Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

Module Name

avm/res/db-for-my-sql/flexible-server

(Optional) Module Version

0.4

Description

Can someone explain to me why the following is in the main.bicep. You can't create delegatedSubnetResourceId, because it requires firewallRules. The main README.MD has no mention of firewallRules.

 @description('Optional. The firewall rules to create in the MySQL flexible server.')
param firewallRules array = []

network: !empty(delegatedSubnetResourceId) && empty(firewallRules)
      ? {
          delegatedSubnetResourceId: delegatedSubnetResourceId
          privateDnsZoneResourceId: privateDnsZoneResourceId
        }
      : null

My feedback after looking into this more.
When to Use mysqlFirewallRule
Public Network Access: If your MySQL flexible server has public network access enabled (publicNetworkAccess: 'Enabled'), you should use firewall rules to restrict access to specific IP addresses or ranges. This helps prevent unauthorized access from the internet.
Specific IP Restrictions: If you need to allow access only from certain IP addresses or ranges, even within a virtual network, firewall rules are necessary.

When You Might Not Need mysqlFirewallRule
Private Network Access Only: If your MySQL flexible server is configured to be accessible only within a virtual network (publicNetworkAccess: 'Disabled'), and you have other network security measures in place (e.g., Network Security Groups, Azure Firewall), you might not need additional firewall rules.
Controlled Environment: If the server is in a highly controlled environment where access is already restricted by other means, firewall rules might be redundant.

It looks like the real issue is that the module is missing publicNetworkAccess in network.

The delegatedSubnetResourceId is used to specify a subnet within a virtual network that is delegated to the MySQL flexible server. This allows the server to be part of a virtual network, providing network isolation and security. However, if publicNetworkAccess is enabled, firewall rules are required to control access to the server.

Suggested fix:

@description('Optional. Specifies whether public network access is allowed for this server. Set to "Enabled" to allow public access, or "Disabled" (default) when the server has VNet integration.')
param publicNetworkAccess string = 'Disabled'

network: publicNetworkAccess == 'Enabled'
  ? (!empty(delegatedSubnetResourceId) || empty(firewallRules)
      ? {
          publicNetworkAccess: publicNetworkAccess
          delegatedSubnetResourceId: delegatedSubnetResourceId
          privateDnsZoneResourceId: privateDnsZoneResourceId
        }
      : null)
  : (!empty(delegatedSubnetResourceId)
      ? {
          publicNetworkAccess: publicNetworkAccess
          delegatedSubnetResourceId: delegatedSubnetResourceId
          privateDnsZoneResourceId: privateDnsZoneResourceId
        }
      : null)

Happy to create a PR if needed.

(Optional) Correlation Id

No response