feat(terraform)!: access backend behind firewall

.github/workflows/terraform.yml

@@ -23,8 +23,7 @@ on:
       backend_config:
         description: The path, relative to the working directory, of a configuration file containing the remaining arguments for a partial backend configuration.
         type: string
-        required: false
-        default: ""
+        required: true
         # Ref: https://developer.hashicorp.com/terraform/language/settings/backends/configuration#partial-configuration
 
       artifact_name:
@@ -78,7 +77,27 @@ env:
   ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
   ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
 
-  ENCRYPTION_PASSWORD: ${{ secrets.ENCRYPTION_PASSWORD }}
+  BACKEND_CONFIG: ${{ inputs.backend_config }}
+
+  PRE_FLIGHT_SCRIPT: |
+    RESOURCE_GROUP=$(jq -r .resource_group_name ${{ inputs.backend_config }})
+    ACCOUNT_NAME=$(jq -r .storage_account_name ${{ inputs.backend_config }})
+    IP_ADDRESS=$(curl https://api.ipify.org)
+
+    echo "IP address: $IP_ADDRESS"
+
+    # Make environment variables available to other steps and jobs.
+    # It's important that this is done before trying to update the Storage account network rules,
+    # as these variables will be used by the job that reverts this change if an error occurs.
+    {
+      echo "RESOURCE_GROUP=$RESOURCE_GROUP" >> "$GITHUB_ENV"
+      echo "ACCOUNT_NAME=$ACCOUNT_NAME" >> "$GITHUB_ENV"
+      echo "IP_ADDRESS=$IP_ADDRESS" >> "$GITHUB_ENV"
+    } >> "$GITHUB_ENV"
+
+    az storage account network-rule add --resource-group "$RESOURCE_GROUP" --account-name "$ACCOUNT_NAME" --ip-address "$IP_ADDRESS" --output none
+
+  POST_FLIGHT_SCRIPT: az storage account network-rule remove --resource-group "$RESOURCE_GROUP" --account-name "$ACCOUNT_NAME" --ip-address "$IP_ADDRESS" --output none
 
 jobs:
   terraform-plan:
@@ -107,6 +126,17 @@ jobs:
         id: fmt
         run: terraform fmt -check
 
+      # Required for Azure CLI commands
+      - name: Login to Azure
+        uses: Azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+
+      - name: Run pre-flight script
+        run: ${{ env.PRE_FLIGHT_SCRIPT }}
+
       - name: Terraform Init
         id: init
         run: terraform init
@@ -123,6 +153,10 @@ jobs:
         id: plan
         run: terraform plan -no-color -input=false -out=tfplan -detailed-exitcode
 
+      - name: Run post-flight script
+        if: always()
+        run: ${{ env.POST_FLIGHT_SCRIPT }}
+
       # The stdout of the plan step must not be set in an intermediate environment variable.
       # Long environment variables will cause Bash to throw an error "Argument list too long" on startup.
       - name: Create job summary
@@ -200,9 +234,24 @@ jobs:
           7z x -p"$ENCRYPTION_PASSWORD" terraform.tar.7z
           tar -xf terraform.tar
 
+      # Required for Azure CLI commands
+      - name: Login to Azure
+        uses: Azure/login@v1
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+
+      - name: Run pre-flight script
+        run: ${{ env.PRE_FLIGHT_SCRIPT }}
+
       - name: Terraform Apply
         run: terraform apply -auto-approve -input=false tfplan
 
+      - name: Run post-flight script
+        if: always()
+        run: ${{ env.POST_FLIGHT_SCRIPT }}
+
       # Once the Terraform plan file has been applied, the artifact is no longer needed.
       # Delete it to save storage space.
       - name: Delete artifact