feat: configure client certificate mode

main.tf

@@ -34,6 +34,9 @@ resource "azurerm_linux_function_app" "this" {
   app_settings                = var.app_settings
   functions_extension_version = var.functions_extension_version
 
+  client_certificate_mode    = var.client_certificate_mode
+  client_certificate_enabled = var.client_certificate_enabled
+
   ftp_publish_basic_authentication_enabled       = var.ftp_publish_basic_authentication_enabled
   webdeploy_publish_basic_authentication_enabled = var.webdeploy_publish_basic_authentication_enabled
 
@@ -164,6 +167,9 @@ resource "azurerm_windows_function_app" "this" {
   app_settings                = var.app_settings
   functions_extension_version = var.functions_extension_version
 
+  client_certificate_mode    = var.client_certificate_mode
+  client_certificate_enabled = var.client_certificate_enabled
+
   ftp_publish_basic_authentication_enabled       = var.ftp_publish_basic_authentication_enabled
   webdeploy_publish_basic_authentication_enabled = var.webdeploy_publish_basic_authentication_enabled
 

tests/certificate.unit.tftest.hcl

@@ -0,0 +1,209 @@
+mock_provider "azurerm" {}
+
+run "setup_tests" {
+  module {
+    source = "./tests/setup-unit-tests"
+  }
+}
+
+run "linux_client_certificate_mode_optional" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_mode = "Optional"
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_mode == "Optional"
+    error_message = "The Client certificate mode is on \"Required\" or \"OptionalInteractiveUser\""
+  }
+}
+
+run "linux_client_certificate_mode_optional_interactive_user" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_mode = "OptionalInteractiveUser"
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_mode == "OptionalInteractiveUser"
+    error_message = "The Client certificate mode is on \"Optional\" or \"Required\""
+  }
+}
+
+run "linux_client_certificate_mode_required" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_mode = "Required"
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_mode == "Required"
+    error_message = "The Client certificate mode is on \"Optional\" or \"OptionalInteractiveUser\""
+  }
+}
+
+run "linux_client_certificate_disable" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_enabled = false
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_enabled == false
+    error_message = "Client certificate enabled for Web App"
+  }
+}
+
+run "linux_client_certificate_enabled" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_enabled = true
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_enabled == true
+    error_message = "Client certificate disable for Web App"
+  }
+}
+
+run "windows_client_certificate_mode_optional" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    kind                       = "Windows"
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_mode = "Optional"
+  }
+
+  assert {
+    condition = azurerm_windows_function_app.this[0].client_certificate_mode == "Optional"
+    error_message = "The Client certificate mode is on \"OptionalInteractiveUser\" or \"Required\""
+  }
+}
+
+run "windows_client_certificate_mode_optional_interactive_user" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_mode = "OptionalInteractiveUser"
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_mode == "OptionalInteractiveUser"
+    error_message = "The Client certificate mode is on \"Optional\" or \"Required\""
+  }
+}
+
+run "windows_client_certificate_mode_required" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    kind                       = "Windows"
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_mode = "Required"
+  }
+
+  assert {
+    condition = azurerm_windows_function_app.this[0].client_certificate_mode == "Required"
+    error_message = "The Client certificate mode is on \"Optional\" or \"OptionalInteractiveUser\""
+  }
+}
+
+run "windows_client_certificate_disable" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_enabled = false
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_enabled == false
+    error_message = "Client certificate enabled for Web App"
+  }
+}
+
+run "windows_client_certificate_enabled" {
+  command = plan
+
+  variables {
+    app_name                   = run.setup_tests.app_name
+    resource_group_name        = run.setup_tests.resource_group_name
+    location                   = run.setup_tests.location
+    app_service_plan_id        = run.setup_tests.app_service_plan_id
+    storage_account_id         = run.setup_tests.storage_account_id
+    log_analytics_workspace_id = run.setup_tests.log_analytics_workspace_id
+
+    client_certificate_enabled = true
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_enabled == true
+    error_message = "Client certificate disable for Web App"
+  }
+}

tests/defaults.unit.tftest.hcl

@@ -37,6 +37,16 @@ run "linux_app" {
     condition     = azurerm_linux_function_app.this[0].webdeploy_publish_basic_authentication_enabled == false
     error_message = "Basic authentication enabled for the WebDeploy client."
   }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_mode == "Required"
+    error_message = "Client certificate mode value is \"Optional\" or \"OptionalInteractiveUser\""
+  }
+
+  assert {
+    condition = azurerm_linux_function_app.this[0].client_certificate_enabled == false
+    error_message = "Client certificate enabled for Web App"
+  }
 }
 
 run "windows_app" {
@@ -71,4 +81,14 @@ run "windows_app" {
     condition     = azurerm_windows_function_app.this[0].webdeploy_publish_basic_authentication_enabled == false
     error_message = "Basic authentication enabled for the WebDeploy client."
   }
+
+  assert {
+    condition = azurerm_windows_function_app.this[0].client_certificate_mode == "Required"
+    error_message = "Client certificate mode value is \"Optional\" or \"OptionalInteractiveUser\""
+  }
+
+  assert {
+    condition = azurerm_windows_function_app.this[0].client_certificate_enabled == false
+    error_message = "Client certificate enabled for Web App"
+  }
 }

variables.tf

@@ -216,6 +216,18 @@ variable "identity_ids" {
   default     = []
 }
 
+variable "client_certificate_mode" {
+  description = "The client cerftificate mode for this Web App. Value must be \"Required\", \"Optional\" or \"OptionalInteractiveUser\"."
+  type        = string
+  default     = "Required"
+}
+
+variable "client_certificate_enabled" {
+  description = "Should client certififcate be enabled for this Web App?"
+  type        = bool
+  default     = false
+}
+
 variable "ftp_publish_basic_authentication_enabled" {
   description = "Should basic (username and password) authentication be enabled for the FTP client?"
   type        = bool