// Reusable Azure Terraform patterns: hub-spoke, private endpoints, diagnostics, AVM-TF modules. USE FOR: Terraform template design, hub-spoke networking, AVM modules, plan interpretation. DO NOT USE FOR: Bicep code, architecture decisions, troubleshooting, diagram generation.
Artifact template structures, H2 compliance rules, and documentation styling for agent outputs (Steps 1-7). USE FOR: generating any agent artifact, checking H2 structure compliance. DO NOT USE FOR: Azure resource configuration (use azure-defaults), Bicep/Terraform patterns (use bicep-patterns or terraform-patterns).
Reusable Azure Bicep patterns: hub-spoke, private endpoints, diagnostics, AVM composition. USE FOR: Bicep template design, hub-spoke networking, private endpoint patterns, AVM modules. DO NOT USE FOR: Terraform code, architecture decisions, troubleshooting, diagram generation.
Prepare Azure apps for deployment (infra Bicep/Terraform, azure.yaml, Dockerfiles). Use for create/modernize or create+deploy; not cross-cloud migration (use azure-cloud-migrate). WHEN: "create app", "build web app", "create API", "create serverless HTTP API", "create frontend", "create back end", "build a service", "modernize application", "update application", "add authentication", "add caching", "host on Azure", "create and deploy", "deploy to Azure", "deploy to Azure using Terraform", "deploy to Azure App Service", "deploy to Azure App Service using Terraform", "deploy to Azure Container Apps", "deploy to Azure Container Apps using Terraform", "generate Terraform", "generate Bicep", "function app", "timer trigger", "service bus trigger", "event-driven function", "containerized Node.js app", "social media app", "static portfolio website", "todo list with frontend and API", "prepare my Azure application to use Key Vault", "managed identity".
Shared IaC deploy patterns for Bicep and Terraform deploy agents: deployment strategies, circuit breaker, known deploy issues. For preflight validation (auth, governance, stop rules), see azure-validate. USE FOR: Phased deployment, circuit breaker, deploy-specific known issues. DO NOT USE FOR: Preflight validation (use azure-validate), code generation (use azure-bicep-patterns or terraform-patterns).
| name | terraform-patterns |
| description | Reusable Azure Terraform patterns: hub-spoke, private endpoints, diagnostics, AVM-TF modules. USE FOR: Terraform template design, hub-spoke networking, AVM modules, plan interpretation. DO NOT USE FOR: Bicep code, architecture decisions, troubleshooting, diagram generation. |
| compatibility | Requires Terraform >= 1.9, azurerm ~> 4.0, Azure CLI |
Composable architecture building blocks for Azure Terraform. Complements
iac-terraform-best-practices.instructions.md (style) and azure-defaults skill (naming, tags, regions).
| Pattern | When to Use | Reference |
|---|---|---|
| Hub-Spoke Networking | Multi-workload environments with shared services | references/hub-spoke-pattern.md |
| Private Endpoint Wiring | Any PaaS service requiring private connectivity | references/private-endpoint-pattern.md |
| Diagnostic Settings | Every deployed resource (mandatory) | references/common-patterns.md |
| Conditional Deployment | Optional resources controlled by variables | references/common-patterns.md |
| Module Composition | Calling multiple AVM modules in root module | See inline example below |
| Managed Identity | Any service-to-service authentication | references/common-patterns.md |
| Budget & Cost Monitoring | Every deployment (mandatory) | references/budget-pattern.md |
| Plan Interpretation | Pre-deployment validation and change analysis | references/plan-interpretation.md |
| AVM Pitfalls | Set-type diffs, provider pins, 4.x changes | references/avm-pitfalls.md |
| AVM Authoring | AVM certification requirements, compliance | references/avm-authoring-requirements.md |
| Module Refactoring | Monolith → module extraction, state migration | references/refactor-module.md |
Wire AVM child modules by passing outputs as inputs; never hardcode IDs:
module "resource_group" {
source = "Azure/avm-res-resources-resourcegroup/azurerm"
version = "~> 0.1"
name = "rg-${var.project}-${var.environment}"
location = var.location
tags = local.tags
}
module "key_vault" {
source = "Azure/avm-res-keyvault-vault/azurerm"
version = "~> 0.9"
name = local.kv_name
resource_group_name = module.resource_group.name # ← output wiring
location = var.location
tenant_id = data.azurerm_client_config.current.tenant_id
tags = local.tags
}
Azure/avm-res-* registry modules over raw azurerm_* resourcesfor_each (keyed) over count (indexed) for named resources~> 4.0 (allows 4.x patches, blocks 5.0)enable_telemetry = false in restricted-network environmentsmoved {} when renaming resources to prevent destroy/recreate| File | Contents |
|---|---|
references/hub-spoke-pattern.md | Full hub & spoke VNet + peering HCL |
references/private-endpoint-pattern.md | PE + DNS zone + VNet link HCL, subresource table |
references/common-patterns.md | Diagnostics, conditional deployment, module composition, identity |
references/budget-pattern.md | Consumption budget, forecast alerts, anomaly detection |
references/plan-interpretation.md | Plan commands, change symbols, red flags, summary script |
references/avm-pitfalls.md | Set-type diffs, provider pins, tag ignore, moved blocks, 4.x |
references/tf-best-practices-examples.md | Best-practice code examples, formatting, code review checklist |
references/bootstrap-backend-template.md | Backend bootstrap template |
references/deploy-script-template.md | Deployment script template |
references/project-scaffold.md | Project scaffolding structure |
references/avm-authoring-requirements.md | AVM certification: 37 requirements, compliance checklist |
references/refactor-module.md | Module extraction, state migration, refactoring patterns |