Azure Terraform Patterns Skill

Composable architecture building blocks for Azure Terraform. Complements iac-terraform-best-practices.instructions.md (style) and azure-defaults skill (naming, tags, regions).

Quick Reference

Canonical Example — Module Composition

Wire AVM child modules by passing outputs as inputs; never hardcode IDs:

module "resource_group" {
  source  = "Azure/avm-res-resources-resourcegroup/azurerm"
  version = "~> 0.1"
  name     = "rg-${var.project}-${var.environment}"
  location = var.location
  tags     = local.tags
}

module "key_vault" {
  source  = "Azure/avm-res-keyvault-vault/azurerm"
  version = "~> 0.9"
  name                = local.kv_name
  resource_group_name = module.resource_group.name  # ← output wiring
  location            = var.location
  tenant_id           = data.azurerm_client_config.current.tenant_id
  tags                = local.tags
}

Key Rules

• AVM-first: Use Azure/avm-res-* registry modules over raw azurerm_* resources
• Hub-spoke: Spokes peer to hub only; never spoke-to-spoke
• Private endpoints: Three resources per service — PE, DNS zone, VNet link
• Diagnostics: Every resource MUST have a diagnostic setting → Log Analytics
• Conditional: Use for_each (keyed) over count (indexed) for named resources
• Identity: SystemAssigned managed identity + RBAC; avoid keys/connection strings
• Provider pin: ~> 4.0 (allows 4.x patches, blocks 5.0)
• Telemetry: Set enable_telemetry = false in restricted-network environments
• Moved blocks: Use moved {} when renaming resources to prevent destroy/recreate
• Budget: 3 forecast thresholds (80%/100%/120%); amount and emails MUST be variables

Gotchas

• Set-type phantom diffs — azurerm_application_gateway, azurerm_lb, azurerm_network_security_group, azurerm_firewall, azurerm_frontdoor: adding ONE element causes ALL elements to show ~ changes. Mitigation: ignore_changes on set-type blocks.
• Provider pin ~> 4.0 is critical — >= 3.0 crosses breaking versions; = 4.1.0 blocks patches. MUST use ~> 4.0.
• for_each over count for named resources — count causes drift when items are inserted/removed (Terraform reindexes). Use for_each = toset().
• moved block required for renaming — Renaming a resource ID without a moved {} block causes destroy + recreate.
• azurerm 4.x renamed attributes — allow_blob_public_access → allow_nested_items_to_be_public; enable_https_traffic_only → https_traffic_only_enabled; azurerm_app_service removed → use azurerm_linux_web_app.

Reference Index