Firewall improvement

README.md

@@ -127,10 +127,9 @@ azd pipeline config
 It is important to secure the databases in web applications to prevent unwanted data access.
 This infrastructure uses the following mechanisms to secure the PostgreSQL database:
 
-* Azure Firewall: The database is accessible only from other Azure IPs, not from public IPs. (Note that includes other customers using Azure).
-* Admin Username: Randomly generated and stored in Key Vault.
-* Admin Password: Randomly generated and stored in Key Vault.
-* PostgreSQL Version: Latest available on Azure, version 14, which includes security improvements.
+* Azure Firewall: The database is accessible from all IPs. Once you've set up the database, you can restrict access to only Azure IPs by running `azd env set POSTGRES_ALLOW_ALL_IPS false` followed by `azd provision`.
+* PostgreSQL Authentication: Passwordless connection using [Microsoft Entra Managed Identity](https://learn.microsoft.com/azure/postgresql/flexible-server/how-to-connect-with-managed-identity).
+* PostgreSQL Version: Latest available on Azure, version 16, which includes security improvements.
 * Django Admin Interface: The URL (typically "/admin") is a unique string generated based on the App Service Plan ID.
 
 ⚠️ For even more security, consider using an Azure Virtual Network to connect the Web App to the Database.

infra/main.bicep

@@ -33,6 +33,10 @@ param djangoSecretKey string
 @description('Running on GitHub Actions?')
 param runningOnGh bool = false
 
+// Necessary for post-provision script, can be disabled after
+@description('Allow all IPs to connect to the PostgreSQL server')
+param postgresAllowAllIPs bool = true
+
 var resourceToken = toLower(uniqueString(subscription().id, name, location))
 var tags = { 'azd-env-name': name }
 
@@ -61,14 +65,14 @@ module postgresServer 'core/database/postgresql/flexibleserver.bicep' = {
     storage: {
       storageSizeGB: 32
     }
-    version: '14'
+    version: '16'
     authType: 'EntraOnly'
     entraAdministratorName: postgresEntraAdministratorName
     entraAdministratorObjectId: postgresEntraAdministratorObjectId
     entraAdministratorType: postgresEntraAdministratorType
     databaseNames: [ postgresDatabaseName ]
     allowAzureIPsFirewall: true
-    allowAllIPsFirewall: true // Necessary for post-provision script, can be disabled after
+    allowAllIPsFirewall: postgresAllowAllIPs
   }
 }
 
@@ -193,3 +197,4 @@ output AZURE_KEY_VAULT_NAME string = keyVault.outputs.name
 
 output POSTGRES_HOST string = postgresServer.outputs.POSTGRES_DOMAIN_NAME
 output POSTGRES_USERNAME string = postgresEntraAdministratorName
+output POSTGRES_ALLOW_ALL_IPS bool = postgresAllowAllIPs

infra/main.parameters.json

@@ -25,6 +25,9 @@
       },
       "postgresEntraAdministratorType": {
         "value": "User"
+      },
+      "postgresAllowAllIPs": {
+        "value": "${POSTGRES_ALLOW_ALL_IPS=true}"
       }
     }
   }