AppService - Add support for ip_restriction_default_action and scm_ip_restriction_default_action to all app service resources

[jackofallops]

supersedes #24519 and #24464
closes #22593

[stephybun]

Thanks @jackofallops, there's one minor mistake in the documentation, but otherwise LGTM 🦫

[jackofallops]

Tests loog good, failures are transient:

[drdamour]

the default value for this in azure portal is null...y did terraform default it to true?

[arno-bootcamp-ghas]

Are there any plans to also add support for this to azurerm_logic_app_standard?

[mattmshell]

Firewall rules implicitly set the default rule to Deny. Adding this property reverses that because it defaults to Allow. As a result AzureRM 3.95 opens up App and SCM endpoints to the Internet. Pretty dangerous change!

[drdamour]

@mattmshell i think it's only deny by default if you have a private endpoint..that's how i read the docs.

if default action is null (which is the defaut) then it's allow unless a private endpoint exists then it's deny

but 100% agree this seems to be the wrong default value for this setting. if you had a private endpoint and were relying on the default of null making that a default deny..this undoes that.

@jackofallops any thoughts?

[rellis-of-rhindleton]

Hey folks ... this looks like a major breaking change. We have a number of app services (that are not on private endpoints) suddenly reverting to default = Allow, where the effective default was Deny.

[mattmshell]

I don't know if ipSecurityRestrictionsDefaultAction is an optional AzureRM property. If it is could we avoid specifying it in payloads if the Terraform property is unset. If it's a mandatory property can we coalesce to the current AzureRM value?

Alternatively, given the likelihood of disaster if the wrong option is chosen, can we require ip_restriction_default_action to be set if there are any access restriction entries present?

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.