Adding IP restrictions to Web App

azurerm/data_source_app_service.go

@@ -123,6 +123,23 @@ func dataSourceArmAppService() *schema.Resource {
 				Computed: true,
 			},
 
+			"ip_restriction": {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ip_address": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						"subnet_mask": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+
 			"https_only": {
 				Type:     schema.TypeBool,
 				Computed: true,
@@ -284,6 +301,11 @@ func dataSourceArmAppServiceRead(d *schema.ResourceData, meta interface{}) error
 		return err
 	}
 
+	restrictions := flattenAppServiceIpRestrictions(configResp.SiteConfig.IPSecurityRestrictions)
+	if err := d.Set("ip_restriction", restrictions); err != nil {
+		return fmt.Errorf("Error setting `ip_restriction`: %s", err)
+	}
+
 	scm := flattenAppServiceSourceControl(scmResp.SiteSourceControlProperties)
 	if err := d.Set("source_control", scm); err != nil {
 		return err

azurerm/data_source_app_service_test.go

@@ -126,6 +126,26 @@ func TestAccDataSourceAzureRMAppService_connectionString(t *testing.T) {
 	})
 }
 
+func TestAccDataSourceAzureRMAppService_ipRestriction(t *testing.T) {
+	dataSourceName := "data.azurerm_app_service.test"
+	rInt := acctest.RandInt()
+	location := testLocation()
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceAppService_ipRestriction(rInt, location),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(dataSourceName, "ip_restriction.0.ip_address", "10.10.10.10"),
+					resource.TestCheckResourceAttr(dataSourceName, "ip_restriction.0.subnet_mask", "255.255.255.255"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDataSourceAzureRMAppService_http2Enabled(t *testing.T) {
 	dataSourceName := "data.azurerm_app_service.test"
 	rInt := acctest.RandInt()
@@ -217,6 +237,18 @@ data "azurerm_app_service" "test" {
 `, config)
 }
 
+func testAccDataSourceAppService_ipRestriction(rInt int, location string) string {
+	config := testAccAzureRMAppService_oneIpRestriction(rInt, location)
+	return fmt.Sprintf(`
+%s
+
+data "azurerm_app_service" "test" {
+  name                = "${azurerm_app_service.test.name}"
+  resource_group_name = "${azurerm_app_service.test.resource_group_name}"
+}
+`, config)
+}
+
 func testAccDataSourceAppService_http2Enabled(rInt int, location string) string {
 	config := testAccAzureRMAppService_http2Enabled(rInt, location)
 	return fmt.Sprintf(`

azurerm/import_arm_app_service_test.go

@@ -145,6 +145,29 @@ func TestAccAzureRMAppService_importConnectionStrings(t *testing.T) {
 	})
 }
 
+func TestAccAzureRMAppService_importIpRestriction(t *testing.T) {
+	resourceName := "azurerm_app_service.test"
+
+	ri := acctest.RandInt()
+	config := testAccAzureRMAppService_oneIpRestriction(ri, testLocation())
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testCheckAzureRMAppServiceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func TestAccAzureRMAppService_importDefaultDocuments(t *testing.T) {
 	resourceName := "azurerm_app_service.test"
 

azurerm/resource_arm_app_service.go

@@ -214,6 +214,25 @@ func resourceArmAppService() *schema.Resource {
 				Computed: true,
 			},
 
+			"ip_restriction": {
+				Type:     schema.TypeList,
+				Optional: true,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"ip_address": {
+							Type:     schema.TypeString,
+							Required: true,
+						},
+						"subnet_mask": {
+							Type:     schema.TypeString,
+							Optional: true,
+							Default:  "255.255.255.255",
+						},
+					},
+				},
+			},
+
 			"https_only": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -432,7 +451,7 @@ func resourceArmAppServiceUpdate(d *schema.ResourceData, meta interface{}) error
 		return err
 	}
 
-	if d.HasChange("site_config") {
+	if d.HasChange("site_config") || d.HasChange("ip_restriction") {
 		// update the main configuration
 		siteConfig := expandAppServiceSiteConfig(d)
 		siteConfigResource := web.SiteConfigResource{
@@ -594,6 +613,11 @@ func resourceArmAppServiceRead(d *schema.ResourceData, meta interface{}) error {
 		return err
 	}
 
+	restrictions := flattenAppServiceIpRestrictions(configResp.SiteConfig.IPSecurityRestrictions)
+	if err := d.Set("ip_restriction", restrictions); err != nil {
+		return fmt.Errorf("Error flattening `ip_restrictions`: %s", err)
+	}
+
 	scm := flattenAppServiceSourceControl(scmResp.SiteSourceControlProperties)
 	if err := d.Set("source_control", scm); err != nil {
 		return err
@@ -643,6 +667,9 @@ func expandAppServiceSiteConfig(d *schema.ResourceData) web.SiteConfig {
 	configs := d.Get("site_config").([]interface{})
 	siteConfig := web.SiteConfig{}
 
+	ipRestrictions := expandIpRestrictions(d)
+	siteConfig.IPSecurityRestrictions = ipRestrictions
+
 	if len(configs) == 0 {
 		return siteConfig
 	}
@@ -852,6 +879,25 @@ func expandAppServiceConnectionStrings(d *schema.ResourceData) map[string]*web.C
 	return output
 }
 
+func expandIpRestrictions(d *schema.ResourceData) *[]web.IPSecurityRestriction {
+	ipSecurityRestrictions := d.Get("ip_restriction").([]interface{})
+	restrictions := make([]web.IPSecurityRestriction, 0)
+
+	for _, ipSecurityRestriction := range ipSecurityRestrictions {
+		restriction := ipSecurityRestriction.(map[string]interface{})
+
+		ip_address := restriction["ip_address"].(string)
+		subnet_mask := restriction["subnet_mask"].(string)
+
+		restrictions = append(restrictions, web.IPSecurityRestriction{
+			IPAddress:  &ip_address,
+			SubnetMask: &subnet_mask,
+		})
+	}
+
+	return &restrictions
+}
+
 func flattenAppServiceConnectionStrings(input map[string]*web.ConnStringValueTypePair) interface{} {
 	results := make([]interface{}, 0)
 
@@ -866,6 +912,21 @@ func flattenAppServiceConnectionStrings(input map[string]*web.ConnStringValueTyp
 	return results
 }
 
+func flattenAppServiceIpRestrictions(input *[]web.IPSecurityRestriction) interface{} {
+	results := make([]interface{}, 0)
+
+	if input != nil {
+		for _, v := range *input {
+			result := make(map[string]interface{}, 0)
+			result["ip_address"] = *v.IPAddress
+			result["subnet_mask"] = *v.SubnetMask
+			results = append(results, result)
+		}
+	}
+
+	return results
+}
+
 func flattenAppServiceAppSettings(input map[string]*string) map[string]string {
 	output := make(map[string]string, 0)
 	for k, v := range input {

azurerm/resource_arm_app_service_test.go

@@ -371,6 +371,54 @@ func TestAccAzureRMAppService_connectionStrings(t *testing.T) {
 	})
 }
 
+func TestAccAzureRMAppService_oneIpRestriction(t *testing.T) {
+	resourceName := "azurerm_app_service.test"
+	ri := acctest.RandInt()
+	config := testAccAzureRMAppService_oneIpRestriction(ri, testLocation())
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testCheckAzureRMAppServiceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMAppServiceExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.0.ip_address", "10.10.10.10"),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.0.subnet_mask", "255.255.255.255"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAzureRMAppService_manyIpRestrictions(t *testing.T) {
+	resourceName := "azurerm_app_service.test"
+	ri := acctest.RandInt()
+	config := testAccAzureRMAppService_manyIpRestrictions(ri, testLocation())
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testCheckAzureRMAppServiceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMAppServiceExists(resourceName),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.0.ip_address", "10.10.10.10"),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.0.subnet_mask", "255.255.255.255"),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.1.ip_address", "20.20.20.0"),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.1.subnet_mask", "255.255.255.0"),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.2.ip_address", "30.30.0.0"),
+					resource.TestCheckResourceAttr(resourceName, "ip_restriction.2.subnet_mask", "255.255.0.0"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAzureRMAppService_defaultDocuments(t *testing.T) {
 	resourceName := "azurerm_app_service.test"
 	ri := acctest.RandInt()
@@ -1153,6 +1201,78 @@ resource "azurerm_app_service" "test" {
 `, rInt, location, rInt, rInt)
 }
 
+func testAccAzureRMAppService_oneIpRestriction(rInt int, location string) string {
+	return fmt.Sprintf(`
+resource "azurerm_resource_group" "test" {
+  name = "acctestRG-%d"
+  location = "%s"
+}
+
+resource "azurerm_app_service_plan" "test" {
+  name                = "acctestASP-%d"
+  location            = "${azurerm_resource_group.test.location}"
+  resource_group_name = "${azurerm_resource_group.test.name}"
+
+  sku {
+    tier = "Standard"
+    size = "S1"
+  }
+}
+
+resource "azurerm_app_service" "test" {
+  name                = "acctestAS-%d"
+  location            = "${azurerm_resource_group.test.location}"
+  resource_group_name = "${azurerm_resource_group.test.name}"
+  app_service_plan_id = "${azurerm_app_service_plan.test.id}"
+
+  ip_restriction {
+    ip_address = "10.10.10.10"
+  }
+}
+`, rInt, location, rInt, rInt)
+}
+
+func testAccAzureRMAppService_manyIpRestrictions(rInt int, location string) string {
+	return fmt.Sprintf(`
+resource "azurerm_resource_group" "test" {
+  name = "acctestRG-%d"
+  location = "%s"
+}
+
+resource "azurerm_app_service_plan" "test" {
+  name                = "acctestASP-%d"
+  location            = "${azurerm_resource_group.test.location}"
+  resource_group_name = "${azurerm_resource_group.test.name}"
+
+  sku {
+    tier = "Standard"
+    size = "S1"
+  }
+}
+
+resource "azurerm_app_service" "test" {
+  name                = "acctestAS-%d"
+  location            = "${azurerm_resource_group.test.location}"
+  resource_group_name = "${azurerm_resource_group.test.name}"
+  app_service_plan_id = "${azurerm_app_service_plan.test.id}"
+
+  ip_restriction {
+    ip_address = "10.10.10.10"
+  }
+
+  ip_restriction {
+    ip_address  = "20.20.20.0"
+    subnet_mask = "255.255.255.0"
+  }
+
+  ip_restriction {
+    ip_address  = "30.30.0.0"
+    subnet_mask = "255.255.0.0"
+  }
+}
+`, rInt, location, rInt, rInt)
+}
+
 func testAccAzureRMAppService_defaultDocuments(rInt int, location string) string {
 	return fmt.Sprintf(`
 resource "azurerm_resource_group" "test" {

website/docs/d/app_service.html.markdown

@@ -47,7 +47,9 @@ output "app_service_id" {
 
 * `https_only` - Can the App Service only be accessed via HTTPS?
 
-* `site_config` - A `site_config` object as defined below.
+* `ip_restriction` - A `ip_restriction` block as defined below.
+
+* `site_config` - A `site_config` block as defined below.
 
 * `tags` - A mapping of tags to assign to the resource.
 
@@ -63,6 +65,14 @@ output "app_service_id" {
 
 ---
 
+`ip_restriction` exports the following:
+
+* `ip_address` - The IP Address used for this IP Restriction.
+
+* `subnet_mask` - The Subnet mask used for this IP Restriction.
+
+---
+
 `site_config` supports the following:
 
 * `always_on` - Is the app be loaded at all times?