Azure API Management stv1 to stv2 migration using terraform

# STV2 MIGRATION: New public ip in the same region and subscription, standard sku with a DNS label
resource "azurerm_public_ip" "apim_mgmt_public_ip" {
  name = local.public_ip_address_name_apim
  location = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku = "Standard"
  sku_tier = "Regional"
  allocation_method = "Static"
  ip_version = "IPv4"
  # STV2 MIGRATION: Required dns label
  domain_name_label = "apim${random_string.azurerm_api_management_name.result}"
}

# STV2 MIGRATION: NSG should have all the rules required for stv2
# This illustration is for internal network model. Refer https://learn.microsoft.com/en-us/azure/api-management/api-management-using-with-internal-vnet?tabs=stv2#configure-nsg-rules
resource "azurerm_network_security_group" "apim_snnsg_nsg_new" {
name = local.apim_snnsg_new
  location = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  
  security_rule {
    name = "AllowApimVnetInbound"
    priority = 2000
    protocol = "Tcp"
    destination_port_range = "3443"
    access = "Allow"
    direction = "Inbound"
    source_port_range = "*"
    source_address_prefix = "ApiManagement"
    destination_address_prefix = "VirtualNetwork"
  }
  
  security_rule {
    name = "apim-azure-infra-lb"
    priority = 2010
    protocol = "Tcp"
    destination_port_range = "6390"
    access = "Allow"
    direction = "Inbound"
    source_port_range = "*"
    source_address_prefix = "AzureLoadBalancer"
    destination_address_prefix = "VirtualNetwork"
  }
  
  security_rule {
    name = "apim-azure-storage"
    priority = 2000
    protocol = "Tcp"
    destination_port_range = "443"
    access = "Allow"
    direction = "Outbound"
    source_port_range = "*"
    source_address_prefix = "VirtualNetwork"
    destination_address_prefix = "Storage"
  }
  
  security_rule {
    name = "apim-azure-sql"
    priority = 2010
    protocol = "Tcp"
    destination_port_range = "1443"
    access = "Allow"
    direction = "Outbound"
    source_port_range = "*"
    source_address_prefix = "VirtualNetwork"
    destination_address_prefix = "SQL"
  }
  
  security_rule {
    name = "apim-azure-kv"
    priority = 2020
    protocol = "Tcp"
    destination_port_range = "443"
    access = "Allow"
    direction = "Outbound"
    source_port_range = "*"
    source_address_prefix = "VirtualNetwork"
    destination_address_prefix = "AzureKeyVault"
  }
}

resource "azurerm_virtual_network" "apim_vnet" {
  name = "vnet${random_string.azurerm_vnet_name.result}"
  location = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space = [var.apim_vnet_name_address_prefix]

  .....
  .....
  .....
      
  # STV2 MIGRATION: New subnet in the same vnet or a different vnet in the same region
  subnet {
    name = local.apim_subnet_name_new
    address_prefix = local.apim_address_prefix_new
    # STV2 MIGRATION: NSG should have all the rules for stv2
    security_group = azurerm_network_security_group.apim_snnsg_nsg_new.id
    # STV2 MIGRATION: required when using a UDR to force tunnel traffic 
    # service_endpoints =
  }
}

# STV2 MIGRATION: UDR to be attached if required to force tunnel
# resource "azurerm_subnet_route_table_association" "example" {
  # subnet_id = azurerm_subnet.example.id
  # route_table_id = azurerm_route_table.example.id
#}

resource "azurerm_api_management" "api" {
  name = "apiservice${random_string.azurerm_api_management_name.result}"
  location = azurerm_resource_group.rg.location

  .....
  .....
  .....
  
  # STV2 MIGRATION: public ip is required to migrate to stv2
  public_ip_address_id = azurerm_public_ip.apim_mgmt_public_ip.id
  
  virtual_network_configuration {
    # STV2 MIGRATION: change the subnet to a new one
    subnet_id = "${azurerm_virtual_network.apim_vnet.id}/subnets/${local.apim_subnet_name_new}"
  }
}