AzureRM Terraform Provider

The following behavioral changes were introduced in version 3.0:

• Resource ID Validation: Resource IDs are validated at import time to ensure correct formats (e.g., preventing a VM Extension ID from being used where a VM ID is expected).
• Minimum TLS Version: The default min_tls_version for resources supporting it is now 1.2.
• Managed Identity: The presence of an identity block now explicitly dictates whether a Managed Identity is assigned. Omitting the block or setting it to null means no identity is assigned.
• Application Gateway: Nested items are now treated as Sets instead of Lists (order no longer matters).
• Firewall: Nested items are now treated as Lists instead of Sets (order now matters).
• API Management: Terraform now removes the Default API and Products when creating a new instance.
• Log Analytics & Recovery Services: The tags field has been removed from various resources.
• Database Migration Service: The provider will now delete azurerm_database_migration_service even if running tasks exist.
• IoT Hub: A Fallback Route is enabled by default on azurerm_iothub.
• MSSQL Database: transparent_data_encryption_enabled is set to true by default and cannot be disabled on non-DW SKUs.

Use the azurerm_stream_analytics_job_storage_account resource to manage the storage account associated with a Stream Analytics Job. This is particularly useful when using Msi (Managed Service Identity) authentication.

Important Note on Resource Conflicts: A Stream Analytics Job's storage account can also be managed directly within the azurerm_stream_analytics_job resource using a job_storage_account block. Do not manage the storage account through both resources, as this will cause configuration conflicts. If you use this standalone resource, it is recommended to add a lifecycle block with ignore_changes = [job_storage_account] to the azurerm_stream_analytics_job resource.

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_stream_analytics_job" "example" {
  name                                     = "example-job"
  resource_group_name                      = azurerm_resource_group.example.name
  location                                 = azurerm_resource_group.example.location
  compatibility_level                      = "1.2"
  data_locale                              = "en-GB"
  events_late_arrival_max_delay_in_seconds = 60
  events_out_of_order_max_delay_in_seconds = 50
  events_out_of_order_policy               = "Adjust"
  output_error_policy                      = "Drop"
  streaming_units                          = 3
  sku_name                                 = "StandardV2"

  identity {
    type = "SystemAssigned"
  }

  tags = {
    environment = "Example"
  }

  transformation_query = <<QUERY
    SELECT *
    INTO [YourOutputAlias]
    FROM [YourInputAlias]
QUERY

  lifecycle {
    ignore_changes = [job_storage_account]
  }
}

resource "azurerm_storage_account" "example" {
  name                     = "exampleaccount"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_stream_analytics_job_storage_account" "example" {
  stream_analytics_job_id = azurerm_stream_analytics_job.example.id
  storage_account_name    = azurerm_storage_account.example.name
  authentication_mode     = "Msi"
}

The azurerm_frontdoor resource manages an Azure Front Door (classic) instance.

Important Deprecation Notice:

• Azure Front Door (classic) is deprecated. New resource creation is no longer supported as of April 1, 2025.
• Modifications to existing resources are supported until the API reaches full retirement on March 31, 2027.
• It is highly recommended to migrate to Azure Front Door (standard/premium) resources using the official migration tool.

Provider Version Note: As of provider version v2.58.0, the custom_https_provisioning_enabled field and custom_https_configuration block have been removed. To enable custom HTTPS functionality, you must now define a separate azurerm_frontdoor_custom_https_configuration block.

resource "azurerm_resource_group" "example" {
  name     = "FrontDoorExampleResourceGroup"
  location = "West Europe"
}

resource "azurerm_frontdoor" "example" {
  name                = "example-FrontDoor"
  resource_group_name = azurerm_resource_group.example.name

  routing_rule {
    name               = "exampleRoutingRule1"
    accepted_protocols = ["Http", "Https"]
    patterns_to_match  = ["/*"]
    frontend_endpoints = ["exampleFrontendEndpoint1"]
    forwarding_configuration {
      forwarding_protocol = "MatchRequest"
      backend_pool_name   = "exampleBackendBing"
    }
  }

  backend_pool_load_balancing {
    name = "exampleLoadBalancingSettings1"
  }

  backend_pool_health_probe {
    name = "exampleHealthProbeSetting1"
  }

  backend_pool {
    name = "exampleBackendBing"
    backend {
      host_header = "www.bing.com"
      address     = "www.bing.com"
      http_port   = 80
      https_port  = 443
    }

    load_balancing_name = "exampleLoadBalancingSettings1"
    health_probe_name   = "exampleHealthProbeSetting1"
  }

  frontend_endpoint {
    name      = "exampleFrontendEndpoint1"
    host_name = "example-FrontDoor.azurefd.net"
  }
}

Preflight validation uses the Azure Preflight Validation API at terraform plan time to surface errors like policy violations, quota breaches, and invalid property values before terraform apply.

Requirements & Limitations:

• Requires valid Azure credentials at terraform plan time.
• Only supported for a subset of resource types.
• Cannot validate arguments that are (known after apply) (computed values).

Configuration

Enable it within the enhanced_validation block:

provider "azurerm" {
  features {
    enhanced_validation {
      preflight_enabled           = true
      preflight_location_fallback = "eastus2"
    }
  }
}

Alternatively, use the environment variable: ARM_PROVIDER_ENHANCED_VALIDATION_PREFLIGHT_ENABLED.

Supported Resources

• azurerm_app_service_environment_v3
• azurerm_service_plan
• azurerm_dashboard_grafana
• azurerm_eventgrid_namespace
• azurerm_managed_redis
• azurerm_nginx_deployment

The azurerm_cdn_frontdoor_rule resource has been significantly restructured to match azurerm_cdn_frontdoor_batch_rule_set.

Key Property Changes:

• behavior_on_match $\rightarrow$ behaviour_on_match
• Header Actions: request_header_action and response_header_action are replaced by modify_request_header and modify_response_header. The sub-properties header_action and value are now operator and header_value respectively.
• Route Overrides: route_configuration_override_action $\rightarrow$ route_configuration_override. Caching and origin group settings are now nested under caching and origin_group blocks.
• Redirects: url_redirect_action $\rightarrow$ url_redirect. Note that destination_host_name, destination_path, destination_fragment, and query_string no longer accept literal empty strings; to preserve the incoming value, omit the argument entirely.
• Rewrites: url_rewrite_action $\rightarrow$ url_rewrite. The destination property is now url_redirect.destination_path and preserve_unmatched_path is now url_redirect.preserve_unmatched_path_enabled.

Condition Changes: Most condition blocks (e.g., client_port_condition, cookies_condition, host_name_condition, http_version_condition, is_device_condition, post_args_condition, query_string_condition) have been renamed to simpler forms (e.g., client_port, request_cookies, host_name, http_version, device_type, post_argument, query_string).

For these conditions:

• match_values is replaced by values.
• negate_condition is replaced by an operator field using Not{Operator} values.
• http_version.operator and device_type.operator are now required.
• device_type.values and post_argument.values are now required.