Skip to content

Commit 8d93b22

Browse files
pregresspregress
committed
feat: new rule auto heal on webapps
1 parent bf3beba commit 8d93b22

File tree

6 files changed

+521
-0
lines changed

6 files changed

+521
-0
lines changed

‎docs/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ This documentation describes a list of rules available by enabling this ruleset.
66

77
|Rule|Enabled by default|
88
| --- | --- |
9+
|[azurerm_app_service_missing_auto_heal_setting](rules/azurerm_app_service_missing_auto_heal_setting.md)|✔|
10+
|[azurerm_linux_virtual_machine_invalid_name](rules/azurerm_linux_virtual_machine_invalid_name.md)|✔|
911
|[azurerm_linux_virtual_machine_invalid_size](rules/azurerm_linux_virtual_machine_invalid_size.md)|✔|
1012
|[azurerm_linux_virtual_machine_scale_set_invalid_sku](rules/azurerm_linux_virtual_machine_scale_set_invalid_sku.md)|✔|
1113
|[azurerm_resource_missing_tags](rules/azurerm_resource_missing_tags.md)||

‎docs/rules/azurerm_app_service_missing_auto_heal_setting.md‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# azurerm_app_service_missing_auto_heal_setting
2+
3+
Disallow missing auto_heal_setting configuration in site_config block for Azure App Service resources.
4+
5+
This rule applies to the following Azure App Service resource types:
6+
- `azurerm_linux_web_app`
7+
- `azurerm_linux_web_app_slot`
8+
- `azurerm_windows_web_app`
9+
- `azurerm_windows_web_app_slot`
10+
11+
## Configuration
12+
13+
```hcl
14+
rule "azurerm_app_service_missing_auto_heal_setting" {
15+
enabled = true
16+
}
17+
```
18+
19+
## Example
20+
21+
### Terraform Configuration
22+
23+
```hcl
24+
# Non-compliant: Linux Web App with site_config but no auto_heal_setting
25+
resource "azurerm_linux_web_app" "example" {
26+
name = "example-app"
27+
resource_group_name = azurerm_resource_group.example.name
28+
location = azurerm_resource_group.example.location
29+
service_plan_id = azurerm_service_plan.example.id
30+
31+
site_config {
32+
always_on = true
33+
}
34+
}
35+
36+
# Compliant: Linux Web App with auto_heal_setting configured
37+
resource "azurerm_linux_web_app" "example" {
38+
name = "example-app"
39+
resource_group_name = azurerm_resource_group.example.name
40+
location = azurerm_resource_group.example.location
41+
service_plan_id = azurerm_service_plan.example.id
42+
43+
site_config {
44+
always_on = true
45+
46+
auto_heal_setting {
47+
action {
48+
action_type = "Recycle"
49+
}
50+
trigger {
51+
status_code {
52+
count = 5
53+
interval = "00:01:00"
54+
status_code_range = "500-599"
55+
}
56+
}
57+
}
58+
}
59+
}
60+
61+
# Compliant: Windows Web App Slot with comprehensive auto_heal_setting
62+
resource "azurerm_windows_web_app_slot" "example" {
63+
name = "example-slot"
64+
app_service_id = azurerm_windows_web_app.example.id
65+
66+
site_config {
67+
auto_heal_setting {
68+
action {
69+
action_type = "Recycle"
70+
minimum_process_execution_time = "00:01:00"
71+
}
72+
trigger {
73+
status_code {
74+
count = 5
75+
interval = "00:01:00"
76+
status_code_range = "500-599"
77+
}
78+
requests {
79+
count = 100
80+
interval = "00:01:00"
81+
}
82+
slow_request {
83+
count = 10
84+
interval = "00:02:00"
85+
time_taken = "00:00:45"
86+
}
87+
}
88+
}
89+
}
90+
}
91+
```
92+
93+
## Why
94+
95+
Configuring `auto_heal_setting` in the `site_config` block is a best practice for production Azure App Service resources. Auto-healing helps improve application resilience by automatically recycling or restarting the app when specific conditions are met, such as:
96+
97+
- High number of HTTP errors (status codes in the 400-599 range)
98+
- Excessive request volume
99+
- Slow response times
100+
- Memory threshold breaches
101+
102+
By proactively detecting and responding to unhealthy states, auto-healing can prevent prolonged outages and improve overall application availability. This rule ensures that App Service resources have auto-healing configured to maintain production resilience.
103+
104+
For more information about building robust apps for the cloud with auto-heal, see the [Azure App Service documentation on Auto Heal](https://azure.github.io/AppService/2020/05/15/Robust-Apps-for-the-cloud.html#auto-heal).
105+
106+
## How to Fix
107+
108+
Add an `auto_heal_setting` block within the `site_config` block:
109+
110+
```hcl
111+
site_config {
112+
auto_heal_setting {
113+
action {
114+
action_type = "Recycle"
115+
}
116+
trigger {
117+
status_code {
118+
count = 5
119+
interval = "00:01:00"
120+
status_code_range = "500-599"
121+
}
122+
}
123+
}
124+
}
125+
```
126+
You can combine multiple triggers to create comprehensive auto-healing policies.

‎rules/azurerm_app_service_missing_auto_heal_setting.go‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
package rules
2+
3+
import (
4+
"github.com/terraform-linters/tflint-plugin-sdk/hclext"
5+
"github.com/terraform-linters/tflint-plugin-sdk/logger"
6+
"github.com/terraform-linters/tflint-plugin-sdk/tflint"
7+
"github.com/terraform-linters/tflint-ruleset-azurerm/project"
8+
)
9+
10+
// AzurermAppServiceMissingAutoHealSettingRule checks whether auto_heal_setting is configured in site_config
11+
type AzurermAppServiceMissingAutoHealSettingRule struct {
12+
tflint.DefaultRule
13+
}
14+
15+
const (
16+
autoHealSettingBlockName = "auto_heal_setting"
17+
)
18+
19+
var autoHealResourceTypes = []string{
20+
"azurerm_linux_web_app",
21+
"azurerm_linux_web_app_slot",
22+
"azurerm_windows_web_app",
23+
"azurerm_windows_web_app_slot",
24+
}
25+
26+
// NewAzurermAppServiceMissingAutoHealSettingRule returns new rule for checking auto_heal_setting configuration
27+
func NewAzurermAppServiceMissingAutoHealSettingRule() *AzurermAppServiceMissingAutoHealSettingRule {
28+
return &AzurermAppServiceMissingAutoHealSettingRule{}
29+
}
30+
31+
// Name returns the rule name
32+
func (r *AzurermAppServiceMissingAutoHealSettingRule) Name() string {
33+
return "azurerm_app_service_missing_auto_heal_setting"
34+
}
35+
36+
// Enabled returns whether the rule is enabled by default
37+
func (r *AzurermAppServiceMissingAutoHealSettingRule) Enabled() bool {
38+
return true
39+
}
40+
41+
// Severity returns the rule severity
42+
func (r *AzurermAppServiceMissingAutoHealSettingRule) Severity() tflint.Severity {
43+
return tflint.WARNING
44+
}
45+
46+
// Link returns the rule reference link
47+
func (r *AzurermAppServiceMissingAutoHealSettingRule) Link() string {
48+
return project.ReferenceLink(r.Name())
49+
}
50+
51+
// checkResourceType checks a specific resource type for auto_heal_setting configuration
52+
func (r *AzurermAppServiceMissingAutoHealSettingRule) checkResourceType(runner tflint.Runner, resourceType string) error {
53+
resources, err := runner.GetResourceContent(resourceType, &hclext.BodySchema{
54+
Blocks: []hclext.BlockSchema{
55+
{
56+
Type: "site_config",
57+
Body: &hclext.BodySchema{
58+
Blocks: []hclext.BlockSchema{
59+
{
60+
Type: autoHealSettingBlockName,
61+
},
62+
},
63+
},
64+
},
65+
},
66+
}, nil)
67+
68+
if err != nil {
69+
return err
70+
}
71+
72+
for _, resource := range resources.Blocks {
73+
logger.Debug("checking", "resource type", resource.Labels[0], "resource name", resource.Labels[1])
74+
75+
// Check if site_config block exists
76+
hasSiteConfig := false
77+
hasAutoHealSetting := false
78+
79+
for _, block := range resource.Body.Blocks {
80+
if block.Type == "site_config" {
81+
hasSiteConfig = true
82+
83+
// Check for auto_heal_setting block
84+
for _, siteConfigBlock := range block.Body.Blocks {
85+
if siteConfigBlock.Type == "auto_heal_setting" {
86+
hasAutoHealSetting = true
87+
break
88+
}
89+
}
90+
91+
break
92+
}
93+
}
94+
95+
// If site_config doesn't exist, skip this resource
96+
if !hasSiteConfig {
97+
logger.Debug("no site_config block found", "resource type", resource.Labels[0], "resource name", resource.Labels[1])
98+
continue
99+
}
100+
101+
// Emit issue if auto_heal_setting is not configured in site_config
102+
if !hasAutoHealSetting {
103+
issue := "auto_heal_setting should be configured in site_config block for robust app services."
104+
if err := runner.EmitIssue(r, issue, resource.DefRange); err != nil {
105+
return err
106+
}
107+
}
108+
}
109+
110+
return nil
111+
}
112+
113+
// Check checks whether auto_heal_setting is configured in site_config
114+
func (r *AzurermAppServiceMissingAutoHealSettingRule) Check(runner tflint.Runner) error {
115+
for _, resourceType := range autoHealResourceTypes {
116+
if err := r.checkResourceType(runner, resourceType); err != nil {
117+
return err
118+
}
119+
}
120+
121+
return nil
122+
}

0 commit comments

Comments
 (0)