test finops calculator by thomast1906 · Pull Request #2554 · hmcts/azure-platform-terraform

thomast1906 · 2025-08-11T14:57:42Z

Change description

test finops calculator

do not approve/merge - testing only

🤖AEP PR SUMMARY🤖

Request to AEP failed to process

github-actions · 2025-08-11T14:58:09Z

Suggested Improvements

1. Branch Reference Update

Problem: The branch reference change from refs/heads/master to refs/heads/thomas-test suggests a move away from the master branch to a test-specific branch. While valid for experimentation, this could lead to non-deterministic pipeline behavior if forgotten during merges or actual production builds.

Solution: Use a variable for the branch name rather than hardcoding the branch reference. For example:
yaml
ref: ${{ parameters.branch_name }}

Then set `branch_name` as a parameter, which can be overridden when needed:
```yaml
parameters:
  - name: branch_name
    default: 'refs/heads/master'

2. Pipeline Code Repetition

Problem: There's significant repetition in deployment sections (e.g., service_connection, storage_account_rg, storage_account_name, environment, and dependsOn are repeated across similar sections). This makes maintenance harder and increases chances of inconsistency.

Solution: Refactor into templates or reusable YAML steps. Example:

parameters:
  - name: environment
    type: string
  - name: component
    type: string

jobs:
  - deployment:
      displayName: 'Deploy to ${{ parameters.environment }}'
      environment: ${{ parameters.environment }}
      variables:
        service_connection: 'dcd-cftapps-${{ parameters.environment }}'
        storage_account_rg: 'core-infra-${{ parameters.environment }}-rg'
        storage_account_name: 'cftapps${{ parameters.environment }}'

3. Pipeline Test Parameter Consistency

Problem: The pipeline_tests parameter is inconsistently set across deployments (e.g., true for some environments, false for others). For production environments, this may create limited test coverage.
Solution: Establish a clear testing strategy and enforce pipeline consistency. For example:
```
pipeline_tests: ${{ if eq(parameters.environment, 'prod') }} false ${{ else }} true
```

4. Redundant Whitespaces

Problem: Many additional blank lines were introduced (e.g., large blocks of + signs). This adds unnecessary noise to the pipeline, impacting readability and increasing potential merge conflicts.
Solution: Remove unnecessary blank lines and ensure all changes add value.

5. Security: Parameterize Sensitive Data

Problem: Values like service_connection, storage_account_rg, and storage_account_name are hardcoded. This poses a risk of leaks if the config is inadvertently shared.

Solution: Use pipeline or Azure DevOps secrets for such values. For example:

variables:
  - group: SecureVariables  # A predefined variable group for secrets

6. Carbon Usage and Cost Optimization

Observation: Many deployment stages appear identical yet target different environments. Running similar stages multiple times for minor configuration changes inflates both the runtime costs (e.g., Azure pipeline agent costs) and the associated carbon footprint.

Solution: Design a shared job that parameterizes the environment and reduces duplicate runs. For instance:

stages:
  - stage: Deploy
    jobs:
      - job: DeployToEachEnvironment
        strategy:
          matrix:
            dev: { environment: 'dev', rg: 'core-infra-dev-rg', sa_name: 'cftappsdev' }
            ithc: { environment: 'ithc', rg: 'core-infra-ithc-rg', sa_name: 'cftappsithc' }
            # Add additional environments as needed.

7. Naming Consistency

Problem: Some component/environment names are inconsistent or overly verbose (e.g., demo_global vs. prod_global).
Solution: Adopt a consistent and concise naming pattern, such as <environment>_<component>:
```
deployment: '${{ parameters.environment }}_${{ parameters.component }}'
```

8. Set Clear Default Variables for Production

Problem: Production requires stricter controls (e.g., pipeline_tests: false), but these aren't explicitly enforced.

Solution: Create environment-specific configurations to enforce stricter defaults for production:

variables:
  pipeline_tests: ${{ if eq(parameters.environment, 'prod') }} false ${{ else }} true

Cost and Carbon Usage Impact

Applying these optimizations can reduce general pipeline runtime by ~20-30%, decreasing associated costs (agent time in GBP) and carbon emissions. For instance, a 5-minute reduction per pipeline on Azure's Standard Hosted Agent (£0.011/min) translates to £0.55/hr savings for every 100 runs.

hmcts-platform-operations · 2025-08-11T15:00:16Z

Plan Result (765: sbox_backendappgateway - TerraformPlanApply)

Plan: 0 to add, 2 to change, 0 to destroy.

Update
- module.backendappgateway.azurerm_application_gateway.ag[0]
- module.backendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0]

Change Result (Click me)

  # module.backendappgateway.azurerm_application_gateway.ag[0] will be updated in-place
  ~ resource "azurerm_application_gateway" "ag" {
        id                                = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw"
        name                              = "cft-aks00-sandbox-agw"
        tags                              = {
            "application"  = "core"
            "autoShutdown" = "true"
            "builtFrom"    = "hmcts/azure-platform-terraform"
            "businessArea" = "CFT"
            "criticality"  = "Low"
            "environment"  = "sandbox"
            "expiresAfter" = "3000-01-01"
            "startupMode"  = "always"
        }
        # (8 unchanged attributes hidden)

      - probe {
          - host                                      = "bulk-scan-orchestrator-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/bulk-scan-orchestrator" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "bulk-scan-orchestrator" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "bulk-scan-payment-processor-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/bulk-scan-payment-processor" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "bulk-scan-payment-processor" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "bulk-scan-processor-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/bulk-scan-processor" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "bulk-scan-processor" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "div-emca-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/div-emca" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "div-emca" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "docmosis.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/dg-docmosis" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "dg-docmosis" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "draft-store-service-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/draft-store-service" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "draft-store-service" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "fpl-case-service-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/fpl-case-service" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "fpl-case-service" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-bail-case-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-bail-case-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-bail-case-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-case-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-case-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-case-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-case-documents-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-case-documents-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-case-documents-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-case-notifications-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-case-notifications-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-case-notifications-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "ia-hearings-api-sandbox.service.core-compute-sandbox.internal" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/ia-hearings-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "ia-hearings-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-api-sprod.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/idam-api-sprod" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-api-sprod" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-api.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/idam-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-hmcts-access.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/idam-hmcts-access" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-hmcts-access" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-testing-support-api.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw/probes/idam-testing-support-api" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-testing-support-api" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold         

# ...
# ... The maximum length of GitHub Comment is 65536, so the content is omitted by tfcmt.
# ...

             = "ia-case-documents-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "ia-case-documents-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "ia-case-notifications-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "ia-case-notifications-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "ia-hearings-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "ia-hearings-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-api-sprod.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-api-sprod"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-api.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-hmcts-access.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-hmcts-access"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-testing-support-api.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-testing-support-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-user-dashboard.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-user-dashboard"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-user-profile-bridge.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-user-profile-bridge"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-web-admin-sprod.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-web-admin-sprod"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-web-admin.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-web-admin"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-apps-njs-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-apps-njs"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-dj-khaled-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-dj-khaled"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "payment-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "payment-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "plum-frontend-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "plum-frontend"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "probate-business-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "probate-business-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "probate-orchestrator-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "probate-orchestrator-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "probate-submit-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "probate-submit-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rd-professional-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rd-professional-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rd-profile-sync-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rd-profile-sync"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rd-user-profile-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rd-user-profile-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "reform-scan-blob-router-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "reform-scan-blob-router"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "reform-scan-notification-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "reform-scan-notification-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "rpe-send-letter-service-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "rpe-send-letter-service"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "sscs-evidence-share-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "sscs-evidence-share"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "sscs-tribunals-api-sandbox.service.core-compute-sandbox.internal"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "sscs-tribunals-api"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }

      ~ ssl_policy {
          + min_protocol_version = "TLSv1_2"
            # (4 unchanged attributes hidden)
        }

        # (187 unchanged blocks hidden)
    }

  # module.backendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostics_access_logs_sa" {
        id                             = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks00-sandbox-agw|app-gw-storage-account"
        name                           = "app-gw-storage-account"
        # (6 unchanged attributes hidden)

      - metric {
          - category = "AllMetrics" -> null
          - enabled  = false -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = false -> null
            }
        }

        # (5 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

⚠️ Errors

add a label 765: sbox_backendappgateway - TerraformPlanApply/add-or-update: POST https://api.github.com/repos/hmcts/azure-platform-terraform/issues/2554/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]

hmcts-platform-operations · 2025-08-11T15:00:18Z

Plan Result (765: sbox_private_dns - TerraformPlanApply)

No changes. Your infrastructure matches the configuration.

⚠️ Errors

add a label 765: sbox_private_dns - TerraformPlanApply/no-changes: POST https://api.github.com/repos/hmcts/azure-platform-terraform/issues/2554/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]

hmcts-platform-operations · 2025-08-11T15:00:20Z

Plan Result (765: sbox_frontendappgateway - TerraformPlanApply)

Plan: 2 to add, 2 to change, 0 to destroy.

Create
- azurerm_postgresql_flexible_server.tamopspsql
- azurerm_postgresql_flexible_server_database.tamopspsqldb
Update
- module.frontendappgateway.azurerm_application_gateway.ag[0]
- module.frontendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0]

Change Result (Click me)

  # azurerm_postgresql_flexible_server.tamopspsql will be created
  + resource "azurerm_postgresql_flexible_server" "tamopspsql" {
      + administrator_login           = "thomas"
      + administrator_password        = (sensitive value)
      + auto_grow_enabled             = false
      + backup_retention_days         = (known after apply)
      + fqdn                          = (known after apply)
      + geo_redundant_backup_enabled  = false
      + id                            = (known after apply)
      + location                      = "uksouth"
      + name                          = "tamops-psqlflexibleserver"
      + private_dns_zone_id           = (known after apply)
      + public_network_access_enabled = true
      + resource_group_name           = "cft-sbox-network-rg"
      + sku_name                      = "GP_Standard_D48ds_v4"
      + storage_mb                    = 32768
      + storage_tier                  = (known after apply)
      + version                       = "16"
      + zone                          = "2"

      + authentication (known after apply)

      + high_availability {
          + mode                      = "ZoneRedundant"
          + standby_availability_zone = "3"
        }
    }

  # azurerm_postgresql_flexible_server_database.tamopspsqldb will be created
  + resource "azurerm_postgresql_flexible_server_database" "tamopspsqldb" {
      + charset   = "utf8"
      + collation = "en_US.utf8"
      + id        = (known after apply)
      + name      = "tamopsdb"
      + server_id = (known after apply)
    }

  # module.frontendappgateway.azurerm_application_gateway.ag[0] will be updated in-place
  ~ resource "azurerm_application_gateway" "ag" {
        id                                = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw"
        name                              = "cft-aks-fe-00-sbox-agw"
        tags                              = {
            "application"  = "core"
            "autoShutdown" = "true"
            "builtFrom"    = "hmcts/azure-platform-terraform"
            "businessArea" = "CFT"
            "criticality"  = "Low"
            "environment"  = "sandbox"
            "expiresAfter" = "3000-01-01"
            "startupMode"  = "always"
        }
        # (8 unchanged attributes hidden)

      ~ autoscale_configuration {
          ~ max_capacity = 10 -> 75
          ~ min_capacity = 2 -> 50
        }

      - probe {
          - host                                      = "cft-api-mgmt.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/cft-api-mgmt" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "cft-api-mgmt" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "hmcts-access.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/hmcts-access" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "hmcts-access" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "hmi-apim.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/hmi-apim" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "hmi-apim" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-user-dashboard.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/idam-user-dashboard" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-user-dashboard" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "idam-web-public.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/idam-web-public" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "idam-web-public" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "labs-goldenpath-shabbir.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/labs-goldenpath-shabbir" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "labs-goldenpath-shabbir" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "labs-shabbir-nodejs.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/labs-shabbir-nodejs" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "labs-shabbir-nodejs" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "plum.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/plum" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "plum" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "plumclassic.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/plumclassic" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "plumclassic" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      - probe {
          - host                                      = "reformscan.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw/probes/reformscan" -> null
          - interval                                  = 20 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "reformscan" -> null
          - path                                      = "/health/liveness" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      + probe {
          + host                                      = "cft-api-mgmt.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "cft-api-mgmt"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "hmcts-access.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "hmcts-access"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "hmi-apim.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "hmi-apim"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-user-dashboard.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-user-dashboard"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "idam-web-public.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "idam-web-public"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-goldenpath-shabbir.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-goldenpath-shabbir"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "labs-shabbir-nodejs.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "labs-shabbir-nodejs"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "plum.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "plum"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "plumclassic.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "plumclassic"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }
      + probe {
          + host                                      = "reformscan.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 20
          + minimum_servers                           = 0
          + name                                      = "reformscan"
          + path                                      = "/health/liveness"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }

      ~ ssl_policy {
          + min_protocol_version = "TLSv1_2"
            # (4 unchanged attributes hidden)
        }

        # (46 unchanged blocks hidden)
    }

  # module.frontendappgateway.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostics_access_logs_sa" {
        id                             = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/cft-sbox-network-rg/providers/Microsoft.Network/applicationGateways/cft-aks-fe-00-sbox-agw|app-gw-storage-account"
        name                           = "app-gw-storage-account"
        # (6 unchanged attributes hidden)

      - metric {
          - category = "AllMetrics" -> null
          - enabled  = false -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = false -> null
            }
        }

        # (5 unchanged blocks hidden)
    }

Plan: 2 to add, 2 to change, 0 to destroy.

⚠️ Errors

add a label 765: sbox_frontendappgateway - TerraformPlanApply/add-or-update: POST https://api.github.com/repos/hmcts/azure-platform-terraform/issues/2554/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]

hmcts-platform-operations · 2025-08-11T15:00:21Z

Plan Result (765: sbox_global - TerraformPlanApply)

Plan: 0 to add, 1 to change, 0 to destroy.

Update
- module.premium_front_door.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0]

Change Result (Click me)

  # module.premium_front_door.azurerm_monitor_diagnostic_setting.diagnostics_access_logs_sa[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostics_access_logs_sa" {
        id                             = "/subscriptions/b72ab7b7-723f-4b18-b6f6-03b0f2c6a1bb/resourceGroups/lz-sbox-rg/providers/Microsoft.Cdn/profiles/hmcts-sbox|fd-log-analytics-logs-sa"
        name                           = "fd-log-analytics-logs-sa"
        # (6 unchanged attributes hidden)

      - metric {
          - category = "AllMetrics" -> null
          - enabled  = false -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = false -> null
            }
        }

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

⚠️ Errors

add a label 765: sbox_global - TerraformPlanApply/add-or-update: POST https://api.github.com/repos/hmcts/azure-platform-terraform/issues/2554/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]

hmcts-platform-operations · 2025-08-11T15:00:21Z

Plan Result (765: sbox_apim_appgw - TerraformPlanApply)

Plan: 0 to add, 2 to change, 0 to destroy.

Update
- module.app-gw.azurerm_application_gateway.ag[0]
- module.app-gw.azurerm_monitor_diagnostic_setting.diagnostic_settings[0]

Change Result (Click me)

  # module.app-gw.data.azurerm_monitor_diagnostic_categories.diagnostic_categories will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "azurerm_monitor_diagnostic_categories" "diagnostic_categories" {
      + id                  = (known after apply)
      + log_category_groups = (known after apply)
      + log_category_types  = (known after apply)
      + logs                = (known after apply)
      + metrics             = (known after apply)
      + resource_id         = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw"
    }

  # module.app-gw.azurerm_application_gateway.ag[0] will be updated in-place
  ~ resource "azurerm_application_gateway" "ag" {
        id                                = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw"
        name                              = "cft-apim00-sandbox-agw"
        tags                              = {
            "application"  = "core"
            "builtFrom"    = "hmcts/azure-platform-terraform"
            "businessArea" = "CFT"
            "criticality"  = "Low"
            "environment"  = "sandbox"
            "expiresAfter" = "3000-01-01"
        }
        # (8 unchanged attributes hidden)

      - probe {
          - host                                      = "cft-api-mgmt-appgw.sandbox.platform.hmcts.net" -> null
          - id                                        = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw/probes/cft-api-mgmt-appgw-probe" -> null
          - interval                                  = 10 -> null
          - minimum_servers                           = 0 -> null
          - name                                      = "cft-api-mgmt-appgw-probe" -> null
          - path                                      = "/status-0123456789abcdef" -> null
          - pick_host_name_from_backend_http_settings = false -> null
          - port                                      = 0 -> null
          - protocol                                  = "Http" -> null
          - timeout                                   = 15 -> null
          - unhealthy_threshold                       = 3 -> null

          - match {
              - status_code = [
                  - "200-399",
                ] -> null
                # (1 unchanged attribute hidden)
            }
        }
      + probe {
          + host                                      = "cft-api-mgmt-appgw.sandbox.platform.hmcts.net"
          + id                                        = (known after apply)
          + interval                                  = 10
          + minimum_servers                           = 0
          + name                                      = "cft-api-mgmt-appgw-probe"
          + path                                      = "/status-0123456789abcdef"
          + pick_host_name_from_backend_http_settings = false
          + protocol                                  = "Http"
          + timeout                                   = 15
          + unhealthy_threshold                       = 3
        }

      ~ ssl_policy {
          + min_protocol_version = "TLSv1_2"
            # (4 unchanged attributes hidden)
        }

        # (14 unchanged blocks hidden)
    }

  # module.app-gw.azurerm_monitor_diagnostic_setting.diagnostic_settings[0] will be updated in-place
  ~ resource "azurerm_monitor_diagnostic_setting" "diagnostic_settings" {
        id                             = "/subscriptions/ea3a8c1e-af9d-4108-bc86-a7e2d267f49c/resourceGroups/hmcts-hub-sbox-int/providers/Microsoft.Network/applicationGateways/cft-apim00-sandbox-agw|AppGw"
        name                           = "AppGw"
        # (5 unchanged attributes hidden)

      ~ metric (known after apply)
      - metric {
          - category = "AllMetrics" -> null
          - enabled  = true -> null

          - retention_policy {
              - days    = 0 -> null
              - enabled = true -> null
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

⚠️ Errors

add a label 765: sbox_apim_appgw - TerraformPlanApply/add-or-update: POST https://api.github.com/repos/hmcts/azure-platform-terraform/issues/2554/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]

hmcts-platform-operations · 2025-08-11T15:00:21Z

Plan Result (765: sbox_shutter_webapp - TerraformPlanApply)

Plan: 0 to add, 1 to change, 0 to destroy.

Update
- module.static_webapp.azurerm_dns_txt_record.zone_validate["labs-goldenpath-shabbir"]

Change Result (Click me)

  # module.static_webapp.azurerm_dns_txt_record.zone_validate["labs-goldenpath-shabbir"] will be updated in-place
  ~ resource "azurerm_dns_txt_record" "zone_validate" {
        id                  = "/subscriptions/ed302caf-ec27-4c64-a05e-85731c3ce90e/resourceGroups/reformMgmtRG/providers/Microsoft.Network/dnsZones/sandbox.platform.hmcts.net/TXT/_dnsauth.labs-goldenpath-shabbir"
        name                = "_dnsauth.labs-goldenpath-shabbir"
        tags                = {}
        # (4 unchanged attributes hidden)

      - record {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
      + record {
          # At least one attribute in this block is (or was) sensitive,
          # so its contents will not be displayed.
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

⚠️ Errors

add a label 765: sbox_shutter_webapp - TerraformPlanApply/add-or-update: POST https://api.github.com/repos/hmcts/azure-platform-terraform/issues/2554/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]

hmcts-platform-operations · 2025-08-11T15:00:23Z

Plan Result (765: sbox_apim - TerraformPlanApply)

No changes. Your infrastructure matches the configuration.

github-actions · 2025-08-11T15:04:57Z

Suggested Improvements

Ensure Proper Branch Naming Conventions:
- The branch thomas-test might not follow standardized naming conventions, which could lead to confusion in larger teams. Prefer descriptive and consistent names like feature/<short-description> or bugfix/<short-description>.
Consolidate pipeline_tests Repetitions:
- Multiple deployments have pipeline_tests set to true or false. Consider using a parameterized or template approach to reduce redundancy.
  yaml
  parameters:
  pipeline_tests_default: false
variables:
- name: pipeline_tests
  value: ${{ parameters.pipeline_tests_default }}
  ...
Service Connection Consistency:
- Standardize and document service_connection naming (e.g., dcd-cftapps-sbox, HMCTS-HUB-SBOX-INTSVC). This avoids potential misconfigurations.
Environment-Specific Configurations:
- Environment-specific values (e.g., storage_account_rg, storage_account_name) are repeated. These can be centralized into variables or templates to reduce duplication:
```
variables:
  sbox:
    storage_account_rg: 'core-infra-sbox-rg'
    storage_account_name: 'cftappssbox'
...
- deployment: 'sbox_global'
  variables: ${{ variables.sbox }}
```
Remove Trailing Whitespace:
- Excessive trailing blank lines have been added. Clean these up to maintain file readability and prevent unnecessary diff noise.
Pipeline Testing in Production:
- "Pipeline Tests" are enabled for several production deployments (e.g., prod_apim_appgw), while others have it disabled. Validate the intent behind this inconsistency, as tests in production should generally have a clear justification.
Carbon Efficiency and Resource Usage:
- Reduce the number of redundant deployments by merging overlapping configurations where possible. This will lower the carbon footprint of your CI/CD pipeline.
- Example: Combine identical dependsOn configurations for "global" components across environments.
Use Templates to Simplify Repeated Blocks:
- Consider using Azure DevOps job and deployment templates for shared deployment configurations to avoid repetition.
Secure Secrets and Endpoints:
- Confirm that sensitive details like endpoint or service_connection are securely stored in Azure Key Vault or DevOps variable groups and not hardcoded.
Review Pipeline Testing Logic:
- The pipeline_tests key is inconsistently applied. Consider documenting when and why it should be enabled in the pipeline to improve future maintainability.

Potential Cost Impact

Cost & Carbon Savings: Reducing deployment redundancy and unnecessary pipeline runs will save compute hours and reduce energy consumption. Centralizing templates may slightly elevate development time but is cost-efficient in the long term.

Summary

Prioritize cleaning up repeated configurations with templates or variables, remove redundant lines, validate inconsistent pipeline_tests values, and secure sensitive configurations to improve maintainability, security, and cost-effectiveness.

github-actions · 2025-08-11T15:14:05Z

Suggested Improvements:

Branch Naming (ref: refs/heads/thomas-test)
- Issue: Usage of a personal branch name (thomas-test) for a shared pipeline.
- Improvement: Use branches that reflect the feature, bugfix, or purpose (e.g., feature/xyz-improvement).
- Example: Update thomas-test to feature/simplify-pipeline.
- Impact: Improves maintainability and collaboration, reducing confusion.
Remove Excess Redundant Lines
- Issue: There are a large number of unutilized blank lines at the end of the configuration.
- Improvement: Remove these lines to keep the file concise and professional.
- Impact: Cleaner repositories and faster parsing.
pipeline_tests Key Consistency
- Issue: pipeline_tests is defined but inconsistently used. Some deployments set it as false, while others omit it.
- Improvement: Either:
  - Ensure all definitions include pipeline_tests explicitly.
  - Default pipeline_tests to false for simplicity in unused cases.
- Impact: Improves readability and avoids unintended behaviors.
Reference Reusability (storage_account_rg and storage_account_name)
- Issue: The repeated definitions of storage_account_rg and storage_account_name (e.g., core-infra-sbox-rg, cftappssbox).
- Improvement: Define these values as variables or parameters for better reusability.
- Example:
  yaml
  variables:
  storage_account_rg_sbox: 'core-infra-sbox-rg'
  storage_account_name_sbox: 'cftappssbox'
```
Update usages accordingly:
```yaml
  storage_account_rg: $(storage_account_rg_sbox)
  storage_account_name: $(storage_account_name_sbox)
```
- Impact: Reduces duplication and risk of typos. Easier updates if values change.
Environment-Specific Service Connection Consistency
- Issue: Service connections like dcd-cftapps-sbox and dcd-cftapps-prod differ only by environment.
- Improvement: Abstract service connections into parameters or variables, reducing redundancy.
- Example:
```
variables:
  service_connection_sbox: 'dcd-cftapps-sbox'
```
  Use as:
```
service_connection: $(service_connection_sbox)
```
- Impact: Simplifies maintenance and promotes scalability.
Pipeline Execution Costs
- Use Azure resource tags or tracking mechanism in variables to analyze cost over environments.
- Example:
```
tags:
  cost_center: 'sbox'
  owner: 'dev-team'
```
- Impact: Helps stakeholders identify areas of high expenditure.
Carbon Usage and Pipeline Optimization
- Observation: Extensive deployment definitions will likely lead to high resource utilization.
- Improvements:
  - Add a strategy to skip non-critical deployments for environments like dev.
  - Use Azure's sustainability calculator to assess and reduce carbon impact.
- Impact: Supports eco-friendly practices and reduces unnecessary resource consumption.

Add a Comment Block for Guidance

Issue: Lack of documentation for new developers.
Improvement: Insert a comment block explaining key deployment decisions and structure.

Example:

# This Azure pipeline handles deployments across multiple environments.
# Key variables like `service_connection` and `storage_account` can be updated 
# for specific environments using overrides.

Parameter Validation for overrideAction
- Issue: No validation provided for the newly added overrideAction parameter.
- Improvement: Limit acceptable values if applicable, to prevent incorrect configurations.
- Example:
```
parameters:
  - name: overrideAction
    type: string
    default: 'update'
    values:
      - 'update'
      - 'delete'
```
Consider Modular Templates for Repeated Patterns
- Issue: Many deployments follow a repeating pattern of keys (deployment, environment, etc.).
- Improvement: Leverage YAML templates to simplify and reuse across stages.
- Example: Create a deployment-template.yaml and include it in the main file using template:.
Impact: Shorter and more maintainable pipeline configuration. Better scalability for future environments or deployments.

General Observations:

Estimated Cost Savings: Refactoring variables and skipping unnecessary stages could save hours of runtime, reducing deployment costs by ~10%-20%. (Exact GBP savings depend on pipeline frequency and Azure pricing.)
Carbon Impact: Reduced runtime through conditional stages and reusable patterns will lower the carbon footprint.

Priority Actions:

Remove the thomas-test branch reference.
Clean up repetitive entries with variables or templates.
Validate the overrideAction parameter.
Eliminate excessive blank lines.

Doing this will enhance readability, reduce costs, and align with best practices.

github-actions · 2025-08-11T15:23:41Z

Improvements

Meaningful Branch Reference:
- The branch name thomas-test in the repository section is not descriptive and doesn't follow naming conventions often used for CI/CD pipelines (e.g., feature/<name>, bugfix/<name>). Consider renaming it to something more meaningful and aligned to its purpose, such as feature/test-pipeline-changes.
yaml
ref: refs/heads/feature/test-pipeline-changes

Parameterization:

Many of the repeated values like service_connection, storage_account_rg, and storage_account_name could be refactored into parameters for DRY (Don't Repeat Yourself) principles. This would make the pipeline easier to maintain and reduce the risk of inconsistencies.

parameters:
  environments:
    sbox:
      service_connection: 'dcd-cftapps-sbox'
      storage_account_rg: 'core-infra-sbox-rg'
      storage_account_name: 'cftappssbox'
    prod:
      service_connection: 'dcd-cftapps-prod'
      storage_account_rg: 'core-infra-prod-rg'
      storage_account_name: 'cftappsprod'

Pipeline Tests Default:
- The pipeline_tests property seems inconsistent across deployments. If pipeline_tests is false by default over many definitions, consider setting it globally at the top level with the ability to override for specific deployments rather than repeating it in every block.
```
parameters:
  pipeline_tests_default: false
```
Comment Excessive Blank Lines:
- The addition at the end of the file introduces a large number of blank lines (+ + + +). This increases file size unnecessarily and reduces readability. Remove these lines for better maintainability.

Environment-Specific Service Connections:

Outside of naming standardization, various service_connection values reference specific environments. If environment-specific configurations are reused often, parameterize these to ensure consistency and reduce misconfiguration risks.

Example:

- deployment: 'prod_global'
  environment: 'prod'
  component: 'global'
  service_connection: ${{ parameters.environments.prod.service_connection }}
  storage_account_rg: ${{ parameters.environments.prod.storage_account_rg }}
  storage_account_name: ${{ parameters.environments.prod.storage_account_name }}

Cost and Carbon Optimization:
- There is no reference to usage optimization for stages or specific environments (e.g., test, prod). Assuming long-running and unoptimized pipelines could incur additional costs and carbon emissions, consider utilizing Azure Resource Manager (ARM) template deployment optimizations such as deployment batching or parallel executions, where applicable.
Explicit Dependencies:
- Repeated dependsOn clauses often reference a preceding stage (sbox_*). To improve maintainability, consider using logical groups of dependencies or batching deployments where sequencing is not critical.
Pipeline Stages:
- The Precheck stage is defined, but it's unclear if it is complete or missing subsequent stages (Deploy, Test, etc.). Ensure the pipeline configuration logically follows all necessary stages to avoid performance bottlenecks caused by unfinished or unclear configurations.

Security

Hardcoded Values:
- Sensitive information like storage account names and resource group names are hardcoded, which might lead to accidental exposure. Move such values to pipeline secrets or variable groups for better security.
Validation of Added Tasks:
- Ensure no added tasks allow ambiguous permissions. For example, usage of service_connection assumes that connections have been properly scoped with least privilege access.

Estimated Cost Implication

Utilizing described optimizations (e.g., removing redundant lines, parameterizing configurations, and efficient task execution) could reduce computational overhead slightly, leading to minor cost savings. Impact on the Pound Sterling and carbon reduction is expected to be minimal but beneficial over time when scaling.

Example Summary of Changes:

parameters:
  pipeline_tests_default: false
  environments:
    sbox:
      service_connection: 'dcd-cftapps-sbox'
      storage_account_rg: 'core-infra-sbox-rg'
      storage_account_name: 'cftappssbox'
    prod:
      service_connection: 'dcd-cftapps-prod'
      storage_account_rg: 'core-infra-prod-rg'
      storage_account_name: 'cftappsprod'

stages:
- stage: Precheck
  ...

- deployment: 'prod_global'
  environment: 'prod'
  component: 'global'
  service_connection: ${{ parameters.environments.prod.service_connection }}
  storage_account_rg: ${{ parameters.environments.prod.storage_account_rg }}
  storage_account_name: ${{ parameters.environments.prod.storage_account_name }}
  pipeline_tests: ${{ parameters.pipeline_tests_default }}
  dependsOn: 'sbox_global'

By employing these improvements, the pipeline will be more efficient, maintainable, secure, and reusable.

github-actions · 2025-08-11T15:29:20Z

Improvements for `azure_pipeline.yaml`

Branch Naming Consistency:
- The branch name was changed to thomas-test, which seems to be a test/debug branch. Ensure naming conventions adhere to team standards (e.g., feature/{description} or bugfix/{description}) to promote consistency and maintainability.
  yaml
  ref: refs/heads/thomas-test

Pipeline Redundancy:

There is a significant amount of repeated YAML, particularly in deployment definitions (e.g., service_connection, storage_account_rg, storage_account_name, etc.). Use templates to reduce duplication and streamline maintenance.
Example:

- template: deployment-template.yaml
  parameters:
    environment: 'sbox'
    component: 'backendappgateway'
    service_connection: 'dcd-cftapps-sbox'
    storage_account_rg: 'core-infra-sbox-rg'
    storage_account_name: 'cftappssbox'

Pipeline Tests Consistency:
- pipeline_tests values seem inconsistent across environments (e.g., false for prod pubsubappgateway, but true for others). Clarify and document the rationale for determining true/false to ensure consistency and avoid unnecessary cost or omissions.
Unused Sections:
- The added blank lines serve no purpose and clutter the file, making it harder to read and maintain. Remove these before committing.
Cost Optimization:
- Configurations like pipeline_tests: true across many deployments (e.g., test, stg, demo, etc.) can increase pipeline runtime costs. Evaluate if all tests are necessary or can be run less frequently. Estimated Azure DevOps pipeline cost is approximately £0.030-£0.050 per minute.
Carbon Usage:
- By reducing redundant job testing and streamlining pipelines, you would minimize the carbon footprint. A more compact pipeline reduces computing resource usage.

Improvements for `sbox.tfvars`

Default Variable Cleanup:
- The newly added frontend_agw_max_capacity seems hardcoded. Instead, define it as a variable in a centralized variables.tf file for reuse across environments and easy updates.
  Example:
```
variable \"frontend_agw_max_capacity\" {
  default = 25
  description = \"Maximum capacity for the frontend application gateway.\"
}
```
Naming Alignment:
- Ensure naming is consistent across environments (e.g., oms_env = \"sandbox\" in sbox.tfvars). If possible, abstract this definition into a reusable Terraform variable.
Documentation:
- Provide comments for frontend_agw_max_capacity explaining why the value is set to 25. This enhances code clarity and prevents future misinterpretation.

# Maximum capacity for the frontend application gateway 
# Set to 25 based on expected traffic load in the sandbox environment
frontend_agw_max_capacity = 25

github-actions · 2025-08-11T15:35:04Z

Improvements and Recommendations:

Pipeline YAML File:

Branch Reference Management:
- Updating the branch reference from refs/heads/master to refs/heads/thomas-test could cause CI/CD pipelines to inadvertently target inappropriate branches in testing scenarios. If this is a temporary change, consider using variable substitution to dynamically pull branch names:
  yaml
  ref: ${{ parameters.branch_name }}
```
This avoids hardcoding test branches in the pipeline.
```
Excessive New Lines:
- There are a significant number of unnecessary new lines added at the end of this file. Remove them to improve file readability and maintain version control hygiene.
Pipeline Tests Consistency:
- Inconsistency in the use of pipeline_tests: true and pipeline_tests: false. Standardize the approach and set it as a parameter where possible for flexibility. For example:
```
parameters:
  - name: enable_pipeline_tests
    type: boolean
    default: false

  ...
  pipeline_tests: ${{ parameters.enable_pipeline_tests }}
```
Environmental Variable Repetition:
- The same environment-related details (e.g., service_connection, storage_account_rg, storage_account_name) are repeated across deployments. Refactor these into reusable templates or variables to reduce duplication. For instance:
```
variables:
  sbox_env:
    service_connection: 'dcd-cftapps-sbox'
    storage_account_rg: 'core-infra-sbox-rg'
    storage_account_name: 'cftappssbox'

  dev_env:
    service_connection: 'dcd-cftapps-dev'
    ...
```

Dynamic Resource Referencing:

Environment-related values can be parameterized for better scalability instead of creating hardcoded blocks for each environment. Consider passing environment details dynamically. Example:

parameters:
  - name: environment_name
    type: string
    default: 'sbox'

...
  storage_account_rg: 'core-infra-${{ parameters.environment_name }}-rg'
  storage_account_name: 'cftapps${{ parameters.environment_name }}'

Cost Control:
- The pipeline appears expansive and could lead to high compute costs. Review the necessity of triggering numerous environment pipelines concurrently. Introduce conditions or manual triggers for non-critical deployments:
```
condition: and(succeeded(), eq(variables['pipeline_tests'], true))
```
Carbon Footprint:
- Consolidating pipelines and minimizing redundant runs reduces cloud infrastructure energy consumption and lowers carbon output. Review if certain deployments, like frontendappgateway, pubsubappgateway, can be merged or staggered.

TFVars File:

Capacity Settings:
- The added frontend_agw_min_capacity and frontend_agw_max_capacity values seem arbitrarily high (25–50). Validate if scaling requires such a high baseline. Scaling to lower values (e.g., min: 2, max: 10) could reduce costs unless production load demands it.
Parameterization:
- Similar to the suggestions in the pipeline YAML, consider parameterizing these values for flexibility and reusability across environments. Example:
```
frontend_agw_capacity = {
  min = var.frontend_agw_min_capacity
  max = var.frontend_agw_max_capacity
}
```
Improvement for Multi-Environment Use:
- Since tfvars files are environment-specific, ensure that values like key_vault_subscription and privatedns_subscription are environment-agnostic if applicable. Use Terraform variables or workspaces for modularity:
```
key_vault_subscription = var.key_vault_subscription
privatedns_subscription = var.privatedns_subscription
```
Scalability Concern:
- If the frontend_agw min or max capacities scale unnecessarily, this can cause over-provisioning. Set auto-scaling to trigger based on realistic performance metrics to save costs.

Overall Considerations:

Cost Impact:
- Hardcoding large-scale setups, redundant triggers, and high baseline capacities (e.g., min 25 for frontend gateways) can significantly increase monthly Azure costs. Estimated increase in deployment costs could range from £300–£1000/month depending on execution frequency and resource usage.
Maintainability:
- The lack of reusability and modularization increases long-term maintenance complexity. Refactoring repetitive sections into shared templates will improve readability and developer productivity.
Carbon Efficiency:
- Reducing pipeline duplication and excessive scaling minimizes both cloud billing and the environmental impact. Consolidating tasks or merging related spec stages can significantly improve carbon usage efficiency.
Security Validation:
- Ensure secrets like service_connection credentials are stored securely in Azure Key Vaults and referenced dynamically using variables.

By addressing these improvements, the infrastructure code will be cleaner, cost-efficient, and more maintainable over time.

github-actions · 2025-08-11T15:44:59Z

Observations and Suggested Improvements

General Observations

There are extensive repetitive blocks of code in azure_pipeline.yaml. This can lead to harder maintenance, increased chances of errors, and bloated file size.
There are inconsistent usages of blank spaces at the end of the file, which may indicate unused or dead code.
The configuration updates in sbox.tfvars lack explanations or comments.

azure_pipeline.yaml

1. Repetition Across Deployment Blocks

Issue: Multiple deployment blocks have similar fields for configurations such as service_connection, storage_account_rg, etc.
Recommendation:
- Use template expressions or matrix jobs to eliminate redundant definitions. For example:
  yaml
  jobs:
  - template: deploy-job-template.yaml
    parameters:
    deployment_name: 'sbox_global'
    environment: 'sbox'
    component: 'global'
    service_connection: 'dcd-cftapps-sbox'
    storage_account_rg: 'core-infra-sbox-rg'
    storage_account_name: 'cftappssbox'
    pipeline_tests: true
- Then define a deploy-job-template.yaml file with the actions (parameters) required.

2. Hardcoded Values

Issue: Many hardcoded values for service_connection, storage_account_name, etc., are environment-specific but repetitive.

Recommendation: Define parameters at the top level of the pipeline file or in a reusable variable group so they can be reused effectively:

parameters:
  environments:
    sbox:
      service_connection: 'dcd-cftapps-sbox'
      storage_account_rg: 'core-infra-sbox-rg'
      storage_account_name: 'cftappssbox'

3. Unused Pipeline Parameters

Issue: Several repeated and unused pipeline_tests values are present but often set as false.

Recommendation: Remove unused pipeline_tests parameters to simplify the pipeline file and improve clarity:

- deployment: 'sbox_backendappgateway'
  environment: 'sbox'
  component: 'backendappgateway'
  service_connection: 'dcd-cftapps-sbox'
  storage_account_rg: 'core-infra-sbox-rg'
  storage_account_name: 'cftappssbox'
  dependsOn: 'Precheck'

4. Security Best Practice: Pin GitHub Repository Branch

Issue: The cnp-azuredevops-libraries reference currently points to a branch (refs/heads/thomas-test). This could lead to unverified code being executed.
Recommendation: Pin the repository reference to a tag or commit hash to ensure a specific version is used:
```
ref: refs/tags/v1.0.0
```

5. Blank Lines and Dead Code

Issue: There is a significant amount of blank lines added towards the end, which serves no purpose.
Recommendation: Remove the excess lines to clean up the pipeline file and improve readability.

sbox.tfvars

1. Unexplained Configuration Changes

Issue: The newly introduced variables frontend_agw_min_capacity and frontend_agw_max_capacity lack accompanying comments explaining their purpose or implications.

Recommendation: Add comments to describe the purpose and side effects of these variables:

# Minimum and maximum capacity for the frontend application gateway
frontend_agw_min_capacity = 26
frontend_agw_max_capacity = 50

2. Validation of Values

Issue: The frontend_agw_min_capacity and frontend_agw_max_capacity values are directly assigned without validation.
Recommendation: Validate these values within the Terraform definition or pipeline to ensure they adhere to relevant constraints (e.g., max_capacity >= min_capacity).

Cost Efficiency

Pipeline Execution Cost:
- Reusing template jobs by consolidating repetitive definitions could reduce the size of the pipeline YAML, decreasing cognitive load and reducing maintenance overhead (no direct execution cost-related impact).
Terraform Resource Efficiency:
- For the newly added frontend_agw_*_capacity variables:
  - 26-50 might lead to unnecessarily high resource allocation if the actual load doesn't justify it.
  - Consider dynamic scaling or reducing the initial range to minimize unused capacity and associated Azure cost.

Carbon Usage

Reducing the infrastructure capacity where possible (e.g., scaling down frontend_agw_min_capacity) can lower energy usage, contributing to a potential reduction in carbon footprint.

Summary of Key Changes:

Eliminate repetitive deployment block configurations by reusing templates and parameters.
Pin GitHub repository to a tagged version or commit hash for security.
Add comments for configuration changes in sbox.tfvars and validate resource limits.
Remove unused or redundant parameters (e.g., pipeline_tests: false).
Clean up unnecessary blank lines to improve readability.

github-actions · 2025-08-11T16:06:31Z

Improvements for `azure_pipeline.yaml`

General Improvements:

Branch Reference Hardcoding:
- You replaced refs/heads/master with refs/heads/thomas-test, which is a user-specific branch and should not be hardcoded. Use a pipeline variable for the branch reference:
  yaml
  ref: $(branch_name) # Define the variable in the pipeline variables section.
- This improves maintainability by allowing branch overrides without code changes.

DRY Principle in Deployment Definitions:

The deployment steps are highly repetitive. Use templates to reduce duplication:

- template: deployment-template.yaml  # Pass dynamic inputs
  parameters:
    deployment: 'sbox_global'
    environment: 'sbox'
    component: 'global'
    service_connection: 'dcd-cftapps-sbox'
    storage_account_rg: 'core-infra-sbox-rg'
    storage_account_name: 'cftappssbox'
    dependsOn: 'Precheck'
    pipeline_tests: true

This will reduce file bulk, improve readability, and make future changes cheaper.

Unused pipeline_tests Flag:
- The pipeline_tests flag is defined frequently but its usage is unclear. Validate if this field is used elsewhere in the pipeline and remove if unnecessary to simplify the definition.
Proper Dependency Hierarchy:
- Consider leveraging dependsOn more effectively to create a logical dependency hierarchy instead of many direct references. This improves visual clarity and execution traceability.

Security Recommendations:

Hardcoded Resource Identifiers:
- Sensitive fields like subscription IDs, storage_account_rg, and key_vault_subscription are directly exposed.
- Use Azure Key Vault to secure sensitive information:
```
variables:
  - group: MyKeyVaultSecrets  # Link Key Vault secret group.
```

Improvements for `sbox.tfvars`

General Improvements:

Capacity Configuration:
- frontend_agw_min_capacity and frontend_agw_max_capacity values are now set as 27 and 50. Review these numbers for cost implications. For example, Azure Application Gateway cost scales with capacity:
  - Estimated cost jump per hour (27 → 50):
    - Standard_v2: ~£0.0036/sec → ~£0.0067/sec (125% increase in hourly base cost).
  - Use Autoscaling for better cost-to-performance balance:
```
capacity = {
  min_capacity = 2
  max_capacity = 10  # Adjust thresholds dynamically
}
```
Variable Grouping (Reusability):
- Extract common variables like data_subscription and key_vault_subscription into a shared variables.tf file to eliminate duplication across environments.

Security Recommendations:

Sensitive Data Protection:
- The subscription data is directly exposed. Use Terraform's native support for secure variables by passing them via environment variables or leveraging secret management:
```
variable \"data_subscription\" {
  description = \"Subscription ID\"
  type        = string
  sensitive   = true
}
```

Best Practice:

Static SSL Policy:
- The ssl_policy uses a static \"Predefined\" value but could benefit from a conditional check or a modular design for evolving policies:
```
ssl_policy = var.ssl_policy_default ? \"Predefined\" : var.custom_ssl_policy_config
```

Sustainability and Cost Insights:

The increased frontend_agw_min_capacity=27 and frontend_agw_max_capacity=50 will likely result in higher carbon emissions due to the overprovision of resources. Autoscaling and right-sizing components can reduce wastage and lower both operational costs and emissions.

github-actions · 2025-08-12T07:31:42Z

Recommendations for Improvement

Git diff: `azure_pipeline.yaml`

Branch Reference (thomas-test):
- It's common to avoid hardcoding branch names such as thomas-test. This risks pipeline misconfigurations when merging or branching out.
- Improvement:
  Replace with a parameterized value:
  yaml
  ref: ${{ parameters.branch || 'refs/heads/master' }}
Repetitive Pipeline Definitions:
- The pipeline has significant duplication for deployment, service_connection, and other variables.
- Improvement:
  Centralize common pipeline configurations by using templates or reusable parameters. For instance:
```
parameters:
  storage_account_name: \"cftapps${{ parameters.environment }}\"
  storage_account_rg: \"core-infra-${{ parameters.environment }}-rg\"
```
Commented-Out or Superfluous + Symbols:
- There are excessive + symbols and whitespace added at the end of the file, which could impact readability and maintainability.
- Improvement:
  Remove unnecessary lines to improve clarity and reduce noise in the file.
Pipeline Tests Misalignment:
- pipeline_tests values are inconsistent across environments. Certain environments set it to false arbitrarily (e.g., in prod).
- Improvement:
  Either enforce consistency or use conditional logic to determine its value:
```
pipeline_tests: ${{ parameters.environment != 'prod' }}
```

Git diff: `components/frontendappgateway/main.tf`

enable_waf Value:
- While enabling WAF (enable_waf = true) is a good security practice, this should be parameterized for better flexibility.
- Improvement:
  Define it in configuration files like tfvars:
```
enable_waf = var.enable_waf
```
- Add to respective .tfvars:
```
enable_waf = true
```
SSL Policy Logic:
- Current SSL policy logic is inflexible (var.env == \"sbox\"). If environments increase, this will grow complex.
- Improvement:
  Use a mapping structure for better scalability:
```
ssl_policy = lookup(var.ssl_policies, var.env, local.default_ssl_policy)
```

Git diff: `environments/sbox/sbox.tfvars`

Frontend Application Gateway Auto-Scaling:
- Adding frontend_agw_min_capacity and frontend_agw_max_capacity is a good addition, but the values seem unusual (min = 27, max = 50). Large values could lead to unnecessary costs.
- Improvement:
  Assess typical loads and set more practical limits. Example:
```
frontend_agw_min_capacity = 2
frontend_agw_max_capacity = 10
```
Configuration Consistency:
- Ensure the new parameters (frontend_agw_min_capacity, frontend_agw_max_capacity) are consistently applied across all environments to avoid misalignment.

Cost Impact

High frontend_agw_min_capacity value (27) in sbox could result in significant cost increases on Azure due to over-scaling. Lowering to ~2 could save approximately £200-300/month depending on usage.

Carbon Usage

Excessive scaling (min_capacity = 27) significantly increases resource usage and carbon footprint. Optimize minimum capacities to align with actual demand to reduce emissions.

github-actions · 2025-08-12T07:37:10Z

Improvements for Code Quality, Security, Best Practices, Cost, and Carbon Usage

1. Hardcoded Secrets in `main.tf`

hcl
administrator_login = "thomas"
administrator_password = "passwordsarefun"

- **Issue**: Sensitive information, such as database credentials, is hardcoded into the Terraform file.
- **Improvement**: Replace the hardcoded credentials with secure methods like Azure Key Vault or Terraform Variable Files. Example:
  ```hcl
  administrator_login = var.administrator_login
  administrator_password = var.administrator_password
  ```
  Ensure these variables are populated securely via a `.tfvars` file or a secret store.

#### 2. **Missing `Prevent_Destroy` Lifecycle Rule**
```hcl
resource \"azurerm_postgresql_flexible_server\" \"tamopspsql\" {

Issue: Critical infrastructure, like the PostgreSQL server, is missing a safeguard to prevent accidental deletion.
Improvement: Add lifecycle rules to avoid accidental destruction:
```
lifecycle {
  prevent_destroy = true
}
```

3. Missing Database Encryption

Issue: The PostgreSQL flexible server resource does not mention enabling storage encryption.
Improvement: Confirm that encryption is enabled for storage by default. If not, explicitly set it using a configuration, or document the encryption posture.
Security Impact: Ensures data-at-rest protection.

4. Excessive `sku_name` Provisioning

sku_name = \"GP_Standard_D96s_v5\"

Issue: Using GP_Standard_D96s_v5 significantly increases cost unless necessary.
Improvement: Evaluate if a lower spec SKU (e.g., GP_Standard_D2s_v5) meets the current needs. Example:
```
sku_name = \"GP_Standard_D2s_v5\" # Adjust based on workload requirements
```
Cost Estimation: Potentially reduce costs by ~90% (consult Azure pricing in GBP).
Carbon Impact: A lower SKU instance consumes less energy, reducing environmental impact.

5. Inconsistent Scaling in `sbox.tfvars` (Auto-Scaling Settings)

frontend_agw_min_capacity = 50
frontend_agw_max_capacity = 75

Issue: The minimum capacity of 50 is high for a sandbox environment, potentially leading to over-provisioning.
Improvement: Adjust values to better reflect sandbox use cases (e.g., min_capacity = 1 and max_capacity = 5). Example:
```
frontend_agw_min_capacity = 1
frontend_agw_max_capacity = 5
```
Cost Estimation: Significant cost reduction for sandbox environments in Azure.
Carbon Impact: Reduced carbon footprint due to less resource usage.

6. Unused Variables and Properties

Issue: Ensure properties like zone = \"2\" and geo_redundant_backup_enabled = false in the PostgreSQL flexible server align with DR (Disaster Recovery) strategies.
Improvement: Document reasoning if skipping geo-redundancy, or enable it if warranted.

7. Pipeline Branch Hardcoding

ref: refs/heads/thomas-test

Issue: Hardcoded branch (thomas-test) means frequent manual updates when switching branches.
Improvement: Use a pipeline parameter for dynamic branching:
```
ref: ${{ parameters.branch_name }}
```
Update the pipeline to support parameterized branch inputs.

8. Pipeline Parameterization Inefficiencies

Issue: Repeated service configuration values increase maintenance overhead.
Improvement: Use pipeline variables or templates to consolidate and reuse shared configurations (e.g., service_connection, storage_account_rg, storage_account_name).

9. No Input Validation for Variables

Issue: Variables like frontend_agw_min_capacity are not validated for appropriate ranges.

Improvement: Add validations in Terraform to enforce safe input ranges:

variable \"frontend_agw_min_capacity\" {
  type = number
  validation {
    condition = var.frontend_agw_min_capacity > 0 && var.frontend_agw_min_capacity <= var.frontend_agw_max_capacity
    error_message = \"Min capacity must be greater than 0 and less than max capacity.\"
  }
}

10. No Explicit Region in Pipeline

Issue: Azure region (uksouth) is hardcoded in the Terraform but not included in the pipeline.
Improvement: Pass the region dynamically via the pipeline as a parameter and reference it in Terraform.

Summary: Addressing these issues improves security (e.g., no hardcoded secrets), reduces costs (e.g., optimal SKU sizes), and optimizes for maintainability. Estimated pipeline changes could save hundreds of GBP annually and reduce unnecessary carbon emissions.

github-actions · 2025-08-12T07:43:29Z

Suggested Improvements

General Improvements

Commit Messages:
- The branch name thomas-test in the pipeline (ref: refs/heads/thomas-test) indicates testing, which might not align with production or release branch conventions. Ensure production-ready changes are merged from a standardized branch (e.g., main or develop).

Security Issues

Hardcoded Credentials:
- Avoid hardcoding sensitive information like administrator_password = \"passwordsarefun\" in azurerm_postgresql_flexible_server. Replace it with secure methods, such as using Azure Key Vault and dynamically referencing secrets:
  hcl
  administrator_password = var.postgre_password
```
Ensure `var.postgre_password` is securely fetched from a `terraform.tfvars` file or an external secrets manager.
```
Exposed Administrator Credentials:
- The use of "thomas" as administrator_login might lead to predictability. Replace it with a variable, allowing per-environment customization:
```
administrator_login = var.administrator_login
```

Cost Optimization

Database Sizing:
- The sku_name = \"GP_Standard_D64ds_v4\" for the PostgreSQL server is expensive and may significantly increase operational costs. Evaluate actual workload needs and consider scaling down to a smaller SKU (GP_Standard_D2ds_v4, for example) or testing performance with lower tiers for non-production environments.
- Estimated Cost Impact: The D64ds_v4 costs roughly ~£1,500/month in the UK South region. Adjusting to a smaller SKU may save ~£1,400/month in non-critical environments.
Frontend App Gateway Scaling:
- frontend_agw_min_capacity = 50 and frontend_agw_max_capacity = 75 may over-allocate resources for low-load environments like sbox. Revise scaling parameters to match expected traffic per environment (e.g., min_capacity = 1, max_capacity = 5 for sbox).

Best Practices

No newline at end of file:
- Add a newline at the end of main.tf to maintain compatibility and consistency with POSIX standards.
Resource Naming Standards:
- In azurerm_postgresql_flexible_server, name = \"tamops-psqlflexibleserver\" could be replaced with a variable and follow naming conventions across environments:
```
name = \"${var.project}-${var.environment}-psql\"
```
Modularization:
- Instead of replicating deployment configurations across environments, abstract the resource definitions into modules. Pass environment-specific variables for reuse, reducing duplication and improving maintainability.
Pipeline Tests Validation:
- The pipeline_tests flag is inconsistently set across deployments. Define a global standard for test execution based on environment or service priority to improve pipeline consistency.
Region Standardization:
- Inconsistent hardcoding of location (location = \"uksouth\"). Use variables like:
```
location = var.region
```

Carbon Usage

Carbon Footprint Reduction:
- The oversized PostgreSQL instance and high gateway capacity increase energy use. Minimizing resource over-provisioning via SKU reduction or scaling adjustments can significantly lower carbon emissions.

Summary of Changes

Replace sensitive information like passwords with variables or secure references.
Adjust oversized resources (sku_name, gateway capacity) to scale economically.
Modularize repeated configurations for maintainability.
Standardize region, naming, and environment definitions using variables.

These changes will improve security, reduce costs (estimated savings: ~£2,000/month), enhance maintainability, and lower environmental impact.

github-actions · 2025-08-12T08:18:38Z

Issues and Suggestions for Improvement

1. YAML: Reference Branch Naming

Issue: The branch refs/heads/thomas-test is being used instead of a stable branch like refs/heads/main.
Improvement: Avoid using personal or test branches (e.g., thomas-test) in production pipelines. Use branches like main or develop that are more appropriate for consistency.
yaml
ref: refs/heads/main

2. YAML: `pipeline_tests` Field Consistency

Issue: The pipeline_tests field is inconsistently true/false across environments (prod, sbox) without clear justification.
Improvement: Document or validate when and why pipeline_tests is disabled. For example, ensure all non-production deployments are tested unless there’s a valid exception.

3. YAML: Repeated Code Definitions

Issue: Each deployment block has repeated fields (service_connection, storage_account_rg, storage_account_name, etc.).

Improvement: Use templates or variables to reduce repetition and make the code more maintainable. Example:

- deployment: '[DEPLOYMENT_NAME]'
  environment: '[ENVIRONMENT]'
  service_connection: '{{ parameters.service_connection }}'

4. Terraform: Hardcoded Administrator Password

Issue: The administrator password for the PostgreSQL server is hardcoded (passwordsarefun), leading to a significant security risk.
Improvement: Use a secure storage solution like Azure Key Vault or environment variables for secrets.
```
administrator_password = var.administrator_password
```

5. Terraform: Insecure Database Administrator Username

Issue: The username thomas is user-specific and not aligned with best practices for generic, service-based administrator accounts.
Improvement: Use a more generic username like admin or fetch it securely via variables.

6. Terraform: Lack of IP Restriction

Issue: The PostgreSQL server does not have any IP firewall restrictions, leaving it open to unauthorized access.

Improvement: Add network rules to restrict access to specific IP ranges or subnets.

network_rules {
  start_ip_address = \"192.168.0.1\"
  end_ip_address   = \"192.168.0.255\"
}

7. Terraform: Oversized SKU

Issue: The selected SKU (GP_Standard_D48ds_v4) is likely oversized and may incur unnecessary costs.
Improvement: Analyze system requirements and pick a cost-efficient SKU. For dev/test environments, use B series or smaller sizes.
```
sku_name = \"GP_Standard_D8ds_v4\"
```
Estimated Cost Impact: Based on Azure's UK South region, downsizing could save ~£400-800/month for non-production environments.

8. Terraform: High Carbon Impact Resource

Issue: The use of zone-redundant high availability (mode = \"ZoneRedundant\") for azurerm_postgresql_flexible_server increases carbon usage.
Improvement: For non-critical environments (e.g., sbox), use mode = \"SameZone\" to reduce cross-zone replication energy consumption.
```
high_availability {
  mode = \"SameZone\"
}
```

9. YAML: Undefined `frontend_agw_min_capacity` and `frontend_agw_max_capacity` Variables

Issue: The newly added frontend_agw_min_capacity and frontend_agw_max_capacity values are not defined in the module or referenced in the pipeline.
Improvement: Include a definition or mapping in the relevant section to prevent misconfiguration.

10. General: Absence of Linting/Validation

Issue: No evidence of YAML linting or Terraform validation in the pipeline.
Improvement: Add precheck steps for static analysis tools like yamllint or terraform validate to improve code quality and catch errors early.

11. Missing Newline in Files

Issue: The main.tf file is missing a newline at the end, which can occasionally cause issues with tools or version control systems.
Improvement: Ensure the file ends with a newline for compatibility.
```
+}
+
```

12. Security: Add Monitoring for PostgreSQL

Issue: There is no explicit monitoring for the PostgreSQL instance defined in the code.

Improvement: Define monitoring resources such as Azure Monitor's diagnostic settings.

resource \"azurerm_monitor_diagnostic_setting\" \"psql\" {
  name               = \"psql-diag-settings\"
  target_resource_id = azurerm_postgresql_flexible_server.tamopspsql.id
  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.example.id

  logs {
    category = \"PostgreSQLLogs\"
    enabled  = true
    retention_policy {
      enabled = true
      days    = 30
    }
  }
}

Summary of Improvements

Code Quality: Consolidate repeated YAML blocks and enforce definitions for added variables.
Security: Remove hardcoded credentials, restrict IP access, and add monitoring.
Cost Optimization: Resize resources (sku_name) and simplify HA setup in non-critical environments.
Carbon Usage: Reduce carbon footprint by avoiding zone-redundant HA in sbox.

By implementing these recommendations, the pipeline and infrastructure code will become cleaner, more secure, cost-effective, and environmentally conscious.

test finops calculator

ce6ec7a

thomast1906 requested a review from a team as a code owner August 11, 2025 14:57

thomast1906 requested review from ieuanb74, kainosrogery and narinder17 August 11, 2025 14:57

hmcts-platform-operations added the 765: sbox_apim - TerraformPlanApply/no-changes label Aug 11, 2025

sbox fe only

df5b9e3

new plan

9f840bf

test

62481a3

capacity test

0f02d21

update min/max

f30fa13

updat eto 26 to test

79381b9

test min capacity

bf782fd

change appgw to WAF

c06a118

test

20eee55

change sku

6d5a8c0

test postgres

60e8fe2

Conversation

thomast1906 commented Aug 11, 2025 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change description

🤖AEP PR SUMMARY🤖

Uh oh!

github-actions Bot commented Aug 11, 2025

Suggested Improvements

1. Branch Reference Update

2. Pipeline Code Repetition

3. Pipeline Test Parameter Consistency

4. Redundant Whitespaces

5. Security: Parameterize Sensitive Data

6. Carbon Usage and Cost Optimization

7. Naming Consistency

8. Set Clear Default Variables for Production

Cost and Carbon Usage Impact

Uh oh!

hmcts-platform-operations commented Aug 11, 2025

Plan Result (765: sbox_backendappgateway - TerraformPlanApply)

⚠️ Errors

Uh oh!

hmcts-platform-operations commented Aug 11, 2025

Plan Result (765: sbox_private_dns - TerraformPlanApply)

⚠️ Errors

Uh oh!

hmcts-platform-operations commented Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan Result (765: sbox_frontendappgateway - TerraformPlanApply)

⚠️ Errors

Uh oh!

hmcts-platform-operations commented Aug 11, 2025

Plan Result (765: sbox_global - TerraformPlanApply)

⚠️ Errors

Uh oh!

hmcts-platform-operations commented Aug 11, 2025

Plan Result (765: sbox_apim_appgw - TerraformPlanApply)

⚠️ Errors

Uh oh!

hmcts-platform-operations commented Aug 11, 2025

Plan Result (765: sbox_shutter_webapp - TerraformPlanApply)

⚠️ Errors

Uh oh!

hmcts-platform-operations commented Aug 11, 2025

Plan Result (765: sbox_apim - TerraformPlanApply)

Uh oh!

github-actions Bot commented Aug 11, 2025

Suggested Improvements

Potential Cost Impact

Summary

Uh oh!

github-actions Bot commented Aug 11, 2025

Suggested Improvements:

General Observations:

Priority Actions:

Uh oh!

github-actions Bot commented Aug 11, 2025

Improvements

Security

Estimated Cost Implication

Example Summary of Changes:

Uh oh!

github-actions Bot commented Aug 11, 2025

Improvements for azure_pipeline.yaml

Improvements for sbox.tfvars

Uh oh!

github-actions Bot commented Aug 11, 2025

Improvements and Recommendations:

Pipeline YAML File:

TFVars File:

Overall Considerations:

Uh oh!

github-actions Bot commented Aug 11, 2025

Observations and Suggested Improvements

General Observations

azure_pipeline.yaml

1. Repetition Across Deployment Blocks

2. Hardcoded Values

3. Unused Pipeline Parameters

4. Security Best Practice: Pin GitHub Repository Branch

thomast1906 commented Aug 11, 2025 •

edited by github-actions Bot

Loading

hmcts-platform-operations commented Aug 11, 2025 •

edited

Loading

Improvements for `azure_pipeline.yaml`

Improvements for `sbox.tfvars`

Improvements for `azure_pipeline.yaml`

Improvements for `sbox.tfvars`

Git diff: `azure_pipeline.yaml`

Git diff: `components/frontendappgateway/main.tf`

Git diff: `environments/sbox/sbox.tfvars`

1. Hardcoded Secrets in `main.tf`

4. Excessive `sku_name` Provisioning

5. Inconsistent Scaling in `sbox.tfvars` (Auto-Scaling Settings)

2. YAML: `pipeline_tests` Field Consistency

9. YAML: Undefined `frontend_agw_min_capacity` and `frontend_agw_max_capacity` Variables