Skip to content

volocloud_tenancy_azure

Tenancy resource configuration main schema.

Example Usage

# Example using Azure Existing Billing account of type MPA
resource "volocloud_tenancy_azure" "example" {
  account_id = volocloud_account.example.account_id
  configuration = {
    abbreviation = "expl"
    assume_identity = {
      tenant_id = "00000000-0000-0000-0000-000000000000"
    }
    billing = {
      account_type = "mpa"
      existing = {
        connectivity_subscription_id = "00000000-0000-0000-0000-000000000000"
        identity_subscription_id     = "00000000-0000-0000-0000-000000000000"
        management_subscription_id   = "00000000-0000-0000-0000-000000000000"
        security_subscription_id     = "00000000-0000-0000-0000-000000000000"
      }
    }
    budgets = {
      root = [
        {
          amount = 1000
          notifications = [
            {
              contact_emails = [
                "example@example.com",
              ]
              threshold = 90
            }
          ]
        }
      ]
    }
    dns_domain = "example.com"
    regions = {
      home = {
        primary = {
          location = "australiaeast"
          network = {
            enabled = true
          }
          region = "auee"
        }
      }
    }
    subscriptions = {
      connectivity = {
        abbreviation = "conn"
        azure_bastion = {
          enabled = false
        }
        budgets = [
          {
            amount = 1500
            notifications = [
              {
                contact_emails = [
                  "example@example.com",
                ]
                threshold = 90
              }
            ]
          }
        ]
        ddos_protection_plan = {
          enabled = false
        }
        dns_resolver = {
          inbound = {
            enabled = false
          }
          outbound = {
            enabled = true
            forwarding_domains = [
              {
                dns_domain = "example.com"
                dns_servers = [
                  "1.2.3.4",
                  "5.6.7.8",
                ]
              }
            ]
          }
        }
        dns_zones = {
          private_subdomains = {
            dev  = "dev"
            prod = "prod"
            qa   = "qa"
            test = "test"
          }
          public_domains = [
            "test.example.com",
          ]
        }
        hub_networks = {
          azure_firewall = {
            enabled = true
          }
          enabled = true
          virtual_network_gateway = {
            enabled = true
            s2s_vpns = [
              {
                gateway_address = "1.2.3.4"
                gateway_address_space = [
                  "10.10.0.0/16",
                ]
                gateway_name = "test"
              }
            ]
            type     = "Vpn"
            vpn_type = "RouteBased"
          }
        }
        keyvault = {
          soft_delete_retention_days = 7
        }
      }
      identity = {
        abbreviation = "id"
        azuread_domain_services = {
          admin_vm = {
            admin_username                       = "local.admin"
            computer_name                        = "aaddsadmin"
            enabled                              = true
            shutdown_schedule_notification_email = "example@example.com"
            shutdown_schedule_recurrence_time    = "0000"
          }
          enabled = true
          notification_recipients = [
            "example@example.com",
          ]
          sku = "Standard"
        }
        budgets = [
          {
            amount = 500
            notifications = [
              {
                contact_emails = [
                  "example@example.com",
                ]
                threshold = 90
              }
            ]
          }
        ]
        keyvault = {
          soft_delete_retention_days = 7
        }
      }
      management = {
        abbreviation = "mgmt"
        automation_account = {
          sku = "Basic"
        }
        budgets = [
          {
            amount = 500
            notifications = [
              {
                contact_emails = [
                  "example@example.com",
                ]
                threshold = 90
              }
            ]
          }
        ]
        keyvault = {
          soft_delete_retention_days = 7
        }
        mdfc = {
          email = "example@example.com"
        }
        vnet = {
          subnets = {
            paas = {
              agw = {
                enabled = true
                service_endpoints = [
                  "Microsoft.KeyVault",
                ]
              }
            }
            standard = {
              secured = {
                delegation = {
                  actions = [
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                  ]
                  name    = "psqlfs"
                  service = "Microsoft.DBforPostgreSQL/flexibleServers"

                }
                service_endpoints = [
                  "Microsoft.KeyVault",
                  "Microsoft.Storage",
                ]
              }
            }
          }
          vnet_link_to_private_dns_zones = [
            "privatelink.postgres.database.azure.com",
          ]
        }
      }
      security = {
        abbreviation = "sec"
        budgets = [
          {
            amount = 500
            notifications = [
              {
                contact_emails = [
                  "example@example.com",
                ]
                threshold = 90
              }
            ]
          }
        ]
        keyvault = {
          soft_delete_retention_days = 7
        }
      }
    }
    tags = {}
  }
  credentials = {
    client_id       = "00000000-0000-0000-0000-000000000000"
    client_secret   = "client_secret"
    subscription_id = "00000000-0000-0000-0000-000000000000"
    tenant_id       = "00000000-0000-0000-0000-000000000000"
  }
  name = "example"
}

Schema

Required

  • account_id (String) Volocloud Account ID associated with this account.
  • configuration (Attributes) Provides configuration required to setup the Tenancy. (see below for nested schema)
  • credentials (Attributes) Provides credentials required to setup the Tenancy. (see below for nested schema)
  • name (String) Volocloud tenancy Name.

Optional

  • trigger_update (String) This attribute provides a mechanism to trigger an update on the tenancy resouce when there is no change to the other attributes.

Read-Only

  • id (String) ID of the resource computed from the account_id and tenancy_id separated by : .
  • provider_version (String) The provider version which is used by this resource. It gets automatically updated whent he provider version is changed. It triggers an update on the tenancy resource.
  • resources (Map of String) These are all the resources created in the tenancy.
  • tenancy_id (String) Volocloud Tenancy ID.

Nested Schema for configuration

Required:

  • abbreviation (String) This abbreviation will be used to uniquily identify resources created. Only applies to resources that require Azure global uniqueness and to Management Groups.
  • assume_identity (Attributes) Azure Tenant details for Volocloud bootstrap identity to be assumed. (see below for nested schema)
  • billing (Attributes) Provides the details required for Microsoft Azure billing. Must provide only one of ea, existing, mca, mpa attributes. (see below for nested schema)
  • dns_domain (String) DNS domain associated with this tenancy.
  • regions (Attributes) Defines which regions to deploy into. (see below for nested schema)
  • subscriptions (Attributes) Azure Core Subscriptions: connectivity, identity and management configuration. (see below for nested schema)

Optional:

  • budgets (Attributes, Deprecated) Provides a nested List of nested budget object to associate with a Management Group. Deprecated: use budgets under management_groups instead. (see below for nested schema)
  • environments (List of String) List of environments to be deployed part of the tenancy. Possible value are dev, prod, qa or test. Defaults to [dev, prod, test]
  • management_groups (Attributes) Azure management group hierarchy configuration. This object represents the tenancy (root) management group. (see below for nested schema)
  • nutanix_deployment (Boolean) If true, enables Nutanix NC2 deployment capabilities including custom role definitions. Defaults to false.
  • tags (Map of String) Key-value map of resource tags for all the tenancy resources.
  • update_manager (Attributes) Azure Update Manager configuration. Controls patch management infrastructure at the management group level. (see below for nested schema)

Nested Schema for configuration.assume_identity

Required:

  • tenant_id (String) The Azure Tenant ID where Volo bootstrap identity was created from the Azure ARM Template provided by the volocloud provider account resource.

Nested Schema for configuration.billing

Required:

  • account_type (String) Microsoft Azure Billing Account type. Possible values are ea, mca or mpa.

Optional:

  • ea (Attributes) Provides required billing information to create subscriptions for a Microsoft Enterprise Agreement billing account. Conflicts with existing, mca, mpa. (see below for nested schema)
  • existing (Attributes) Provides existing tenancy core subscription ids. Conflicts with ea, mca, mpa. (see below for nested schema)
  • mca (Attributes) Provides required billing information to create subscriptions for an Microsoft Customer Agreement billing account. Conflicts with existing, ea, mpa. (see below for nested schema)
  • mpa (Attributes) All the CSP Partners that we support to create subscriptions programatically. Conflicts with ea, existing, mca attributes. (see below for nested schema)

Nested Schema for configuration.billing.ea

Required:

  • account_id (String) Microsoft Enterprise Agreement billing account id.
  • enrollment_id (String) Microsoft Enterprise Agreement billing enrollment id.

Nested Schema for configuration.billing.existing

Required:

  • connectivity_subscription_id (String) Existing subscription id to be used for connectivity.
  • identity_subscription_id (String) Existing subscription id to be used for identity.
  • management_subscription_id (String) Existing subscription id to be used for management.
  • security_subscription_id (String) Existing subscription id to be used for security.

Optional:

  • data_subscription_id (String) Existing subscription id to be used for data. Required when the data subscription is configured.

Nested Schema for configuration.billing.mca

Required:

  • account_id (String) Microsoft Customer Agreement billing account id.
  • invoice_id (String) Microsoft Customer Agreement billing invoice id.
  • profile_id (String) Microsoft Customer Agreement billing profile id.

Nested Schema for configuration.billing.mpa

Optional:

Nested Schema for configuration.billing.mpa.rhipe

Optional:

  • description (String) Rhipe Description.

Nested Schema for configuration.regions

Required:

Optional:

  • other (Attributes List) A list of Non-Home geographies containing a pair of primary/secondary regions in each geography. (see below for nested schema)

Nested Schema for configuration.regions.home

Required:

Optional:

Nested Schema for configuration.regions.home.primary

Required:

  • location (String) The Azure location of the region. Possible values are [australiacentral australiacentral2 australiaeast australiasoutheast brazilsouth brazilsoutheast canadacentral canadaeast centralindia centralus chilecentral chinaeast chinaeast2 chinanorth chinanorth2 eastasia eastus eastus2 francecentral francesouth germanynorth germanywestcentral indonesiacentral israelcentral italynorth japaneast japanwest koreacentral koreasouth malaysiawest mexicocentral newzealandnorth northcentralus northeurope norwayeast norwaywest polandcentral qatarcentral southafricanorth southafricawest southcentralus southeastasia southindia spaincentral swedencentral switzerlandnorth switzerlandwest uaecentral uaenorth uksouth ukwest usdodcentral usdodeast usgovarizona usgovtexas usgovvirginia westcentralus westeurope westindia westus westus2 westus3].
  • network (Attributes) This information is used to deploy a network on top of the landing zone. A lot of other services depend on this. (see below for nested schema)
  • region (String) The Azure region code of the location. Possible values are [aecc aenn apee apse atee auc2 aucc auee ause brse brss cacc caee chnn chww clee cne2 cnee cnn2 cnnn decw denn escc eunn euww frcc frss gbss gbww idcc ilcc incc inss inww itnn jpee jpww krcc krss mxcc myww noee noww nznn plcc qacc secc uscc uscn uscs uscw usdc usde use2 usee usgc usge usgw usw2 usw3 usww zann zaww].

Nested Schema for configuration.regions.home.primary.network

Required:

  • enabled (Boolean) If enabled, it will deploy a network on top of the landing zone.

Optional:

Nested Schema for configuration.regions.home.primary.network.ip_schema

Optional:

  • address (String) The base IP Network for the entire region (e.g. x.x.x.x). It will be used to perform IPAM for the tenancy and it's tenancy accounts. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 172.16.0.0.
  • environments (Attributes) The Network CIDR configuration for environments. (see below for nested schema)
  • mask (Number) The base IP Network Mask for the entire region (e.g. 16). It will be used to perform IPAM for the tenancy and it's tenancy accounts. It MUST be between 8 and 18. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 16

Nested Schema for configuration.regions.home.primary.network.ip_schema.environments

Optional:

Nested Schema for configuration.regions.home.primary.network.ip_schema.environments.core

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.primary.network.ip_schema.environments.dev

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.primary.network.ip_schema.environments.prod

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.primary.network.ip_schema.environments.qa

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.primary.network.ip_schema.environments.test

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.secondary

Required:

  • location (String) The Azure location of the region. Possible values are [australiacentral australiacentral2 australiaeast australiasoutheast brazilsouth brazilsoutheast canadacentral canadaeast centralindia centralus chilecentral chinaeast chinaeast2 chinanorth chinanorth2 eastasia eastus eastus2 francecentral francesouth germanynorth germanywestcentral indonesiacentral israelcentral italynorth japaneast japanwest koreacentral koreasouth malaysiawest mexicocentral newzealandnorth northcentralus northeurope norwayeast norwaywest polandcentral qatarcentral southafricanorth southafricawest southcentralus southeastasia southindia spaincentral swedencentral switzerlandnorth switzerlandwest uaecentral uaenorth uksouth ukwest usdodcentral usdodeast usgovarizona usgovtexas usgovvirginia westcentralus westeurope westindia westus westus2 westus3].
  • network (Attributes) This information is used to deploy a network on top of the landing zone. A lot of other services depend on this. (see below for nested schema)
  • region (String) The Azure region code of the location. Possible values are [aecc aenn apee apse atee auc2 aucc auee ause brse brss cacc caee chnn chww clee cne2 cnee cnn2 cnnn decw denn escc eunn euww frcc frss gbss gbww idcc ilcc incc inss inww itnn jpee jpww krcc krss mxcc myww noee noww nznn plcc qacc secc uscc uscn uscs uscw usdc usde use2 usee usgc usge usgw usw2 usw3 usww zann zaww].

Nested Schema for configuration.regions.home.secondary.network

Required:

  • enabled (Boolean) If enabled, it will deploy a network on top of the landing zone.

Optional:

Nested Schema for configuration.regions.home.secondary.network.ip_schema

Optional:

  • address (String) The base IP Network for the entire region (e.g. x.x.x.x). It will be used to perform IPAM for the tenancy and it's tenancy accounts. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 172.16.0.0.
  • environments (Attributes) The Network CIDR configuration for environments. (see below for nested schema)
  • mask (Number) The base IP Network Mask for the entire region (e.g. 16). It will be used to perform IPAM for the tenancy and it's tenancy accounts. It MUST be between 8 and 18. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 16

Nested Schema for configuration.regions.home.secondary.network.ip_schema.environments

Optional:

Nested Schema for configuration.regions.home.secondary.network.ip_schema.environments.core

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.secondary.network.ip_schema.environments.dev

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.secondary.network.ip_schema.environments.prod

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.secondary.network.ip_schema.environments.qa

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.home.secondary.network.ip_schema.environments.test

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other

Required:

Optional:

Nested Schema for configuration.regions.other.primary

Required:

  • location (String) The Azure location of the region. Possible values are [australiacentral australiacentral2 australiaeast australiasoutheast brazilsouth brazilsoutheast canadacentral canadaeast centralindia centralus chilecentral chinaeast chinaeast2 chinanorth chinanorth2 eastasia eastus eastus2 francecentral francesouth germanynorth germanywestcentral indonesiacentral israelcentral italynorth japaneast japanwest koreacentral koreasouth malaysiawest mexicocentral newzealandnorth northcentralus northeurope norwayeast norwaywest polandcentral qatarcentral southafricanorth southafricawest southcentralus southeastasia southindia spaincentral swedencentral switzerlandnorth switzerlandwest uaecentral uaenorth uksouth ukwest usdodcentral usdodeast usgovarizona usgovtexas usgovvirginia westcentralus westeurope westindia westus westus2 westus3].
  • network (Attributes) This information is used to deploy a network on top of the landing zone. A lot of other services depend on this. (see below for nested schema)
  • region (String) The Azure region code of the location. Possible values are [aecc aenn apee apse atee auc2 aucc auee ause brse brss cacc caee chnn chww clee cne2 cnee cnn2 cnnn decw denn escc eunn euww frcc frss gbss gbww idcc ilcc incc inss inww itnn jpee jpww krcc krss mxcc myww noee noww nznn plcc qacc secc uscc uscn uscs uscw usdc usde use2 usee usgc usge usgw usw2 usw3 usww zann zaww].

Nested Schema for configuration.regions.other.primary.network

Required:

  • enabled (Boolean) If enabled, it will deploy a network on top of the landing zone.

Optional:

Nested Schema for configuration.regions.other.primary.network.ip_schema

Optional:

  • address (String) The base IP Network for the entire region (e.g. x.x.x.x). It will be used to perform IPAM for the tenancy and it's tenancy accounts. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 172.16.0.0.
  • environments (Attributes) The Network CIDR configuration for environments. (see below for nested schema)
  • mask (Number) The base IP Network Mask for the entire region (e.g. 16). It will be used to perform IPAM for the tenancy and it's tenancy accounts. It MUST be between 8 and 18. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 16

Nested Schema for configuration.regions.other.primary.network.ip_schema.environments

Optional:

Nested Schema for configuration.regions.other.primary.network.ip_schema.environments.core

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.primary.network.ip_schema.environments.dev

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.primary.network.ip_schema.environments.prod

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.primary.network.ip_schema.environments.qa

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.primary.network.ip_schema.environments.test

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.secondary

Required:

  • location (String) The Azure location of the region. Possible values are [australiacentral australiacentral2 australiaeast australiasoutheast brazilsouth brazilsoutheast canadacentral canadaeast centralindia centralus chilecentral chinaeast chinaeast2 chinanorth chinanorth2 eastasia eastus eastus2 francecentral francesouth germanynorth germanywestcentral indonesiacentral israelcentral italynorth japaneast japanwest koreacentral koreasouth malaysiawest mexicocentral newzealandnorth northcentralus northeurope norwayeast norwaywest polandcentral qatarcentral southafricanorth southafricawest southcentralus southeastasia southindia spaincentral swedencentral switzerlandnorth switzerlandwest uaecentral uaenorth uksouth ukwest usdodcentral usdodeast usgovarizona usgovtexas usgovvirginia westcentralus westeurope westindia westus westus2 westus3].
  • network (Attributes) This information is used to deploy a network on top of the landing zone. A lot of other services depend on this. (see below for nested schema)
  • region (String) The Azure region code of the location. Possible values are [aecc aenn apee apse atee auc2 aucc auee ause brse brss cacc caee chnn chww clee cne2 cnee cnn2 cnnn decw denn escc eunn euww frcc frss gbss gbww idcc ilcc incc inss inww itnn jpee jpww krcc krss mxcc myww noee noww nznn plcc qacc secc uscc uscn uscs uscw usdc usde use2 usee usgc usge usgw usw2 usw3 usww zann zaww].

Nested Schema for configuration.regions.other.secondary.network

Required:

  • enabled (Boolean) If enabled, it will deploy a network on top of the landing zone.

Optional:

Nested Schema for configuration.regions.other.secondary.network.ip_schema

Optional:

  • address (String) The base IP Network for the entire region (e.g. x.x.x.x). It will be used to perform IPAM for the tenancy and it's tenancy accounts. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 172.16.0.0.
  • environments (Attributes) The Network CIDR configuration for environments. (see below for nested schema)
  • mask (Number) The base IP Network Mask for the entire region (e.g. 16). It will be used to perform IPAM for the tenancy and it's tenancy accounts. It MUST be between 8 and 18. CANNOT be changed after creation without destroying everything running on top of the network. Defaults to 16

Nested Schema for configuration.regions.other.secondary.network.ip_schema.environments

Optional:

Nested Schema for configuration.regions.other.secondary.network.ip_schema.environments.core

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.secondary.network.ip_schema.environments.dev

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.secondary.network.ip_schema.environments.prod

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.secondary.network.ip_schema.environments.qa

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.regions.other.secondary.network.ip_schema.environments.test

Optional:

  • address (String) The base IP Network for the environment. CANNOT be changed after creation without destroying everything running on top of the network.
  • mask (Number) The base IP Network Mask for the environment. It MUST be between 10 and 20. CANNOT be changed after creation without destroying everything running on top of the network.

Nested Schema for configuration.subscriptions

Required:

Optional:

  • data (Attributes) Provides details for configuring data management resources. This platform subscription hosts centralised data governance: Fabric tenant settings, Fabric domains, and optionally Microsoft Purview. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity

Required:

  • abbreviation (String) This abbreviation will be used to uniquily identify resources created in this subscription. Only applies to resources that require Azure global uniqueness.

Optional:

  • azure_bastion (Attributes) Azure Bastion configuration details. (see below for nested schema)
  • backups (Attributes) Configuration settings for backups in this subscription. Defaults to {"recovery_services_vault":{"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"daily","retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"weekly","retention":{"daily":{"count":33},"monthly":,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"daily","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"monthly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"weekly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"yearly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":}} (see below for nested schema)
  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • ddos_protection_plan (Attributes) Azure DDOS Protection Plan configuration. If not provides, DDOS Protection Plan will not be enabled. (see below for nested schema)
  • dns_resolver (Attributes) Azure Private DNS Resolver configuration. (see below for nested schema)
  • dns_zones (Attributes) Azure DNS Zones for public and private DNS object. (see below for nested schema)
  • hub_networks (Attributes) Hub and Spoke setup. Conflicts with vwan_hub_networks. (see below for nested schema)
  • keyvault (Attributes) Azure KeyVault configuration details. (see below for nested schema)
  • mdfc_servers_fim_custom_rules (Attributes List) Custom FIM rules for Defender for Servers File Integrity Monitoring. Each rule defines file paths, registry paths, and change types to monitor. Defaults to []. (see below for nested schema)
  • resource_groups_lock (Attributes) Configures Azure Delete Lock at Resource Groups level. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this subscription scope. (see below for nested schema)
  • update_manager (Attributes) Azure Update Manager configuration for this subscription. Maintenance configurations defined here are additive on top of MG-level defaults. (see below for nested schema)
  • vwan_hub_networks (Attributes) VWAN setup. Conflicts with hub_networks. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.azure_bastion

Optional:

  • copy_paste (Boolean) Is Copy/Paste feature enabled for the Bastion Host. Defaults to true.
  • enabled (Boolean) Is Azure Bastion enabled? Defaults to true.
  • file_copy (Boolean) Is File Copy feature enabled for the Bastion Host. Defaults to false.
  • sku (String) The SKU of the Bastion Host. Accepted values are Basic and Standard. Defaults to Basic.
  • tunneling (Boolean) Is Tunneling feature enabled for the Bastion Host. Defaults to false.

Nested Schema for configuration.subscriptions.connectivity.backups

Optional:

  • recovery_services_vault (Attributes) Configuration settings for Recovery Services Vault in this subscription. Defaults to {"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":<null>,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":<null>}. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault

Optional:

  • backup_policies (Attributes) Backup policies to be created in this Recovery Services Vault. Defaults to {"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]}. (see below for nested schema)
  • encryption (Attributes) Encryption configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • immutability (String) Immutability settings of vault. Possible values are Locked, Unlocked or Disabled.

Warning

Once immutability is set to Locked, changing it to other values forces a new Recovery Services Vault to be created.

  • monitoring (Attributes) Monitoring configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • sku (String) Sets the vault's SKU. Possible values are Standard or RS0. Defaults to Standard
  • soft_delete (Boolean) Is soft delete enable for this Vault? Defaults to true.
  • storage_mode_type (String) The storage type of the Recovery Services Vault. Possible values are GeoRedundant, LocallyRedundant or ZoneRedundant. Defaults to GeoRedundant.

Note

If storage_mode_type is GeoRedundant and there are multiple regions defined in this subscription, cross region restore will be enabled by default, otherwise it will be disabled. Once cross region restore is enabled, changing it back to false forces a new Recovery Service Vault to be created.


- tags (Map of String) Key-value map of resource tags.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies

Optional:

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily or hourly MUST be specified. (see below for nested schema)
  • timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.retention

Optional:

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 33.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 120. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 10. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.frequency

Optional:

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.file_share.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily, hourly or weekly MUST be specified. (see below for nested schema)
  • policy_type (Attributes) Type of the Backup Policy. Possible values are v1 or v2. Defaults to {"v1":<null>,"v2":{"instant_restore_retention_days":7}}.

Warning

Changing this forces a new resource to be created.


(see below for nested schema) - tiering_policy (Attributes) Tiering policy configuration. (see below for nested schema) - timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.retention

Optional:

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 7 and 9999. Defaults to 33.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.frequency

Optional:

  • daily (Attributes) Sets the backup frequency to daily. Conflicts with hourly and weekly. (see below for nested schema)
  • hourly (Attributes) Sets the backup frequency to hourly. Conflicts with daily and weekly. (see below for nested schema)
  • weekly (Attributes) Sets the backup frequency to daily. Conflicts with daily and hourly. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.frequency.weekly

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.policy_type

Optional:

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.policy_type.v1

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 5. Defaults to 5.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.policy_type.v2

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 30. Defaults to 7.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.tiering_policy

Required:

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.backup_policies.vm.tiering_policy.archived_restore_point

Required:

  • mode (String) The tiering mode to control automatic tiering of recovery points. Possible values are TierAfter or TierRecommended.

Optional:

  • duration (Number) The number of days/weeks/months/years to retain backups in current tier before tiering.
  • duration_type (String) The retention duration type. Possible values are Days, Weeks, Months or Years.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.encryption

Optional:

  • enabled (Boolean) Enabling/Disabling encryption state using the Key Vault key id created part of volocloud resource. Defaults to true .!!! warning Once Encryption with your own key has been Enabled it's not possible to Disable it.
  • infrastructure_encryption (Boolean) Enabling/Disabling the Double Encryption state. Defaults to false .!!! warning Once infrastructure_encryption has been set it's not possible to change it.

Nested Schema for configuration.subscriptions.connectivity.backups.recovery_services_vault.monitoring

Optional:

  • alerts_for_all_job_failures (Boolean) Enabling/Disabling built-in Azure Monitor alerts for security scenarios and job failure scenarios. Defaults to true.

Nested Schema for configuration.subscriptions.connectivity.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.connectivity.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.connectivity.ddos_protection_plan

Required:

  • enabled (Boolean) Is Azure DDOS Protection Plan enabled?

Optional:

  • existing_ddos_protection_plan_resource_id (String) Existing Azure DDOS Protection Plan resource ID to be used.

Nested Schema for configuration.subscriptions.connectivity.dns_resolver

Optional:

Nested Schema for configuration.subscriptions.connectivity.dns_resolver.inbound

Optional:

  • enabled (Boolean) Is Azure Private DNS Resolver Inbound enpoint enabled?

Nested Schema for configuration.subscriptions.connectivity.dns_resolver.outbound

Optional:

  • enabled (Boolean) Is Azure Private Resolver DNS Outbound enpoint enabled?
  • forwarding_domains (Attributes List) Provides a list of objects to configure outbound conditional forwarding. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.dns_resolver.outbound.forwarding_domains

Required:

  • dns_domain (String) DNS domain for conditional forwarding.
  • dns_servers (List of String) List of DNS servers that are authoritative for the domain.

Nested Schema for configuration.subscriptions.connectivity.dns_zones

Optional:

  • private_subdomains (Attributes) Map contains the private DNS domain for each environment. (see below for nested schema)
  • public_domains (List of String) List contains the public DNS domains.

Nested Schema for configuration.subscriptions.connectivity.dns_zones.private_subdomains

Optional:

  • dev (String) The subdomain name for creating the DEV environment private dns zone.
  • prod (String) The subdomain name for creating the PROD environment private dns zone.
  • qa (String) The subdomain name for creating the QA environment private dns zone.
  • test (String) The subdomain name for creating the TEST environment private dns zone.

Nested Schema for configuration.subscriptions.connectivity.hub_networks

Required:

  • enabled (Boolean) If true, deploys a Hub and Spoke setup.

Optional:

  • azure_firewall (Attributes) Provides details for configuring Azure Firewall service. (see below for nested schema)
  • azure_route_server (Attributes) Creates an Azure Route Server in the HUB VNET. (see below for nested schema)
  • virtual_network_gateway (Attributes) Provides the details to create a new virtual network gateway. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.hub_networks.azure_firewall

Optional:

  • availability_zones (Boolean) Is Azure Firewall deployed across the 3 AZs? Defaults to true.
  • dns_proxy (Boolean) Is Azure Firewall going to act as a DNS Proxy? Defaults to true.
  • dns_servers (List of String) A list of DNS servers to configure on the Azure Firewall to use instead of Azure provided servers.
  • enabled (Boolean) Is Azure Firewall enabled? Defaults to true.
  • policy (Attributes) Configures Azure Firewall Policy. (see below for nested schema)
  • sku (String) SKU tier of the Firewall. Possible values are Premium, Standard and Basic. Defaults to Standard.
  • threat_intelligence_mode (String) The operation mode for threat intelligence-based filtering. Possible values are: Off, Alert and Deny. Defaults to Alert.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.azure_firewall.policy

Optional:

  • auto_learn_private_ranges_enabled (Boolean) If true, configures the Azure Firewalll to auto-learn SNAT IP prefixes. Defaults to true.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.azure_route_server

Required:

  • enabled (Boolean) If true, deploys an Azure Route Server in Hub VNET.

Optional:

  • attach_to_azure_firewall (Boolean) If true, configures the deployed Azure Firewall(deployed part of Hub network) to use this Route Server. Defaults to false.
  • bgp_connections (Attributes List) Provides a list of BGP Peer settings object. (see below for nested schema)
  • branch_to_branch_traffic_enabled (Boolean) Whether to enable route exchange between Azure Route Server and the gateway(s). Defaults to false.
  • sku (String) The SKU of the Route Server. The only possible value is Standard. Changing this forces a new resource to be created. Defaults to Standard.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.azure_route_server.bgp_connections

Required:

  • peer_asn (Number) The BGP ASN number of the peer.
  • peer_geo (String) The Geography Key (as defined in the geographies object under tenancy resource) where the peer needs to be configured.
  • peer_ip (String) The IP address of the peer.
  • peer_name (String) The name of the peer.
  • peer_region (String) The Region Key (primary/secondary) where the peer needs to be configured.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway

Required:

  • enabled (Boolean) Is Azure Virtual Network Gateway enabled?

Optional:

  • active_active (Boolean) If true, an active-active Virtual Network Gateway will be created. An active-active gateway requires a HighPerformance or an UltraPerformance SKU. If false, an active-standby gateway will be created. Defaults to false.
  • bgp_settings (Attributes) BGP settings for this Virtual Network Gateway. (see below for nested schema)
  • s2s_vpns (Attributes List) Provides a list of objects, each object has configuration for a site-to-site VPN with a remote gateway. (see below for nested schema)
  • sku (String) Configuration of the size and capacity of the virtual network gateway. Valid options are Basic, Standard, HighPerformance, UltraPerformance, ErGw1AZ, ErGw2AZ, ErGw3AZ, VpnGw1, VpnGw2, VpnGw3, VpnGw4,VpnGw5, VpnGw1AZ, VpnGw2AZ, VpnGw3AZ,VpnGw4AZ and VpnGw5AZ and depend on the type, vpn_type and generation arguments. A PolicyBased gateway only supports the Basic SKU. Further, the UltraPerformance SKU is only supported by an ExpressRoute gateway. Defaults to Basic.
  • type (String) The type of the Virtual Network Gateway. Valid options are Vpn or ExpressRoute. Defaults to Vpn. Changing the type forces a new resource to be created.
  • vpn_type (String) The routing type of the Virtual Network Gateway. Valid options are RouteBased or PolicyBased. Defaults to RouteBased. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.bgp_settings

Optional:

  • active_active (Attributes) BGP settings for this active-active Virtual Network Gateway. (see below for nested schema)
  • active_standby (Attributes) BGP settings for this active-standby Virtual Network Gateway. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.bgp_settings.active_active

Required:

  • asn (Number) The BGP ASN of this Virtual Network Gateway.

Optional:

  • peer_weight (Number) The weight added to routes which have been learned through BGP peering. Valid values can be between 0 and 100.
  • peering_apipa_addresses (Attributes) An object with apipa addresses for this active-active Virtual Network Gateway. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.bgp_settings.active_active.peering_apipa_addresses

Required:

  • instance_0 (Attributes) Azure primary/secondary custom APIPA addresses assigned to the instance 0 BGP peer of this active-active Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255. (see below for nested schema)
  • instance_1 (Attributes) Azure primary/secondary custom APIPA addresses assigned to the instance 1 BGP peer of this active-active Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.bgp_settings.active_active.peering_apipa_addresses.instance_0

Required:

  • primary (String) Azure primary custom APIPA address assigned to the instance 0 BGP peer of this active-active Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255.

Optional:

  • secondary (String) Azure secondary custom APIPA address assigned to the instance 0 BGP peer of this active-active Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.bgp_settings.active_active.peering_apipa_addresses.instance_1

Required:

  • primary (String) Azure primary custom APIPA address assigned to the instance 1 BGP peer of this active-active Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255.

Optional:

  • secondary (String) Azure secondary custom APIPA address assigned to the instance 1 BGP peer of this active-active Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.bgp_settings.active_standby

Required:

  • asn (Number) The BGP ASN of this Virtual Network Gateway.
  • peering_apipa_addresses (Attributes) Azure primary/secondary custom APIPA addresses assigned to the BGP peer of this active-standby Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255. (see below for nested schema)

Optional:

  • peer_weight (Number) The weight added to routes which have been learned through BGP peering. Valid values can be between 0 and 100.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.bgp_settings.active_standby.peering_apipa_addresses

Required:

  • primary (String) Azure primary custom APIPA address assigned to the BGP peer of this active-standby Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255.

Optional:

  • secondary (String) Azure secondary custom APIPA address assigned to the BGP peer of this active-standby Virtual Network Gateway. The valid range for the reserved APIPA address in Azure Public is from 169.254.21.0 to 169.254.22.255.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.s2s_vpns

Required:

  • gateway_name (String) The name of the local network gateway. Changing this forces a new resource to be created.

Optional:

  • connection_dpd_timeout_seconds (Number) The dead peer detection timeout of this connection in seconds. Changing this forces a new resource to be created. Defaults to 45
  • connection_egress_nat_rule_ids (List of String) A list of the egress NAT Rule Ids.
  • connection_ingress_nat_rule_ids (List of String) A list of the ingress NAT Rule Ids.
  • connection_instance (String) Specifies the instance of this active-active Virtual Network Gateway for the connection. Valid values are instance_0 | instance_1.
  • connection_ipsec_policy (Attributes) A ipsec_policy object. Only a single policy can be defined for a connection. For details on custom policies refer to the relevant section in the Azure documentation. (see below for nested schema)
  • connection_local_azure_ip_address_enabled (Boolean) Use private local Azure IP for the connection. Changing this forces a new resource to be created.
  • connection_mode (String) Connection mode to use. Possible values are Default, InitiatorOnly and ResponderOnly. Defaults to Default. Changing this value will force a resource to be created.
  • connection_protocol (String) The IKE protocol version to use. Possible values are IKEv1 and IKEv2. Defaults to IKEv2. Changing this forces a new resource to be created. -> Note: Only valid for IPSec connections on virtual network gateways with SKU VpnGw1, VpnGw2, VpnGw3, VpnGw1AZ, VpnGw2AZ or VpnGw3AZ.
  • connection_psk_kv_secret_name (String) The name of a KeyVault secret that has the PSK for the connection. If not provided, the code will generate a new PSK and store it in a KeyVault secret.
  • connection_type (String) The type of connection. Valid options are IPsec (Site-to-Site), ExpressRoute (ExpressRoute), and Vnet2Vnet (VNet-to-VNet). Each connection type requires different mandatory arguments (refer to the examples above). Defaults to IPSec. Changing this forces a new resource to be created.
  • gateway_address (String) The gateway IP address to connect with.
  • gateway_address_space (List of String) The list of string CIDRs representing the address spaces the gateway exposes.
  • gateway_bpg_settings (Attributes) A bgp_settings containing the Local Network Gateway's BGP speaker settings. (see below for nested schema)
  • gateway_fqdn (String) The gateway FQDN to connect with.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.s2s_vpns.connection_ipsec_policy

Optional:

  • dh_group (String) The DH group used in IKE phase 1 for initial SA. Valid options are DHGroup1, DHGroup14, DHGroup2, DHGroup2048, DHGroup24, ECP256, ECP384, or None. Defaults to DHGroup2.
  • ike_encryption (String) The IKE encryption algorithm. Valid options are AES128, AES192, AES256, DES, DES3, GCMAES128, or GCMAES256. Defaults to AES256.
  • ike_integrity (String) The IKE integrity algorithm. Valid options are GCMAES128, GCMAES256, MD5, SHA1, SHA256, or SHA384. Defaults to SHA256.
  • ipsec_encryption (String) The IPSec encryption algorithm. Valid options are AES128, AES192, AES256, DES, DES3, GCMAES128, GCMAES192, GCMAES256, or None. Defaults to AES256.
  • ipsec_integrity (String) The IPSec integrity algorithm. Valid options are GCMAES128, GCMAES192, GCMAES256, MD5, SHA1, or SHA256. Defaults to SHA256.
  • pfs_group (String) The DH group used in IKE phase 2 for new child SA. Valid options are ECP256, ECP384, PFS1, PFS14, PFS2, PFS2048, PFS24, PFSMM, or None. Defaults to PFS2.
  • sa_datasize (Number) The IPSec SA payload size in KB. Must be at least 1024 KB. Defaults to 102400000.
  • sa_lifetime (Number) The IPSec SA lifetime in seconds. Must be at least 300 seconds. Defaults to 28800 seconds.

Nested Schema for configuration.subscriptions.connectivity.hub_networks.virtual_network_gateway.s2s_vpns.gateway_bpg_settings

Required:

  • asn (String) The BGP speaker's ASN.
  • peering_address (String) The BGP peering address and BGP identifier of this BGP speaker.

Optional:

  • peer_weight (String) The weight added to routes learned from this BGP speaker.

Nested Schema for configuration.subscriptions.connectivity.keyvault

Optional:

  • purge_protection_enabled (Boolean) Is Purge Protection enabled for this Key Vault? Defaults to true.
  • sku (String) The Name of the SKU used for this Key Vault. Possible values are standard and premium. Defaults to standard.
  • soft_delete_retention_days (Number) The number of days that items should be retained for once soft-deleted. This field can only be configured one time and cannot be updated. This value can be between 7 and 90 days. Defaults to 90.

Nested Schema for configuration.subscriptions.connectivity.mdfc_servers_fim_custom_rules

Required:

  • change_type (String) Change types to monitor. Combination of: C=Create, M=Modify, D=Delete, R=Rename. E.g. CMDR for all types.
  • monitored_entities (Attributes) Entities to monitor for this rule, grouped by type. (see below for nested schema)
  • rule_name (String) Display name of the monitoring rule.

Optional:

  • rule_description (String) Description of the monitoring rule.

Nested Schema for configuration.subscriptions.connectivity.mdfc_servers_fim_custom_rules.monitored_entities

Optional:

Nested Schema for configuration.subscriptions.connectivity.mdfc_servers_fim_custom_rules.monitored_entities.linux_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.connectivity.mdfc_servers_fim_custom_rules.monitored_entities.registries

Required:

  • path (String) The registry path to monitor.

Nested Schema for configuration.subscriptions.connectivity.mdfc_servers_fim_custom_rules.monitored_entities.windows_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.connectivity.resource_groups_lock

Optional:

  • baseline (Boolean) Boolean flag to enable/disable RG lock. Defaults to true.
  • ddos (Boolean) Boolean flag to enable/disable RG lock. Defaults to false.
  • dns (Boolean) Boolean flag to enable/disable RG lock. Defaults to false.
  • rsv (Boolean) Boolean flag to enable/disable RG lock. Defaults to false.

Nested Schema for configuration.subscriptions.connectivity.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_definition_name (String) The name of the role definition to assign. For built-in roles use the Azure display name (e.g. Contributor, Reader). For custom roles, use the exact name as defined in the management_groups.role_definitions schema.

Warning

Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.subscriptions.connectivity.update_manager

Optional:

  • alert_action_groups (Attributes List) Alert action groups with filters and notification channels. Each entry creates an action group and alert processing rule. (see below for nested schema)
  • exclusion_tag (String) Tag key used to exclude VMs from dynamic scopes in this subscription. Defaults to PatchExclude.
  • maintenance_configurations (Attributes List) List of maintenance configurations to create. Each defines a schedule, patch classifications, and tag-based dynamic scoping. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.update_manager.alert_action_groups

Required:

  • channels (Attributes List) Notification channels for this action group. (see below for nested schema)
  • name (String) Name identifier for the action group. Used in resource naming.

Optional:

  • filter (Attributes) Filter conditions determining which alerts route to this action group. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.update_manager.alert_action_groups.channels

Required:

  • type (String) Channel type. Valid values: 'email', 'webhook'.

Optional:

  • address (String) Email address (required when type is 'email').
  • name (String) Display name for the channel (required for webhook type).
  • uri (String, Sensitive) Webhook URI (required when type is 'webhook').

Nested Schema for configuration.subscriptions.connectivity.update_manager.alert_action_groups.filter

Optional:

  • critical_patch_threshold (Number) Number of days critical patches can be missing before alerting. Defaults to 7.
  • severity (List of String) Severity levels to route to this action group. Valid values: 'critical', 'warning'. Defaults to ["critical" "warning"].
  • stale_assessment_threshold (Number) Number of hours since last assessment before considering it stale. Defaults to 48.

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations

Required:

  • name (String) Name identifier for the maintenance configuration. Used in resource naming.
  • os_type (String) Operating system type. Valid values: 'Linux', 'Windows'.
  • patch_classifications (List of String) Patch classifications to include. Windows: 'Critical', 'Definition', 'FeaturePack', 'Security', 'ServicePack', 'Tools', 'UpdateRollUp', 'Updates'. Linux: 'Critical', 'Other', 'Security'.
  • recurrence (String) Recurrence pattern. Valid values: 'monthly', 'weekly'.
  • tags_filter (Map of List of String) Map of tag keys to lists of tag values for dynamic scope filtering. VMs matching ALL tag filters (AND logic) are included.

Optional:

  • automation (Attributes) Automation settings for this maintenance configuration. Set to null to disable pre/post event handling for this config. (see below for nested schema)
  • day_of_week (String) Day of the week for weekly recurrence. Required when recurrence is 'weekly'.
  • duration (Number) Maintenance window duration in hours. Minimum 1, maximum 4. Defaults to 3.
  • offset_day_of_month (Number) Day of the month (1-28) for monthly recurrence. Required when recurrence is 'monthly'.
  • reboot_setting (String) Reboot setting after patching. Valid values: 'Always', 'IfRequired', 'Never'. Defaults to IfRequired.
  • start_time (String) Start time in HH:MM format (24-hour). Defaults to 02:00.
  • timezone (String) Timezone for the schedule. Defaults to UTC.

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation

Required:

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.post_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for post-maintenance validation. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.post_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.post_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health validation after patching (heartbeat, agent, extensions). Defaults to true.
  • timeout (Number) Timeout in seconds for post-maintenance heartbeat wait. Defaults to 300.

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.pre_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for pre-maintenance validation. (see below for nested schema)
  • snapshot (Attributes) Snapshot configuration for pre-maintenance VM protection. (see below for nested schema)
  • sql_conflict_handling (Attributes) SQL Server conflict handling configuration. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.pre_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.pre_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health check (agent status, extension status) before patching. Defaults to true.
  • timeout (Number) Timeout in seconds for health check. Defaults to 120.

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.pre_maintenance.snapshot

Optional:

  • enabled (Boolean) Create a VM snapshot before patching. Skipped for Arc-enabled servers. Defaults to true.
  • retention (Number) Number of days to retain the snapshot after successful patching. A value of 0 means delete immediately on successful post-maintenance validation. Defaults to 1.
  • timeout (Number) Timeout in minutes for snapshot creation. Defaults to 10.

Nested Schema for configuration.subscriptions.connectivity.update_manager.maintenance_configurations.automation.pre_maintenance.sql_conflict_handling

Optional:

  • enabled (Boolean) Enable SQL Server active transaction checking before patching. VMs must be tagged with SQLServer:true. Defaults to false.
  • transaction_wait_timeout (Number) Minutes to wait for active SQL transactions to complete. Defaults to 15.

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks

Required:

  • enabled (Boolean) If true, deploys a VWAN setup.

Optional:

  • azure_firewall (Attributes) Provides details for configuring Azure Firewall service. (see below for nested schema)
  • existing_virtual_wan_resource_id (String) Existing Virtual WAN resource ID to be used.
  • expressroute_gateway (Attributes) Manages an ExpressRoute gateway within a Virtual WAN. (see below for nested schema)
  • routes (Attributes List) One or more route objects as defined below. (see below for nested schema)
  • vpn_gateway (Attributes) Manages a VPN Gateway within a Virtual Hub, which enables Site-to-Site communication. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks.azure_firewall

Optional:

  • availability_zones (Boolean) Is Azure Firewall deployed across the 3 AZs? Defaults to true.
  • dns_proxy (Boolean) Is Azure Firewall going to act as a DNS Proxy? Defaults to true.
  • dns_servers (List of String) A list of DNS servers to configure on the Azure Firewall to use instead of Azure provided servers.
  • enabled (Boolean) Is Azure Firewall enabled? Defaults to true.
  • sku (String) SKU tier of the Firewall. Possible values are Premium, Standard and Basic. Defaults to Standard.
  • threat_intelligence_mode (String) The operation mode for threat intelligence-based filtering. Possible values are: Off, Alert and Deny. Defaults to Alert.

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks.expressroute_gateway

Required:

  • enabled (Boolean) If true, deploys Expressroute Gateway.

Optional:

  • scale_unit (Number) The number of scale units with which to provision the ExpressRoute gateway. Each scale unit is equal to 2Gbps, with support for up to 10 scale units (20Gbps). Defaults to 1

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks.routes

Required:

  • address_prefixes (List of String) A list of Address Prefixes.
  • next_hop_ip_address (String) The IP Address that Packets should be forwarded to as the Next Hop.

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks.vpn_gateway

Required:

  • enabled (Boolean) If true, deploys VPN Gateway.

Optional:

  • bgp_settings (Attributes) A bgp_settings object. (see below for nested schema)
  • routing_preference (String) Azure routing preference lets you to choose how your traffic routes between Azure and the internet. You can choose to route traffic either via the Microsoft Network or via the ISP network, Internet. Defaults to Microsoft Network.
  • scale_unit (Number) The number of scale units with which to provision the VPN gateway. Each scale unit is equal to 2Gbps, with support for up to 10 scale units (20Gbps). Defaults to 1

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks.vpn_gateway.bgp_settings

Required:

  • asn (Number) The ASN of the BGP Speaker. Changing this forces a new resource to be created.
  • peer_weight (Number) The weight added to Routes learned from this BGP Speaker. Changing this forces a new resource to be created.

Optional:

  • instance_0_bgp_peering_address (Attributes List) An instance_bgp_peering_address object. (see below for nested schema)
  • instance_1_bgp_peering_address (Attributes List) An instance_bgp_peering_address object. (see below for nested schema)

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks.vpn_gateway.bgp_settings.instance_0_bgp_peering_address

Required:

  • custom_ips (List of String) A list of custom BGP peering addresses to assign to this instance.

Nested Schema for configuration.subscriptions.connectivity.vwan_hub_networks.vpn_gateway.bgp_settings.instance_1_bgp_peering_address

Required:

  • custom_ips (List of String) A list of custom BGP peering addresses to assign to this instance.

Nested Schema for configuration.subscriptions.identity

Required:

  • abbreviation (String) This abbreviation will be used to uniquily identify resources created in this subscription. Only applies to resources that require Azure global uniqueness.

Optional:

  • backups (Attributes) Configuration settings for backups in this subscription. Defaults to {"recovery_services_vault":{"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"daily","retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"weekly","retention":{"daily":{"count":33},"monthly":,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"daily","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"monthly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"weekly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"yearly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":}} (see below for nested schema)
  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • keyvault (Attributes) Azure KeyVault configuration details. (see below for nested schema)
  • mdfc_servers_fim_custom_rules (Attributes List) Custom FIM rules for Defender for Servers File Integrity Monitoring. Each rule defines file paths, registry paths, and change types to monitor. Defaults to []. (see below for nested schema)
  • microsoft_entra_domain_services (Attributes) Microsoft Entra Domain Services configuration details. (see below for nested schema)
  • resource_groups_lock (Attributes) Configures Azure Delete Lock at Resource Groups level. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this subscription scope. (see below for nested schema)
  • update_manager (Attributes) Azure Update Manager configuration for this subscription. Maintenance configurations defined here are additive on top of MG-level defaults. (see below for nested schema)
  • vnet (Attributes) Settings for customizing standard subnets and adding PaaS subnets. (see below for nested schema)

Nested Schema for configuration.subscriptions.identity.backups

Optional:

  • recovery_services_vault (Attributes) Configuration settings for Recovery Services Vault in this subscription. Defaults to {"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":<null>,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":<null>}. (see below for nested schema)

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault

Optional:

  • backup_policies (Attributes) Backup policies to be created in this Recovery Services Vault. Defaults to {"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]}. (see below for nested schema)
  • encryption (Attributes) Encryption configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • immutability (String) Immutability settings of vault. Possible values are Locked, Unlocked or Disabled.

Warning

Once immutability is set to Locked, changing it to other values forces a new Recovery Services Vault to be created.

  • monitoring (Attributes) Monitoring configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • sku (String) Sets the vault's SKU. Possible values are Standard or RS0. Defaults to Standard
  • soft_delete (Boolean) Is soft delete enable for this Vault? Defaults to true.
  • storage_mode_type (String) The storage type of the Recovery Services Vault. Possible values are GeoRedundant, LocallyRedundant or ZoneRedundant. Defaults to GeoRedundant.

Note

If storage_mode_type is GeoRedundant and there are multiple regions defined in this subscription, cross region restore will be enabled by default, otherwise it will be disabled. Once cross region restore is enabled, changing it back to false forces a new Recovery Service Vault to be created.


- tags (Map of String) Key-value map of resource tags.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies

Optional:

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily or hourly MUST be specified. (see below for nested schema)
  • timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.retention

Optional:

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 33.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 120. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 10. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.frequency

Optional:

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.file_share.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily, hourly or weekly MUST be specified. (see below for nested schema)
  • policy_type (Attributes) Type of the Backup Policy. Possible values are v1 or v2. Defaults to {"v1":<null>,"v2":{"instant_restore_retention_days":7}}.

Warning

Changing this forces a new resource to be created.


(see below for nested schema) - tiering_policy (Attributes) Tiering policy configuration. (see below for nested schema) - timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.retention

Optional:

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 7 and 9999. Defaults to 33.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.frequency

Optional:

  • daily (Attributes) Sets the backup frequency to daily. Conflicts with hourly and weekly. (see below for nested schema)
  • hourly (Attributes) Sets the backup frequency to hourly. Conflicts with daily and weekly. (see below for nested schema)
  • weekly (Attributes) Sets the backup frequency to daily. Conflicts with daily and hourly. (see below for nested schema)

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.frequency.weekly

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.policy_type

Optional:

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.policy_type.v1

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 5. Defaults to 5.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.policy_type.v2

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 30. Defaults to 7.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.tiering_policy

Required:

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.backup_policies.vm.tiering_policy.archived_restore_point

Required:

  • mode (String) The tiering mode to control automatic tiering of recovery points. Possible values are TierAfter or TierRecommended.

Optional:

  • duration (Number) The number of days/weeks/months/years to retain backups in current tier before tiering.
  • duration_type (String) The retention duration type. Possible values are Days, Weeks, Months or Years.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.encryption

Optional:

  • enabled (Boolean) Enabling/Disabling encryption state using the Key Vault key id created part of volocloud resource. Defaults to true .!!! warning Once Encryption with your own key has been Enabled it's not possible to Disable it.
  • infrastructure_encryption (Boolean) Enabling/Disabling the Double Encryption state. Defaults to false .!!! warning Once infrastructure_encryption has been set it's not possible to change it.

Nested Schema for configuration.subscriptions.identity.backups.recovery_services_vault.monitoring

Optional:

  • alerts_for_all_job_failures (Boolean) Enabling/Disabling built-in Azure Monitor alerts for security scenarios and job failure scenarios. Defaults to true.

Nested Schema for configuration.subscriptions.identity.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.identity.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.identity.keyvault

Optional:

  • purge_protection_enabled (Boolean) Is Purge Protection enabled for this Key Vault? Defaults to true.
  • sku (String) The Name of the SKU used for this Key Vault. Possible values are standard and premium. Defaults to standard.
  • soft_delete_retention_days (Number) The number of days that items should be retained for once soft-deleted. This field can only be configured one time and cannot be updated. This value can be between 7 and 90 days. Defaults to 90.

Nested Schema for configuration.subscriptions.identity.mdfc_servers_fim_custom_rules

Required:

  • change_type (String) Change types to monitor. Combination of: C=Create, M=Modify, D=Delete, R=Rename. E.g. CMDR for all types.
  • monitored_entities (Attributes) Entities to monitor for this rule, grouped by type. (see below for nested schema)
  • rule_name (String) Display name of the monitoring rule.

Optional:

  • rule_description (String) Description of the monitoring rule.

Nested Schema for configuration.subscriptions.identity.mdfc_servers_fim_custom_rules.monitored_entities

Optional:

Nested Schema for configuration.subscriptions.identity.mdfc_servers_fim_custom_rules.monitored_entities.linux_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.identity.mdfc_servers_fim_custom_rules.monitored_entities.registries

Required:

  • path (String) The registry path to monitor.

Nested Schema for configuration.subscriptions.identity.mdfc_servers_fim_custom_rules.monitored_entities.windows_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.identity.microsoft_entra_domain_services

Optional:

  • admin_vm (Attributes) Provides configuration details for AAD DS Admin VM. (see below for nested schema)
  • enabled (Boolean) (Oprional) Boolean flag to enable/disable Microsoft Entra Domain Services. Defaults to false.
  • notification_recipients (List of String) Provides a list of email addresses to receive notifications from Azure AD Domain Services.
  • sku (String) The SKU to use when provisioning the Domain Service resource. One of Standard, Enterprise or Premium. Defaults to Standard.

Nested Schema for configuration.subscriptions.identity.microsoft_entra_domain_services.admin_vm

Optional:

  • admin_username (String) Provides a username for the local admin of the Admin VM. Defaults to local.admin.
  • computer_name (String) Provides a computer name for the Admin VM. Defaults to medsadmin.
  • enabled (Boolean) If true, it will create an Admin VM based on Windows 11 Enterprise for Microsoft Entra Domain Services and join it into the AD domain. Defaults to false.
  • shutdown_schedule (Attributes) Configures auto-shutdown. For more details see Azure Documentation. (see below for nested schema)
  • spot (Attributes) Use Azure Spot pricing for the Microsoft Entra Domain Services Admin VM. (see below for nested schema)
  • update_manager_maintenance_configuration (String) Name of a maintenance configuration defined in either the identity subscription's update_manager block or the tenancy-level update_manager block. If specified and the name matches a valid config, the VM will have patch mode set to AutomaticByPlatform and receive the matching tags for dynamic scope association. If not specified or the name does not match any config, the VM will not be configured for Update Manager patching.
  • vm_size (String) The VM Size to use for Admin VM. Must be a valid Azure VM size and available in the home region. Defaults toStandard_B2s`.

Nested Schema for configuration.subscriptions.identity.microsoft_entra_domain_services.admin_vm.shutdown_schedule

Optional:

  • enabled (Boolean) If true, it will configure auto-shutdown for the Microsoft Entra Domain Services Admin VM. Defaults to false.
  • notification_email (String) Email address to receive notification of shutdown 30 min before a shutdown event.
  • recurrence_time (String) The time each day when the shutdown schedule takes effect. Must match the format HHmm where HH is 00-23 and mm is 00-59 (e.g. 0930, 2300, etc.). Defaults to 0000.
  • recurrence_timezone (String) Specifies the time zone in which the shutdown schedule takes effect. The possible values are defined here. Default is UTC.

Nested Schema for configuration.subscriptions.identity.microsoft_entra_domain_services.admin_vm.spot

Optional:

  • enabled (Boolean) If true, enables Azure Spot princing for the Admin VM. Defaults to false. The SKU provided MUST be supported for Spot pricing, otherwise the creation of the VM will fail. Please double check Azure Region and Spot princing before selecting the SKU.
  • eviction_policy (String) Specifies what should happen when this VM is evicted for price reasons when using a Spot instance. Possible values are Deallocate and Delete. Changing this forces a new resource to be created. Defaults to Deallocate.
  • max_bid_price (Number) The maximum price you're willing to pay for this VM, in US Dollars; which must be greater than the current spot price. If this bid price falls below the current spot price the Virtual Machine will be evicted using the eviction_policy. Defaults to -1, which means that the Virtual Machine should not be evicted for price reasons.

Nested Schema for configuration.subscriptions.identity.resource_groups_lock

Optional:

  • baseline (Boolean) Boolean flag to enable/disable the baseline resource group lock. Defaults to true.
  • rsv (Boolean) Boolean flag to enable/disable the recovery services vault resource group lock. Defaults to false.

Nested Schema for configuration.subscriptions.identity.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_definition_name (String) The name of the role definition to assign. For built-in roles use the Azure display name (e.g. Contributor, Reader). For custom roles, use the exact name as defined in the management_groups.role_definitions schema.

Warning

Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.subscriptions.identity.update_manager

Optional:

  • alert_action_groups (Attributes List) Alert action groups with filters and notification channels. Each entry creates an action group and alert processing rule. (see below for nested schema)
  • exclusion_tag (String) Tag key used to exclude VMs from dynamic scopes in this subscription. Defaults to PatchExclude.
  • maintenance_configurations (Attributes List) List of maintenance configurations to create. Each defines a schedule, patch classifications, and tag-based dynamic scoping. (see below for nested schema)

Nested Schema for configuration.subscriptions.identity.update_manager.alert_action_groups

Required:

  • channels (Attributes List) Notification channels for this action group. (see below for nested schema)
  • name (String) Name identifier for the action group. Used in resource naming.

Optional:

  • filter (Attributes) Filter conditions determining which alerts route to this action group. (see below for nested schema)

Nested Schema for configuration.subscriptions.identity.update_manager.alert_action_groups.channels

Required:

  • type (String) Channel type. Valid values: 'email', 'webhook'.

Optional:

  • address (String) Email address (required when type is 'email').
  • name (String) Display name for the channel (required for webhook type).
  • uri (String, Sensitive) Webhook URI (required when type is 'webhook').

Nested Schema for configuration.subscriptions.identity.update_manager.alert_action_groups.filter

Optional:

  • critical_patch_threshold (Number) Number of days critical patches can be missing before alerting. Defaults to 7.
  • severity (List of String) Severity levels to route to this action group. Valid values: 'critical', 'warning'. Defaults to ["critical" "warning"].
  • stale_assessment_threshold (Number) Number of hours since last assessment before considering it stale. Defaults to 48.

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations

Required:

  • name (String) Name identifier for the maintenance configuration. Used in resource naming.
  • os_type (String) Operating system type. Valid values: 'Linux', 'Windows'.
  • patch_classifications (List of String) Patch classifications to include. Windows: 'Critical', 'Definition', 'FeaturePack', 'Security', 'ServicePack', 'Tools', 'UpdateRollUp', 'Updates'. Linux: 'Critical', 'Other', 'Security'.
  • recurrence (String) Recurrence pattern. Valid values: 'monthly', 'weekly'.
  • tags_filter (Map of List of String) Map of tag keys to lists of tag values for dynamic scope filtering. VMs matching ALL tag filters (AND logic) are included.

Optional:

  • automation (Attributes) Automation settings for this maintenance configuration. Set to null to disable pre/post event handling for this config. (see below for nested schema)
  • day_of_week (String) Day of the week for weekly recurrence. Required when recurrence is 'weekly'.
  • duration (Number) Maintenance window duration in hours. Minimum 1, maximum 4. Defaults to 3.
  • offset_day_of_month (Number) Day of the month (1-28) for monthly recurrence. Required when recurrence is 'monthly'.
  • reboot_setting (String) Reboot setting after patching. Valid values: 'Always', 'IfRequired', 'Never'. Defaults to IfRequired.
  • start_time (String) Start time in HH:MM format (24-hour). Defaults to 02:00.
  • timezone (String) Timezone for the schedule. Defaults to UTC.

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation

Required:

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.post_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for post-maintenance validation. (see below for nested schema)

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.post_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.post_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health validation after patching (heartbeat, agent, extensions). Defaults to true.
  • timeout (Number) Timeout in seconds for post-maintenance heartbeat wait. Defaults to 300.

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.pre_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for pre-maintenance validation. (see below for nested schema)
  • snapshot (Attributes) Snapshot configuration for pre-maintenance VM protection. (see below for nested schema)
  • sql_conflict_handling (Attributes) SQL Server conflict handling configuration. (see below for nested schema)

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.pre_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.pre_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health check (agent status, extension status) before patching. Defaults to true.
  • timeout (Number) Timeout in seconds for health check. Defaults to 120.

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.pre_maintenance.snapshot

Optional:

  • enabled (Boolean) Create a VM snapshot before patching. Skipped for Arc-enabled servers. Defaults to true.
  • retention (Number) Number of days to retain the snapshot after successful patching. A value of 0 means delete immediately on successful post-maintenance validation. Defaults to 1.
  • timeout (Number) Timeout in minutes for snapshot creation. Defaults to 10.

Nested Schema for configuration.subscriptions.identity.update_manager.maintenance_configurations.automation.pre_maintenance.sql_conflict_handling

Optional:

  • enabled (Boolean) Enable SQL Server active transaction checking before patching. VMs must be tagged with SQLServer:true. Defaults to false.
  • transaction_wait_timeout (Number) Minutes to wait for active SQL transactions to complete. Defaults to 15.

Nested Schema for configuration.subscriptions.identity.vnet

Optional:

  • iaas_subnets (Attributes) Configure IaaS subnets. (see below for nested schema)
  • vnet_link_to_private_dns_zones (List of String) Provides a list of Azure Private DNS Zones to link to this VNET. The zones must be zones created by the volocloud provider: either PaaS private zones or custom private zones.

Nested Schema for configuration.subscriptions.identity.vnet.iaas_subnets

Optional:

Nested Schema for configuration.subscriptions.identity.vnet.iaas_subnets.app_tier

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.identity.vnet.iaas_subnets.app_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.identity.vnet.iaas_subnets.entrads

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.identity.vnet.iaas_subnets.entrads.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.management

Required:

  • abbreviation (String) This abbreviation will be used to uniquily identify resources created in this subscription. Only applies to resources that require Azure global uniqueness.

Optional:

  • automation_account (Attributes) Automation Account configuration details. (see below for nested schema)
  • backups (Attributes) Configuration settings for backups in this subscription. Defaults to {"recovery_services_vault":{"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"daily","retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"weekly","retention":{"daily":{"count":33},"monthly":,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"daily","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"monthly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"weekly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"yearly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":}} (see below for nested schema)
  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • keyvault (Attributes) Azure KeyVault configuration details. (see below for nested schema)
  • log_analytics (Attributes) Log Analytics Workspace configuration. (see below for nested schema)
  • mdfc_servers_fim_custom_rules (Attributes List) Custom FIM rules for Defender for Servers File Integrity Monitoring. Each rule defines file paths, registry paths, and change types to monitor. Defaults to []. (see below for nested schema)
  • monitoring_agent (List of String) Provides a list of Azure Monitoring Agent services to enable. To disable all services, provide an empty list. Defaults to ["uami", "vminsights_dcr", "change_tracking_dcr"]
  • network_watcher_flow_logs (Attributes) Network Watcher Flow Logs configuration details. (see below for nested schema)
  • resource_groups_lock (Attributes) Configures Azure Delete Lock at Resource Groups level. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this subscription scope. (see below for nested schema)
  • update_manager (Attributes) Azure Update Manager configuration for this subscription. Maintenance configurations defined here are additive on top of MG-level defaults. (see below for nested schema)
  • vnet (Attributes) Settings for customizing standard subnets and adding PaaS subnets. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.automation_account

Optional:

  • enabled (Boolean) Whether the Automation Account is enabled. Set to false for regions that do not support Microsoft.Automation. Defaults to true.
  • sku (String) The SKU of the account. Possible values are Basic and Free. Defaults to Basic.

Nested Schema for configuration.subscriptions.management.backups

Optional:

  • recovery_services_vault (Attributes) Configuration settings for Recovery Services Vault in this subscription. Defaults to {"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":<null>,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":<null>}. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault

Optional:

  • backup_policies (Attributes) Backup policies to be created in this Recovery Services Vault. Defaults to {"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]}. (see below for nested schema)
  • encryption (Attributes) Encryption configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • immutability (String) Immutability settings of vault. Possible values are Locked, Unlocked or Disabled.

Warning

Once immutability is set to Locked, changing it to other values forces a new Recovery Services Vault to be created.

  • monitoring (Attributes) Monitoring configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • sku (String) Sets the vault's SKU. Possible values are Standard or RS0. Defaults to Standard
  • soft_delete (Boolean) Is soft delete enable for this Vault? Defaults to true.
  • storage_mode_type (String) The storage type of the Recovery Services Vault. Possible values are GeoRedundant, LocallyRedundant or ZoneRedundant. Defaults to GeoRedundant.

Note

If storage_mode_type is GeoRedundant and there are multiple regions defined in this subscription, cross region restore will be enabled by default, otherwise it will be disabled. Once cross region restore is enabled, changing it back to false forces a new Recovery Service Vault to be created.


- tags (Map of String) Key-value map of resource tags.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies

Optional:

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily or hourly MUST be specified. (see below for nested schema)
  • timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.retention

Optional:

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 33.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 120. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 10. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.frequency

Optional:

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.file_share.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily, hourly or weekly MUST be specified. (see below for nested schema)
  • policy_type (Attributes) Type of the Backup Policy. Possible values are v1 or v2. Defaults to {"v1":<null>,"v2":{"instant_restore_retention_days":7}}.

Warning

Changing this forces a new resource to be created.


(see below for nested schema) - tiering_policy (Attributes) Tiering policy configuration. (see below for nested schema) - timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.retention

Optional:

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 7 and 9999. Defaults to 33.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.frequency

Optional:

  • daily (Attributes) Sets the backup frequency to daily. Conflicts with hourly and weekly. (see below for nested schema)
  • hourly (Attributes) Sets the backup frequency to hourly. Conflicts with daily and weekly. (see below for nested schema)
  • weekly (Attributes) Sets the backup frequency to daily. Conflicts with daily and hourly. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.frequency.weekly

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.policy_type

Optional:

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.policy_type.v1

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 5. Defaults to 5.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.policy_type.v2

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 30. Defaults to 7.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.tiering_policy

Required:

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.backup_policies.vm.tiering_policy.archived_restore_point

Required:

  • mode (String) The tiering mode to control automatic tiering of recovery points. Possible values are TierAfter or TierRecommended.

Optional:

  • duration (Number) The number of days/weeks/months/years to retain backups in current tier before tiering.
  • duration_type (String) The retention duration type. Possible values are Days, Weeks, Months or Years.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.encryption

Optional:

  • enabled (Boolean) Enabling/Disabling encryption state using the Key Vault key id created part of volocloud resource. Defaults to true .!!! warning Once Encryption with your own key has been Enabled it's not possible to Disable it.
  • infrastructure_encryption (Boolean) Enabling/Disabling the Double Encryption state. Defaults to false .!!! warning Once infrastructure_encryption has been set it's not possible to change it.

Nested Schema for configuration.subscriptions.management.backups.recovery_services_vault.monitoring

Optional:

  • alerts_for_all_job_failures (Boolean) Enabling/Disabling built-in Azure Monitor alerts for security scenarios and job failure scenarios. Defaults to true.

Nested Schema for configuration.subscriptions.management.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.management.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.management.keyvault

Optional:

  • purge_protection_enabled (Boolean) Is Purge Protection enabled for this Key Vault? Defaults to true.
  • sku (String) The Name of the SKU used for this Key Vault. Possible values are standard and premium. Defaults to standard.
  • soft_delete_retention_days (Number) The number of days that items should be retained for once soft-deleted. This field can only be configured one time and cannot be updated. This value can be between 7 and 90 days. Defaults to 90.

Nested Schema for configuration.subscriptions.management.log_analytics

Optional:

  • daily_quota_gb (Number) The workspace daily quota for ingestion in GB. Defaults to -1 (unlimited).
  • internet_ingestion_enabled (Boolean) Should the Log Analytics Workspace support ingestion over the Public Internet? Defaults to true.
  • internet_query_enabled (Boolean) Should the Log Analytics Workspace support querying over the Public Internet? Defaults to true.
  • reservation_capacity_in_gb_per_day (Number) The capacity reservation level in GB for this workspace. Must be in increments of 100 between 100 and 5000.
  • retention_in_days (Number) The workspace data retention in days. Possible values are either 7 (Free Tier only) or range between 30 and 730. Defaults to 30.
  • sku (String) Specifies the SKU of the Log Analytics Workspace. Possible values are Free, PerNode, Premium, Standard, Standalone, Unlimited, CapacityReservation, and PerGB2018 (new SKU as of 2018-04-03). Defaults to PerGB2018.

Nested Schema for configuration.subscriptions.management.mdfc_servers_fim_custom_rules

Required:

  • change_type (String) Change types to monitor. Combination of: C=Create, M=Modify, D=Delete, R=Rename. E.g. CMDR for all types.
  • monitored_entities (Attributes) Entities to monitor for this rule, grouped by type. (see below for nested schema)
  • rule_name (String) Display name of the monitoring rule.

Optional:

  • rule_description (String) Description of the monitoring rule.

Nested Schema for configuration.subscriptions.management.mdfc_servers_fim_custom_rules.monitored_entities

Optional:

Nested Schema for configuration.subscriptions.management.mdfc_servers_fim_custom_rules.monitored_entities.linux_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.management.mdfc_servers_fim_custom_rules.monitored_entities.registries

Required:

  • path (String) The registry path to monitor.

Nested Schema for configuration.subscriptions.management.mdfc_servers_fim_custom_rules.monitored_entities.windows_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.management.network_watcher_flow_logs

Optional:

Nested Schema for configuration.subscriptions.management.network_watcher_flow_logs.retention_policy

Optional:

  • days (Number) The number of days to retain flow log records. Defaults to 30 days.
  • enabled (Boolean) Boolean flag to enable/disable retention. Defaults to true.

Nested Schema for configuration.subscriptions.management.network_watcher_flow_logs.traffic_analytics

Optional:

  • enabled (Boolean) Boolean flag to enable/disable traffic analytics. Defaults to false.
  • interval_in_minutes (Number) How frequently service should do flow analytics in minutes. Defaults to 60.

Nested Schema for configuration.subscriptions.management.resource_groups_lock

Optional:

  • baseline (Boolean) Boolean flag to enable/disable the baseline resource group lock. Defaults to true.
  • rsv (Boolean) Boolean flag to enable/disable the recovery services vault resource group lock. Defaults to false.

Nested Schema for configuration.subscriptions.management.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_definition_name (String) The name of the role definition to assign. For built-in roles use the Azure display name (e.g. Contributor, Reader). For custom roles, use the exact name as defined in the management_groups.role_definitions schema.

Warning

Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.subscriptions.management.update_manager

Optional:

  • alert_action_groups (Attributes List) Alert action groups with filters and notification channels. Each entry creates an action group and alert processing rule. (see below for nested schema)
  • exclusion_tag (String) Tag key used to exclude VMs from dynamic scopes in this subscription. Defaults to PatchExclude.
  • maintenance_configurations (Attributes List) List of maintenance configurations to create. Each defines a schedule, patch classifications, and tag-based dynamic scoping. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.update_manager.alert_action_groups

Required:

  • channels (Attributes List) Notification channels for this action group. (see below for nested schema)
  • name (String) Name identifier for the action group. Used in resource naming.

Optional:

  • filter (Attributes) Filter conditions determining which alerts route to this action group. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.update_manager.alert_action_groups.channels

Required:

  • type (String) Channel type. Valid values: 'email', 'webhook'.

Optional:

  • address (String) Email address (required when type is 'email').
  • name (String) Display name for the channel (required for webhook type).
  • uri (String, Sensitive) Webhook URI (required when type is 'webhook').

Nested Schema for configuration.subscriptions.management.update_manager.alert_action_groups.filter

Optional:

  • critical_patch_threshold (Number) Number of days critical patches can be missing before alerting. Defaults to 7.
  • severity (List of String) Severity levels to route to this action group. Valid values: 'critical', 'warning'. Defaults to ["critical" "warning"].
  • stale_assessment_threshold (Number) Number of hours since last assessment before considering it stale. Defaults to 48.

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations

Required:

  • name (String) Name identifier for the maintenance configuration. Used in resource naming.
  • os_type (String) Operating system type. Valid values: 'Linux', 'Windows'.
  • patch_classifications (List of String) Patch classifications to include. Windows: 'Critical', 'Definition', 'FeaturePack', 'Security', 'ServicePack', 'Tools', 'UpdateRollUp', 'Updates'. Linux: 'Critical', 'Other', 'Security'.
  • recurrence (String) Recurrence pattern. Valid values: 'monthly', 'weekly'.
  • tags_filter (Map of List of String) Map of tag keys to lists of tag values for dynamic scope filtering. VMs matching ALL tag filters (AND logic) are included.

Optional:

  • automation (Attributes) Automation settings for this maintenance configuration. Set to null to disable pre/post event handling for this config. (see below for nested schema)
  • day_of_week (String) Day of the week for weekly recurrence. Required when recurrence is 'weekly'.
  • duration (Number) Maintenance window duration in hours. Minimum 1, maximum 4. Defaults to 3.
  • offset_day_of_month (Number) Day of the month (1-28) for monthly recurrence. Required when recurrence is 'monthly'.
  • reboot_setting (String) Reboot setting after patching. Valid values: 'Always', 'IfRequired', 'Never'. Defaults to IfRequired.
  • start_time (String) Start time in HH:MM format (24-hour). Defaults to 02:00.
  • timezone (String) Timezone for the schedule. Defaults to UTC.

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation

Required:

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.post_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for post-maintenance validation. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.post_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.post_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health validation after patching (heartbeat, agent, extensions). Defaults to true.
  • timeout (Number) Timeout in seconds for post-maintenance heartbeat wait. Defaults to 300.

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.pre_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for pre-maintenance validation. (see below for nested schema)
  • snapshot (Attributes) Snapshot configuration for pre-maintenance VM protection. (see below for nested schema)
  • sql_conflict_handling (Attributes) SQL Server conflict handling configuration. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.pre_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.pre_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health check (agent status, extension status) before patching. Defaults to true.
  • timeout (Number) Timeout in seconds for health check. Defaults to 120.

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.pre_maintenance.snapshot

Optional:

  • enabled (Boolean) Create a VM snapshot before patching. Skipped for Arc-enabled servers. Defaults to true.
  • retention (Number) Number of days to retain the snapshot after successful patching. A value of 0 means delete immediately on successful post-maintenance validation. Defaults to 1.
  • timeout (Number) Timeout in minutes for snapshot creation. Defaults to 10.

Nested Schema for configuration.subscriptions.management.update_manager.maintenance_configurations.automation.pre_maintenance.sql_conflict_handling

Optional:

  • enabled (Boolean) Enable SQL Server active transaction checking before patching. VMs must be tagged with SQLServer:true. Defaults to false.
  • transaction_wait_timeout (Number) Minutes to wait for active SQL transactions to complete. Defaults to 15.

Nested Schema for configuration.subscriptions.management.vnet

Optional:

  • iaas_subnets (Attributes) Configure IaaS subnets. (see below for nested schema)
  • paas_subnets (Attributes) Configure PaaS subnets. (see below for nested schema)
  • vnet_link_to_private_dns_zones (List of String) Provides a list of Azure Private DNS Zones to link to this VNET. The zones must be zones created by the volocloud provider: either PaaS private zones or custom private zones.

Nested Schema for configuration.subscriptions.management.vnet.iaas_subnets

Optional:

Nested Schema for configuration.subscriptions.management.vnet.iaas_subnets.app_tier

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.management.vnet.iaas_subnets.app_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.management.vnet.iaas_subnets.data_tier

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.management.vnet.iaas_subnets.data_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.management.vnet.iaas_subnets.web_tier

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.management.vnet.iaas_subnets.web_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.management.vnet.paas_subnets

Optional:

  • app_tier (Attributes Map) Enables PaaS subnets for app tier services. The map keys CAN be on of: aci, etc. (see below for nested schema)
  • data_tier (Attributes Map) Enables 1 PaaS subnet for data tier services. The map keys CAN be on of: pgsql and sqlmi. (see below for nested schema)
  • web_tier (Attributes Map) Enables 1 PaaS subnet for web tier (internet facing) services. The map keys CAN be on of: agw. (see below for nested schema)

Nested Schema for configuration.subscriptions.management.vnet.paas_subnets.app_tier

Required:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.management.vnet.paas_subnets.app_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.management.vnet.paas_subnets.data_tier

Required:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.management.vnet.paas_subnets.data_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.management.vnet.paas_subnets.web_tier

Required:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.management.vnet.paas_subnets.web_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.security

Required:

  • abbreviation (String) This abbreviation will be used to uniquily identify resources created in this subscription. Only applies to resources that require Azure global uniqueness.
  • defender (Attributes) Configures Microsoft Defender for Cloud service. (see below for nested schema)

Optional:

  • backups (Attributes) Configuration settings for backups in this subscription. Defaults to {"recovery_services_vault":{"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"daily","retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"weekly","retention":{"daily":{"count":33},"monthly":,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"daily","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"monthly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"weekly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"yearly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":}} (see below for nested schema)
  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • keyvault (Attributes) Azure KeyVault configuration details. (see below for nested schema)
  • resource_groups_lock (Attributes) Configures Azure Delete Lock at Resource Groups level. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this subscription scope. (see below for nested schema)
  • sentinel (Attributes) Microsoft Sentinel configuration for the security subscription. (see below for nested schema)
  • update_manager (Attributes) Azure Update Manager configuration for this subscription. Maintenance configurations defined here are additive on top of MG-level defaults. (see below for nested schema)
  • vnet (Attributes) Settings for customizing standard subnets and adding PaaS subnets. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender

Required:

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Microsoft Defender for Cloud. Defaults to true.
  • export (Attributes) Configures continuous export of Defender for Cloud data. Currently supports Log Analytics workspace as a target. (see below for nested schema)
  • services (Attributes) Defender for Cloud services configuration. Each attribute represents a service with optional subplan and extensions. (see below for nested schema)
  • settings (Attributes) Microsoft Defender for Cloud integration settings (WDATP, MCAS, Sentinel). Controls subscription-level toggles for endpoint protection and alert sync. (see below for nested schema)
  • tier (String) The pricing tier for Defender for Cloud services. Defaults to Standard.

Nested Schema for configuration.subscriptions.security.defender.contact

Required:

  • email (String) Email address to receive security alerts from Defender for Cloud.

Optional:

  • alert_notifications (Attributes) Alert notification settings for Defender for Cloud security contact. (see below for nested schema)
  • notifications_by_role (Attributes) Notification settings for subscription roles for Defender for Cloud security contact. (see below for nested schema)
  • phone (String) Phone number to receive security alerts from Defender for Cloud.

Nested Schema for configuration.subscriptions.security.defender.contact.alert_notifications

Optional:

  • minimal_severity (String) The minimal severity level of alerts that will be sent as email notifications. Possible values are High, Medium, and Low. Defaults to High.
  • state (String) Whether to send email notifications for alerts. Possible values are On and Off. Defaults to On.

Nested Schema for configuration.subscriptions.security.defender.contact.notifications_by_role

Optional:

  • roles (List of String) The roles to send email notifications to. Possible values are AccountAdmin, Contributor, Owner, and ServiceAdmin. Defaults to ["Owner"].
  • state (String) Whether to send email notifications to subscription roles. Possible values are On and Off. Defaults to On.

Nested Schema for configuration.subscriptions.security.defender.export

Optional:

  • log_analytics_workspace (Attributes) Configures which Defender for Cloud data types are exported to a Log Analytics workspace via continuous export. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.export.log_analytics_workspace

Optional:

  • regulatory_compliance (Attributes) Regulatory compliance export configuration. Standards filtering is dynamic per-subscription and not configurable here. (see below for nested schema)
  • secure_score (Attributes) Secure score export configuration. Controls whether overall score and/or control scores are exported. (see below for nested schema)
  • security_alerts (Attributes) Security alerts export configuration with severity filtering. (see below for nested schema)
  • security_recommendations (Attributes) Security recommendations export configuration with severity filtering and security findings toggle. (see below for nested schema)
  • snapshots (Boolean) Enable weekly snapshots of all selected data types in addition to streaming updates. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.export.log_analytics_workspace.regulatory_compliance

Optional:

  • enabled (Boolean) Export regulatory compliance assessments. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.export.log_analytics_workspace.secure_score

Optional:

  • control_score (Boolean) Export secure score control scores. Defaults to true.
  • overall_score (Boolean) Export overall secure score. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.export.log_analytics_workspace.security_alerts

Optional:

  • severity (List of String) Alert severity levels to export. Possible values are High, Medium, and Low. Defaults to ["High","Medium","Low"].

Nested Schema for configuration.subscriptions.security.defender.export.log_analytics_workspace.security_recommendations

Optional:

  • include_security_findings (Boolean) Include security findings (sub-assessments) from vulnerability assessment solutions. Defaults to true.
  • severity (List of String) Recommendation severity levels to export. Possible values are High, Medium, and Low. Defaults to ["High","Medium","Low"].

Nested Schema for configuration.subscriptions.security.defender.services

Optional:

  • agentless_scan_exclusion_tags (String) JSON-encoded array of tag key-value pairs to exclude VMs from agentless scanning. Applied to all services with AgentlessVmScanning (CSPM, Containers, Servers). Format: [{"Key":"TagName","Value":"TagValue"}]. Defaults to [{"Key":"AgentlessScanExclude","Value":"true"}].
  • ai (Attributes) Defender for AI configuration. (see below for nested schema)
  • apis (Attributes) Defender for APIs configuration. (see below for nested schema)
  • app_services (Attributes) Defender for App Services configuration. (see below for nested schema)
  • arm (Attributes) Defender for Azure Resource Manager configuration. (see below for nested schema)
  • containers (Attributes) Defender for Containers configuration. (see below for nested schema)
  • cosmosdbs (Attributes) Defender for Cosmos DB configuration. (see below for nested schema)
  • cspm (Attributes) Defender Cloud Security Posture Management configuration. (see below for nested schema)
  • keyvault (Attributes) Defender for Key Vault configuration. (see below for nested schema)
  • oss_db (Attributes) Defender for Open Source Relational Databases configuration. (see below for nested schema)
  • servers (Attributes) Defender for Servers configuration. (see below for nested schema)
  • servers_vulnerability_assessments (Attributes) Defender for Servers Vulnerability Assessments configuration. (see below for nested schema)
  • sql (Attributes) Defender for SQL configuration. (see below for nested schema)
  • sql_on_vm (Attributes) Defender for SQL on Virtual Machines configuration. (see below for nested schema)
  • storage (Attributes) Defender for Storage configuration. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.ai

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for AI. Defaults to true.
  • extensions (Attributes) Extensions for Defender for AI. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.ai.extensions

Optional:

  • ai_model_scanner (Attributes) AI Model Scanner extension (Preview). Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • ai_prompt_evidence (Attributes) AI Prompt Evidence extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • ai_prompt_sharing_with_purview (Attributes) AI Prompt Sharing with Purview extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.ai.extensions.ai_model_scanner

Nested Schema for configuration.subscriptions.security.defender.services.ai.extensions.ai_prompt_evidence

Nested Schema for configuration.subscriptions.security.defender.services.ai.extensions.ai_prompt_sharing_with_purview

Nested Schema for configuration.subscriptions.security.defender.services.apis

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for APIs. Defaults to true.
  • subplan (String) Pricing subplan for the service. Defaults to P1.

Nested Schema for configuration.subscriptions.security.defender.services.app_services

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for App Services. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.arm

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Azure Resource Manager. Defaults to true.
  • subplan (String) Pricing subplan for the service. Defaults to PerSubscription.

Nested Schema for configuration.subscriptions.security.defender.services.containers

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Containers. Defaults to true.
  • extensions (Attributes) Extensions for Defender for Containers. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.containers.extensions

Optional:

  • agentless_discovery_for_kubernetes (Attributes) Agentless Discovery for Kubernetes extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • agentless_vm_scanning (Attributes) Agentless VM Scanning extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • container_integrity_contribution (Attributes) Container Integrity Contribution extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • container_registries_vulnerability_assessments (Attributes) Container Registries Vulnerability Assessments extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • container_sensor (Attributes) Container Sensor extension. Presence enables the extension, set to null to disable. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.containers.extensions.agentless_discovery_for_kubernetes

Nested Schema for configuration.subscriptions.security.defender.services.containers.extensions.agentless_vm_scanning

Nested Schema for configuration.subscriptions.security.defender.services.containers.extensions.container_integrity_contribution

Nested Schema for configuration.subscriptions.security.defender.services.containers.extensions.container_registries_vulnerability_assessments

Nested Schema for configuration.subscriptions.security.defender.services.containers.extensions.container_sensor

Optional:

  • security_gating (Boolean) Whether Kubernetes gated deployment is enabled. When enabled, container images that violate security policies are blocked at deployment time. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.cosmosdbs

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Cosmos DB. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.cspm

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender Cloud Security Posture Management. Defaults to true.
  • extensions (Attributes) Extensions for Defender CSPM. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions

Optional:

  • agentless_discovery_for_kubernetes (Attributes) Agentless Discovery for Kubernetes extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • agentless_serverless_posture (Attributes) Agentless Serverless Posture extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • agentless_vm_scanning (Attributes) Agentless VM Scanning extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • api_posture (Attributes) API Security Posture Management extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • container_registries_vulnerability_assessments (Attributes) Container Registries Vulnerability Assessments extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • entra_permissions_management (Attributes) Entra Permissions Management extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • sensitive_data_discovery (Attributes) Sensitive Data Discovery extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions.agentless_discovery_for_kubernetes

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions.agentless_serverless_posture

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions.agentless_vm_scanning

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions.api_posture

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions.container_registries_vulnerability_assessments

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions.entra_permissions_management

Nested Schema for configuration.subscriptions.security.defender.services.cspm.extensions.sensitive_data_discovery

Nested Schema for configuration.subscriptions.security.defender.services.keyvault

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Key Vault. Defaults to true.
  • subplan (String) Pricing subplan for the service. Defaults to PerKeyVault.

Nested Schema for configuration.subscriptions.security.defender.services.oss_db

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Open Source Relational Databases. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.servers

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Servers. Defaults to true.
  • extensions (Attributes) Extensions for Defender for Servers. (see below for nested schema)
  • subplan (String) Pricing subplan for the service. Defaults to P2.

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions

Optional:

  • agentless_vm_scanning (Attributes) Agentless VM Scanning extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)
  • file_integrity_monitoring (Attributes) File Integrity Monitoring extension. Presence enables the extension, set to null to disable. (see below for nested schema)
  • mde_designated_subscription (Attributes) MDE Designated Subscription extension. Requires manual prerequisites outside of the API before enabling. Presence (as empty {}) enables the extension, set to null to disable. Defaults to disabled. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.agentless_vm_scanning

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.file_integrity_monitoring

Optional:

  • detection_type (String) FIM detection type. Possible values are AuditD, Both, and MDE. Defaults to Both.
  • rules (Attributes) File Integrity Monitoring rules configuration. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.file_integrity_monitoring.rules

Optional:

  • custom (Attributes List) Custom FIM rules to add alongside the default recommended rule. Each rule defines file paths, registry paths, and change types to monitor. (see below for nested schema)
  • default (Boolean) Include Microsoft's recommended FIM rule for critical OS files, registries, and system paths. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.file_integrity_monitoring.rules.custom

Required:

  • change_type (String) Change types to monitor. Combination of: C=Create, M=Modify, D=Delete, R=Rename. E.g. CMDR for all types.
  • monitored_entities (Attributes) Entities to monitor for this rule, grouped by type. (see below for nested schema)
  • rule_name (String) Display name of the monitoring rule.

Optional:

  • rule_description (String) Description of the monitoring rule.

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.file_integrity_monitoring.rules.custom.monitored_entities

Optional:

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.file_integrity_monitoring.rules.custom.monitored_entities.linux_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.file_integrity_monitoring.rules.custom.monitored_entities.registries

Required:

  • path (String) The registry path to monitor.

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.file_integrity_monitoring.rules.custom.monitored_entities.windows_files

Required:

  • path (String) The file or directory path to monitor.

Nested Schema for configuration.subscriptions.security.defender.services.servers.extensions.mde_designated_subscription

Nested Schema for configuration.subscriptions.security.defender.services.servers_vulnerability_assessments

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Servers Vulnerability Assessments. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.sql

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for SQL. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.sql_on_vm

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for SQL on Virtual Machines. Defaults to true.

Nested Schema for configuration.subscriptions.security.defender.services.storage

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Defender for Storage. Defaults to true.
  • extensions (Attributes) Extensions for Defender for Storage. (see below for nested schema)
  • subplan (String) Pricing subplan for the service. Defaults to DefenderForStorageV2.

Nested Schema for configuration.subscriptions.security.defender.services.storage.extensions

Optional:

  • on_upload_malware_scanning (Attributes) On Upload Malware Scanning extension. Presence enables the extension, set to null to disable. (see below for nested schema)
  • sensitive_data_discovery (Attributes) Sensitive Data Discovery extension. Presence (as empty {}) enables the extension, set to null to disable. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.defender.services.storage.extensions.on_upload_malware_scanning

Optional:

  • automated_response (String) Automated response action for malware detection. Defaults to None.
  • blob_scan_results_options (String) Where to store scan results. Defaults to BlobIndexTags.
  • cap_gb_per_month_per_storage_account (String) Monthly scan cap in GB per storage account. Use "-1" for unlimited. Defaults to 10000.

Nested Schema for configuration.subscriptions.security.defender.services.storage.extensions.sensitive_data_discovery

Nested Schema for configuration.subscriptions.security.defender.settings

Optional:

  • mcas (Boolean) Enable Microsoft Cloud App Security (MCAS) integration. Defaults to true.
  • sentinel (Boolean) Enable bi-directional alert sync with Microsoft Sentinel. Defaults to true.
  • wdatp (Boolean) Enable Microsoft Defender for Endpoint (MDE) integration. Defaults to true.
  • wdatp_exclude_linux_public_preview (Boolean) Exclude Linux servers from MDE auto-provisioning. Defaults to false.

Nested Schema for configuration.subscriptions.security.backups

Optional:

  • recovery_services_vault (Attributes) Configuration settings for Recovery Services Vault in this subscription. Defaults to {"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":<null>,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":<null>}. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault

Optional:

  • backup_policies (Attributes) Backup policies to be created in this Recovery Services Vault. Defaults to {"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]}. (see below for nested schema)
  • encryption (Attributes) Encryption configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • immutability (String) Immutability settings of vault. Possible values are Locked, Unlocked or Disabled.

Warning

Once immutability is set to Locked, changing it to other values forces a new Recovery Services Vault to be created.

  • monitoring (Attributes) Monitoring configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • sku (String) Sets the vault's SKU. Possible values are Standard or RS0. Defaults to Standard
  • soft_delete (Boolean) Is soft delete enable for this Vault? Defaults to true.
  • storage_mode_type (String) The storage type of the Recovery Services Vault. Possible values are GeoRedundant, LocallyRedundant or ZoneRedundant. Defaults to GeoRedundant.

Note

If storage_mode_type is GeoRedundant and there are multiple regions defined in this subscription, cross region restore will be enabled by default, otherwise it will be disabled. Once cross region restore is enabled, changing it back to false forces a new Recovery Service Vault to be created.


- tags (Map of String) Key-value map of resource tags.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies

Optional:

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily or hourly MUST be specified. (see below for nested schema)
  • timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.retention

Optional:

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 33.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 120. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 10. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.frequency

Optional:

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.file_share.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily, hourly or weekly MUST be specified. (see below for nested schema)
  • policy_type (Attributes) Type of the Backup Policy. Possible values are v1 or v2. Defaults to {"v1":<null>,"v2":{"instant_restore_retention_days":7}}.

Warning

Changing this forces a new resource to be created.


(see below for nested schema) - tiering_policy (Attributes) Tiering policy configuration. (see below for nested schema) - timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.retention

Optional:

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 7 and 9999. Defaults to 33.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.frequency

Optional:

  • daily (Attributes) Sets the backup frequency to daily. Conflicts with hourly and weekly. (see below for nested schema)
  • hourly (Attributes) Sets the backup frequency to hourly. Conflicts with daily and weekly. (see below for nested schema)
  • weekly (Attributes) Sets the backup frequency to daily. Conflicts with daily and hourly. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.frequency.weekly

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.policy_type

Optional:

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.policy_type.v1

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 5. Defaults to 5.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.policy_type.v2

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 30. Defaults to 7.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.tiering_policy

Required:

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.backup_policies.vm.tiering_policy.archived_restore_point

Required:

  • mode (String) The tiering mode to control automatic tiering of recovery points. Possible values are TierAfter or TierRecommended.

Optional:

  • duration (Number) The number of days/weeks/months/years to retain backups in current tier before tiering.
  • duration_type (String) The retention duration type. Possible values are Days, Weeks, Months or Years.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.encryption

Optional:

  • enabled (Boolean) Enabling/Disabling encryption state using the Key Vault key id created part of volocloud resource. Defaults to true .!!! warning Once Encryption with your own key has been Enabled it's not possible to Disable it.
  • infrastructure_encryption (Boolean) Enabling/Disabling the Double Encryption state. Defaults to false .!!! warning Once infrastructure_encryption has been set it's not possible to change it.

Nested Schema for configuration.subscriptions.security.backups.recovery_services_vault.monitoring

Optional:

  • alerts_for_all_job_failures (Boolean) Enabling/Disabling built-in Azure Monitor alerts for security scenarios and job failure scenarios. Defaults to true.

Nested Schema for configuration.subscriptions.security.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.security.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.security.keyvault

Optional:

  • purge_protection_enabled (Boolean) Is Purge Protection enabled for this Key Vault? Defaults to true.
  • sku (String) The Name of the SKU used for this Key Vault. Possible values are standard and premium. Defaults to standard.
  • soft_delete_retention_days (Number) The number of days that items should be retained for once soft-deleted. This field can only be configured one time and cannot be updated. This value can be between 7 and 90 days. Defaults to 90.

Nested Schema for configuration.subscriptions.security.resource_groups_lock

Optional:

  • baseline (Boolean) Boolean flag to enable/disable the baseline resource group lock. Defaults to true.
  • rsv (Boolean) Boolean flag to enable/disable the recovery services vault resource group lock. Defaults to false.

Nested Schema for configuration.subscriptions.security.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_definition_name (String) The name of the role definition to assign. For built-in roles use the Azure display name (e.g. Contributor, Reader). For custom roles, use the exact name as defined in the management_groups.role_definitions schema.

Warning

Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.subscriptions.security.sentinel

Optional:

  • enabled (Boolean) Boolean flag to enable/disable Microsoft Sentinel. Defaults to false.
  • log_analytics_workspace (Attributes) Sentinel Log Analytics Workspace configuration. (see below for nested schema)
  • managed_by_lighthouse (Attributes) Azure Lighthouse configuration for delegated access to the Sentinel resource group. When set, onboards the Sentinel RG to the specified managing tenant with the defined authorizations. (see below for nested schema)
  • settings (Attributes) Microsoft Sentinel settings for anomalies, UEBA, EyesOn, and auditing/health monitoring. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.sentinel.log_analytics_workspace

Optional:

  • daily_quota_gb (Number) The workspace daily quota for ingestion in GB. Defaults to -1 (unlimited).
  • internet_ingestion_enabled (Boolean) Should the Log Analytics Workspace support ingestion over the Public Internet? Defaults to true.
  • internet_query_enabled (Boolean) Should the Log Analytics Workspace support querying over the Public Internet? Defaults to true.
  • reservation_capacity_in_gb_per_day (Number) The capacity reservation level in GB for this workspace. Must be in increments of 100 between 100 and 5000.
  • retention_in_days (Number) The workspace data retention in days. Possible values range between 30 and 730. Defaults to 90.
  • sku (String) Specifies the SKU of the Log Analytics Workspace. Possible values are Free, PerNode, Premium, Standard, Standalone, Unlimited, CapacityReservation, and PerGB2018. Defaults to PerGB2018.

Nested Schema for configuration.subscriptions.security.sentinel.managed_by_lighthouse

Required:

  • authorizations (Attributes List) Standing access authorizations. These principals will have permanent access with the specified role. (see below for nested schema)
  • offer_description (String) Description of the Lighthouse managed service offer.
  • offer_name (String) Name of the Lighthouse managed service offer.
  • tenant_id (String) Tenant ID of the managing (Lighthouse) service provider.

Optional:

  • eligible_authorizations (Attributes List) Just-in-time (JIT) access authorizations. These principals must activate the role via PIM before use. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.sentinel.managed_by_lighthouse.authorizations

Required:

  • principal_display_name (String) Display name of the security group/service principal in the managing tenant.
  • principal_id (String) Principal ID of the security group/service principal in the managing tenant.
  • role_name (String) Azure built-in role name to assign (e.g. Microsoft Sentinel Reader). The role definition ID is looked up automatically.

Nested Schema for configuration.subscriptions.security.sentinel.managed_by_lighthouse.eligible_authorizations

Required:

  • principal_display_name (String) Display name of the security group/service principal in the managing tenant.
  • principal_id (String) Principal ID of the security group/service principal in the managing tenant.
  • role_name (String) Azure built-in role name to assign (e.g. Microsoft Sentinel Contributor). The role definition ID is looked up automatically.

Optional:

  • max_activation_duration (String) Maximum activation duration in ISO 8601 format. Defaults to PT8H.

Nested Schema for configuration.subscriptions.security.sentinel.settings

Optional:

  • anomalies (Attributes) Microsoft Sentinel Anomalies detection configuration. (see below for nested schema)
  • eyes_on (Attributes) SOC audit and health monitoring (EyesOn) configuration. (see below for nested schema)
  • logs (Attributes) Sentinel auditing and health monitoring configuration. (see below for nested schema)
  • ueba (Attributes) User and Entity Behavior Analytics (UEBA) configuration. UEBA transforms raw data into meaningful insights to identify advanced threats. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.sentinel.settings.anomalies

Optional:

  • enabled (Boolean) Enable Microsoft Sentinel Anomalies detection. Defaults to true.

Nested Schema for configuration.subscriptions.security.sentinel.settings.eyes_on

Optional:

  • enabled (Boolean) Enable SOC audit and health monitoring (EyesOn). Defaults to true.

Nested Schema for configuration.subscriptions.security.sentinel.settings.logs

Optional:

  • enabled (Boolean) Enable Sentinel auditing and health monitoring diagnostic logs. Sends all Sentinel log categories back to the same workspace. Defaults to true.

Nested Schema for configuration.subscriptions.security.sentinel.settings.ueba

Optional:

  • data_sources (List of String) List of data sources for UEBA enrichment. Values must match the supported data sources in UEBA data sources, otherwise the Azure API will reject the request. Defaults to ["AuditLogs","AzureActivity","SecurityEvent","SigninLogs"].
  • enabled (Boolean) Enable User and Entity Behavior Analytics (UEBA). Requires the Terraform service principal to have Security Administrator Entra ID directory role. Defaults to true.
  • entity_providers (List of String) List of entity providers for UEBA. Valid values are AzureActiveDirectory and ActiveDirectory (Preview, requires Defender for Identity). Defaults to ["AzureActiveDirectory"].

Nested Schema for configuration.subscriptions.security.update_manager

Optional:

  • alert_action_groups (Attributes List) Alert action groups with filters and notification channels. Each entry creates an action group and alert processing rule. (see below for nested schema)
  • exclusion_tag (String) Tag key used to exclude VMs from dynamic scopes in this subscription. Defaults to PatchExclude.
  • maintenance_configurations (Attributes List) List of maintenance configurations to create. Each defines a schedule, patch classifications, and tag-based dynamic scoping. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.update_manager.alert_action_groups

Required:

  • channels (Attributes List) Notification channels for this action group. (see below for nested schema)
  • name (String) Name identifier for the action group. Used in resource naming.

Optional:

  • filter (Attributes) Filter conditions determining which alerts route to this action group. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.update_manager.alert_action_groups.channels

Required:

  • type (String) Channel type. Valid values: 'email', 'webhook'.

Optional:

  • address (String) Email address (required when type is 'email').
  • name (String) Display name for the channel (required for webhook type).
  • uri (String, Sensitive) Webhook URI (required when type is 'webhook').

Nested Schema for configuration.subscriptions.security.update_manager.alert_action_groups.filter

Optional:

  • critical_patch_threshold (Number) Number of days critical patches can be missing before alerting. Defaults to 7.
  • severity (List of String) Severity levels to route to this action group. Valid values: 'critical', 'warning'. Defaults to ["critical" "warning"].
  • stale_assessment_threshold (Number) Number of hours since last assessment before considering it stale. Defaults to 48.

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations

Required:

  • name (String) Name identifier for the maintenance configuration. Used in resource naming.
  • os_type (String) Operating system type. Valid values: 'Linux', 'Windows'.
  • patch_classifications (List of String) Patch classifications to include. Windows: 'Critical', 'Definition', 'FeaturePack', 'Security', 'ServicePack', 'Tools', 'UpdateRollUp', 'Updates'. Linux: 'Critical', 'Other', 'Security'.
  • recurrence (String) Recurrence pattern. Valid values: 'monthly', 'weekly'.
  • tags_filter (Map of List of String) Map of tag keys to lists of tag values for dynamic scope filtering. VMs matching ALL tag filters (AND logic) are included.

Optional:

  • automation (Attributes) Automation settings for this maintenance configuration. Set to null to disable pre/post event handling for this config. (see below for nested schema)
  • day_of_week (String) Day of the week for weekly recurrence. Required when recurrence is 'weekly'.
  • duration (Number) Maintenance window duration in hours. Minimum 1, maximum 4. Defaults to 3.
  • offset_day_of_month (Number) Day of the month (1-28) for monthly recurrence. Required when recurrence is 'monthly'.
  • reboot_setting (String) Reboot setting after patching. Valid values: 'Always', 'IfRequired', 'Never'. Defaults to IfRequired.
  • start_time (String) Start time in HH:MM format (24-hour). Defaults to 02:00.
  • timezone (String) Timezone for the schedule. Defaults to UTC.

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation

Required:

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.post_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for post-maintenance validation. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.post_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.post_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health validation after patching (heartbeat, agent, extensions). Defaults to true.
  • timeout (Number) Timeout in seconds for post-maintenance heartbeat wait. Defaults to 300.

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.pre_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for pre-maintenance validation. (see below for nested schema)
  • snapshot (Attributes) Snapshot configuration for pre-maintenance VM protection. (see below for nested schema)
  • sql_conflict_handling (Attributes) SQL Server conflict handling configuration. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.pre_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.pre_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health check (agent status, extension status) before patching. Defaults to true.
  • timeout (Number) Timeout in seconds for health check. Defaults to 120.

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.pre_maintenance.snapshot

Optional:

  • enabled (Boolean) Create a VM snapshot before patching. Skipped for Arc-enabled servers. Defaults to true.
  • retention (Number) Number of days to retain the snapshot after successful patching. A value of 0 means delete immediately on successful post-maintenance validation. Defaults to 1.
  • timeout (Number) Timeout in minutes for snapshot creation. Defaults to 10.

Nested Schema for configuration.subscriptions.security.update_manager.maintenance_configurations.automation.pre_maintenance.sql_conflict_handling

Optional:

  • enabled (Boolean) Enable SQL Server active transaction checking before patching. VMs must be tagged with SQLServer:true. Defaults to false.
  • transaction_wait_timeout (Number) Minutes to wait for active SQL transactions to complete. Defaults to 15.

Nested Schema for configuration.subscriptions.security.vnet

Optional:

  • iaas_subnets (Attributes) Configure IaaS subnets. (see below for nested schema)
  • paas_subnets (Attributes) Configure PaaS subnets. (see below for nested schema)
  • vnet_link_to_private_dns_zones (List of String) Provides a list of Azure Private DNS Zones to link to this VNET. The zones must be zones created by the volocloud provider: either PaaS private zones or custom private zones.

Nested Schema for configuration.subscriptions.security.vnet.iaas_subnets

Optional:

Nested Schema for configuration.subscriptions.security.vnet.iaas_subnets.app_tier

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.security.vnet.iaas_subnets.app_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.security.vnet.iaas_subnets.data_tier

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.security.vnet.iaas_subnets.data_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.security.vnet.iaas_subnets.web_tier

Required:

  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.security.vnet.iaas_subnets.web_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.security.vnet.paas_subnets

Optional:

  • app_tier (Attributes Map) Enables PaaS subnets for app tier services. The map keys CAN be on of: aci, etc. (see below for nested schema)
  • data_tier (Attributes Map) Enables 1 PaaS subnet for data tier services. The map keys CAN be on of: pgsql and sqlmi. (see below for nested schema)
  • web_tier (Attributes Map) Enables 1 PaaS subnet for web tier (internet facing) services. The map keys CAN be on of: agw. (see below for nested schema)

Nested Schema for configuration.subscriptions.security.vnet.paas_subnets.app_tier

Required:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.security.vnet.paas_subnets.app_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.security.vnet.paas_subnets.data_tier

Required:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.security.vnet.paas_subnets.data_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.security.vnet.paas_subnets.web_tier

Required:

  • delegation (Attributes) Provides details to deleted the subnet to a supported Azure service. (see below for nested schema)
  • ip_address_netnum (Number) Netnum is a whole number that represent the order of the resulting subnet after increasing the bits with newbits. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26. There are 4 x /26 possible resulting subnets and netnum can choose which one by provinding 0, 1, 2 or 3.
  • ip_address_newbits (Number) Newbits is the number of additional bits with which to extend the Region's ip_address_mask. For example, if given a /24 and a newbits value of 2, the resulting subnet address will have length /26.

Optional:

  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.subscriptions.security.vnet.paas_subnets.web_tier.delegation

Required:

  • name (String) A name for this delegation.
  • service (String) The name of service to delegate to.

Optional:

  • actions (List of String) A list of Actions which should be delegated. This list is specific to the service to delegate to.

Nested Schema for configuration.subscriptions.data

Required:

  • abbreviation (String) This abbreviation will be used to uniquely identify resources created in this subscription. Only applies to resources that require Azure global uniqueness.

Optional:

  • backups (Attributes) Configuration settings for backups in this subscription. Defaults to {"recovery_services_vault":{"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"daily","retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"weekly","retention":{"daily":{"count":33},"monthly":,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"daily","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":,"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"monthly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"weekly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":},"tiering_policy":,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":,"weekly":},"name":"yearly","policy_type":{"v1":,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":,"include_last_days":,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":,"include_last_days":,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":}} (see below for nested schema)
  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • fabric (Attributes) Fabric governance configuration. Manages tenant-wide settings and domains from this centralised subscription.

Warning

Prerequisite: A user with Global Admin must sign up for Microsoft Fabric (Free) at https://app.fabric.microsoft.com to register the tenant with Microsoft's Fabric backend. This is a one-time manual step per tenant. Without it, the Fabric API (https://api.fabric.microsoft.com) is unavailable and tenant settings will fail to apply.
(see below for nested schema)

  • keyvault (Attributes) Azure KeyVault configuration details. (see below for nested schema)
  • purview (Attributes) Microsoft Purview configuration. Optional data governance enhancement deployed to the tenancy home region. (see below for nested schema)
  • resource_groups_lock (Attributes) Configures Azure Delete Lock at Resource Groups level. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this subscription scope. (see below for nested schema)
  • update_manager (Attributes) Azure Update Manager configuration for this subscription. Maintenance configurations defined here are additive on top of MG-level defaults. (see below for nested schema)
  • vnet (Attributes) Settings for customizing subnets and adding PaaS subnets in the data subscription VNET. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.backups

Optional:

  • recovery_services_vault (Attributes) Configuration settings for Recovery Services Vault in this subscription. Defaults to {"backup_policies":{"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]},"encryption":{"enabled":true,"infrastructure_encryption":false},"immutability":<null>,"monitoring":{"alerts_for_all_job_failures":true},"sku":"Standard","soft_delete":true,"storage_mode_type":"GeoRedundant","tags":<null>}. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault

Optional:

  • backup_policies (Attributes) Backup policies to be created in this Recovery Services Vault. Defaults to {"file_share":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"daily","retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"monthly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"weekly","retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":<null>},"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>},"name":"yearly","retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":13,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"timezone":"UTC"}],"vm":[{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"daily","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":<null>,"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"monthly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"weekly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":<null>,"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":<null>},"tiering_policy":<null>,"timezone":"UTC"},{"frequency":{"daily":{"time":"23:00"},"hourly":<null>,"weekly":<null>},"name":"yearly","policy_type":{"v1":<null>,"v2":{"instant_restore_retention_days":7}},"retention":{"daily":{"count":33},"monthly":{"count":13,"days":<null>,"include_last_days":<null>,"weekdays":["Sunday"],"weeks":["Last"]},"weekly":{"count":5,"weekdays":["Saturday"]},"yearly":{"count":7,"days":<null>,"include_last_days":<null>,"months":["January"],"weekdays":["Monday"],"weeks":["First"]}},"tiering_policy":<null>,"timezone":"UTC"}]}. (see below for nested schema)
  • encryption (Attributes) Encryption configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • immutability (String) Immutability settings of vault. Possible values are Locked, Unlocked or Disabled.

Warning

Once immutability is set to Locked, changing it to other values forces a new Recovery Services Vault to be created.

  • monitoring (Attributes) Monitoring configuration for the Recovery Services Vault. Defaults to `` (see below for nested schema)
  • sku (String) Sets the vault's SKU. Possible values are Standard or RS0. Defaults to Standard
  • soft_delete (Boolean) Is soft delete enable for this Vault? Defaults to true.
  • storage_mode_type (String) The storage type of the Recovery Services Vault. Possible values are GeoRedundant, LocallyRedundant or ZoneRedundant. Defaults to GeoRedundant.

Note

If storage_mode_type is GeoRedundant and there are multiple regions defined in this subscription, cross region restore will be enabled by default, otherwise it will be disabled. Once cross region restore is enabled, changing it back to false forces a new Recovery Service Vault to be created.


- tags (Map of String) Key-value map of resource tags.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies

Optional:

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily or hourly MUST be specified. (see below for nested schema)
  • timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.retention

Optional:

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 33.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 120. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 200. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 10. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.frequency

Optional:

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.file_share.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm

Required:

  • name (String) Backup policy name MUST be lowercase alphanumeric and dash, between 1 and 80 characters.
  • retention (Attributes) Configures the policy retention. (see below for nested schema)

Optional:

  • frequency (Attributes) Sets the backup frequency. Exactly one of daily, hourly or weekly MUST be specified. (see below for nested schema)
  • policy_type (Attributes) Type of the Backup Policy. Possible values are v1 or v2. Defaults to {"v1":<null>,"v2":{"instant_restore_retention_days":7}}.

Warning

Changing this forces a new resource to be created.


(see below for nested schema) - tiering_policy (Attributes) Tiering policy configuration. (see below for nested schema) - timezone (String) Specifies the Time Zone which should be used by the host pool and its associated resources for time based events, the possible values are defined here. Defaults to UTC.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.retention

Optional:

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.retention.daily

Optional:

  • count (Number) The number of backups to keep. Must be between 7 and 9999. Defaults to 33.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.retention.monthly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 13.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.retention.weekly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 5.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.retention.yearly

Optional:

  • count (Number) The number of backups to keep. Must be between 1 and 9999. Defaults to 7.
  • days (Number) The days of the month to retain backups of. Must be between 1 and 31. If specified, include_last_days MUST be specified as well and conflicts with weekdays and weeks.
  • include_last_days (Boolean) Including the last day of the month. If specified, days MUST be specified as well and conflicts with weekdays and weeks.
  • months (List of String) The months of the year to retain backups of. Possible values are January, February, March, April, May, June, July, August, September, October, November and December. Defaults to ["January"].
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday. If specified, weeks MUST be specified as well and conflicts with days and include_last_days.
  • weeks (List of String) The weeks of the month to retain backups of. Possible values are First, Second, Third, Fourth or Last. If specified, weekdays MUST be specified as well and conflicts with days and include_last_days.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.frequency

Optional:

  • daily (Attributes) Sets the backup frequency to daily. Conflicts with hourly and weekly. (see below for nested schema)
  • hourly (Attributes) Sets the backup frequency to hourly. Conflicts with daily and weekly. (see below for nested schema)
  • weekly (Attributes) Sets the backup frequency to daily. Conflicts with daily and hourly. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.frequency.daily

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.frequency.hourly

Required:

  • duration (Number) Species the duration of the backup window in hours. MUST be a number between 4 and 24. Details could be found here.

Note

duration must be multiplier of interval

  • interval (Number) Specifies the interval at which backup needs to be triggered. Possible values are 4, 6, 8 and 12.
  • time (String) Specifies the start time of the hourly backup. The time format should be in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.).

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.frequency.weekly

Required:

  • time (String) The time of day to perform the backup in 24-hour format. Times must be either on the hour or half hour (e.g. 12:00, 12:30, 13:00, etc.
  • weekdays (List of String) The weekday backups to retain. Possible values are Sunday, Monday, Tuesday, Wednesday, Thursday, Friday or Saturday.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.policy_type

Optional:

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.policy_type.v1

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 5. Defaults to 5.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.policy_type.v2

Optional:

  • instant_restore_retention_days (Number) Specifies the instant restore retention range in days. Possible values are between 1 and 30. Defaults to 7.!!! note instant_restore_retention_days MUST be set to 5 if the backup frequency is set to weekly.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.tiering_policy

Required:

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.backup_policies.vm.tiering_policy.archived_restore_point

Required:

  • mode (String) The tiering mode to control automatic tiering of recovery points. Possible values are TierAfter or TierRecommended.

Optional:

  • duration (Number) The number of days/weeks/months/years to retain backups in current tier before tiering.
  • duration_type (String) The retention duration type. Possible values are Days, Weeks, Months or Years.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.encryption

Optional:

  • enabled (Boolean) Enabling/Disabling encryption state using the Key Vault key id created part of volocloud resource. Defaults to true .!!! warning Once Encryption with your own key has been Enabled it's not possible to Disable it.
  • infrastructure_encryption (Boolean) Enabling/Disabling the Double Encryption state. Defaults to false .!!! warning Once infrastructure_encryption has been set it's not possible to change it.

Nested Schema for configuration.subscriptions.data.backups.recovery_services_vault.monitoring

Optional:

  • alerts_for_all_job_failures (Boolean) Enabling/Disabling built-in Azure Monitor alerts for security scenarios and job failure scenarios. Defaults to true.

Nested Schema for configuration.subscriptions.data.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.data.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.subscriptions.data.fabric

Required:

  • admin_groups (Attributes) Admin security groups for Fabric governance. These groups must be created manually as prerequisites because they require assignable_to_role = true which needs Privileged Role Administrator permissions. (see below for nested schema)

Optional:

  • architecture_pattern (Attributes) Architecture patterns to deploy. Each pattern is a list of workspaces. All patterns can coexist in the same capacity. (see below for nested schema)
  • capacity (Attributes) Fabric capacity configuration. One capacity per deployment. (see below for nested schema)
  • domains (Attributes List) Fabric domains for organising workspaces by business area. Domains are created centrally here and referenced by name in tenancy account fabric configurations. (see below for nested schema)
  • git_provider (Attributes) Git provider configuration for Fabric workspace content synchronisation. Exactly one of github or azuredevops must be specified. Shared across all workspaces with git enabled. (see below for nested schema)
  • tags (Map of String) Tags applied to the Azure Fabric capacity resource.
  • tenant_settings (Attributes List) Fabric tenant-wide admin settings managed from this subscription. Each item represents a tenant setting to configure. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.admin_groups

Required:

  • api_admin (String) Display name of the Entra ID security group used for Fabric API administration. This group must be created manually as a prerequisite (assignable to M365 roles).

Optional:

  • fabric_admin (String) Display name of the Entra ID security group for human Fabric administrators. This group must be created manually as a prerequisite (assignable to M365 roles). Members get Owner role on all Fabric connections.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern

Optional:

  • bi_serving (Attributes List) BI serving architecture pattern. Each item defines a workspace for Power BI reports and semantic models. (see below for nested schema)
  • lakehouse (Attributes List) Lakehouse architecture pattern. Each item defines a workspace with medallion-layer lakehouse topology. (see below for nested schema)
  • real_time_intelligence (Attributes List) Real-time intelligence architecture pattern. Each item defines a workspace with eventhouses and KQL databases. (see below for nested schema)
  • warehouse (Attributes List) Warehouse architecture pattern. Each item defines a workspace with a Fabric SQL warehouse. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving

Required:

  • name (String) Name of the workspace. Used as identifier in resource naming. Must be lowercase alphanumeric with hyphens only.

Optional:

  • connections (Attributes List) Data source connections for this workspace. (see below for nested schema)
  • domain (String) Fabric domain name to assign this workspace to. The domain must be defined at the data subscription level.
  • git_provider (Attributes) Git provider integration for this workspace. The root-level git_provider must be configured first. (see below for nested schema)
  • outbound_rules (Attributes List) Outbound network rules for the workspace. When provided, workspace network policy is set to Deny by default. (see below for nested schema)
  • private_link (Boolean) Enable workspace-level private link. Creates a private endpoint for this workspace and blocks public inbound access. Defaults to false.
  • tags (Map of String) Tags for this workspace.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.connections

Required:

  • name (String) Name of the connection. Must be lowercase alphanumeric with hyphens only.
  • type (Attributes) Connection type. Exactly one type must be specified. (see below for nested schema)

Optional:

  • connectivity (String) Connectivity type. Use public for ShareableCloud or private for VirtualNetworkGateway. Defaults to public.
  • encryption (String) Connection encryption. Defaults to Encrypted.
  • skip_test_connection (Boolean) Whether to skip the connection test during creation. Defaults to false.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.connections.type

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.connections.type.jdbc

Required:

  • credentials (Attributes) Credentials for the connection. Exactly one credential type must be specified. (see below for nested schema)
  • database (String) Database name to connect to.
  • server (String) Server hostname or IP address.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.connections.type.jdbc.credentials

Optional:

  • basic (Attributes) Basic authentication (username + password from Key Vault). (see below for nested schema)
  • key_pair (Attributes) Key pair authentication (private key from Key Vault). (see below for nested schema)
  • service_principal (Attributes) Service principal authentication (client secret from Key Vault). (see below for nested schema)
  • workspace_identity (Boolean) Use Fabric workspace identity for authentication. No credentials required.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.connections.type.jdbc.credentials.basic

Required:

  • kv_secret_name (String) Key Vault secret name holding the password.
  • username (String) Username for authentication.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.connections.type.jdbc.credentials.key_pair

Required:

  • identifier (String) Identifier (username) for the key pair.
  • kv_secret_name (String) Key Vault secret name holding the private key.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.connections.type.jdbc.credentials.service_principal

Required:

  • kv_secret_name (String) Key Vault secret name holding the client secret.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.git_provider

Optional:

  • azuredevops (Attributes) Azure DevOps git integration for this workspace. Mutually exclusive with github. (see below for nested schema)
  • github (Attributes) GitHub git integration for this workspace. Mutually exclusive with azuredevops. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.git_provider.azuredevops

Required:

  • enabled (Boolean) Enable git integration for this workspace using Azure DevOps.
  • project (String) Azure DevOps project name within the organisation.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.git_provider.github

Required:

  • enabled (Boolean) Enable git integration for this workspace using GitHub.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.outbound_rules

Required:

  • connection_type (String) Connection type this rule applies to.
  • default_action (String) Default action for this rule (Allow or Deny).

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.outbound_rules.allowed_endpoints

Required:

  • hostname_pattern (String) Hostname pattern to allow (e.g. *.database.windows.net).

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.bi_serving.outbound_rules.allowed_workspaces

Required:

  • workspace_id (String) Fabric workspace ID to allow outbound connections to.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse

Required:

  • name (String) Name of the workspace. Used as identifier in resource naming. Must be lowercase alphanumeric with hyphens only.

Optional:

  • connections (Attributes List) Data source connections for this workspace. (see below for nested schema)
  • domain (String) Fabric domain name to assign this workspace to. The domain must be defined at the data subscription level.
  • enable_schemas (Boolean) Enable lakehouse schemas (preview feature). Defaults to false.
  • git_provider (Attributes) Git provider integration for this workspace. The root-level git_provider must be configured first. (see below for nested schema)
  • lakehouse_per_layer (Boolean) Create a separate lakehouse per medallion layer. Defaults to true.
  • layers (List of String) Medallion architecture layers to create (e.g. bronze, silver, gold).
  • outbound_rules (Attributes List) Outbound network rules for the workspace. When provided, workspace network policy is set to Deny by default. (see below for nested schema)
  • private_link (Boolean) Enable workspace-level private link. Creates a private endpoint for this workspace and blocks public inbound access. Defaults to false.
  • tags (Map of String) Tags for this workspace.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.connections

Required:

  • name (String) Name of the connection. Must be lowercase alphanumeric with hyphens only.
  • type (Attributes) Connection type. Exactly one type must be specified. (see below for nested schema)

Optional:

  • connectivity (String) Connectivity type. Use public for ShareableCloud or private for VirtualNetworkGateway. Defaults to public.
  • encryption (String) Connection encryption. Defaults to Encrypted.
  • skip_test_connection (Boolean) Whether to skip the connection test during creation. Defaults to false.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.connections.type

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.connections.type.jdbc

Required:

  • credentials (Attributes) Credentials for the connection. Exactly one credential type must be specified. (see below for nested schema)
  • database (String) Database name to connect to.
  • server (String) Server hostname or IP address.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.connections.type.jdbc.credentials

Optional:

  • basic (Attributes) Basic authentication (username + password from Key Vault). (see below for nested schema)
  • key_pair (Attributes) Key pair authentication (private key from Key Vault). (see below for nested schema)
  • service_principal (Attributes) Service principal authentication (client secret from Key Vault). (see below for nested schema)
  • workspace_identity (Boolean) Use Fabric workspace identity for authentication. No credentials required.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.connections.type.jdbc.credentials.basic

Required:

  • kv_secret_name (String) Key Vault secret name holding the password.
  • username (String) Username for authentication.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.connections.type.jdbc.credentials.key_pair

Required:

  • identifier (String) Identifier (username) for the key pair.
  • kv_secret_name (String) Key Vault secret name holding the private key.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.connections.type.jdbc.credentials.service_principal

Required:

  • kv_secret_name (String) Key Vault secret name holding the client secret.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.git_provider

Optional:

  • azuredevops (Attributes) Azure DevOps git integration for this workspace. Mutually exclusive with github. (see below for nested schema)
  • github (Attributes) GitHub git integration for this workspace. Mutually exclusive with azuredevops. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.git_provider.azuredevops

Required:

  • enabled (Boolean) Enable git integration for this workspace using Azure DevOps.
  • project (String) Azure DevOps project name within the organisation.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.git_provider.github

Required:

  • enabled (Boolean) Enable git integration for this workspace using GitHub.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.outbound_rules

Required:

  • connection_type (String) Connection type this rule applies to.
  • default_action (String) Default action for this rule (Allow or Deny).

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.outbound_rules.allowed_endpoints

Required:

  • hostname_pattern (String) Hostname pattern to allow (e.g. *.database.windows.net).

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.lakehouse.outbound_rules.allowed_workspaces

Required:

  • workspace_id (String) Fabric workspace ID to allow outbound connections to.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence

Required:

  • eventhouses (Attributes List) Eventhouses to create for real-time analytics. (see below for nested schema)
  • name (String) Name of the workspace. Used as identifier in resource naming. Must be lowercase alphanumeric with hyphens only.

Optional:

  • connections (Attributes List) Data source connections for this workspace. (see below for nested schema)
  • domain (String) Fabric domain name to assign this workspace to. The domain must be defined at the data subscription level.
  • git_provider (Attributes) Git provider integration for this workspace. The root-level git_provider must be configured first. (see below for nested schema)
  • outbound_rules (Attributes List) Outbound network rules for the workspace. When provided, workspace network policy is set to Deny by default. (see below for nested schema)
  • private_link (Boolean) Enable workspace-level private link. Creates a private endpoint for this workspace and blocks public inbound access. Defaults to false.
  • tags (Map of String) Tags for this workspace.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.eventhouses

Required:

  • databases (List of String) KQL database names to create within this eventhouse.
  • name (String) Name of the eventhouse. Must be lowercase alphanumeric with hyphens only.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.connections

Required:

  • name (String) Name of the connection. Must be lowercase alphanumeric with hyphens only.
  • type (Attributes) Connection type. Exactly one type must be specified. (see below for nested schema)

Optional:

  • connectivity (String) Connectivity type. Use public for ShareableCloud or private for VirtualNetworkGateway. Defaults to public.
  • encryption (String) Connection encryption. Defaults to Encrypted.
  • skip_test_connection (Boolean) Whether to skip the connection test during creation. Defaults to false.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.connections.type

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.connections.type.jdbc

Required:

  • credentials (Attributes) Credentials for the connection. Exactly one credential type must be specified. (see below for nested schema)
  • database (String) Database name to connect to.
  • server (String) Server hostname or IP address.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.connections.type.jdbc.credentials

Optional:

  • basic (Attributes) Basic authentication (username + password from Key Vault). (see below for nested schema)
  • key_pair (Attributes) Key pair authentication (private key from Key Vault). (see below for nested schema)
  • service_principal (Attributes) Service principal authentication (client secret from Key Vault). (see below for nested schema)
  • workspace_identity (Boolean) Use Fabric workspace identity for authentication. No credentials required.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.connections.type.jdbc.credentials.basic

Required:

  • kv_secret_name (String) Key Vault secret name holding the password.
  • username (String) Username for authentication.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.connections.type.jdbc.credentials.key_pair

Required:

  • identifier (String) Identifier (username) for the key pair.
  • kv_secret_name (String) Key Vault secret name holding the private key.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.connections.type.jdbc.credentials.service_principal

Required:

  • kv_secret_name (String) Key Vault secret name holding the client secret.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.git_provider

Optional:

  • azuredevops (Attributes) Azure DevOps git integration for this workspace. Mutually exclusive with github. (see below for nested schema)
  • github (Attributes) GitHub git integration for this workspace. Mutually exclusive with azuredevops. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.git_provider.azuredevops

Required:

  • enabled (Boolean) Enable git integration for this workspace using Azure DevOps.
  • project (String) Azure DevOps project name within the organisation.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.git_provider.github

Required:

  • enabled (Boolean) Enable git integration for this workspace using GitHub.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.outbound_rules

Required:

  • connection_type (String) Connection type this rule applies to.
  • default_action (String) Default action for this rule (Allow or Deny).

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.outbound_rules.allowed_endpoints

Required:

  • hostname_pattern (String) Hostname pattern to allow (e.g. *.database.windows.net).

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.real_time_intelligence.outbound_rules.allowed_workspaces

Required:

  • workspace_id (String) Fabric workspace ID to allow outbound connections to.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse

Required:

  • name (String) Name of the workspace. Used as identifier in resource naming. Must be lowercase alphanumeric with hyphens only.

Optional:

  • connections (Attributes List) Data source connections for this workspace. (see below for nested schema)
  • domain (String) Fabric domain name to assign this workspace to. The domain must be defined at the data subscription level.
  • git_provider (Attributes) Git provider integration for this workspace. The root-level git_provider must be configured first. (see below for nested schema)
  • outbound_rules (Attributes List) Outbound network rules for the workspace. When provided, workspace network policy is set to Deny by default. (see below for nested schema)
  • private_link (Boolean) Enable workspace-level private link. Creates a private endpoint for this workspace and blocks public inbound access. Defaults to false.
  • tags (Map of String) Tags for this workspace.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.connections

Required:

  • name (String) Name of the connection. Must be lowercase alphanumeric with hyphens only.
  • type (Attributes) Connection type. Exactly one type must be specified. (see below for nested schema)

Optional:

  • connectivity (String) Connectivity type. Use public for ShareableCloud or private for VirtualNetworkGateway. Defaults to public.
  • encryption (String) Connection encryption. Defaults to Encrypted.
  • skip_test_connection (Boolean) Whether to skip the connection test during creation. Defaults to false.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.connections.type

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.connections.type.jdbc

Required:

  • credentials (Attributes) Credentials for the connection. Exactly one credential type must be specified. (see below for nested schema)
  • database (String) Database name to connect to.
  • server (String) Server hostname or IP address.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.connections.type.jdbc.credentials

Optional:

  • basic (Attributes) Basic authentication (username + password from Key Vault). (see below for nested schema)
  • key_pair (Attributes) Key pair authentication (private key from Key Vault). (see below for nested schema)
  • service_principal (Attributes) Service principal authentication (client secret from Key Vault). (see below for nested schema)
  • workspace_identity (Boolean) Use Fabric workspace identity for authentication. No credentials required.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.connections.type.jdbc.credentials.basic

Required:

  • kv_secret_name (String) Key Vault secret name holding the password.
  • username (String) Username for authentication.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.connections.type.jdbc.credentials.key_pair

Required:

  • identifier (String) Identifier (username) for the key pair.
  • kv_secret_name (String) Key Vault secret name holding the private key.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.connections.type.jdbc.credentials.service_principal

Required:

  • kv_secret_name (String) Key Vault secret name holding the client secret.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.git_provider

Optional:

  • azuredevops (Attributes) Azure DevOps git integration for this workspace. Mutually exclusive with github. (see below for nested schema)
  • github (Attributes) GitHub git integration for this workspace. Mutually exclusive with azuredevops. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.git_provider.azuredevops

Required:

  • enabled (Boolean) Enable git integration for this workspace using Azure DevOps.
  • project (String) Azure DevOps project name within the organisation.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.git_provider.github

Required:

  • enabled (Boolean) Enable git integration for this workspace using GitHub.

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.outbound_rules

Required:

  • connection_type (String) Connection type this rule applies to.
  • default_action (String) Default action for this rule (Allow or Deny).

Optional:

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.outbound_rules.allowed_endpoints

Required:

  • hostname_pattern (String) Hostname pattern to allow (e.g. *.database.windows.net).

Nested Schema for configuration.subscriptions.data.fabric.architecture_pattern.warehouse.outbound_rules.allowed_workspaces

Required:

  • workspace_id (String) Fabric workspace ID to allow outbound connections to.

Nested Schema for configuration.subscriptions.data.fabric.capacity

Required:

  • sku (String) Fabric capacity SKU. Determines available compute resources (capacity units).

Optional:

  • gateway (Attributes) VNet Data Gateway configuration. When set, a gateway is created in the vnet_data_gateway subnet to enable private connectivity to data sources. Requires networking to be enabled. (see below for nested schema)
  • resource_lock_enabled (Boolean) Whether to apply a CanNotDelete lock on the Fabric resource group to prevent accidental deletion of the capacity and workspaces. Defaults to true.
  • spark_settings (Attributes) Spark compute settings for the capacity. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.capacity.gateway

Optional:

  • enabled (Boolean) Whether the VNet Data Gateway is enabled. Defaults to false.
  • inactivity_minutes_before_sleep (Number) Minutes of inactivity before the gateway goes to sleep. Defaults to 120.
  • scaling (Attributes) Gateway scaling strategy. Either fixed or autoscaling. Defaults to fixed with 1 member. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.capacity.gateway.scaling

Optional:

  • autoscaling (Attributes) Autoscaling mode. Fabric scales gateway members between min and max based on load. Mutually exclusive with fixed. (see below for nested schema)
  • fixed (Attributes) Fixed scaling mode. A static number of gateway members. Mutually exclusive with autoscaling. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.capacity.gateway.scaling.autoscaling

Required:

  • max_member_gateway_count (Number) Maximum number of member gateways to scale up to. Value must be between 1 and 9.
  • min_member_gateway_count (Number) Minimum number of member gateways to scale down to. Value must be between 1 and 9.

Nested Schema for configuration.subscriptions.data.fabric.capacity.gateway.scaling.fixed

Optional:

  • number_of_member_gateways (Number) Fixed number of member gateways. Value must be between 1 and 9. Defaults to 1.

Nested Schema for configuration.subscriptions.data.fabric.capacity.spark_settings

Optional:

  • custom_pools (Attributes List) Custom Spark pools for dedicated compute. (see below for nested schema)
  • starter_pool (Boolean) Enable the starter Spark pool. Defaults to true.

Nested Schema for configuration.subscriptions.data.fabric.capacity.spark_settings.custom_pools

Required:

  • max_node_count (Number) Maximum number of nodes for autoscaling.
  • min_node_count (Number) Minimum number of nodes.
  • name (String) Name of the custom Spark pool.

Optional:

  • node_size (String) Node size for the pool. Defaults to Medium.

Nested Schema for configuration.subscriptions.data.fabric.domains

Required:

  • name (String) Unique name for the domain. Used as a reference key by tenancy accounts to assign workspaces to this domain.

Optional:

  • description (String) Human-readable description of the domain's purpose.

Nested Schema for configuration.subscriptions.data.fabric.git_provider

Optional:

  • azuredevops (Attributes) Azure DevOps git provider configuration. Mutually exclusive with github. (see below for nested schema)
  • github (Attributes) GitHub git provider configuration. Mutually exclusive with azuredevops. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.fabric.git_provider.azuredevops

Required:

  • kv_secret_name (String) Key Vault secret name holding the Azure DevOps PAT.
  • url (String) Azure DevOps organisation URL (e.g. https://dev.azure.com/OrgName).

Nested Schema for configuration.subscriptions.data.fabric.git_provider.github

Required:

  • kv_secret_name (String) Key Vault secret name holding the GitHub PAT.
  • url (String) GitHub owner URL (e.g. https://github.com/OrgName or https://company.ghe.com/OrgName).

Optional:

  • emu (Boolean) Whether the GitHub organisation uses Enterprise Managed Users (EMU) for SSO. Enables Entra ID group-to-team synchronisation.

Nested Schema for configuration.subscriptions.data.fabric.tenant_settings

Required:

  • enabled (Boolean) Whether the tenant setting is enabled.
  • setting_name (String) The Fabric tenant setting API name (e.g. ExportReport, CreateAppWorkspaces, ExternalSharingV2). Setting names are PascalCase identifiers used by the Fabric Admin API. Use https://learn.microsoft.com/en-us/rest/api/fabric/admin/tenants/list-tenant-settings?tabs=HTTP#code-try-0 to retrieve valid setting names for your tenant.

Optional:

  • delegate_to_workspace (Boolean) Whether workspace admins can override this tenant setting.
  • enabled_security_groups (List of String) List of Entra ID security group names that the setting applies to. Empty means entire organisation.
  • excluded_security_groups (List of String) List of Entra ID security group names excluded from the setting.

Nested Schema for configuration.subscriptions.data.keyvault

Optional:

  • purge_protection_enabled (Boolean) Is Purge Protection enabled for this Key Vault? Defaults to true.
  • sku (String) The Name of the SKU used for this Key Vault. Possible values are standard and premium. Defaults to standard.
  • soft_delete_retention_days (Number) The number of days that items should be retained for once soft-deleted. This field can only be configured one time and cannot be updated. This value can be between 7 and 90 days. Defaults to 90.

Nested Schema for configuration.subscriptions.data.purview

Optional:

  • enabled (Boolean) Deploy Microsoft Purview in this subscription. Deploys to the tenancy home region (one per tenant). Defaults to false.

Nested Schema for configuration.subscriptions.data.resource_groups_lock

Optional:

  • baseline (Boolean) Boolean flag to enable/disable the baseline resource group lock. Defaults to true.
  • rsv (Boolean) Boolean flag to enable/disable the recovery services vault resource group lock. Defaults to false.

Nested Schema for configuration.subscriptions.data.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_definition_name (String) The name of the role definition to assign. For built-in roles use the Azure display name (e.g. Contributor, Reader). For custom roles, use the exact name as defined in the management_groups.role_definitions schema.

Warning

Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.subscriptions.data.update_manager

Optional:

  • alert_action_groups (Attributes List) Alert action groups with filters and notification channels. Each entry creates an action group and alert processing rule. (see below for nested schema)
  • exclusion_tag (String) Tag key used to exclude VMs from dynamic scopes in this subscription. Defaults to PatchExclude.
  • maintenance_configurations (Attributes List) List of maintenance configurations to create. Each defines a schedule, patch classifications, and tag-based dynamic scoping. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.update_manager.alert_action_groups

Required:

  • channels (Attributes List) Notification channels for this action group. (see below for nested schema)
  • name (String) Name identifier for the action group. Used in resource naming.

Optional:

  • filter (Attributes) Filter conditions determining which alerts route to this action group. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.update_manager.alert_action_groups.channels

Required:

  • type (String) Channel type. Valid values: 'email', 'webhook'.

Optional:

  • address (String) Email address (required when type is 'email').
  • name (String) Display name for the channel (required for webhook type).
  • uri (String, Sensitive) Webhook URI (required when type is 'webhook').

Nested Schema for configuration.subscriptions.data.update_manager.alert_action_groups.filter

Optional:

  • critical_patch_threshold (Number) Number of days critical patches can be missing before alerting. Defaults to 7.
  • severity (List of String) Severity levels to route to this action group. Valid values: 'critical', 'warning'. Defaults to ["critical" "warning"].
  • stale_assessment_threshold (Number) Number of hours since last assessment before considering it stale. Defaults to 48.

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations

Required:

  • name (String) Name identifier for the maintenance configuration. Used in resource naming.
  • os_type (String) Operating system type. Valid values: 'Linux', 'Windows'.
  • patch_classifications (List of String) Patch classifications to include. Windows: 'Critical', 'Definition', 'FeaturePack', 'Security', 'ServicePack', 'Tools', 'UpdateRollUp', 'Updates'. Linux: 'Critical', 'Other', 'Security'.
  • recurrence (String) Recurrence pattern. Valid values: 'monthly', 'weekly'.
  • tags_filter (Map of List of String) Map of tag keys to lists of tag values for dynamic scope filtering. VMs matching ALL tag filters (AND logic) are included.

Optional:

  • automation (Attributes) Automation settings for this maintenance configuration. Set to null to disable pre/post event handling for this config. (see below for nested schema)
  • day_of_week (String) Day of the week for weekly recurrence. Required when recurrence is 'weekly'.
  • duration (Number) Maintenance window duration in hours. Minimum 1, maximum 4. Defaults to 3.
  • offset_day_of_month (Number) Day of the month (1-28) for monthly recurrence. Required when recurrence is 'monthly'.
  • reboot_setting (String) Reboot setting after patching. Valid values: 'Always', 'IfRequired', 'Never'. Defaults to IfRequired.
  • start_time (String) Start time in HH:MM format (24-hour). Defaults to 02:00.
  • timezone (String) Timezone for the schedule. Defaults to UTC.

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation

Required:

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.post_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for post-maintenance validation. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.post_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.post_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health validation after patching (heartbeat, agent, extensions). Defaults to true.
  • timeout (Number) Timeout in seconds for post-maintenance heartbeat wait. Defaults to 300.

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.pre_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for pre-maintenance validation. (see below for nested schema)
  • snapshot (Attributes) Snapshot configuration for pre-maintenance VM protection. (see below for nested schema)
  • sql_conflict_handling (Attributes) SQL Server conflict handling configuration. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.pre_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.pre_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health check (agent status, extension status) before patching. Defaults to true.
  • timeout (Number) Timeout in seconds for health check. Defaults to 120.

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.pre_maintenance.snapshot

Optional:

  • enabled (Boolean) Create a VM snapshot before patching. Skipped for Arc-enabled servers. Defaults to true.
  • retention (Number) Number of days to retain the snapshot after successful patching. A value of 0 means delete immediately on successful post-maintenance validation. Defaults to 1.
  • timeout (Number) Timeout in minutes for snapshot creation. Defaults to 10.

Nested Schema for configuration.subscriptions.data.update_manager.maintenance_configurations.automation.pre_maintenance.sql_conflict_handling

Optional:

  • enabled (Boolean) Enable SQL Server active transaction checking before patching. VMs must be tagged with SQLServer:true. Defaults to false.
  • transaction_wait_timeout (Number) Minutes to wait for active SQL transactions to complete. Defaults to 15.

Nested Schema for configuration.subscriptions.data.vnet

Optional:

  • paas_subnets (Attributes) Configure PaaS subnets with delegations (e.g. SQL MI, PostgreSQL). (see below for nested schema)
  • vnet_link_to_private_dns_zones (List of String) Private DNS zones to link to this VNET. Defaults to Fabric privatelink zones: ["privatelink.analysis.windows.net","privatelink.fabric.microsoft.com","privatelink.pbidedicated.windows.net"].

Nested Schema for configuration.subscriptions.data.vnet.paas_subnets

Optional:

  • data_tier (Attributes Map) Enables PaaS subnets for data tier services. The map keys CAN be one of: pgsql, sqlmi. (see below for nested schema)

Nested Schema for configuration.subscriptions.data.vnet.paas_subnets.data_tier

Required:

  • enabled (Boolean) If true, deploys a PaaS subnet in the VNET.

Optional:

  • service_endpoints (List of String) The list of Service endpoints to associate with the subnet.

Nested Schema for configuration.budgets

Optional:

Nested Schema for configuration.budgets.landingzone_nonprod

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.budgets.landingzone_nonprod.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.budgets.landingzone_prod

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.budgets.landingzone_prod.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.budgets.platform

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.budgets.platform.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.budgets.tenancy

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.budgets.tenancy.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • child_mgs (Attributes) Child management groups under the root. Contains default (hardcoded hierarchy) and custom (customer-defined) groups. (see below for nested schema)
  • name (String) The name for the root management group. Defaults to Tenancy.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • policy_definitions (Attributes List) Custom policy definitions to create at the root management group scope. Permissions are read from the blob at apply time. (see below for nested schema)
  • policy_set_definitions (Attributes List) Custom policy definitions to create at the root management group scope. Permissions are read from the blob at apply time. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

  • role_definitions (Attributes List) Role definitions to create at the root management group scope. Permissions are read from the blob URL at apply time.

Warning

Before removing a role definition, ensure all role assignments referencing it have been removed first (including assignments in subscription templates). Azure will reject deletion of a role definition that still has assignments.
(see below for nested schema)

Nested Schema for configuration.management_groups.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs

Optional:

  • default (Attributes) Default management group hierarchy. These are the hardcoded ALZ management groups. (see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default

Optional:

  • decommissioned (Attributes) Decommissioned management group. Subscriptions placed here are being retired. (see below for nested schema)
  • landing_zones (Attributes) Landing Zones management group. Contains workload subscriptions split by environment. (see below for nested schema)
  • platform (Attributes) Platform management group. Contains core platform subscriptions (connectivity, identity, management, security). (see below for nested schema)
  • sandboxes (Attributes) Sandboxes management group. Subscriptions placed here have relaxed policies for experimentation. (see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.decommissioned

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Decommissioned.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.decommissioned.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.decommissioned.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.decommissioned.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.decommissioned.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • child_mgs (Attributes) Child management groups under Landing Zones. (see below for nested schema)
  • name (String) The name for the Landing Zones management group. Defaults to Landing Zones.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs

Optional:

  • non_production (Attributes) Non-Production management group. Contains non-production workload subscriptions. (see below for nested schema)
  • production (Attributes) Production management group. Contains production workload subscriptions. (see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.non_production

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Non Production.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.non_production.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.non_production.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.non_production.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.non_production.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.production

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Production.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.production.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.production.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.production.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.child_mgs.production.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.landing_zones.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.platform

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • child_mgs (Attributes) Child management groups under Platform. (see below for nested schema)
  • name (String) The name for the Platform management group. Defaults to Platform.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.platform.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs

Optional:

  • connectivity (Attributes) Connectivity management group. Contains the connectivity subscription. (see below for nested schema)
  • data (Attributes) Data management group. Contains the data subscription for centralised data governance. (see below for nested schema)
  • identity (Attributes) Identity management group. Contains the identity subscription. (see below for nested schema)
  • management (Attributes) Management management group. Contains the management subscription. (see below for nested schema)
  • security (Attributes) Security management group. Contains the security subscription. (see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.connectivity

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Connectivity.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.connectivity.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.connectivity.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.connectivity.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.connectivity.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.data

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Data.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.data.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.data.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.data.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.data.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.identity

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Identity.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.identity.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.identity.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.identity.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.identity.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.management

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Management.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.management.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.management.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.management.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.management.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.security

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Security.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.security.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.security.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.security.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.platform.child_mgs.security.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.platform.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.platform.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.child_mgs.default.sandboxes

Optional:

  • budgets (Attributes List) Provides a list of budget objects. (see below for nested schema)
  • name (String) The name for this management group. Defaults to Sandboxes.
  • policy_assignments (Attributes List) List of policy assignments at this management group scope. Can reference built-in policy definition names/IDs or custom definitions. (see below for nested schema)
  • role_assignments (Attributes List) List of role assignments at this management group scope.

Warning

Custom roles that contain data_actions cannot be assigned at management group scope (Azure platform limitation). Assign those at subscription scope instead.
(see below for nested schema)

Nested Schema for configuration.management_groups.child_mgs.default.sandboxes.budgets

Required:

  • amount (Number) The total amount of cost to track with the budget.
  • notifications (Attributes List) One or more notification objects. (see below for nested schema)

Optional:

  • time_grain (String) The time covered by a budget. Tracking of the amount will be reset based on the time grain. Possible values are BillingAnnual, BillingMonth, BillingQuarter, Annually, Monthly and Quarterly. Defaults to Monthly. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.sandboxes.budgets.notifications

Required:

  • contact_emails (List of String) Specifies a list of email addresses to send the budget notification to when the threshold is exceeded.
  • threshold (Number) Threshold value associated with a notification. Notification is sent when the cost exceeded the threshold. It is always percent and has to be between 0 and 1000.

Optional:

  • operator (String) The comparison operator for the notification. Possible values are EqualTo, GreaterThan, or GreaterThanOrEqualTo. Defaults to EqualTo.
  • threshold_type (String) The type of threshold for the notification. This determines whether the notification is triggered by forecasted costs or actual costs. The allowed values are Actual and Forecasted. Default is Actual. Changing this forces a new resource to be created.

Nested Schema for configuration.management_groups.child_mgs.default.sandboxes.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.child_mgs.default.sandboxes.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.policy_assignments

Required:

  • name (String) The name of the policy definition to assign. Must match a name defined in policy_definitions.

Optional:

  • parameters (String) JSON-encoded parameters for the policy assignment. Optional.

Nested Schema for configuration.management_groups.policy_definitions

Required:

  • blob_name (String) Name of the JSON blob within the policies container of the management baseline storage account containing the policy definition rule.

Warning

The blob must exist in the storage account before adding the definition to the configuration. Apply will fail if the blob is not found.

  • name (String) The name of the custom policy definition. Must be lowercase with dashes only.

Nested Schema for configuration.management_groups.policy_set_definitions

Required:

  • blob_name (String) Name of the JSON blob within the policies container of the management baseline storage account containing the policy definition rule.

Warning

The blob must exist in the storage account before adding the definition to the configuration. Apply will fail if the blob is not found.

  • name (String) The name of the custom policy definition. Must be lowercase with dashes only.

Nested Schema for configuration.management_groups.role_assignments

Required:

  • principal_id (String) The Object ID of the Entra ID principal (user, group, or service principal) to assign the role to.
  • role_name (String) The name of the role definition to assign. For custom roles this must match the name defined in role_definitions or a platform role name. For built-in roles use the Azure display name.

Warning

Custom roles with data_actions cannot be assigned at management group scope. Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.management_groups.role_definitions

Required:

  • blob_name (String) Name of the JSON file within the roles container of the management subscription baseline storage account. The file must contain the role permissions structure (actions, not_actions, data_actions, not_data_actions). Example: my-custom-role.json.

Warning

The blob must exist in the storage account before adding the definition to the configuration. Apply will fail if the blob is not found.

  • name (String) The name of the custom role definition. Must use Title Case with spaces (e.g. Storage Blob Reader).

Warning

Custom role names must be unique and must not clash with Azure built-in role names.

Nested Schema for configuration.update_manager

Optional:

  • alert_action_groups (Attributes List) Alert action groups with filters and notification channels. Each entry creates an action group and alert processing rule. (see below for nested schema)
  • enabled (Boolean) Master switch to enable Azure Update Manager across the tenancy. When enabled, creates runbooks, policies, workbook, and publishes state for subscription templates. Defaults to true.
  • exclusion_tag (String) Tag key used to exclude VMs from Update Manager policies and dynamic scopes. VMs tagged with this key set to 'true' are excluded. Defaults to PatchExclude.
  • maintenance_configurations (Attributes List) List of maintenance configurations to create. Each defines a schedule, patch classifications, and tag-based dynamic scoping. (see below for nested schema)
  • tags (Map of String) Key-value map of resource tags. Tag keys must be PascalCase (e.g., 'CostCenter', 'Environment', 'Owner').

Nested Schema for configuration.update_manager.alert_action_groups

Required:

  • channels (Attributes List) Notification channels for this action group. (see below for nested schema)
  • name (String) Name identifier for the action group. Used in resource naming.

Optional:

  • filter (Attributes) Filter conditions determining which alerts route to this action group. (see below for nested schema)

Nested Schema for configuration.update_manager.alert_action_groups.channels

Required:

  • type (String) Channel type. Valid values: 'email', 'webhook'.

Optional:

  • address (String) Email address (required when type is 'email').
  • name (String) Display name for the channel (required for webhook type).
  • uri (String, Sensitive) Webhook URI (required when type is 'webhook').

Nested Schema for configuration.update_manager.alert_action_groups.filter

Optional:

  • critical_patch_threshold (Number) Number of days critical patches can be missing before alerting. Defaults to 7.
  • severity (List of String) Severity levels to route to this action group. Valid values: 'critical', 'warning'. Defaults to ["critical" "warning"].
  • stale_assessment_threshold (Number) Number of hours since last assessment before considering it stale. Defaults to 48.

Nested Schema for configuration.update_manager.maintenance_configurations

Required:

  • name (String) Name identifier for the maintenance configuration. Used in resource naming.
  • os_type (String) Operating system type. Valid values: 'Linux', 'Windows'.
  • patch_classifications (List of String) Patch classifications to include. Windows: 'Critical', 'Definition', 'FeaturePack', 'Security', 'ServicePack', 'Tools', 'UpdateRollUp', 'Updates'. Linux: 'Critical', 'Other', 'Security'.
  • recurrence (String) Recurrence pattern. Valid values: 'monthly', 'weekly'.
  • tags_filter (Map of List of String) Map of tag keys to lists of tag values for dynamic scope filtering. VMs matching ALL tag filters (AND logic) are included.

Optional:

  • automation (Attributes) Automation settings for this maintenance configuration. Set to null to disable pre/post event handling for this config. (see below for nested schema)
  • day_of_week (String) Day of the week for weekly recurrence. Required when recurrence is 'weekly'.
  • duration (Number) Maintenance window duration in hours. Minimum 1, maximum 4. Defaults to 3.
  • offset_day_of_month (Number) Day of the month (1-28) for monthly recurrence. Required when recurrence is 'monthly'.
  • reboot_setting (String) Reboot setting after patching. Valid values: 'Always', 'IfRequired', 'Never'. Defaults to IfRequired.
  • start_time (String) Start time in HH:MM format (24-hour). Defaults to 02:00.
  • timezone (String) Timezone for the schedule. Defaults to UTC.

Nested Schema for configuration.update_manager.maintenance_configurations.automation

Required:

Nested Schema for configuration.update_manager.maintenance_configurations.automation.post_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for post-maintenance validation. (see below for nested schema)

Nested Schema for configuration.update_manager.maintenance_configurations.automation.post_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.update_manager.maintenance_configurations.automation.post_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health validation after patching (heartbeat, agent, extensions). Defaults to true.
  • timeout (Number) Timeout in seconds for post-maintenance heartbeat wait. Defaults to 300.

Nested Schema for configuration.update_manager.maintenance_configurations.automation.pre_maintenance

Optional:

  • custom_script (Attributes) Custom script to execute during maintenance. The script must be a PowerShell (.ps1) file uploaded to the 'update-manager-scripts' container in the management subscription's baseline storage account. The Automation Account managed identity has read access to this storage account. If the script returns a non-zero exit code, the maintenance event is cancelled and the VM is tagged with PatchStatus:CustomScriptFailed. (see below for nested schema)
  • health_check (Attributes) Health check configuration for pre-maintenance validation. (see below for nested schema)
  • snapshot (Attributes) Snapshot configuration for pre-maintenance VM protection. (see below for nested schema)
  • sql_conflict_handling (Attributes) SQL Server conflict handling configuration. (see below for nested schema)

Nested Schema for configuration.update_manager.maintenance_configurations.automation.pre_maintenance.custom_script

Required:

  • name (String) Name of the PowerShell script file (.ps1) stored in the 'update-manager-scripts' container of the management subscription's baseline storage account. Must follow the naming convention: '{pre|post}-{purpose}.ps1'. The script must be uploaded to this location before applying the configuration.

Optional:

  • parameters (Map of String) Key-value map of parameters to pass to the custom script. These are passed as named PowerShell parameters to the script execution.

Nested Schema for configuration.update_manager.maintenance_configurations.automation.pre_maintenance.health_check

Optional:

  • enabled (Boolean) Perform health check (agent status, extension status) before patching. Defaults to true.
  • timeout (Number) Timeout in seconds for health check. Defaults to 120.

Nested Schema for configuration.update_manager.maintenance_configurations.automation.pre_maintenance.snapshot

Optional:

  • enabled (Boolean) Create a VM snapshot before patching. Skipped for Arc-enabled servers. Defaults to true.
  • retention (Number) Number of days to retain the snapshot after successful patching. A value of 0 means delete immediately on successful post-maintenance validation. Defaults to 1.
  • timeout (Number) Timeout in minutes for snapshot creation. Defaults to 10.

Nested Schema for configuration.update_manager.maintenance_configurations.automation.pre_maintenance.sql_conflict_handling

Optional:

  • enabled (Boolean) Enable SQL Server active transaction checking before patching. VMs must be tagged with SQLServer:true. Defaults to false.
  • transaction_wait_timeout (Number) Minutes to wait for active SQL transactions to complete. Defaults to 15.

Nested Schema for credentials

Required:

  • client_id (String, Sensitive) Service Principal client ID configured in the target Azure tenant.
  • client_secret (String, Sensitive) Service Principal client secret configured in the target Azure tenant.
  • tenant_id (String, Sensitive) Target Azure tenant ID.

Optional:

  • subscription_id (String, Sensitive, Deprecated) Target Azure Subscription ID. Optional for the tenancy resource — not needed for management-group-scoped operations.

Import

Import is supported using the following syntax:

$ terraform import volocloud_tenancy_azure.example <resource ID>

Note

The format is: "account_id:tenancy_id"