azure-verified-modules

# Azure Verified Modules (Reference) Skill This skill helps you learn from Azure Verified Modules (AVM) - Microsoft's official Terraform modules - to understand best practices, security patterns, and proper resource configuration when building your own custom modules. ## When to Use This Skill - **Learning best practices** for Azure resource configuration - **Researching security defaults** that Microsoft recommends - **Understanding module structure** and organization patterns - **Finding proper resource attributes** and configurations - **Reference architecture** for custom module development ## How to Use AVM as Reference **AVM provides examples of:** - Security-first configurations (TLS versions, encryption, network rules) - Proper variable validation patterns - Output structure and naming conventions - Dynamic blocks for optional resources - Module organization and file structure ## What are Azure Verified Modules? Azure Verified Modules (AVM) are Microsoft's official Terraform modules that serve as **reference implementations** showing: - **Security best practices** - Microsoft-recommended security configurations - **Proper resource patterns** - How to structure and organize resources - **Validation rules** - Input validation for Azure resource constraints - **Output conventions** - Standard output naming and structure - **Testing patterns** - How Microsoft tests infrastructure code ## Finding AVM for Reference ### Official AVM Catalog Browse implementations: https://azure.github.io/Azure-Verified-Modules/ ### Terraform Registry View source code: https://registry.terraform.io/namespaces/Azure AVM modules are prefixed with `avm-`, e.g., `avm-res-storage-storageaccount`. (https://registry.terraform.io/search/modules?q=avm) ### Using Terraform MCP Tools \`\`\`bash # Use terraform MCP to find relevant AVM modules search_modules("azure storage account verified") # View AVM implementation details get_module_details("Azure/avm-res-storage-storageaccount/azurerm") \`\`\` ## Key Learnings from AVM ### 1. Security Defaults - Always enforce TLS 1.2 minimum - Disable public access by default - Use private endpoints for PaaS services - Enable encryption at rest and in transit ### 2. Variable Design - Add validation for Azure resource constraints - Provide sensible defaults for optional values - Use object types for complex configurations - Document all variables with descriptions ### 3. Resource Organization - Use \`for_each\` for child resources - Implement dynamic blocks for optional configs - Tag all resources consistently - Name resources predictably ### 4. Output Structure - Expose resource IDs - Provide connection endpoints - Mark sensitive values appropriately - Use descriptive output names ## What NOT to Do ❌ **DON'T copy AVM by calling it as a module:** \`\`\`hcl # This defeats the purpose - just creates a wrapper module "storage_wrapper" { source = "Azure/avm-res-storage-storageaccount/azurerm" version = "0.2.0" name = var.name } \`\`\` ✅ **DO learn patterns and implement resources directly:** \`\`\`hcl # This is what we want - actual resource using AVM patterns resource "azurerm_storage_account" "this" { name = var.name resource_group_name = var.resource_group_name location = var.location # Using security patterns learned from AVM min_tls_version = "TLS1_2" https_traffic_only_enabled = true } \`\`\` ## Additional Resources For detailed code examples, security patterns, and module templates, see the [reference guide](references/REFERENCE.md).