Configure observability for Azure MySQL Flexible Server (mysql module)

[Roger Doherty (MSFT) (doherty100)]

Fixes #607.

Wires the observability framework (diagnostic settings → shared Log Analytics workspace owned by vnet-shared) into the mysql module, mirroring the mssql integration from #606.

Changes

• modules/mysql/main.tf
  • Add azurerm_monitor_diagnostic_setting.this on the flexible server, emitting the MySqlSlowLogs and MySqlAuditLogs log categories and AllMetrics to the shared Log Analytics workspace.
  • Enable the required server parameters via azurerm_mysql_flexible_server_configuration (slow_query_log = ON, audit_log_enabled = ON, audit_log_events = CONNECTION,DML,DDL,DCL) so the diagnostic categories actually produce data. The diagnostic setting depends_on these so parameters are applied first.
• modules/mysql/variables.tf — add validated log_analytics_workspace_id input.
• main.tf (root) — wire log_analytics_workspace_id = module.vnet_shared.resource_ids["log_analytics_workspace"], mirroring mssql.
• modules/mysql/scripts/Test-Mysql.ps1 — add Test 6 verifying the diagnostic setting targets a Log Analytics workspace and enables the expected log/metric categories.
• Docs — update modules/mysql/README.md (input variables + resources tables) and root README.md.

Diagnostic settings are control-plane, so no public-access data-plane barrier wiring is required (confirmed — consistent with the mssql precedent).

Acceptance criteria

• MySQL slow/audit logs and metrics flow to the shared Log Analytics workspace.
• New log_analytics_workspace_id variable added and wired from root.
• Unit test added to verify the diagnostic setting exists (mirrors Test-Mssql.ps1).
• modules/mysql/README.md and root README.md updated.
• ./scripts/Invoke-CIChecks.sh terraform markdown passes (also ran powershell). terraform init + validate succeed.

[Roger Doherty (MSFT) (doherty100)]

✅ Validated against a live deployment

Deployed a fresh sandbox with only the impacted modules — vnet_shared (always-on), vnet_app (hub dependency), and mysql — and ran the module's unit + integration tests.

Deployment

• terraform apply: 220 added, 0 changed, 0 destroyed, no errors.
• All four new resources from this PR provisioned cleanly:
  • azurerm_mysql_flexible_server_configuration ×3 — slow_query_log, audit_log_enabled, audit_log_events
  • azurerm_monitor_diagnostic_setting.this — Diagnostic Logs

Tests — Invoke-UnitTests.ps1 -Module mysql -Integration

All VMs confirmed running before testing (VM-start gate).

Unit — Passed=6 Failed=0, including the new diagnostic-setting check:

[MODULE:mysql] [PASS] MySQL Flexible Server '<mysql-server>' exists with expected configuration (public access disabled)
[MODULE:mysql] [PASS] Database 'testdb' exists on server '<mysql-server>'
[MODULE:mysql] [PASS] Private endpoint 'pe-<...>-mysql-server' is connected with status 'Approved'
[MODULE:mysql] [PASS] Private DNS A record exists
[MODULE:mysql] [PASS] SQL auth admin login is configured
[MODULE:mysql] [PASS] Diagnostic setting 'Diagnostic Logs' streams 'MySqlSlowLogs', 'MySqlAuditLogs', and 'AllMetrics' to Log Analytics

Integration (jumpwin1 → mysql) — Passed=4 Failed=0:

[MODULE:integration] [PASS] MySQL: DNS resolved to private IP
[MODULE:integration] [PASS] MySQL: TCP connection to port 3306 succeeded
[MODULE:integration] [PASS] MySQL: Retrieved credentials from Key Vault
[MODULE:integration] [PASS] MySQL: Connected to 'testdb' as 'bootstrapadmin' via private endpoint

Overall: Passed=10 Failed=0 — RESULT: PASS

The MySQL slow/audit logs and metrics flow to the shared Log Analytics workspace as intended, and the new server parameters + diagnostic setting apply without errors.