(Onboarding) Implement MOCK-AZR-SVB-02

[samcolson4]

• Expands the test to include a check for public_network_access_enabled
• Sets the default for public_network_access_enabled to be false

[gusfcarvalho]

This assertion here because it's the default value.. but what would happen if someone used it with a non-default (setting it to true)? Would this test still pass?

[gusfcarvalho]

hi @samcolson4 ! Thanks for the PR!

Regarding the logic behind the implementation of SCF controls for terraform, if someone wants to deploy a a Service Bus with public access network enabled, they would be able to. However, from an enforcing layer, they would be blocked from actually running their code. Since the terraform module's idea is to allow people to run code that is aligned to the security controls, we should avoid that (having options that are, really, not options as they are blocked elsewhere).

Can you think of a way to implement these controls in order to make sure the terraform module user cannot set Public Network Access as enabled ? :)

[samcolson4]

@gusfcarvalho - my latest commit uses the azurerm_servicebus_namespace_network_rule_set resource to define a (very simple) rule set on this. Does this satisfy the requirement?

I can see in Robel's implementation he added another layer to this around private subnets so I may grab him to speak about that too.