable with a default value of \"TODO\", ensure this is addressed before live deployment to avoid potential runtime errors or misconfigurations. If it's no longer needed, consider removing it to clean up the codebase.

    - variable \"shutter_storage\" { default = \"TODO\" // Is this even used? }
    + # Review needed to confirm if \"shutter_storage\" variable is required and update or remove accordingly.
  • General Best Practices:

    • Documentation: Inline documentation for each variable and module can greatly improve maintainability. Consider adding comments describing the purpose and expected values for each, especially for non-self-explanatory entries.
    • Security Review: Since changes involve asset caching and compression, review security implications, ensuring that sensitive data is not inadvertently cached and that compression configurations do not introduce vulnerabilities such as CRIME.

Overall, the changes are heading in the right direction by leveraging caching and compression to improve performance. Ensure the configurations are finely tuned, maintained, and reviewed for security and cost benefits.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment