Azure Verified Modules

New content: AI-Assisted IaC Solution Development

New articles available on specification-driven development with AVM modules! Learn how to use GitHub Copilot and Spec Kit to accelerate the development of Azure infrastructure solutions with AVM. See end-to-end examples for both Bicep and Terraform.

Introduction

Value Proposition

Azure Verified Modules (AVM) is an initiative to consolidate and set the standards for what a good Infrastructure-as-Code module looks like.

Modules will then align to these standards, across languages (Bicep, Terraform etc.) and will then be classified as AVMs and available from their respective language specific registries.

AVM is a common code base, a toolkit for our Customers, our Partners, and Microsoft. It’s an official, Microsoft driven initiative, with a devolved ownership approach to develop modules, leveraging internal & external communities.

Azure Verified Modules enable and accelerate consistent solution development and delivery of cloud-native or migrated applications and their supporting infrastructure by codifying Microsoft guidance (WAF), with best practice configurations.

Modules

Azure Verified Modules provides two types of modules: Resource and Pattern modules.

AVM modules are used to deploy Azure resources and their extensions, as well as reusable architectural patterns consistently.

Modules are composable building blocks that encapsulate groups of resources dedicated to one task.

Flexible, generalized, multi-purpose
Integrates child resources
Integrates extension resources

AVM improves code quality and provides a unified customer experience.

Important

AVM is owned, developed & supported by Microsoft, you may raise a GitHub issue on this repository or the module’s repository directly to get support or log feature requests.

You can also log a support ticket and if the issue is not related to the Azure platform, you will be redirected to submit a GitHub issue for the module owner(s) or the AVM team.

See Module Support for more information.

Next Steps

Review Overview
Review the Module Classification Definitions
Review the Specifications
Review the FAQ
Learn how to contribute to AVM

Overview

Summary

This section provides an overview of the Azure Verified Modules (AVM) program.

Introduction

Introduction

What is Azure Verified Modules?

Azure Verified Modules (AVM), as “One Microsoft”, we want to provide and define the single definition of what a good IaC module is;

How they should be constructed and built
- Enforcing consistency and testing where possible
How they are to be consumed
What they deliver for consumers in terms of resources deployed and configured
And where appropriate aligned across IaC languages (e.g. Bicep, Terraform, etc.).

Mission Statement

Our mission is to deliver a comprehensive Azure Verified Modules library in multiple IaC languages, following the principles of the well-architected framework, serving as the trusted Microsoft source of truth. Supported by Microsoft, AVM will accelerate deployment time for Azure resources and architectural patterns, empowering every person and organization on the planet on their IaC journey.

Definition of “Verified” Summary

The modules are supported by Microsoft, across it’s many internal organizations, as described in Module Support
Modules are aligned to clear specifications that enforces consistency between all AVM modules. See the ‘Specifications & Definitions’ section in the menu
Modules will continue to stay up-to-date with product/service roadmaps owned by the module owners and contributors
Modules will align to WAF high priority recommendations. See ‘What does AVM mean by “WAF Aligned”?’
Modules will provide clear documentation alongside examples to promote self-service consumption
Modules will be tested to ensure they comply with the specifications for AVM and their examples deploy as intended

Why Azure Verified Modules?

This effort to create Azure Verified Modules, with a strategy and definition, is required based on the sheer number of existing attempts from all areas across Microsoft to try and address this same area for our customers and partners. Across Microsoft there are many initiatives, projects and repositories that host and provide IaC modules in several languages, for example Bicep and Terraform. Each of these come with differing code styling and standards, consumption methods and approaches, testing frameworks, target personas, contribution guidelines, module definitions and most importantly support statements from their owners and maintainers.

However, none of these existing attempts have ever made it all the way through to becoming a brand and the go to place for IaC modules from Microsoft that consumers can trust (mainly around longevity and support), build upon and contribute back to.

Performing this effort now to create a shared single aligned strategy and definition for IaC modules from Microsoft, as One Microsoft, will allow us to accelerate existing and future projects, such as Application Landing Zone Accelerators (LZAs), as well as providing the building blocks via a library of modules, in the language of the consumers choice, that is consistent, trusted and supported by Microsoft. This all leads to consumers being able to accelerate faster, no matter what stage of their IaC journey they are on.

We also know, from our customers, that well defined support statements from Microsoft are required for initiatives like this to succeed at scale, especially in larger enterprise customers. We have seen over the past FY that this topic alone is important and is one that has led to confusion and frustration to customers who are consuming modules developed by individuals that in the end are not “officially” Microsoft supported and this unfortunately normally occurs at a critical point in time for the project being worked on, which amplifies frustrations.

How will we create, support and enforce Azure Verified Modules?

Azure Verified Modules will achieve this, and its mission statement, by implementing and enforcing the following; driven by the AVM Core Team:

Publishing AVM modules to their respective public registries for consumption
- For Bicep this will be the Bicep Public Module Registry
- For Terraform this will be the HashiCorp Terraform Registry
Creating, publishing and maintaining the Azure Verified Modules specifications (this site)
- Including IaC language specific specifications (today Bicep and Terraform)
Creating easy to follow AVM module contribution and publishing guidance for each IaC language (today Bicep and Terraform)
Enforcing tests for each AVM module is compliant with the AVM specifications, where possible, via Unit and Integration tests
Enforcing End-to-End Deployment tests of each AVM module
Providing, and backing, a long-term support statement, regardless of the AVM module’s ownership status
- Backed by the AVM Core Team, Microsoft CSS and Azure PGs

Module Indexes

Summary

The following table shows the number of all available, orphaned and planned AVM Bicep and Terraform Modules.

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Bicep	Resource	170	23	193
	Pattern	41	20	61
	Utility	1	1	2
Terraform	Resource	111	41	152
	Pattern	26	30	56
	Utility	11	3	14

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Want to contribute to AVM modules?

#	Labels	Link and description
1.	Type: New Module Proposal 💡 Needs: Module Owner 📣	To become the owner of a new module, see all new modules looking for owners or check out the “Looking for owners” swimlane here.
2.	Status: Module Orphaned 🟡	To become the owner of an orphaned module, see all orphaned modules or check out the “Orphaned” swimlane here.
3.	Needs: Module Contributor 📣	To become a co-owner or contribute to a module, see all modules looking for contributors.

For more details on “What are the different ways to contribute to AVM?”, see here.

Bicep Modules

Summary

The following table shows the number of all available, orphaned and planned Bicep Modules.

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Bicep	Resource	170	23	193
	Pattern	41	20	61
	Utility	1	1	2

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Want to contribute to AVM Bicep modules?

#	Labels	Link and description
1.	Type: New Module Proposal 💡 Needs: Module Owner 📣 Language: Bicep 💪	To become the owner of a new Bicep module, see all new Bicep modules looking for owners or check out the “Looking for owners” swimlane here.
2.	Status: Module Orphaned 🟡 Language: Bicep 💪	To become the owner of an orphaned Bicep module, see all orphaned Bicep modules or check out the “Orphaned” swimlane here.
3.	Needs: Module Contributor 📣 Language: Bicep 💪	To become a co-owner or contribute to a Bicep module, see all Bicep modules looking for contributors.

For more details on “What are the different ways to contribute to AVM?”, see here.

Status Badges

This section gives you an overview of the latest workflow status of each AVM module in the Public Bicep Registry repository.

Note

While some pipelines can momentarily show as red, a new module version cannot be published without a successful test run. A failing test may indicate a recent change to the platform that is causing a break in the module or any intermittent errors, such as a periodic test deployment attempting to create a resource with a name already taken in another Azure region.

#	Module	Status
1	ptn/aca-lza hosting-environment
2	ptn/ai-ml ai-foundry
3	ptn/ai-platform baseline
4	ptn/alz ama
5	ptn/alz empty
6	ptn/app-service-lza hosting-environment
7	ptn/app container-job-toolkit
8	ptn/app iaas-vm-cosmosdb-tier4
9	ptn/app paas-ase-cosmosdb-tier4
10	ptn/authorization pim-role-assignment
11	ptn/authorization policy-assignment
12	ptn/authorization policy-exemption
13	ptn/authorization resource-role-assignment
14	ptn/authorization role-assignment
15	ptn/authorization role-definition
16	ptn/azd acr-container-app
17	ptn/azd aks
18	ptn/azd aks-automatic-cluster
19	ptn/azd apim-api
20	ptn/azd container-app-upsert
21	ptn/azd container-apps-stack
22	ptn/azd insights-dashboard
23	ptn/azd ml-ai-environment	Deprecated
24	ptn/azd ml-hub-dependencies	Deprecated
25	ptn/azd ml-project	Deprecated
26	ptn/azd monitoring
27	ptn/data private-analytical-workspace
28	ptn/deployment-script import-image-to-acr
29	ptn/dev-ops cicd-agents-and-runners
30	ptn/finops-toolkit finops-hub
31	ptn/lz sub-vending
32	ptn/mgmt-groups subscription-placement
33	ptn/network hub-networking
34	ptn/network private-link-private-dns-zones
35	ptn/network virtual-wan
36	ptn/policy-insights remediation
37	ptn/sa build-your-own-copilot	Deprecated
38	ptn/sa chat-with-your-data
39	ptn/sa content-generation
40	ptn/sa content-processing
41	ptn/sa conversation-knowledge-mining
42	ptn/sa customer-chatbot
43	ptn/sa document-knowledge-mining
44	ptn/sa modernize-your-code
45	ptn/sa multi-agent-custom-automation-engine
46	ptn/security security-center
47	ptn/subscription service-health-alerts
48	ptn/virtual-machine-images azure-image-builder
49	res/aad domain-service
50	res/alerts-management action-rule
51	res/analysis-services server
52	res/api-management service
53	res/app-configuration configuration-store
54	res/app container-app
55	res/app job
56	res/app managed-environment
57	res/app session-pool
58	res/authorization policy-assignment
59	res/authorization role-assignment
60	res/automation automation-account
61	res/azure-stack-hci cluster
62	res/azure-stack-hci logical-network
63	res/azure-stack-hci marketplace-gallery-image
64	res/azure-stack-hci network-interface
65	res/azure-stack-hci virtual-hard-disk
66	res/azure-stack-hci virtual-machine-instance
67	res/batch batch-account
68	res/cache redis
69	res/cache redis-enterprise
70	res/cdn profile
71	res/cognitive-services account
72	res/communication communication-service
73	res/communication email-service
74	res/compute availability-set
75	res/compute disk
76	res/compute disk-encryption-set
77	res/compute gallery
78	res/compute image
79	res/compute proximity-placement-group
80	res/compute ssh-public-key
81	res/compute virtual-machine
82	res/compute virtual-machine-scale-set
83	res/consumption budget
84	res/container-instance container-group
85	res/container-registry registry
86	res/container-service managed-cluster
87	res/data-factory factory
88	res/data-protection backup-vault
89	res/databricks access-connector
90	res/databricks workspace
91	res/db-for-my-sql flexible-server
92	res/db-for-postgre-sql flexible-server
93	res/desktop-virtualization application-group
94	res/desktop-virtualization host-pool
95	res/desktop-virtualization scaling-plan
96	res/desktop-virtualization workspace
97	res/dev-center devcenter
98	res/dev-center network-connection
99	res/dev-center project
100	res/dev-ops-infrastructure pool
101	res/dev-test-lab lab
102	res/devices iot-hub
103	res/digital-twins digital-twins-instance
104	res/document-db database-account
105	res/document-db mongo-cluster
106	res/elastic-san elastic-san
107	res/event-grid domain
108	res/event-grid namespace
109	res/event-grid system-topic
110	res/event-grid topic
111	res/event-hub namespace
112	res/fabric capacity
113	res/health-bot health-bot
114	res/healthcare-apis workspace
115	res/hybrid-compute gateway
116	res/hybrid-compute license
117	res/hybrid-compute machine
118	res/hybrid-container-service provisioned-cluster-instance
119	res/insights action-group
120	res/insights activity-log-alert
121	res/insights component
122	res/insights data-collection-endpoint
123	res/insights data-collection-rule
124	res/insights diagnostic-setting
125	res/insights metric-alert
126	res/insights private-link-scope
127	res/insights scheduled-query-rule
128	res/insights webtest
129	res/key-vault vault
130	res/kubernetes-configuration extension
131	res/kubernetes-configuration flux-configuration
132	res/kubernetes-runtime load-balancer
133	res/kubernetes connected-cluster
134	res/kusto cluster
135	res/load-test-service load-test
136	res/logic integration-account
137	res/logic workflow
138	res/machine-learning-services registry
139	res/machine-learning-services workspace
140	res/maintenance configuration-assignment
141	res/maintenance maintenance-configuration
142	res/managed-identity user-assigned-identity
143	res/managed-services registration-definition
144	res/management management-group
145	res/management service-group
146	res/maps account
147	res/net-app net-app-account
148	res/network application-gateway
149	res/network application-gateway-web-application-firewall-policy
150	res/network application-security-group
151	res/network azure-firewall
152	res/network bastion-host
153	res/network connection
154	res/network ddos-protection-plan
155	res/network dns-forwarding-ruleset
156	res/network dns-resolver
157	res/network dns-zone
158	res/network express-route-circuit
159	res/network express-route-gateway
160	res/network express-route-port
161	res/network firewall-policy
162	res/network front-door	Deprecated
163	res/network front-door-web-application-firewall-policy
164	res/network ip-group
165	res/network load-balancer
166	res/network local-network-gateway
167	res/network nat-gateway
168	res/network network-interface
169	res/network network-manager
170	res/network network-security-group
171	res/network network-security-perimeter
172	res/network network-watcher
173	res/network p2s-vpn-gateway
174	res/network private-dns-zone
175	res/network private-endpoint
176	res/network private-link-service
177	res/network public-ip-address
178	res/network public-ip-prefix
179	res/network route-table
180	res/network service-endpoint-policy
181	res/network trafficmanagerprofile
182	res/network virtual-hub
183	res/network virtual-network
184	res/network virtual-network-gateway
185	res/network virtual-wan
186	res/network vpn-gateway
187	res/network vpn-server-configuration
188	res/network vpn-site
189	res/operational-insights cluster
190	res/operational-insights workspace
191	res/operations-management solution
192	res/portal dashboard
193	res/power-bi-dedicated capacity
194	res/purview account
195	res/recovery-services vault
196	res/relay namespace
197	res/resource-graph query
198	res/resources deployment-script
199	res/resources resource-group
200	res/search search-service
201	res/security-insights data-connector
202	res/security-insights setting
203	res/service-bus namespace
204	res/service-fabric cluster
205	res/service-networking traffic-controller
206	res/signal-r-service signal-r
207	res/signal-r-service web-pub-sub
208	res/sql instance-pool
209	res/sql managed-instance
210	res/sql server
211	res/storage storage-account
212	res/synapse private-link-hub
213	res/synapse workspace
214	res/virtual-machine-images image-template
215	res/web connection
216	res/web hosting-environment
217	res/web serverfarm
218	res/web site
219	res/web static-site
220	utl/types avm-common-types

Bicep Resource Modules

Module catalog

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Bicep	Resource	170	23	193

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Info

This page contains various views of the module index (catalog) for Bicep Resource Modules. To see these views, click on the expandable sections with the “➕” sign below.

To see the full, unfiltered, unformatted module index on GitHub, click here.
To download the source CSV file, click here.

Note

Modules listed below that aren’t shown with the status of Module Available 🟢, are currently in development and are not yet available for use. For proposed modules, see the Proposed modules section below.

Published modules - 🟢 & 🟡

➕ Published Modules - Module names, status and owners

No.	Module Name	Display Name	Owner(s)
01	avm/res/aad/domain-service	Azure Active Directory Domain Service AAD, Entra ID, Microsoft Entra Domain Services, AAD DS, Azure AD DS	ReneHezser Rene Hezser CRYP70N1X Paul Chirila
02	avm/res/alerts-management/action-rule	Action Rules	judyer28 Justin Dyer
03	avm/res/analysis-services/server	Analysis Services Server
04	avm/res/api-management/service ▶ api diagnostics operation policy policy api-version-set authorization-server backend cache diagnostics identity-provider logger named-value policy portalsetting private-endpoint-connection product api group policy subscription workspace api diagnostics operation policy policy api-version-set backend diagnostics logger named-value policy product api-link group-link policy subscription	API Management Service	abhishekaryams Abhishek Arya
05	avm/res/app-configuration/configuration-store ▶ key-value replica	App Configuration Store	Jfolberth John Folberth
06	avm/res/app/container-app ▶ auth-config	Container App	oZakari Zach Trocinski
07	avm/res/app/job	App Job	ReneHezser Rene Hezser
08	avm/res/app/managed-environment ▶ certificate storage	App Managed Environment	abhishekaryams Abhishek Arya
09	avm/res/app/session-pool	App Session Pool	abhishekaryams Abhishek Arya
10	avm/res/authorization/policy-assignment ▶ mg-scope rg-scope sub-scope	Authorization - Policy Assignment	AlexanderSehr Alexander Sehr
11	avm/res/authorization/role-assignment ▶ mg-scope rg-scope sub-scope	Authorization - Role Assignment	arnoldna Nate Arnold
12	avm/res/automation/automation-account ▶ credential hybrid-runbook-worker-group hybrid-runbook-worker job-schedule module powershell72-module python2-package python3-package runbook schedule source-control variable webhook	Automation Account	gpacetti Giuseppe Pacetti
13	avm/res/azure-stack-hci/cluster ▶ arc-setting/extension deployment-setting	Azure Stack HCI Cluster	chirag1603 Chirag Choudha
14	avm/res/azure-stack-hci/logical-network	Azure Stack HCI Logical Network	chirag1603 Chirag Choudha
15	avm/res/azure-stack-hci/marketplace-gallery-image	Azure Stack HCI Marketplace Gallery Image	chirag1603 Chirag Choudha
16	avm/res/azure-stack-hci/network-interface	Azure Stack HCI Network Interface	chirag1603 Chirag Choudha
17	avm/res/azure-stack-hci/virtual-hard-disk	Azure Stack HCI Hard Disk	chirag1603 Chirag Choudha
18	avm/res/azure-stack-hci/virtual-machine-instance	Azure Stack HCI Virtual Machine Instance	chirag1603 Chirag Choudha
19	avm/res/batch/batch-account	Batch Account	didayal-msft Divyadeep Dayal
20	avm/res/cache/redis ▶ access-policy access-policy-assignment firewall-rule linked-server	Redis Cache	TomazMlakar Tomaz Mlakar
21	avm/res/cache/redis-enterprise ▶ database access-policy-assignment	Redis Enterprise Cache	JeffreyCA Jeffrey Chen
22	avm/res/cdn/profile ▶ afd-endpoint route custom-domain endpoint origin origin-group origin rule-set rule secret security-policy	CDN Profile Azure Front Door	gbeaud Guillaume Beaud
23	avm/res/cognitive-services/account ▶ project	Azure AI Services (Cognitive Services) AI Foundry	mswantek68 Mike Swantek chanakanissanka Chanaka Nissanka
24	avm/res/communication/communication-service	Communication Service	donk-msft Don Koning
25	avm/res/communication/email-service ▶ domain sender-username	Email Communication Service	donk-msft Don Koning
26	avm/res/compute/availability-set	Availability Set AS	ahmadabdalla Ahmad Abdalla
27	avm/res/compute/disk	Compute Disk	segraef Sebastian Graef
28	avm/res/compute/disk-encryption-set	Disk Encryption Set	segraef Sebastian Graef
29	avm/res/compute/gallery ▶ application image	Azure Compute Gallery	ReneHezser Rene Hezser
30	avm/res/compute/image	Image	tony-box Tony Box
31	avm/res/compute/proximity-placement-group	Proximity Placement Group	jeetgarg Jeet Garg
32	avm/res/compute/ssh-public-key	Public SSH Key	ChrisSidebotham Chris Sidebotham
33	avm/res/compute/virtual-machine ▶ extension	Virtual Machine VM	josunefon Jordi Sune Fontanals
34	avm/res/compute/virtual-machine-scale-set ▶ extension	Virtual Machine Scale Set VMSS	josunefon Jordi Sune Fontanals
35	avm/res/consumption/budget ▶ mg-scope rg-scope sub-scope	Consumption Budget	segraef Sebastian Graef
36	avm/res/container-instance/container-group	Container Instance ACI	JPEasier Julian Peißker
37	avm/res/container-registry/registry ▶ cache-rule credential-set replication scope-map task token webhook	Azure Container Registry (ACR)	JPEasier Julian Peißker
38	avm/res/container-service/managed-cluster ▶ agent-pool maintenance-configuration	Azure Kubernetes Service (AKS) Managed Cluster	JPEasier Julian Peißker
39	avm/res/data-factory/factory ▶ integration-runtime linked-service managed-virtual-network managed-private-endpoint	Data Factory	TomazMlakar Tomaz Mlakar
40	avm/res/data-protection/backup-vault ▶ backup-instance backup-policy	Data Protection Backup Vault	abhishekaryams Abhishek Arya
41	avm/res/databricks/access-connector	Azure Databricks Access Connector	abhishekaryams Abhishek Arya
42	avm/res/databricks/workspace	Azure Databricks Workspace	abhishekaryams Abhishek Arya
43	avm/res/db-for-my-sql/flexible-server ▶ administrator advanced-threat-protection configuration database firewall-rule	DB for MySQL Flexible Server	abhishekaryams Abhishek Arya
44	avm/res/db-for-postgre-sql/flexible-server ▶ administrator advanced-threat-protection-setting configuration database firewall-rule	DB for Postgre SQL Flexible Server	arnoldna Nate Arnold
45	avm/res/desktop-virtualization/application-group ▶ application	Azure Virtual Desktop (AVD) Application Group
46	avm/res/desktop-virtualization/host-pool	Azure Virtual Desktop (AVD) Host Pool
47	avm/res/desktop-virtualization/scaling-plan	Azure Virtual Desktop (AVD) Scaling Plan
48	avm/res/desktop-virtualization/workspace	Azure Virtual Desktop (AVD) Workspace	reikor0x Vincenzo Sciarra
49	avm/res/dev-center/devcenter ▶ attachednetwork catalog devboxdefinition environment-type gallery project-policy	Dev Center	ahmadabdalla Ahmad Abdalla
50	avm/res/dev-center/network-connection	Dev Center Network Connection	ahmadabdalla Ahmad Abdalla
51	avm/res/dev-center/project ▶ catalog environment-type pool schedule	Dev Center Project	ahmadabdalla Ahmad Abdalla
52	avm/res/dev-ops-infrastructure/pool	DevOps Infrastructure Pool	elizatargithub7 Eliza Tarasila
53	avm/res/dev-test-lab/lab ▶ artifactsource cost notificationchannel policyset/policy schedule secret virtualnetwork	DevTest Lab	ahmadabdalla Ahmad Abdalla
54	avm/res/devices/iot-hub	IoT Hub	TomazMlakar Tomaz Mlakar
55	avm/res/digital-twins/digital-twins-instance ▶ endpoint	Digital Twins Instance	ryanmstephens Ryan Stephens
56	avm/res/document-db/database-account ▶ cassandra-keyspace table view cassandra-role-assignment cassandra-role-definition gremlin-database graph mongodb-database collection sql-database container sql-role-assignment sql-role-definition table	Cosmos DB Database Account	cmaneu Christopher Maneu
57	avm/res/document-db/mongo-cluster ▶ firewall-rule user	Cosmos DB for MongoDB (vCore)	sinedied Yohan Lasorsa
58	avm/res/elastic-san/elastic-san ▶ volume-group snapshot volume	Elastic SAN SAN, ESAN, Elastic SAN, Azure Elastic Storage Area Network, iSCSI, internet Small Computer Systems Interface	jbinko Jiri Binko
59	avm/res/event-grid/domain ▶ event-subscription topic	Event Grid Domain	fabmas Fabio Masciotra
60	avm/res/event-grid/namespace ▶ ca-certificate client client-group permission-binding topic event-subscription topic-space	Event Grid Namespace	fabmas Fabio Masciotra
61	avm/res/event-grid/system-topic ▶ event-subscription	Event Grid System Topic	fabmas Fabio Masciotra
62	avm/res/event-grid/topic ▶ event-subscription	Event Grid Topic	fabmas Fabio Masciotra
63	avm/res/event-hub/namespace ▶ authorization-rule disaster-recovery-config eventhub authorization-rule consumergroup network-rule-set	Event Hub Namespace	abhishekaryams Abhishek Arya
64	avm/res/fabric/capacity	Fabric	mswantek68 Mike Swantek cmaneu Christopher Maneu
65	avm/res/health-bot/health-bot	Azure Health Bot	TomazMlakar Tomaz Mlakar
66	avm/res/healthcare-apis/workspace ▶ dicomservice fhirservice iotconnector fhirdestination	Healthcare API Workspace
67	avm/res/hybrid-compute/gateway	Hybrid Compute Gateway	chirag1603 Chirag Choudha
68	avm/res/hybrid-compute/license	Hybrid Compute License	chirag1603 Chirag Choudha
69	avm/res/hybrid-compute/machine ▶ extension	Hybrid Compute Machine	chirag1603 Chirag Choudha
70	avm/res/hybrid-container-service/provisioned-cluster-instance	Hybrid Container Service - Provisioned Cluster Instance	chirag1603 Chirag Choudha
71	avm/res/insights/action-group	Action Group	rahalan Rainer Halanek
72	avm/res/insights/activity-log-alert	Activity Log Alert	donk-msft Don Koning
73	avm/res/insights/component ▶ linked-storage-account	Application Insight	krbar Kris Baranek
74	avm/res/insights/data-collection-endpoint	Data Collection Endpoint	krbar Kris Baranek
75	avm/res/insights/data-collection-rule	Data Collection Rule DCR	krbar Kris Baranek
76	avm/res/insights/diagnostic-setting	Diagnostic Setting	krbar Kris Baranek
77	avm/res/insights/metric-alert	Metric Alert	kijunkang Ki Jun Kang
78	avm/res/insights/private-link-scope ▶ scoped-resource	Azure Monitor Private Link Scope	ahmadabdalla Ahmad Abdalla
79	avm/res/insights/scheduled-query-rule	Scheduled Query Rule	abhishekaryams Abhishek Arya
80	avm/res/insights/webtest	Web Test	Jfolberth John Folberth
81	avm/res/key-vault/vault ▶ access-policy key secret	Key Vault KV	fblix Felix Borst
82	avm/res/kubernetes-configuration/extension	Kubernetes Configuration Extension	JPEasier Julian Peißker
83	avm/res/kubernetes-configuration/flux-configuration	Kubernetes Configuration Flux Configuration	JPEasier Julian Peißker
84	avm/res/kubernetes-runtime/load-balancer	Kubernetes Runtime Load Balancer	chirag1603 Chirag Choudha
85	avm/res/kubernetes/connected-cluster	Kubernetes Connected Cluster	chirag1603 Chirag Choudha
86	avm/res/kusto/cluster ▶ database principal-assignment principal-assignment	Azure Data Explorer (Kusto) cluster	oZakari Zach Trocinski
87	avm/res/load-test-service/load-test	Load Testing Service	sebassem Seif Bassem
88	avm/res/logic/integration-account ▶ agreement assembly certificate map partner schema	Logic Apps Integration Account	lsnoddy Luke Snoddy
89	avm/res/logic/workflow	Logic Apps Workflow	lsnoddy Luke Snoddy
90	avm/res/machine-learning-services/registry	Machine Learning Services Registry	josunefon Jordi Sune Fontanals
91	avm/res/machine-learning-services/workspace ▶ compute connection datastore	Machine Learning Services Workspace ML Workspace	cecheta Chinedum Echeta ross-p-smith Ross Smith
92	avm/res/maintenance/configuration-assignment	Maintenance Configuration Assignment	eriqua Erika Gressi
93	avm/res/maintenance/maintenance-configuration	Maintenance Configuration	arievanderwende Arie van der Wende
94	avm/res/managed-identity/user-assigned-identity ▶ federated-identity-credential	User Assigned Identity MSI	gpacetti Giuseppe Pacetti
95	avm/res/managed-services/registration-definition	Registration Definition (Lighthouse)
96	avm/res/management/management-group	Management Group MG	fblix Felix Borst
97	avm/res/management/service-group	Service Group	jtracey93 Jack Tracey
98	avm/res/maps/account	Azure Maps Account	jhueppauff Julian Huppauff
99	avm/res/net-app/net-app-account ▶ backup-policy backup-vault backup capacity-pool volume snapshot-policy	Azure NetApp File	fbinotto Felipe Binotto
100	avm/res/network/application-gateway	Application Gateway App GW	toddbeauchemin Todd Beauchemin
101	avm/res/network/application-gateway-web-application-firewall-policy	Application Gateway Web Application Firewall (WAF) Policy	toddbeauchemin Todd Beauchemin
102	avm/res/network/application-security-group	Application Security Group (ASG) ASG	segraef Sebastian Graef
103	avm/res/network/azure-firewall	Azure Firewall Azure FW	jtracey93 Jack Tracey oZakari Zach Trocinski
104	avm/res/network/bastion-host	Bastion Host	krbar Kris Baranek
105	avm/res/network/connection	Virtual Network Gateway Connection	fabmas Fabio Masciotra
106	avm/res/network/ddos-protection-plan	DDoS Protection Plan	segraef Sebastian Graef
107	avm/res/network/dns-forwarding-ruleset ▶ forwarding-rule virtual-network-link	DNS Forwarding Ruleset	ChrisSidebotham Chris Sidebotham
108	avm/res/network/dns-resolver ▶ inbound-endpoint outbound-endpoint	DNS Resolver	ChrisSidebotham Chris Sidebotham
109	avm/res/network/dns-zone ▶ a aaaa caa cname dnssec-config mx ns ptr soa srv txt	Public DNS Zone	ChrisSidebotham Chris Sidebotham
110	avm/res/network/express-route-circuit	ExpressRoute Circuit ER Circuit	arnoldna Nate Arnold
111	avm/res/network/express-route-gateway	Express Route Gateway ER GW	arnoldna Nate Arnold
112	avm/res/network/express-route-port	ExpressRoute Port ER Port	arnoldna Nate Arnold
113	avm/res/network/firewall-policy ▶ rule-collection-group	Firewall Policy	jtracey93 Jack Tracey oZakari Zach Trocinski
114	avm/res/network/front-door-web-application-firewall-policy	Front Door Web Application Firewall (WAF) Policy	PaulJohnston88 Paul Johnston
115	avm/res/network/ip-group	IP Group	ahmadabdalla Ahmad Abdalla
116	avm/res/network/load-balancer ▶ backend-address-pool inbound-nat-rule	Load Balancer LB, NLB	arnoldna Nate Arnold
117	avm/res/network/local-network-gateway	Local Network Gateway	fabmas Fabio Masciotra
118	avm/res/network/nat-gateway	NAT Gateway NAT GW	fabmas Fabio Masciotra
119	avm/res/network/network-interface	Network Interface NIC	rahalan Rainer Halanek
120	avm/res/network/network-manager ▶ connectivity-configuration network-group static-member routing-configuration rule-collection rule scope-connection security-admin-configuration rule-collection rule	Network Manager	ahmadabdalla Ahmad Abdalla
121	avm/res/network/network-security-group	Network Security Group NSG	ahmadabdalla Ahmad Abdalla
122	avm/res/network/network-security-perimeter ▶ profile access-rule	Network Security Perimeter	peterbud Peter Budai
123	avm/res/network/network-watcher ▶ connection-monitor flow-log	Network Watcher	segraef Sebastian Graef
124	avm/res/network/p2s-vpn-gateway	P2S VPN Gateway	ericscheffler Eric Scheffler
125	avm/res/network/private-dns-zone ▶ a aaaa cname mx ptr soa srv txt virtual-network-link	Private DNS Zone	ChrisSidebotham Chris Sidebotham
126	avm/res/network/private-endpoint ▶ private-dns-zone-group	Private Endpoint	segraef Sebastian Graef
127	avm/res/network/private-link-service	Private Link Service	ahmadabdalla Ahmad Abdalla
128	avm/res/network/public-ip-address	Public IP Address PIP	ChrisSidebotham Chris Sidebotham krbar Kris Baranek
129	avm/res/network/public-ip-prefix	Public IP Prefix PIP Prefix	krbar Kris Baranek
130	avm/res/network/route-table	Route Table UDR	segraef Sebastian Graef
131	avm/res/network/service-endpoint-policy	Service Endpoint Policy	jeetgarg Jeet Garg
132	avm/res/network/trafficmanagerprofile	Traffic Manager Profile	lsnoddy Luke Snoddy
133	avm/res/network/virtual-hub ▶ hub-route-table hub-virtual-network-connection route-map routing-intent	Virtual Hub	arnoldna Nate Arnold
134	avm/res/network/virtual-network ▶ subnet virtual-network-peering	Virtual Network VNET	mjrich19 MJ Richardson
135	avm/res/network/virtual-network-gateway ▶ nat-rule	Virtual Network Gateway VNET GW	fabmas Fabio Masciotra
136	avm/res/network/virtual-wan	Virtual WAN vWAN	arnoldna Nate Arnold
137	avm/res/network/vpn-gateway ▶ nat-rule vpn-connection	VPN Gateway VPN GW	fabmas Fabio Masciotra
138	avm/res/network/vpn-server-configuration	VPN Server Configuration	ericscheffler Eric Scheffler
139	avm/res/network/vpn-site	VPN Site	fabmas Fabio Masciotra
140	avm/res/operational-insights/cluster	Log Analytics Dedicated Cluster	abhishekaryams Abhishek Arya
141	avm/res/operational-insights/workspace ▶ data-export data-source linked-service linked-storage-account saved-search storage-insight-config table	Log Analytics Workspace	krbar Kris Baranek
142	avm/res/operations-management/solution	Operations Management Solution	krbar Kris Baranek
143	avm/res/portal/dashboard	Portal Dashboard	krbar Kris Baranek
144	avm/res/power-bi-dedicated/capacity	Power BI Dedicated Capacity	ChrisSidebotham Chris Sidebotham
145	avm/res/purview/account	Purview Account	abhishekaryams Abhishek Arya
146	avm/res/recovery-services/vault ▶ backup-config backup-fabric/protection-container/protected-item backup-policy replication-alert-setting replication-fabric replication-protection-container replication-protection-container-mapping replication-policy	Recovery Services Vault	alexanderojala Alexander Ojala
147	avm/res/relay/namespace ▶ authorization-rule hybrid-connection authorization-rule network-rule-set wcf-relay authorization-rule	Relay Namespace
148	avm/res/resource-graph/query	Resource Graph Query	sebassem Seif Bassem
149	avm/res/resources/deployment-script	Deployment Script	sebassem Seif Bassem
150	avm/res/resources/resource-group	Resource Group RG	segraef Sebastian Graef
151	avm/res/search/search-service ▶ shared-private-link-resource	Search Service	krbar Kris Baranek
152	avm/res/security-insights/data-connector	Security Insights - Data Connector
153	avm/res/security-insights/setting	Security Insights - Setting	TomazMlakar Tomaz Mlakar
154	avm/res/service-bus/namespace ▶ authorization-rule disaster-recovery-config migration-configuration network-rule-set queue authorization-rule topic authorization-rule subscription rule	Service Bus Namespace	ChrisSidebotham Chris Sidebotham
155	avm/res/service-fabric/cluster ▶ application-type	Service Fabric Cluster	lsnoddy Luke Snoddy
156	avm/res/service-networking/traffic-controller ▶ association frontend security-policy	Application Gateway for Containers (Traffic Controller)	krbar Kris Baranek
157	avm/res/signal-r-service/signal-r	SignalR Service SignalR
158	avm/res/signal-r-service/web-pub-sub	SignalR Web PubSub Service
159	avm/res/sql/instance-pool	SQL Instance Pool	gpacetti Giuseppe Pacetti
160	avm/res/sql/managed-instance ▶ database backup-long-term-retention-policy backup-short-term-retention-policy encryption-protector key security-alert-policy vulnerability-assessment	SQL Managed Instance SQL MI	chanakanissanka Chanaka Nissanka
161	avm/res/sql/server ▶ auditing-setting database backup-long-term-retention-policy backup-short-term-retention-policy elastic-pool encryption-protector failover-group firewall-rule key security-alert-policy virtual-network-rule vulnerability-assessment	Azure SQL Server	peterbud Peter Budai
162	avm/res/storage/storage-account ▶ blob-service container immutability-policy file-service share local-user management-policy object-replication-policy policy queue-service queue table-service table	Storage Account	fblix Felix Borst
163	avm/res/synapse/private-link-hub	Azure Synapse Analytics Private Link Hub	TomazMlakar Tomaz Mlakar
164	avm/res/synapse/workspace ▶ administrator big-data-pool firewall-rule integration-runtime key sql-pool	Azure Synapse Analytics Workspace	TomazMlakar Tomaz Mlakar
165	avm/res/virtual-machine-images/image-template	Virtual Machine Image Template	ahmadabdalla Ahmad Abdalla
166	avm/res/web/connection	API Connection	abhishekaryams Abhishek Arya
167	avm/res/web/hosting-environment ▶ configuration	App Service Environment ASE	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
168	avm/res/web/serverfarm	App Service Plan	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
169	avm/res/web/site ▶ basic-publishing-credentials-policy config extension hybrid-connection-namespace/relay slot basic-publishing-credentials-policy config extension hybrid-connection-namespace/relay	Web/Function App App Service, Web Site, Logic App, Function App	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
170	avm/res/web/static-site ▶ config custom-domain linked-backend	Static Web App	ChrisSidebotham Chris Sidebotham

Proposed modules - ⚪

➕ Proposed Modules - Module names, status and owners

No.	Module Name	Display Name	Owner(s)
01	avm/res/api-center/service	API Center Service	maciejporebski Maciej Porebski
02	avm/res/app/agent	Azure SRE Agent	FallenHoot Zach Olinske
03	avm/res/avs/private-cloud	AVS Private Cloud	jchancellor-ms Jon Chancellor
04	avm/res/bot-service/bot-service	Bot Service	AnkitSDesai Ankit Desai asishr Asish R
05	avm/res/chaos/experiment	Chaos Experiment Azure Chaos Studio, Chaos Engineering	jbinko Jiri Binko
06	avm/res/code-signing/code-signing-account	Azure Artifact Signing
07	avm/res/dashboard/grafana	Azure Managed Grafana	vlahane Vishal Lahane
08	avm/res/data-protection/resource-guard	Data Protection Resource Guard
09	avm/res/durable-task/scheduler	Durable Task Scheduler	greenie-msft Nick Greenfield
10	avm/res/edge-order/order-item	Edge Order Item	chirag1603 Chirag Choudha
11	avm/res/edge/configuration	Edge Configuration	chirag1603 Chirag Choudha
12	avm/res/edge/site ▶ rg-scope sub-scope	Edge Site	chirag1603 Chirag Choudha
13	avm/res/hybrid-compute/private-link-scope	Hybrid Compute Private Link Scope	chirag1603 Chirag Choudha
14	avm/res/hybrid-compute/setting	Hybrid Compute Setting	chirag1603 Chirag Choudha
15	avm/res/insights/autoscale-setting	Insights - Auto Scale Setting	FallenHoot Zach Olinske
16	avm/res/iot-operations/instance	IoT Operations Instance	agreaves-ms Allen Greaves
17	avm/res/key-vault/managed-hsm	Managed HSM	ns-github-design Nasreen Sarah
18	avm/res/kubernetes-runtime/bpg-peer	Kubernetes Runtime BGP Peer	chirag1603 Chirag Choudha
19	avm/res/kubernetes-runtime/service	Kubernetes Runtime Service	chirag1603 Chirag Choudha
20	avm/res/scom/managed-instance	SCOM MI System Center Operations Manager - Managed Instance
21	avm/res/security-insights/onboarding-state	Security Insights - Onboarding State
22	avm/res/sql-virtual-machine/sql-virtual-machine	SQL Virtual Machine SQL VM	peterbud Peter Budai
23	avm/res/stream-analytics/streaming-job	Stream Analytics Job

Deprecated modules - 🔴

➕ Deprecated Modules - Module names, status and owners

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/res/network/front-door	Azure Front Door

All modules - 📇

➕ All Modules - Module names, status and owners

No.	Module Name	Display Name	Owner(s)
01	avm/res/aad/domain-service	Azure Active Directory Domain Service AAD, Entra ID, Microsoft Entra Domain Services, AAD DS, Azure AD DS	ReneHezser Rene Hezser CRYP70N1X Paul Chirila
02	avm/res/alerts-management/action-rule	Action Rules	judyer28 Justin Dyer
03	avm/res/analysis-services/server	Analysis Services Server
04	avm/res/api-center/service	API Center Service	maciejporebski Maciej Porebski
05	avm/res/api-management/service ▶ api diagnostics operation policy policy api-version-set authorization-server backend cache diagnostics identity-provider logger named-value policy portalsetting private-endpoint-connection product api group policy subscription workspace api diagnostics operation policy policy api-version-set backend diagnostics logger named-value policy product api-link group-link policy subscription	API Management Service	abhishekaryams Abhishek Arya
06	avm/res/app-configuration/configuration-store ▶ key-value replica	App Configuration Store	Jfolberth John Folberth
07	avm/res/app/agent	Azure SRE Agent	FallenHoot Zach Olinske
08	avm/res/app/container-app ▶ auth-config	Container App	oZakari Zach Trocinski
09	avm/res/app/job	App Job	ReneHezser Rene Hezser
10	avm/res/app/managed-environment ▶ certificate storage	App Managed Environment	abhishekaryams Abhishek Arya
11	avm/res/app/session-pool	App Session Pool	abhishekaryams Abhishek Arya
12	avm/res/authorization/policy-assignment ▶ mg-scope rg-scope sub-scope	Authorization - Policy Assignment	AlexanderSehr Alexander Sehr
13	avm/res/authorization/role-assignment ▶ mg-scope rg-scope sub-scope	Authorization - Role Assignment	arnoldna Nate Arnold
14	avm/res/automation/automation-account ▶ credential hybrid-runbook-worker-group hybrid-runbook-worker job-schedule module powershell72-module python2-package python3-package runbook schedule source-control variable webhook	Automation Account	gpacetti Giuseppe Pacetti
15	avm/res/avs/private-cloud	AVS Private Cloud	jchancellor-ms Jon Chancellor
16	avm/res/azure-stack-hci/cluster ▶ arc-setting/extension deployment-setting	Azure Stack HCI Cluster	chirag1603 Chirag Choudha
17	avm/res/azure-stack-hci/logical-network	Azure Stack HCI Logical Network	chirag1603 Chirag Choudha
18	avm/res/azure-stack-hci/marketplace-gallery-image	Azure Stack HCI Marketplace Gallery Image	chirag1603 Chirag Choudha
19	avm/res/azure-stack-hci/network-interface	Azure Stack HCI Network Interface	chirag1603 Chirag Choudha
20	avm/res/azure-stack-hci/virtual-hard-disk	Azure Stack HCI Hard Disk	chirag1603 Chirag Choudha
21	avm/res/azure-stack-hci/virtual-machine-instance	Azure Stack HCI Virtual Machine Instance	chirag1603 Chirag Choudha
22	avm/res/batch/batch-account	Batch Account	didayal-msft Divyadeep Dayal
23	avm/res/bot-service/bot-service	Bot Service	AnkitSDesai Ankit Desai asishr Asish R
24	avm/res/cache/redis ▶ access-policy access-policy-assignment firewall-rule linked-server	Redis Cache	TomazMlakar Tomaz Mlakar
25	avm/res/cache/redis-enterprise ▶ database access-policy-assignment	Redis Enterprise Cache	JeffreyCA Jeffrey Chen
26	avm/res/cdn/profile ▶ afd-endpoint route custom-domain endpoint origin origin-group origin rule-set rule secret security-policy	CDN Profile Azure Front Door	gbeaud Guillaume Beaud
27	avm/res/chaos/experiment	Chaos Experiment Azure Chaos Studio, Chaos Engineering	jbinko Jiri Binko
28	avm/res/code-signing/code-signing-account	Azure Artifact Signing
29	avm/res/cognitive-services/account ▶ project	Azure AI Services (Cognitive Services) AI Foundry	mswantek68 Mike Swantek chanakanissanka Chanaka Nissanka
30	avm/res/communication/communication-service	Communication Service	donk-msft Don Koning
31	avm/res/communication/email-service ▶ domain sender-username	Email Communication Service	donk-msft Don Koning
32	avm/res/compute/availability-set	Availability Set AS	ahmadabdalla Ahmad Abdalla
33	avm/res/compute/disk	Compute Disk	segraef Sebastian Graef
34	avm/res/compute/disk-encryption-set	Disk Encryption Set	segraef Sebastian Graef
35	avm/res/compute/gallery ▶ application image	Azure Compute Gallery	ReneHezser Rene Hezser
36	avm/res/compute/image	Image	tony-box Tony Box
37	avm/res/compute/proximity-placement-group	Proximity Placement Group	jeetgarg Jeet Garg
38	avm/res/compute/ssh-public-key	Public SSH Key	ChrisSidebotham Chris Sidebotham
39	avm/res/compute/virtual-machine ▶ extension	Virtual Machine VM	josunefon Jordi Sune Fontanals
40	avm/res/compute/virtual-machine-scale-set ▶ extension	Virtual Machine Scale Set VMSS	josunefon Jordi Sune Fontanals
41	avm/res/consumption/budget ▶ mg-scope rg-scope sub-scope	Consumption Budget	segraef Sebastian Graef
42	avm/res/container-instance/container-group	Container Instance ACI	JPEasier Julian Peißker
43	avm/res/container-registry/registry ▶ cache-rule credential-set replication scope-map task token webhook	Azure Container Registry (ACR)	JPEasier Julian Peißker
44	avm/res/container-service/managed-cluster ▶ agent-pool maintenance-configuration	Azure Kubernetes Service (AKS) Managed Cluster	JPEasier Julian Peißker
45	avm/res/dashboard/grafana	Azure Managed Grafana	vlahane Vishal Lahane
46	avm/res/data-factory/factory ▶ integration-runtime linked-service managed-virtual-network managed-private-endpoint	Data Factory	TomazMlakar Tomaz Mlakar
47	avm/res/data-protection/backup-vault ▶ backup-instance backup-policy	Data Protection Backup Vault	abhishekaryams Abhishek Arya
48	avm/res/data-protection/resource-guard	Data Protection Resource Guard
49	avm/res/databricks/access-connector	Azure Databricks Access Connector	abhishekaryams Abhishek Arya
50	avm/res/databricks/workspace	Azure Databricks Workspace	abhishekaryams Abhishek Arya
51	avm/res/db-for-my-sql/flexible-server ▶ administrator advanced-threat-protection configuration database firewall-rule	DB for MySQL Flexible Server	abhishekaryams Abhishek Arya
52	avm/res/db-for-postgre-sql/flexible-server ▶ administrator advanced-threat-protection-setting configuration database firewall-rule	DB for Postgre SQL Flexible Server	arnoldna Nate Arnold
53	avm/res/desktop-virtualization/application-group ▶ application	Azure Virtual Desktop (AVD) Application Group
54	avm/res/desktop-virtualization/host-pool	Azure Virtual Desktop (AVD) Host Pool
55	avm/res/desktop-virtualization/scaling-plan	Azure Virtual Desktop (AVD) Scaling Plan
56	avm/res/desktop-virtualization/workspace	Azure Virtual Desktop (AVD) Workspace	reikor0x Vincenzo Sciarra
57	avm/res/dev-center/devcenter ▶ attachednetwork catalog devboxdefinition environment-type gallery project-policy	Dev Center	ahmadabdalla Ahmad Abdalla
58	avm/res/dev-center/network-connection	Dev Center Network Connection	ahmadabdalla Ahmad Abdalla
59	avm/res/dev-center/project ▶ catalog environment-type pool schedule	Dev Center Project	ahmadabdalla Ahmad Abdalla
60	avm/res/dev-ops-infrastructure/pool	DevOps Infrastructure Pool	elizatargithub7 Eliza Tarasila
61	avm/res/dev-test-lab/lab ▶ artifactsource cost notificationchannel policyset/policy schedule secret virtualnetwork	DevTest Lab	ahmadabdalla Ahmad Abdalla
62	avm/res/devices/iot-hub	IoT Hub	TomazMlakar Tomaz Mlakar
63	avm/res/digital-twins/digital-twins-instance ▶ endpoint	Digital Twins Instance	ryanmstephens Ryan Stephens
64	avm/res/document-db/database-account ▶ cassandra-keyspace table view cassandra-role-assignment cassandra-role-definition gremlin-database graph mongodb-database collection sql-database container sql-role-assignment sql-role-definition table	Cosmos DB Database Account	cmaneu Christopher Maneu
65	avm/res/document-db/mongo-cluster ▶ firewall-rule user	Cosmos DB for MongoDB (vCore)	sinedied Yohan Lasorsa
66	avm/res/durable-task/scheduler	Durable Task Scheduler	greenie-msft Nick Greenfield
67	avm/res/edge-order/order-item	Edge Order Item	chirag1603 Chirag Choudha
68	avm/res/edge/configuration	Edge Configuration	chirag1603 Chirag Choudha
69	avm/res/edge/site ▶ rg-scope sub-scope	Edge Site	chirag1603 Chirag Choudha
70	avm/res/elastic-san/elastic-san ▶ volume-group snapshot volume	Elastic SAN SAN, ESAN, Elastic SAN, Azure Elastic Storage Area Network, iSCSI, internet Small Computer Systems Interface	jbinko Jiri Binko
71	avm/res/event-grid/domain ▶ event-subscription topic	Event Grid Domain	fabmas Fabio Masciotra
72	avm/res/event-grid/namespace ▶ ca-certificate client client-group permission-binding topic event-subscription topic-space	Event Grid Namespace	fabmas Fabio Masciotra
73	avm/res/event-grid/system-topic ▶ event-subscription	Event Grid System Topic	fabmas Fabio Masciotra
74	avm/res/event-grid/topic ▶ event-subscription	Event Grid Topic	fabmas Fabio Masciotra
75	avm/res/event-hub/namespace ▶ authorization-rule disaster-recovery-config eventhub authorization-rule consumergroup network-rule-set	Event Hub Namespace	abhishekaryams Abhishek Arya
76	avm/res/fabric/capacity	Fabric	mswantek68 Mike Swantek cmaneu Christopher Maneu
77	avm/res/health-bot/health-bot	Azure Health Bot	TomazMlakar Tomaz Mlakar
78	avm/res/healthcare-apis/workspace ▶ dicomservice fhirservice iotconnector fhirdestination	Healthcare API Workspace
79	avm/res/hybrid-compute/gateway	Hybrid Compute Gateway	chirag1603 Chirag Choudha
80	avm/res/hybrid-compute/license	Hybrid Compute License	chirag1603 Chirag Choudha
81	avm/res/hybrid-compute/machine ▶ extension	Hybrid Compute Machine	chirag1603 Chirag Choudha
82	avm/res/hybrid-compute/private-link-scope	Hybrid Compute Private Link Scope	chirag1603 Chirag Choudha
83	avm/res/hybrid-compute/setting	Hybrid Compute Setting	chirag1603 Chirag Choudha
84	avm/res/hybrid-container-service/provisioned-cluster-instance	Hybrid Container Service - Provisioned Cluster Instance	chirag1603 Chirag Choudha
85	avm/res/insights/action-group	Action Group	rahalan Rainer Halanek
86	avm/res/insights/activity-log-alert	Activity Log Alert	donk-msft Don Koning
87	avm/res/insights/autoscale-setting	Insights - Auto Scale Setting	FallenHoot Zach Olinske
88	avm/res/insights/component ▶ linked-storage-account	Application Insight	krbar Kris Baranek
89	avm/res/insights/data-collection-endpoint	Data Collection Endpoint	krbar Kris Baranek
90	avm/res/insights/data-collection-rule	Data Collection Rule DCR	krbar Kris Baranek
91	avm/res/insights/diagnostic-setting	Diagnostic Setting	krbar Kris Baranek
92	avm/res/insights/metric-alert	Metric Alert	kijunkang Ki Jun Kang
93	avm/res/insights/private-link-scope ▶ scoped-resource	Azure Monitor Private Link Scope	ahmadabdalla Ahmad Abdalla
94	avm/res/insights/scheduled-query-rule	Scheduled Query Rule	abhishekaryams Abhishek Arya
95	avm/res/insights/webtest	Web Test	Jfolberth John Folberth
96	avm/res/iot-operations/instance	IoT Operations Instance	agreaves-ms Allen Greaves
97	avm/res/key-vault/managed-hsm	Managed HSM	ns-github-design Nasreen Sarah
98	avm/res/key-vault/vault ▶ access-policy key secret	Key Vault KV	fblix Felix Borst
99	avm/res/kubernetes-configuration/extension	Kubernetes Configuration Extension	JPEasier Julian Peißker
100	avm/res/kubernetes-configuration/flux-configuration	Kubernetes Configuration Flux Configuration	JPEasier Julian Peißker
101	avm/res/kubernetes-runtime/bpg-peer	Kubernetes Runtime BGP Peer	chirag1603 Chirag Choudha
102	avm/res/kubernetes-runtime/load-balancer	Kubernetes Runtime Load Balancer	chirag1603 Chirag Choudha
103	avm/res/kubernetes-runtime/service	Kubernetes Runtime Service	chirag1603 Chirag Choudha
104	avm/res/kubernetes/connected-cluster	Kubernetes Connected Cluster	chirag1603 Chirag Choudha
105	avm/res/kusto/cluster ▶ database principal-assignment principal-assignment	Azure Data Explorer (Kusto) cluster	oZakari Zach Trocinski
106	avm/res/load-test-service/load-test	Load Testing Service	sebassem Seif Bassem
107	avm/res/logic/integration-account ▶ agreement assembly certificate map partner schema	Logic Apps Integration Account	lsnoddy Luke Snoddy
108	avm/res/logic/workflow	Logic Apps Workflow	lsnoddy Luke Snoddy
109	avm/res/machine-learning-services/registry	Machine Learning Services Registry	josunefon Jordi Sune Fontanals
110	avm/res/machine-learning-services/workspace ▶ compute connection datastore	Machine Learning Services Workspace ML Workspace	cecheta Chinedum Echeta ross-p-smith Ross Smith
111	avm/res/maintenance/configuration-assignment	Maintenance Configuration Assignment	eriqua Erika Gressi
112	avm/res/maintenance/maintenance-configuration	Maintenance Configuration	arievanderwende Arie van der Wende
113	avm/res/managed-identity/user-assigned-identity ▶ federated-identity-credential	User Assigned Identity MSI	gpacetti Giuseppe Pacetti
114	avm/res/managed-services/registration-definition	Registration Definition (Lighthouse)
115	avm/res/management/management-group	Management Group MG	fblix Felix Borst
116	avm/res/management/service-group	Service Group	jtracey93 Jack Tracey
117	avm/res/maps/account	Azure Maps Account	jhueppauff Julian Huppauff
118	avm/res/net-app/net-app-account ▶ backup-policy backup-vault backup capacity-pool volume snapshot-policy	Azure NetApp File	fbinotto Felipe Binotto
119	avm/res/network/application-gateway	Application Gateway App GW	toddbeauchemin Todd Beauchemin
120	avm/res/network/application-gateway-web-application-firewall-policy	Application Gateway Web Application Firewall (WAF) Policy	toddbeauchemin Todd Beauchemin
121	avm/res/network/application-security-group	Application Security Group (ASG) ASG	segraef Sebastian Graef
122	avm/res/network/azure-firewall	Azure Firewall Azure FW	jtracey93 Jack Tracey oZakari Zach Trocinski
123	avm/res/network/bastion-host	Bastion Host	krbar Kris Baranek
124	avm/res/network/connection	Virtual Network Gateway Connection	fabmas Fabio Masciotra
125	avm/res/network/ddos-protection-plan	DDoS Protection Plan	segraef Sebastian Graef
126	avm/res/network/dns-forwarding-ruleset ▶ forwarding-rule virtual-network-link	DNS Forwarding Ruleset	ChrisSidebotham Chris Sidebotham
127	avm/res/network/dns-resolver ▶ inbound-endpoint outbound-endpoint	DNS Resolver	ChrisSidebotham Chris Sidebotham
128	avm/res/network/dns-zone ▶ a aaaa caa cname dnssec-config mx ns ptr soa srv txt	Public DNS Zone	ChrisSidebotham Chris Sidebotham
129	avm/res/network/express-route-circuit	ExpressRoute Circuit ER Circuit	arnoldna Nate Arnold
130	avm/res/network/express-route-gateway	Express Route Gateway ER GW	arnoldna Nate Arnold
131	avm/res/network/express-route-port	ExpressRoute Port ER Port	arnoldna Nate Arnold
132	avm/res/network/firewall-policy ▶ rule-collection-group	Firewall Policy	jtracey93 Jack Tracey oZakari Zach Trocinski
133	avm/res/network/front-door	Azure Front Door
134	avm/res/network/front-door-web-application-firewall-policy	Front Door Web Application Firewall (WAF) Policy	PaulJohnston88 Paul Johnston
135	avm/res/network/ip-group	IP Group	ahmadabdalla Ahmad Abdalla
136	avm/res/network/load-balancer ▶ backend-address-pool inbound-nat-rule	Load Balancer LB, NLB	arnoldna Nate Arnold
137	avm/res/network/local-network-gateway	Local Network Gateway	fabmas Fabio Masciotra
138	avm/res/network/nat-gateway	NAT Gateway NAT GW	fabmas Fabio Masciotra
139	avm/res/network/network-interface	Network Interface NIC	rahalan Rainer Halanek
140	avm/res/network/network-manager ▶ connectivity-configuration network-group static-member routing-configuration rule-collection rule scope-connection security-admin-configuration rule-collection rule	Network Manager	ahmadabdalla Ahmad Abdalla
141	avm/res/network/network-security-group	Network Security Group NSG	ahmadabdalla Ahmad Abdalla
142	avm/res/network/network-security-perimeter ▶ profile access-rule	Network Security Perimeter	peterbud Peter Budai
143	avm/res/network/network-watcher ▶ connection-monitor flow-log	Network Watcher	segraef Sebastian Graef
144	avm/res/network/p2s-vpn-gateway	P2S VPN Gateway	ericscheffler Eric Scheffler
145	avm/res/network/private-dns-zone ▶ a aaaa cname mx ptr soa srv txt virtual-network-link	Private DNS Zone	ChrisSidebotham Chris Sidebotham
146	avm/res/network/private-endpoint ▶ private-dns-zone-group	Private Endpoint	segraef Sebastian Graef
147	avm/res/network/private-link-service	Private Link Service	ahmadabdalla Ahmad Abdalla
148	avm/res/network/public-ip-address	Public IP Address PIP	ChrisSidebotham Chris Sidebotham krbar Kris Baranek
149	avm/res/network/public-ip-prefix	Public IP Prefix PIP Prefix	krbar Kris Baranek
150	avm/res/network/route-table	Route Table UDR	segraef Sebastian Graef
151	avm/res/network/service-endpoint-policy	Service Endpoint Policy	jeetgarg Jeet Garg
152	avm/res/network/trafficmanagerprofile	Traffic Manager Profile	lsnoddy Luke Snoddy
153	avm/res/network/virtual-hub ▶ hub-route-table hub-virtual-network-connection route-map routing-intent	Virtual Hub	arnoldna Nate Arnold
154	avm/res/network/virtual-network ▶ subnet virtual-network-peering	Virtual Network VNET	mjrich19 MJ Richardson
155	avm/res/network/virtual-network-gateway ▶ nat-rule	Virtual Network Gateway VNET GW	fabmas Fabio Masciotra
156	avm/res/network/virtual-wan	Virtual WAN vWAN	arnoldna Nate Arnold
157	avm/res/network/vpn-gateway ▶ nat-rule vpn-connection	VPN Gateway VPN GW	fabmas Fabio Masciotra
158	avm/res/network/vpn-server-configuration	VPN Server Configuration	ericscheffler Eric Scheffler
159	avm/res/network/vpn-site	VPN Site	fabmas Fabio Masciotra
160	avm/res/operational-insights/cluster	Log Analytics Dedicated Cluster	abhishekaryams Abhishek Arya
161	avm/res/operational-insights/workspace ▶ data-export data-source linked-service linked-storage-account saved-search storage-insight-config table	Log Analytics Workspace	krbar Kris Baranek
162	avm/res/operations-management/solution	Operations Management Solution	krbar Kris Baranek
163	avm/res/portal/dashboard	Portal Dashboard	krbar Kris Baranek
164	avm/res/power-bi-dedicated/capacity	Power BI Dedicated Capacity	ChrisSidebotham Chris Sidebotham
165	avm/res/purview/account	Purview Account	abhishekaryams Abhishek Arya
166	avm/res/recovery-services/vault ▶ backup-config backup-fabric/protection-container/protected-item backup-policy replication-alert-setting replication-fabric replication-protection-container replication-protection-container-mapping replication-policy	Recovery Services Vault	alexanderojala Alexander Ojala
167	avm/res/relay/namespace ▶ authorization-rule hybrid-connection authorization-rule network-rule-set wcf-relay authorization-rule	Relay Namespace
168	avm/res/resource-graph/query	Resource Graph Query	sebassem Seif Bassem
169	avm/res/resources/deployment-script	Deployment Script	sebassem Seif Bassem
170	avm/res/resources/resource-group	Resource Group RG	segraef Sebastian Graef
171	avm/res/scom/managed-instance	SCOM MI System Center Operations Manager - Managed Instance
172	avm/res/search/search-service ▶ shared-private-link-resource	Search Service	krbar Kris Baranek
173	avm/res/security-insights/data-connector	Security Insights - Data Connector
174	avm/res/security-insights/onboarding-state	Security Insights - Onboarding State
175	avm/res/security-insights/setting	Security Insights - Setting	TomazMlakar Tomaz Mlakar
176	avm/res/service-bus/namespace ▶ authorization-rule disaster-recovery-config migration-configuration network-rule-set queue authorization-rule topic authorization-rule subscription rule	Service Bus Namespace	ChrisSidebotham Chris Sidebotham
177	avm/res/service-fabric/cluster ▶ application-type	Service Fabric Cluster	lsnoddy Luke Snoddy
178	avm/res/service-networking/traffic-controller ▶ association frontend security-policy	Application Gateway for Containers (Traffic Controller)	krbar Kris Baranek
179	avm/res/signal-r-service/signal-r	SignalR Service SignalR
180	avm/res/signal-r-service/web-pub-sub	SignalR Web PubSub Service
181	avm/res/sql-virtual-machine/sql-virtual-machine	SQL Virtual Machine SQL VM	peterbud Peter Budai
182	avm/res/sql/instance-pool	SQL Instance Pool	gpacetti Giuseppe Pacetti
183	avm/res/sql/managed-instance ▶ database backup-long-term-retention-policy backup-short-term-retention-policy encryption-protector key security-alert-policy vulnerability-assessment	SQL Managed Instance SQL MI	chanakanissanka Chanaka Nissanka
184	avm/res/sql/server ▶ auditing-setting database backup-long-term-retention-policy backup-short-term-retention-policy elastic-pool encryption-protector failover-group firewall-rule key security-alert-policy virtual-network-rule vulnerability-assessment	Azure SQL Server	peterbud Peter Budai
185	avm/res/storage/storage-account ▶ blob-service container immutability-policy file-service share local-user management-policy object-replication-policy policy queue-service queue table-service table	Storage Account	fblix Felix Borst
186	avm/res/stream-analytics/streaming-job	Stream Analytics Job
187	avm/res/synapse/private-link-hub	Azure Synapse Analytics Private Link Hub	TomazMlakar Tomaz Mlakar
188	avm/res/synapse/workspace ▶ administrator big-data-pool firewall-rule integration-runtime key sql-pool	Azure Synapse Analytics Workspace	TomazMlakar Tomaz Mlakar
189	avm/res/virtual-machine-images/image-template	Virtual Machine Image Template	ahmadabdalla Ahmad Abdalla
190	avm/res/web/connection	API Connection	abhishekaryams Abhishek Arya
191	avm/res/web/hosting-environment ▶ configuration	App Service Environment ASE	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
192	avm/res/web/serverfarm	App Service Plan	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
193	avm/res/web/site ▶ basic-publishing-credentials-policy config extension hybrid-connection-namespace/relay slot basic-publishing-credentials-policy config extension hybrid-connection-namespace/relay	Web/Function App App Service, Web Site, Logic App, Function App	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
194	avm/res/web/static-site ▶ config custom-domain linked-backend	Static Web App	ChrisSidebotham Chris Sidebotham

Module Publication History - 📅

➕ Module Publication History - Module names, status and owners

Modules published in May 2026

No.	Module Name	Display Name	Owner(s)
01	avm/res/communication/email-service/domain	Email Communication Service - Domain (Child of avm/res/communication/email-service)	(Inherited): donk-msft Don Koning
02	avm/res/communication/email-service/domain/sender-username	Email Communication Service - Domain - Sender Username (Child of avm/res/communication/email-service)	(Inherited): donk-msft Don Koning
03	avm/res/compute/virtual-machine-scale-set/extension	Virtual Machine Scale Set - Extension (Child of avm/res/compute/virtual-machine-scale-set)	(Inherited): josunefon Jordi Sune Fontanals
04	avm/res/compute/virtual-machine/extension	Virtual Machine - Extension (Child of avm/res/compute/virtual-machine)	(Inherited): josunefon Jordi Sune Fontanals
05	avm/res/data-factory/factory/integration-runtime	Data Factory - Integration Runtime (Child of avm/res/data-factory/factory)	(Inherited): TomazMlakar Tomaz Mlakar
06	avm/res/data-factory/factory/linked-service	Data Factory - Linked Service (Child of avm/res/data-factory/factory)	(Inherited): TomazMlakar Tomaz Mlakar
07	avm/res/data-factory/factory/managed-virtual-network	Data Factory - Managed Virtual Network (Child of avm/res/data-factory/factory)	(Inherited): TomazMlakar Tomaz Mlakar
08	avm/res/data-factory/factory/managed-virtual-network/managed-private-endpoint	Data Factory - Managed Virtual Network - Managed Private Endpoint (Child of avm/res/data-factory/factory)	(Inherited): TomazMlakar Tomaz Mlakar
09	avm/res/dev-center/devcenter/attachednetwork	Dev Center - Attachednetwork (Child of avm/res/dev-center/devcenter)	(Inherited): ahmadabdalla Ahmad Abdalla
10	avm/res/dev-center/devcenter/catalog	Dev Center - Catalog (Child of avm/res/dev-center/devcenter)	(Inherited): ahmadabdalla Ahmad Abdalla
11	avm/res/dev-center/devcenter/devboxdefinition	Dev Center - Devboxdefinition (Child of avm/res/dev-center/devcenter)	(Inherited): ahmadabdalla Ahmad Abdalla
12	avm/res/dev-center/devcenter/environment-type	Dev Center - Environment Type (Child of avm/res/dev-center/devcenter)	(Inherited): ahmadabdalla Ahmad Abdalla
13	avm/res/dev-center/devcenter/gallery	Dev Center - Gallery (Child of avm/res/dev-center/devcenter)	(Inherited): ahmadabdalla Ahmad Abdalla
14	avm/res/dev-center/devcenter/project-policy	Dev Center - Project Policy (Child of avm/res/dev-center/devcenter)	(Inherited): ahmadabdalla Ahmad Abdalla
15	avm/res/dev-center/project/catalog	Dev Center Project - Catalog (Child of avm/res/dev-center/project)	(Inherited): ahmadabdalla Ahmad Abdalla
16	avm/res/dev-center/project/environment-type	Dev Center Project - Environment Type (Child of avm/res/dev-center/project)	(Inherited): ahmadabdalla Ahmad Abdalla
17	avm/res/dev-center/project/pool	Dev Center Project - Pool (Child of avm/res/dev-center/project)	(Inherited): ahmadabdalla Ahmad Abdalla
18	avm/res/dev-center/project/pool/schedule	Dev Center Project - Pool - Schedule (Child of avm/res/dev-center/project)	(Inherited): ahmadabdalla Ahmad Abdalla
19	avm/res/dev-test-lab/lab/artifactsource	DevTest Lab - Artifactsource (Child of avm/res/dev-test-lab/lab)	(Inherited): ahmadabdalla Ahmad Abdalla
20	avm/res/dev-test-lab/lab/cost	DevTest Lab - Cost (Child of avm/res/dev-test-lab/lab)	(Inherited): ahmadabdalla Ahmad Abdalla
21	avm/res/dev-test-lab/lab/notificationchannel	DevTest Lab - Notificationchannel (Child of avm/res/dev-test-lab/lab)	(Inherited): ahmadabdalla Ahmad Abdalla
22	avm/res/dev-test-lab/lab/policyset/policy	DevTest Lab - Policyset - Policy (Child of avm/res/dev-test-lab/lab)	(Inherited): ahmadabdalla Ahmad Abdalla
23	avm/res/dev-test-lab/lab/schedule	DevTest Lab - Schedule (Child of avm/res/dev-test-lab/lab)	(Inherited): ahmadabdalla Ahmad Abdalla
24	avm/res/dev-test-lab/lab/secret	DevTest Lab - Secret (Child of avm/res/dev-test-lab/lab)	(Inherited): ahmadabdalla Ahmad Abdalla
25	avm/res/dev-test-lab/lab/virtualnetwork	DevTest Lab - Virtualnetwork (Child of avm/res/dev-test-lab/lab)	(Inherited): ahmadabdalla Ahmad Abdalla
26	avm/res/digital-twins/digital-twins-instance/endpoint	Digital Twins Instance - Endpoint (Child of avm/res/digital-twins/digital-twins-instance)	(Inherited): ryanmstephens Ryan Stephens
27	avm/res/event-grid/domain/event-subscription	Event Grid Domain - Event Subscription (Child of avm/res/event-grid/domain)	(Inherited): fabmas Fabio Masciotra
28	avm/res/event-grid/domain/topic	Event Grid Domain - Topic (Child of avm/res/event-grid/domain)	(Inherited): fabmas Fabio Masciotra
29	avm/res/event-grid/namespace/ca-certificate	Event Grid Namespace - Ca Certificate (Child of avm/res/event-grid/namespace)	(Inherited): fabmas Fabio Masciotra
30	avm/res/event-grid/namespace/client	Event Grid Namespace - Client (Child of avm/res/event-grid/namespace)	(Inherited): fabmas Fabio Masciotra
31	avm/res/event-grid/namespace/client-group	Event Grid Namespace - Client Group (Child of avm/res/event-grid/namespace)	(Inherited): fabmas Fabio Masciotra
32	avm/res/event-grid/namespace/permission-binding	Event Grid Namespace - Permission Binding (Child of avm/res/event-grid/namespace)	(Inherited): fabmas Fabio Masciotra
33	avm/res/event-grid/namespace/topic	Event Grid Namespace - Topic (Child of avm/res/event-grid/namespace)	(Inherited): fabmas Fabio Masciotra
34	avm/res/event-grid/namespace/topic-space	Event Grid Namespace - Topic Space (Child of avm/res/event-grid/namespace)	(Inherited): fabmas Fabio Masciotra
35	avm/res/event-grid/namespace/topic/event-subscription	Event Grid Namespace - Topic - Event Subscription (Child of avm/res/event-grid/namespace)	(Inherited): fabmas Fabio Masciotra
36	avm/res/event-grid/topic/event-subscription	Event Grid Topic - Event Subscription (Child of avm/res/event-grid/topic)	(Inherited): fabmas Fabio Masciotra
37	avm/res/hybrid-compute/machine/extension	Hybrid Compute Machine - Extension (Child of avm/res/hybrid-compute/machine)	(Inherited): chirag1603 Chirag Choudha
38	avm/res/logic/integration-account/agreement	Logic Apps Integration Account - Agreement (Child of avm/res/logic/integration-account)	(Inherited): lsnoddy Luke Snoddy
39	avm/res/logic/integration-account/assembly	Logic Apps Integration Account - Assembly (Child of avm/res/logic/integration-account)	(Inherited): lsnoddy Luke Snoddy
40	avm/res/logic/integration-account/certificate	Logic Apps Integration Account - Certificate (Child of avm/res/logic/integration-account)	(Inherited): lsnoddy Luke Snoddy
41	avm/res/logic/integration-account/map	Logic Apps Integration Account - Map (Child of avm/res/logic/integration-account)	(Inherited): lsnoddy Luke Snoddy
42	avm/res/logic/integration-account/partner	Logic Apps Integration Account - Partner (Child of avm/res/logic/integration-account)	(Inherited): lsnoddy Luke Snoddy
43	avm/res/logic/integration-account/schema	Logic Apps Integration Account - Schema (Child of avm/res/logic/integration-account)	(Inherited): lsnoddy Luke Snoddy
44	avm/res/managed-identity/user-assigned-identity/federated-identity-credential	User Assigned Identity - Federated Identity Credential (Child of avm/res/managed-identity/user-assigned-identity)	(Inherited): gpacetti Giuseppe Pacetti
45	avm/res/net-app/net-app-account/backup-policy	Azure NetApp File - Backup Policy (Child of avm/res/net-app/net-app-account)	(Inherited): fbinotto Felipe Binotto
46	avm/res/net-app/net-app-account/backup-vault	Azure NetApp File - Backup Vault (Child of avm/res/net-app/net-app-account)	(Inherited): fbinotto Felipe Binotto
47	avm/res/net-app/net-app-account/backup-vault/backup	Azure NetApp File - Backup Vault - Backup (Child of avm/res/net-app/net-app-account)	(Inherited): fbinotto Felipe Binotto
48	avm/res/net-app/net-app-account/capacity-pool	Azure NetApp File - Capacity Pool (Child of avm/res/net-app/net-app-account)	(Inherited): fbinotto Felipe Binotto
49	avm/res/net-app/net-app-account/capacity-pool/volume	Azure NetApp File - Capacity Pool - Volume (Child of avm/res/net-app/net-app-account)	(Inherited): fbinotto Felipe Binotto
50	avm/res/net-app/net-app-account/snapshot-policy	Azure NetApp File - Snapshot Policy (Child of avm/res/net-app/net-app-account)	(Inherited): fbinotto Felipe Binotto
51	avm/res/operational-insights/workspace/data-export	Log Analytics Workspace - Data Export (Child of avm/res/operational-insights/workspace)	(Inherited): krbar Kris Baranek
52	avm/res/operational-insights/workspace/data-source	Log Analytics Workspace - Data Source (Child of avm/res/operational-insights/workspace)	(Inherited): krbar Kris Baranek
53	avm/res/operational-insights/workspace/linked-service	Log Analytics Workspace - Linked Service (Child of avm/res/operational-insights/workspace)	(Inherited): krbar Kris Baranek
54	avm/res/operational-insights/workspace/linked-storage-account	Log Analytics Workspace - Linked Storage Account (Child of avm/res/operational-insights/workspace)	(Inherited): krbar Kris Baranek
55	avm/res/operational-insights/workspace/saved-search	Log Analytics Workspace - Saved Search (Child of avm/res/operational-insights/workspace)	(Inherited): krbar Kris Baranek
56	avm/res/operational-insights/workspace/storage-insight-config	Log Analytics Workspace - Storage Insight Config (Child of avm/res/operational-insights/workspace)	(Inherited): krbar Kris Baranek
57	avm/res/operational-insights/workspace/table	Log Analytics Workspace - Table (Child of avm/res/operational-insights/workspace)	(Inherited): krbar Kris Baranek
58	avm/res/service-networking/traffic-controller/association	Application Gateway for Containers (Traffic Controller) - Association (Child of avm/res/service-networking/traffic-controller)	(Inherited): krbar Kris Baranek
59	avm/res/service-networking/traffic-controller/frontend	Application Gateway for Containers (Traffic Controller) - Frontend (Child of avm/res/service-networking/traffic-controller)	(Inherited): krbar Kris Baranek
60	avm/res/service-networking/traffic-controller/security-policy	Application Gateway for Containers (Traffic Controller) - Sec Policy (Child of avm/res/service-networking/traffic-controller)	(Inherited): krbar Kris Baranek

Modules published in April 2026

No.	Module Name	Display Name	Owner(s)
01	avm/res/app-configuration/configuration-store/key-value	App Configuration Store - Key Value (Child of avm/res/app-configuration/configuration-store)	(Inherited): Jfolberth John Folberth
02	avm/res/app-configuration/configuration-store/replica	App Configuration Store - Replica (Child of avm/res/app-configuration/configuration-store)	(Inherited): Jfolberth John Folberth
03	avm/res/app/container-app/auth-config	Container App - Auth Config (Child of avm/res/app/container-app)	(Inherited): oZakari Zach Trocinski
04	avm/res/cdn/profile/afd-endpoint	CDN Profile - Afd Endpoint (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
05	avm/res/cdn/profile/endpoint	CDN Profile - Endpoint (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
06	avm/res/cdn/profile/endpoint/origin	CDN Profile - Endpoint - Origin (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
07	avm/res/cdn/profile/rule-set/rule	CDN Profile - Rule Set - Rule (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
08	avm/res/cdn/profile/secret	CDN Profile - Secret (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
09	avm/res/data-protection/backup-vault/backup-instance	Data Protection Backup Vault - Backup Instance (Child of avm/res/data-protection/backup-vault)	(Inherited): abhishekaryams Abhishek Arya
10	avm/res/data-protection/backup-vault/backup-policy	Data Protection Backup Vault - Backup Policy (Child of avm/res/data-protection/backup-vault)	(Inherited): abhishekaryams Abhishek Arya
11	avm/res/db-for-postgre-sql/flexible-server/administrator	DB for Postgre SQL Flexible Server - Administrator (Child of avm/res/db-for-postgre-sql/flexible-server)	(Inherited): arnoldna Nate Arnold
12	avm/res/db-for-postgre-sql/flexible-server/advanced-threat-protection-setting	DB for Postgre SQL Flexible Server - Adv Threat Protection Setting (Child of avm/res/db-for-postgre-sql/flexible-server)	(Inherited): arnoldna Nate Arnold
13	avm/res/db-for-postgre-sql/flexible-server/configuration	DB for Postgre SQL Flexible Server - Configuration (Child of avm/res/db-for-postgre-sql/flexible-server)	(Inherited): arnoldna Nate Arnold
14	avm/res/db-for-postgre-sql/flexible-server/database	DB for Postgre SQL Flexible Server - Database (Child of avm/res/db-for-postgre-sql/flexible-server)	(Inherited): arnoldna Nate Arnold
15	avm/res/db-for-postgre-sql/flexible-server/firewall-rule	DB for Postgre SQL Flexible Server - Firewall Rule (Child of avm/res/db-for-postgre-sql/flexible-server)	(Inherited): arnoldna Nate Arnold
16	avm/res/desktop-virtualization/application-group/application	Azure Virtual Desktop (AVD) Application Group - Application (Child of avm/res/desktop-virtualization/application-group)	(Inherited):
17	avm/res/event-hub/namespace/authorization-rule	Event Hub Namespace - Authorization Rule (Child of avm/res/event-hub/namespace)	(Inherited): abhishekaryams Abhishek Arya
18	avm/res/event-hub/namespace/disaster-recovery-config	Event Hub Namespace - Disaster Recovery Config (Child of avm/res/event-hub/namespace)	(Inherited): abhishekaryams Abhishek Arya
19	avm/res/event-hub/namespace/eventhub/authorization-rule	Event Hub Namespace - Eventhub - Authorization Rule (Child of avm/res/event-hub/namespace)	(Inherited): abhishekaryams Abhishek Arya
20	avm/res/event-hub/namespace/eventhub/consumergroup	Event Hub Namespace - Eventhub - Consumergroup (Child of avm/res/event-hub/namespace)	(Inherited): abhishekaryams Abhishek Arya
21	avm/res/event-hub/namespace/network-rule-set	Event Hub Namespace - Network Rule Set (Child of avm/res/event-hub/namespace)	(Inherited): abhishekaryams Abhishek Arya
22	avm/res/healthcare-apis/workspace/dicomservice	Healthcare API Workspace - Dicomservice (Child of avm/res/healthcare-apis/workspace)	(Inherited):
23	avm/res/healthcare-apis/workspace/fhirservice	Healthcare API Workspace - Fhirservice (Child of avm/res/healthcare-apis/workspace)	(Inherited):
24	avm/res/healthcare-apis/workspace/iotconnector	Healthcare API Workspace - Iotconnector (Child of avm/res/healthcare-apis/workspace)	(Inherited):
25	avm/res/healthcare-apis/workspace/iotconnector/fhirdestination	Healthcare API Workspace - Iotconnector - Fhirdestination (Child of avm/res/healthcare-apis/workspace)	(Inherited):
26	avm/res/network/virtual-network/virtual-network-peering	Virtual Network - Peering (Child of avm/res/network/virtual-network) VNET Peering	(Inherited): mjrich19 MJ Richardson
27	avm/res/relay/namespace/authorization-rule	Relay Namespace - Authorization Rule (Child of avm/res/relay/namespace)	(Inherited):
28	avm/res/relay/namespace/hybrid-connection	Relay Namespace - Hybrid Connection (Child of avm/res/relay/namespace)	(Inherited):
29	avm/res/relay/namespace/hybrid-connection/authorization-rule	Relay Namespace - Hybrid Connection - Authorization Rule (Child of avm/res/relay/namespace)	(Inherited):
30	avm/res/relay/namespace/network-rule-set	Relay Namespace - Network Rule Set (Child of avm/res/relay/namespace)	(Inherited):
31	avm/res/relay/namespace/wcf-relay	Relay Namespace - Wcf Relay (Child of avm/res/relay/namespace)	(Inherited):
32	avm/res/relay/namespace/wcf-relay/authorization-rule	Relay Namespace - Wcf Relay - Authorization Rule (Child of avm/res/relay/namespace)	(Inherited):

Modules published in March 2026

No.	Module Name	Display Name	Owner(s)
01	avm/res/cdn/profile/afd-endpoint/route	CDN Profile - AFD Endpoint Route (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
02	avm/res/cdn/profile/custom-domain	CDN Profile - Custom Domain (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
03	avm/res/cdn/profile/origin-group	CDN Profile - Origin Group (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
04	avm/res/cdn/profile/origin-group/origin	CDN Profile - Origin Group - Origin (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
05	avm/res/cdn/profile/rule-set	CDN Profile - Rule Set (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
06	avm/res/cdn/profile/security-policy	CDN Profile - Security Policy (Child of avm/res/cdn/profile)	(Inherited): gbeaud Guillaume Beaud
07	avm/res/container-registry/registry/cache-rule	Azure Container Registry (ACR) - Cache Rule (Child of avm/res/container-registry/registry)	(Inherited): JPEasier Julian Peißker
08	avm/res/container-registry/registry/credential-set	Azure Container Registry (ACR) - Credential Set (Child of avm/res/container-registry/registry)	(Inherited): JPEasier Julian Peißker
09	avm/res/container-registry/registry/replication	Azure Container Registry (ACR) - Replication (Child of avm/res/container-registry/registry)	(Inherited): JPEasier Julian Peißker
10	avm/res/container-registry/registry/scope-map	Azure Container Registry (ACR) - Scope Map (Child of avm/res/container-registry/registry)	(Inherited): JPEasier Julian Peißker
11	avm/res/container-registry/registry/task	Azure Container Registry (ACR) - Task (Child of avm/res/container-registry/registry)	(Inherited): JPEasier Julian Peißker
12	avm/res/container-registry/registry/token	Azure Container Registry (ACR) - Token (Child of avm/res/container-registry/registry)	(Inherited): JPEasier Julian Peißker
13	avm/res/container-registry/registry/webhook	Azure Container Registry (ACR) - Webhook (Child of avm/res/container-registry/registry)	(Inherited): JPEasier Julian Peißker
14	avm/res/devices/iot-hub	IoT Hub	TomazMlakar Tomaz Mlakar
15	avm/res/network/private-dns-zone/virtual-network-link	Virtual Network Links (Child of avm/res/network/private-dns-zone) VNET Link	(Inherited): ChrisSidebotham Chris Sidebotham
16	avm/res/storage/storage-account/blob-service/container/immutability-policy	Storage Account - Blob Container Immutability Policy (Child of avm/res/storage/storage-account)	(Inherited): fblix Felix Borst
17	avm/res/storage/storage-account/local-user	Storage Account - Local User (Child of avm/res/storage/storage-account)	(Inherited): fblix Felix Borst
18	avm/res/storage/storage-account/management-policy	Storage Account - Management Policy (Child of avm/res/storage/storage-account)	(Inherited): fblix Felix Borst
19	avm/res/storage/storage-account/queue-service/queue	Storage Account - Queue (Child of avm/res/storage/storage-account)	(Inherited): fblix Felix Borst
20	avm/res/storage/storage-account/table-service/table	Storage Account - Table (Child of avm/res/storage/storage-account)	(Inherited): fblix Felix Borst

Modules published in January 2026

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/res/service-bus/namespace/queue	Service Bus Namespace - Queue (Child of avm/res/service-bus/namespace)		(Inherited): ChrisSidebotham Chris Sidebotham
02	avm/res/service-bus/namespace/topic	Service Bus Namespace - Topic (Child of avm/res/service-bus/namespace)		(Inherited): ChrisSidebotham Chris Sidebotham

Modules published in December 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/res/logic/integration-account	Logic Apps Integration Account		lsnoddy Luke Snoddy

Modules published in November 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/res/operational-insights/cluster	Log Analytics Dedicated Cluster		abhishekaryams Abhishek Arya

Modules published in September 2025

No.	Module Name	Display Name	Owner(s)
01	avm/res/api-management/service/api	API Management Service - API (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
02	avm/res/api-management/service/api-version-set	API Management Service - API Version Set (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
03	avm/res/api-management/service/api/diagnostics	API Management Service - API Diagnostics (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
04	avm/res/api-management/service/api/policy	API Management Service - API Policy (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
05	avm/res/api-management/service/authorization-server	API Management Service - Authorization Server (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
06	avm/res/api-management/service/backend	API Management Service - Backend (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
07	avm/res/api-management/service/cache	API Management Service - Cache (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
08	avm/res/api-management/service/identity-provider	API Management Service - Identity Provider (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
09	avm/res/api-management/service/logger	API Management Service - Logger (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
10	avm/res/api-management/service/named-value	API Management Service - Named Value (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
11	avm/res/api-management/service/policy	API Management Service - Policy (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
12	avm/res/api-management/service/portalsetting	API Management Service - Portal Setting (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
13	avm/res/api-management/service/product	API Management Service - Product (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
14	avm/res/api-management/service/product/api	API Management Service - Product API (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
15	avm/res/api-management/service/product/group	API Management Service - Product Group (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
16	avm/res/api-management/service/subscription	API Management Service - Subscription (Child of avm/res/api-management/service)	(Inherited): abhishekaryams Abhishek Arya
17	avm/res/authorization/policy-assignment/mg-scope	Authorization - Policy Assignment - Management Group Scope (Child of avm/res/authorization/policy-assignment)	(Inherited): AlexanderSehr Alexander Sehr
18	avm/res/authorization/policy-assignment/rg-scope	Authorization - Policy Assignment - Resource Group Scope (Child of avm/res/authorization/policy-assignment)	(Inherited): AlexanderSehr Alexander Sehr
19	avm/res/authorization/policy-assignment/sub-scope	Authorization - Policy Assignment - Subscription Scope (Child of avm/res/authorization/policy-assignment)	(Inherited): AlexanderSehr Alexander Sehr
20	avm/res/consumption/budget/mg-scope	Consumption Budget - Management Group Scope (Child of avm/res/consumption/budget)	(Inherited): segraef Sebastian Graef
21	avm/res/consumption/budget/rg-scope	Consumption Budget - Resource Group Scope (Child of avm/res/consumption/budget)	(Inherited): segraef Sebastian Graef
22	avm/res/consumption/budget/sub-scope	Consumption Budget - Subscription Scope (Child of avm/res/consumption/budget)	(Inherited): segraef Sebastian Graef
23	avm/res/document-db/database-account/sql-role-assignment	Cosmos DB - SQL Role Assignment (Child of avm/res/document-db/database-account)	(Inherited): cmaneu Christopher Maneu
24	avm/res/document-db/database-account/sql-role-definition	Cosmos DB - SQL Role Definition (Child of avm/res/document-db/database-account)	(Inherited): cmaneu Christopher Maneu
25	avm/res/event-hub/namespace/eventhub	Event Hub (Child of avm/res/event-hub/namespace)	(Inherited): abhishekaryams Abhishek Arya
26	avm/res/kubernetes-runtime/load-balancer	Kubernetes Runtime Load Balancer	chirag1603 Chirag Choudha
27	avm/res/management/service-group	Service Group	jtracey93 Jack Tracey
28	avm/res/sql/server/database	Azure SQL Database (Child of avm/res/sql/server)	(Inherited): peterbud Peter Budai

Modules published in August 2025

No.	Module Name	Display Name	Owner(s)
01	avm/res/key-vault/vault/access-policy	Key Vault - Access Policy (Child of avm/res/key-vault/vault)	(Inherited): fblix Felix Borst
02	avm/res/key-vault/vault/key	Key Vault - Key (Child of avm/res/key-vault/vault)	(Inherited): fblix Felix Borst
03	avm/res/key-vault/vault/secret	Key Vault - Secret (Child of avm/res/key-vault/vault)	(Inherited): fblix Felix Borst
04	avm/res/network/private-dns-zone/a	Private DNS Zone - A (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
05	avm/res/network/private-dns-zone/aaaa	Private DNS Zone - AAAA (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
06	avm/res/network/private-dns-zone/cname	Private DNS Zone - CNAME (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
07	avm/res/network/private-dns-zone/mx	Private DNS Zone - MX (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
08	avm/res/network/private-dns-zone/ptr	Private DNS Zone - PTR (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
09	avm/res/network/private-dns-zone/soa	Private DNS Zone - SOA (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
10	avm/res/network/private-dns-zone/srv	Private DNS Zone - SRV (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
11	avm/res/network/private-dns-zone/txt	Private DNS Zone - TXT (Child of avm/res/network/private-dns-zone)	(Inherited): ChrisSidebotham Chris Sidebotham
12	avm/res/web/site/config	Web Site Configuration (Child of avm/res/web/site)	(Inherited): tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
13	avm/res/web/site/slot	Web Site Slot (Child of avm/res/web/site)	(Inherited): tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal

Modules published in July 2025

No.	Module Name	Display Name	Owner(s)
01	avm/res/azure-stack-hci/marketplace-gallery-image	Azure Stack HCI Marketplace Gallery Image	chirag1603 Chirag Choudha
02	avm/res/azure-stack-hci/virtual-machine-instance	Azure Stack HCI Virtual Machine Instance	chirag1603 Chirag Choudha
03	avm/res/storage/storage-account/file-service/share	Storage Account - File Share (Child of avm/res/storage/storage-account)	(Inherited): fblix Felix Borst

Modules published in June 2025

No.	Module Name	Display Name	Owner(s)
01	avm/res/authorization/role-assignment/mg-scope	Authorization - Role Assignment - Management Group Scope (Child of avm/res/authorization/role-assignment)	(Inherited): arnoldna Nate Arnold
02	avm/res/authorization/role-assignment/rg-scope	Authorization - Role Assignment - Resource Group Scope (Child of avm/res/authorization/role-assignment)	(Inherited): arnoldna Nate Arnold
03	avm/res/authorization/role-assignment/sub-scope	Authorization - Role Assignment - Subscription Scope (Child of avm/res/authorization/role-assignment)	(Inherited): arnoldna Nate Arnold
04	avm/res/dev-center/devcenter	Dev Center	ahmadabdalla Ahmad Abdalla
05	avm/res/dev-center/project	Dev Center Project	ahmadabdalla Ahmad Abdalla
06	avm/res/machine-learning-services/registry	Machine Learning Services Registry	josunefon Jordi Sune Fontanals
07	avm/res/storage/storage-account/blob-service/container	Storage Account - Blob Container (Child of avm/res/storage/storage-account)	(Inherited): fblix Felix Borst

Modules published in May 2025

No.	Module Name	Display Name	Owner(s)
01	avm/res/dev-center/network-connection	Dev Center Network Connection	ahmadabdalla Ahmad Abdalla
02	avm/res/security-insights/data-connector	Security Insights - Data Connector
03	avm/res/security-insights/setting	Security Insights - Setting	TomazMlakar Tomaz Mlakar

Modules published in March 2025

No.	Module Name	Display Name	Owner(s)
01	avm/res/azure-stack-hci/network-interface	Azure Stack HCI Network Interface	chirag1603 Chirag Choudha
02	avm/res/azure-stack-hci/virtual-hard-disk	Azure Stack HCI Hard Disk	chirag1603 Chirag Choudha
03	avm/res/hybrid-container-service/provisioned-cluster-instance	Hybrid Container Service - Provisioned Cluster Instance	chirag1603 Chirag Choudha
04	avm/res/kubernetes/connected-cluster	Kubernetes Connected Cluster	chirag1603 Chirag Choudha
05	avm/res/maintenance/configuration-assignment	Maintenance Configuration Assignment	eriqua Erika Gressi
06	avm/res/maps/account	Azure Maps Account	jhueppauff Julian Huppauff
07	avm/res/network/network-security-perimeter	Network Security Perimeter	peterbud Peter Budai
08	avm/res/network/virtual-network/subnet	Virtual Network - Subnet (Child of avm/res/network/virtual-network)	(Inherited): mjrich19 MJ Richardson

Modules published in February 2025

No.	Module Name	Display Name	Owner(s)
01	avm/res/app/session-pool	App Session Pool	abhishekaryams Abhishek Arya
02	avm/res/azure-stack-hci/cluster	Azure Stack HCI Cluster	chirag1603 Chirag Choudha
03	avm/res/azure-stack-hci/logical-network	Azure Stack HCI Logical Network	chirag1603 Chirag Choudha
04	avm/res/cache/redis-enterprise	Redis Enterprise Cache	JeffreyCA Jeffrey Chen
05	avm/res/hybrid-compute/gateway	Hybrid Compute Gateway	chirag1603 Chirag Choudha
06	avm/res/hybrid-compute/license	Hybrid Compute License	chirag1603 Chirag Choudha

Modules published in January 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/res/network/express-route-port	ExpressRoute Port ER Port		arnoldna Nate Arnold

Modules published in December 2024

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/res/elastic-san/elastic-san	Elastic SAN SAN, ESAN, Elastic SAN, Azure Elastic Storage Area Network, iSCSI, internet Small Computer Systems Interface		jbinko Jiri Binko
02	avm/res/network/p2s-vpn-gateway	P2S VPN Gateway		ericscheffler Eric Scheffler

Modules published in October 2024

No.	Module Name	Display Name	Owner(s)
01	avm/res/fabric/capacity	Fabric	mswantek68 Mike Swantek cmaneu Christopher Maneu
02	avm/res/network/vpn-server-configuration	VPN Server Configuration	ericscheffler Eric Scheffler
03	avm/res/service-networking/traffic-controller	Application Gateway for Containers (Traffic Controller)	krbar Kris Baranek

Modules published in September 2024

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/res/dev-ops-infrastructure/pool	DevOps Infrastructure Pool		elizatargithub7 Eliza Tarasila

Modules published in June 2024

No.	Module Name	Display Name	Owner(s)
01	avm/res/alerts-management/action-rule	Action Rules	judyer28 Justin Dyer
02	avm/res/hybrid-compute/machine	Hybrid Compute Machine	chirag1603 Chirag Choudha
03	avm/res/kusto/cluster	Azure Data Explorer (Kusto) cluster	oZakari Zach Trocinski
04	avm/res/portal/dashboard	Portal Dashboard	krbar Kris Baranek

Modules published in May 2024

No.	Module Name	Display Name	Owner(s)
01	avm/res/app/job	App Job	ReneHezser Rene Hezser
02	avm/res/communication/communication-service	Communication Service	donk-msft Don Koning
03	avm/res/communication/email-service	Email Communication Service	donk-msft Don Koning

Modules published in April 2024

No.	Module Name	Display Name	Owner(s)
01	avm/res/aad/domain-service	Azure Active Directory Domain Service AAD, Entra ID, Microsoft Entra Domain Services, AAD DS, Azure AD DS	ReneHezser Rene Hezser CRYP70N1X Paul Chirila
02	avm/res/healthcare-apis/workspace	Healthcare API Workspace
03	avm/res/load-test-service/load-test	Load Testing Service	sebassem Seif Bassem
04	avm/res/managed-services/registration-definition	Registration Definition (Lighthouse)
05	avm/res/network/application-gateway	Application Gateway App GW	toddbeauchemin Todd Beauchemin
06	avm/res/network/application-gateway-web-application-firewall-policy	Application Gateway Web Application Firewall (WAF) Policy	toddbeauchemin Todd Beauchemin
07	avm/res/network/network-watcher	Network Watcher	segraef Sebastian Graef
08	avm/res/service-fabric/cluster	Service Fabric Cluster	lsnoddy Luke Snoddy
09	avm/res/sql/instance-pool	SQL Instance Pool	gpacetti Giuseppe Pacetti
10	avm/res/sql/managed-instance	SQL Managed Instance SQL MI	chanakanissanka Chanaka Nissanka

Modules published in March 2024

No.	Module Name	Display Name	Owner(s)
01	avm/res/app-configuration/configuration-store	App Configuration Store	Jfolberth John Folberth
02	avm/res/cdn/profile	CDN Profile Azure Front Door	gbeaud Guillaume Beaud
03	avm/res/compute/virtual-machine-scale-set	Virtual Machine Scale Set VMSS	josunefon Jordi Sune Fontanals
04	avm/res/container-instance/container-group	Container Instance ACI	JPEasier Julian Peißker
05	avm/res/digital-twins/digital-twins-instance	Digital Twins Instance	ryanmstephens Ryan Stephens
06	avm/res/event-grid/namespace	Event Grid Namespace	fabmas Fabio Masciotra
07	avm/res/event-hub/namespace	Event Hub Namespace	abhishekaryams Abhishek Arya
08	avm/res/network/azure-firewall	Azure Firewall Azure FW	jtracey93 Jack Tracey oZakari Zach Trocinski
09	avm/res/network/service-endpoint-policy	Service Endpoint Policy	jeetgarg Jeet Garg
10	avm/res/recovery-services/vault	Recovery Services Vault	alexanderojala Alexander Ojala
11	avm/res/relay/namespace	Relay Namespace
12	avm/res/signal-r-service/signal-r	SignalR Service SignalR
13	avm/res/signal-r-service/web-pub-sub	SignalR Web PubSub Service
14	avm/res/web/connection	API Connection	abhishekaryams Abhishek Arya
15	avm/res/web/hosting-environment	App Service Environment ASE	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal

Modules published in February 2024

No.	Module Name	Display Name	Owner(s)
01	avm/res/compute/availability-set	Availability Set AS	ahmadabdalla Ahmad Abdalla
02	avm/res/desktop-virtualization/application-group	Azure Virtual Desktop (AVD) Application Group
03	avm/res/desktop-virtualization/host-pool	Azure Virtual Desktop (AVD) Host Pool
04	avm/res/desktop-virtualization/scaling-plan	Azure Virtual Desktop (AVD) Scaling Plan
05	avm/res/desktop-virtualization/workspace	Azure Virtual Desktop (AVD) Workspace	reikor0x Vincenzo Sciarra
06	avm/res/dev-test-lab/lab	DevTest Lab	ahmadabdalla Ahmad Abdalla
07	avm/res/insights/private-link-scope	Azure Monitor Private Link Scope	ahmadabdalla Ahmad Abdalla
08	avm/res/machine-learning-services/workspace	Machine Learning Services Workspace ML Workspace	cecheta Chinedum Echeta ross-p-smith Ross Smith
09	avm/res/management/management-group	Management Group MG	fblix Felix Borst
10	avm/res/network/ip-group	IP Group	ahmadabdalla Ahmad Abdalla
11	avm/res/network/network-manager	Network Manager	ahmadabdalla Ahmad Abdalla
12	avm/res/network/private-link-service	Private Link Service	ahmadabdalla Ahmad Abdalla
13	avm/res/network/virtual-hub	Virtual Hub	arnoldna Nate Arnold
14	avm/res/network/virtual-wan	Virtual WAN vWAN	arnoldna Nate Arnold
15	avm/res/purview/account	Purview Account	abhishekaryams Abhishek Arya
16	avm/res/synapse/private-link-hub	Azure Synapse Analytics Private Link Hub	TomazMlakar Tomaz Mlakar
17	avm/res/synapse/workspace	Azure Synapse Analytics Workspace	TomazMlakar Tomaz Mlakar
18	avm/res/virtual-machine-images/image-template	Virtual Machine Image Template	ahmadabdalla Ahmad Abdalla

Modules published in January 2024

No.	Module Name	Display Name	Owner(s)
01	avm/res/analysis-services/server	Analysis Services Server
02	avm/res/app/container-app	Container App	oZakari Zach Trocinski
03	avm/res/cache/redis	Redis Cache	TomazMlakar Tomaz Mlakar
04	avm/res/compute/disk	Compute Disk	segraef Sebastian Graef
05	avm/res/compute/disk-encryption-set	Disk Encryption Set	segraef Sebastian Graef
06	avm/res/compute/image	Image	tony-box Tony Box
07	avm/res/compute/proximity-placement-group	Proximity Placement Group	jeetgarg Jeet Garg
08	avm/res/compute/virtual-machine	Virtual Machine VM	josunefon Jordi Sune Fontanals
09	avm/res/consumption/budget	Consumption Budget	segraef Sebastian Graef
10	avm/res/container-registry/registry	Azure Container Registry (ACR)	JPEasier Julian Peißker
11	avm/res/container-service/managed-cluster	Azure Kubernetes Service (AKS) Managed Cluster	JPEasier Julian Peißker
12	avm/res/data-protection/backup-vault	Data Protection Backup Vault	abhishekaryams Abhishek Arya
13	avm/res/databricks/access-connector	Azure Databricks Access Connector	abhishekaryams Abhishek Arya
14	avm/res/databricks/workspace	Azure Databricks Workspace	abhishekaryams Abhishek Arya
15	avm/res/db-for-my-sql/flexible-server	DB for MySQL Flexible Server	abhishekaryams Abhishek Arya
16	avm/res/health-bot/health-bot	Azure Health Bot	TomazMlakar Tomaz Mlakar
17	avm/res/net-app/net-app-account	Azure NetApp File	fbinotto Felipe Binotto
18	avm/res/network/ddos-protection-plan	DDoS Protection Plan	segraef Sebastian Graef
19	avm/res/network/firewall-policy	Firewall Policy	jtracey93 Jack Tracey oZakari Zach Trocinski
20	avm/res/network/front-door	Azure Front Door
21	avm/res/network/front-door-web-application-firewall-policy	Front Door Web Application Firewall (WAF) Policy	PaulJohnston88 Paul Johnston
22	avm/res/network/local-network-gateway	Local Network Gateway	fabmas Fabio Masciotra
23	avm/res/network/nat-gateway	NAT Gateway NAT GW	fabmas Fabio Masciotra
24	avm/res/network/virtual-network-gateway	Virtual Network Gateway VNET GW	fabmas Fabio Masciotra
25	avm/res/network/vpn-gateway	VPN Gateway VPN GW	fabmas Fabio Masciotra
26	avm/res/storage/storage-account	Storage Account	fblix Felix Borst
27	avm/res/web/site	Web/Function App App Service, Web Site, Logic App, Function App	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal
28	avm/res/web/static-site	Static Web App	ChrisSidebotham Chris Sidebotham

Modules published in December 2023

No.	Module Name	Display Name	Owner(s)
01	avm/res/api-management/service	API Management Service	abhishekaryams Abhishek Arya
02	avm/res/app/managed-environment	App Managed Environment	abhishekaryams Abhishek Arya
03	avm/res/automation/automation-account	Automation Account	gpacetti Giuseppe Pacetti
04	avm/res/compute/gallery	Azure Compute Gallery	ReneHezser Rene Hezser
05	avm/res/data-factory/factory	Data Factory	TomazMlakar Tomaz Mlakar
06	avm/res/document-db/database-account	Cosmos DB Database Account	cmaneu Christopher Maneu
07	avm/res/insights/activity-log-alert	Activity Log Alert	donk-msft Don Koning
08	avm/res/insights/data-collection-endpoint	Data Collection Endpoint	krbar Kris Baranek
09	avm/res/insights/data-collection-rule	Data Collection Rule DCR	krbar Kris Baranek
10	avm/res/insights/metric-alert	Metric Alert	kijunkang Ki Jun Kang
11	avm/res/insights/scheduled-query-rule	Scheduled Query Rule	abhishekaryams Abhishek Arya
12	avm/res/insights/webtest	Web Test	Jfolberth John Folberth
13	avm/res/maintenance/maintenance-configuration	Maintenance Configuration	arievanderwende Arie van der Wende
14	avm/res/managed-identity/user-assigned-identity	User Assigned Identity MSI	gpacetti Giuseppe Pacetti
15	avm/res/network/application-security-group	Application Security Group (ASG) ASG	segraef Sebastian Graef
16	avm/res/network/bastion-host	Bastion Host	krbar Kris Baranek
17	avm/res/network/connection	Virtual Network Gateway Connection	fabmas Fabio Masciotra
18	avm/res/network/network-security-group	Network Security Group NSG	ahmadabdalla Ahmad Abdalla
19	avm/res/network/public-ip-prefix	Public IP Prefix PIP Prefix	krbar Kris Baranek
20	avm/res/network/trafficmanagerprofile	Traffic Manager Profile	lsnoddy Luke Snoddy
21	avm/res/network/vpn-site	VPN Site	fabmas Fabio Masciotra
22	avm/res/resources/resource-group	Resource Group RG	segraef Sebastian Graef
23	avm/res/service-bus/namespace	Service Bus Namespace	ChrisSidebotham Chris Sidebotham
24	avm/res/web/serverfarm	App Service Plan	tsc-buddy Buddy Davies pankajagrawal16 Pankaj Agrawal

Modules published in November 2023

No.	Module Name	Display Name	Owner(s)
01	avm/res/batch/batch-account	Batch Account	didayal-msft Divyadeep Dayal
02	avm/res/db-for-postgre-sql/flexible-server	DB for Postgre SQL Flexible Server	arnoldna Nate Arnold
03	avm/res/event-grid/domain	Event Grid Domain	fabmas Fabio Masciotra
04	avm/res/event-grid/system-topic	Event Grid System Topic	fabmas Fabio Masciotra
05	avm/res/event-grid/topic	Event Grid Topic	fabmas Fabio Masciotra
06	avm/res/insights/component	Application Insight	krbar Kris Baranek
07	avm/res/insights/diagnostic-setting	Diagnostic Setting	krbar Kris Baranek
08	avm/res/logic/workflow	Logic Apps Workflow	lsnoddy Luke Snoddy
09	avm/res/network/express-route-circuit	ExpressRoute Circuit ER Circuit	arnoldna Nate Arnold
10	avm/res/network/express-route-gateway	Express Route Gateway ER GW	arnoldna Nate Arnold
11	avm/res/network/load-balancer	Load Balancer LB, NLB	arnoldna Nate Arnold
12	avm/res/network/route-table	Route Table UDR	segraef Sebastian Graef
13	avm/res/network/virtual-network	Virtual Network VNET	mjrich19 MJ Richardson
14	avm/res/operational-insights/workspace	Log Analytics Workspace	krbar Kris Baranek
15	avm/res/operations-management/solution	Operations Management Solution	krbar Kris Baranek
16	avm/res/power-bi-dedicated/capacity	Power BI Dedicated Capacity	ChrisSidebotham Chris Sidebotham
17	avm/res/resource-graph/query	Resource Graph Query	sebassem Seif Bassem
18	avm/res/resources/deployment-script	Deployment Script	sebassem Seif Bassem
19	avm/res/search/search-service	Search Service	krbar Kris Baranek
20	avm/res/sql/server	Azure SQL Server	peterbud Peter Budai

Modules published in October 2023

No.	Module Name	Display Name	Owner(s)
01	avm/res/cognitive-services/account	Azure AI Services (Cognitive Services) AI Foundry	mswantek68 Mike Swantek chanakanissanka Chanaka Nissanka
02	avm/res/compute/ssh-public-key	Public SSH Key	ChrisSidebotham Chris Sidebotham
03	avm/res/document-db/mongo-cluster	Cosmos DB for MongoDB (vCore)	sinedied Yohan Lasorsa
04	avm/res/insights/action-group	Action Group	rahalan Rainer Halanek
05	avm/res/key-vault/vault	Key Vault KV	fblix Felix Borst
06	avm/res/kubernetes-configuration/extension	Kubernetes Configuration Extension	JPEasier Julian Peißker
07	avm/res/kubernetes-configuration/flux-configuration	Kubernetes Configuration Flux Configuration	JPEasier Julian Peißker
08	avm/res/network/dns-forwarding-ruleset	DNS Forwarding Ruleset	ChrisSidebotham Chris Sidebotham
09	avm/res/network/dns-resolver	DNS Resolver	ChrisSidebotham Chris Sidebotham
10	avm/res/network/dns-zone	Public DNS Zone	ChrisSidebotham Chris Sidebotham
11	avm/res/network/network-interface	Network Interface NIC	rahalan Rainer Halanek
12	avm/res/network/private-dns-zone	Private DNS Zone	ChrisSidebotham Chris Sidebotham
13	avm/res/network/private-endpoint	Private Endpoint	segraef Sebastian Graef
14	avm/res/network/public-ip-address	Public IP Address PIP	ChrisSidebotham Chris Sidebotham krbar Kris Baranek

Consistent Features & Extension Resources (Interfaces)

➕ Consistent Features & Extension Resources (Interfaces)

The following table shows which Bicep resource modules have which consistent features and extension resources (interfaces) implemented as defined in the Bicep Interfaces specification.

#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
1	avm/res/aad/domain-service	✅	✅	✅	✅
2	avm/res/alerts-management/action-rule	✅	✅	✅
3	avm/res/analysis-services/server	✅	✅	✅	✅
4	avm/res/api-management/service	✅	✅	✅	✅	✅			✅
5	avm/res/app-configuration/configuration-store	✅	✅	✅	✅	✅	✅		✅
6	avm/res/app/container-app	✅	✅	✅	✅				✅
7	avm/res/app/job	✅	✅	✅					✅
8	avm/res/app/managed-environment	✅	✅	✅					✅
9	avm/res/app/session-pool	✅	✅	✅					✅
10	avm/res/authorization/policy-assignment
11	avm/res/authorization/role-assignment
12	avm/res/automation/automation-account	✅	✅	✅	✅	✅	✅		✅
13	avm/res/azure-stack-hci/cluster	✅		✅
14	avm/res/azure-stack-hci/logical-network	✅		✅
15	avm/res/azure-stack-hci/marketplace-gallery-image	✅		✅
16	avm/res/azure-stack-hci/network-interface	✅		✅
17	avm/res/azure-stack-hci/virtual-hard-disk	✅		✅
18	avm/res/azure-stack-hci/virtual-machine-instance	✅
19	avm/res/batch/batch-account	✅	✅	✅	✅	✅	✅		✅
20	avm/res/cache/redis	✅	✅	✅	✅	✅			✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
21	avm/res/cache/redis-enterprise	✅	✅	✅	✅	✅	✅	✅	✅
22	avm/res/cdn/profile	✅	✅	✅	✅				✅
23	avm/res/cognitive-services/account	✅	✅	✅	✅	✅	✅	✅	✅
24	avm/res/communication/communication-service	✅	✅	✅	✅				✅
25	avm/res/communication/email-service	✅	✅	✅
26	avm/res/compute/availability-set	✅	✅	✅
27	avm/res/compute/disk	✅	✅	✅
28	avm/res/compute/disk-encryption-set	✅	✅	✅			✅	✅	✅
29	avm/res/compute/gallery	✅	✅	✅
30	avm/res/compute/image	✅		✅
31	avm/res/compute/proximity-placement-group	✅	✅	✅
32	avm/res/compute/ssh-public-key	✅	✅	✅
33	avm/res/compute/virtual-machine	✅	✅	✅					✅
34	avm/res/compute/virtual-machine-scale-set	✅	✅	✅	✅				✅
35	avm/res/consumption/budget
36	avm/res/container-instance/container-group		✅	✅			✅		✅
37	avm/res/container-registry/registry	✅	✅	✅	✅	✅	✅		✅
38	avm/res/container-service/managed-cluster	✅	✅	✅	✅				✅
39	avm/res/data-factory/factory	✅	✅	✅	✅	✅	✅	✅	✅
40	avm/res/data-protection/backup-vault	✅	✅	✅			✅	✅	✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
41	avm/res/databricks/access-connector	✅	✅	✅					✅
42	avm/res/databricks/workspace	✅	✅	✅	✅	✅	✅	✅
43	avm/res/db-for-my-sql/flexible-server	✅	✅	✅	✅	✅	✅	✅	✅
44	avm/res/db-for-postgre-sql/flexible-server	✅	✅	✅	✅	✅	✅	✅	✅
45	avm/res/desktop-virtualization/application-group	✅	✅	✅	✅
46	avm/res/desktop-virtualization/host-pool	✅	✅	✅	✅	✅
47	avm/res/desktop-virtualization/scaling-plan	✅	✅	✅	✅
48	avm/res/desktop-virtualization/workspace	✅	✅	✅	✅	✅
49	avm/res/dev-center/devcenter	✅	✅	✅	✅				✅
50	avm/res/dev-center/network-connection	✅	✅	✅
51	avm/res/dev-center/project	✅	✅	✅					✅
52	avm/res/dev-ops-infrastructure/pool	✅	✅	✅	✅				✅
53	avm/res/dev-test-lab/lab	✅	✅	✅					✅
54	avm/res/devices/iot-hub	✅	✅	✅	✅	✅			✅
55	avm/res/digital-twins/digital-twins-instance	✅	✅	✅	✅	✅			✅
56	avm/res/document-db/database-account	✅	✅	✅	✅	✅	✅	✅	✅
57	avm/res/document-db/mongo-cluster	✅	✅	✅	✅	✅
58	avm/res/elastic-san/elastic-san	✅	✅	✅	✅
59	avm/res/event-grid/domain	✅	✅	✅	✅	✅			✅
60	avm/res/event-grid/namespace	✅	✅	✅	✅	✅			✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
61	avm/res/event-grid/system-topic	✅	✅	✅	✅				✅
62	avm/res/event-grid/topic	✅	✅	✅	✅	✅			✅
63	avm/res/event-hub/namespace	✅	✅	✅	✅	✅	✅	✅	✅
64	avm/res/fabric/capacity		✅	✅
65	avm/res/health-bot/health-bot	✅	✅	✅					✅
66	avm/res/healthcare-apis/workspace	✅	✅	✅
67	avm/res/hybrid-compute/gateway		✅	✅
68	avm/res/hybrid-compute/license			✅
69	avm/res/hybrid-compute/machine	✅	✅	✅
70	avm/res/hybrid-container-service/provisioned-cluster-instance			✅
71	avm/res/insights/action-group	✅	✅	✅
72	avm/res/insights/activity-log-alert	✅	✅	✅
73	avm/res/insights/component	✅	✅	✅	✅
74	avm/res/insights/data-collection-endpoint	✅	✅	✅
75	avm/res/insights/data-collection-rule	✅	✅	✅					✅
76	avm/res/insights/diagnostic-setting
77	avm/res/insights/metric-alert	✅	✅	✅
78	avm/res/insights/private-link-scope	✅	✅	✅		✅
79	avm/res/insights/scheduled-query-rule	✅	✅	✅					✅
80	avm/res/insights/webtest	✅	✅	✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
81	avm/res/key-vault/vault	✅	✅	✅	✅	✅
82	avm/res/kubernetes-configuration/extension
83	avm/res/kubernetes-configuration/flux-configuration
84	avm/res/kubernetes-runtime/load-balancer
85	avm/res/kubernetes/connected-cluster	✅		✅
86	avm/res/kusto/cluster	✅	✅	✅	✅	✅	✅		✅
87	avm/res/load-test-service/load-test	✅	✅	✅			✅		✅
88	avm/res/logic/integration-account	✅	✅	✅	✅
89	avm/res/logic/workflow	✅	✅	✅	✅				✅
90	avm/res/machine-learning-services/registry	✅	✅	✅		✅			✅
91	avm/res/machine-learning-services/workspace	✅	✅	✅	✅	✅	✅		✅
92	avm/res/maintenance/configuration-assignment
93	avm/res/maintenance/maintenance-configuration	✅	✅	✅
94	avm/res/managed-identity/user-assigned-identity	✅	✅	✅
95	avm/res/managed-services/registration-definition
96	avm/res/management/management-group
97	avm/res/management/service-group	✅	✅
98	avm/res/maps/account	✅		✅			✅	✅	✅
99	avm/res/net-app/net-app-account	✅	✅	✅			✅	✅	✅
100	avm/res/network/application-gateway	✅	✅	✅	✅	✅			✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
101	avm/res/network/application-gateway-web-application-firewall-policy	✅	✅	✅
102	avm/res/network/application-security-group	✅	✅	✅
103	avm/res/network/azure-firewall	✅	✅	✅	✅
104	avm/res/network/bastion-host	✅	✅	✅	✅
105	avm/res/network/connection		✅	✅
106	avm/res/network/ddos-protection-plan	✅	✅	✅
107	avm/res/network/dns-forwarding-ruleset	✅	✅	✅
108	avm/res/network/dns-resolver	✅	✅	✅
109	avm/res/network/dns-zone	✅	✅	✅
110	avm/res/network/express-route-circuit	✅	✅	✅	✅
111	avm/res/network/express-route-gateway	✅	✅	✅
112	avm/res/network/express-route-port	✅	✅	✅					✅
113	avm/res/network/firewall-policy	✅	✅	✅					✅
114	avm/res/network/front-door	✅	✅	✅	✅
115	avm/res/network/front-door-web-application-firewall-policy	✅	✅	✅
116	avm/res/network/ip-group	✅	✅	✅
117	avm/res/network/load-balancer	✅	✅	✅	✅
118	avm/res/network/local-network-gateway	✅	✅	✅
119	avm/res/network/nat-gateway	✅	✅	✅
120	avm/res/network/network-interface	✅	✅	✅	✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
121	avm/res/network/network-manager	✅	✅	✅
122	avm/res/network/network-security-group	✅	✅	✅	✅
123	avm/res/network/network-security-perimeter	✅	✅	✅	✅
124	avm/res/network/network-watcher	✅	✅	✅
125	avm/res/network/p2s-vpn-gateway		✅	✅
126	avm/res/network/private-dns-zone	✅	✅	✅
127	avm/res/network/private-endpoint	✅	✅	✅
128	avm/res/network/private-link-service	✅	✅	✅
129	avm/res/network/public-ip-address	✅	✅	✅	✅
130	avm/res/network/public-ip-prefix	✅	✅	✅
131	avm/res/network/route-table	✅	✅	✅
132	avm/res/network/service-endpoint-policy	✅	✅	✅
133	avm/res/network/trafficmanagerprofile	✅	✅	✅	✅
134	avm/res/network/virtual-hub		✅	✅
135	avm/res/network/virtual-network	✅	✅	✅	✅
136	avm/res/network/virtual-network-gateway	✅	✅	✅	✅
137	avm/res/network/virtual-wan	✅	✅	✅
138	avm/res/network/vpn-gateway		✅	✅
139	avm/res/network/vpn-server-configuration		✅	✅
140	avm/res/network/vpn-site	✅	✅	✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
141	avm/res/operational-insights/cluster	✅	✅	✅			✅	✅	✅
142	avm/res/operational-insights/workspace	✅	✅	✅	✅				✅
143	avm/res/operations-management/solution
144	avm/res/portal/dashboard	✅	✅	✅
145	avm/res/power-bi-dedicated/capacity	✅	✅	✅
146	avm/res/purview/account	✅	✅	✅	✅				✅
147	avm/res/recovery-services/vault	✅	✅	✅	✅	✅	✅	✅	✅
148	avm/res/relay/namespace	✅	✅	✅	✅	✅
149	avm/res/resource-graph/query	✅	✅	✅
150	avm/res/resources/deployment-script	✅	✅	✅					✅
151	avm/res/resources/resource-group	✅	✅	✅
152	avm/res/search/search-service	✅	✅	✅	✅	✅			✅
153	avm/res/security-insights/data-connector
154	avm/res/security-insights/setting	✅
155	avm/res/service-bus/namespace	✅	✅	✅	✅	✅	✅	✅	✅
156	avm/res/service-fabric/cluster	✅	✅	✅
157	avm/res/service-networking/traffic-controller	✅	✅	✅	✅
158	avm/res/signal-r-service/signal-r	✅	✅	✅	✅	✅			✅
159	avm/res/signal-r-service/web-pub-sub	✅	✅	✅		✅			✅
160	avm/res/sql/instance-pool			✅
#	Module	RBAC	Locks	Tags	Diag	PE	CMK	CMK-mHSM	Identity
161	avm/res/sql/managed-instance	✅	✅	✅	✅				✅
162	avm/res/sql/server	✅	✅	✅		✅	✅	✅	✅
163	avm/res/storage/storage-account	✅	✅	✅	✅	✅	✅	✅	✅
164	avm/res/synapse/private-link-hub	✅	✅	✅		✅
165	avm/res/synapse/workspace	✅	✅	✅	✅	✅	✅		✅
166	avm/res/virtual-machine-images/image-template	✅	✅	✅					✅
167	avm/res/web/connection	✅	✅	✅
168	avm/res/web/hosting-environment	✅	✅	✅	✅				✅
169	avm/res/web/serverfarm	✅	✅	✅	✅				✅
170	avm/res/web/site	✅	✅	✅	✅	✅			✅
171	avm/res/web/static-site	✅	✅	✅		✅			✅
Sum		148	146	156	68	40	26	17	67

For Module Owners & Contributors

Note

This section is mainly intended for module owners and contributors as it contains information important for module development, such as telemetry ID prefix, and GitHub Teams for Owners.

Module name, Telemetry ID prefix, GitHub Teams for Owners

➕ All Modules - Module name, Telemetry ID prefix, GitHub Teams for Owners

No.	Module Name	Telemetry ID prefix	GitHub Teams for Module Owners (`@Azure` org)
01	avm/res/aad/domain-service	`46d3xbcp.res.aad-domainservice`	`avm-res-aad-domainservice-module-owners-bicep`
02	avm/res/alerts-management/action-rule	`46d3xbcp.res.alertsmanagement-actionrule`	`avm-res-alertsmanagement-actionrule-module-owners-bicep`
03	avm/res/analysis-services/server	`46d3xbcp.res.analysisservices-server`	`avm-res-analysisservices-server-module-owners-bicep`
04	avm/res/api-center/service	`46d3xbcp.res.apicenter-service`	`avm-res-apicenter-service-module-owners-bicep`
05	avm/res/api-management/service	`46d3xbcp.res.apimanagement-service`	`avm-res-apimanagement-service-module-owners-bicep`
06	avm/res/api-management/service/api	`46d3xbcp.res.apimgmt-api`	`avm-res-apimanagement-service-module-owners-bicep`
07	avm/res/api-management/service/api-version-set	`46d3xbcp.res.apimgmt-apiversionset`	`avm-res-apimanagement-service-module-owners-bicep`
08	avm/res/api-management/service/api/diagnostics	`46d3xbcp.res.apimgm-apidiagnostics`	`avm-res-apimanagement-service-module-owners-bicep`
09	avm/res/api-management/service/api/operation	`46d3xbcp.res.apimgmt-service-apioperation`	`avm-res-apimanagement-service-module-owners-bicep`
10	avm/res/api-management/service/api/operation/policy	`46d3xbcp.res.apimgmt-service-apioperationpolicy`	`avm-res-apimanagement-service-module-owners-bicep`
11	avm/res/api-management/service/api/policy	`46d3xbcp.res.apimgmt-apipolicy`	`avm-res-apimanagement-service-module-owners-bicep`
12	avm/res/api-management/service/authorization-server	`46d3xbcp.res.apimgmt-authzserver`	`avm-res-apimanagement-service-module-owners-bicep`
13	avm/res/api-management/service/backend	`46d3xbcp.res.apimgmt-backend`	`avm-res-apimanagement-service-module-owners-bicep`
14	avm/res/api-management/service/cache	`46d3xbcp.res.apimgmt-cache`	`avm-res-apimanagement-service-module-owners-bicep`
15	avm/res/api-management/service/diagnostics	`46d3xbcp.res.apimgmt-service-diag`	`avm-res-apimanagement-service-module-owners-bicep`
16	avm/res/api-management/service/identity-provider	`46d3xbcp.res.apimgmt-identityprovider`	`avm-res-apimanagement-service-module-owners-bicep`
17	avm/res/api-management/service/logger	`46d3xbcp.res.apimgmt-logger`	`avm-res-apimanagement-service-module-owners-bicep`
18	avm/res/api-management/service/named-value	`46d3xbcp.res.apimgmt-namedvalue`	`avm-res-apimanagement-service-module-owners-bicep`
19	avm/res/api-management/service/policy	`46d3xbcp.res.apimgmt-policy`	`avm-res-apimanagement-service-module-owners-bicep`
20	avm/res/api-management/service/portalsetting	`46d3xbcp.res.apimgmt-portalsetting`	`avm-res-apimanagement-service-module-owners-bicep`
21	avm/res/api-management/service/private-endpoint-connection	`46d3xbcp.res.apimgmt-privendpointconn`	`avm-res-apimanagement-service-module-owners-bicep`
22	avm/res/api-management/service/product	`46d3xbcp.res.apimgmt-product`	`avm-res-apimanagement-service-module-owners-bicep`
23	avm/res/api-management/service/product/api	`46d3xbcp.res.apimgmt-productapi`	`avm-res-apimanagement-service-module-owners-bicep`
24	avm/res/api-management/service/product/group	`46d3xbcp.res.apimgmt-productgroup`	`avm-res-apimanagement-service-module-owners-bicep`
25	avm/res/api-management/service/product/policy	`46d3xbcp.res.apimgmt-service-productpolicy`	`avm-res-apimanagement-service-module-owners-bicep`
26	avm/res/api-management/service/subscription	`46d3xbcp.res.apimgmt-subscription`	`avm-res-apimanagement-service-module-owners-bicep`
27	avm/res/api-management/service/workspace	`46d3xbcp.res.apimgmt-workspace`	`avm-res-apimanagement-service-module-owners-bicep`
28	avm/res/api-management/service/workspace/api	`46d3xbcp.res.apimgmt-service-workspaceapi`	`avm-res-apimanagement-service-module-owners-bicep`
29	avm/res/api-management/service/workspace/api-version-set	`46d3xbcp.res.apimgmt-service-workspaceapiverset`	`avm-res-apimanagement-service-module-owners-bicep`
30	avm/res/api-management/service/workspace/api/diagnostics	`46d3xbcp.res.apimgmt-service-workspaceapidiag`	`avm-res-apimanagement-service-module-owners-bicep`
31	avm/res/api-management/service/workspace/api/operation	`46d3xbcp.res.apimgmt-service-workspaceapiop`	`avm-res-apimanagement-service-module-owners-bicep`
32	avm/res/api-management/service/workspace/api/operation/policy	`46d3xbcp.res.apimgmt-service-workspaceapioppol`	`avm-res-apimanagement-service-module-owners-bicep`
33	avm/res/api-management/service/workspace/api/policy	`46d3xbcp.res.apimgmt-service-workspaceapipol`	`avm-res-apimanagement-service-module-owners-bicep`
34	avm/res/api-management/service/workspace/backend	`46d3xbcp.res.apimgmt-service-workspacebackend`	`avm-res-apimanagement-service-module-owners-bicep`
35	avm/res/api-management/service/workspace/diagnostics	`46d3xbcp.res.apimgmt-service-workspacediag`	`avm-res-apimanagement-service-module-owners-bicep`
36	avm/res/api-management/service/workspace/logger	`46d3xbcp.res.apimgmt-service-workspacelogger`	`avm-res-apimanagement-service-module-owners-bicep`
37	avm/res/api-management/service/workspace/named-value	`46d3xbcp.res.apimgmt-service-workspacenamedval`	`avm-res-apimanagement-service-module-owners-bicep`
38	avm/res/api-management/service/workspace/policy	`46d3xbcp.res.apimgmt-service-workspacepolicy`	`avm-res-apimanagement-service-module-owners-bicep`
39	avm/res/api-management/service/workspace/product	`46d3xbcp.res.apimgmt-service-workspaceproduct`	`avm-res-apimanagement-service-module-owners-bicep`
40	avm/res/api-management/service/workspace/product/api-link	`46d3xbcp.res.apimgmt-service-workspprodapilink`	`avm-res-apimanagement-service-module-owners-bicep`
41	avm/res/api-management/service/workspace/product/group-link	`46d3xbcp.res.apimgmt-service-workspprodgrplink`	`avm-res-apimanagement-service-module-owners-bicep`
42	avm/res/api-management/service/workspace/product/policy	`46d3xbcp.res.apimgmt-service-workspprodpolicy`	`avm-res-apimanagement-service-module-owners-bicep`
43	avm/res/api-management/service/workspace/subscription	`46d3xbcp.res.apimgmt-service-workspacesub`	`avm-res-apimanagement-service-module-owners-bicep`
44	avm/res/app-configuration/configuration-store	`46d3xbcp.res.appconfiguration-configurationstore`	`avm-res-appconfiguration-configurationstore-module-owners-bicep`
45	avm/res/app-configuration/configuration-store/key-value	`46d3xbcp.res.appconfig-configstore-keyvalue`	`avm-res-appconfiguration-configurationstore-module-owners-bicep`
46	avm/res/app-configuration/configuration-store/replica	`46d3xbcp.res.appconfig-configstore-replica`	`avm-res-appconfiguration-configurationstore-module-owners-bicep`
47	avm/res/app/agent	`46d3xbcp.res.app-agent`	`avm-res-app-agent-module-owners-bicep`
48	avm/res/app/container-app	`46d3xbcp.res.app-containerapp`	`avm-res-app-containerapp-module-owners-bicep`
49	avm/res/app/container-app/auth-config	`46d3xbcp.res.app-containerapp-authconfig`	`avm-res-app-containerapp-module-owners-bicep`
50	avm/res/app/job	`46d3xbcp.res.app-job`	`avm-res-app-job-module-owners-bicep`
51	avm/res/app/managed-environment	`46d3xbcp.res.app-managedenvironment`	`avm-res-app-managedenvironment-module-owners-bicep`
52	avm/res/app/managed-environment/certificate	`46d3xbcp.res.app-managedenvironment-certificate`	`avm-res-app-managedenvironment-module-owners-bicep`
53	avm/res/app/managed-environment/storage	`46d3xbcp.res.app-managedenvironment-storage`	`avm-res-app-managedenvironment-module-owners-bicep`
54	avm/res/app/session-pool	`46d3xbcp.res.app-sessionpool`	`avm-res-app-sessionpool-module-owners-bicep`
55	avm/res/authorization/policy-assignment	`46d3xbcp.res.authz-policyassignment`	`avm-res-authorization-policyassignment-module-owners-bicep`
56	avm/res/authorization/policy-assignment/mg-scope	`46d3xbcp.res.authz-policyassignment_mgscope`	`avm-res-authorization-policyassignment-module-owners-bicep`
57	avm/res/authorization/policy-assignment/rg-scope	`46d3xbcp.res.authz-policyassignment_rgscope`	`avm-res-authorization-policyassignment-module-owners-bicep`
58	avm/res/authorization/policy-assignment/sub-scope	`46d3xbcp.res.authz-policyassignment_subscope`	`avm-res-authorization-policyassignment-module-owners-bicep`
59	avm/res/authorization/role-assignment	`46d3xbcp.res.authz-roleassignment`	`avm-res-authorization-roleassignment-module-owners-bicep`
60	avm/res/authorization/role-assignment/mg-scope	`46d3xbcp.res.authz-roleassignment_mgscope`	`avm-res-authorization-roleassignment-module-owners-bicep`
61	avm/res/authorization/role-assignment/rg-scope	`46d3xbcp.res.authz-roleassignment_rgscope`	`avm-res-authorization-roleassignment-module-owners-bicep`
62	avm/res/authorization/role-assignment/sub-scope	`46d3xbcp.res.authz-roleassignment_subscope`	`avm-res-authorization-roleassignment-module-owners-bicep`
63	avm/res/automation/automation-account	`46d3xbcp.res.automation-automationaccount`	`avm-res-automation-automationaccount-module-owners-bicep`
64	avm/res/automation/automation-account/credential	`46d3xbcp.res.aut-autacct-credential`	`avm-res-automation-automationaccount-module-owners-bicep`
65	avm/res/automation/automation-account/hybrid-runbook-worker-group	`46d3xbcp.res.aut-autacct-hybrunbookwrkrgrp`	`avm-res-automation-automationaccount-module-owners-bicep`
66	avm/res/automation/automation-account/hybrid-runbook-worker-group/hybrid-runbook-worker	`46d3xbcp.res.aut-autacct-hybrunbkwrkrgrphybrubo`	`avm-res-automation-automationaccount-module-owners-bicep`
67	avm/res/automation/automation-account/job-schedule	`46d3xbcp.res.aut-autacct-jobschedule`	`avm-res-automation-automationaccount-module-owners-bicep`
68	avm/res/automation/automation-account/module	`46d3xbcp.res.aut-autacct-module`	`avm-res-automation-automationaccount-module-owners-bicep`
69	avm/res/automation/automation-account/powershell72-module	`46d3xbcp.res.aut-autacct-powersh72module`	`avm-res-automation-automationaccount-module-owners-bicep`
70	avm/res/automation/automation-account/python2-package	`46d3xbcp.res.aut-autacct-python2package`	`avm-res-automation-automationaccount-module-owners-bicep`
71	avm/res/automation/automation-account/python3-package	`46d3xbcp.res.aut-autacct-python3package`	`avm-res-automation-automationaccount-module-owners-bicep`
72	avm/res/automation/automation-account/runbook	`46d3xbcp.res.aut-autacct-runbook`	`avm-res-automation-automationaccount-module-owners-bicep`
73	avm/res/automation/automation-account/schedule	`46d3xbcp.res.aut-autacct-schedule`	`avm-res-automation-automationaccount-module-owners-bicep`
74	avm/res/automation/automation-account/source-control	`46d3xbcp.res.aut-autacct-sourcecontrol`	`avm-res-automation-automationaccount-module-owners-bicep`
75	avm/res/automation/automation-account/variable	`46d3xbcp.res.aut-autacct-variable`	`avm-res-automation-automationaccount-module-owners-bicep`
76	avm/res/automation/automation-account/webhook	`46d3xbcp.res.aut-autacct-webhook`	`avm-res-automation-automationaccount-module-owners-bicep`
77	avm/res/avs/private-cloud	`46d3xbcp.res.avs-privatecloud`	`avm-res-avs-privatecloud-module-owners-bicep`
78	avm/res/azure-stack-hci/cluster	`46d3xbcp.res.azurestackhci-cluster`	`avm-res-azurestackhci-cluster-module-owners-bicep`
79	avm/res/azure-stack-hci/cluster/arc-setting/extension	`46d3xbcp.res.azurestackhci-clusterarcsetting`	`avm-res-azurestackhci-cluster-module-owners-bicep`
80	avm/res/azure-stack-hci/cluster/deployment-setting	`46d3xbcp.res.azurestackhci-cluster-deplsetting`	`avm-res-azurestackhci-cluster-module-owners-bicep`
81	avm/res/azure-stack-hci/logical-network	`46d3xbcp.res.azurestackhci-logicalnetwork`	`avm-res-azurestackhci-logicalnetwork-module-owners-bicep`
82	avm/res/azure-stack-hci/marketplace-gallery-image	`46d3xbcp.res.azurestackhci-markplgalleryimg`	`avm-res-azurestackhci-marketplacegalleryimage-module-owners-bicep`
83	avm/res/azure-stack-hci/network-interface	`46d3xbcp.res.azurestackhci-networkinterface`	`avm-res-azurestackhci-networkinterface-module-owners-bicep`
84	avm/res/azure-stack-hci/virtual-hard-disk	`46d3xbcp.res.azurestackhci-virtualharddisk`	`avm-res-azurestackhci-virtualharddisk-module-owners-bicep`
85	avm/res/azure-stack-hci/virtual-machine-instance	`46d3xbcp.res.azurestackhci-virtualmachineinstance`	`avm-res-azurestackhci-virtualmachineinstance-module-owners-bicep`
86	avm/res/batch/batch-account	`46d3xbcp.res.batch-batchaccount`	`avm-res-batch-batchaccount-module-owners-bicep`
87	avm/res/bot-service/bot-service	`46d3xbcp.res.botservice-botservice`	`avm-res-botservice-botservice-module-owners-bicep`
88	avm/res/cache/redis	`46d3xbcp.res.cache-redis`	`avm-res-cache-redis-module-owners-bicep`
89	avm/res/cache/redis-enterprise	`46d3xbcp.res.cache-redisenterprise`	`avm-res-cache-redisenterprise-module-owners-bicep`
90	avm/res/cache/redis-enterprise/database	`46d3xbcp.res.cache-redisenterprise-database`	`avm-res-cache-redisenterprise-module-owners-bicep`
91	avm/res/cache/redis-enterprise/database/access-policy-assignment	`46d3xbcp.res.cache-redisenterprise-databaseaccess`	`avm-res-cache-redisenterprise-module-owners-bicep`
92	avm/res/cache/redis/access-policy	`46d3xbcp.res.cache-redis-accesspolicy`	`avm-res-cache-redis-module-owners-bicep`
93	avm/res/cache/redis/access-policy-assignment	`46d3xbcp.res.cache-redis-accesspolicyassignment`	`avm-res-cache-redis-module-owners-bicep`
94	avm/res/cache/redis/firewall-rule	`46d3xbcp.res.cache-redis-firewallrule`	`avm-res-cache-redis-module-owners-bicep`
95	avm/res/cache/redis/linked-server	`46d3xbcp.res.cache-redis-linkedserver`	`avm-res-cache-redis-module-owners-bicep`
96	avm/res/cdn/profile	`46d3xbcp.res.cdn-profile`	`avm-res-cdn-profile-module-owners-bicep`
97	avm/res/cdn/profile/afd-endpoint	`46d3xbcp.res.cdn-profile-afdendpoint`	`avm-res-cdn-profile-module-owners-bicep`
98	avm/res/cdn/profile/afd-endpoint/route	`46d3xbcp.res.cdn-profile-afdendpointroute`	`avm-res-cdn-profile-module-owners-bicep`
99	avm/res/cdn/profile/custom-domain	`46d3xbcp.res.cdn-profile-domain`	`avm-res-cdn-profile-module-owners-bicep`
100	avm/res/cdn/profile/endpoint	`46d3xbcp.res.cdn-profile-endpoint`	`avm-res-cdn-profile-module-owners-bicep`
101	avm/res/cdn/profile/endpoint/origin	`46d3xbcp.res.cdn-profile-endpointorigin`	`avm-res-cdn-profile-module-owners-bicep`
102	avm/res/cdn/profile/origin-group	`46d3xbcp.res.cdn-profile-origingroup`	`avm-res-cdn-profile-module-owners-bicep`
103	avm/res/cdn/profile/origin-group/origin	`46d3xbcp.res.cdn-profile-origingroup-origin`	`avm-res-cdn-profile-module-owners-bicep`
104	avm/res/cdn/profile/rule-set	`46d3xbcp.res.cdn-profile-ruleset`	`avm-res-cdn-profile-module-owners-bicep`
105	avm/res/cdn/profile/rule-set/rule	`46d3xbcp.res.cdn-profile-rulesetrule`	`avm-res-cdn-profile-module-owners-bicep`
106	avm/res/cdn/profile/secret	`46d3xbcp.res.cdn-profile-secret`	`avm-res-cdn-profile-module-owners-bicep`
107	avm/res/cdn/profile/security-policy	`46d3xbcp.res.cdn-profile-securitypolicy`	`avm-res-cdn-profile-module-owners-bicep`
108	avm/res/chaos/experiment	`46d3xbcp.res.chaos-experiment`	`avm-res-chaos-experiment-module-owners-bicep`
109	avm/res/code-signing/code-signing-account	`46d3xbcp.res.codesigning-codesigningaccount`	`avm-res-codesigning-codesigningaccount-module-owners-bicep`
110	avm/res/cognitive-services/account	`46d3xbcp.res.cognitiveservices-account`	`avm-res-cognitiveservices-account-module-owners-bicep`
111	avm/res/cognitive-services/account/project	`46d3xbcp.res.cognitiveservices-account-project`	`avm-res-cognitiveservices-account-module-owners-bicep`
112	avm/res/communication/communication-service	`46d3xbcp.res.communication-communicationservice`	`avm-res-communication-communicationservice-module-owners-bicep`
113	avm/res/communication/email-service	`46d3xbcp.res.communication-emailservice`	`avm-res-communication-emailservice-module-owners-bicep`
114	avm/res/communication/email-service/domain	`46d3xbcp.res.comm-emailservice-domain`	`avm-res-communication-emailservice-module-owners-bicep`
115	avm/res/communication/email-service/domain/sender-username	`46d3xbcp.res.comm-emailservice-domsndrusrname`	`avm-res-communication-emailservice-module-owners-bicep`
116	avm/res/compute/availability-set	`46d3xbcp.res.compute-availabilityset`	`avm-res-compute-availabilityset-module-owners-bicep`
117	avm/res/compute/disk	`46d3xbcp.res.compute-disk`	`avm-res-compute-disk-module-owners-bicep`
118	avm/res/compute/disk-encryption-set	`46d3xbcp.res.compute-diskencryptionset`	`avm-res-compute-diskencryptionset-module-owners-bicep`
119	avm/res/compute/gallery	`46d3xbcp.res.compute-gallery`	`avm-res-compute-gallery-module-owners-bicep`
120	avm/res/compute/gallery/application	`46d3xbcp.res.compute-gallery-application`	`avm-res-compute-gallery-module-owners-bicep`
121	avm/res/compute/gallery/image	`46d3xbcp.res.compute-gallery-image`	`avm-res-compute-gallery-module-owners-bicep`
122	avm/res/compute/image	`46d3xbcp.res.compute-image`	`avm-res-compute-image-module-owners-bicep`
123	avm/res/compute/proximity-placement-group	`46d3xbcp.res.compute-proximityplacementgroup`	`avm-res-compute-proximityplacementgroup-module-owners-bicep`
124	avm/res/compute/ssh-public-key	`46d3xbcp.res.compute-sshpublickey`	`avm-res-compute-sshpublickey-module-owners-bicep`
125	avm/res/compute/virtual-machine	`46d3xbcp.res.compute-virtualmachine`	`avm-res-compute-virtualmachine-module-owners-bicep`
126	avm/res/compute/virtual-machine-scale-set	`46d3xbcp.res.compute-virtualmachinescaleset`	`avm-res-compute-virtualmachinescaleset-module-owners-bicep`
127	avm/res/compute/virtual-machine-scale-set/extension	`46d3xbcp.res.compute-vmss-extension`	`avm-res-compute-virtualmachinescaleset-module-owners-bicep`
128	avm/res/compute/virtual-machine/extension	`46d3xbcp.res.compute-vm-extension`	`avm-res-compute-virtualmachine-module-owners-bicep`
129	avm/res/consumption/budget	`46d3xbcp.res.consumption-budget`	`avm-res-consumption-budget-module-owners-bicep`
130	avm/res/consumption/budget/mg-scope	`46d3xbcp.res.consumption-budget_mgscope`	`avm-res-consumption-budget-module-owners-bicep`
131	avm/res/consumption/budget/rg-scope	`46d3xbcp.res.consumption-budget_rgscope`	`avm-res-consumption-budget-module-owners-bicep`
132	avm/res/consumption/budget/sub-scope	`46d3xbcp.res.consumption-budget_subscope`	`avm-res-consumption-budget-module-owners-bicep`
133	avm/res/container-instance/container-group	`46d3xbcp.res.containerinstance-containergroup`	`avm-res-containerinstance-containergroup-module-owners-bicep`
134	avm/res/container-registry/registry	`46d3xbcp.res.containerregistry-registry`	`avm-res-containerregistry-registry-module-owners-bicep`
135	avm/res/container-registry/registry/cache-rule	`46d3xbcp.res.containerregistry-registry-cacherule`	`avm-res-containerregistry-registry-module-owners-bicep`
136	avm/res/container-registry/registry/credential-set	`46d3xbcp.res.containerregistry-registry-credset`	`avm-res-containerregistry-registry-module-owners-bicep`
137	avm/res/container-registry/registry/replication	`46d3xbcp.res.containerregistry-registry-repl`	`avm-res-containerregistry-registry-module-owners-bicep`
138	avm/res/container-registry/registry/scope-map	`46d3xbcp.res.containerregistry-registry-scopemap`	`avm-res-containerregistry-registry-module-owners-bicep`
139	avm/res/container-registry/registry/task	`46d3xbcp.res.containerregistry-registry-task`	`avm-res-containerregistry-registry-module-owners-bicep`
140	avm/res/container-registry/registry/token	`46d3xbcp.res.containerregistry-registry-token`	`avm-res-containerregistry-registry-module-owners-bicep`
141	avm/res/container-registry/registry/webhook	`46d3xbcp.res.containerregistry-registry-webhook`	`avm-res-containerregistry-registry-module-owners-bicep`
142	avm/res/container-service/managed-cluster	`46d3xbcp.res.containerservice-managedcluster`	`avm-res-containerservice-managedcluster-module-owners-bicep`
143	avm/res/container-service/managed-cluster/agent-pool	`46d3xbcp.res.consvc-mgdcluster-agentpool`	`avm-res-containerservice-managedcluster-module-owners-bicep`
144	avm/res/container-service/managed-cluster/maintenance-configuration	`46d3xbcp.res.consvc-mgdcluster-maintenancecfg`	`avm-res-containerservice-managedcluster-module-owners-bicep`
145	avm/res/dashboard/grafana	`46d3xbcp.res.dashboard-grafana`	`avm-res-dashboard-grafana-module-owners-bicep`
146	avm/res/data-factory/factory	`46d3xbcp.res.datafactory-factory`	`avm-res-datafactory-factory-module-owners-bicep`
147	avm/res/data-factory/factory/integration-runtime	`46d3xbcp.res.datafactory-factory-integrruntime`	`avm-res-datafactory-factory-module-owners-bicep`
148	avm/res/data-factory/factory/linked-service	`46d3xbcp.res.datafactory-factory-linkedservice`	`avm-res-datafactory-factory-module-owners-bicep`
149	avm/res/data-factory/factory/managed-virtual-network	`46d3xbcp.res.datafactory-factory-managedvnet`	`avm-res-datafactory-factory-module-owners-bicep`
150	avm/res/data-factory/factory/managed-virtual-network/managed-private-endpoint	`46d3xbcp.res.datafactory-factory-managedvnetmgdpe`	`avm-res-datafactory-factory-module-owners-bicep`
151	avm/res/data-protection/backup-vault	`46d3xbcp.res.dataprotection-backupvault`	`avm-res-dataprotection-backupvault-module-owners-bicep`
152	avm/res/data-protection/backup-vault/backup-instance	`46d3xbcp.res.dataprot-backupvault-backupinst`	`avm-res-dataprotection-backupvault-module-owners-bicep`
153	avm/res/data-protection/backup-vault/backup-policy	`46d3xbcp.res.dataprot-backupvault-backuppolicy`	`avm-res-dataprotection-backupvault-module-owners-bicep`
154	avm/res/data-protection/resource-guard	`46d3xbcp.res.dataprotection-resourceguard`	`avm-res-dataprotection-resourceguard-module-owners-bicep`
155	avm/res/databricks/access-connector	`46d3xbcp.res.databricks-accessconnector`	`avm-res-databricks-accessconnector-module-owners-bicep`
156	avm/res/databricks/workspace	`46d3xbcp.res.databricks-workspace`	`avm-res-databricks-workspace-module-owners-bicep`
157	avm/res/db-for-my-sql/flexible-server	`46d3xbcp.res.dbformysql-flexibleserver`	`avm-res-dbformysql-flexibleserver-module-owners-bicep`
158	avm/res/db-for-my-sql/flexible-server/administrator	`46d3xbcp.res.dbformysql-flexisrv-administrator`	`avm-res-dbformysql-flexibleserver-module-owners-bicep`
159	avm/res/db-for-my-sql/flexible-server/advanced-threat-protection	`46d3xbcp.res.dbformysql-flexisrv-advdthreatprot`	`avm-res-dbformysql-flexibleserver-module-owners-bicep`
160	avm/res/db-for-my-sql/flexible-server/configuration	`46d3xbcp.res.dbformysql-flexisrv-configuration`	`avm-res-dbformysql-flexibleserver-module-owners-bicep`
161	avm/res/db-for-my-sql/flexible-server/database	`46d3xbcp.res.dbformysql-flexisrv-database`	`avm-res-dbformysql-flexibleserver-module-owners-bicep`
162	avm/res/db-for-my-sql/flexible-server/firewall-rule	`46d3xbcp.res.dbformysql-flexisrv-firewallrule`	`avm-res-dbformysql-flexibleserver-module-owners-bicep`
163	avm/res/db-for-postgre-sql/flexible-server	`46d3xbcp.res.dbforpostgresql-flexibleserver`	`avm-res-dbforpostgresql-flexibleserver-module-owners-bicep`
164	avm/res/db-for-postgre-sql/flexible-server/administrator	`46d3xbcp.res.dbforpostgresql-flexisrv-admin`	`avm-res-dbforpostgresql-flexibleserver-module-owners-bicep`
165	avm/res/db-for-postgre-sql/flexible-server/advanced-threat-protection-setting	`46d3xbcp.res.dbforpostgresql-flexisrv-adthprotstg`	`avm-res-dbforpostgresql-flexibleserver-module-owners-bicep`
166	avm/res/db-for-postgre-sql/flexible-server/configuration	`46d3xbcp.res.dbforpostgresql-flexisrv-config`	`avm-res-dbforpostgresql-flexibleserver-module-owners-bicep`
167	avm/res/db-for-postgre-sql/flexible-server/database	`46d3xbcp.res.dbforpostgresql-flexisrv-database`	`avm-res-dbforpostgresql-flexibleserver-module-owners-bicep`
168	avm/res/db-for-postgre-sql/flexible-server/firewall-rule	`46d3xbcp.res.dbforpostgresql-flexisrv-fwrule`	`avm-res-dbforpostgresql-flexibleserver-module-owners-bicep`
169	avm/res/desktop-virtualization/application-group	`46d3xbcp.res.desktopvirtualization-appgroup`	`avm-res-desktopvirtualization-applicationgroup-module-owners-bicep`
170	avm/res/desktop-virtualization/application-group/application	`46d3xbcp.res.desktopvirtualization-appgroup-app`	`avm-res-desktopvirtualization-applicationgroup-module-owners-bicep`
171	avm/res/desktop-virtualization/host-pool	`46d3xbcp.res.desktopvirtualization-hostpool`	`avm-res-desktopvirtualization-hostpool-module-owners-bicep`
172	avm/res/desktop-virtualization/scaling-plan	`46d3xbcp.res.desktopvirtualization-scalingplan`	`avm-res-desktopvirtualization-scalingplan-module-owners-bicep`
173	avm/res/desktop-virtualization/workspace	`46d3xbcp.res.desktopvirtualization-workspace`	`avm-res-desktopvirtualization-workspace-module-owners-bicep`
174	avm/res/dev-center/devcenter	`46d3xbcp.res.devcenter-devcenter`	`avm-res-devcenter-devcenter-module-owners-bicep`
175	avm/res/dev-center/devcenter/attachednetwork	`46d3xbcp.res.devcenter-devcenter-attachednetwork`	`avm-res-devcenter-devcenter-module-owners-bicep`
176	avm/res/dev-center/devcenter/catalog	`46d3xbcp.res.devcenter-devcenter-catalog`	`avm-res-devcenter-devcenter-module-owners-bicep`
177	avm/res/dev-center/devcenter/devboxdefinition	`46d3xbcp.res.devcenter-devcenter-devboxdefinition`	`avm-res-devcenter-devcenter-module-owners-bicep`
178	avm/res/dev-center/devcenter/environment-type	`46d3xbcp.res.devcenter-devcenter-environmenttype`	`avm-res-devcenter-devcenter-module-owners-bicep`
179	avm/res/dev-center/devcenter/gallery	`46d3xbcp.res.devcenter-devcenter-gallery`	`avm-res-devcenter-devcenter-module-owners-bicep`
180	avm/res/dev-center/devcenter/project-policy	`46d3xbcp.res.devcenter-devcenter-projectpolicy`	`avm-res-devcenter-devcenter-module-owners-bicep`
181	avm/res/dev-center/network-connection	`46d3xbcp.res.devcenter-networkconnection`	`avm-res-devcenter-networkconnection-module-owners-bicep`
182	avm/res/dev-center/project	`46d3xbcp.res.devcenter-project`	`avm-res-devcenter-project-module-owners-bicep`
183	avm/res/dev-center/project/catalog	`46d3xbcp.res.devcenter-project-catalog`	`avm-res-devcenter-project-module-owners-bicep`
184	avm/res/dev-center/project/environment-type	`46d3xbcp.res.devcenter-project-environmenttype`	`avm-res-devcenter-project-module-owners-bicep`
185	avm/res/dev-center/project/pool	`46d3xbcp.res.devcenter-project-pool`	`avm-res-devcenter-project-module-owners-bicep`
186	avm/res/dev-center/project/pool/schedule	`46d3xbcp.res.devcenter-project-poolschedule`	`avm-res-devcenter-project-module-owners-bicep`
187	avm/res/dev-ops-infrastructure/pool	`46d3xbcp.res.devopsinfrastructure-pool`	`avm-res-devopsinfrastructure-pool-module-owners-bicep`
188	avm/res/dev-test-lab/lab	`46d3xbcp.res.devtestlab-lab`	`avm-res-devtestlab-lab-module-owners-bicep`
189	avm/res/dev-test-lab/lab/artifactsource	`46d3xbcp.res.devtestlab-lab-artifactsource`	`avm-res-devtestlab-lab-module-owners-bicep`
190	avm/res/dev-test-lab/lab/cost	`46d3xbcp.res.devtestlab-lab-cost`	`avm-res-devtestlab-lab-module-owners-bicep`
191	avm/res/dev-test-lab/lab/notificationchannel	`46d3xbcp.res.devtestlab-lab-notificationchannel`	`avm-res-devtestlab-lab-module-owners-bicep`
192	avm/res/dev-test-lab/lab/policyset/policy	`46d3xbcp.res.devtestlab-lab-policysetpolicy`	`avm-res-devtestlab-lab-module-owners-bicep`
193	avm/res/dev-test-lab/lab/schedule	`46d3xbcp.res.devtestlab-lab-schedule`	`avm-res-devtestlab-lab-module-owners-bicep`
194	avm/res/dev-test-lab/lab/secret	`46d3xbcp.res.devtestlab-lab-secret`	`avm-res-devtestlab-lab-module-owners-bicep`
195	avm/res/dev-test-lab/lab/virtualnetwork	`46d3xbcp.res.devtestlab-lab-virtualnetwork`	`avm-res-devtestlab-lab-module-owners-bicep`
196	avm/res/devices/iot-hub	`46d3xbcp.res.devices-iothub`	`avm-res-devices-iothub-module-owners-bicep`
197	avm/res/digital-twins/digital-twins-instance	`46d3xbcp.res.digitaltwins-digitaltwinsinstance`	`avm-res-digitaltwins-digitaltwinsinstance-module-owners-bicep`
198	avm/res/digital-twins/digital-twins-instance/endpoint	`46d3xbcp.res.digitaltwins-digitaltwinsinstance-en`	`avm-res-digitaltwins-digitaltwinsinstance-module-owners-bicep`
199	avm/res/document-db/database-account	`46d3xbcp.res.documentdb-databaseaccount`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
200	avm/res/document-db/database-account/cassandra-keyspace	`46d3xbcp.res.doctdb-dbacct-cassandrkeyspace`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
201	avm/res/document-db/database-account/cassandra-keyspace/table	`46d3xbcp.res.doctdb-dbacct-cassandrkeyspacetable`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
202	avm/res/document-db/database-account/cassandra-keyspace/view	`46d3xbcp.res.doctdb-dbacct-cassandrkeyspaceview`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
203	avm/res/document-db/database-account/cassandra-role-assignment	`46d3xbcp.res.doctdb-dbacct-cassandrroleassignment`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
204	avm/res/document-db/database-account/cassandra-role-definition	`46d3xbcp.res.doctdb-dbacct-cassandrroledefinition`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
205	avm/res/document-db/database-account/gremlin-database	`46d3xbcp.res.doctdb-dbacct-gremlindb`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
206	avm/res/document-db/database-account/gremlin-database/graph	`46d3xbcp.res.doctdb-dbacct-gremlindbgraph`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
207	avm/res/document-db/database-account/mongodb-database	`46d3xbcp.res.doctdb-dbacct-mongodbdatabase`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
208	avm/res/document-db/database-account/mongodb-database/collection	`46d3xbcp.res.doctdb-dbacct-mongodbdbcollection`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
209	avm/res/document-db/database-account/sql-database	`46d3xbcp.res.documentdb-databaseaccountsqldb`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
210	avm/res/document-db/database-account/sql-database/container	`46d3xbcp.res.doctdb-dbacct-sqldbcontainer`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
211	avm/res/document-db/database-account/sql-role-assignment	`46d3xbcp.res.doctdb-dbacct-sqlroleassignment`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
212	avm/res/document-db/database-account/sql-role-definition	`46d3xbcp.res.doctdb-dbacct-sqlroledefinition`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
213	avm/res/document-db/database-account/table	`46d3xbcp.res.documentdb-databaseaccounttable`	`avm-res-documentdb-databaseaccount-module-owners-bicep`
214	avm/res/document-db/mongo-cluster	`46d3xbcp.res.documentdb-mongocluster`	`avm-res-documentdb-mongocluster-module-owners-bicep`
215	avm/res/document-db/mongo-cluster/firewall-rule	`46d3xbcp.res.documentdb-mongocluster-firewallrule`	`avm-res-documentdb-mongocluster-module-owners-bicep`
216	avm/res/document-db/mongo-cluster/user	`46d3xbcp.res.documentdb-mongocluster-user`	`avm-res-documentdb-mongocluster-module-owners-bicep`
217	avm/res/durable-task/scheduler	`46d3xbcp.res.durabletask-scheduler`	`avm-res-durabletask-scheduler-module-owners-bicep`
218	avm/res/edge-order/order-item	`46d3xbcp.res.edgeorder-orderitem`	`avm-res-edgeorder-orderitem-module-owners-bicep`
219	avm/res/edge/configuration	`46d3xbcp.res.edge-configuration`	`avm-res-edge-configuration-module-owners-bicep`
220	avm/res/edge/site	`46d3xbcp.res.edge-site`	`avm-res-edge-site-module-owners-bicep`
221	avm/res/edge/site/rg-scope	`46d3xbcp.res.edge-site_rgscope`	`avm-res-edge-site-module-owners-bicep`
222	avm/res/edge/site/sub-scope	`46d3xbcp.res.edge-site_subscope`	`avm-res-edge-site-module-owners-bicep`
223	avm/res/elastic-san/elastic-san	`46d3xbcp.res.elasticsan-elasticsan`	`avm-res-elasticsan-elasticsan-module-owners-bicep`
224	avm/res/elastic-san/elastic-san/volume-group	`46d3xbcp.res.elsan-elsan-volumegroup`	`avm-res-elasticsan-elasticsan-module-owners-bicep`
225	avm/res/elastic-san/elastic-san/volume-group/snapshot	`46d3xbcp.res.elsan-elsan-volumegroupsnapshot`	`avm-res-elasticsan-elasticsan-module-owners-bicep`
226	avm/res/elastic-san/elastic-san/volume-group/volume	`46d3xbcp.res.elsan-elsan-volumegroupvolume`	`avm-res-elasticsan-elasticsan-module-owners-bicep`
227	avm/res/event-grid/domain	`46d3xbcp.res.eventgrid-domain`	`avm-res-eventgrid-domain-module-owners-bicep`
228	avm/res/event-grid/domain/event-subscription	`46d3xbcp.res.eventgrid-domain-eventsubscription`	`avm-res-eventgrid-domain-module-owners-bicep`
229	avm/res/event-grid/domain/topic	`46d3xbcp.res.eventgrid-domain-topic`	`avm-res-eventgrid-domain-module-owners-bicep`
230	avm/res/event-grid/namespace	`46d3xbcp.res.eventgrid-namespace`	`avm-res-eventgrid-namespace-module-owners-bicep`
231	avm/res/event-grid/namespace/ca-certificate	`46d3xbcp.res.eventgrid-namespace-cacertificate`	`avm-res-eventgrid-namespace-module-owners-bicep`
232	avm/res/event-grid/namespace/client	`46d3xbcp.res.eventgrid-namespace-client`	`avm-res-eventgrid-namespace-module-owners-bicep`
233	avm/res/event-grid/namespace/client-group	`46d3xbcp.res.eventgrid-namespace-clientgroup`	`avm-res-eventgrid-namespace-module-owners-bicep`
234	avm/res/event-grid/namespace/permission-binding	`46d3xbcp.res.eventgrid-namespace-permbinding`	`avm-res-eventgrid-namespace-module-owners-bicep`
235	avm/res/event-grid/namespace/topic	`46d3xbcp.res.eventgrid-namespace-topic`	`avm-res-eventgrid-namespace-module-owners-bicep`
236	avm/res/event-grid/namespace/topic-space	`46d3xbcp.res.eventgrid-namespace-topicspace`	`avm-res-eventgrid-namespace-module-owners-bicep`
237	avm/res/event-grid/namespace/topic/event-subscription	`46d3xbcp.res.eventgrid-namespace-topiceventsub`	`avm-res-eventgrid-namespace-module-owners-bicep`
238	avm/res/event-grid/system-topic	`46d3xbcp.res.eventgrid-systemtopic`	`avm-res-eventgrid-systemtopic-module-owners-bicep`
239	avm/res/event-grid/system-topic/event-subscription	`46d3xbcp.res.eventgrid-systemtopic-eventsub`	`avm-res-eventgrid-systemtopic-module-owners-bicep`
240	avm/res/event-grid/topic	`46d3xbcp.res.eventgrid-topic`	`avm-res-eventgrid-topic-module-owners-bicep`
241	avm/res/event-grid/topic/event-subscription	`46d3xbcp.res.eventgrid-topic-eventsub`	`avm-res-eventgrid-topic-module-owners-bicep`
242	avm/res/event-hub/namespace	`46d3xbcp.res.eventhub-namespace`	`avm-res-eventhub-namespace-module-owners-bicep`
243	avm/res/event-hub/namespace/authorization-rule	`46d3xbcp.res.eventhub-namespace-authorizationrule`	`avm-res-eventhub-namespace-module-owners-bicep`
244	avm/res/event-hub/namespace/disaster-recovery-config	`46d3xbcp.res.eventhub-namespace-drconfig`	`avm-res-eventhub-namespace-module-owners-bicep`
245	avm/res/event-hub/namespace/eventhub	`46d3xbcp.res.eventhub-nseventhub`	`avm-res-eventhub-namespace-module-owners-bicep`
246	avm/res/event-hub/namespace/eventhub/authorization-rule	`46d3xbcp.res.eventhub-namespace-eventhubauthrule`	`avm-res-eventhub-namespace-module-owners-bicep`
247	avm/res/event-hub/namespace/eventhub/consumergroup	`46d3xbcp.res.eventhub-namespace-eventhubconsgrp`	`avm-res-eventhub-namespace-module-owners-bicep`
248	avm/res/event-hub/namespace/network-rule-set	`46d3xbcp.res.eventhub-namespace-networkruleset`	`avm-res-eventhub-namespace-module-owners-bicep`
249	avm/res/fabric/capacity	`46d3xbcp.res.fabric-capacity`	`avm-res-fabric-capacity-module-owners-bicep`
250	avm/res/health-bot/health-bot	`46d3xbcp.res.healthbot-healthbot`	`avm-res-healthbot-healthbot-module-owners-bicep`
251	avm/res/healthcare-apis/workspace	`46d3xbcp.res.healthcareapis-workspace`	`avm-res-healthcareapis-workspace-module-owners-bicep`
252	avm/res/healthcare-apis/workspace/dicomservice	`46d3xbcp.res.healthcapis-workspace-dicomservic`	`avm-res-healthcareapis-workspace-module-owners-bicep`
253	avm/res/healthcare-apis/workspace/fhirservice	`46d3xbcp.res.healthcapis-workspace-fhirservice`	`avm-res-healthcareapis-workspace-module-owners-bicep`
254	avm/res/healthcare-apis/workspace/iotconnector	`46d3xbcp.res.healthcapis-workspace-iotconn`	`avm-res-healthcareapis-workspace-module-owners-bicep`
255	avm/res/healthcare-apis/workspace/iotconnector/fhirdestination	`46d3xbcp.res.healthcapis-workspace-iotconnfhirdst`	`avm-res-healthcareapis-workspace-module-owners-bicep`
256	avm/res/hybrid-compute/gateway	`46d3xbcp.res.hybridcompute-gateway`	`avm-res-hybridcompute-gateway-module-owners-bicep`
257	avm/res/hybrid-compute/license	`46d3xbcp.res.hybridcompute-license`	`avm-res-hybridcompute-license-module-owners-bicep`
258	avm/res/hybrid-compute/machine	`46d3xbcp.res.hybridcompute-machine`	`avm-res-hybridcompute-machine-module-owners-bicep`
259	avm/res/hybrid-compute/machine/extension	`46d3xbcp.res.hybridcompute-machine-extension`	`avm-res-hybridcompute-machine-module-owners-bicep`
260	avm/res/hybrid-compute/private-link-scope	`46d3xbcp.res.hybridcompute-privatelinkscope`	`avm-res-hybridcompute-privatelinkscope-module-owners-bicep`
261	avm/res/hybrid-compute/setting	`46d3xbcp.res.hybridcompute-setting`	`avm-res-hybridcompute-setting-module-owners-bicep`
262	avm/res/hybrid-container-service/provisioned-cluster-instance	`46d3xbcp.res.hybcontsvc-provclustinst`	`avm-res-hybridcontainerservice-provisionedclusterinstance-module-owners-bicep`
263	avm/res/insights/action-group	`46d3xbcp.res.insights-actiongroup`	`avm-res-insights-actiongroup-module-owners-bicep`
264	avm/res/insights/activity-log-alert	`46d3xbcp.res.insights-activitylogalert`	`avm-res-insights-activitylogalert-module-owners-bicep`
265	avm/res/insights/autoscale-setting	`46d3xbcp.res.insights-autoscalesetting`	`avm-res-insights-autoscalesetting-module-owners-bicep`
266	avm/res/insights/component	`46d3xbcp.res.insights-component`	`avm-res-insights-component-module-owners-bicep`
267	avm/res/insights/component/linked-storage-account	`46d3xbcp.res.insights-component-linkedstoracct`	`avm-res-insights-component-module-owners-bicep`
268	avm/res/insights/data-collection-endpoint	`46d3xbcp.res.insights-datacollectionendpoint`	`avm-res-insights-datacollectionendpoint-module-owners-bicep`
269	avm/res/insights/data-collection-rule	`46d3xbcp.res.insights-datacollectionrule`	`avm-res-insights-datacollectionrule-module-owners-bicep`
270	avm/res/insights/diagnostic-setting	`46d3xbcp.res.insights-diagnosticsetting`	`avm-res-insights-diagnosticsetting-module-owners-bicep`
271	avm/res/insights/metric-alert	`46d3xbcp.res.insights-metricalert`	`avm-res-insights-metricalert-module-owners-bicep`
272	avm/res/insights/private-link-scope	`46d3xbcp.res.insights-privatelinkscope`	`avm-res-insights-privatelinkscope-module-owners-bicep`
273	avm/res/insights/private-link-scope/scoped-resource	`46d3xbcp.res.insights-privatelinkscope-scopedres`	`avm-res-insights-privatelinkscope-module-owners-bicep`
274	avm/res/insights/scheduled-query-rule	`46d3xbcp.res.insights-scheduledqueryrule`	`avm-res-insights-scheduledqueryrule-module-owners-bicep`
275	avm/res/insights/webtest	`46d3xbcp.res.insights-webtest`	`avm-res-insights-webtest-module-owners-bicep`
276	avm/res/iot-operations/instance	`46d3xbcp.res.iotoperations-instance`	`avm-res-iotoperations-instance-module-owners-bicep`
277	avm/res/key-vault/managed-hsm	`46d3xbcp.res.keyvault-managedhsm`	`avm-res-keyvault-managedhsm-module-owners-bicep`
278	avm/res/key-vault/vault	`46d3xbcp.res.keyvault-vault`	`avm-res-keyvault-vault-module-owners-bicep`
279	avm/res/key-vault/vault/access-policy	`46d3xbcp.res.keyvault-accesspolicy`	`avm-res-keyvault-vault-module-owners-bicep`
280	avm/res/key-vault/vault/key	`46d3xbcp.res.keyvault-key`	`avm-res-keyvault-vault-module-owners-bicep`
281	avm/res/key-vault/vault/secret	`46d3xbcp.res.keyvault-secret`	`avm-res-keyvault-vault-module-owners-bicep`
282	avm/res/kubernetes-configuration/extension	`46d3xbcp.res.kubernetesconfiguration-extension`	`avm-res-kubernetesconfiguration-extension-module-owners-bicep`
283	avm/res/kubernetes-configuration/flux-configuration	`46d3xbcp.res.kubernetesconfiguration-fluxconfig`	`avm-res-kubernetesconfiguration-fluxconfiguration-module-owners-bicep`
284	avm/res/kubernetes-runtime/bpg-peer	`46d3xbcp.res.kubernetesruntime-bgppeer`	`avm-res-kubernetesruntime-bpgpeer-module-owners-bicep`
285	avm/res/kubernetes-runtime/load-balancer	`46d3xbcp.res.kubernetesruntime-loadbalancer`	`avm-res-kubernetesruntime-loadbalancer-module-owners-bicep`
286	avm/res/kubernetes-runtime/service	`46d3xbcp.res.kubernetesruntime-service`	`avm-res-kubernetesruntime-service-module-owners-bicep`
287	avm/res/kubernetes/connected-cluster	`46d3xbcp.res.kubernetes-connectedcluster`	`avm-res-kubernetes-connectedcluster-module-owners-bicep`
288	avm/res/kusto/cluster	`46d3xbcp.res.kusto-cluster`	`avm-res-kusto-cluster-module-owners-bicep`
289	avm/res/kusto/cluster/database	`46d3xbcp.res.kusto-cluster-database`	`avm-res-kusto-cluster-module-owners-bicep`
290	avm/res/kusto/cluster/database/principal-assignment	`46d3xbcp.res.kusto-cluster-dbprinassignment`	`avm-res-kusto-cluster-module-owners-bicep`
291	avm/res/kusto/cluster/principal-assignment	`46d3xbcp.res.kusto-cluster-principalassignment`	`avm-res-kusto-cluster-module-owners-bicep`
292	avm/res/load-test-service/load-test	`46d3xbcp.res.loadtestservice-loadtest`	`avm-res-loadtestservice-loadtest-module-owners-bicep`
293	avm/res/logic/integration-account	`46d3xbcp.res.logic-integrationaccount`	`avm-res-logic-integrationaccount-module-owners-bicep`
294	avm/res/logic/integration-account/agreement	`46d3xbcp.res.logic-integrationaccount-agreement`	`avm-res-logic-integrationaccount-module-owners-bicep`
295	avm/res/logic/integration-account/assembly	`46d3xbcp.res.logic-integrationaccount-assembly`	`avm-res-logic-integrationaccount-module-owners-bicep`
296	avm/res/logic/integration-account/certificate	`46d3xbcp.res.logic-integrationaccount-certificate`	`avm-res-logic-integrationaccount-module-owners-bicep`
297	avm/res/logic/integration-account/map	`46d3xbcp.res.logic-integrationaccount-map`	`avm-res-logic-integrationaccount-module-owners-bicep`
298	avm/res/logic/integration-account/partner	`46d3xbcp.res.logic-integrationaccount-partner`	`avm-res-logic-integrationaccount-module-owners-bicep`
299	avm/res/logic/integration-account/schema	`46d3xbcp.res.logic-integrationaccount-schema`	`avm-res-logic-integrationaccount-module-owners-bicep`
300	avm/res/logic/workflow	`46d3xbcp.res.logic-workflow`	`avm-res-logic-workflow-module-owners-bicep`
301	avm/res/machine-learning-services/registry	`46d3xbcp.res.machinelearningservices-registry`	`avm-res-machinelearningservices-registry-module-owners-bicep`
302	avm/res/machine-learning-services/workspace	`46d3xbcp.res.machinelearningservices-workspace`	`avm-res-machinelearningservices-workspace-module-owners-bicep`
303	avm/res/machine-learning-services/workspace/compute	`46d3xbcp.res.mlservices-workspace-compute`	`avm-res-machinelearningservices-workspace-module-owners-bicep`
304	avm/res/machine-learning-services/workspace/connection	`46d3xbcp.res.mlservices-workspace-connection`	`avm-res-machinelearningservices-workspace-module-owners-bicep`
305	avm/res/machine-learning-services/workspace/datastore	`46d3xbcp.res.mlservices-workspace-datastore`	`avm-res-machinelearningservices-workspace-module-owners-bicep`
306	avm/res/maintenance/configuration-assignment	`46d3xbcp.res.maintenance-configurationassignment`	`avm-res-maintenance-configurationassignment-module-owners-bicep`
307	avm/res/maintenance/maintenance-configuration	`46d3xbcp.res.maintenance-maintenanceconfiguration`	`avm-res-maintenance-maintenanceconfiguration-module-owners-bicep`
308	avm/res/managed-identity/user-assigned-identity	`46d3xbcp.res.managedidentity-userassignedidentity`	`avm-res-managedidentity-userassignedidentity-module-owners-bicep`
309	avm/res/managed-identity/user-assigned-identity/federated-identity-credential	`46d3xbcp.res.managedid-userassignedidcredential`	`avm-res-managedidentity-userassignedidentity-module-owners-bicep`
310	avm/res/managed-services/registration-definition	`46d3xbcp.res.managedservices-registrationdef`	`avm-res-managedservices-registrationdefinition-module-owners-bicep`
311	avm/res/management/management-group	`46d3xbcp.res.management-managementgroup`	`avm-res-management-managementgroup-module-owners-bicep`
312	avm/res/management/service-group	`46d3xbcp.res.management-servicegroup`	`avm-res-management-servicegroup-module-owners-bicep`
313	avm/res/maps/account	`46d3xbcp.res.maps-account`	`avm-res-maps-account-module-owners-bicep`
314	avm/res/net-app/net-app-account	`46d3xbcp.res.netapp-netappaccount`	`avm-res-netapp-netappaccount-module-owners-bicep`
315	avm/res/net-app/net-app-account/backup-policy	`46d3xbcp.res.netapp-netappaccount-backuppolicy`	`avm-res-netapp-netappaccount-module-owners-bicep`
316	avm/res/net-app/net-app-account/backup-vault	`46d3xbcp.res.netapp-netappaccount-backupvault`	`avm-res-netapp-netappaccount-module-owners-bicep`
317	avm/res/net-app/net-app-account/backup-vault/backup	`46d3xbcp.res.netapp-netappaccount-backupvaultbckp`	`avm-res-netapp-netappaccount-module-owners-bicep`
318	avm/res/net-app/net-app-account/capacity-pool	`46d3xbcp.res.netapp-netappaccount-capacitypool`	`avm-res-netapp-netappaccount-module-owners-bicep`
319	avm/res/net-app/net-app-account/capacity-pool/volume	`46d3xbcp.res.netapp-netappaccount-capacitypoolvol`	`avm-res-netapp-netappaccount-module-owners-bicep`
320	avm/res/net-app/net-app-account/snapshot-policy	`46d3xbcp.res.netapp-netappaccount-snapshotpolicy`	`avm-res-netapp-netappaccount-module-owners-bicep`
321	avm/res/network/application-gateway	`46d3xbcp.res.network-appgw`	`avm-res-network-applicationgateway-module-owners-bicep`
322	avm/res/network/application-gateway-web-application-firewall-policy	`46d3xbcp.res.network-appgwwebappfirewallpolicy`	`avm-res-network-applicationgatewaywebapplicationfirewallpolicy-module-owners-bicep`
323	avm/res/network/application-security-group	`46d3xbcp.res.network-applicationsecuritygroup`	`avm-res-network-applicationsecuritygroup-module-owners-bicep`
324	avm/res/network/azure-firewall	`46d3xbcp.res.network-azurefirewall`	`avm-res-network-azurefirewall-module-owners-bicep`
325	avm/res/network/bastion-host	`46d3xbcp.res.network-bastionhost`	`avm-res-network-bastionhost-module-owners-bicep`
326	avm/res/network/connection	`46d3xbcp.res.network-connection`	`avm-res-network-connection-module-owners-bicep`
327	avm/res/network/ddos-protection-plan	`46d3xbcp.res.network-ddosprotectionplan`	`avm-res-network-ddosprotectionplan-module-owners-bicep`
328	avm/res/network/dns-forwarding-ruleset	`46d3xbcp.res.network-dnsforwardingruleset`	`avm-res-network-dnsforwardingruleset-module-owners-bicep`
329	avm/res/network/dns-forwarding-ruleset/forwarding-rule	`46d3xbcp.res.network-dnsforwardingruleset-fwdrule`	`avm-res-network-dnsforwardingruleset-module-owners-bicep`
330	avm/res/network/dns-forwarding-ruleset/virtual-network-link	`46d3xbcp.res.network-dnsfwdruleset-vnetlink`	`avm-res-network-dnsforwardingruleset-module-owners-bicep`
331	avm/res/network/dns-resolver	`46d3xbcp.res.network-dnsresolver`	`avm-res-network-dnsresolver-module-owners-bicep`
332	avm/res/network/dns-resolver/inbound-endpoint	`46d3xbcp.res.network-dnsresolver-inboundendpoint`	`avm-res-network-dnsresolver-module-owners-bicep`
333	avm/res/network/dns-resolver/outbound-endpoint	`46d3xbcp.res.network-dnsresolver-outboundendpoint`	`avm-res-network-dnsresolver-module-owners-bicep`
334	avm/res/network/dns-zone	`46d3xbcp.res.network-dnszone`	`avm-res-network-dnszone-module-owners-bicep`
335	avm/res/network/dns-zone/a	`46d3xbcp.res.network-dnszone-a`	`avm-res-network-dnszone-module-owners-bicep`
336	avm/res/network/dns-zone/aaaa	`46d3xbcp.res.network-dnszone-aaaa`	`avm-res-network-dnszone-module-owners-bicep`
337	avm/res/network/dns-zone/caa	`46d3xbcp.res.network-dnszone-caa`	`avm-res-network-dnszone-module-owners-bicep`
338	avm/res/network/dns-zone/cname	`46d3xbcp.res.network-dnszone-cname`	`avm-res-network-dnszone-module-owners-bicep`
339	avm/res/network/dns-zone/dnssec-config	`46d3xbcp.res.network-dnszone-dnssecconfig`	`avm-res-network-dnszone-module-owners-bicep`
340	avm/res/network/dns-zone/mx	`46d3xbcp.res.network-dnszone-mx`	`avm-res-network-dnszone-module-owners-bicep`
341	avm/res/network/dns-zone/ns	`46d3xbcp.res.network-dnszone-ns`	`avm-res-network-dnszone-module-owners-bicep`
342	avm/res/network/dns-zone/ptr	`46d3xbcp.res.network-dnszone-ptr`	`avm-res-network-dnszone-module-owners-bicep`
343	avm/res/network/dns-zone/soa	`46d3xbcp.res.network-dnszone-soa`	`avm-res-network-dnszone-module-owners-bicep`
344	avm/res/network/dns-zone/srv	`46d3xbcp.res.network-dnszone-srv`	`avm-res-network-dnszone-module-owners-bicep`
345	avm/res/network/dns-zone/txt	`46d3xbcp.res.network-dnszone-txt`	`avm-res-network-dnszone-module-owners-bicep`
346	avm/res/network/express-route-circuit	`46d3xbcp.res.network-expressroutecircuit`	`avm-res-network-expressroutecircuit-module-owners-bicep`
347	avm/res/network/express-route-gateway	`46d3xbcp.res.network-expressroutegateway`	`avm-res-network-expressroutegateway-module-owners-bicep`
348	avm/res/network/express-route-port	`46d3xbcp.res.network-expressrouteport`	`avm-res-network-expressrouteport-module-owners-bicep`
349	avm/res/network/firewall-policy	`46d3xbcp.res.network-firewallpolicy`	`avm-res-network-firewallpolicy-module-owners-bicep`
350	avm/res/network/firewall-policy/rule-collection-group	`46d3xbcp.res.network-fwpolicy-rulecollection`	`avm-res-network-firewallpolicy-module-owners-bicep`
351	avm/res/network/front-door	`46d3xbcp.res.network-frontdoor`	`avm-res-network-frontdoor-module-owners-bicep`
352	avm/res/network/front-door-web-application-firewall-policy	`46d3xbcp.res.network-frontdoorwebappfwpolicy`	`avm-res-network-frontdoorwebapplicationfirewallpolicy-module-owners-bicep`
353	avm/res/network/ip-group	`46d3xbcp.res.network-ipgroup`	`avm-res-network-ipgroup-module-owners-bicep`
354	avm/res/network/load-balancer	`46d3xbcp.res.network-loadbalancer`	`avm-res-network-loadbalancer-module-owners-bicep`
355	avm/res/network/load-balancer/backend-address-pool	`46d3xbcp.res.network-loadbalancer-beaddresspool`	`avm-res-network-loadbalancer-module-owners-bicep`
356	avm/res/network/load-balancer/inbound-nat-rule	`46d3xbcp.res.network-loadbalancer-inboundnatrule`	`avm-res-network-loadbalancer-module-owners-bicep`
357	avm/res/network/local-network-gateway	`46d3xbcp.res.network-localnetworkgateway`	`avm-res-network-localnetworkgateway-module-owners-bicep`
358	avm/res/network/nat-gateway	`46d3xbcp.res.network-natgateway`	`avm-res-network-natgateway-module-owners-bicep`
359	avm/res/network/network-interface	`46d3xbcp.res.network-networkinterface`	`avm-res-network-networkinterface-module-owners-bicep`
360	avm/res/network/network-manager	`46d3xbcp.res.network-networkmanager`	`avm-res-network-networkmanager-module-owners-bicep`
361	avm/res/network/network-manager/connectivity-configuration	`46d3xbcp.res.network-nwmgr-connectivityconfig`	`avm-res-network-networkmanager-module-owners-bicep`
362	avm/res/network/network-manager/network-group	`46d3xbcp.res.network-nwmgr-networkgroup`	`avm-res-network-networkmanager-module-owners-bicep`
363	avm/res/network/network-manager/network-group/static-member	`46d3xbcp.res.network-nwmgr-nwgrpstaticmember`	`avm-res-network-networkmanager-module-owners-bicep`
364	avm/res/network/network-manager/routing-configuration	`46d3xbcp.res.network-nwmgr-routingcfg`	`avm-res-network-networkmanager-module-owners-bicep`
365	avm/res/network/network-manager/routing-configuration/rule-collection	`46d3xbcp.res.network-nwmgr-routingcfgrulecoll`	`avm-res-network-networkmanager-module-owners-bicep`
366	avm/res/network/network-manager/routing-configuration/rule-collection/rule	`46d3xbcp.res.network-nwmgr-routingcfgrulecollrule`	`avm-res-network-networkmanager-module-owners-bicep`
367	avm/res/network/network-manager/scope-connection	`46d3xbcp.res.network-nwmgr-scopeconnection`	`avm-res-network-networkmanager-module-owners-bicep`
368	avm/res/network/network-manager/security-admin-configuration	`46d3xbcp.res.network-nwmgr-secadmcfg`	`avm-res-network-networkmanager-module-owners-bicep`
369	avm/res/network/network-manager/security-admin-configuration/rule-collection	`46d3xbcp.res.network-nwmgr-secadmcfgrulecoll`	`avm-res-network-networkmanager-module-owners-bicep`
370	avm/res/network/network-manager/security-admin-configuration/rule-collection/rule	`46d3xbcp.res.network-nwmgr-secadmcfgrulecollrule`	`avm-res-network-networkmanager-module-owners-bicep`
371	avm/res/network/network-security-group	`46d3xbcp.res.network-networksecuritygroup`	`avm-res-network-networksecuritygroup-module-owners-bicep`
372	avm/res/network/network-security-perimeter	`46d3xbcp.res.network-nwsecurityperimeter`	`avm-res-network-networksecurityperimeter-module-owners-bicep`
373	avm/res/network/network-security-perimeter/profile	`46d3xbcp.res.network-nwsecperim-profile`	`avm-res-network-networksecurityperimeter-module-owners-bicep`
374	avm/res/network/network-security-perimeter/profile/access-rule	`46d3xbcp.res.network-nwsecperim-profileaccessrule`	`avm-res-network-networksecurityperimeter-module-owners-bicep`
375	avm/res/network/network-watcher	`46d3xbcp.res.network-networkwatcher`	`avm-res-network-networkwatcher-module-owners-bicep`
376	avm/res/network/network-watcher/connection-monitor	`46d3xbcp.res.network-networkwatcher-connmonitor`	`avm-res-network-networkwatcher-module-owners-bicep`
377	avm/res/network/network-watcher/flow-log	`46d3xbcp.res.network-networkwatcher-flowlog`	`avm-res-network-networkwatcher-module-owners-bicep`
378	avm/res/network/p2s-vpn-gateway	`46d3xbcp.res.network-p2svpngateway`	`avm-res-network-p2svpngateway-module-owners-bicep`
379	avm/res/network/private-dns-zone	`46d3xbcp.res.network-privatednszone`	`avm-res-network-privatednszone-module-owners-bicep`
380	avm/res/network/private-dns-zone/a	`46d3xbcp.res.nw-privdnszonea`	`avm-res-network-privatednszone-module-owners-bicep`
381	avm/res/network/private-dns-zone/aaaa	`46d3xbcp.res.nw-privdnszoneaaaa`	`avm-res-network-privatednszone-module-owners-bicep`
382	avm/res/network/private-dns-zone/cname	`46d3xbcp.res.nw-privdnszonecname`	`avm-res-network-privatednszone-module-owners-bicep`
383	avm/res/network/private-dns-zone/mx	`46d3xbcp.res.nw-privdnszonemx`	`avm-res-network-privatednszone-module-owners-bicep`
384	avm/res/network/private-dns-zone/ptr	`46d3xbcp.res.nw-privdnszoneptr`	`avm-res-network-privatednszone-module-owners-bicep`
385	avm/res/network/private-dns-zone/soa	`46d3xbcp.res.nw-privdnszonesoa`	`avm-res-network-privatednszone-module-owners-bicep`
386	avm/res/network/private-dns-zone/srv	`46d3xbcp.res.nw-privdnszonesrv`	`avm-res-network-privatednszone-module-owners-bicep`
387	avm/res/network/private-dns-zone/txt	`46d3xbcp.res.nw-privdnszonetxt`	`avm-res-network-privatednszone-module-owners-bicep`
388	avm/res/network/private-dns-zone/virtual-network-link	`46d3xbcp.res.nw-privdnszonevnetlink`	`avm-res-network-privatednszone-module-owners-bicep`
389	avm/res/network/private-endpoint	`46d3xbcp.res.network-privateendpoint`	`avm-res-network-privateendpoint-module-owners-bicep`
390	avm/res/network/private-endpoint/private-dns-zone-group	`46d3xbcp.res.network-privendpoint-privdnszonegrp`	`avm-res-network-privateendpoint-module-owners-bicep`
391	avm/res/network/private-link-service	`46d3xbcp.res.network-privatelinkservice`	`avm-res-network-privatelinkservice-module-owners-bicep`
392	avm/res/network/public-ip-address	`46d3xbcp.res.network-publicipaddress`	`avm-res-network-publicipaddress-module-owners-bicep`
393	avm/res/network/public-ip-prefix	`46d3xbcp.res.network-publicipprefix`	`avm-res-network-publicipprefix-module-owners-bicep`
394	avm/res/network/route-table	`46d3xbcp.res.network-routetable`	`avm-res-network-routetable-module-owners-bicep`
395	avm/res/network/service-endpoint-policy	`46d3xbcp.res.network-serviceendpointpolicy`	`avm-res-network-serviceendpointpolicy-module-owners-bicep`
396	avm/res/network/trafficmanagerprofile	`46d3xbcp.res.network-trafficmanagerprofile`	`avm-res-network-trafficmanagerprofile-module-owners-bicep`
397	avm/res/network/virtual-hub	`46d3xbcp.res.network-virtualhub`	`avm-res-network-virtualhub-module-owners-bicep`
398	avm/res/network/virtual-hub/hub-route-table	`46d3xbcp.res.network-virtualhub-hubroutetable`	`avm-res-network-virtualhub-module-owners-bicep`
399	avm/res/network/virtual-hub/hub-virtual-network-connection	`46d3xbcp.res.network-virtualhub-hubvirtualnetwork`	`avm-res-network-virtualhub-module-owners-bicep`
400	avm/res/network/virtual-hub/route-map	`46d3xbcp.res.network-virtualhubroutemap`	`avm-res-network-virtualhub-module-owners-bicep`
401	avm/res/network/virtual-hub/routing-intent	`46d3xbcp.res.network-virtualhub-routingintent`	`avm-res-network-virtualhub-module-owners-bicep`
402	avm/res/network/virtual-network	`46d3xbcp.res.network-virtualnetwork`	`avm-res-network-virtualnetwork-module-owners-bicep`
403	avm/res/network/virtual-network-gateway	`46d3xbcp.res.network-virtualnetworkgateway`	`avm-res-network-virtualnetworkgateway-module-owners-bicep`
404	avm/res/network/virtual-network-gateway/nat-rule	`46d3xbcp.res.network-vnetgw-natrule`	`avm-res-network-virtualnetworkgateway-module-owners-bicep`
405	avm/res/network/virtual-network/subnet	`46d3xbcp.res.network-virtualnetworksubnet`	`avm-res-network-virtualnetwork-module-owners-bicep`
406	avm/res/network/virtual-network/virtual-network-peering	`46d3xbcp.res.network-virtualnetwork-peering`	`avm-res-network-virtualnetwork-module-owners-bicep`
407	avm/res/network/virtual-wan	`46d3xbcp.res.network-virtualwan`	`avm-res-network-virtualwan-module-owners-bicep`
408	avm/res/network/vpn-gateway	`46d3xbcp.res.network-vpngateway`	`avm-res-network-vpngateway-module-owners-bicep`
409	avm/res/network/vpn-gateway/nat-rule	`46d3xbcp.res.network-vpngateway-natrule`	`avm-res-network-vpngateway-module-owners-bicep`
410	avm/res/network/vpn-gateway/vpn-connection	`46d3xbcp.res.network-vpngateway-vpnconnection`	`avm-res-network-vpngateway-module-owners-bicep`
411	avm/res/network/vpn-server-configuration	`46d3xbcp.res.network-vpnserverconfiguration`	`avm-res-network-vpnserverconfiguration-module-owners-bicep`
412	avm/res/network/vpn-site	`46d3xbcp.res.network-vpnsite`	`avm-res-network-vpnsite-module-owners-bicep`
413	avm/res/operational-insights/cluster	`46d3xbcp.res.operationalinsights-cluster`	`avm-res-operationalinsights-cluster-module-owners-bicep`
414	avm/res/operational-insights/workspace	`46d3xbcp.res.operationalinsights-workspace`	`avm-res-operationalinsights-workspace-module-owners-bicep`
415	avm/res/operational-insights/workspace/data-export	`46d3xbcp.res.opins-worksp-dataexport`	`avm-res-operationalinsights-workspace-module-owners-bicep`
416	avm/res/operational-insights/workspace/data-source	`46d3xbcp.res.opins-worksp-datasource`	`avm-res-operationalinsights-workspace-module-owners-bicep`
417	avm/res/operational-insights/workspace/linked-service	`46d3xbcp.res.opins-worksp-linkedservice`	`avm-res-operationalinsights-workspace-module-owners-bicep`
418	avm/res/operational-insights/workspace/linked-storage-account	`46d3xbcp.res.opins-worksp-linkedstgaccount`	`avm-res-operationalinsights-workspace-module-owners-bicep`
419	avm/res/operational-insights/workspace/saved-search	`46d3xbcp.res.opins-worksp-savedsearch`	`avm-res-operationalinsights-workspace-module-owners-bicep`
420	avm/res/operational-insights/workspace/storage-insight-config	`46d3xbcp.res.opins-worksp-stginsightconfig`	`avm-res-operationalinsights-workspace-module-owners-bicep`
421	avm/res/operational-insights/workspace/table	`46d3xbcp.res.opins-worksp-table`	`avm-res-operationalinsights-workspace-module-owners-bicep`
422	avm/res/operations-management/solution	`46d3xbcp.res.operationsmanagement-solution`	`avm-res-operationsmanagement-solution-module-owners-bicep`
423	avm/res/portal/dashboard	`46d3xbcp.res.portal-dashboard`	`avm-res-portal-dashboard-module-owners-bicep`
424	avm/res/power-bi-dedicated/capacity	`46d3xbcp.res.powerbidedicated-capacity`	`avm-res-powerbidedicated-capacity-module-owners-bicep`
425	avm/res/purview/account	`46d3xbcp.res.purview-account`	`avm-res-purview-account-module-owners-bicep`
426	avm/res/recovery-services/vault	`46d3xbcp.res.recoveryservices-vault`	`avm-res-recoveryservices-vault-module-owners-bicep`
427	avm/res/recovery-services/vault/backup-config	`46d3xbcp.res.recsvcs-vault-backupconfig`	`avm-res-recoveryservices-vault-module-owners-bicep`
428	avm/res/recovery-services/vault/backup-fabric/protection-container/protected-item	`46d3xbcp.res.recsvcs-vault-bckpfabprotcontprotitm`	`avm-res-recoveryservices-vault-module-owners-bicep`
429	avm/res/recovery-services/vault/backup-policy	`46d3xbcp.res.recsvcs-vault-backuppolicy`	`avm-res-recoveryservices-vault-module-owners-bicep`
430	avm/res/recovery-services/vault/replication-alert-setting	`46d3xbcp.res.recsvcs-vault-replalertsetting`	`avm-res-recoveryservices-vault-module-owners-bicep`
431	avm/res/recovery-services/vault/replication-fabric	`46d3xbcp.res.recsvcs-vault-repfab`	`avm-res-recoveryservices-vault-module-owners-bicep`
432	avm/res/recovery-services/vault/replication-fabric/replication-protection-container	`46d3xbcp.res.recsvcs-vault-repfabrepprotcontainer`	`avm-res-recoveryservices-vault-module-owners-bicep`
433	avm/res/recovery-services/vault/replication-fabric/replication-protection-container/replication-protection-container-mapping	`46d3xbcp.res.recsvcs-vault-repfabrepprotcontmap`	`avm-res-recoveryservices-vault-module-owners-bicep`
434	avm/res/recovery-services/vault/replication-policy	`46d3xbcp.res.recsvcs-vault-replicationpolicy`	`avm-res-recoveryservices-vault-module-owners-bicep`
435	avm/res/relay/namespace	`46d3xbcp.res.relay-namespace`	`avm-res-relay-namespace-module-owners-bicep`
436	avm/res/relay/namespace/authorization-rule	`46d3xbcp.res.relay-namespace-authorizationrule`	`avm-res-relay-namespace-module-owners-bicep`
437	avm/res/relay/namespace/hybrid-connection	`46d3xbcp.res.relay-namespace-hybconn`	`avm-res-relay-namespace-module-owners-bicep`
438	avm/res/relay/namespace/hybrid-connection/authorization-rule	`46d3xbcp.res.relay-namespace-hybconnautzrule`	`avm-res-relay-namespace-module-owners-bicep`
439	avm/res/relay/namespace/network-rule-set	`46d3xbcp.res.relay-namespace-networkruleset`	`avm-res-relay-namespace-module-owners-bicep`
440	avm/res/relay/namespace/wcf-relay	`46d3xbcp.res.relay-namespace-wcfrelay`	`avm-res-relay-namespace-module-owners-bicep`
441	avm/res/relay/namespace/wcf-relay/authorization-rule	`46d3xbcp.res.relay-namespace-wcfrelayauthzrule`	`avm-res-relay-namespace-module-owners-bicep`
442	avm/res/resource-graph/query	`46d3xbcp.resourcegraph-query`	`avm-res-resourcegraph-query-module-owners-bicep`
443	avm/res/resources/deployment-script	`46d3xbcp.res.resources-deploymentscript`	`avm-res-resources-deploymentscript-module-owners-bicep`
444	avm/res/resources/resource-group	`46d3xbcp.res.resources-resourcegroup`	`avm-res-resources-resourcegroup-module-owners-bicep`
445	avm/res/scom/managed-instance	`46d3xbcp.res.scom-managedinstance`	`avm-res-scom-managedinstance-module-owners-bicep`
446	avm/res/search/search-service	`46d3xbcp.res.search-searchservice`	`avm-res-search-searchservice-module-owners-bicep`
447	avm/res/search/search-service/shared-private-link-resource	`46d3xbcp.res.search-searchsvc-sharedprivlinkres`	`avm-res-search-searchservice-module-owners-bicep`
448	avm/res/security-insights/data-connector	`46d3xbcp.res.securityinsights-dataconnector`	`avm-res-securityinsights-dataconnector-module-owners-bicep`
449	avm/res/security-insights/onboarding-state	`46d3xbcp.res.securityinsights-onboardingstate`	`avm-res-securityinsights-onboardingstate-module-owners-bicep`
450	avm/res/security-insights/setting	`46d3xbcp.res.securityinsights-setting`	`avm-res-securityinsights-setting-module-owners-bicep`
451	avm/res/service-bus/namespace	`46d3xbcp.res.servicebus-namespace`	`avm-res-servicebus-namespace-module-owners-bicep`
452	avm/res/service-bus/namespace/authorization-rule	`46d3xbcp.res.servicebus-namespace-authzrule`	`avm-res-servicebus-namespace-module-owners-bicep`
453	avm/res/service-bus/namespace/disaster-recovery-config	`46d3xbcp.res.servicebus-namespace-drconfig`	`avm-res-servicebus-namespace-module-owners-bicep`
454	avm/res/service-bus/namespace/migration-configuration	`46d3xbcp.res.servicebus-namespace-migrconfig`	`avm-res-servicebus-namespace-module-owners-bicep`
455	avm/res/service-bus/namespace/network-rule-set	`46d3xbcp.res.servicebus-namespace-netruleset`	`avm-res-servicebus-namespace-module-owners-bicep`
456	avm/res/service-bus/namespace/queue	`46d3xbcp.res.servicebus-namespacequeue`	`avm-res-servicebus-namespace-module-owners-bicep`
457	avm/res/service-bus/namespace/queue/authorization-rule	`46d3xbcp.res.servicebus-namespace-queueauthzrule`	`avm-res-servicebus-namespace-module-owners-bicep`
458	avm/res/service-bus/namespace/topic	`46d3xbcp.res.servicebus-namespacetopic`	`avm-res-servicebus-namespace-module-owners-bicep`
459	avm/res/service-bus/namespace/topic/authorization-rule	`46d3xbcp.res.servicebus-namespace-topicauthzrule`	`avm-res-servicebus-namespace-module-owners-bicep`
460	avm/res/service-bus/namespace/topic/subscription	`46d3xbcp.res.servicebus-namespace-topicsub`	`avm-res-servicebus-namespace-module-owners-bicep`
461	avm/res/service-bus/namespace/topic/subscription/rule	`46d3xbcp.res.servicebus-namespace-topicsubrule`	`avm-res-servicebus-namespace-module-owners-bicep`
462	avm/res/service-fabric/cluster	`46d3xbcp.res.servicefabric-cluster`	`avm-res-servicefabric-cluster-module-owners-bicep`
463	avm/res/service-fabric/cluster/application-type	`46d3xbcp.res.servicefabric-cluster-apptype`	`avm-res-servicefabric-cluster-module-owners-bicep`
464	avm/res/service-networking/traffic-controller	`46d3xbcp.res.servicenetworking-trafficcontroller`	`avm-res-servicenetworking-trafficcontroller-module-owners-bicep`
465	avm/res/service-networking/traffic-controller/association	`46d3xbcp.res.servicenetworking-traffctrlassoc`	`avm-res-servicenetworking-trafficcontroller-module-owners-bicep`
466	avm/res/service-networking/traffic-controller/frontend	`46d3xbcp.res.servicenetworking-traffctrlfrontend`	`avm-res-servicenetworking-trafficcontroller-module-owners-bicep`
467	avm/res/service-networking/traffic-controller/security-policy	`46d3xbcp.res.servicenetworking-traffctrlsecpolicy`	`avm-res-servicenetworking-trafficcontroller-module-owners-bicep`
468	avm/res/signal-r-service/signal-r	`46d3xbcp.res.signalrservice-signalr`	`avm-res-signalrservice-signalr-module-owners-bicep`
469	avm/res/signal-r-service/web-pub-sub	`46d3xbcp.res.signalrservice-webpubsub`	`avm-res-signalrservice-webpubsub-module-owners-bicep`
470	avm/res/sql-virtual-machine/sql-virtual-machine	`46d3xbcp.res.sqlvm-sqlvm`	`avm-res-sqlvirtualmachine-sqlvirtualmachine-module-owners-bicep`
471	avm/res/sql/instance-pool	`46d3xbcp.res.sql-instancepool`	`avm-res-sql-instancepool-module-owners-bicep`
472	avm/res/sql/managed-instance	`46d3xbcp.res.sql-managedinstance`	`avm-res-sql-managedinstance-module-owners-bicep`
473	avm/res/sql/managed-instance/database	`46d3xbcp.res.sql-mi-database`	`avm-res-sql-managedinstance-module-owners-bicep`
474	avm/res/sql/managed-instance/database/backup-long-term-retention-policy	`46d3xbcp.res.sql-mi-dbbckplongermretpolicy`	`avm-res-sql-managedinstance-module-owners-bicep`
475	avm/res/sql/managed-instance/database/backup-short-term-retention-policy	`46d3xbcp.res.sql-mi-dbbckpshortermretpolicy`	`avm-res-sql-managedinstance-module-owners-bicep`
476	avm/res/sql/managed-instance/encryption-protector	`46d3xbcp.res.sql-mi-encryptionprotecor`	`avm-res-sql-managedinstance-module-owners-bicep`
477	avm/res/sql/managed-instance/key	`46d3xbcp.res.sql-mi-key`	`avm-res-sql-managedinstance-module-owners-bicep`
478	avm/res/sql/managed-instance/security-alert-policy	`46d3xbcp.res.sql-mi-securityalertpolicy`	`avm-res-sql-managedinstance-module-owners-bicep`
479	avm/res/sql/managed-instance/vulnerability-assessment	`46d3xbcp.res.sql-mi-vulnerabilityassessment`	`avm-res-sql-managedinstance-module-owners-bicep`
480	avm/res/sql/server	`46d3xbcp.res.sql-server`	`avm-res-sql-server-module-owners-bicep`
481	avm/res/sql/server/auditing-setting	`46d3xbcp.res.sql-server-auditingsetting`	`avm-res-sql-server-module-owners-bicep`
482	avm/res/sql/server/database	`46d3xbcp.res.sql-serverdb`	`avm-res-sql-server-module-owners-bicep`
483	avm/res/sql/server/database/backup-long-term-retention-policy	`46d3xbcp.res.sql-server-dbbckplongtermretpolicy`	`avm-res-sql-server-module-owners-bicep`
484	avm/res/sql/server/database/backup-short-term-retention-policy	`46d3xbcp.res.sql-server-dbbckpshorttermretpolicy`	`avm-res-sql-server-module-owners-bicep`
485	avm/res/sql/server/elastic-pool	`46d3xbcp.res.sql-server-elasticpool`	`avm-res-sql-server-module-owners-bicep`
486	avm/res/sql/server/encryption-protector	`46d3xbcp.res.sql-server-encryptionprotector`	`avm-res-sql-server-module-owners-bicep`
487	avm/res/sql/server/failover-group	`46d3xbcp.res.sql-server-failovergroup`	`avm-res-sql-server-module-owners-bicep`
488	avm/res/sql/server/firewall-rule	`46d3xbcp.res.sql-server-firewallrule`	`avm-res-sql-server-module-owners-bicep`
489	avm/res/sql/server/key	`46d3xbcp.res.sql-server-key`	`avm-res-sql-server-module-owners-bicep`
490	avm/res/sql/server/security-alert-policy	`46d3xbcp.res.sql-server-securityalertpolicy`	`avm-res-sql-server-module-owners-bicep`
491	avm/res/sql/server/virtual-network-rule	`46d3xbcp.res.sql-server-virtualnetworkrule`	`avm-res-sql-server-module-owners-bicep`
492	avm/res/sql/server/vulnerability-assessment	`46d3xbcp.res.sql-server-vulnerabilityassessment`	`avm-res-sql-server-module-owners-bicep`
493	avm/res/storage/storage-account	`46d3xbcp.res.storage-storageaccount`	`avm-res-storage-storageaccount-module-owners-bicep`
494	avm/res/storage/storage-account/blob-service	`46d3xbcp.res.storage-storageaccount-blobservice`	`avm-res-storage-storageaccount-module-owners-bicep`
495	avm/res/storage/storage-account/blob-service/container	`46d3xbcp.res.storage-blobcontainer`	`avm-res-storage-storageaccount-module-owners-bicep`
496	avm/res/storage/storage-account/blob-service/container/immutability-policy	`46d3xbcp.res.storage-containerimmutpolicy`	`avm-res-storage-storageaccount-module-owners-bicep`
497	avm/res/storage/storage-account/file-service	`46d3xbcp.res.storage-storageaccount-fileservice`	`avm-res-storage-storageaccount-module-owners-bicep`
498	avm/res/storage/storage-account/file-service/share	`46d3xbcp.res.storage-fileshare`	`avm-res-storage-storageaccount-module-owners-bicep`
499	avm/res/storage/storage-account/local-user	`46d3xbcp.res.storage-localuser`	`avm-res-storage-storageaccount-module-owners-bicep`
500	avm/res/storage/storage-account/management-policy	`46d3xbcp.res.storage-mgmtpolicy`	`avm-res-storage-storageaccount-module-owners-bicep`
501	avm/res/storage/storage-account/object-replication-policy	`46d3xbcp.res.storage-storacct-objectreplpolicy`	`avm-res-storage-storageaccount-module-owners-bicep`
502	avm/res/storage/storage-account/object-replication-policy/policy	`46d3xbcp.res.storage-storacct-objectreplpolicypol`	`avm-res-storage-storageaccount-module-owners-bicep`
503	avm/res/storage/storage-account/queue-service	`46d3xbcp.res.storage-storageaccount-queueservice`	`avm-res-storage-storageaccount-module-owners-bicep`
504	avm/res/storage/storage-account/queue-service/queue	`46d3xbcp.res.storage-queue`	`avm-res-storage-storageaccount-module-owners-bicep`
505	avm/res/storage/storage-account/table-service	`46d3xbcp.res.storage-storageaccount-tableservice`	`avm-res-storage-storageaccount-module-owners-bicep`
506	avm/res/storage/storage-account/table-service/table	`46d3xbcp.res.storage-table`	`avm-res-storage-storageaccount-module-owners-bicep`
507	avm/res/stream-analytics/streaming-job	`46d3xbcp.res.streamanalytics-streamingjob`	`avm-res-streamanalytics-streamingjob-module-owners-bicep`
508	avm/res/synapse/private-link-hub	`46d3xbcp.res.synapse-privatelinkhub`	`avm-res-synapse-privatelinkhub-module-owners-bicep`
509	avm/res/synapse/workspace	`46d3xbcp.res.synapse-workspace`	`avm-res-synapse-workspace-module-owners-bicep`
510	avm/res/synapse/workspace/administrator	`46d3xbcp.res.synapse-workspace-administrator`	`avm-res-synapse-workspace-module-owners-bicep`
511	avm/res/synapse/workspace/big-data-pool	`46d3xbcp.res.synapse-workspace-bigdatapool`	`avm-res-synapse-workspace-module-owners-bicep`
512	avm/res/synapse/workspace/firewall-rule	`46d3xbcp.res.synapse-workspace-firewallrule`	`avm-res-synapse-workspace-module-owners-bicep`
513	avm/res/synapse/workspace/integration-runtime	`46d3xbcp.res.synapse-workspace-integrationruntime`	`avm-res-synapse-workspace-module-owners-bicep`
514	avm/res/synapse/workspace/key	`46d3xbcp.res.synapse-workspace-key`	`avm-res-synapse-workspace-module-owners-bicep`
515	avm/res/synapse/workspace/sql-pool	`46d3xbcp.res.synapse-workspace-sqlpool`	`avm-res-synapse-workspace-module-owners-bicep`
516	avm/res/virtual-machine-images/image-template	`46d3xbcp.res.virtualmachineimages-imagetemplate`	`avm-res-virtualmachineimages-imagetemplate-module-owners-bicep`
517	avm/res/web/connection	`46d3xbcp.res.web-connection`	`avm-res-web-connection-module-owners-bicep`
518	avm/res/web/hosting-environment	`46d3xbcp.res.web-hostingenvironment`	`avm-res-web-hostingenvironment-module-owners-bicep`
519	avm/res/web/hosting-environment/configuration	`46d3xbcp.res.web-hostingenvironment-configuration`	`avm-res-web-hostingenvironment-module-owners-bicep`
520	avm/res/web/serverfarm	`46d3xbcp.res.web-serverfarm`	`avm-res-web-serverfarm-module-owners-bicep`
521	avm/res/web/site	`46d3xbcp.res.web-site`	`avm-res-web-site-module-owners-bicep`
522	avm/res/web/site/basic-publishing-credentials-policy	`46d3xbcp.res.web-site-basicpublishingcredpolicy`	`avm-res-web-site-module-owners-bicep`
523	avm/res/web/site/config	`46d3xbcp.res.web-siteconfig`	`avm-res-web-site-module-owners-bicep`
524	avm/res/web/site/extension	`46d3xbcp.res.web-site-extension`	`avm-res-web-site-module-owners-bicep`
525	avm/res/web/site/hybrid-connection-namespace/relay	`46d3xbcp.res.web-site-hybconnnamespacerelay`	`avm-res-web-site-module-owners-bicep`
526	avm/res/web/site/slot	`46d3xbcp.res.web-siteslot`	`avm-res-web-site-module-owners-bicep`
527	avm/res/web/site/slot/basic-publishing-credentials-policy	`46d3xbcp.res.web-site-slotbasicpubcredpolicy`	`avm-res-web-site-module-owners-bicep`
528	avm/res/web/site/slot/config	`46d3xbcp.res.web-site-slotconfig`	`avm-res-web-site-module-owners-bicep`
529	avm/res/web/site/slot/extension	`46d3xbcp.res.web-site-slotextension`	`avm-res-web-site-module-owners-bicep`
530	avm/res/web/site/slot/hybrid-connection-namespace/relay	`46d3xbcp.res.web-site-slothybconnnamespacerelay`	`avm-res-web-site-module-owners-bicep`
531	avm/res/web/static-site	`46d3xbcp.res.web-staticsite`	`avm-res-web-staticsite-module-owners-bicep`
532	avm/res/web/static-site/config	`46d3xbcp.res.web-staticsite-config`	`avm-res-web-staticsite-module-owners-bicep`
533	avm/res/web/static-site/custom-domain	`46d3xbcp.res.web-staticsite-customdomain`	`avm-res-web-staticsite-module-owners-bicep`
534	avm/res/web/static-site/linked-backend	`46d3xbcp.res.web-staticsite-linkedbackend`	`avm-res-web-staticsite-module-owners-bicep`

Bicep Pattern Modules

Module catalog

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Bicep	Pattern	41	20	61

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Info

This page contains various views of the module index (catalog) for Bicep Pattern Modules. To see these views, click on the expandable sections with the “➕” sign below.

To see the full, unfiltered, unformatted module index on GitHub, click here.
To download the source CSV file, click here.

Note

Published modules - 🟢 & 🟡

➕ Published Modules - Module names, status and owners

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/aca-lza/hosting-environment	Azure Container Apps (ACA) LZA - Hosting Environment	kpantos Konstantinos Pantos
02	avm/ptn/ai-ml/ai-foundry	AI-ML - AI Foundry	mswantek68 Mike Swantek sethsteenken Seth Steenken
03	avm/ptn/ai-platform/baseline	AI Platform - Baseline	cecheta Chinedum Echeta ross-p-smith Ross Smith
04	avm/ptn/alz/ama	Azure Landing Zones (ALZ) - Azure Monitoring Agent (AMA)	oZakari Zach Trocinski
05	avm/ptn/alz/empty	Azure Landing Zones (ALZ) - Empty	jtracey93 Jack Tracey oZakari Zach Trocinski
06	avm/ptn/app-service-lza/hosting-environment	App Service LZA - Hosting Environment	MikeTB-Microsoft Michael Baker
07	avm/ptn/app/container-job-toolkit	Container Job Toolkit	ReneHezser Rene Hezser
08	avm/ptn/app/iaas-vm-cosmosdb-tier4	Workload - IaaS VM Cosmos DB - Tier 4	mikestiers Mike Stiers
09	avm/ptn/authorization/pim-role-assignment	Authorization - PIM Role Assignment	sebassem Seif Bassem
10	avm/ptn/authorization/policy-assignment	Authorization - Policy Assignment	jtracey93 Jack Tracey
11	avm/ptn/authorization/policy-exemption	Authorization - Policy Exemption	oZakari Zach Trocinski
12	avm/ptn/authorization/resource-role-assignment	Authorization - Resource Role Assignment	peterbud Peter Budai
13	avm/ptn/authorization/role-assignment	Authorization - Role Assignment	jtracey93 Jack Tracey
14	avm/ptn/authorization/role-definition	Authorization - Role Definition	jtracey93 Jack Tracey
15	avm/ptn/azd/acr-container-app	AZD - ACR Container App Azure Developer CLI - ACR Container App	JeffreyCA Jeffrey Chen
16	avm/ptn/azd/aks	AZD - AKS Azure Developer CLI - Azure Kubernetes Services	JeffreyCA Jeffrey Chen
17	avm/ptn/azd/aks-automatic-cluster	AZD - AKS Automatic Cluster Azure Developer CLI - Azure Kubernetes Services Automatic Cluster	JeffreyCA Jeffrey Chen
18	avm/ptn/azd/apim-api	AZD - APIM API Azure Developer CLI - API Management	JeffreyCA Jeffrey Chen
19	avm/ptn/azd/container-app-upsert	AZD - Container App Upsert Azure Developer CLI - Container Apps Upsert	JeffreyCA Jeffrey Chen
20	avm/ptn/azd/container-apps-stack	AZD - Container Apps Stack Azure Developer CLI - Container Apps Stack	JeffreyCA Jeffrey Chen
21	avm/ptn/azd/insights-dashboard	AZD - Insights Dashboard Azure Developer CLI - Inishgts Dashboard	JeffreyCA Jeffrey Chen
22	avm/ptn/azd/monitoring	AZD - Monitoring Azure Developer CLI - Monitoring	JeffreyCA Jeffrey Chen
23	avm/ptn/data/private-analytical-workspace	Private Analytical Workspace Data Analytics, Data Lake, Databricks, Database	jbinko Jiri Binko
24	avm/ptn/deployment-script/import-image-to-acr	Deployment Script - Import Container Image to ACR	ReneHezser Rene Hezser
25	avm/ptn/dev-ops/cicd-agents-and-runners	Azure DevOps and GitHub CI/CD Agents and Runners	sebassem Seif Bassem
26	avm/ptn/finops-toolkit/finops-hub	FinOps Toolkit - FinOps Hub	FallenHoot Zach Olinske
27	avm/ptn/lz/sub-vending	Landing Zone Subscription Vending	jtracey93 Jack Tracey sebassem Seif Bassem
28	avm/ptn/mgmt-groups/subscription-placement	Management Groups - Subscription Placement	oZakari Zach Trocinski
29	avm/ptn/network/hub-networking	Hub Networking
30	avm/ptn/network/private-link-private-dns-zones	Private Link Private DNS Zones	jtracey93 Jack Tracey
31	avm/ptn/network/virtual-wan	Virtual WAN vWAN	ericscheffler Eric Scheffler juancj Juan Jimenez
32	avm/ptn/policy-insights/remediation	Policy Insights Remediation	donk-msft Don Koning
33	avm/ptn/sa/chat-with-your-data	SA - Chat with your data Solution Accelerator - Chat with your data (CWYD)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
34	avm/ptn/sa/content-processing	SA - Content Processing Solution Accelerator - Content Processing	brittneek Brittnee Keller
35	avm/ptn/sa/conversation-knowledge-mining	SA - Conversation knowledge mining Solution Accelerator - Conversation knowledge mining (CKM)	alguadam Alvaro Guadamillas Herranz
36	avm/ptn/sa/document-knowledge-mining	SA - Document knowledge mining Solution Accelerator - Document knowledge mining (DKM)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
37	avm/ptn/sa/modernize-your-code	SA - Modernize your code Solution Accelerator - Modernize your code	sethsteenken Seth Steenken
38	avm/ptn/sa/multi-agent-custom-automation-engine	SA - Multi Agent Custom Automation Engine Solution Accelerator - Multi Agent Custom Automation Engine	alguadam Alvaro Guadamillas Herranz
39	avm/ptn/security/security-center	Azure Security Center (Defender for Cloud)	oZakari Zach Trocinski jtracey93 Jack Tracey
40	avm/ptn/subscription/service-health-alerts	Service Health Alerts	sebassem Seif Bassem
41	avm/ptn/virtual-machine-images/azure-image-builder	Custom Images using Azure Image Builder	AlexanderSehr Alexander Sehr

Proposed modules - ⚪

➕ Proposed Modules - Module names, status and owners

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/ai-ml/landing-zone	AI-ML - Landing Zone (LZ)	placerda Paulo Lacerda mbilalamjad Bilal Amjad
02	avm/ptn/app/cosmos-db-account-container-app	Cosmos DB Account - Container App
03	avm/ptn/app/mongodb-cluster-container-app	MongoDB Cluster - Container App
04	avm/ptn/app/paas-ase-cosmosdb-tier4	Workload - PaaS ASE Cosmos DB - Tier 4	mikestiers Mike Stiers
05	avm/ptn/avd-lza/insights	Azure Virtual Desktop (AVD) LZA - Insights
06	avm/ptn/avd-lza/management-plane	Azure Virtual Desktop (AVD) LZA - Management Plane
07	avm/ptn/avd-lza/networking	Azure Virtual Desktop (AVD) LZA - Networking
08	avm/ptn/avd-lza/session-hosts	Azure Virtual Desktop (AVD) LZA - Session Hosts
09	avm/ptn/deployment-script/create-kv-ssh-key-pair	Deployment Script - Create Key Vault SSH Key Pair	vlahane Vishal Lahane
10	avm/ptn/deployment-script/private	Deployment Script - Private Script	sebassem Seif Bassem
11	avm/ptn/dev-center/dev-box	Dev-Box	timfurnival-MSFT Tim Furnival
12	avm/ptn/lza-shared/data-services	LZA Shared - Data Services Landing Zone Accelerators - Shared - Data Services	kpantos Konstantinos Pantos
13	avm/ptn/maintenance/azure-update-manager	Azure Update Manager	akhilthomas011 Akhil Thomas
14	avm/ptn/monitoring/amba	Azure Monitor Baseline Alerts (AMBA)	arjenhuitema Arjen Huitema
15	avm/ptn/monitoring/amba-alz	Azure Monitor Baseline Alerts (AMBA) - ALZ	arjenhuitema Arjen Huitema
16	avm/ptn/network/vwan-connected-vnets	VNETs peered to Virtual WAN	juancj Juan Jimenez ericscheffler Eric Scheffler
17	avm/ptn/openai/e2e-baseline	Azure OpenAI End-to-End Baseline Implementation
18	avm/ptn/sa/content-generation	SA - Content Generation Solution Accelerator - Content Generation	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
19	avm/ptn/sa/customer-chatbot	SA - Bring your own Customer Chatbot Solution Accelerator - Bring your own Customer Chatbot (BYOCC)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
20	avm/ptn/security/sentinel	Sentinel

Deprecated modules - 🔴

➕ Deprecated Modules - Module names, status and owners

No.	Module Name	Display Name
01	avm/ptn/azd/ml-ai-environment	AZD - ML AI Environment Azure Developer CLI - Machine Learning AI Environment
02	avm/ptn/azd/ml-hub-dependencies	AZD - ML Hub Dependencies Azure Developer CLI - Machine Learning Hub Dependencies
03	avm/ptn/azd/ml-project	AZD - ML Project Azure Developer CLI - Machine Learning Project
04	avm/ptn/sa/build-your-own-copilot	SA - Build your own Copilot Solution Accelerator - Build your own Copilot (BYOC)

All modules - 📇

➕ All Modules - Module names, status and owners

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/aca-lza/hosting-environment	Azure Container Apps (ACA) LZA - Hosting Environment	kpantos Konstantinos Pantos
02	avm/ptn/ai-ml/ai-foundry	AI-ML - AI Foundry	mswantek68 Mike Swantek sethsteenken Seth Steenken
03	avm/ptn/ai-ml/landing-zone	AI-ML - Landing Zone (LZ)	placerda Paulo Lacerda mbilalamjad Bilal Amjad
04	avm/ptn/ai-platform/baseline	AI Platform - Baseline	cecheta Chinedum Echeta ross-p-smith Ross Smith
05	avm/ptn/alz/ama	Azure Landing Zones (ALZ) - Azure Monitoring Agent (AMA)	oZakari Zach Trocinski
06	avm/ptn/alz/empty	Azure Landing Zones (ALZ) - Empty	jtracey93 Jack Tracey oZakari Zach Trocinski
07	avm/ptn/app-service-lza/hosting-environment	App Service LZA - Hosting Environment	MikeTB-Microsoft Michael Baker
08	avm/ptn/app/container-job-toolkit	Container Job Toolkit	ReneHezser Rene Hezser
09	avm/ptn/app/cosmos-db-account-container-app	Cosmos DB Account - Container App
10	avm/ptn/app/iaas-vm-cosmosdb-tier4	Workload - IaaS VM Cosmos DB - Tier 4	mikestiers Mike Stiers
11	avm/ptn/app/mongodb-cluster-container-app	MongoDB Cluster - Container App
12	avm/ptn/app/paas-ase-cosmosdb-tier4	Workload - PaaS ASE Cosmos DB - Tier 4	mikestiers Mike Stiers
13	avm/ptn/authorization/pim-role-assignment	Authorization - PIM Role Assignment	sebassem Seif Bassem
14	avm/ptn/authorization/policy-assignment	Authorization - Policy Assignment	jtracey93 Jack Tracey
15	avm/ptn/authorization/policy-exemption	Authorization - Policy Exemption	oZakari Zach Trocinski
16	avm/ptn/authorization/resource-role-assignment	Authorization - Resource Role Assignment	peterbud Peter Budai
17	avm/ptn/authorization/role-assignment	Authorization - Role Assignment	jtracey93 Jack Tracey
18	avm/ptn/authorization/role-definition	Authorization - Role Definition	jtracey93 Jack Tracey
19	avm/ptn/avd-lza/insights	Azure Virtual Desktop (AVD) LZA - Insights
20	avm/ptn/avd-lza/management-plane	Azure Virtual Desktop (AVD) LZA - Management Plane
21	avm/ptn/avd-lza/networking	Azure Virtual Desktop (AVD) LZA - Networking
22	avm/ptn/avd-lza/session-hosts	Azure Virtual Desktop (AVD) LZA - Session Hosts
23	avm/ptn/azd/acr-container-app	AZD - ACR Container App Azure Developer CLI - ACR Container App	JeffreyCA Jeffrey Chen
24	avm/ptn/azd/aks	AZD - AKS Azure Developer CLI - Azure Kubernetes Services	JeffreyCA Jeffrey Chen
25	avm/ptn/azd/aks-automatic-cluster	AZD - AKS Automatic Cluster Azure Developer CLI - Azure Kubernetes Services Automatic Cluster	JeffreyCA Jeffrey Chen
26	avm/ptn/azd/apim-api	AZD - APIM API Azure Developer CLI - API Management	JeffreyCA Jeffrey Chen
27	avm/ptn/azd/container-app-upsert	AZD - Container App Upsert Azure Developer CLI - Container Apps Upsert	JeffreyCA Jeffrey Chen
28	avm/ptn/azd/container-apps-stack	AZD - Container Apps Stack Azure Developer CLI - Container Apps Stack	JeffreyCA Jeffrey Chen
29	avm/ptn/azd/insights-dashboard	AZD - Insights Dashboard Azure Developer CLI - Inishgts Dashboard	JeffreyCA Jeffrey Chen
30	avm/ptn/azd/ml-ai-environment	AZD - ML AI Environment Azure Developer CLI - Machine Learning AI Environment
31	avm/ptn/azd/ml-hub-dependencies	AZD - ML Hub Dependencies Azure Developer CLI - Machine Learning Hub Dependencies
32	avm/ptn/azd/ml-project	AZD - ML Project Azure Developer CLI - Machine Learning Project
33	avm/ptn/azd/monitoring	AZD - Monitoring Azure Developer CLI - Monitoring	JeffreyCA Jeffrey Chen
34	avm/ptn/data/private-analytical-workspace	Private Analytical Workspace Data Analytics, Data Lake, Databricks, Database	jbinko Jiri Binko
35	avm/ptn/deployment-script/create-kv-ssh-key-pair	Deployment Script - Create Key Vault SSH Key Pair	vlahane Vishal Lahane
36	avm/ptn/deployment-script/import-image-to-acr	Deployment Script - Import Container Image to ACR	ReneHezser Rene Hezser
37	avm/ptn/deployment-script/private	Deployment Script - Private Script	sebassem Seif Bassem
38	avm/ptn/dev-center/dev-box	Dev-Box	timfurnival-MSFT Tim Furnival
39	avm/ptn/dev-ops/cicd-agents-and-runners	Azure DevOps and GitHub CI/CD Agents and Runners	sebassem Seif Bassem
40	avm/ptn/finops-toolkit/finops-hub	FinOps Toolkit - FinOps Hub	FallenHoot Zach Olinske
41	avm/ptn/lz/sub-vending	Landing Zone Subscription Vending	jtracey93 Jack Tracey sebassem Seif Bassem
42	avm/ptn/lza-shared/data-services	LZA Shared - Data Services Landing Zone Accelerators - Shared - Data Services	kpantos Konstantinos Pantos
43	avm/ptn/maintenance/azure-update-manager	Azure Update Manager	akhilthomas011 Akhil Thomas
44	avm/ptn/mgmt-groups/subscription-placement	Management Groups - Subscription Placement	oZakari Zach Trocinski
45	avm/ptn/monitoring/amba	Azure Monitor Baseline Alerts (AMBA)	arjenhuitema Arjen Huitema
46	avm/ptn/monitoring/amba-alz	Azure Monitor Baseline Alerts (AMBA) - ALZ	arjenhuitema Arjen Huitema
47	avm/ptn/network/hub-networking	Hub Networking
48	avm/ptn/network/private-link-private-dns-zones	Private Link Private DNS Zones	jtracey93 Jack Tracey
49	avm/ptn/network/virtual-wan	Virtual WAN vWAN	ericscheffler Eric Scheffler juancj Juan Jimenez
50	avm/ptn/network/vwan-connected-vnets	VNETs peered to Virtual WAN	juancj Juan Jimenez ericscheffler Eric Scheffler
51	avm/ptn/openai/e2e-baseline	Azure OpenAI End-to-End Baseline Implementation
52	avm/ptn/policy-insights/remediation	Policy Insights Remediation	donk-msft Don Koning
53	avm/ptn/sa/build-your-own-copilot	SA - Build your own Copilot Solution Accelerator - Build your own Copilot (BYOC)
54	avm/ptn/sa/chat-with-your-data	SA - Chat with your data Solution Accelerator - Chat with your data (CWYD)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
55	avm/ptn/sa/content-generation	SA - Content Generation Solution Accelerator - Content Generation	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
56	avm/ptn/sa/content-processing	SA - Content Processing Solution Accelerator - Content Processing	brittneek Brittnee Keller
57	avm/ptn/sa/conversation-knowledge-mining	SA - Conversation knowledge mining Solution Accelerator - Conversation knowledge mining (CKM)	alguadam Alvaro Guadamillas Herranz
58	avm/ptn/sa/customer-chatbot	SA - Bring your own Customer Chatbot Solution Accelerator - Bring your own Customer Chatbot (BYOCC)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
59	avm/ptn/sa/document-knowledge-mining	SA - Document knowledge mining Solution Accelerator - Document knowledge mining (DKM)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
60	avm/ptn/sa/modernize-your-code	SA - Modernize your code Solution Accelerator - Modernize your code	sethsteenken Seth Steenken
61	avm/ptn/sa/multi-agent-custom-automation-engine	SA - Multi Agent Custom Automation Engine Solution Accelerator - Multi Agent Custom Automation Engine	alguadam Alvaro Guadamillas Herranz
62	avm/ptn/security/security-center	Azure Security Center (Defender for Cloud)	oZakari Zach Trocinski jtracey93 Jack Tracey
63	avm/ptn/security/sentinel	Sentinel
64	avm/ptn/subscription/service-health-alerts	Service Health Alerts	sebassem Seif Bassem
65	avm/ptn/virtual-machine-images/azure-image-builder	Custom Images using Azure Image Builder	AlexanderSehr Alexander Sehr

Module Publication History - 📅

➕ Module Publication History - Module names, status and owners

Modules published in April 2026

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/network/virtual-wan	Virtual WAN vWAN		ericscheffler Eric Scheffler juancj Juan Jimenez

Modules published in September 2025

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/sa/build-your-own-copilot	SA - Build your own Copilot Solution Accelerator - Build your own Copilot (BYOC)
02	avm/ptn/sa/chat-with-your-data	SA - Chat with your data Solution Accelerator - Chat with your data (CWYD)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz
03	avm/ptn/sa/document-knowledge-mining	SA - Document knowledge mining Solution Accelerator - Document knowledge mining (DKM)	aniaroramsft Anish Arora alguadam Alvaro Guadamillas Herranz

Modules published in August 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/alz/ama	Azure Landing Zones (ALZ) - Azure Monitoring Agent (AMA)		oZakari Zach Trocinski

Modules published in July 2025

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/ai-ml/ai-foundry	AI-ML - AI Foundry	mswantek68 Mike Swantek sethsteenken Seth Steenken
02	avm/ptn/app/iaas-vm-cosmosdb-tier4	Workload - IaaS VM Cosmos DB - Tier 4	mikestiers Mike Stiers
03	avm/ptn/sa/content-processing	SA - Content Processing Solution Accelerator - Content Processing	brittneek Brittnee Keller
04	avm/ptn/sa/modernize-your-code	SA - Modernize your code Solution Accelerator - Modernize your code	sethsteenken Seth Steenken

Modules published in June 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/sa/multi-agent-custom-automation-engine	SA - Multi Agent Custom Automation Engine Solution Accelerator - Multi Agent Custom Automation Engine		alguadam Alvaro Guadamillas Herranz
02	avm/ptn/subscription/service-health-alerts	Service Health Alerts		sebassem Seif Bassem

Modules published in April 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/alz/empty	Azure Landing Zones (ALZ) - Empty		jtracey93 Jack Tracey oZakari Zach Trocinski
02	avm/ptn/app-service-lza/hosting-environment	App Service LZA - Hosting Environment		MikeTB-Microsoft Michael Baker

Modules published in March 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/sa/conversation-knowledge-mining	SA - Conversation knowledge mining Solution Accelerator - Conversation knowledge mining (CKM)		alguadam Alvaro Guadamillas Herranz

Modules published in February 2025

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/authorization/pim-role-assignment	Authorization - PIM Role Assignment		sebassem Seif Bassem
02	avm/ptn/mgmt-groups/subscription-placement	Management Groups - Subscription Placement		oZakari Zach Trocinski

Modules published in December 2024

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/app/container-job-toolkit	Container Job Toolkit	ReneHezser Rene Hezser
02	avm/ptn/authorization/policy-exemption	Authorization - Policy Exemption	oZakari Zach Trocinski
03	avm/ptn/authorization/role-definition	Authorization - Role Definition	jtracey93 Jack Tracey
04	avm/ptn/azd/aks-automatic-cluster	AZD - AKS Automatic Cluster Azure Developer CLI - Azure Kubernetes Services Automatic Cluster	JeffreyCA Jeffrey Chen

Modules published in October 2024

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/azd/acr-container-app	AZD - ACR Container App Azure Developer CLI - ACR Container App	JeffreyCA Jeffrey Chen
02	avm/ptn/azd/aks	AZD - AKS Azure Developer CLI - Azure Kubernetes Services	JeffreyCA Jeffrey Chen
03	avm/ptn/azd/container-app-upsert	AZD - Container App Upsert Azure Developer CLI - Container Apps Upsert	JeffreyCA Jeffrey Chen
04	avm/ptn/azd/container-apps-stack	AZD - Container Apps Stack Azure Developer CLI - Container Apps Stack	JeffreyCA Jeffrey Chen
05	avm/ptn/azd/ml-ai-environment	AZD - ML AI Environment Azure Developer CLI - Machine Learning AI Environment
06	avm/ptn/azd/ml-hub-dependencies	AZD - ML Hub Dependencies Azure Developer CLI - Machine Learning Hub Dependencies
07	avm/ptn/azd/ml-project	AZD - ML Project Azure Developer CLI - Machine Learning Project
08	avm/ptn/azd/monitoring	AZD - Monitoring Azure Developer CLI - Monitoring	JeffreyCA Jeffrey Chen
09	avm/ptn/data/private-analytical-workspace	Private Analytical Workspace Data Analytics, Data Lake, Databricks, Database	jbinko Jiri Binko

Modules published in September 2024

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/azd/apim-api	AZD - APIM API Azure Developer CLI - API Management	JeffreyCA Jeffrey Chen
02	avm/ptn/azd/insights-dashboard	AZD - Insights Dashboard Azure Developer CLI - Inishgts Dashboard	JeffreyCA Jeffrey Chen
03	avm/ptn/dev-ops/cicd-agents-and-runners	Azure DevOps and GitHub CI/CD Agents and Runners	sebassem Seif Bassem
04	avm/ptn/network/hub-networking	Hub Networking
05	avm/ptn/virtual-machine-images/azure-image-builder	Custom Images using Azure Image Builder	AlexanderSehr Alexander Sehr

Modules published in August 2024

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/aca-lza/hosting-environment	Azure Container Apps (ACA) LZA - Hosting Environment		kpantos Konstantinos Pantos

Modules published in July 2024

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/ai-platform/baseline	AI Platform - Baseline	cecheta Chinedum Echeta ross-p-smith Ross Smith
02	avm/ptn/deployment-script/import-image-to-acr	Deployment Script - Import Container Image to ACR	ReneHezser Rene Hezser
03	avm/ptn/network/private-link-private-dns-zones	Private Link Private DNS Zones	jtracey93 Jack Tracey

Modules published in June 2024

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/lz/sub-vending	Landing Zone Subscription Vending		jtracey93 Jack Tracey sebassem Seif Bassem

Modules published in May 2024

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/ptn/authorization/resource-role-assignment	Authorization - Resource Role Assignment		peterbud Peter Budai
02	avm/ptn/finops-toolkit/finops-hub	FinOps Toolkit - FinOps Hub		FallenHoot Zach Olinske

Modules published in April 2024

No.	Module Name	Display Name	Owner(s)
01	avm/ptn/authorization/policy-assignment	Authorization - Policy Assignment	jtracey93 Jack Tracey
02	avm/ptn/authorization/role-assignment	Authorization - Role Assignment	jtracey93 Jack Tracey
03	avm/ptn/policy-insights/remediation	Policy Insights Remediation	donk-msft Don Koning
04	avm/ptn/security/security-center	Azure Security Center (Defender for Cloud)	oZakari Zach Trocinski jtracey93 Jack Tracey

For Module Owners & Contributors

Note

This section is mainly intended for module owners and contributors as it contains information important for module development, such as telemetry ID prefix, and GitHub Teams for Owners.

Module name, Telemetry ID prefix, GitHub Teams for Owners

➕ All Modules - Module name, Telemetry ID prefix, GitHub Teams for Owners

No.	Module Name	Telemetry ID prefix	GitHub Teams for Module Owners (`@Azure` org)
01	avm/ptn/aca-lza/hosting-environment	`46d3xbcp.ptn.acalza-hostingenvironment`	`avm-ptn-acalza-hostingenvironment-module-owners-bicep`
02	avm/ptn/ai-ml/ai-foundry	`46d3xbcp.ptn.aiml-aifoundry`	`avm-ptn-aiml-aifoundry-module-owners-bicep`
03	avm/ptn/ai-ml/landing-zone	`46d3xbcp.ptn.aiml-lz`	`avm-ptn-aiml-landingzone-module-owners-bicep`
04	avm/ptn/ai-platform/baseline	`46d3xbcp.ptn.aiplatform-baseline`	`avm-ptn-aiplatform-baseline-module-owners-bicep`
05	avm/ptn/alz/ama	`46d3xbcp.ptn.alz-ama`	`avm-ptn-alz-ama-module-owners-bicep`
06	avm/ptn/alz/empty	`46d3xbcp.ptn.alz-empty`	`avm-ptn-alz-empty-module-owners-bicep`
07	avm/ptn/app-service-lza/hosting-environment	`46d3xbcp.ptn.appsvclza-hostingenvironment`	`avm-ptn-appservicelza-hostingenvironment-module-owners-bicep`
08	avm/ptn/app/container-job-toolkit	`46d3xbcp.ptn.app-containerjobtoolkit`	`avm-ptn-app-containerjobtoolkit-module-owners-bicep`
09	avm/ptn/app/cosmos-db-account-container-app	`46d3xbcp.ptn.app-cosmosdbacctcontapp`	`avm-ptn-app-cosmosdbaccountcontainerapp-module-owners-bicep`
10	avm/ptn/app/iaas-vm-cosmosdb-tier4	`46d3xbcp.ptn.app-iaasvmcosmosdbt4`	`avm-ptn-app-iaasvmcosmosdbtier4-module-owners-bicep`
11	avm/ptn/app/mongodb-cluster-container-app	`46d3xbcp.ptn.app-mongodbclustcontapp`	`avm-ptn-app-mongodbclustercontainerapp-module-owners-bicep`
12	avm/ptn/app/paas-ase-cosmosdb-tier4	`46d3xbcp.ptn.app-paasasecosmosdbt4`	`avm-ptn-app-paasasecosmosdbtier4-module-owners-bicep`
13	avm/ptn/authorization/pim-role-assignment	`46d3xbcp.ptn.authorization-pimroleassignment`	`avm-ptn-authorization-pimroleassignment-module-owners-bicep`
14	avm/ptn/authorization/policy-assignment	`46d3xbcp.ptn.authorization-policyassignment`	`avm-ptn-authorization-policyassignment-module-owners-bicep`
15	avm/ptn/authorization/policy-exemption	`46d3xbcp.ptn.authorization-policyexemption`	`avm-ptn-authorization-policyexemption-module-owners-bicep`
16	avm/ptn/authorization/resource-role-assignment	`46d3xbcp.ptn.authorization-resourceroleassignment`	`avm-ptn-authorization-resourceroleassignment-module-owners-bicep`
17	avm/ptn/authorization/role-assignment	`46d3xbcp.ptn.authorization-roleassignment`	`avm-ptn-authorization-roleassignment-module-owners-bicep`
18	avm/ptn/authorization/role-definition	`46d3xbcp.ptn.authorization-roledefinition`	`avm-ptn-authorization-roledefinition-module-owners-bicep`
19	avm/ptn/avd-lza/insights	`46d3xbcp.ptn.avdlza-insights`	`avm-ptn-avdlza-insights-module-owners-bicep`
20	avm/ptn/avd-lza/management-plane	`46d3xbcp.ptn.avdlza-managementplane`	`avm-ptn-avdlza-managementplane-module-owners-bicep`
21	avm/ptn/avd-lza/networking	`46d3xbcp.ptn.avdlza-networking`	`avm-ptn-avdlza-networking-module-owners-bicep`
22	avm/ptn/avd-lza/session-hosts	`46d3xbcp.ptn.avdlza-sessionhosts`	`avm-ptn-avdlza-sessionhosts-module-owners-bicep`
23	avm/ptn/azd/acr-container-app	`46d3xbcp.ptn.azd-acrcontainerapp`	`avm-ptn-azd-acrcontainerapp-module-owners-bicep`
24	avm/ptn/azd/aks	`46d3xbcp.ptn.azd-aks`	`avm-ptn-azd-aks-module-owners-bicep`
25	avm/ptn/azd/aks-automatic-cluster	`46d3xbcp.ptn.azd-aksautomaticcluster`	`avm-ptn-azd-aksautomaticcluster-module-owners-bicep`
26	avm/ptn/azd/apim-api	`46d3xbcp.ptn.azd-apimapi`	`avm-ptn-azd-apimapi-module-owners-bicep`
27	avm/ptn/azd/container-app-upsert	`46d3xbcp.ptn.azd-containerappupsert`	`avm-ptn-azd-containerappupsert-module-owners-bicep`
28	avm/ptn/azd/container-apps-stack	`46d3xbcp.ptn.azd-containerappsstack`	`avm-ptn-azd-containerappsstack-module-owners-bicep`
29	avm/ptn/azd/insights-dashboard	`46d3xbcp.ptn.azd-insightsdashboard`	`avm-ptn-azd-insightsdashboard-module-owners-bicep`
30	avm/ptn/azd/ml-ai-environment	`46d3xbcp.ptn.azd-mlaienvironment`	`avm-ptn-azd-mlaienvironment-module-owners-bicep`
31	avm/ptn/azd/ml-hub-dependencies	`46d3xbcp.ptn.azd-mlhubdependencies`	`avm-ptn-azd-mlhubdependencies-module-owners-bicep`
32	avm/ptn/azd/ml-project	`46d3xbcp.ptn.azd-mlproject`	`avm-ptn-azd-mlproject-module-owners-bicep`
33	avm/ptn/azd/monitoring	`46d3xbcp.ptn.azd-monitoring`	`avm-ptn-azd-monitoring-module-owners-bicep`
34	avm/ptn/data/private-analytical-workspace	`46d3xbcp.ptn.data-privateanalyticalworkspace`	`avm-ptn-data-privateanalyticalworkspace-module-owners-bicep`
35	avm/ptn/deployment-script/create-kv-ssh-key-pair	`46d3xbcp.ptn.deploymentscript-createkvsshkeypair`	`avm-ptn-deploymentscript-createkvsshkeypair-module-owners-bicep`
36	avm/ptn/deployment-script/import-image-to-acr	`46d3xbcp.ptn.deploymentscript-importimagetoacr`	`avm-ptn-deploymentscript-importimagetoacr-module-owners-bicep`
37	avm/ptn/deployment-script/private	`46d3xbcp.ptn.deploymentscript-private`	`avm-ptn-deploymentscript-private-module-owners-bicep`
38	avm/ptn/dev-center/dev-box	`46d3xbcp.ptn.devcenter-devbox`	`avm-ptn-devcenter-devbox-module-owners-bicep`
39	avm/ptn/dev-ops/cicd-agents-and-runners	`46d3xbcp.ptn.devops-cicdagentsandrunners`	`avm-ptn-devops-cicdagentsandrunners-module-owners-bicep`
40	avm/ptn/finops-toolkit/finops-hub	`46d3xbcp.ptn.finopstoolkit-finopshub`	`avm-ptn-finopstoolkit-finopshub-module-owners-bicep`
41	avm/ptn/lz/sub-vending	`46d3xbcp.ptn.lz-subvending`	`avm-ptn-lz-subvending-module-owners-bicep`
42	avm/ptn/lza-shared/data-services	`46d3xbcp.ptn.lzashared-dataservices`	`avm-ptn-lzashared-dataservices-module-owners-bicep`
43	avm/ptn/maintenance/azure-update-manager	`46d3xbcp.ptn.maintenance-azureupdatemanager`	`avm-ptn-maintenance-azureupdatemanager-module-owners-bicep`
44	avm/ptn/mgmt-groups/subscription-placement	`46d3xbcp.ptn.mgmtgroup-subplacement`	`avm-ptn-mgmtgroups-subscriptionplacement-module-owners-bicep`
45	avm/ptn/monitoring/amba	`46d3xbcp.ptn.monitoring-amba`	`avm-ptn-monitoring-amba-module-owners-bicep`
46	avm/ptn/monitoring/amba-alz	`46d3xbcp.ptn.monitoring-ambaalz`	`avm-ptn-monitoring-ambaalz-module-owners-bicep`
47	avm/ptn/network/hub-networking	`46d3xbcp.ptn.network-hubnetworking`	`avm-ptn-network-hubnetworking-module-owners-bicep`
48	avm/ptn/network/private-link-private-dns-zones	`46d3xbcp.ptn.network-privatelinkprivatednszones`	`avm-ptn-network-privatelinkprivatednszones-module-owners-bicep`
49	avm/ptn/network/virtual-wan	`46d3xbcp.ptn.network-virtualwan`	`avm-ptn-network-virtualwan-module-owners-bicep`
50	avm/ptn/network/vwan-connected-vnets	`46d3xbcp.ptn.network-vwanconnectedvnets`	`avm-ptn-network-vwanconnectedvnets-module-owners-bicep`
51	avm/ptn/openai/e2e-baseline	`46d3xbcp.ptn.openai-e2ebaseline`	`avm-ptn-openai-e2ebaseline-module-owners-bicep`
52	avm/ptn/policy-insights/remediation	`46d3xbcp.ptn.policyinsights-remediation`	`avm-ptn-policyinsights-remediation-module-owners-bicep`
53	avm/ptn/sa/build-your-own-copilot	`46d3xbcp.ptn.sa-buildyourowncopilot`	`avm-ptn-sa-buildyourowncopilot-module-owners-bicep`
54	avm/ptn/sa/chat-with-your-data	`46d3xbcp.ptn.sa-chatwithyourdata`	`avm-ptn-sa-chatwithyourdata-module-owners-bicep`
55	avm/ptn/sa/content-generation	`46d3xbcp.ptn.sa-contentgeneration`	`avm-ptn-sa-contentgeneration-module-owners-bicep`
56	avm/ptn/sa/content-processing	`46d3xbcp.ptn.sa-contentprocessing`	`avm-ptn-sa-contentprocessing-module-owners-bicep`
57	avm/ptn/sa/conversation-knowledge-mining	`46d3xbcp.ptn.sa-convknowledgemining`	`avm-ptn-sa-conversationknowledgemining-module-owners-bicep`
58	avm/ptn/sa/customer-chatbot	`46d3xbcp.ptn.sa-customerchatbot`	`avm-ptn-sa-customerchatbot-module-owners-bicep`
59	avm/ptn/sa/document-knowledge-mining	`46d3xbcp.ptn.sa-documentknowledgemining`	`avm-ptn-sa-documentknowledgemining-module-owners-bicep`
60	avm/ptn/sa/modernize-your-code	`46d3xbcp.ptn.sa-modernizeyourcode`	`avm-ptn-sa-modernizeyourcode-module-owners-bicep`
61	avm/ptn/sa/multi-agent-custom-automation-engine	`46d3xbcp.ptn.sa-multiagentcustauteng`	`avm-ptn-sa-multiagentcustomautomationengine-module-owners-bicep`
62	avm/ptn/security/security-center	`46d3xbcp.ptn.security-securitycenter`	`avm-ptn-security-securitycenter-module-owners-bicep`
63	avm/ptn/security/sentinel	`46d3xbcp.ptn.security-sentinel`	`avm-ptn-security-sentinel-module-owners-bicep`
64	avm/ptn/subscription/service-health-alerts	`46d3xbcp.ptn.subscription-svchealthalerts`	`avm-ptn-subscription-servicehealthalerts-module-owners-bicep`
65	avm/ptn/virtual-machine-images/azure-image-builder	`46d3xbcp.ptn.vmimages-azureimagebuilder`	`avm-ptn-virtualmachineimages-azureimagebuilder-module-owners-bicep`

Bicep Utility Modules

Module catalog

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Bicep	Utility	1	1	2

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Info

This page contains various views of the module index (catalog) for Bicep Utility Modules. To see these views, click on the expandable sections with the “➕” sign below.

To see the full, unfiltered, unformatted module index on GitHub, click here.
To download the source CSV file, click here.

Note

Published modules - 🟢 & 🟡

➕ Published Modules - Module names, status and owners

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/utl/types/avm-common-types	AVM Common Types		AlexanderSehr Alexander Sehr

Proposed modules - ⚪

➕ Proposed Modules - Module names, status and owners

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/utl/general/get-environment	Get-Environment		alex-frankel Alex Frankel

Deprecated modules - 🔴

➕ Deprecated Modules - Module names, status and owners

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	❌ None listed	❌ None listed	❌ None listed	❌ None listed

All modules - 📇

➕ All Modules - Module names, status and owners

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/utl/general/get-environment	Get-Environment		alex-frankel Alex Frankel
02	avm/utl/types/avm-common-types	AVM Common Types		AlexanderSehr Alexander Sehr

Module Publication History - 📅

➕ Module Publication History - Module names, status and owners

Modules published in October 2024

No.	Module Name	Display Name	Status & Versions	Owner(s)
01	avm/utl/types/avm-common-types	AVM Common Types		AlexanderSehr Alexander Sehr

For Module Owners & Contributors

Note

This section is mainly intended for module owners and contributors as it contains information important for module development, such as telemetry ID prefix, and GitHub Teams for Owners.

Module name, Telemetry ID prefix, GitHub Teams for Owners

➕ All Modules - Module name, Telemetry ID prefix, GitHub Teams for Owners

No.	Module Name	Telemetry ID prefix	GitHub Teams for Module Owners (`@Azure` org)
01	avm/utl/general/get-environment	`46d3xbcp.utl.general-getenvironment`	`avm-utl-general-getenvironment-module-owners-bicep`
02	avm/utl/types/avm-common-types	`46d3xbcp.utl.types-avmcommontypes`	`avm-utl-types-avmcommontypes-module-owners-bicep`

Terraform Modules

Summary

The following table shows the number of all available, orphaned and planned Terraform Modules.

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Terraform	Resource	111	41	152
	Pattern	26	30	56
	Utility	11	3	14

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Want to contribute to AVM Terraform modules?

#	Labels	Link and description
1.	Type: New Module Proposal 💡 Needs: Module Owner 📣 Language: Terraform 🌐	To become the owner of a new Terraform module, see all new Terraform modules looking for owners or check out the “Looking for owners” swimlane here.
2.	Status: Module Orphaned 🟡 Language: Terraform 🌐	To become the owner of an orphaned Terraform module, see all orphaned Terraform modules or check out the “Orphaned” swimlane here.
3.	Needs: Module Contributor 📣 Language: Terraform 🌐	To become a co-owner or contribute to a Terraform module, see all Terraform modules looking for contributors.

For more details on “What are the different ways to contribute to AVM?”, see here.

Terraform Resource Modules

Module catalog

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Terraform	Resource	111	41	152

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Info

This page contains various views of the module index (catalog) for Terraform Resource Modules. To see these views, click on the expandable sections with the “➕” sign below.

To see the full, unfiltered, unformatted module index on GitHub, click here.
To download the source CSV file, click here.

Note

Published modules - 🟢 & 🟡

➕ Published Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-res-apimanagement-service	📄	API Management Service	swatilekhapaul Swatilekha Paul
02	avm-res-app-containerapp	📄	Container App	lonegunmanb Zijie He
03	avm-res-app-job	📄	App Job	sujaypillai Sujay Pillai
04	avm-res-app-managedenvironment ▶ certificate dapr_component managed_certificate storage	📄	App Managed Environment	segraef Sebastian Graef
05	avm-res-appconfiguration-configurationstore ▶ keyvalue replicas keyvalue-data	📄	App Configuration Store	matt-FFFFFF Matt White
06	avm-res-authorization-roleassignment	📄	Role Assignment	jaredfholgate Jared Holgate
07	avm-res-automation-automationaccount	📄	Automation Account	didayal-msft Divyadeep Dayal Poven795909 Poornima Venkataramanan
08	avm-res-avs-privatecloud ▶ generate_deployment_region create_elastic_san_volume create_jump_vm create_test_domain_controllers create_test_netapp_volume	📄	AVS Private Cloud	jchancellor-ms Jon Chancellor
09	avm-res-azurestackhci-cluster	📄	Azure Stack HCI Cluster	chirag1603 Chirag Choudha
10	avm-res-azurestackhci-logicalnetwork	📄	AzureStackHCI logical network	chirag1603 Chirag Choudha
11	avm-res-azurestackhci-virtualmachineinstance	📄	Stack HCI Virtual Machine Instance	chirag1603 Chirag Choudha
12	avm-res-batch-batchaccount	📄	Batch Account	ethanjenkins1 Ethan Jenkins
13	avm-res-botservice-botservice	📄	Bot Service	ethanjenkins1 Ethan Jenkins
14	avm-res-cache-redis	📄	Redis Cache	jchancellor-ms Jon Chancellor
15	avm-res-cache-redisenterprise	📄	Azure Managed Redis	Ankur1106 Ankur Sharma
16	avm-res-cdn-profile	📄	CDN Profile	Poven795909 Poornima Venkataramanan didayal-msft Divyadeep Dayal
17	avm-res-certificateregistration-certificateorder	📄	Certificate Orders	lonegunmanb Zijie He
18	avm-res-cognitiveservices-account	📄	Cognitive Service	lonegunmanb Zijie He
19	avm-res-communication-emailservice	📄	Email Communication Service	lonegunmanb Zijie He
20	avm-res-compute-capacityreservationgroup ▶ capacity_reservation	📄	Capacity Reservation Group	WenAI2020 Wen Tian
21	avm-res-compute-disk	📄	Compute Disk	terrymandin Terry Mandin
22	avm-res-compute-diskencryptionset	📄	Disk Encryption Set	Akashc0807 Akash Choudhary
23	avm-res-compute-gallery	📄	Azure Compute Gallery	Akashc0807 Akash Choudhary
24	avm-res-compute-hostgroup	📄	Host Groups	WenAI2020 Wen Tian
25	avm-res-compute-proximityplacementgroup	📄	Proximity Placement Group	fafriha Farouk Friha
26	avm-res-compute-sshpublickey	📄	Public SSH Key	ChrisSidebotham Chris Sidebotham
27	avm-res-compute-virtualmachine ▶ extension run-command	📄	Virtual Machine VM	jchancellor-ms Jon Chancellor
28	avm-res-compute-virtualmachinescaleset ▶ sku_selector	📄	Virtual Machine Scale Set VMSS	terrymandin Terry Mandin marcelkmfst Marcel Keller
29	avm-res-containerinstance-containergroup	📄	Container Instance	sharmilamusunuru Sharmila Musunuru
30	avm-res-containerregistry-registry ▶ scope-map	📄	Azure Container Registry (ACR)	Akashc0807 Akash Choudhary
31	avm-res-containerservice-managedcluster ▶ agentpool maintenanceconfiguration monitoring alerting namespace	📄	AKS Managed Cluster	matt-FFFFFF Matt White ethanjenkins1 Ethan Jenkins
32	avm-res-databricks-workspace	📄	Azure Databricks Workspace	segraef Sebastian Graef
33	avm-res-datafactory-factory	📄	Data Factory	asishr Asish R
34	avm-res-dataprotection-backupvault	📄	Data Protection Backup Vault	ethanjenkins1 Ethan Jenkins
35	avm-res-dataprotection-resourceguard	📄	Data Protection Resource Guard	WenAI2020 Wen Tian
36	avm-res-dbformysql-flexibleserver	📄	DB for MySQL Flexible Server	elsalvos Cesar Abrego
37	avm-res-dbforpostgresql-flexibleserver ▶ database	📄	DB for Postgre SQL Flexible Server	zaidmohd Zaid Mohammad
38	avm-res-desktopvirtualization-applicationgroup	📄	Azure Virtual Desktop (AVD) Application Group	jensheerin Jen Sheerin sihbher Gerardo Reyes
39	avm-res-desktopvirtualization-hostpool	📄	Azure Virtual Desktop (AVD) Host Pool	jensheerin Jen Sheerin sihbher Gerardo Reyes
40	avm-res-desktopvirtualization-scalingplan	📄	Azure Virtual Desktop (AVD) Scaling Plan	jensheerin Jen Sheerin sihbher Gerardo Reyes
41	avm-res-desktopvirtualization-workspace	📄	Azure Virtual Desktop (AVD) Workspace	jensheerin Jen Sheerin sihbher Gerardo Reyes
42	avm-res-devcenter-devcenter ▶ dev_center_environment_type dev_center_gallery dev_center_catalog dev_center_devbox_definition	📄	Dev Center	abhishekaryams Abhishek Arya
43	avm-res-devopsinfrastructure-pool	📄	DevOps Pools	jaredfholgate Jared Holgate
44	avm-res-documentdb-databaseaccount	📄	CosmosDB Database Account	cmaneu Christopher Maneu
45	avm-res-documentdb-mongocluster	📄	Cosmos DB for MongoDB (vCore)	sujaypillai Sujay Pillai
46	avm-res-edge-site	📄	Azure Arc Site manager	chirag1603 Chirag Choudha
47	avm-res-eventgrid-domain ▶ domain_topic domain_topic_event_subscription domain_event_subscription	📄	Event Grid Domain	sujaypillai Sujay Pillai
48	avm-res-eventgrid-namespace ▶ topic_event_subscription topic_space ca_certificate client_group client namespace_topic permission_binding	📄	Event Grid Namespace	dassbernd Berna Sandalli
49	avm-res-eventgrid-topic ▶ event_subscription	📄	Event Grid Topic	sujaypillai Sujay Pillai
50	avm-res-eventhub-namespace	📄	Event Hub Namespace	rcavaturu Raja Kalyan Ram Cavaturu
51	avm-res-features-feature	📄	Azure Feature Exposure Control (AFEC)	lonegunmanb Zijie He
52	avm-res-hybridcontainerservice-provisionedclusterinstance	📄	AKS Arc	chirag1603 Chirag Choudha
53	avm-res-insights-autoscalesetting ▶ sku_selector	📄	Auto scale settings	MinHeinA Min Hein Aung
54	avm-res-insights-component	📄	Application Insight	Jfolberth John Folberth
55	avm-res-insights-datacollectionendpoint	📄	Data Collection Endpoint	sharmilamusunuru Sharmila Musunuru
56	avm-res-insights-datacollectionrule	📄	Data Collection Rule	ethanjenkins1 Ethan Jenkins
57	avm-res-keyvault-vault ▶ key secret	📄	Key Vault KV	matt-FFFFFF Matt White
58	avm-res-kusto-cluster ▶ azurerm_kusto_cluster_principal_assignment azurerm_kusto_database azurerm_kusto_database_principal_assignment	📄	Kusto Clusters	LaurentLesle Laurent Lesle
59	avm-res-logic-workflow	📄	Logic Apps (Workflow)	bakrish Bala Krishnamoorthy
60	avm-res-machinelearningservices-workspace	📄	Machine Learning Services Workspace ML Workspace	Nepomuceno Gabriel Monteiro Nepomuceno
61	avm-res-maintenance-maintenanceconfiguration	📄	Maintenance Configuration	ASHR4 Rhys Ash
62	avm-res-managedidentity-userassignedidentity	📄	User Assigned Identity MSI	Jfolberth John Folberth
63	avm-res-management-servicegroup ▶ members	📄	Management Service Groups	haflidif Haflidi Fridthjofsson
64	avm-res-netapp-netappaccount ▶ backup-policy backup-vault capacity-pool snapshot-policy volume	📄	Azure NetApp File	jtracey93 Jack Tracey
65	avm-res-network-applicationgateway	📄	Application Gateway App GW	mofaizal Mohamed Faizal
66	avm-res-network-applicationgatewaywebapplicationfirewallpolicy	📄	Application Gateway Web Application Firewall (WAF) Policy	mofaizal Mohamed Faizal
67	avm-res-network-applicationsecuritygroup	📄	Application Security Group (ASG) ASG	MinHeinA Min Hein Aung
68	avm-res-network-azurefirewall	📄	Azure Firewall Azure FW	vmisson Vincent Misson
69	avm-res-network-bastionhost	📄	Bastion Host	omer5574 Omer Sharon
70	avm-res-network-connection	📄	Virtual Network Gateway Connection	jchancellor-ms Jon Chancellor
71	avm-res-network-ddosprotectionplan	📄	DDoS Protection	sitarant Simona Tarantola jtracey93 Jack Tracey
72	avm-res-network-dnsresolver ▶ ruleset_vnet_link	📄	DNS Resolver	omer5574 Omer Sharon
73	avm-res-network-dnszone	📄	Public DNS Zone	sharmilamusunuru Sharmila Musunuru
74	avm-res-network-expressroutecircuit	📄	ExpressRoute Circuit ER	khushal08 Khush Kaviraj adammontlake Adam Montlake
75	avm-res-network-firewallpolicy ▶ rule_collection_groups	📄	Azure Firewall Policy	MinHeinA Min Hein Aung
76	avm-res-network-frontdoorwebapplicationfirewallpolicy	📄	Front Door Web Application Firewall (WAF) Policy	sihbher Gerardo Reyes
77	avm-res-network-ipgroup	📄	IP Group	mathewsg Mathews George
78	avm-res-network-loadbalancer	📄	Loadbalancer	donovm4 Donovan McCoy
79	avm-res-network-localnetworkgateway	📄	Local Network Gateway	Bhavyasree08 Bhavyasree Damarla
80	avm-res-network-natgateway	📄	NAT Gateway	iarik0440 Yarik Simineans
81	avm-res-network-networkinterface	📄	Network Interface NIC	fafriha Farouk Friha
82	avm-res-network-networkmanager ▶ network-group connectivity-configuration scope-connection security-admin-configuration routing-configuration	📄	Azure Virtual Network Manager	MrRoundRobin Robin Muller
83	avm-res-network-networksecuritygroup	📄	Network Security Group	maheshbenke Mahesh Benke
84	avm-res-network-networkwatcher	📄	Azure Network Watcher	terrymandin Terry Mandin
85	avm-res-network-privatednszone ▶ private_dns_txt_record private_dns_virtual_network_link private_dns_a_record private_dns_aaaa_record private_dns_cname_record private_dns_mx_record private_dns_ptr_record private_dns_srv_record private_dns_soa_record	📄	Private DNS Zone	MinHeinA Min Hein Aung
86	avm-res-network-privateendpoint	📄	Private Endpoint	jaredfholgate Jared Holgate
87	avm-res-network-publicipaddress	📄	Public IP Address PIP	vmisson Vincent Misson
88	avm-res-network-publicipprefix	📄	Public IP Prefix	PmeshramPM Pankaj Meshram
89	avm-res-network-routetable ▶ route	📄	Route Table UDR	adammontlake Adam Montlake
90	avm-res-network-trafficmanagerprofile ▶ azure_endpoint external_endpoint nested_endpoint	📄	Traffic Manager Profile	AnubhaR94 Anubha Rana
91	avm-res-network-virtualnetwork ▶ peering subnet	📄	Virtual Network VNET	jaredfholgate Jared Holgate
92	avm-res-operationalinsights-workspace ▶ query_packs log_analytics_solution	📄	Log Analytics workspace	iarik0440 Yarik Simineans
93	avm-res-oracledatabase-cloudexadatainfrastructure	📄	Oracle Exadata Infrastructure	sihbher Gerardo Reyes terrymandin Terry Mandin
94	avm-res-oracledatabase-cloudvmcluster	📄	Oracle VM cluster	sihbher Gerardo Reyes terrymandin Terry Mandin
95	avm-res-portal-dashboard	📄	Azure Portal Dashboard	VeronicaSea Veronica Xu
96	avm-res-recoveryservices-vault ▶ backup_protected_vm backup_protected_file_share virtual_machine_policy file_share_policy workload_policy	📄	Recovery Services Vault	elsalvos Cesar Abrego
97	avm-res-redhatopenshift-openshiftcluster	📄	OpenShift Cluster	ethanjenkins1 Ethan Jenkins puneetdevadiga Puneet Devadiga
98	avm-res-relay-namespace ▶ authorization-rule hybrid-connection wcf-relay network-rule-set	📄	Relay Namespace	sujaypillai Sujay Pillai
99	avm-res-resourcegraph-query	📄	Resource Graph Query	SJAYAP S Jayaprakash
100	avm-res-resources-resourcegroup	📄	Resource Group RG	Jfolberth John Folberth
101	avm-res-search-searchservice	📄	Search Service	lestermarch Lester March
102	avm-res-servicebus-namespace	📄	Service Bus Namespace	iarik0440 Yarik Simineans
103	avm-res-sql-managedinstance	📄	SQL Managed Instance SQL MI	chanakanissanka Chanaka Nissanka abhishekaryams Abhishek Arya
104	avm-res-sql-server ▶ elasticpool database	📄	Azure SQL Server	abhishekaryams Abhishek Arya
105	avm-res-sqlvirtualmachine-sqlvirtualmachine	📄	Sql Virtual Machine SQL VM	sujaypillai Sujay Pillai
106	avm-res-storage-storageaccount	📄	Storage Account	chinthakaru Chinthaka Rupasinghe
107	avm-res-web-connection	📄	API Connection	donovm4 Donovan McCoy
108	avm-res-web-hostingenvironment ▶ custom_dns_suffix_configuration networking_configuration	📄	App Service Environment ASE	matt-FFFFFF Matt White
109	avm-res-web-serverfarm	📄	App Service Plan	matt-FFFFFF Matt White ethanjenkins1 Ethan Jenkins
110	avm-res-web-site ▶ config_connectionstrings config_slotconfignames publishing_credential_policy extensions_zipdeploy config_metadata config_logs certificate config_authsettings slot site_config_helpers config_azurestorageaccounts config_appsettings config_backup hostname_binding config_authsettingsv2	📄	Web/Function App App Service, Web Site, Logic App, Function App	donovm4 Donovan McCoy
111	avm-res-web-staticsite	📄	Static Web App	donovm4 Donovan McCoy

Proposed modules - ⚪

➕ Proposed Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-res-aad-domainservice	n/a	Azure Active Directory Domain Service	humanascode Itamar Hirosh
02	avm-res-alertsmanagement-actionrule	n/a	Action Rules	xsatishx Satish Balakrishnan
03	avm-res-analysisservices-server	n/a	Analysis Services Server	Bhavyasree08 Bhavyasree Damarla
04	avm-res-compute-image	n/a	Image
05	avm-res-consumption-budget	n/a	Consumption Budget	Akashc0807 Akash Choudhary
06	avm-res-containerservice-fleet	n/a	AKS Fleet	didayal-msft Divyadeep Dayal amruta53 Amruta Kulkarni
07	avm-res-dashboard-grafana	n/a	Azure Managed Grafana	khajour Abdelaziz Khajour
08	avm-res-databricks-accessconnector	n/a	Azure Databricks Access Connector
09	avm-res-deviceregistry-assetendpointprofile	n/a	Device Registry Asset Endpoint Profile	lonegunmanb Zijie He
10	avm-res-devtestlab-lab	n/a	DevTest Lab	sharmilamusunuru Sharmila Musunuru
11	avm-res-digitaltwins-digitaltwinsinstance	n/a	Digital Twins Instance
12	avm-res-eventgrid-systemtopic	n/a	Event Grid System Topic	sujaypillai Sujay Pillai
13	avm-res-healthbot-healthbot	n/a	Azure Health Bot
14	avm-res-hybridcompute-machine	n/a	Hybrid Compute Machine
15	avm-res-insights-actiongroup	n/a	Action Group	arjenhuitema Arjen Huitema Brunoga-MS Bruno Gabrielli
16	avm-res-insights-activitylogalert	n/a	Activity log alerts	tagolovina Tanya Golovina
17	avm-res-insights-logprofile	n/a	Log profile	sharmilamusunuru Sharmila Musunuru
18	avm-res-insights-metricalert	n/a	Metric Alert	arjenhuitema Arjen Huitema
19	avm-res-insights-privatelinkscope	n/a	Azure Monitor Private Link Scope	sharmilamusunuru Sharmila Musunuru
20	avm-res-insights-scheduledqueryrule	n/a	Scheduled Query Rule	xsatishx Satish Balakrishnan
21	avm-res-iotoperations-instance	n/a	Azure IoT Operations	agreaves-ms Allen Greaves WilliamBerryiii Bill Berry
22	avm-res-loadtestservice-loadtest	n/a	Load Testing Service	pfayika1 Philippe Fayika
23	avm-res-managedservices-registrationdefinition	n/a	Registration Definition (Lighthouse)
24	avm-res-management-managementgroup	n/a	Management Group MG	herms14 Hermes Miraflor II
25	avm-res-network-dnsforwardingruleset	n/a	DNS Forwarding Ruleset	sharmilamusunuru Sharmila Musunuru
26	avm-res-network-expressrouteport	n/a	ExpressRoute Port	adammontlake Adam Montlake
27	avm-res-network-networksecurityperimeter	n/a	Network Security Perimeter	sujaypillai Sujay Pillai
28	avm-res-network-privatelinkservice	n/a	Private Link Service	avivshrem Aviv Shrem
29	avm-res-network-serviceendpointpolicy	n/a	Service Endpoint Policy	ASHR4 Rhys Ash
30	avm-res-network-virtualnetworkgateway	n/a	Virtual Network Gateway VNET GW
31	avm-res-network-virtualrouter	n/a	Route Server
32	avm-res-operationsmanagement-solution	n/a	Operations Management Solution
33	avm-res-powerbidedicated-capacity	n/a	Power BI Dedicated Capacity
34	avm-res-purview-account	n/a	Purview Account
35	avm-res-resources-feature	n/a	Resource Features	lonegunmanb Zijie He
36	avm-res-servicefabric-cluster	n/a	Service Fabric Cluster
37	avm-res-servicenetworking-trafficcontroller	n/a	Application Gateway for Containers (Traffic Controller)	mofaizal Mohamed Faizal
38	avm-res-signalrservice-signalr	n/a	SignalR Service SignalR
39	avm-res-sql-instancepool	n/a	Instance Pools	sujaypillai Sujay Pillai
40	avm-res-synapse-workspace	n/a	Synapse Workspace	Karni-G Karni Gupta
41	avm-res-virtualmachineimages-imagetemplate	n/a	Virtual Machine Image Template	travishankins Travis Hankins

Deprecated modules - 🔴

➕ Deprecated Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Status & Versions	Primary Owner
01	❌ None listed	❌ None listed	❌ None listed	❌ None listed	❌ None listed

All modules - 📇

➕ All Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-res-aad-domainservice	n/a	Azure Active Directory Domain Service	humanascode Itamar Hirosh
02	avm-res-alertsmanagement-actionrule	n/a	Action Rules	xsatishx Satish Balakrishnan
03	avm-res-analysisservices-server	n/a	Analysis Services Server	Bhavyasree08 Bhavyasree Damarla
04	avm-res-apimanagement-service	📄	API Management Service	swatilekhapaul Swatilekha Paul
05	avm-res-app-containerapp	📄	Container App	lonegunmanb Zijie He
06	avm-res-app-job	📄	App Job	sujaypillai Sujay Pillai
07	avm-res-app-managedenvironment ▶ certificate dapr_component managed_certificate storage	📄	App Managed Environment	segraef Sebastian Graef
08	avm-res-appconfiguration-configurationstore ▶ keyvalue replicas keyvalue-data	📄	App Configuration Store	matt-FFFFFF Matt White
09	avm-res-authorization-roleassignment	📄	Role Assignment	jaredfholgate Jared Holgate
10	avm-res-automation-automationaccount	📄	Automation Account	didayal-msft Divyadeep Dayal Poven795909 Poornima Venkataramanan
11	avm-res-avs-privatecloud ▶ generate_deployment_region create_elastic_san_volume create_jump_vm create_test_domain_controllers create_test_netapp_volume	📄	AVS Private Cloud	jchancellor-ms Jon Chancellor
12	avm-res-azurestackhci-cluster	📄	Azure Stack HCI Cluster	chirag1603 Chirag Choudha
13	avm-res-azurestackhci-logicalnetwork	📄	AzureStackHCI logical network	chirag1603 Chirag Choudha
14	avm-res-azurestackhci-virtualmachineinstance	📄	Stack HCI Virtual Machine Instance	chirag1603 Chirag Choudha
15	avm-res-batch-batchaccount	📄	Batch Account	ethanjenkins1 Ethan Jenkins
16	avm-res-botservice-botservice	📄	Bot Service	ethanjenkins1 Ethan Jenkins
17	avm-res-cache-redis	📄	Redis Cache	jchancellor-ms Jon Chancellor
18	avm-res-cache-redisenterprise	📄	Azure Managed Redis	Ankur1106 Ankur Sharma
19	avm-res-cdn-profile	📄	CDN Profile	Poven795909 Poornima Venkataramanan didayal-msft Divyadeep Dayal
20	avm-res-certificateregistration-certificateorder	📄	Certificate Orders	lonegunmanb Zijie He
21	avm-res-cognitiveservices-account	📄	Cognitive Service	lonegunmanb Zijie He
22	avm-res-communication-emailservice	📄	Email Communication Service	lonegunmanb Zijie He
23	avm-res-compute-capacityreservationgroup ▶ capacity_reservation	📄	Capacity Reservation Group	WenAI2020 Wen Tian
24	avm-res-compute-disk	📄	Compute Disk	terrymandin Terry Mandin
25	avm-res-compute-diskencryptionset	📄	Disk Encryption Set	Akashc0807 Akash Choudhary
26	avm-res-compute-gallery	📄	Azure Compute Gallery	Akashc0807 Akash Choudhary
27	avm-res-compute-hostgroup	📄	Host Groups	WenAI2020 Wen Tian
28	avm-res-compute-image	n/a	Image
29	avm-res-compute-proximityplacementgroup	📄	Proximity Placement Group	fafriha Farouk Friha
30	avm-res-compute-sshpublickey	📄	Public SSH Key	ChrisSidebotham Chris Sidebotham
31	avm-res-compute-virtualmachine ▶ extension run-command	📄	Virtual Machine VM	jchancellor-ms Jon Chancellor
32	avm-res-compute-virtualmachinescaleset ▶ sku_selector	📄	Virtual Machine Scale Set VMSS	terrymandin Terry Mandin marcelkmfst Marcel Keller
33	avm-res-consumption-budget	n/a	Consumption Budget	Akashc0807 Akash Choudhary
34	avm-res-containerinstance-containergroup	📄	Container Instance	sharmilamusunuru Sharmila Musunuru
35	avm-res-containerregistry-registry ▶ scope-map	📄	Azure Container Registry (ACR)	Akashc0807 Akash Choudhary
36	avm-res-containerservice-fleet	n/a	AKS Fleet	didayal-msft Divyadeep Dayal amruta53 Amruta Kulkarni
37	avm-res-containerservice-managedcluster ▶ agentpool maintenanceconfiguration monitoring alerting namespace	📄	AKS Managed Cluster	matt-FFFFFF Matt White ethanjenkins1 Ethan Jenkins
38	avm-res-dashboard-grafana	n/a	Azure Managed Grafana	khajour Abdelaziz Khajour
39	avm-res-databricks-accessconnector	n/a	Azure Databricks Access Connector
40	avm-res-databricks-workspace	📄	Azure Databricks Workspace	segraef Sebastian Graef
41	avm-res-datafactory-factory	📄	Data Factory	asishr Asish R
42	avm-res-dataprotection-backupvault	📄	Data Protection Backup Vault	ethanjenkins1 Ethan Jenkins
43	avm-res-dataprotection-resourceguard	📄	Data Protection Resource Guard	WenAI2020 Wen Tian
44	avm-res-dbformysql-flexibleserver	📄	DB for MySQL Flexible Server	elsalvos Cesar Abrego
45	avm-res-dbforpostgresql-flexibleserver ▶ database	📄	DB for Postgre SQL Flexible Server	zaidmohd Zaid Mohammad
46	avm-res-desktopvirtualization-applicationgroup	📄	Azure Virtual Desktop (AVD) Application Group	jensheerin Jen Sheerin sihbher Gerardo Reyes
47	avm-res-desktopvirtualization-hostpool	📄	Azure Virtual Desktop (AVD) Host Pool	jensheerin Jen Sheerin sihbher Gerardo Reyes
48	avm-res-desktopvirtualization-scalingplan	📄	Azure Virtual Desktop (AVD) Scaling Plan	jensheerin Jen Sheerin sihbher Gerardo Reyes
49	avm-res-desktopvirtualization-workspace	📄	Azure Virtual Desktop (AVD) Workspace	jensheerin Jen Sheerin sihbher Gerardo Reyes
50	avm-res-devcenter-devcenter ▶ dev_center_environment_type dev_center_gallery dev_center_catalog dev_center_devbox_definition	📄	Dev Center	abhishekaryams Abhishek Arya
51	avm-res-deviceregistry-assetendpointprofile	n/a	Device Registry Asset Endpoint Profile	lonegunmanb Zijie He
52	avm-res-devopsinfrastructure-pool	📄	DevOps Pools	jaredfholgate Jared Holgate
53	avm-res-devtestlab-lab	n/a	DevTest Lab	sharmilamusunuru Sharmila Musunuru
54	avm-res-digitaltwins-digitaltwinsinstance	n/a	Digital Twins Instance
55	avm-res-documentdb-databaseaccount	📄	CosmosDB Database Account	cmaneu Christopher Maneu
56	avm-res-documentdb-mongocluster	📄	Cosmos DB for MongoDB (vCore)	sujaypillai Sujay Pillai
57	avm-res-edge-site	📄	Azure Arc Site manager	chirag1603 Chirag Choudha
58	avm-res-eventgrid-domain ▶ domain_topic domain_topic_event_subscription domain_event_subscription	📄	Event Grid Domain	sujaypillai Sujay Pillai
59	avm-res-eventgrid-namespace ▶ topic_event_subscription topic_space ca_certificate client_group client namespace_topic permission_binding	📄	Event Grid Namespace	dassbernd Berna Sandalli
60	avm-res-eventgrid-systemtopic	n/a	Event Grid System Topic	sujaypillai Sujay Pillai
61	avm-res-eventgrid-topic ▶ event_subscription	📄	Event Grid Topic	sujaypillai Sujay Pillai
62	avm-res-eventhub-namespace	📄	Event Hub Namespace	rcavaturu Raja Kalyan Ram Cavaturu
63	avm-res-features-feature	📄	Azure Feature Exposure Control (AFEC)	lonegunmanb Zijie He
64	avm-res-healthbot-healthbot	n/a	Azure Health Bot
65	avm-res-hybridcompute-machine	n/a	Hybrid Compute Machine
66	avm-res-hybridcontainerservice-provisionedclusterinstance	📄	AKS Arc	chirag1603 Chirag Choudha
67	avm-res-insights-actiongroup	n/a	Action Group	arjenhuitema Arjen Huitema Brunoga-MS Bruno Gabrielli
68	avm-res-insights-activitylogalert	n/a	Activity log alerts	tagolovina Tanya Golovina
69	avm-res-insights-autoscalesetting ▶ sku_selector	📄	Auto scale settings	MinHeinA Min Hein Aung
70	avm-res-insights-component	📄	Application Insight	Jfolberth John Folberth
71	avm-res-insights-datacollectionendpoint	📄	Data Collection Endpoint	sharmilamusunuru Sharmila Musunuru
72	avm-res-insights-datacollectionrule	📄	Data Collection Rule	ethanjenkins1 Ethan Jenkins
73	avm-res-insights-logprofile	n/a	Log profile	sharmilamusunuru Sharmila Musunuru
74	avm-res-insights-metricalert	n/a	Metric Alert	arjenhuitema Arjen Huitema
75	avm-res-insights-privatelinkscope	n/a	Azure Monitor Private Link Scope	sharmilamusunuru Sharmila Musunuru
76	avm-res-insights-scheduledqueryrule	n/a	Scheduled Query Rule	xsatishx Satish Balakrishnan
77	avm-res-iotoperations-instance	n/a	Azure IoT Operations	agreaves-ms Allen Greaves WilliamBerryiii Bill Berry
78	avm-res-keyvault-vault ▶ key secret	📄	Key Vault KV	matt-FFFFFF Matt White
79	avm-res-kusto-cluster ▶ azurerm_kusto_cluster_principal_assignment azurerm_kusto_database azurerm_kusto_database_principal_assignment	📄	Kusto Clusters	LaurentLesle Laurent Lesle
80	avm-res-loadtestservice-loadtest	n/a	Load Testing Service	pfayika1 Philippe Fayika
81	avm-res-logic-workflow	📄	Logic Apps (Workflow)	bakrish Bala Krishnamoorthy
82	avm-res-machinelearningservices-workspace	📄	Machine Learning Services Workspace ML Workspace	Nepomuceno Gabriel Monteiro Nepomuceno
83	avm-res-maintenance-maintenanceconfiguration	📄	Maintenance Configuration	ASHR4 Rhys Ash
84	avm-res-managedidentity-userassignedidentity	📄	User Assigned Identity MSI	Jfolberth John Folberth
85	avm-res-managedservices-registrationdefinition	n/a	Registration Definition (Lighthouse)
86	avm-res-management-managementgroup	n/a	Management Group MG	herms14 Hermes Miraflor II
87	avm-res-management-servicegroup ▶ members	📄	Management Service Groups	haflidif Haflidi Fridthjofsson
88	avm-res-netapp-netappaccount ▶ backup-policy backup-vault capacity-pool snapshot-policy volume	📄	Azure NetApp File	jtracey93 Jack Tracey
89	avm-res-network-applicationgateway	📄	Application Gateway App GW	mofaizal Mohamed Faizal
90	avm-res-network-applicationgatewaywebapplicationfirewallpolicy	📄	Application Gateway Web Application Firewall (WAF) Policy	mofaizal Mohamed Faizal
91	avm-res-network-applicationsecuritygroup	📄	Application Security Group (ASG) ASG	MinHeinA Min Hein Aung
92	avm-res-network-azurefirewall	📄	Azure Firewall Azure FW	vmisson Vincent Misson
93	avm-res-network-bastionhost	📄	Bastion Host	omer5574 Omer Sharon
94	avm-res-network-connection	📄	Virtual Network Gateway Connection	jchancellor-ms Jon Chancellor
95	avm-res-network-ddosprotectionplan	📄	DDoS Protection	sitarant Simona Tarantola jtracey93 Jack Tracey
96	avm-res-network-dnsforwardingruleset	n/a	DNS Forwarding Ruleset	sharmilamusunuru Sharmila Musunuru
97	avm-res-network-dnsresolver ▶ ruleset_vnet_link	📄	DNS Resolver	omer5574 Omer Sharon
98	avm-res-network-dnszone	📄	Public DNS Zone	sharmilamusunuru Sharmila Musunuru
99	avm-res-network-expressroutecircuit	📄	ExpressRoute Circuit ER	khushal08 Khush Kaviraj adammontlake Adam Montlake
100	avm-res-network-expressrouteport	n/a	ExpressRoute Port	adammontlake Adam Montlake
101	avm-res-network-firewallpolicy ▶ rule_collection_groups	📄	Azure Firewall Policy	MinHeinA Min Hein Aung
102	avm-res-network-frontdoorwebapplicationfirewallpolicy	📄	Front Door Web Application Firewall (WAF) Policy	sihbher Gerardo Reyes
103	avm-res-network-ipgroup	📄	IP Group	mathewsg Mathews George
104	avm-res-network-loadbalancer	📄	Loadbalancer	donovm4 Donovan McCoy
105	avm-res-network-localnetworkgateway	📄	Local Network Gateway	Bhavyasree08 Bhavyasree Damarla
106	avm-res-network-natgateway	📄	NAT Gateway	iarik0440 Yarik Simineans
107	avm-res-network-networkinterface	📄	Network Interface NIC	fafriha Farouk Friha
108	avm-res-network-networkmanager ▶ network-group connectivity-configuration scope-connection security-admin-configuration routing-configuration	📄	Azure Virtual Network Manager	MrRoundRobin Robin Muller
109	avm-res-network-networksecuritygroup	📄	Network Security Group	maheshbenke Mahesh Benke
110	avm-res-network-networksecurityperimeter	n/a	Network Security Perimeter	sujaypillai Sujay Pillai
111	avm-res-network-networkwatcher	📄	Azure Network Watcher	terrymandin Terry Mandin
112	avm-res-network-privatednszone ▶ private_dns_txt_record private_dns_virtual_network_link private_dns_a_record private_dns_aaaa_record private_dns_cname_record private_dns_mx_record private_dns_ptr_record private_dns_srv_record private_dns_soa_record	📄	Private DNS Zone	MinHeinA Min Hein Aung
113	avm-res-network-privateendpoint	📄	Private Endpoint	jaredfholgate Jared Holgate
114	avm-res-network-privatelinkservice	n/a	Private Link Service	avivshrem Aviv Shrem
115	avm-res-network-publicipaddress	📄	Public IP Address PIP	vmisson Vincent Misson
116	avm-res-network-publicipprefix	📄	Public IP Prefix	PmeshramPM Pankaj Meshram
117	avm-res-network-routetable ▶ route	📄	Route Table UDR	adammontlake Adam Montlake
118	avm-res-network-serviceendpointpolicy	n/a	Service Endpoint Policy	ASHR4 Rhys Ash
119	avm-res-network-trafficmanagerprofile ▶ azure_endpoint external_endpoint nested_endpoint	📄	Traffic Manager Profile	AnubhaR94 Anubha Rana
120	avm-res-network-virtualnetwork ▶ peering subnet	📄	Virtual Network VNET	jaredfholgate Jared Holgate
121	avm-res-network-virtualnetworkgateway	n/a	Virtual Network Gateway VNET GW
122	avm-res-network-virtualrouter	n/a	Route Server
123	avm-res-operationalinsights-workspace ▶ query_packs log_analytics_solution	📄	Log Analytics workspace	iarik0440 Yarik Simineans
124	avm-res-operationsmanagement-solution	n/a	Operations Management Solution
125	avm-res-oracledatabase-cloudexadatainfrastructure	📄	Oracle Exadata Infrastructure	sihbher Gerardo Reyes terrymandin Terry Mandin
126	avm-res-oracledatabase-cloudvmcluster	📄	Oracle VM cluster	sihbher Gerardo Reyes terrymandin Terry Mandin
127	avm-res-portal-dashboard	📄	Azure Portal Dashboard	VeronicaSea Veronica Xu
128	avm-res-powerbidedicated-capacity	n/a	Power BI Dedicated Capacity
129	avm-res-purview-account	n/a	Purview Account
130	avm-res-recoveryservices-vault ▶ backup_protected_vm backup_protected_file_share virtual_machine_policy file_share_policy workload_policy	📄	Recovery Services Vault	elsalvos Cesar Abrego
131	avm-res-redhatopenshift-openshiftcluster	📄	OpenShift Cluster	ethanjenkins1 Ethan Jenkins puneetdevadiga Puneet Devadiga
132	avm-res-relay-namespace ▶ authorization-rule hybrid-connection wcf-relay network-rule-set	📄	Relay Namespace	sujaypillai Sujay Pillai
133	avm-res-resourcegraph-query	📄	Resource Graph Query	SJAYAP S Jayaprakash
134	avm-res-resources-feature	n/a	Resource Features	lonegunmanb Zijie He
135	avm-res-resources-resourcegroup	📄	Resource Group RG	Jfolberth John Folberth
136	avm-res-search-searchservice	📄	Search Service	lestermarch Lester March
137	avm-res-servicebus-namespace	📄	Service Bus Namespace	iarik0440 Yarik Simineans
138	avm-res-servicefabric-cluster	n/a	Service Fabric Cluster
139	avm-res-servicenetworking-trafficcontroller	n/a	Application Gateway for Containers (Traffic Controller)	mofaizal Mohamed Faizal
140	avm-res-signalrservice-signalr	n/a	SignalR Service SignalR
141	avm-res-sql-instancepool	n/a	Instance Pools	sujaypillai Sujay Pillai
142	avm-res-sql-managedinstance	📄	SQL Managed Instance SQL MI	chanakanissanka Chanaka Nissanka abhishekaryams Abhishek Arya
143	avm-res-sql-server ▶ elasticpool database	📄	Azure SQL Server	abhishekaryams Abhishek Arya
144	avm-res-sqlvirtualmachine-sqlvirtualmachine	📄	Sql Virtual Machine SQL VM	sujaypillai Sujay Pillai
145	avm-res-storage-storageaccount	📄	Storage Account	chinthakaru Chinthaka Rupasinghe
146	avm-res-synapse-workspace	n/a	Synapse Workspace	Karni-G Karni Gupta
147	avm-res-virtualmachineimages-imagetemplate	n/a	Virtual Machine Image Template	travishankins Travis Hankins
148	avm-res-web-connection	📄	API Connection	donovm4 Donovan McCoy
149	avm-res-web-hostingenvironment ▶ custom_dns_suffix_configuration networking_configuration	📄	App Service Environment ASE	matt-FFFFFF Matt White
150	avm-res-web-serverfarm	📄	App Service Plan	matt-FFFFFF Matt White ethanjenkins1 Ethan Jenkins
151	avm-res-web-site ▶ config_connectionstrings config_slotconfignames publishing_credential_policy extensions_zipdeploy config_metadata config_logs certificate config_authsettings slot site_config_helpers config_azurestorageaccounts config_appsettings config_backup hostname_binding config_authsettingsv2	📄	Web/Function App App Service, Web Site, Logic App, Function App	donovm4 Donovan McCoy
152	avm-res-web-staticsite	📄	Static Web App	donovm4 Donovan McCoy

Module Publication History - 📅

➕ Module Publication History - Module names, status and owners

Modules published in April 2026

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-insights-datacollectionrule	📄	Data Collection Rule		ethanjenkins1 Ethan Jenkins

Modules published in March 2026

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-botservice-botservice	📄	Bot Service		ethanjenkins1 Ethan Jenkins

Modules published in February 2026

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-cache-redisenterprise	📄	Azure Managed Redis	Ankur1106 Ankur Sharma
02	avm-res-eventgrid-namespace	📄	Event Grid Namespace	dassbernd Berna Sandalli
03	avm-res-network-trafficmanagerprofile	📄	Traffic Manager Profile	AnubhaR94 Anubha Rana
04	avm-res-sqlvirtualmachine-sqlvirtualmachine	📄	Sql Virtual Machine SQL VM	sujaypillai Sujay Pillai

Modules published in January 2026

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-eventgrid-domain	📄	Event Grid Domain	sujaypillai Sujay Pillai
02	avm-res-eventgrid-topic	📄	Event Grid Topic	sujaypillai Sujay Pillai
03	avm-res-relay-namespace	📄	Relay Namespace	sujaypillai Sujay Pillai

Modules published in November 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-features-feature	📄	Azure Feature Exposure Control (AFEC)		lonegunmanb Zijie He
02	avm-res-web-connection	📄	API Connection		donovm4 Donovan McCoy

Modules published in October 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-management-servicegroup	📄	Management Service Groups		haflidif Haflidi Fridthjofsson
02	avm-res-redhatopenshift-openshiftcluster	📄	OpenShift Cluster		ethanjenkins1 Ethan Jenkins puneetdevadiga Puneet Devadiga

Modules published in August 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-compute-capacityreservationgroup	📄	Capacity Reservation Group		WenAI2020 Wen Tian
02	avm-res-documentdb-mongocluster	📄	Cosmos DB for MongoDB (vCore)		sujaypillai Sujay Pillai

Modules published in July 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-certificateregistration-certificateorder	📄	Certificate Orders		lonegunmanb Zijie He
02	avm-res-dataprotection-resourceguard	📄	Data Protection Resource Guard		WenAI2020 Wen Tian

Modules published in June 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-communication-emailservice	📄	Email Communication Service		lonegunmanb Zijie He

Modules published in May 2025

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-app-job	📄	App Job	sujaypillai Sujay Pillai
02	avm-res-batch-batchaccount	📄	Batch Account	ethanjenkins1 Ethan Jenkins
03	avm-res-dataprotection-backupvault	📄	Data Protection Backup Vault	ethanjenkins1 Ethan Jenkins

Modules published in April 2025

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-apimanagement-service	📄	API Management Service	swatilekhapaul Swatilekha Paul
02	avm-res-automation-automationaccount	📄	Automation Account	didayal-msft Divyadeep Dayal Poven795909 Poornima Venkataramanan
03	avm-res-datafactory-factory	📄	Data Factory	asishr Asish R
04	avm-res-eventhub-namespace	📄	Event Hub Namespace	rcavaturu Raja Kalyan Ram Cavaturu
05	avm-res-maintenance-maintenanceconfiguration	📄	Maintenance Configuration	ASHR4 Rhys Ash
06	avm-res-network-ipgroup	📄	IP Group	mathewsg Mathews George
07	avm-res-network-publicipprefix	📄	Public IP Prefix	PmeshramPM Pankaj Meshram
08	avm-res-resourcegraph-query	📄	Resource Graph Query	SJAYAP S Jayaprakash

Modules published in March 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-appconfiguration-configurationstore	📄	App Configuration Store		matt-FFFFFF Matt White

Modules published in February 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-network-applicationgatewaywebapplicationfirewallpolicy	📄	Application Gateway Web Application Firewall (WAF) Policy		mofaizal Mohamed Faizal

Modules published in January 2025

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-netapp-netappaccount	📄	Azure NetApp File	jtracey93 Jack Tracey
02	avm-res-network-applicationsecuritygroup	📄	Application Security Group (ASG) ASG	MinHeinA Min Hein Aung
03	avm-res-network-connection	📄	Virtual Network Gateway Connection	jchancellor-ms Jon Chancellor
04	avm-res-recoveryservices-vault	📄	Recovery Services Vault	elsalvos Cesar Abrego

Modules published in December 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-compute-gallery	📄	Azure Compute Gallery		Akashc0807 Akash Choudhary

Modules published in November 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-compute-proximityplacementgroup	📄	Proximity Placement Group	fafriha Farouk Friha
02	avm-res-containerservice-managedcluster	📄	AKS Managed Cluster	matt-FFFFFF Matt White ethanjenkins1 Ethan Jenkins
03	avm-res-insights-autoscalesetting	📄	Auto scale settings	MinHeinA Min Hein Aung
04	avm-res-network-localnetworkgateway	📄	Local Network Gateway	Bhavyasree08 Bhavyasree Damarla
05	avm-res-network-networkinterface	📄	Network Interface NIC	fafriha Farouk Friha

Modules published in October 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-compute-diskencryptionset	📄	Disk Encryption Set	Akashc0807 Akash Choudhary
02	avm-res-devcenter-devcenter	📄	Dev Center	abhishekaryams Abhishek Arya
03	avm-res-network-expressroutecircuit	📄	ExpressRoute Circuit ER	khushal08 Khush Kaviraj adammontlake Adam Montlake
04	avm-res-network-frontdoorwebapplicationfirewallpolicy	📄	Front Door Web Application Firewall (WAF) Policy	sihbher Gerardo Reyes

Modules published in September 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-dbformysql-flexibleserver	📄	DB for MySQL Flexible Server	elsalvos Cesar Abrego
02	avm-res-dbforpostgresql-flexibleserver	📄	DB for Postgre SQL Flexible Server	zaidmohd Zaid Mohammad
03	avm-res-network-privateendpoint	📄	Private Endpoint	jaredfholgate Jared Holgate
04	avm-res-oracledatabase-cloudexadatainfrastructure	📄	Oracle Exadata Infrastructure	sihbher Gerardo Reyes terrymandin Terry Mandin
05	avm-res-oracledatabase-cloudvmcluster	📄	Oracle VM cluster	sihbher Gerardo Reyes terrymandin Terry Mandin
06	avm-res-portal-dashboard	📄	Azure Portal Dashboard	VeronicaSea Veronica Xu
07	avm-res-sql-managedinstance	📄	SQL Managed Instance SQL MI	chanakanissanka Chanaka Nissanka abhishekaryams Abhishek Arya
08	avm-res-sql-server	📄	Azure SQL Server	abhishekaryams Abhishek Arya

Modules published in August 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-azurestackhci-cluster	📄	Azure Stack HCI Cluster	chirag1603 Chirag Choudha
02	avm-res-azurestackhci-logicalnetwork	📄	AzureStackHCI logical network	chirag1603 Chirag Choudha
03	avm-res-azurestackhci-virtualmachineinstance	📄	Stack HCI Virtual Machine Instance	chirag1603 Chirag Choudha
04	avm-res-compute-hostgroup	📄	Host Groups	WenAI2020 Wen Tian
05	avm-res-devopsinfrastructure-pool	📄	DevOps Pools	jaredfholgate Jared Holgate
06	avm-res-documentdb-databaseaccount	📄	CosmosDB Database Account	cmaneu Christopher Maneu
07	avm-res-edge-site	📄	Azure Arc Site manager	chirag1603 Chirag Choudha
08	avm-res-hybridcontainerservice-provisionedclusterinstance	📄	AKS Arc	chirag1603 Chirag Choudha
09	avm-res-insights-component	📄	Application Insight	Jfolberth John Folberth
10	avm-res-insights-datacollectionendpoint	📄	Data Collection Endpoint	sharmilamusunuru Sharmila Musunuru
11	avm-res-network-applicationgateway	📄	Application Gateway App GW	mofaizal Mohamed Faizal
12	avm-res-network-dnszone	📄	Public DNS Zone	sharmilamusunuru Sharmila Musunuru
13	avm-res-resources-resourcegroup	📄	Resource Group RG	Jfolberth John Folberth
14	avm-res-search-searchservice	📄	Search Service	lestermarch Lester March
15	avm-res-web-serverfarm	📄	App Service Plan	matt-FFFFFF Matt White ethanjenkins1 Ethan Jenkins

Modules published in July 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-app-containerapp	📄	Container App	lonegunmanb Zijie He
02	avm-res-containerinstance-containergroup	📄	Container Instance	sharmilamusunuru Sharmila Musunuru
03	avm-res-machinelearningservices-workspace	📄	Machine Learning Services Workspace ML Workspace	Nepomuceno Gabriel Monteiro Nepomuceno
04	avm-res-network-networkwatcher	📄	Azure Network Watcher	terrymandin Terry Mandin

Modules published in June 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-cache-redis	📄	Redis Cache	jchancellor-ms Jon Chancellor
02	avm-res-logic-workflow	📄	Logic Apps (Workflow)	bakrish Bala Krishnamoorthy
03	avm-res-web-hostingenvironment	📄	App Service Environment ASE	matt-FFFFFF Matt White

Modules published in May 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-cdn-profile	📄	CDN Profile	Poven795909 Poornima Venkataramanan didayal-msft Divyadeep Dayal
02	avm-res-compute-disk	📄	Compute Disk	terrymandin Terry Mandin
03	avm-res-compute-sshpublickey	📄	Public SSH Key	ChrisSidebotham Chris Sidebotham
04	avm-res-network-dnsresolver	📄	DNS Resolver	omer5574 Omer Sharon
05	avm-res-network-routetable	📄	Route Table UDR	adammontlake Adam Montlake

Modules published in April 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-kusto-cluster	📄	Kusto Clusters		LaurentLesle Laurent Lesle
02	avm-res-servicebus-namespace	📄	Service Bus Namespace		iarik0440 Yarik Simineans

Modules published in March 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-databricks-workspace	📄	Azure Databricks Workspace	segraef Sebastian Graef
02	avm-res-managedidentity-userassignedidentity	📄	User Assigned Identity MSI	Jfolberth John Folberth
03	avm-res-network-privatednszone	📄	Private DNS Zone	MinHeinA Min Hein Aung

Modules published in February 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-app-managedenvironment	📄	App Managed Environment	segraef Sebastian Graef
02	avm-res-avs-privatecloud	📄	AVS Private Cloud	jchancellor-ms Jon Chancellor
03	avm-res-cognitiveservices-account	📄	Cognitive Service	lonegunmanb Zijie He
04	avm-res-compute-virtualmachinescaleset	📄	Virtual Machine Scale Set VMSS	terrymandin Terry Mandin marcelkmfst Marcel Keller
05	avm-res-containerregistry-registry	📄	Azure Container Registry (ACR)	Akashc0807 Akash Choudhary
06	avm-res-network-bastionhost	📄	Bastion Host	omer5574 Omer Sharon
07	avm-res-network-networksecuritygroup	📄	Network Security Group	maheshbenke Mahesh Benke
08	avm-res-network-publicipaddress	📄	Public IP Address PIP	vmisson Vincent Misson
09	avm-res-storage-storageaccount	📄	Storage Account	chinthakaru Chinthaka Rupasinghe
10	avm-res-web-site	📄	Web/Function App App Service, Web Site, Logic App, Function App	donovm4 Donovan McCoy
11	avm-res-web-staticsite	📄	Static Web App	donovm4 Donovan McCoy

Modules published in January 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-authorization-roleassignment	📄	Role Assignment	jaredfholgate Jared Holgate
02	avm-res-network-azurefirewall	📄	Azure Firewall Azure FW	vmisson Vincent Misson
03	avm-res-network-firewallpolicy	📄	Azure Firewall Policy	MinHeinA Min Hein Aung
04	avm-res-network-networkmanager	📄	Azure Virtual Network Manager	MrRoundRobin Robin Muller
05	avm-res-operationalinsights-workspace	📄	Log Analytics workspace	iarik0440 Yarik Simineans

Modules published in December 2023

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-desktopvirtualization-applicationgroup	📄	Azure Virtual Desktop (AVD) Application Group	jensheerin Jen Sheerin sihbher Gerardo Reyes
02	avm-res-desktopvirtualization-scalingplan	📄	Azure Virtual Desktop (AVD) Scaling Plan	jensheerin Jen Sheerin sihbher Gerardo Reyes
03	avm-res-desktopvirtualization-workspace	📄	Azure Virtual Desktop (AVD) Workspace	jensheerin Jen Sheerin sihbher Gerardo Reyes
04	avm-res-network-natgateway	📄	NAT Gateway	iarik0440 Yarik Simineans

Modules published in November 2023

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-res-compute-virtualmachine	📄	Virtual Machine VM	jchancellor-ms Jon Chancellor
02	avm-res-network-ddosprotectionplan	📄	DDoS Protection	sitarant Simona Tarantola jtracey93 Jack Tracey
03	avm-res-network-loadbalancer	📄	Loadbalancer	donovm4 Donovan McCoy

Modules published in October 2023

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-desktopvirtualization-hostpool	📄	Azure Virtual Desktop (AVD) Host Pool		jensheerin Jen Sheerin sihbher Gerardo Reyes
02	avm-res-network-virtualnetwork	📄	Virtual Network VNET		jaredfholgate Jared Holgate

Modules published in September 2023

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-res-keyvault-vault	📄	Key Vault KV		matt-FFFFFF Matt White

Terraform Pattern Modules

Module catalog

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Terraform	Pattern	26	30	56

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Info

This page contains various views of the module index (catalog) for Terraform Pattern Modules. To see these views, click on the expandable sections with the “➕” sign below.

To see the full, unfiltered, unformatted module index on GitHub, click here.
To download the source CSV file, click here.

Note

Published modules - 🟢 & 🟡

➕ Published Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-ptn-aca-lza-hosting-environment ▶ naming spoke supporting_services linux_vm container_apps_environment windows_vm sample_application application_gateway front_door	📄	Azure Container Apps Landing Zone Accelerator	sam-cogan Sam Cogan
02	avm-ptn-aiml-ai-foundry ▶ ai-foundry-project	📄	AI-ML - AI Foundry	segraef Sebastian Graef mbilalamjad Bilal Amjad
03	avm-ptn-aiml-landing-zone ▶ example_hub_vnet	📄	AI-ML - Landing Zone (LZ)	jchancellor-ms Jon Chancellor mbilalamjad Bilal Amjad
04	avm-ptn-aks-dev	📄	AKS dev	ms-henglu Heng Lu
05	avm-ptn-aks-economy	📄	AKS economy	ms-henglu Heng Lu
06	avm-ptn-aks-enterprise	📄	AKS Enterprise	ms-henglu Heng Lu
07	avm-ptn-aks-production	📄	Azure Kubernetes Service	chanakanissanka Chanaka Nissanka
08	avm-ptn-alz	📄	Azure Landing Zone Management Groups and Policy ALZ Management Groups and Policy	matt-FFFFFF Matt White
09	avm-ptn-alz-connectivity-hub-and-spoke-vnet ▶ hub-virtual-network-mesh virtual-network-gateway	📄	ALZ Connectivity Hub and Spoke Azure Landing Zones - Hub and Spoke	jaredfholgate Jared Holgate
10	avm-ptn-alz-connectivity-virtual-wan ▶ virtual-wan site-to-site-gateway-connection virtual-hub site-to-site-gateway expressroute-gateway expressroute-gateway-connection firewall virtual-network-connection site-to-site-vpn-site	📄	ALZ Connectivity vWAN Azure Landing Zones - vWAN	jaredfholgate Jared Holgate
11	avm-ptn-alz-management	📄	ALZ Management Azure Landing Zones - Management	matt-FFFFFF Matt White
12	avm-ptn-alz-sub-vending ▶ network-security-group resource-group role-assignment subscription user-assigned-managed-identity budget resource-provider route-table virtual-network	📄	ALZ Subscription vending Azure Landing Zones - Sub vending	matt-FFFFFF Matt White jaredfholgate Jared Holgate
13	avm-ptn-avd-lza-insights	📄	AVD Insights Azure Virtual Desktop Insights	jensheerin Jen Sheerin sihbher Gerardo Reyes
14	avm-ptn-avd-lza-managementplane	📄	AVD Management Plane Azure Virtual Desktop Management Plane	jensheerin Jen Sheerin sihbher Gerardo Reyes
15	avm-ptn-azuremonitorwindowsagent	📄	Azure Monitor Windows Agent	chirag1603 Chirag Choudha
16	avm-ptn-cicd-agents-and-runners ▶ container-app-job container-instance container-registry	📄	CI CD Agents and Runners	jaredfholgate Jared Holgate
17	avm-ptn-commercial-marketplace	📄	Commercial Marketplace SaaS Accelerator	ethanjenkins1 Ethan Jenkins
18	avm-ptn-ephemeral-credential	📄	Ephemeral Credentials Generator	lonegunmanb Zijie He
19	avm-ptn-function-app-storage-private-endpoints	📄	Function App and private endpoint-secured Storage	donovm4 Donovan McCoy
20	avm-ptn-hci-ad-provisioner	📄	Arc for AD registration	chirag1603 Chirag Choudha
21	avm-ptn-hci-server-provisioner	📄	Arc for Server registration	chirag1603 Chirag Choudha
22	avm-ptn-monitoring-amba-alz	📄	AMBA ALZ Pattern Azure Monitor Baseline Alerts - Azure Landing Zones Pattern	arjenhuitema Arjen Huitema Brunoga-MS Bruno Gabrielli
23	avm-ptn-network-private-link-private-dns-zones	📄	Private Link Private DNS Zones	jtracey93 Jack Tracey
24	avm-ptn-network-routeserver	📄	Azure Route Server	jchancellor-ms Jon Chancellor
25	avm-ptn-odaa ▶ vnet_peerings	📄	Oracle Exedata Workload	terrymandin Terry Mandin
26	avm-ptn-policyassignment	📄	Policy assignment	bjornhofer Bjorn Hofer

Proposed modules - ⚪

➕ Proposed Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-ptn-ai-platform-baseline	n/a	AI platform baseline	Nepomuceno Gabriel Monteiro Nepomuceno
02	avm-ptn-aiml-ai-gateway	n/a	AI-ML - Gateway	mbilalamjad Bilal Amjad
03	avm-ptn-alz-application-landing-zone-cicd-bootstrap-azure-devops	n/a	ALZ Application Landing Zone - CICD Bootstrap for Azure DevOps	jaredfholgate Jared Holgate
04	avm-ptn-alz-application-landing-zone-cicd-bootstrap-github	n/a	ALZ Application Landing Zone - CICD Bootstrap for GitHub	jaredfholgate Jared Holgate
05	avm-ptn-alz-application-landing-zone-identity-and-access	n/a	ALZ Identity and Access Management	jaredfholgate Jared Holgate matt-FFFFFF Matt White
06	avm-ptn-alz-identity	n/a	ALZ Identity Azure Landing Zones - Identity
07	avm-ptn-alz-policy-exemptions	n/a	ALZ Policy Exemptions	jaredfholgate Jared Holgate matt-FFFFFF Matt White
08	avm-ptn-app-iaas-vm-cosmosdb-tier-four	n/a	Workload - IaaS VM Cosmos DB - Tier 4	mikestiers Mike Stiers andbron Andrew Lambert
09	avm-ptn-app-service-landing-zone	n/a	App Service Landing Zone	jaredfholgate Jared Holgate
10	avm-ptn-avd-lza-sessionhosts	n/a	AVD Session Hosts Azure Virtual Desktop Session Hosts
11	avm-ptn-azure-aws-s2s-vpn	n/a	Azure-AWS S2S VPN	ShironB Shiron Babi
12	avm-ptn-azure-ipam	n/a	IPAM IP Address Management
13	avm-ptn-azureimagebuilder	n/a	Azure Image Builder	ethanjenkins1 Ethan Jenkins
14	avm-ptn-bcdr-vm-replication	n/a	Azure Site Recovery VM Replication	ns-github-design Nasreen Sarah
15	avm-ptn-botservice-teamsapp	n/a	Bot Service Teams App
16	avm-ptn-cicd-bootstrap	n/a	CI CD bootstrap
17	avm-ptn-cloudshell-vnet	n/a	Azure Cloud Shell in a Virtual Network	travishankins Travis Hankins
18	avm-ptn-confidential-compute	n/a	Azure Confidential Compute	abhilashasr21 Abhilasha Srivastava
19	avm-ptn-dev-center-dev-box	n/a	Microsoft Dev Center Dev Box	autocloudarc Preston Parsard
20	avm-ptn-lbvmss	n/a	Virtual Machine Scale Set	terrymandin Terry Mandin
21	avm-ptn-mongodb-atlas-lza	n/a	MongoDB Atlas on Azure - Landing Zone (LZ)	cloud-architect-dev Deven Wagle
22	avm-ptn-odaa-identity	n/a	Oracle Identity	terrymandin Terry Mandin kohei3110 Kohei Saito
23	avm-ptn-openai-cognitivesearch	n/a	Corporate Line of Business (LoB) ChatBot	mikestiers Mike Stiers
24	avm-ptn-openai-e2e-baseline	n/a	Baseline OpenAI end-to-end chat
25	avm-ptn-oracle-iaas	n/a	Oracle Database on Azure	sihbher Gerardo Reyes
26	avm-ptn-pipeline-agent-container-job	n/a	Pipeline Agent with Azure Container Apps jobs	mathewsg Mathews George
27	avm-ptn-purestorage-cbs-array	n/a	Pure Storage Cloud Block Store on Azure	sundarb19 Sundar Balaji Anantharamakrishnan
28	avm-ptn-sentinel-solutions	n/a	Sentinel Solutions	LaurentLesle Laurent Lesle
29	avm-ptn-subnets-nsgs-routes	n/a	Network Security Groups NSG	vamsi-boya Vamsi Boya
30	avm-ptn-subscription-service-health-alerts	n/a	Subscriptions Service Health Alerts	ASHR4 Rhys Ash

Deprecated modules - 🔴

➕ Deprecated Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name
01	avm-ptn-hubnetworking	📄	Hub Networking
02	avm-ptn-virtualwan ▶ expressroute-gateway-conn firewall vnet-conn site-to-site-vpn-site site-to-site-gateway-conn virtualhub site-to-site-gateway expressroute-gateway	📄	Virtual WAN vWAN
03	avm-ptn-vnetgateway	📄	Virtual Network Gateway VNET GW

All modules - 📇

➕ All Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-ptn-aca-lza-hosting-environment ▶ naming spoke supporting_services linux_vm container_apps_environment windows_vm sample_application application_gateway front_door	📄	Azure Container Apps Landing Zone Accelerator	sam-cogan Sam Cogan
02	avm-ptn-ai-platform-baseline	n/a	AI platform baseline	Nepomuceno Gabriel Monteiro Nepomuceno
03	avm-ptn-aiml-ai-foundry ▶ ai-foundry-project	📄	AI-ML - AI Foundry	segraef Sebastian Graef mbilalamjad Bilal Amjad
04	avm-ptn-aiml-ai-gateway	n/a	AI-ML - Gateway	mbilalamjad Bilal Amjad
05	avm-ptn-aiml-landing-zone ▶ example_hub_vnet	📄	AI-ML - Landing Zone (LZ)	jchancellor-ms Jon Chancellor mbilalamjad Bilal Amjad
06	avm-ptn-aks-dev	📄	AKS dev	ms-henglu Heng Lu
07	avm-ptn-aks-economy	📄	AKS economy	ms-henglu Heng Lu
08	avm-ptn-aks-enterprise	📄	AKS Enterprise	ms-henglu Heng Lu
09	avm-ptn-aks-production	📄	Azure Kubernetes Service	chanakanissanka Chanaka Nissanka
10	avm-ptn-alz	📄	Azure Landing Zone Management Groups and Policy ALZ Management Groups and Policy	matt-FFFFFF Matt White
11	avm-ptn-alz-application-landing-zone-cicd-bootstrap-azure-devops	n/a	ALZ Application Landing Zone - CICD Bootstrap for Azure DevOps	jaredfholgate Jared Holgate
12	avm-ptn-alz-application-landing-zone-cicd-bootstrap-github	n/a	ALZ Application Landing Zone - CICD Bootstrap for GitHub	jaredfholgate Jared Holgate
13	avm-ptn-alz-application-landing-zone-identity-and-access	n/a	ALZ Identity and Access Management	jaredfholgate Jared Holgate matt-FFFFFF Matt White
14	avm-ptn-alz-connectivity-hub-and-spoke-vnet ▶ hub-virtual-network-mesh virtual-network-gateway	📄	ALZ Connectivity Hub and Spoke Azure Landing Zones - Hub and Spoke	jaredfholgate Jared Holgate
15	avm-ptn-alz-connectivity-virtual-wan ▶ virtual-wan site-to-site-gateway-connection virtual-hub site-to-site-gateway expressroute-gateway expressroute-gateway-connection firewall virtual-network-connection site-to-site-vpn-site	📄	ALZ Connectivity vWAN Azure Landing Zones - vWAN	jaredfholgate Jared Holgate
16	avm-ptn-alz-identity	n/a	ALZ Identity Azure Landing Zones - Identity
17	avm-ptn-alz-management	📄	ALZ Management Azure Landing Zones - Management	matt-FFFFFF Matt White
18	avm-ptn-alz-policy-exemptions	n/a	ALZ Policy Exemptions	jaredfholgate Jared Holgate matt-FFFFFF Matt White
19	avm-ptn-alz-sub-vending ▶ network-security-group resource-group role-assignment subscription user-assigned-managed-identity budget resource-provider route-table virtual-network	📄	ALZ Subscription vending Azure Landing Zones - Sub vending	matt-FFFFFF Matt White jaredfholgate Jared Holgate
20	avm-ptn-app-iaas-vm-cosmosdb-tier-four	n/a	Workload - IaaS VM Cosmos DB - Tier 4	mikestiers Mike Stiers andbron Andrew Lambert
21	avm-ptn-app-service-landing-zone	n/a	App Service Landing Zone	jaredfholgate Jared Holgate
22	avm-ptn-avd-lza-insights	📄	AVD Insights Azure Virtual Desktop Insights	jensheerin Jen Sheerin sihbher Gerardo Reyes
23	avm-ptn-avd-lza-managementplane	📄	AVD Management Plane Azure Virtual Desktop Management Plane	jensheerin Jen Sheerin sihbher Gerardo Reyes
24	avm-ptn-avd-lza-sessionhosts	n/a	AVD Session Hosts Azure Virtual Desktop Session Hosts
25	avm-ptn-azure-aws-s2s-vpn	n/a	Azure-AWS S2S VPN	ShironB Shiron Babi
26	avm-ptn-azure-ipam	n/a	IPAM IP Address Management
27	avm-ptn-azureimagebuilder	n/a	Azure Image Builder	ethanjenkins1 Ethan Jenkins
28	avm-ptn-azuremonitorwindowsagent	📄	Azure Monitor Windows Agent	chirag1603 Chirag Choudha
29	avm-ptn-bcdr-vm-replication	n/a	Azure Site Recovery VM Replication	ns-github-design Nasreen Sarah
30	avm-ptn-botservice-teamsapp	n/a	Bot Service Teams App
31	avm-ptn-cicd-agents-and-runners ▶ container-app-job container-instance container-registry	📄	CI CD Agents and Runners	jaredfholgate Jared Holgate
32	avm-ptn-cicd-bootstrap	n/a	CI CD bootstrap
33	avm-ptn-cloudshell-vnet	n/a	Azure Cloud Shell in a Virtual Network	travishankins Travis Hankins
34	avm-ptn-commercial-marketplace	📄	Commercial Marketplace SaaS Accelerator	ethanjenkins1 Ethan Jenkins
35	avm-ptn-confidential-compute	n/a	Azure Confidential Compute	abhilashasr21 Abhilasha Srivastava
36	avm-ptn-dev-center-dev-box	n/a	Microsoft Dev Center Dev Box	autocloudarc Preston Parsard
37	avm-ptn-ephemeral-credential	📄	Ephemeral Credentials Generator	lonegunmanb Zijie He
38	avm-ptn-function-app-storage-private-endpoints	📄	Function App and private endpoint-secured Storage	donovm4 Donovan McCoy
39	avm-ptn-hci-ad-provisioner	📄	Arc for AD registration	chirag1603 Chirag Choudha
40	avm-ptn-hci-server-provisioner	📄	Arc for Server registration	chirag1603 Chirag Choudha
41	avm-ptn-hubnetworking	📄	Hub Networking
42	avm-ptn-lbvmss	n/a	Virtual Machine Scale Set	terrymandin Terry Mandin
43	avm-ptn-mongodb-atlas-lza	n/a	MongoDB Atlas on Azure - Landing Zone (LZ)	cloud-architect-dev Deven Wagle
44	avm-ptn-monitoring-amba-alz	📄	AMBA ALZ Pattern Azure Monitor Baseline Alerts - Azure Landing Zones Pattern	arjenhuitema Arjen Huitema Brunoga-MS Bruno Gabrielli
45	avm-ptn-network-private-link-private-dns-zones	📄	Private Link Private DNS Zones	jtracey93 Jack Tracey
46	avm-ptn-network-routeserver	📄	Azure Route Server	jchancellor-ms Jon Chancellor
47	avm-ptn-odaa ▶ vnet_peerings	📄	Oracle Exedata Workload	terrymandin Terry Mandin
48	avm-ptn-odaa-identity	n/a	Oracle Identity	terrymandin Terry Mandin kohei3110 Kohei Saito
49	avm-ptn-openai-cognitivesearch	n/a	Corporate Line of Business (LoB) ChatBot	mikestiers Mike Stiers
50	avm-ptn-openai-e2e-baseline	n/a	Baseline OpenAI end-to-end chat
51	avm-ptn-oracle-iaas	n/a	Oracle Database on Azure	sihbher Gerardo Reyes
52	avm-ptn-pipeline-agent-container-job	n/a	Pipeline Agent with Azure Container Apps jobs	mathewsg Mathews George
53	avm-ptn-policyassignment	📄	Policy assignment	bjornhofer Bjorn Hofer
54	avm-ptn-purestorage-cbs-array	n/a	Pure Storage Cloud Block Store on Azure	sundarb19 Sundar Balaji Anantharamakrishnan
55	avm-ptn-sentinel-solutions	n/a	Sentinel Solutions	LaurentLesle Laurent Lesle
56	avm-ptn-subnets-nsgs-routes	n/a	Network Security Groups NSG	vamsi-boya Vamsi Boya
57	avm-ptn-subscription-service-health-alerts	n/a	Subscriptions Service Health Alerts	ASHR4 Rhys Ash
58	avm-ptn-virtualwan ▶ expressroute-gateway-conn firewall vnet-conn site-to-site-vpn-site site-to-site-gateway-conn virtualhub site-to-site-gateway expressroute-gateway	📄	Virtual WAN vWAN
59	avm-ptn-vnetgateway	📄	Virtual Network Gateway VNET GW

Module Publication History - 📅

➕ Module Publication History - Module names, status and owners

Modules published in April 2026

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-commercial-marketplace	📄	Commercial Marketplace SaaS Accelerator		ethanjenkins1 Ethan Jenkins

Modules published in February 2026

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-aca-lza-hosting-environment	📄	Azure Container Apps Landing Zone Accelerator		sam-cogan Sam Cogan

Modules published in January 2026

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-alz-sub-vending	📄	ALZ Subscription vending Azure Landing Zones - Sub vending		matt-FFFFFF Matt White jaredfholgate Jared Holgate

Modules published in November 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-ephemeral-credential	📄	Ephemeral Credentials Generator		lonegunmanb Zijie He

Modules published in September 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-aiml-landing-zone	📄	AI-ML - Landing Zone (LZ)		jchancellor-ms Jon Chancellor mbilalamjad Bilal Amjad

Modules published in July 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-aiml-ai-foundry	📄	AI-ML - AI Foundry		segraef Sebastian Graef mbilalamjad Bilal Amjad

Modules published in April 2025

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-ptn-alz-connectivity-virtual-wan	📄	ALZ Connectivity vWAN Azure Landing Zones - vWAN	jaredfholgate Jared Holgate
02	avm-ptn-function-app-storage-private-endpoints	📄	Function App and private endpoint-secured Storage	donovm4 Donovan McCoy
03	avm-ptn-monitoring-amba-alz	📄	AMBA ALZ Pattern Azure Monitor Baseline Alerts - Azure Landing Zones Pattern	arjenhuitema Arjen Huitema Brunoga-MS Bruno Gabrielli

Modules published in March 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-alz-connectivity-hub-and-spoke-vnet	📄	ALZ Connectivity Hub and Spoke Azure Landing Zones - Hub and Spoke		jaredfholgate Jared Holgate

Modules published in November 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-aks-economy	📄	AKS economy		ms-henglu Heng Lu
02	avm-ptn-aks-enterprise	📄	AKS Enterprise		ms-henglu Heng Lu

Modules published in October 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-ptn-aks-dev	📄	AKS dev	ms-henglu Heng Lu
02	avm-ptn-odaa	📄	Oracle Exedata Workload	terrymandin Terry Mandin
03	avm-ptn-policyassignment	📄	Policy assignment	bjornhofer Bjorn Hofer

Modules published in September 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-hubnetworking	n/a	Hub Networking

Modules published in August 2024

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-ptn-azuremonitorwindowsagent	📄	Azure Monitor Windows Agent	chirag1603 Chirag Choudha
02	avm-ptn-cicd-agents-and-runners	📄	CI CD Agents and Runners	jaredfholgate Jared Holgate
03	avm-ptn-hci-ad-provisioner	📄	Arc for AD registration	chirag1603 Chirag Choudha
04	avm-ptn-hci-server-provisioner	📄	Arc for Server registration	chirag1603 Chirag Choudha

Modules published in June 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-network-private-link-private-dns-zones	📄	Private Link Private DNS Zones		jtracey93 Jack Tracey
02	avm-ptn-network-routeserver	📄	Azure Route Server		jchancellor-ms Jon Chancellor

Modules published in May 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-avd-lza-insights	📄	AVD Insights Azure Virtual Desktop Insights		jensheerin Jen Sheerin sihbher Gerardo Reyes
02	avm-ptn-avd-lza-managementplane	📄	AVD Management Plane Azure Virtual Desktop Management Plane		jensheerin Jen Sheerin sihbher Gerardo Reyes

Modules published in April 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-aks-production	📄	Azure Kubernetes Service		chanakanissanka Chanaka Nissanka

Modules published in December 2023

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-alz-management	📄	ALZ Management Azure Landing Zones - Management		matt-FFFFFF Matt White

Modules published in November 2023

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-alz	📄	Azure Landing Zone Management Groups and Policy ALZ Management Groups and Policy		matt-FFFFFF Matt White
02	avm-ptn-vnetgateway	n/a	Virtual Network Gateway VNET GW

Modules published in October 2023

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-ptn-virtualwan	n/a	Virtual WAN vWAN

Terraform Utility Modules

Module catalog

Language	Classification	Published 🟢 & 🟡	Proposed ⚪	SUM
Terraform	Utility	11	3	14

➕ Additional information

Legend

Summary of status icons used on this page

Icon	Status	Description
⚪	Proposed modules	Modules that are proposed and/or being worked on but not published yet.
🟢 & 🟡	Published modules	Available (🟢) and Orphaned (🟡) modules that are active and usable.
🔴	Deprecated modules	Modules that reached the end of their lifecycle.
📇	All modules	Including Published, Proposed and Deprecated ones.

See the Module Lifecycle page for more details.

Info

This page contains various views of the module index (catalog) for Terraform Utility Modules. To see these views, click on the expandable sections with the “➕” sign below.

To see the full, unfiltered, unformatted module index on GitHub, click here.
To download the source CSV file, click here.

Note

Published modules - 🟢 & 🟡

➕ Published Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-utl-compute-linuxvirtualmachine-azapi-replicator	📄	Linux VM AzRM to AzAPI Replicator	lonegunmanb Zijie He
02	avm-utl-compute-orchestratedvirtualmachinescaleset-azapi-replicator ▶ sku_selector	📄	VMSS AzRM to AzAPI Replicator	lonegunmanb Zijie He
03	avm-utl-compute-windowsvirtualmachine-azapi-replicator	📄	Windows VM AzRM to AzAPI Replicator	lonegunmanb Zijie He
04	avm-utl-interfaces	📄	AVM Interfaces	matt-FFFFFF Matt White
05	avm-utl-network-ip-addresses	📄	AVM Network IP Addresses IPv4 CIDR	jaredfholgate Jared Holgate
06	avm-utl-network-virtualnetwork-azapi-replicator	📄	Virtual Network AzRM to AzAPI Replicator	lonegunmanb Zijie He
07	avm-utl-privatedns-privatednszone-azapi-replicator	📄	Private DNS Zone AzRM to AzAPI Replicator	lonegunmanb Zijie He
08	avm-utl-regions ▶ cached-data	📄	Azure Regions Data	matt-FFFFFF Matt White
09	avm-utl-resources-resourcegroup-azapi-replicator	📄	Resource Group AzRM to AzAPI Replicator	lonegunmanb Zijie He
10	avm-utl-roledefinitions ▶ cached-data	📄	Azure Role Definitions	matt-FFFFFF Matt White
11	avm-utl-sku-finder	📄	AVM SKU Finder Sku	jchancellor-ms Jon Chancellor

Proposed modules - ⚪

➕ Proposed Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-utl-containerregistry-containerregistry-azapi-replicator	n/a	Container Registry AzRM to AzAPI Replicator	lonegunmanb Zijie He
02	avm-utl-naming	n/a	Module Naming	Nepomuceno Gabriel Monteiro Nepomuceno matt-FFFFFF Matt White
03	avm-utl-network-subnet-azapi-replicator	n/a	Subnet AzRM to AzAPI Replicator	lonegunmanb Zijie He

Deprecated modules - 🔴

➕ Deprecated Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Status & Versions	Primary Owner
01	❌ None listed	❌ None listed	❌ None listed	❌ None listed	❌ None listed

All modules - 📇

➕ All Modules - Module names, status and owners

No.	Module Name	Source Code	Display Name	Primary Owner
01	avm-utl-compute-linuxvirtualmachine-azapi-replicator	📄	Linux VM AzRM to AzAPI Replicator	lonegunmanb Zijie He
02	avm-utl-compute-orchestratedvirtualmachinescaleset-azapi-replicator ▶ sku_selector	📄	VMSS AzRM to AzAPI Replicator	lonegunmanb Zijie He
03	avm-utl-compute-windowsvirtualmachine-azapi-replicator	📄	Windows VM AzRM to AzAPI Replicator	lonegunmanb Zijie He
04	avm-utl-containerregistry-containerregistry-azapi-replicator	n/a	Container Registry AzRM to AzAPI Replicator	lonegunmanb Zijie He
05	avm-utl-interfaces	📄	AVM Interfaces	matt-FFFFFF Matt White
06	avm-utl-naming	n/a	Module Naming	Nepomuceno Gabriel Monteiro Nepomuceno matt-FFFFFF Matt White
07	avm-utl-network-ip-addresses	📄	AVM Network IP Addresses IPv4 CIDR	jaredfholgate Jared Holgate
08	avm-utl-network-subnet-azapi-replicator	n/a	Subnet AzRM to AzAPI Replicator	lonegunmanb Zijie He
09	avm-utl-network-virtualnetwork-azapi-replicator	📄	Virtual Network AzRM to AzAPI Replicator	lonegunmanb Zijie He
10	avm-utl-privatedns-privatednszone-azapi-replicator	📄	Private DNS Zone AzRM to AzAPI Replicator	lonegunmanb Zijie He
11	avm-utl-regions ▶ cached-data	📄	Azure Regions Data	matt-FFFFFF Matt White
12	avm-utl-resources-resourcegroup-azapi-replicator	📄	Resource Group AzRM to AzAPI Replicator	lonegunmanb Zijie He
13	avm-utl-roledefinitions ▶ cached-data	📄	Azure Role Definitions	matt-FFFFFF Matt White
14	avm-utl-sku-finder	📄	AVM SKU Finder Sku	jchancellor-ms Jon Chancellor

Module Publication History - 📅

➕ Module Publication History - Module names, status and owners

Modules published in January 2026

No.	Module Name	Source Code	Display Name	Owner(s)
01	avm-utl-compute-linuxvirtualmachine-azapi-replicator	📄	Linux VM AzRM to AzAPI Replicator	lonegunmanb Zijie He
02	avm-utl-compute-orchestratedvirtualmachinescaleset-azapi-replicator	📄	VMSS AzRM to AzAPI Replicator	lonegunmanb Zijie He
03	avm-utl-compute-windowsvirtualmachine-azapi-replicator	📄	Windows VM AzRM to AzAPI Replicator	lonegunmanb Zijie He
04	avm-utl-network-virtualnetwork-azapi-replicator	📄	Virtual Network AzRM to AzAPI Replicator	lonegunmanb Zijie He
05	avm-utl-privatedns-privatednszone-azapi-replicator	📄	Private DNS Zone AzRM to AzAPI Replicator	lonegunmanb Zijie He
06	avm-utl-resources-resourcegroup-azapi-replicator	📄	Resource Group AzRM to AzAPI Replicator	lonegunmanb Zijie He

Modules published in September 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-utl-roledefinitions	📄	Azure Role Definitions		matt-FFFFFF Matt White

Modules published in March 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-utl-network-ip-addresses	📄	AVM Network IP Addresses IPv4 CIDR		jaredfholgate Jared Holgate

Modules published in January 2025

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-utl-interfaces	📄	AVM Interfaces		matt-FFFFFF Matt White

Modules published in December 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-utl-sku-finder	📄	AVM SKU Finder Sku		jchancellor-ms Jon Chancellor

Modules published in August 2024

No.	Module Name	Source Code	Display Name	Status & Versions	Owner(s)
01	avm-utl-regions	📄	Azure Regions Data		matt-FFFFFF Matt White

Usage Guide

Summary

This section describes usage guidance.

Concepts

Note

This page is a work in progress and will be updated as we improve & finalize the content. Please check back regularly for updates.

When developing an Azure solution using AVM modules, there are several aspects to consider. This page covers important concepts and provides guidance the technical decisions. Each concept/topic referenced here will be further detailed in the corresponding Bicep or Terraform specific guidance.

Language-agnostic concepts

Topics/concepts that are relevant and applicable for both Bicep and Terraform.

Module Sourcing

Public Registry

Leveraging the public registries (i.e., the Bicep Public Registry or the Terraform Public Registry) is the most common and recommended approach.

This allows you to leverage the latest and greatest features of the AVM modules, as well as the latest security updates. While there aren’t any prerequisites for using the public registry - no extra software component or service needs to be installed and no configuration is needed - the client machine the deployment is initiated from will need to have access to the public registry.

Private Registry (synced)

A private registry - that is hosted in your own environment - can store modules originating from the public registry. Using a private registry still grants you the latest version of AVM modules while allowing you to review each version of each module before admitting them to your private registry. You also have control over who can access your own private registry. Note that using a private registry means that you’re still using each module as is, without making any changes.

Inner-sourcing

Inner-sourcing AVM means maintaining your own, synchronized copy of AVM modules in your own internal private registry, repositories or other storage option. Customers normally look to inner-source AVM modules when they have strict security and compliance requirements, or when they want to publish their own lightly wrapped versions of the modules to meet their specific needs; for example changing some allowed or default values for parameter or variable inputs.

This is a more complex approach and requires more effort to maintain, but it can be beneficial in certain scenarios, however, it should not be the default approach as it can lead to a lot of overhead and maintenance and requires significant skills and resources to set up and maintain.

There are many ways to approach inner-sourcing AVM modules for both Bicep and Terraform. The AVM team will be publishing guidance on this topic, based on customer experience and learnings.

Tip

You can see the AVM team talking about inner-sourcing on the AVM February 2025 community call on YouTube.

Solution Development

This section provides advanced guidance for developing solutions using Azure Verified Modules (AVM). It covers technical decisions and concepts that are important for building and deploying Azure solutions using AVM modules.

Planning your solution

When implementing infrastructure in Azure leveraging IaaS and PaaS services, there are multiple options for Azure deployments. In this article we assume that a decision has been made to implement your solution, using Infrastructure-as-Code (IaC). This is best suited to allow programmatic declarative control of the target infrastructure and is ideal for projects that require repeatability and idempotency.

Choosing an Infrastructure-as-Code language

There are multiple language choices when implementing your solution using IaC in Azure. The Azure Verified Modules project currently supports Bicep and Terraform. The following guidance summarizes considerations that can help choose the option that best suits your requirements.

Reasons to choose Bicep

Bicep is the Microsoft 1st party offering for IaC deployments. It supports Generally Available (GA) and preview features for all Azure resources and allows for modular composition of resources and solution templates. The use of simplified syntax makes IaC development intuitive and the use of the Bicep extension for VSCode provides IntelliSense and syntax validation to assist with coding. Finally, Bicep is well suited for infrastructure projects and teams that don’t require management of other cloud platforms or services outside of Azure. For a more detailed read on reasons to choose Bicep, read this article from the Bicep documentation.

Reasons to choose Terraform

HashiCorp’s Terraform is an extensible 3rd party platform that can be used across multiple cloud and on-premises platforms using multiple provider plugins. It has widespread adoption due to its simplified human-readable configuration files, common functionality, and the ability to allow a project to span multiple provider spaces.

In Azure, support is provided through two primary providers called AzureRM and AzAPI respectively. The default provider for many Azure use cases is AzureRM which is co-developed between Microsoft and HashiCorp. It includes support for generally available (GA) features, while support for new and preview features might be slightly delayed following their initial release. AzAPI is developed exclusively by Microsoft and supports all preview and GA features while being more complex to use due to the more direct interaction with Azure’s APIs. While it is possible to use both providers in a single project as needed, the best practice is to standardize on a single provider as much as is reasonable.

Projects typically choose Terraform when they bridge multiple cloud infrastructure platforms or when the development team has previous experience coding in Terraform. Modern Integrated Development Environments (IDE) - such as Visual Studio Code - include extension support for Terraform features as well as additional Azure specific extensions. These extensions enable syntax validation and highlighting as well as code formatting and HashiCorp Cloud Platform (HCP) integration for HashiCorp Cloud customers. For a more detailed read on reasons to choose Terraform, read this article from the Terraform on Azure documentation.

Architecture design

Before starting the process of codifying infrastructure, it is important to develop a detailed architecture of what will be created. This should include details for:

Organizational elements such as management groups, subscriptions, and resource groups as well as any tagging and Role Based Access (RBAC) configurations for each.
Infrastructure services that will be created along with key configuration details like sku values, network CIDR range sizes, or other solution specific configuration.
Any relationship between services that will be codified as part of the deployment.
Identify inputs to your solution for designs that are intended to be used as templates.

Note

For a production grade solution, you need to

follow the recommendations of the Cloud Adoption Framework (CAF) and have your platform and application landing zones defined, as per Azure Landing Zones (ALZ);
follow the recommendations of the Azure Well-Architected Framework (WAF) to ensure that your solution is compliant with and integrates into your organization’s policies and standards. This includes considerations for security, identity, networking, monitoring, cost management, and governance.

Sourcing content for deployment

Once the architecture is agreed upon, it is time to plan the development of your IaC code. There are several key decision points that should be considered during this phase.

Content creation methods

The two primary methods used to create your solutions module are:

Using base resources (“vanilla resources”) from scratch or
Leveraging pre-created modules from the AVM library to minimize the time to value during development.

The trade-off between the two options is primarily around control vs. speed. AVM works to provide the best of both options by providing modules with opinionated and recommended practice defaults while allowing for more detailed configuration as needed. In our sample exercise we’ll be using AVM modules to demonstrate building the example solution.

AVM module type considerations

When using AVM modules for your solution, there is an additional choice that should be considered. The AVM library includes both pattern and resource module types. If your architecture includes or follows a well-known pattern then a pattern module may be the right option for you. If you determine this is the case, then search the module index for pattern modules in your chosen language to see if an option exists for your scenario. Otherwise, using resource modules from the library will be your best option.

In cases where an AVM resource or pattern module isn’t available for use, review the Bicep or Terraform provider documentation to identify how to augment AVM modules with standalone resources. If you feel that additional resource or pattern modules would be useful, you can also request the creation of a pattern or resource module by creating a module proposal issue on the AVM github repository.

Module source considerations

Once the decision has been made to use AVM modules to help accelerate solution development, a decision about where those modules will be sourced from is the next key decision point. A detailed exploration of the different sourcing options can be found in the Module Sourcing section of the Concepts page. Take a moment to review the options discussed there.

For our solution we will leverage the Public Registry option by sourcing AVM modules directly from the respective Terraform and Bicep public registries. This will avoid the need to fork copies of the modules for private use.

Bicep - Solution Development

Introduction

Azure Verified Modules (AVM) for Bicep are a powerful tool that leverage the Bicep domain-specific language (DSL), industry knowledge, and an Open Source community, which altogether enable developers to quickly deploy Azure resources that follow Microsoft’s recommended practices for Azure.
In this article, we will walk through the Bicep specific considerations and recommended practices on developing your solution leveraging Azure Verified Modules. We’ll review some of the design features and trade-offs and include sample code to illustrate each discussion point.

In this tutorial, we will:

Deploy a basic Virtual Machine architecture into Azure
Explore recommended practices related to Bicep template development
Demonstrate the ease with which you can deploy AVM modules
Describe each of the development and deployment steps in detail

After completing this tutorial, you’ll have a working knowledge of:

How to discover and add AVM modules to your Bicep template
How to reference and use outputs across AVM modules
Recommended practices for parameterization and structure of your Bicep file
Configuration of AVM modules to meet Microsoft’s Well Architected Framework (WAF) principles
How to deploy your Bicep template into an Azure subscription from your local machine

Let’s get started!

Prerequisites

You will need the following tools and components to complete this guide:

Visual Studio Code (VS Code) to develop your solution.
Bicep Visual Studio Code Extension to author your Bicep template and explore modules published in the Registry.
One of the following command line tools:
- PowerShell AND Azure PowerShell
- Azure CLI to deploy your solution.
Bicep CLI
Azure Subscription to deploy your Bicep templates.

Before you begin, make sure you have these tools installed in your development environment.

Solution Architecture

Before we begin coding, it is important to have details about what the infrastructure architecture will include. For our example, we will be building a solution that will host a simple application on a Linux virtual machine (VM). The solution must be secure and auditable. The VM must not be accessible from the internet and its logs should be easily accessible. All Azure services should utilize logging tools for auditing purposes.

Develop the Solution Code

Creating the main.bicep file

The architecture diagram shows all components needed for a successful solution deployment. Rather than building the complete solution at once, this tutorial takes an incremental approach building the Bicep file piece-by-piece and testing the deployment at each stage. This approach allows for discussion of each design decision along the way.

The development will start with core platform components: first the backend logging services (Log Analytics) and then the virtual network.

Let’s begin by creating our folder structure along with a main.bicep file. Your folder structure should be as follows:

VirtualMachineAVM_Example1/
└── main.bicep

After you have your folder structure and main.bicep file, we can proceed with our first AVM resources!

Log Analytics

Let’s start by adding a logging service to our main.bicep since all other deployed resources will use this service for their logs.

Tip

Always begin template development by adding resources that create dependencies for other downstream services. This approach simplifies referencing these dependencies within your other modules as you develop them. For example, starting with Logging and Virtual Network services makes sense since all other services will depend on these.

The logging solution depicted in our Architecture Diagram shows we will be using a Log Analytics workspace. Let’s add that to our template! Open your main.bicep file and add the following:

➕ Expand Code

1module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
2  name: 'logAnalyticsWorkspace'
3  params: {
4    // Required parameters
5    name: 'VM-AVM-Ex1-law'
6    // Non-required parameters
7    location: 'westus2'
8  }
9}

Note

Always click on the “Copy to clipboard” button in the top right corner of the Code sample area in order not to have the line numbers included in the copied code.

You now have a fully functional Bicep template that will deploy a working Log Analytics workspace! If you would like to try it, run the following in your console:

Note

For keeping the example below simple, we are using the traditional deployment commands, e.g., az deployment group create or New-AzResourceGroupDeployment. However, we encourage you to look into using Deployment Stacks instead by simply replacing the previous commands with az stack group create or New-AzResourceGroupDeploymentStack as well as the other required input parameters as shown here.

Deployment Stacks allow you to deploy a Bicep file as a stack, which is a collection of resources that are deployed together. This allows you to manage the lifecycle of the stack as a single unit, making it easier to deploy, update, and now even delete resources via Bicep. You can also implement RBAC Deny Assignments on your stacks deployed resources to prevent changes to the resources or specific actions on the resources to all but an excluded list of users, groups or other principals.

Deploy with

# Log in to Azure
Connect-AzAccount

# Select your subscription
Set-AzContext -SubscriptionId '<subscriptionId>'

# Deploy a resource group
New-AzResourceGroup -Name 'avm-bicep-vmexample1' -Location '<location>'

# Invoke your deployment
New-AzResourceGroupDeployment -DeploymentName 'avm-bicep-vmexample1-deployment' -ResourceGroupName 'avm-bicep-vmexample1' -TemplateFile '/<path-to>/VirtualMachineAVM_Example1/main.bicep'

# Log in to Azure
az login

# Select your subscription
az account set --subscription '<subscriptionId>'

# Deploy a resource group
az group create --name 'avm-bicep-vmexample1' --location '<location>'

# Invoke your deployment
az deployment group create --name 'avm-bicep-vmexample1-deployment' --resource-group 'avm-bicep-vmexample1' --template-file '/<path-to>/VirtualMachineAVM_Example1/main.bicep'

The above commands will log you in to your Azure subscription, select a subscription to use, create a resource group, then deploy the main.bicep template to your resource group.

AVM Makes the deployment of Azure resources incredibly easy. Many of the parameters you would normally be required to define are taken care of by the AVM module itself. In fact, the location parameter is not even needed in your template—when left blank, by default, all AVM modules will deploy to the location in which your target Resource Group exists.

Now we have a Log Analytics workspace in our resource group which doesn’t do a whole lot of good on its own. Let’s take our template a step further by adding a Virtual Network that integrates with the Log Analytics workspace.

Virtual Network

We will now add a Virtual Network to our main.bicep file. This VNet will contain subnets and Network Security Groups (NSGs) for any of the resources we deploy that require IP addresses.

In your main.bicep file, add the following:

➕ Expand Code

 1module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 2  name: 'logAnalyticsWorkspace'
 3  params: {
 4    // Required parameters
 5    name: 'VM-AVM-Ex1-law'
 6    // Non-required parameters
 7    location: 'westus2'
 8  }
 9}
10
11module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
12  name: 'virtualNetworkDeployment'
13  params: {
14    // Required parameters
15    addressPrefixes: [
16      '10.0.0.0/16'
17    ]
18    name: 'VM-AVM-Ex1-vnet'
19    // Non-required parameters
20    location: 'westus2'
21  }
22}

Again, the Virtual Network AVM module requires only two things: a name and an addressPrefixes parameter.

Configure Diagnostics Settings

There is an additional parameter available in most AVM modules named diagnosticSettings. This parameter allows you to configure your resource to send its logs to any suitable logging service. In our case, we are using a Log Analytics workspace.

Let’s update our main.bicep file to have our VNet send all of its logging data to our Log Analytics workspace:

➕ Expand Code

 1module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 2  name: 'logAnalyticsWorkspace'
 3  params: {
 4    // Required parameters
 5    name: 'VM-AVM-Ex1-law'
 6    // Non-required parameters
 7    location: 'westus2'
 8  }
 9}
10
11module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
12  name: 'virtualNetworkDeployment'
13  params: {
14    // Required parameters
15    addressPrefixes: [
16      '10.0.0.0/16'
17    ]
18    name: 'VM-AVM-Ex1-vnet'
19    // Non-required parameters
20    location: 'westus2'
21    diagnosticSettings: [
22      {
23        name: 'vNetDiagnostics'
24        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
25      }
26    ]
27  }
28}

Notice how the diagnosticsSettings parameter needs a workspaceResourceId? All you need to do is add a reference to the built-in logAnalyticsWorkspaceId output of the logAnalyticsWorkspace AVM module. That’s it! Our VNet now has integrated its logging with our Log Analytics workspace. All AVM modules come with a set of built-in outputs that can be easily referenced by other modules within your template.

Info

All AVM modules have built-in outputs which can be referenced using the <moduleName>.outputs.<outputName> syntax.

When using plain Bicep, many of these outputs require multiple lines of code or knowledge of the correct object ID references to get at the desired output. AVM modules do much of this heavy lifting for you by taking care of these complex tasks within the module itself, then exposing them to you through the module’s outputs. Find out more about Bicep Outputs.

Add a Subnet and NAT Gateway

We can’t use a Virtual Network without subnets, so let’s add a subnet next. According to our Architecture, we will have three subnets: one for the Virtual Machine, one for the Bastion host, and one for Private Endpoints. We can start with the VM subnet for now. While we’re at it, let’s also add the NAT Gateway, the NAT Gateway’s Public IP, the attach the NAT Gateway to the VM subnet.

Add the following to your main.bicep:

➕ Expand Code

 1module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 2  name: 'logAnalyticsWorkspace'
 3  params: {
 4    // Required parameters
 5    name: 'VM-AVM-Ex1-law'
 6    // Non-required parameters
 7    location: 'westus2'
 8  }
 9}
10
11module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
12  name: 'natGwPublicIpDeployment'
13  params: {
14    // Required parameters
15    name: 'VM-AVM-Ex1-natgwpip'
16    // Non-required parameters
17    location: 'westus2'
18    diagnosticSettings: [
19      {
20        name: 'natGwPublicIpDiagnostics'
21        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
22      }
23    ]
24  }
25}
26
27module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
28  name: 'natGatewayDeployment'
29  params: {
30    // Required parameters
31    name: 'VM-AVM-Ex1-natGw'
32    zone: 1
33    // Non-required parameters
34    publicIpResourceIds: [
35      natGwPublicIp.outputs.resourceId
36    ]
37  }
38}
39
40module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
41  name: 'virtualNetworkDeployment'
42  params: {
43    // Required parameters
44    addressPrefixes: [
45      '10.0.0.0/16'
46    ]
47    name: 'VM-AVM-Ex1-vnet'
48    // Non-required parameters
49    location: 'westus2'
50    diagnosticSettings: [
51      {
52        name: 'vNetDiagnostics'
53        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
54      }
55    ]
56    subnets: [
57      {
58        name: 'VMSubnet'
59        addressPrefix: cidrSubnet('10.0.0.0/16', 24, 0) // first subnet in address space
60        natGatewayResourceId: natGateway.outputs.resourceId
61      }
62    ]
63  }
64}

The modification adds a subnets property to our virtualNetwork module. The AVM network/virtual-network module supports the creation of subnets directly within the module itself. We can also link our NAT Gateway directly to the subnet within this submodule.

A nice feature within Bicep are the various functions available. We use the cidrSubnet() function to declare CIDR blocks without having to calculate them on your own.

Switch to Parameters and Variables

See how we are reusing the same CIDR block 10.0.0.0/16 in multiple locations? You may have noticed we are defining the same location in two different spots as well. We’re now at a point in the development where we should leverage one of our first recommended practices: using parameters and variables!

Tip

Use Bicep variables to define values that will be constant and reused with your template; use parameters anywhere you may need a modifiable value.

Let’s enhance the template by adding variables for the CIDR block and prefix, then use a location parameter with a default value. We’ll then reference those in the module:

➕ Expand Code

 1param location string = 'westus2'
 2
 3var addressPrefix = '10.0.0.0/16'
 4var prefix = 'VM-AVM-Ex1'
 5
 6module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 7  name: 'logAnalyticsWorkspace'
 8  params: {
 9    // Required parameters
10    name: '${prefix}-law'
11    // Non-required parameters
12    location: location
13  }
14}
15
16module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
17  name: 'natGwPublicIpDeployment'
18  params: {
19    // Required parameters
20    name: '${prefix}-natgwpip'
21    // Non-required parameters
22    location: location
23    diagnosticSettings: [
24      {
25        name: 'natGwPublicIpDiagnostics'
26        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
27      }
28    ]
29  }
30}
31
32module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
33  name: 'natGatewayDeployment'
34  params: {
35    // Required parameters
36    name: '${prefix}-natgw'
37    zone: 1
38    // Non-required parameters
39    publicIpResourceIds: [
40      natGwPublicIp.outputs.resourceId
41    ]
42  }
43}
44
45module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
46  name: 'virtualNetworkDeployment'
47  params: {
48    // Required parameters
49    addressPrefixes: [
50      addressPrefix
51    ]
52    name: '${prefix}-vnet'
53    // Non-required parameters
54    location: location
55    diagnosticSettings: [
56      {
57        name: 'vNetDiagnostics'
58        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
59      }
60    ]
61    subnets: [
62      {
63        name: 'VMSubnet'
64        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
65        natGatewayResourceId: natGateway.outputs.resourceId
66      }
67    ]
68  }
69}

We now have a good basis for the infrastructure to be utilized by the rest of the resources in our Architecture. We will come back to our networking in a future step, once we are ready to create some Network Security Groups. For now, let’s move on to other modules.

Key Vault

Key Vaults are one of the key components in most Azure architectures as they create a place where you can save and reference secrets in a secure manner (“secrets” in the general sense, as opposed to the secret object type in Key Vaults). The Key Vault AVM module makes it very simple to store secrets generated in your template. In this tutorial, we will use one of the most secure methods of storing and retrieving secrets by leveraging this Key Vault in our Bicep template.

The first step is easy: add the Key Vault AVM module to our main.bicep file. In addition, let’s also ensure it’s hooked into our Log Analytics workspace (we will do this for every new module from here on out).

➕ Expand Code

 1param location string = 'westus2'
 2
 3var addressPrefix = '10.0.0.0/16'
 4var prefix = 'VM-AVM-Ex1'
 5
 6module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 7  name: 'logAnalyticsWorkspace'
 8  params: {
 9    // Required parameters
10    name: '${prefix}-law'
11    // Non-required parameters
12    location: location
13  }
14}
15
16module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
17  name: 'natGwPublicIpDeployment'
18  params: {
19    // Required parameters
20    name: '${prefix}-natgwpip'
21    // Non-required parameters
22    location: location
23    diagnosticSettings: [
24      {
25        name: 'natGwPublicIpDiagnostics'
26        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
27      }
28    ]
29  }
30}
31
32module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
33  name: 'natGatewayDeployment'
34  params: {
35    // Required parameters
36    name: '${prefix}-natgw'
37    zone: 1
38    // Non-required parameters
39    publicIpResourceIds: [
40      natGwPublicIp.outputs.resourceId
41    ]
42  }
43}
44
45module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
46  name: 'virtualNetworkDeployment'
47  params: {
48    // Required parameters
49    addressPrefixes: [
50      addressPrefix
51    ]
52    name: '${prefix}-vnet'
53    // Non-required parameters
54    location: location
55    diagnosticSettings: [
56      {
57        name: 'vNetDiagnostics'
58        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
59      }
60    ]
61    subnets: [
62      {
63        name: 'VMSubnet'
64        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
65        natGatewayResourceId: natGateway.outputs.resourceId
66      }
67    ]
68  }
69}
70
71module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
72  name: 'keyVaultDeployment'
73  params: {
74    // Required parameters
75    name: '${uniqueString(resourceGroup().id)}-kv'
76    // Non-required parameters
77    location: location
78    diagnosticSettings: [
79      {
80        name: 'keyVaultDiagnostics'
81        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
82      }
83    ]
84  }
85}

The name of the Key Vault we will deploy uses the uniqueString() Bicep function. Key Vault names must be globally unique. We will therefore deviate from our standard naming convention thus far and make an exception for the Key Vault. Note how we are still adding a suffix to the Key Vault name, so its name remains recognizable; you can use a combination of concatenating unique strings, prefixes, or suffixes to follow your own naming standard preferences.

When we generate our unique string, we will pass in the resourceGroup().id as the seed for the uniqueString() function so that every time you deploy this main.bicep to the same resource group, it will use the same randomly generated name for your Key Vault (since resourceGroup().id will be the same).

Tip

Bicep has many built-in functions available. We used two here: uniqueString() and resourceGroup(). The resourceGroup(), subscription(), and deployment() functions are very useful when seeding uniqueString() or guid() functions. Just be cautious about name length limitations for each Azure service! Visit this page to learn more about Bicep functions.

We will use this Key Vault later on when we create a VM and need to store its password. Now that we have it, a Virtual Network, Subnet, and Log Analytics prepared, we should have everything we need to deploy a Virtual Machine!

Info

In the future, we will update this guide to show how to generate and store a certificate in the Key Vault, then use that certificate to authenticate into the Virtual Machine.

Virtual Machine

Warning

The AVM Virtual Machine module enables the EncryptionAtHost feature by default. You must enable this feature within your Azure subscription successfully deploy this example code. To do so, run the following:

Deploy with

# Wait a few minutes after running the command to allow it to propagate
Register-AzProviderFeature -FeatureName "EncryptionAtHost" -ProviderNamespace "Microsoft.Compute"

az feature register --namespace Microsoft.Compute --name EncryptionAtHost

# Propagate the change
az provider register --namespace Microsoft.Compute

For our Virtual Machine (VM) deployment, we need to add the following to our main.bicep file:

➕ Expand Code

  1param location string = 'westus2'
  2
  3// START add-password-param
  4@description('Required. A password for the VM admin user.')
  5@secure()
  6param vmAdminPass string
  7// END add-password-param
  8
  9var addressPrefix = '10.0.0.0/16'
 10var prefix = 'VM-AVM-Ex1'
 11
 12module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 13  name: 'logAnalyticsWorkspace'
 14  params: {
 15    // Required parameters
 16    name: '${prefix}-law'
 17    // Non-required parameters
 18    location: location
 19  }
 20}
 21
 22module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
 23  name: 'natGwPublicIpDeployment'
 24  params: {
 25    // Required parameters
 26    name: '${prefix}-natgwpip'
 27    // Non-required parameters
 28    location: location
 29    diagnosticSettings: [
 30      {
 31        name: 'natGwPublicIpDiagnostics'
 32        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 33      }
 34    ]
 35  }
 36}
 37
 38module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
 39  name: 'natGatewayDeployment'
 40  params: {
 41    // Required parameters
 42    name: '${prefix}-natgw'
 43    zone: 1
 44    // Non-required parameters
 45    publicIpResourceIds: [
 46      natGwPublicIp.outputs.resourceId
 47    ]
 48  }
 49}
 50
 51module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
 52  name: 'virtualNetworkDeployment'
 53  params: {
 54    // Required parameters
 55    addressPrefixes: [
 56      addressPrefix
 57    ]
 58    name: '${prefix}-vnet'
 59    // Non-required parameters
 60    location: location
 61    diagnosticSettings: [
 62      {
 63        name: 'vNetDiagnostics'
 64        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 65      }
 66    ]
 67    subnets: [
 68      {
 69        name: 'VMSubnet'
 70        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
 71        natGatewayResourceId: natGateway.outputs.resourceId
 72      }
 73    ]
 74  }
 75}
 76
 77module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
 78  name: 'keyVaultDeployment'
 79  params: {
 80    // Required parameters
 81    name: '${uniqueString(resourceGroup().id)}-kv'
 82    // Non-required parameters
 83    location: location
 84    diagnosticSettings: [
 85      {
 86        name: 'keyVaultDiagnostics'
 87        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 88      }
 89    ]
 90    // START add-keyvault-secret
 91    secrets: [
 92      {
 93        name: 'vmAdminPassword'
 94        value: vmAdminPass
 95      }
 96    ]
 97    // END add-keyvault-secret
 98  }
 99}
100
101module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.13.1' = {
102  name: 'linuxVirtualMachineDeployment'
103  params: {
104    // Required parameters
105    adminUsername: 'localAdminUser'
106    adminPassword: vmAdminPass
107    imageReference: {
108      offer: '0001-com-ubuntu-server-jammy'
109      publisher: 'Canonical'
110      sku: '22_04-lts-gen2'
111      version: 'latest'
112    }
113    name: '${prefix}-vm1'
114    // START vm-subnet-reference
115    nicConfigurations: [
116      {
117        ipConfigurations: [
118          {
119            name: 'ipconfig01'
120            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
121          }
122        ]
123        nicSuffix: '-nic-01'
124      }
125    ]
126    // END vm-subnet-reference
127    osDisk: {
128      caching: 'ReadWrite'
129      diskSizeGB: 128
130      managedDisk: {
131        storageAccountType: 'Standard_LRS'
132      }
133    }
134    osType: 'Linux'
135    vmSize: 'Standard_B2s_v2'
136    zone: 0
137    // Non-required parameters
138    location: location
139  }
140}

The VM module is one of the more complex modules in AVM—behind the scenes, it takes care of a lot of heavy lifting that, without AVM, would require multiple Bicep resources to be deployed and referenced.

For example, look at the nicConfigurations parameter: normally, you would need to deploy a separate NIC resource, which itself also requires an IP resource, then attach them to each other, and finally, attach them all to your VM.

With the AVM VM module, the nicConfigurations parameter accepts an object, allowing you to create any number of NICs to attach to your VM from within the VM resource deployment itself. It handles all the naming, creation of other necessary dependencies, and attaches them all together, so you don’t have to. The osDisk parameter is similar, though slightly less complex. There are many more parameters within the VM module that you can leverage if needed, that share a similar ease-of-use.

Since this is the real highlight of our main.bicep file, we need to take a closer look at some of the other changes that were made.

VM Admin Password Parameter
```
1@description('Required. A password for the VM admin user.')
2@secure()
3param vmAdminPass string
```
First, we added a new parameter. The value of this will be provided when the main.bicep template is deployed. We don’t want any passwords stored as text in code; for our purposes, the safest way to do this is to prompt the end user for the password at the time of deployment.
Warning
The supplied password must be between 6-72 characters long and must satisfy at least 3 of password complexity requirements from the following: Contains an uppercase character; Contains a lowercase character; Contains a numeric digit; Contains a special character. Control characters are not allowed
Also note how we are using the @secure() decorator on the password parameter. This will ensure the value of the password is never displayed in any of the deployment logs or in Azure. We have also added the @description() decorator and started the description with “Required.” It’s a good habit and recommended practice to document your parameters in Bicep. This will ensure that VS Code’s built-in Bicep linter can provide end-users insightful information when deploying your Bicep templates.
Info
Always use the @secure() decorator when creating a parameter that will hold sensitive data!
Add the VM Admin Password to Key Vault
```
1    secrets: [
2      {
3        name: 'vmAdminPassword'
4        value: vmAdminPass
5      }
6    ]
```
The next thing we have done is save the value of our vmAdminPass parameter to our Key Vault. We have done this by adding a secrets parameter to the Key Vault module. Adding secrets to Key Vaults is very simple when using the AVM module.
By adding our password to the Key Vault, it will ensure that we never lose the password and that it is stored securely. As long as a user has appropriate permissions on the vault, the password can be fetched easily.
Reference the VM Subnet
```
 1    nicConfigurations: [
 2      {
 3        ipConfigurations: [
 4          {
 5            name: 'ipconfig01'
 6            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
 7          }
 8        ]
 9        nicSuffix: '-nic-01'
10      }
11    ]
```
Here, we reference another built-in output, this time from the AVM Virtual Network module. This example shows how to use an output that is part of an array. When the Virtual Network module creates subnets, it automatically creates a set of pre-defined outputs for them, one of which is an array that contains each subnet’s subnetResourceId. Our VM Subnet was the first one created which is position [0] in the array.
Other AVM modules may make use of arrays to store outputs. If you are unsure what type of outputs a module provides, you can always reference the Outputs section of each module’s README.md.

Storage Account

The last major component we need to add is a Storage Account. Because this Storage Account will be used as a backend storage to hold blobs for the hypothetical application that runs on our VM, we’ll also create a blob container within it using the same AVM Storage Account module.

➕ Expand Code

  1param location string = 'westus2'
  2
  3@description('Required. A password for the VM admin user.')
  4@secure()
  5param vmAdminPass string
  6
  7var addressPrefix = '10.0.0.0/16'
  8var prefix = 'VM-AVM-Ex1'
  9
 10module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 11  name: 'logAnalyticsWorkspace'
 12  params: {
 13    // Required parameters
 14    name: '${prefix}-law'
 15    // Non-required parameters
 16    location: location
 17  }
 18}
 19
 20module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
 21  name: 'natGwPublicIpDeployment'
 22  params: {
 23    // Required parameters
 24    name: '${prefix}-natgwpip'
 25    // Non-required parameters
 26    location: location
 27    diagnosticSettings: [
 28      {
 29        name: 'natGwPublicIpDiagnostics'
 30        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 31      }
 32    ]
 33  }
 34}
 35
 36module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
 37  name: 'natGatewayDeployment'
 38  params: {
 39    // Required parameters
 40    name: '${prefix}-natgw'
 41    zone: 1
 42    // Non-required parameters
 43    publicIpResourceIds: [
 44      natGwPublicIp.outputs.resourceId
 45    ]
 46  }
 47}
 48
 49module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
 50  name: 'virtualNetworkDeployment'
 51  params: {
 52    // Required parameters
 53    addressPrefixes: [
 54      addressPrefix
 55    ]
 56    name: '${prefix}-vnet'
 57    // Non-required parameters
 58    location: location
 59    diagnosticSettings: [
 60      {
 61
 62        name: 'vNetDiagnostics'
 63        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 64      }
 65    ]
 66    subnets: [
 67      {
 68        name: 'VMSubnet'
 69        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
 70        natGatewayResourceId: natGateway.outputs.resourceId
 71      }
 72    ]
 73  }
 74}
 75
 76module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
 77  name: 'keyVaultDeployment'
 78  params: {
 79    // Required parameters
 80    name: '${uniqueString(resourceGroup().id)}-kv'
 81    // Non-required parameters
 82    location: location
 83    diagnosticSettings: [
 84      {
 85        name: 'keyVaultDiagnostics'
 86        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 87      }
 88    ]
 89    enablePurgeProtection: false // disable purge protection for this example so we can more easily delete it
 90    secrets: [
 91      {
 92        name: 'vmAdminPassword'
 93        value: vmAdminPass
 94      }
 95    ]
 96  }
 97}
 98
 99module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.13.1' = {
100  name: 'linuxVirtualMachineDeployment'
101  params: {
102    // Required parameters
103    adminUsername: 'localAdminUser'
104    adminPassword: vmAdminPass
105    imageReference: {
106      offer: '0001-com-ubuntu-server-jammy'
107      publisher: 'Canonical'
108      sku: '22_04-lts-gen2'
109      version: 'latest'
110    }
111    name: '${prefix}-vm1'
112    nicConfigurations: [
113      {
114        ipConfigurations: [
115          {
116            name: 'ipconfig01'
117            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
118          }
119        ]
120        nicSuffix: '-nic-01'
121      }
122    ]
123    osDisk: {
124      caching: 'ReadWrite'
125      diskSizeGB: 128
126      managedDisk: {
127        storageAccountType: 'Standard_LRS'
128      }
129    }
130
131    osType: 'Linux'
132    vmSize: 'Standard_B2s_v2'
133    zone: 0
134    // Non-required parameters
135    location: location
136  }
137}
138
139module storageAccount 'br/public:avm/res/storage/storage-account:0.19.0' = {
140  name: 'storageAccountDeployment'
141  params: {
142    // Required parameters
143    name: '${uniqueString(resourceGroup().id)}sa'
144    // Non-required parameters
145    location: location
146    skuName: 'Standard_LRS'
147    diagnosticSettings: [
148      {
149        name: 'storageAccountDiagnostics'
150        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
151      }
152    ]
153    blobServices: {
154      containers: [
155        {
156          name: 'vmstorage'
157          publicAccess: 'None'
158        }
159      ]
160    }
161  }
162}

We now have all the major components of our Architecture diagram built!

The last steps we need to take to meet our requirements is to ensure our networking resources are secure and that we are using least privileged access by leveraging Role-Based Access Control (RBAC). Let’s get to it!

Network Security Groups

We’ll add a Network Security Group (NSG) to our VM subnet. This will act as a layer 3 and layer 4 firewall for networked resources. This implementation includes an appropriate inbound rule to allow SSH traffic from the Bastion host:

➕ Expand Code

  1param location string = 'westus2'
  2
  3@description('Required. A password for the VM admin user.')
  4@secure()
  5param vmAdminPass string
  6
  7var addressPrefix = '10.0.0.0/16'
  8var prefix = 'VM-AVM-Ex1'
  9
 10module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 11  name: 'logAnalyticsWorkspace'
 12  params: {
 13    // Required parameters
 14    name: '${prefix}-law'
 15    // Non-required parameters
 16    location: location
 17  }
 18}
 19
 20module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
 21  name: 'natGwPublicIpDeployment'
 22  params: {
 23    // Required parameters
 24    name: '${prefix}-natgwpip'
 25    // Non-required parameters
 26    location: location
 27    diagnosticSettings: [
 28      {
 29        name: 'natGwPublicIpDiagnostics'
 30        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 31      }
 32    ]
 33  }
 34}
 35
 36module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
 37  name: 'natGatewayDeployment'
 38  params: {
 39    // Required parameters
 40    name: '${prefix}-natgw'
 41    zone: 1
 42    // Non-required parameters
 43    publicIpResourceIds: [
 44      natGwPublicIp.outputs.resourceId
 45    ]
 46  }
 47}
 48
 49module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
 50  name: 'virtualNetworkDeployment'
 51  params: {
 52    // Required parameters
 53    addressPrefixes: [
 54      addressPrefix
 55    ]
 56    name: '${prefix}-vnet'
 57    // Non-required parameters
 58    location: location
 59    diagnosticSettings: [
 60      {
 61        name: 'vNetDiagnostics'
 62        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 63      }
 64    ]
 65    subnets: [
 66      {
 67        name: 'VMSubnet'
 68        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
 69        natGatewayResourceId: natGateway.outputs.resourceId
 70        networkSecurityGroupResourceId: nsgVM.outputs.resourceId
 71      }
 72    ]
 73  }
 74}
 75
 76module nsgVM 'br/public:avm/res/network/network-security-group:0.5.1' = {
 77  name: 'nsgVmDeployment'
 78  params: {
 79    name: '${prefix}-NSG-VM'
 80    location: location
 81    securityRules: [
 82      {
 83        name: 'AllowBastionSSH'
 84        properties: {
 85          access: 'Allow'
 86          direction: 'Inbound'
 87          priority: 100
 88          protocol: 'Tcp'
 89          sourceAddressPrefix: 'virtualNetwork'
 90          sourcePortRange: '*'
 91          destinationAddressPrefix: '*'
 92          destinationPortRange: '22'
 93        }
 94      }
 95    ]
 96  }
 97}
 98
 99module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
100  name: 'keyVaultDeployment'
101  params: {
102    // Required parameters
103    name: '${uniqueString(resourceGroup().id)}-kv'
104    // Non-required parameters
105    location: location
106    diagnosticSettings: [
107      {
108        name: 'keyVaultDiagnostics'
109        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
110      }
111    ]
112    enablePurgeProtection: false // disable purge protection for this example so we can more easily delete it
113    secrets: [
114      {
115        name: 'vmAdminPassword'
116        value: vmAdminPass
117      }
118    ]
119  }
120}
121
122module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.13.1' = {
123  name: 'linuxVirtualMachineDeployment'
124  params: {
125    // Required parameters
126    adminUsername: 'localAdminUser'
127    adminPassword: vmAdminPass
128    imageReference: {
129      offer: '0001-com-ubuntu-server-jammy'
130      publisher: 'Canonical'
131      sku: '22_04-lts-gen2'
132      version: 'latest'
133    }
134    name: '${prefix}-vm1'
135    nicConfigurations: [
136      {
137        ipConfigurations: [
138          {
139            name: 'ipconfig01'
140            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
141          }
142        ]
143        nicSuffix: '-nic-01'
144      }
145    ]
146    osDisk: {
147      caching: 'ReadWrite'
148      diskSizeGB: 128
149      managedDisk: {
150        storageAccountType: 'Standard_LRS'
151      }
152    }
153
154    osType: 'Linux'
155    vmSize: 'Standard_B2s_v2'
156    zone: 0
157    // Non-required parameters
158    location: location
159  }
160}
161
162module storageAccount 'br/public:avm/res/storage/storage-account:0.19.0' = {
163  name: 'storageAccountDeployment'
164  params: {
165    // Required parameters
166    name: '${uniqueString(resourceGroup().id)}sa'
167    // Non-required parameters
168    location: location
169    skuName: 'Standard_LRS'
170    diagnosticSettings: [
171      {
172        name: 'storageAccountDiagnostics'
173        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
174      }
175    ]
176    blobServices: {
177      containers: [
178        {
179          name: 'vmstorage'
180          publicAccess: 'None'
181        }
182      ]
183    }
184  }
185}

Disable Public Access to Storage Account

Since the Storage Account serves as a backend resource exclusively for the Virtual Machine, it will be secured as much as possible. This involves adding a Private Endpoint and disabling public internet access. AVM makes creation and assignment of Private Endpoints to resources incredibly easy. Take a look:

➕ Expand Code

  1param location string = 'westus2'
  2
  3@description('Required. A password for the VM admin user.')
  4@secure()
  5param vmAdminPass string
  6
  7var addressPrefix = '10.0.0.0/16'
  8var prefix = 'VM-AVM-Ex1'
  9
 10module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 11  name: 'logAnalyticsWorkspace'
 12  params: {
 13    // Required parameters
 14    name: '${prefix}-law'
 15    // Non-required parameters
 16    location: location
 17  }
 18}
 19
 20module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
 21  name: 'natGwPublicIpDeployment'
 22  params: {
 23    // Required parameters
 24    name: '${prefix}-natgwpip'
 25    // Non-required parameters
 26    location: location
 27    diagnosticSettings: [
 28      {
 29        name: 'natGwPublicIpDiagnostics'
 30        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 31      }
 32    ]
 33  }
 34}
 35
 36module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
 37  name: 'natGatewayDeployment'
 38  params: {
 39    // Required parameters
 40    name: '${prefix}-natgw'
 41    zone: 1
 42    // Non-required parameters
 43    publicIpResourceIds: [
 44      natGwPublicIp.outputs.resourceId
 45    ]
 46  }
 47}
 48
 49module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
 50  name: 'virtualNetworkDeployment'
 51  params: {
 52    // Required parameters
 53    addressPrefixes: [
 54      addressPrefix
 55    ]
 56    name: '${prefix}-vnet'
 57    // Non-required parameters
 58    location: location
 59    diagnosticSettings: [
 60      {
 61        name: 'vNetDiagnostics'
 62        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 63      }
 64    ]
 65    subnets: [
 66      {
 67        name: 'VMSubnet'
 68        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
 69        natGatewayResourceId: natGateway.outputs.resourceId
 70        networkSecurityGroupResourceId: nsgVM.outputs.resourceId
 71      }
 72      {
 73        name: 'PrivateEndpointSubnet'
 74        addressPrefix: cidrSubnet(addressPrefix, 24, 1) // second subnet in address space
 75      }
 76    ]
 77  }
 78}
 79
 80module nsgVM 'br/public:avm/res/network/network-security-group:0.5.1' = {
 81  name: 'nsgVmDeployment'
 82  params: {
 83    name: '${prefix}-NSG-VM'
 84    location: location
 85    securityRules: [
 86      {
 87        name: 'AllowBastionSSH'
 88        properties: {
 89          access: 'Allow'
 90          direction: 'Inbound'
 91          priority: 100
 92          protocol: 'Tcp'
 93          sourceAddressPrefix: 'virtualNetwork'
 94          sourcePortRange: '*'
 95          destinationAddressPrefix: '*'
 96          destinationPortRange: '22'
 97        }
 98      }
 99    ]
100  }
101}
102
103module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
104  name: 'keyVaultDeployment'
105  params: {
106    // Required parameters
107    name: '${uniqueString(resourceGroup().id)}-kv'
108    // Non-required parameters
109    location: location
110    diagnosticSettings: [
111      {
112        name: 'keyVaultDiagnostics'
113        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
114      }
115    ]
116    enablePurgeProtection: false // disable purge protection for this example so we can more easily delete it
117    secrets: [
118      {
119        name: 'vmAdminPassword'
120        value: vmAdminPass
121      }
122    ]
123  }
124}
125
126module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.14.0' = {
127  name: 'linuxVirtualMachineDeployment'
128  params: {
129    // Required parameters
130    adminUsername: 'localAdminUser'
131    adminPassword: vmAdminPass
132    imageReference: {
133      offer: '0001-com-ubuntu-server-jammy'
134      publisher: 'Canonical'
135      sku: '22_04-lts-gen2'
136      version: 'latest'
137    }
138    name: '${prefix}-vm1'
139    nicConfigurations: [
140      {
141        ipConfigurations: [
142          {
143            name: 'ipconfig01'
144            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
145          }
146        ]
147        nicSuffix: '-nic-01'
148      }
149    ]
150    osDisk: {
151      caching: 'ReadWrite'
152      diskSizeGB: 128
153      managedDisk: {
154        storageAccountType: 'Standard_LRS'
155      }
156    }
157    osType: 'Linux'
158    vmSize: 'Standard_B2s_v2'
159    zone: 0
160    // Non-required parameters
161    location: location
162  }
163}
164
165module storageAccount 'br/public:avm/res/storage/storage-account:0.19.0' = {
166  name: 'storageAccountDeployment'
167  params: {
168    // Required parameters
169    name: '${uniqueString(resourceGroup().id)}sa'
170    // Non-required parameters
171    location: location
172    skuName: 'Standard_LRS'
173    diagnosticSettings: [
174      {
175        name: 'storageAccountDiagnostics'
176        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
177      }
178    ]
179    publicNetworkAccess: 'Disabled'
180    allowBlobPublicAccess: false
181    blobServices: {
182      containers: [
183        {
184          name: 'vmstorage'
185          publicAccess: 'None'
186        }
187      ]
188    }
189    privateEndpoints: [
190      {
191        service: 'Blob'
192        subnetResourceId: virtualNetwork.outputs.subnetResourceIds[1] // Private Endpoint Subnet
193        privateDnsZoneGroup: {
194          privateDnsZoneGroupConfigs: [
195            {
196              privateDnsZoneResourceId: privateDnsBlob.outputs.resourceId
197            }
198          ]
199        }
200      }
201    ]
202  }
203}
204
205module privateDnsBlob 'br/public:avm/res/network/private-dns-zone:0.7.1' = {
206  name: '${prefix}-privatedns-blob'
207  params: {
208    name: 'privatelink.blob.${environment().suffixes.storage}'
209    location: 'global'
210    virtualNetworkLinks: [
211      {
212        name: '${virtualNetwork.outputs.name}-vnetlink'
213        virtualNetworkResourceId: virtualNetwork.outputs.resourceId
214      }
215    ]
216  }
217}

This implementation adds a dedicated subnet for Private Endpoints following the recommended practice of isolating Private Endpoints in their own subnet.

The addition of just a few lines of code in the privateEndpoints parameter handles the complex tasks of creating the Private Endpoint, associating it with the VNet, and attaching it to the resource. AVM drastically simplifies the creation of Private Endpoints for just about every Azure Resource that supports them.

The implementation also disables all public network connectivity to the Storage Account, ensuring it only accepts traffic via the Private Endpoint.

Finally, a Private DNS zone is added and linked to the VNet, enabling the VM to resolve the Private IP address associated with the Storage Account.

Bastion

To securely access the Virtual Machine without exposing its SSH port to the public internet, we’ll create an Azure Bastion host. The Bastion Host requires a subnet with the exact name AzureBastionSubnet which cannot contain anything other than Bastion Hosts.

➕ Expand Code

  1param location string = 'westus2'
  2
  3@description('Required. A password for the VM admin user.')
  4@secure()
  5param vmAdminPass string
  6
  7var addressPrefix = '10.0.0.0/16'
  8var prefix = 'VM-AVM-Ex1'
  9
 10module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 11  name: 'logAnalyticsWorkspace'
 12  params: {
 13    // Required parameters
 14    name: '${prefix}-law'
 15    // Non-required parameters
 16    location: location
 17  }
 18}
 19
 20module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
 21  name: 'natGwPublicIpDeployment'
 22  params: {
 23    // Required parameters
 24    name: '${prefix}-natgwpip'
 25    // Non-required parameters
 26    location: location
 27    diagnosticSettings: [
 28      {
 29        name: 'natGwPublicIpDiagnostics'
 30        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 31      }
 32    ]
 33  }
 34}
 35
 36module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
 37  name: 'natGatewayDeployment'
 38  params: {
 39    // Required parameters
 40    name: '${prefix}-natgw'
 41    zone: 1
 42    // Non-required parameters
 43    publicIpResourceIds: [
 44      natGwPublicIp.outputs.resourceId
 45    ]
 46  }
 47}
 48
 49module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
 50  name: 'virtualNetworkDeployment'
 51  params: {
 52    // Required parameters
 53    addressPrefixes: [
 54      addressPrefix
 55    ]
 56    name: '${prefix}-vnet'
 57    // Non-required parameters
 58    location: location
 59    diagnosticSettings: [
 60      {
 61        name: 'vNetDiagnostics'
 62        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 63      }
 64    ]
 65    subnets: [
 66      {
 67        name: 'VMSubnet'
 68        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
 69        natGatewayResourceId: natGateway.outputs.resourceId
 70        networkSecurityGroupResourceId: nsgVM.outputs.resourceId
 71      }
 72      {
 73        name: 'PrivateEndpointSubnet'
 74        addressPrefix: cidrSubnet(addressPrefix, 24, 1) // second subnet in address space
 75      }
 76      {
 77        name: 'AzureBastionSubnet' // Azure Bastion Host requires this subnet to be named exactly "AzureBastionSubnet"
 78        addressPrefix: cidrSubnet(addressPrefix, 24, 2) // third subnet in address space
 79      }
 80    ]
 81  }
 82}
 83
 84module nsgVM 'br/public:avm/res/network/network-security-group:0.5.1' = {
 85  name: 'nsgVmDeployment'
 86  params: {
 87    name: '${prefix}-NSG-VM'
 88    location: location
 89    securityRules: [
 90      {
 91        name: 'AllowBastionSSH'
 92        properties: {
 93          access: 'Allow'
 94          direction: 'Inbound'
 95          priority: 100
 96          protocol: 'Tcp'
 97          sourceAddressPrefix: 'virtualNetwork'
 98          sourcePortRange: '*'
 99          destinationAddressPrefix: '*'
100          destinationPortRange: '22'
101        }
102      }
103    ]
104  }
105}
106
107module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
108  name: 'keyVaultDeployment'
109  params: {
110    // Required parameters
111    name: '${uniqueString(resourceGroup().id)}-kv'
112    // Non-required parameters
113    location: location
114    diagnosticSettings: [
115      {
116        name: 'keyVaultDiagnostics'
117        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
118      }
119    ]
120    enablePurgeProtection: false // disable purge protection for this example so we can more easily delete it
121    secrets: [
122      {
123        name: 'vmAdminPassword'
124        value: vmAdminPass
125      }
126    ]
127  }
128}
129
130module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.14.0' = {
131  name: 'linuxVirtualMachineDeployment'
132  params: {
133    // Required parameters
134    adminUsername: 'localAdminUser'
135    adminPassword: vmAdminPass
136    imageReference: {
137      offer: '0001-com-ubuntu-server-jammy'
138      publisher: 'Canonical'
139      sku: '22_04-lts-gen2'
140      version: 'latest'
141    }
142    name: '${prefix}-vm1'
143    nicConfigurations: [
144      {
145        ipConfigurations: [
146          {
147            name: 'ipconfig01'
148            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
149          }
150        ]
151        nicSuffix: '-nic-01'
152      }
153    ]
154    osDisk: {
155      caching: 'ReadWrite'
156      diskSizeGB: 128
157      managedDisk: {
158        storageAccountType: 'Standard_LRS'
159      }
160    }
161    osType: 'Linux'
162    vmSize: 'Standard_B2s_v2'
163    zone: 0
164    // Non-required parameters
165    location: location
166  }
167}
168
169module storageAccount 'br/public:avm/res/storage/storage-account:0.19.0' = {
170  name: 'storageAccountDeployment'
171  params: {
172    // Required parameters
173    name: '${uniqueString(resourceGroup().id)}sa'
174    // Non-required parameters
175    location: location
176    skuName: 'Standard_LRS'
177    diagnosticSettings: [
178      {
179        name: 'storageAccountDiagnostics'
180        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
181      }
182    ]
183    publicNetworkAccess: 'Disabled'
184    allowBlobPublicAccess: false
185    blobServices: {
186      containers: [
187        {
188          name: 'vmstorage'
189          publicAccess: 'None'
190        }
191      ]
192    }
193    privateEndpoints: [
194      {
195        service: 'Blob'
196        subnetResourceId: virtualNetwork.outputs.subnetResourceIds[1] // Private Endpoint Subnet
197        privateDnsZoneGroup: {
198          privateDnsZoneGroupConfigs: [
199            {
200              privateDnsZoneResourceId: privateDnsBlob.outputs.resourceId
201            }
202          ]
203        }
204      }
205    ]
206  }
207}
208
209module privateDnsBlob 'br/public:avm/res/network/private-dns-zone:0.7.1' = {
210  name: '${prefix}-privatedns-blob'
211  params: {
212    name: 'privatelink.blob.${environment().suffixes.storage}'
213    location: 'global'
214    virtualNetworkLinks: [
215      {
216        name: '${virtualNetwork.outputs.name}-vnetlink'
217        virtualNetworkResourceId: virtualNetwork.outputs.resourceId
218      }
219    ]
220  }
221}
222
223// Note: Deploying a Bastion Host will automatically create a Public IP and use the subnet named "AzureBastionSubnet"
224// within our VNet. This subnet is required and must be named exactly "AzureBastionSubnet" for the Bastion Host to work.
225module bastion 'br/public:avm/res/network/bastion-host:0.6.1' = {
226  name: 'bastionDeployment'
227  params: {
228    name: '${prefix}-bastion'
229    virtualNetworkResourceId: virtualNetwork.outputs.resourceId
230    skuName: 'Basic'
231    location: location
232    diagnosticSettings: [
233      {
234        name: 'bastionDiagnostics'
235        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
236      }
237    ]
238  }
239}

This simple addition of the bastion-host AVM module completes the secure access component of our architecture. You can now access the Virtual Machine by way of the Bastion Host in the Azure Portal.

Role-Based Access Control

To complete our solution, we have one final task: to apply Role-Based Access Control (RBAC) restrictions on our services, namely the Key Vault and Storage Account. The goal is to explicitly allow only the Virtual Machine to have Create, Read, Update, or Delete (CRUD) permissions on these two services.

This is accomplished by enabling a System-assigned Managed Identity on the Virtual Machine, then granting the VM’s Managed Identity appropriate permissions on the Storage Account and Key Vault:

➕ Expand Code

  1param location string = 'westus2'
  2
  3@description('Required. A password for the VM admin user.')
  4@secure()
  5param vmAdminPass string
  6
  7var addressPrefix = '10.0.0.0/16'
  8var prefix = 'VM-AVM-Ex1'
  9
 10module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 11  name: 'logAnalyticsWorkspace'
 12  params: {
 13    // Required parameters
 14    name: '${prefix}-law'
 15    // Non-required parameters
 16    location: location
 17  }
 18}
 19
 20module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
 21  name: 'natGwPublicIpDeployment'
 22  params: {
 23    // Required parameters
 24    name: '${prefix}-natgwpip'
 25    // Non-required parameters
 26    location: location
 27    diagnosticSettings: [
 28      {
 29        name: 'natGwPublicIpDiagnostics'
 30        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 31      }
 32    ]
 33  }
 34}
 35
 36module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
 37  name: 'natGatewayDeployment'
 38  params: {
 39    // Required parameters
 40    name: '${prefix}-natgw'
 41    zone: 1
 42    // Non-required parameters
 43    publicIpResourceIds: [
 44      natGwPublicIp.outputs.resourceId
 45    ]
 46  }
 47}
 48
 49module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
 50  name: 'virtualNetworkDeployment'
 51  params: {
 52    // Required parameters
 53    addressPrefixes: [
 54      addressPrefix
 55    ]
 56    name: '${prefix}-vnet'
 57    // Non-required parameters
 58    location: location
 59    diagnosticSettings: [
 60      {
 61        name: 'vNetDiagnostics'
 62        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 63      }
 64    ]
 65    subnets: [
 66      {
 67        name: 'VMSubnet'
 68        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
 69        natGatewayResourceId: natGateway.outputs.resourceId
 70        networkSecurityGroupResourceId: nsgVM.outputs.resourceId
 71      }
 72      {
 73        name: 'PrivateEndpointSubnet'
 74        addressPrefix: cidrSubnet(addressPrefix, 24, 1) // second subnet in address space
 75      }
 76      {
 77        name: 'AzureBastionSubnet' // Azure Bastion Host requires this subnet to be named exactly "AzureBastionSubnet"
 78        addressPrefix: cidrSubnet(addressPrefix, 24, 2) // third subnet in address space
 79      }
 80    ]
 81  }
 82}
 83
 84module nsgVM 'br/public:avm/res/network/network-security-group:0.5.1' = {
 85  name: 'nsgVmDeployment'
 86  params: {
 87    name: '${prefix}-NSG-VM'
 88    location: location
 89    securityRules: [
 90      {
 91        name: 'AllowBastionSSH'
 92        properties: {
 93          access: 'Allow'
 94          direction: 'Inbound'
 95          priority: 100
 96          protocol: 'Tcp'
 97          sourceAddressPrefix: 'virtualNetwork'
 98          sourcePortRange: '*'
 99          destinationAddressPrefix: '*'
100          destinationPortRange: '22'
101        }
102      }
103    ]
104  }
105}
106
107module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
108  name: 'keyVaultDeployment'
109  params: {
110    // Required parameters
111    name: '${uniqueString(resourceGroup().id)}-kv'
112    // Non-required parameters
113    location: location
114    diagnosticSettings: [
115      {
116        name: 'keyVaultDiagnostics'
117        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
118      }
119    ]
120    enablePurgeProtection: false // disable purge protection for this example so we can more easily delete it
121    secrets: [
122      {
123        name: 'vmAdminPassword'
124        value: vmAdminPass
125      }
126    ]
127    roleAssignments: [
128      {
129        principalId: virtualMachine.outputs.systemAssignedMIPrincipalId
130        principalType: 'ServicePrincipal'
131        roleDefinitionIdOrName: 'Key Vault Secrets User' // Allows read access to secrets
132      }
133    ]
134  }
135}
136
137module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.14.0' = {
138  name: 'linuxVirtualMachineDeployment'
139  params: {
140    // Required parameters
141    adminUsername: 'localAdminUser'
142    adminPassword: vmAdminPass
143    imageReference: {
144      offer: '0001-com-ubuntu-server-jammy'
145      publisher: 'Canonical'
146      sku: '22_04-lts-gen2'
147      version: 'latest'
148    }
149    name: '${prefix}-vm1'
150    nicConfigurations: [
151      {
152        ipConfigurations: [
153          {
154            name: 'ipconfig01'
155            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
156          }
157        ]
158        nicSuffix: '-nic-01'
159      }
160    ]
161    osDisk: {
162      caching: 'ReadWrite'
163      diskSizeGB: 128
164      managedDisk: {
165        storageAccountType: 'Standard_LRS'
166      }
167    }
168    osType: 'Linux'
169    vmSize: 'Standard_B2s_v2'
170    zone: 0
171    // Non-required parameters
172    location: location
173    managedIdentities: {
174      systemAssigned: true
175    }
176  }
177}
178
179module storageAccount 'br/public:avm/res/storage/storage-account:0.19.0' = {
180  name: 'storageAccountDeployment'
181  params: {
182    // Required parameters
183    name: '${uniqueString(resourceGroup().id)}sa'
184    // Non-required parameters
185    location: location
186    skuName: 'Standard_LRS'
187    diagnosticSettings: [
188      {
189        name: 'storageAccountDiagnostics'
190        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
191      }
192    ]
193    publicNetworkAccess: 'Disabled'
194    allowBlobPublicAccess: false
195    blobServices: {
196      containers: [
197        {
198          name: 'vmstorage'
199          publicAccess: 'None'
200        }
201      ]
202      roleAssignments:[
203        {
204          principalId: virtualMachine.outputs.systemAssignedMIPrincipalId
205          principalType: 'ServicePrincipal'
206          roleDefinitionName: 'Storage Blob Data Contributor' // Allows read/write/delete on blob containers
207        }
208      ]
209    }
210    privateEndpoints: [
211      {
212        service: 'Blob'
213        subnetResourceId: virtualNetwork.outputs.subnetResourceIds[1] // Private Endpoint Subnet
214        privateDnsZoneGroup: {
215          privateDnsZoneGroupConfigs: [
216            {
217              privateDnsZoneResourceId: privateDnsBlob.outputs.resourceId
218            }
219          ]
220        }
221      }
222    ]
223  }
224}
225
226module privateDnsBlob 'br/public:avm/res/network/private-dns-zone:0.7.1' = {
227  name: '${prefix}-privatedns-blob'
228  params: {
229    name: 'privatelink.blob.${environment().suffixes.storage}'
230    location: 'global'
231    virtualNetworkLinks: [
232      {
233        name: '${virtualNetwork.outputs.name}-vnetlink'
234        virtualNetworkResourceId: virtualNetwork.outputs.resourceId
235      }
236    ]
237  }
238}
239
240// Note: Deploying a Bastion Host will automatically create a Public IP and use the subnet named "AzureBastionSubnet"
241// within our VNet. This subnet is required and must be named exactly "AzureBastionSubnet" for the Bastion Host to work.
242module bastion 'br/public:avm/res/network/bastion-host:0.6.1' = {
243  name: 'bastionDeployment'
244  params: {
245    name: '${prefix}-bastion'
246    virtualNetworkResourceId: virtualNetwork.outputs.resourceId
247    skuName: 'Basic'
248    location: location
249    diagnosticSettings: [
250      {
251        name: 'bastionDiagnostics'
252        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
253      }
254    ]
255  }
256}

Info

The Azure Subscription owner will have CRUD permissions for the Storage Account but not for the Key Vault. The Key Vault requires explicit RBAC permissions assigned to a user to grant them access: Provide access to Key Vaults using RBAC. Important!: at this point, you will only be able to access the Storage Account from the Bastion Host. Remember, public internet access has been disabled!

The RBAC policies have been successfully applied using a System-assigned Managed Identity on the Virtual Machine. This identity has been granted permissions on both the Key Vault and Storage Account. Now the VM can read secrets from the Key Vault and Read, Create, or Delete blobs in the Storage Account.

In a real production environment, the principle of least privileged access should be applied, providing only the exact permissions each service needs to carry out its functions. Learn more about Microsoft’s recommendations for identity and access management.

Conclusion

In this tutorial, we’ve explored how to leverage Azure Verified Modules (AVM) to build a secure, well-architected solution in Azure. AVM modules significantly simplify the deployment of Azure resources by abstracting away much of the complexity involved in configuring individual resources.

Your final, deployable Bicep template file should now look like this:

➕ Expand Code

  1param location string = 'westus2'
  2
  3@description('Required. A password for the VM admin user.')
  4@secure()
  5param vmAdminPass string
  6
  7var addressPrefix = '10.0.0.0/16'
  8var prefix = 'VM-AVM-Ex1'
  9
 10module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0.11.1' = {
 11  name: 'logAnalyticsWorkspace'
 12  params: {
 13    // Required parameters
 14    name: '${prefix}-law'
 15    // Non-required parameters
 16    location: location
 17  }
 18}
 19
 20module natGwPublicIp 'br/public:avm/res/network/public-ip-address:0.8.0' = {
 21  name: 'natGwPublicIpDeployment'
 22  params: {
 23    // Required parameters
 24    name: '${prefix}-natgwpip'
 25    // Non-required parameters
 26    location: location
 27    diagnosticSettings: [
 28      {
 29        name: 'natGwPublicIpDiagnostics'
 30        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 31      }
 32    ]
 33  }
 34}
 35
 36module natGateway 'br/public:avm/res/network/nat-gateway:1.2.2' = {
 37  name: 'natGatewayDeployment'
 38  params: {
 39    // Required parameters
 40    name: '${prefix}-natgw'
 41    zone: 1
 42    // Non-required parameters
 43    publicIpResourceIds: [
 44      natGwPublicIp.outputs.resourceId
 45    ]
 46  }
 47}
 48
 49module virtualNetwork 'br/public:avm/res/network/virtual-network:0.6.1' = {
 50  name: 'virtualNetworkDeployment'
 51  params: {
 52    // Required parameters
 53    addressPrefixes: [
 54      addressPrefix
 55    ]
 56    name: '${prefix}-vnet'
 57    // Non-required parameters
 58    location: location
 59    diagnosticSettings: [
 60      {
 61        name: 'vNetDiagnostics'
 62        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
 63      }
 64    ]
 65    subnets: [
 66      {
 67        name: 'VMSubnet'
 68        addressPrefix: cidrSubnet(addressPrefix, 24, 0) // first subnet in address space
 69        natGatewayResourceId: natGateway.outputs.resourceId
 70        networkSecurityGroupResourceId: nsgVM.outputs.resourceId
 71      }
 72      {
 73        name: 'PrivateEndpointSubnet'
 74        addressPrefix: cidrSubnet(addressPrefix, 24, 1) // second subnet in address space
 75      }
 76      {
 77        name: 'AzureBastionSubnet' // Azure Bastion Host requires this subnet to be named exactly "AzureBastionSubnet"
 78        addressPrefix: cidrSubnet(addressPrefix, 24, 2) // third subnet in address space
 79      }
 80    ]
 81  }
 82}
 83
 84module nsgVM 'br/public:avm/res/network/network-security-group:0.5.1' = {
 85  name: 'nsgVmDeployment'
 86  params: {
 87    name: '${prefix}-NSG-VM'
 88    location: location
 89    securityRules: [
 90      {
 91        name: 'AllowBastionSSH'
 92        properties: {
 93          access: 'Allow'
 94          direction: 'Inbound'
 95          priority: 100
 96          protocol: 'Tcp'
 97          sourceAddressPrefix: 'virtualNetwork'
 98          sourcePortRange: '*'
 99          destinationAddressPrefix: '*'
100          destinationPortRange: '22'
101        }
102      }
103    ]
104  }
105}
106
107module keyVault 'br/public:avm/res/key-vault/vault:0.12.1' = {
108  name: 'keyVaultDeployment'
109  params: {
110    // Required parameters
111    name: '${uniqueString(resourceGroup().id)}-kv'
112    // Non-required parameters
113    location: location
114    diagnosticSettings: [
115      {
116        name: 'keyVaultDiagnostics'
117        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
118      }
119    ]
120    enablePurgeProtection: false // disable purge protection for this example so we can more easily delete it
121    secrets: [
122      {
123        name: 'vmAdminPassword'
124        value: vmAdminPass
125      }
126    ]
127    roleAssignments: [
128      {
129        principalId: virtualMachine.outputs.systemAssignedMIPrincipalId
130        principalType: 'ServicePrincipal'
131        roleDefinitionIdOrName: 'Key Vault Secrets User' // Allows read access to secrets
132      }
133    ]
134  }
135}
136
137module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.14.0' = {
138  name: 'linuxVirtualMachineDeployment'
139  params: {
140    // Required parameters
141    adminUsername: 'localAdminUser'
142    adminPassword: vmAdminPass
143    imageReference: {
144      offer: '0001-com-ubuntu-server-jammy'
145      publisher: 'Canonical'
146      sku: '22_04-lts-gen2'
147      version: 'latest'
148    }
149    name: '${prefix}-vm1'
150    nicConfigurations: [
151      {
152        ipConfigurations: [
153          {
154            name: 'ipconfig01'
155            subnetResourceId: virtualNetwork.outputs.subnetResourceIds[0] // VMSubnet
156          }
157        ]
158        nicSuffix: '-nic-01'
159      }
160    ]
161    osDisk: {
162      caching: 'ReadWrite'
163      diskSizeGB: 128
164      managedDisk: {
165        storageAccountType: 'Standard_LRS'
166      }
167    }
168    osType: 'Linux'
169    vmSize: 'Standard_B2s_v2'
170    zone: 0
171    // Non-required parameters
172    location: location
173    managedIdentities: {
174      systemAssigned: true
175    }
176  }
177}
178
179module storageAccount 'br/public:avm/res/storage/storage-account:0.19.0' = {
180  name: 'storageAccountDeployment'
181  params: {
182    // Required parameters
183    name: '${uniqueString(resourceGroup().id)}sa'
184    // Non-required parameters
185    location: location
186    skuName: 'Standard_LRS'
187    diagnosticSettings: [
188      {
189        name: 'storageAccountDiagnostics'
190        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
191      }
192    ]
193    publicNetworkAccess: 'Disabled'
194    allowBlobPublicAccess: false
195    blobServices: {
196      containers: [
197        {
198          name: 'vmstorage'
199          publicAccess: 'None'
200        }
201      ]
202      roleAssignments:[
203        {
204          principalId: virtualMachine.outputs.systemAssignedMIPrincipalId
205          principalType: 'ServicePrincipal'
206          roleDefinitionName: 'Storage Blob Data Contributor' // Allows read/write/delete on blob containers
207        }
208      ]
209    }
210    privateEndpoints: [
211      {
212        service: 'Blob'
213        subnetResourceId: virtualNetwork.outputs.subnetResourceIds[1] // Private Endpoint Subnet
214        privateDnsZoneGroup: {
215          privateDnsZoneGroupConfigs: [
216            {
217              privateDnsZoneResourceId: privateDnsBlob.outputs.resourceId
218            }
219          ]
220        }
221      }
222    ]
223  }
224}
225
226module privateDnsBlob 'br/public:avm/res/network/private-dns-zone:0.7.1' = {
227  name: '${prefix}-privatedns-blob'
228  params: {
229    name: 'privatelink.blob.${environment().suffixes.storage}'
230    location: 'global'
231    virtualNetworkLinks: [
232      {
233        name: '${virtualNetwork.outputs.name}-vnetlink'
234        virtualNetworkResourceId: virtualNetwork.outputs.resourceId
235      }
236    ]
237  }
238}
239
240// Note: Deploying a Bastion Host will automatically create a Public IP and use the subnet named "AzureBastionSubnet"
241// within our VNet. This subnet is required and must be named exactly "AzureBastionSubnet" for the Bastion Host to work.
242module bastion 'br/public:avm/res/network/bastion-host:0.6.1' = {
243  name: 'bastionDeployment'
244  params: {
245    name: '${prefix}-bastion'
246    virtualNetworkResourceId: virtualNetwork.outputs.resourceId
247    skuName: 'Basic'
248    location: location
249    diagnosticSettings: [
250      {
251        name: 'bastionDiagnostics'
252        workspaceResourceId: logAnalyticsWorkspace.outputs.resourceId
253      }
254    ]
255  }
256}

AVM modules provide several key advantages over writing raw Bicep templates:

Simplified Resource Configuration: AVM modules handle much of the complex configuration work behind the scenes
Built-in Recommended Practices: The modules implement many of Microsoft’s recommended practices by default
Consistent Outputs: Each module exposes a consistent set of outputs that can be easily referenced
Reduced Boilerplate Code: What would normally require hundreds of lines of Bicep code can be accomplished in a fraction of the space

As you continue your journey with Azure and AVM, remember that this approach can be applied to more complex architectures as well. The modular nature of AVM allows you to mix and match components to build solutions that meet your specific needs while adhering to Microsoft’s Well-Architected Framework.

By using AVM modules as building blocks, you can focus more on your solution architecture and less on the intricacies of individual resource configurations, ultimately leading to faster development cycles and more reliable deployments.

Clean up your environment

When you are ready, you can remove the infrastructure deployed in this example. Key Vaults are set to a soft-delete state so you will also need to purge the one we created in order to fully delete it. The following commands will remove all resources created by your deployment:

Clean up with

# Delete the resource group
Remove-AzResourceGroup -Name "avm-bicep-vmexample1" -Force

# Purge the Key Vault
Remove-AzKeyVault -VaultName "<keyVaultName>" -Location "<location>" -InRemovedState -Force

# Delete the resource group
az group delete --name 'avm-bicep-vmexample1' --yes --no-wait

# Purge the Key Vault
az keyvault purge --name '<keyVaultName>' --no-wait

Congratulations, you have successfully leveraged AVM Bicep modules to deploy resources in Azure!

Tip

We welcome your contributions and feedback to help us improve the AVM modules and the overall experience for the community!

Terraform - Solution Development

Introduction

Azure Verified Modules (AVM) for Terraform are a powerful tool that leverage the Terraform domain-specific language (DSL), industry knowledge, and an Open Source community, which altogether enable developers to quickly deploy Azure resources that follow Microsoft’s recommended practices for Azure.
In this article, we will walk through the Terraform specific considerations and recommended practices on developing your solution leveraging Azure Verified Modules. We’ll review some of the design features and trade-offs and include sample code to illustrate each discussion point.

Prerequisites

You will need the following tools and components to complete this guide:

Visual Studio Code (VS Code) to develop your solution.
Terraform CLI to deploy your Terraform modules. Make sure you have a recent version installed.
Azure CLI to authenticate to Azure.
Azure Subscription to deploy your resources.

Before you begin, ensure you have these tools installed in your development environment.

Planning

Good module development should start with a good plan. Let’s first review the architecture and module design prior to developing our solution.

Solution Architecture

In our design, the resource group for our solution will require appropriate tagging to comply with our corporate standards. Resources that support Diagnostic Settings must also send metric data to a Log Analytics workspace, so that the infrastructure support teams can get metric telemetry. The virtual machine will require outbound internet access to allow the application to properly function. A Key Vault will be included to store any secrets and key artifacts, and we will include a Bastion instance to allow support personnel to access the virtual machine if needed. Finally, the VM is intended to run without interaction, so we will auto-generate an SSH private key and store it in the Key Vault for the rare event of someone needing to log into the VM.

Based on this narrative, we will create the following resources:

A resource group to contain all the resources with tagging
A random string resource for use in resources with global naming (Key Vault)
A Log Analytics workspace for diagnostic data
A Key Vault with:
- Role-Based Access Control (RBAC) to allow data access
- Logging to the Log Analytics workspace
A virtual network with:
- A virtual machine subnet
- A Bastion subnet
- Network Security Group on the VM subnet allowing SSH traffic
- Logging to the Log Analytics workspace
A NAT Gateway for enabling outbound internet access
- Associated to the virtual machine subnet
A Bastion service for secure remote access to the Virtual Machine
- Logging to the Log Analytics workspace
A virtual machine resource with
- A single private IPv4 interface attached to the VM subnet
- A randomly generated admin account private key stored in the Key Vault
- Metrics sent to the log Analytics workspace

Solution template (root module) design

Since our solution template (root module) is intended to be deployed multiple times, we want to develop it in a way that provides flexibility while minimizing the amount of input necessary to deploy the solution. For these reasons, we will create our module with a small set of variables that allow for deployment differentiation while still populating solution-specific defaults to minimize input. We will also separate our content into variables.tf, outputs.tf, terraform.tf, and main.tf files to simplify future maintenance.

Based on this, our file system will take the following structure:

Module Directory
- terraform.tf - This file holds the provider definitions and versions.
- variables.tf - This file contains the input variable definitions and defaults.
- outputs.tf - This file contains the outputs and their descriptions for use by any external modules calling this root module.
- main.tf - This file contains the core module code for creating the solutions infrastructure.
- development.tfvars - This file will contain the inputs for the instance of the module that is being deployed. Content in this file will vary from instance to instance.

Note

Terraform will merge content from any file ending in a .tf extension in the module folder to create the full module content. Because of this, using different files is not required. We encourage file separation to allow for organizing code in a way that makes it easier to maintain. While the naming structure we’ve used is common, there are many other valid file naming and organization options that can be used.

In our example, we will use the following variables as inputs to allow for customization:

location - The location where our infrastructure will be deployed.
name_prefix - This will be used to preface all of the resource naming.
virtual_network_prefix - This will be used to ensure IP uniqueness for the deployment.
tags - The custom tags to use for each deployment.

Finally, we will export the following outputs:

resource_group_name - This will allow for finding this deployment if there are multiples.
virtual_machine_name - This can be used to find and login to the vm if needed.

Identifying AVM modules that match our solution

Now that we’ve determined our architecture and module configurations, we need to see what AVM modules exist for use in our solution. To do this, we will open the AVM Terraform pattern module index and check if there are any existing pattern modules that match our requirement. In this case, no pattern modules fit our needs. If this was a common pattern, we could open an issue on the AVM github repository to get assistance from the AVM project to create a pattern module matching our requirements. Since our architecture isn’t common, we’ll continue to the next step.

When a pattern module fitting our needs doesn’t exist for a solution, leveraging AVM resource modules to build our own solution is the next best option. Review the AVM Terraform published resource module index for each of the resource types included in your architecture. For each AVM module, capture a link to the module to allow for a review of the documentation details on the Terraform Registry website.

Note

Some of the published pattern modules cover multi-resource configurations that can sometimes be interpreted as a single resource. Be sure to check the pattern index for groups of resources that may be part of your architecture and that don’t exist in the resource module index. (e.g., Virtual WAN)

For our sample architecture, we have the following AVM resource modules at our disposal. Click on each module to explore its documentation on the Terraform Registry.

Develop the Solution Code

We can now begin coding our solution. We will create each element individually, to allow us to test our deployment as we build it out. This will also allow us to correct any bugs incrementally, so that we aren’t troubleshooting a large number of resources at the end.

Creating the terraform.tf file

Let’s begin by configuring the provider details necessary to build our solution. Since this is a root module, we want to include any provider and Terraform version constraints for this module. We’ll periodically come back and add any needed additional providers if our design includes a resource from a new provider.

Open up your development IDE (Visual studio code in our example) and create a file named terraform.tf in your root directory.

Add the following code to your terraform.tf file:

➕ Expand Code

1terraform {
2  required_version = "~> 1.9"
3  required_providers {
4  }
5}

Note

Always click on the “Copy to clipboard” button in the top right corner of the Code sample area in order not to have the line numbers included in the copied code.

This specifies that the required Terraform binary version to run your module can be any version between 1.9 and 2.0. This is a good compromise for allowing a range of binary versions while also ensuring support for any required features that are used as part of the module. This can include things like newly introduced functions or support for new key words.

Since we are developing our solution incrementally, we should validate our code. To do this, we will take the following steps:

Open up a terminal window if it is not already open. In some IDE’s this can be done as a function of the IDE.
Change directory to the module directory by typing cd and then the path to the module. As an example, if the module directory was named example we would run cd example.
Run terraform init to initialize your provider file.

You should now see a message indicating that Terraform has been successfully initialized. This indicates that our code is error free and we can continue on. If you get errors, examine the provider syntax for typos, missing quotes, or missing brackets.

Creating a variables.tf file

Because our module is intended to be reusable, we want to provide the capability to customize each module call with those items that will differ between them. This is done by using variables to accept inputs into the module. We’ll define these inputs in a separate file named variables.tf.

Go back to the IDE, and create a file named variables.tf in the working directory.

Add the following code to your variables.tf file to configure the inputs for our example:

➕ Expand Code

 1variable "name_prefix" {
 2  description = "Prefix for the name of the resources"
 3  type        = string
 4  default     = "example"
 5}
 6
 7variable "location" {
 8  description = "The Azure location to deploy the resources"
 9  type        = string
10  default     = "East US"
11}
12
13variable "virtual_network_cidr" {
14  description = "The CIDR prefix for the virtual network. This should be at least a /22. Example 10.0.0.0/22"
15  type        = string
16}
17
18variable "tags" {
19  description = "Tags to be applied to all resources"
20  type        = map(string)
21  default     = {}
22}

Note

Note that each variable definition includes a type definition to guide module users on how to properly define an input. Also note that it is possible to set a default value. This allows module consumers to avoid setting a value if they find the default to be acceptable.

We should now test the new content we’ve created for our module. To do this, first re-run terraform init on your command line. Note that nothing has changed and the initialization completes successfully. Since we now have module content, we will attempt to run the plan as the next step of the workflow.

Type terraform plan on your command line. Note that it now asks for us to provide a value for the var.virtual_network_cidr variable. This is because we don’t provide a default value for that input so Terraform must have a valid input before it can continue. Type 10.0.0.0/22 into the input and press enter to allow the plan to complete. You should now see a message indicating that Your infrastructure matches the configuration and that no changes are needed.

Creating a development.tfvars file

There are multiple ways to provide input to the module we’re creating. We will create a tfvars file that can be supplied during plan and apply stages to minimize the need for manual input. tfvars files are a nice way to document inputs as well as allow for deploying different versions of your module. This is useful if you have a pipeline where infrastructure code is deployed first for development, and then is deployed for QA, staging, or production with different input values.

In your IDE, create a new file named development.tfvars in your working directory.

Now add the following content to your development.tfvars file.

➕ Expand Code

1location = "westus2"
2prefix = dev
3virtual_network_cidr = "10.1.0.0/22"
4tags = {
5  environment = "development"
6  owner       = "dev-team"
7}

Note

Note that each variable has a value defined. Although, only inputs without default values are required, we include values for all of the inputs for clarity. Consider doing this in your environments so that someone looking at the tfvars files has a full picture of what values are being set.

Re-run the terraform apply, but this time, reference the .tfvars file by using the following command: terraform plan -var-file=development.tfvars. You should get a successful completion without needing to manually provide inputs.

Creating the main.tf file

Now that we’ve created the supporting files, we can start building the actual infrastructure code in our main file. We will add one AVM resource module at a time so that we can test each as we implement them.

Return to your IDE and create a new file named main.tf.

Add a resource group

In Azure, we need a resource group to hold any infrastructure resources we create. This is a simple resource that typically wouldn’t require an AVM module, but we’ll include the AVM module so we can take advantage of the Role-Based Access Control (RBAC) interface if we need to restrict access to the resource group in future versions.

First, let’s visit the Terraform registry documentation page for the resource group and explore several key sections.

Note the Provision Instructions box on the right-hand side of the page. This contains the module source and version details which allows us to copy the latest version syntax without needing to type everything ourselves.
Now review the Readme tab in the middle of the page. It contains details about all required and optional inputs, resources that are created with the module, and any outputs that are defined. If you want to explore any of these items in detail, each element has a tab that you can review as needed.
Finally, in the middle of the page, there is a drop-down menu named Examples that contains functioning examples for the AVM module. These showcase a good example of using copy/paste to bootstrap module code and then modify it for your specific purpose.

Now that we’ve explored the registry content, let’s add a resource group to our module.

First, copy the content from the Provision Instructions box into our main.tf file.

➕ Expand Code

1module "avm-res-resources-resourcegroup" {
2  source  = "Azure/avm-res-resources-resourcegroup/azurerm"
3  version = "0.2.1"
4  # insert the 2 required variables here
5}

On the modules documentation page, go to the inputs tab. Review the Required Inputs tab. These are the values that don’t have defaults and are the minimum required values to deploy the module. There are additional inputs in the Optional Inputs section that can be used to configure additional module functionality. Review these inputs and determine which values you would like to define in your AVM module call.

Now, replace the # insert the 2 required variables here comment with the following code to define the module inputs. Our main.tf code should look like the following:

➕ Expand Code

1module "avm-res-resources-resourcegroup" {
2  source  = "Azure/avm-res-resources-resourcegroup/azurerm"
3  version = "0.2.1"
4
5  name = "${var.name_prefix}-rg"
6  location = var.location
7  tags = var.tags
8}

Note

Note how we’ve used the prefix variable and Terraform interpolation syntax to dynamically name the resource group. This allows for module customization and re-use. Also note that even though we chose to use the default module name of avm-res-resources-resourcegroup, we could modify the name of the module if needed.

After saving the file, we want to test our new content. To do this, return to the command line and first run terraform init. Notice how Terraform has downloaded the module code, as well as providers that the module requires. In this case, you can see the azurerm, random, and modtm providers were downloaded.

Let’s now deploy our resource group. First, let’s run a plan operation to review what will be created. Type terraform plan -var-file=development.tfvars and press enter to initiate the plan.

Add the features block

Notice that we get an error indicating that we are Missing required argument and that for the azurerm provider, we need to provide a features argument. The addition of the resource group AVM resource requires that the azurerm provider be installed to provision resources in our module. This provider requires a features block in its provider definition that is missing in our configuration.

Return to the terraform.tf file and add the following content to it. Note how the features block is currently empty. If we needed to activate any feature flags in our module, we could add them here.

➕ Expand Code

 1terraform {
 2  required_version = "~> 1.9"
 3  required_providers {
 4  }
 5}
 6
 7provider "azurerm" {
 8  features {
 9  }
10}

Re-run terraform plan -var-file=development.tfvars now that we have updated the features block.

Set the subscription ID

Note that we once again get an error. This time, the error indicates that subscription_id is a required provider property for plan/apply operations. This is a change that was introduced as part of the version 4 release of the AzureRM provider. We need to supply the ID of the deployment subscription where our resources will be created.

First, we need to get the subscription ID value. We will use the portal for this exercise, but using the Azure CLI, PowerShell, or the resource graph will also work to retrieve this value.

Open the Azure portal.
Enter Subscriptions in the search field at the top middle of the page.
Select Subscriptions from the services menu in the search drop-down.
Select the subscription you wish to deploy to, from the list of subscriptions.
Find the Subscription ID field on the overview page and click the copy button to copy it to the clipboard.

Secondly, we need to update Terraform so that it can use the subscription ID. There are multiple ways to provide a subscription ID to the provider including adding it to the features block or using environment variables. For this scenario we’ll use environment variables to set the values so that we don’t have to re-enter them on each run. This also keeps us from storing the subscription ID in our code since it is considered a sensitive value. Select a command from the list below based on your operating system.

(Linux/MacOS) - Run the following command with your subscription ID: export ARM_SUBSCRIPTION_ID=<your ID here>
(Windows) - Run the following command with your subscription ID: set ARM_SUBSCRIPTION_ID=<your ID here>

Finally, we should now be able to complete our plan operation by re-running terraform plan -var-file=development.tfvars. Note that the plan will create three resources, two for telemetry and one for the resource group.

Deploy the resource group

We can complete testing by implementing the resource group. Run terraform apply -var-file="development.tfvars" and type yes and press enter when prompted to accept the changes. Terraform will create the resource group and notify you with a Apply complete message and a summary of the resources that were added, changed, and destroyed.

Deploy the Log Analytics Workspace

We can now continue by adding the Log Analytics Workspace to our main.tf file. We will follow a workflow similar to what we did with the resource group.

Browse to the AVM Log Analytics Workspace module page in the Terraform Registry.
Copy the module content from the Provision Instructions portion of the page into the main.tf file.

This time, instead of manually supplying module inputs, we will copy module content from one of the examples to minimize the amount of typing required. In most examples, the AVM module call is located at the bottom of the example.

Navigate to the Examples drop-down menu in the documentation and select the default example from the menu. You will see a fully functioning example code which includes the module and any supporting resources. Since we only care about the workspace resource from this example, we can scroll to the bottom of the code block and find the module "log_analytics_workspace" line.
Copy the content between the module brackets with the exception of the line defining the module source. Because these examples are part of the testing methodology for the module, they use a dot reference value (../..) for the module source value which will not work in our module call. To work around this, we copied those values from the provision instructions section of the module documentation in a previous step.
Update the location and resource group name values to reference outputs from the resource group module. Using implicit references such as these allow Terraform to determine the order in which resources should be built.
Update the name field using the prefix variable to allow for customization using a similar pattern to what we used on the resource group.

The Log Analytics module content should look like the following code block. For simplicity, you can also copy this directly to avoid multiple copy/paste actions.

➕ Expand Code

 1module "avm-res-operationalinsights-workspace" {
 2  source  = "Azure/avm-res-operationalinsights-workspace/azurerm"
 3  version = "0.4.2"
 4
 5  enable_telemetry                          = true
 6  location                                  = module.avm-res-resources-resourcegroup.resource.location
 7  resource_group_name                       = module.avm-res-resources-resourcegroup.name
 8  name                                      = "${var.name_prefix}-law"
 9  log_analytics_workspace_retention_in_days = 30
10  log_analytics_workspace_sku               = "PerGB2018"
11}

Again, we will need to run terraform init to allow Terraform to initialize a copy of the AVM Log Analytics module.

Now, we can deploy the Log Analytics workspace by running terraform apply -var-file="development.tfvars", typing yes and pressing enter. Note that Terraform will only create the new Log Analytics resources since the resource group already exists. This is one of the key benefits of deploying using Infrastructure as Code (IAC) tools like Terraform.

Note

Note that we ran the terraform apply command without first running terraform plan. Because terraform apply runs a plan before prompting for the apply, we opted to shorten the instructions by skipping the explicit plan step. If you are testing in a live environment, you may want to run the plan step and save the plan as part of your governance or change control processes.

Deploy the Azure Key Vault

Our solution calls for a simple Key Vault implementation to store virtual machine secrets. We’ll follow the same workflow for deploying the Key Vault as we used for the previous resource group and Log Analytics workspace resources. However, since Key Vaults require data roles to manage secrets and keys, we will need to use the RBAC interface and a data resource to configure Role-Based Access Control (RBAC) during the deployment.

Note

For this exercise, we will provision the deployment user with data rights on the Key Vault. In your environment, you will likely want to either provide additional roles as inputs or statically assign users, or groups to the Key Vault data roles. For simplicity we also set the Key Vault to have public access enabled due to us not being able to dictate a private deployment environment. In your environment where your deployment machine will be on a private network it is recommended to restrict public access for the Key Vault.

Before we implement the AVM module for the Key Vault, we want to use a data resource to read the client details about the user context of the current Terraform deployment.

Add the following line to your main.tf file and save it.

➕ Expand Code

1data "azurerm_client_config" "this" {}

Key vaults use a global namespace which means that we will also need to add a randomization resource to allow us to randomize the name to avoid any potential name intersection issues with other Key Vault deployments. We will use Terraform’s random provider to generate the random string which we will append to the Key Vault name. Add the following code to your main module to create the random_string resource we will use for naming.

➕ Expand Code

1resource "random_string" "name_suffix" {
2  length  = 4
3  special = false
4  upper   = false
5}

Now we can continue with adding the AVM Key Vault module to our solution.

Browse to the AVM Key Vault resource module page in the Terraform Registry.
Copy the module content from the Provision Instructions portion of the page into the main.tf file.
This time, we’re going to select relevant content from the Create secret example to fill out our module.
Copy the name, location, enable_telemetry, resource_group_name, tenant_id, and role_assignments value content from the example and paste it into the new Key Vault module in your solution.
Update the name value to be "${var.prefix}-kv-${random_string.name_suffix.result}"
Update the location and resource_group_name values to the same implicit resource group module references we used in the Log Analytics workspace.
Set the enable_telemetry value to true.
Leave the tenant_id and role_assignments values to the same values that are in the example.

Our architecture calls for us to include a diagnostic settings configuration for each resource that supports it. We’ll use the diagnostic-settings example to copy this content.

Return to the documentation page and select the diagnostic-settings option from the examples drop-down.
Locate the Key Vault resource in the example’s code block and copy the diagnostic_settings value and paste it into the Key Vault module block we’re building in main.tf.
Update the name value to use our prefix variable to allow for name customization.
Update the workspace_resource_id value to be an implicit reference to the output from the previously implemented Log Analytics module (module.avm-res-operationalinsights-workspace.resource_id in our code).

Finally, we will allow public access, so that our deployer machine can add secrets to the Key Vault. If your environment doesn’t allow public access for Key Vault deployments, locate the public IP address of your deployer machine (this may be an external NAT IP for your network) and add it to the network_acls.ip_rules list value using CIDR notation.

Set the network_acls input to null in your module block for the Key Vault.

Your Key Vault module definition should now look like the following:

➕ Expand Code

 1module "avm-res-keyvault-vault" {
 2  source  = "Azure/avm-res-keyvault-vault/azurerm"
 3  version = "0.10.0"
 4
 5  enable_telemetry    = true
 6  location            = module.avm-res-resources-resourcegroup.resource.location
 7  resource_group_name = module.avm-res-resources-resourcegroup.name
 8  name                = "${var.name_prefix}-kv-${random_string.name_suffix.result}"
 9  tenant_id           = data.azurerm_client_config.this.tenant_id
10  network_acls        = null
11
12  diagnostic_settings = {
13    to_la = {
14      name                  = "${var.name_prefix}-kv-diags"
15      workspace_resource_id = module.avm-res-operationalinsights-workspace.resource_id
16    }
17  }
18
19  role_assignments = {
20    deployment_user_kv_admin = {
21      role_definition_id_or_name = "Key Vault Administrator"
22      principal_id               = data.azurerm_client_config.this.object_id
23    }
24  }
25}

Note

One of the core values of AVM is the standard configuration for interfaces across modules. The Role Assignments interface we used as part of the Key Vault deployment is a good example of this.

Continue the incremental testing of your module by running another terraform init and terraform apply -var-file="development.tfvars" sequence.

Deploy the NAT Gateway

Our architecture calls for a NAT Gateway to allow virtual machines to access the internet. We will use the NAT Gateway resource_id output in future modules to link the virtual machine subnet.

Browse to the AVM NAT Gateway resource module page in the Terraform Registry.
Copy the module definition and source from the Provision Instructions card from the module main page.
Copy the remaining module content from the default example excluding the subnet associations map, as we will do the association when we build the vnet.
Update the location and resource_group_nameusing implicit references from our resource group module.
Then update each of the name values to use the name_prefix variables.

Review the following code to see each of these changes.

➕ Expand Code

 1module "avm-res-network-natgateway" {
 2  source  = "Azure/avm-res-network-natgateway/azurerm"
 3  version = "0.2.1"
 4
 5  name                = "${var.name_prefix}-natgw"
 6  enable_telemetry    = true
 7  location            = module.avm-res-resources-resourcegroup.resource.location
 8  resource_group_name = module.avm-res-resources-resourcegroup.name
 9
10  public_ips = {
11    public_ip_1 = {
12      name = "${var.name_prefix}-natgw-pip"
13    }
14  }
15}

Continue the incremental testing of your module by running another terraform init and terraform apply -var-file="development.tfvars" sequence.

Deploy the Network Security Group

Our architecture calls for a Network Security Group (NSG) allowing SSH access to the virtual machine subnet. We will use the NSG AVM resource module to accomplish this task.

Browse to the AVM Network Security Group resource module page in the Terraform Registry.
Copy the module definition and source from the Provision Instructions card from the module main page.
Copy the remaining module content from the example_with_NSG_rule example.
Update the location and resource_group_nameusing implicit references from our resource group module.
Update the name value using the name_prefix variable interpolation as we did with the other modules.
Copy the map entry labeled rule02 from the locals nsg_rules map and paste it between two curly braces to create the security_rules attribute in the NSG module we’re building.
Make the following updates to the rule details:
1. Rename the map key to "rule01" from "rule02".
2. Update the name to use the var.prefix interpolation and SSH to describe the rule.
3. Update the destination_port_ranges list to be ["22"].

Upon completion the code for the NSG module should be as follows:

➕ Expand Code

 1module "avm-res-network-networksecuritygroup" {
 2  source  = "Azure/avm-res-network-networksecuritygroup/azurerm"
 3  version = "0.4.0"
 4  resource_group_name = module.avm-res-resources-resourcegroup.name
 5  name                = "${var.name_prefix}-vm-subnet-nsg"
 6  location            = module.avm-res-resources-resourcegroup.resource.location
 7
 8  security_rules = {
 9    "rule01" = {
10      name                       = "${var.name_prefix}-ssh"
11      access                     = "Allow"
12      destination_address_prefix = "*"
13      destination_port_ranges    = ["22"]
14      direction                  = "Inbound"
15      priority                   = 200
16      protocol                   = "Tcp"
17      source_address_prefix      = "*"
18      source_port_range          = "*"
19    }
20  }
21}

Continue the incremental testing of your module by running another terraform init and terraform apply -var-file="development.tfvars" sequence.

Deploy the Virtual Network

We can now continue the build-out of our architecture by configuring the virtual network (vnet) deployment. This will follow a similar pattern as the previous resource modules, but this time, we will also add some network functions to help us customize the subnet configurations.

Browse to the AVM Virtual Network resource module page in the Terraform Registry.
Copy the module definition and source from the Provision Instructions card from the module main page.
After looking through the examples, this time, we’ll use the complete example as a source to copy our content.
Copy the resource_group_name, location, name, and address_space lines and replace their values with our deployment specific variables or module references.
We’ll copy the subnets map and duplicate the subnet0 map for each subnet.
Now we will update the map key and name values for each subnet so that they are unique.
Then we’ll use the cidrsubnet function to dynamically generate the CIDR range for each subnet. You can explore the function documentation for more details on how it can be used.
We will also populate the nat_gateway object on subnet0 with the resource_id output from our NAT Gateway module.
To configure the NSG on the VM subnet we need to link it. Add a network_security_group attribute to the subnet0 definition and replace the value with the resource_id output from the NSG module.
Finally, we’ll copy the diagnostic settings from the example and update the implicit references to point to our previously deployed Log Analytics workspace.

After making these changes our virtual network module call code will be as follows:

➕ Expand Code

 1module "avm-res-network-virtualnetwork" {
 2  source  = "Azure/avm-res-network-virtualnetwork/azurerm"
 3  version = "0.8.1"
 4
 5  resource_group_name = module.avm-res-resources-resourcegroup.name
 6  location            = module.avm-res-resources-resourcegroup.resource.location
 7  name                = "${var.name_prefix}-vnet"
 8
 9  address_space = [var.virtual_network_cidr]
10
11  subnets = {
12    subnet0 = {
13      name                            = "${var.name_prefix}-vm-subnet"
14      default_outbound_access_enabled = false
15      address_prefixes = [cidrsubnet(var.virtual_network_cidr, 1, 0)]
16      nat_gateway = {
17        id = module.avm-res-network-natgateway.resource_id
18      }
19      network_security_group = {
20        id = module.avm-res-network-networksecuritygroup.resource_id
21      }
22    }
23    bastion = {
24      name                            = "AzureBastionSubnet"
25      default_outbound_access_enabled = false
26      address_prefixes = [cidrsubnet(var.virtual_network_cidr, 1, 1)]
27    }
28  }
29
30  diagnostic_settings = {
31    sendToLogAnalytics = {
32      name                           = "${var.name_prefix}-vnet-diagnostic"
33      workspace_resource_id          = module.avm-res-operationalinsights-workspace.resource_id
34      log_analytics_destination_type = "Dedicated"
35    }
36  }
37}

Note

Note how the Log Analytics workspace reference ends in resource_id. Each AVM module is required to export its Azure resource ID with the resource_id name to allow for consistent references.

Continue the incremental testing of your module by running another terraform init and terraform apply -var-file="development.tfvars" sequence.

Deploy the Bastion service

We want to allow for secure remote access to the virtual machine for configuration and troubleshooting tasks. We’ll use Azure Bastion to accomplish this objective following a similar workflow to our other resources.

Browse to the AVM Bastion resource module page in the Terraform Registry.
Copy the module definition and source from the Provision Instructions card from the module main page.
Copy the remaining module content from the Simple Deployment example.
Update the location and resource_group_nameusing implicit references from our resource group module.
Update the name value using the name_prefix variable interpolation as we did with the other modules.
Finally, update the subnet_id value to include an implicit reference to the bastion keyed subnet from our virtual network module.

Our architecture calls for diagnostic settings to be configured on the Azure Bastion resource. In this case, there aren’t any examples that include this configuration. However, since the diagnostic settings interface is one of the standard interfaces in Azure Verified Modules, we can just copy the interface definition from our virtual network module.

Locate the virtual network module and copy the diagnostic_settings value from it.
Paste the diagnostic_settings value into the code for our Bastion module.
Update the diagnostic setting’s name value from vnet to Bastion.

The new code we added for the Bastion resource will be as follows:

➕ Expand Code

 1module "avm-res-network-bastionhost" {
 2  source  = "Azure/avm-res-network-bastionhost/azurerm"
 3  version = "0.7.2"
 4
 5  name                = "${var.name_prefix}-bastion"
 6  resource_group_name = module.avm-res-resources-resourcegroup.name
 7  location            = module.avm-res-resources-resourcegroup.resource.location
 8  ip_configuration = {
 9    subnet_id = module.avm-res-network-virtualnetwork.subnets["bastion"].resource_id
10  }
11
12  diagnostic_settings = {
13    sendToLogAnalytics = {
14      name                           = "${var.name_prefix}-bastion-diagnostic"
15      workspace_resource_id          = module.avm-res-operationalinsights-workspace.resource_id
16      log_analytics_destination_type = "Dedicated"
17    }
18  }
19}

Note

Pay attention to the subnet_id syntax. In the virtual network module, the subnets are created as a sub-module allowing us to reference each of them using the map key that was defined in the subnets input. Again, we see the consistent output naming with the resource_id output for the sub-module.

Continue the incremental testing of your module by running another terraform init and terraform apply -var-file="development.tfvars" sequence.

Deploy the virtual machine

The final step in our deployment will be our application virtual machine. We’ve had good success with our workflow so far, so we’ll use it for this step as well.

Browse to the AVM Virtual Machine resource module page in the Terraform Registry.
Copy the module definition and source from the Provision Instructions card from the module main page.
Copy the remaining module content from the linux_default example.
Update the location and resource_group_nameusing implicit references from our resource group module.
To be compliant with Well Architected Framework guidance we encourage defining a zone if your region supports it. Update the zone input to 1.
Update the sku_size input to “Standard_D2s_v5”.
Update the name values using the name_prefix variable interpolation as we did with the other modules and include the output from the random_string.name_suffix resource to add uniqueness.
Set the account_credentials.key_vault_configuration.resource_id value to reference the resource_id output from the Key Vault module.
Update the private_ip_subnet_resource_id value to an implicit reference to the subnet0 subnet output from the virtual network module.

Because the default Linux example doesn’t include diagnostic settings, we need to add that content in a different way. Since the diagnostic settings interface has a standard schema, we can copy the diagnostic_settings input from our virtual network module.

Locate the virtual network module in your code and copy the diagnostic_settings map from it.
Paste the diagnostic_settings content into your virtual machine module code.
Update the name value to reflect that it applies to the virtual machine.

The new code we added for the virtual machine resource will be as follows:

➕ Expand Code

 1module "avm-res-compute-virtualmachine" {
 2  source  = "Azure/avm-res-compute-virtualmachine/azurerm"
 3  version = "0.19.1"
 4
 5  enable_telemetry    = true
 6  location            = module.avm-res-resources-resourcegroup.resource.location
 7  resource_group_name = module.avm-res-resources-resourcegroup.name
 8  name                = "${var.name_prefix}-vm"
 9  os_type             = "Linux"
10  sku_size            = "Standard_D2s_v5"
11  zone                = 1
12
13  source_image_reference = {
14    publisher = "Canonical"
15    offer     = "0001-com-ubuntu-server-focal"
16    sku       = "20_04-lts-gen2"
17    version   = "latest"
18  }
19
20  network_interfaces = {
21    network_interface_1 = {
22      name = "${var.name_prefix}-nic-${random_string.name_suffix.result}"
23      ip_configurations = {
24        ip_configuration_1 = {
25          name                          = "${var.name_prefix}-ipconfig-${random_string.name_suffix.result}"
26          private_ip_subnet_resource_id = module.avm-res-network-virtualnetwork.subnets["subnet0"].resource_id
27        }
28      }
29    }
30  }
31
32  diagnostic_settings = {
33    sendToLogAnalytics = {
34      name                           = "${var.name_prefix}-vm-diagnostic"
35      workspace_resource_id          = module.avm-res-operationalinsights-workspace.resource_id
36      log_analytics_destination_type = "Dedicated"
37    }
38  }
39}

Continue the incremental testing of your module by running another terraform init and terraform apply -var-file="development.tfvars" sequence.

Creating the outputs.tf file

The final piece of our module is to export any values that may need to be consumed by module users. From our architecture, we’ll export the resource group name and the virtual machine resource name.

Create an outputs.tf file in your IDE.
Create an output named resource_group_name and set the value to an implicit reference to the resource group modules name output. Include a brief description for the output.
Create an output named virtual_machine_name and set the value to an implicit reference to the virtual machine module’s name output. Include a brief description for the output.

The new code we added for the outputs will be as follows:

➕ Expand Code

1output "resource_group_name" {
2  value =  module.avm-res-resources-resourcegroup.name
3  description = "The resource group name where the resources are deployed"
4}
5
6output "virtual_machine_name" {
7    value = module.avm-res-compute-virtualmachine.name
8    description = "The name of the virtual machine"
9}

Because no new modules were created, we don’t need to run terraform init to test this change. Run terraform apply -var-file="development.tfvars" to see the new outputs that have been created.

Update the terraform.tf file

It is a recommended practice to define the required versions of the providers for your module to ensure consistent behavior when it is being run. In this case we are going to be slightly permissive and allow increases in minor and patch versions to fluctuate, since those are not supposed to include breaking changes. In a production environment, you would likely want to pin on a specific version to guarantee behavior.

Run terraform init to review the providers and versions that are currently installed.
Update your terraform.tf file’s required providers field for each provider listed in the downloaded providers.

The updated code we added for the providers in the terraform.tf file will be as follows:

➕ Expand Code

 1terraform {
 2  required_version = "~> 1.9"
 3  required_providers {
 4    azapi = {
 5      source  = "azure/azapi"
 6      version = "~> 2.3"
 7    }
 8    azurerm = {
 9      source  = "hashicorp/azurerm"
10      version = "~> 4.27"
11    }
12    modtm = {
13      source  = "azure/modtm"
14      version = "~> 0.3"
15    }
16    random = {
17      source  = "hashicorp/random"
18      version = "~> 3.7"
19    }
20    time = {
21      source  = "hashicorp/time"
22      version = "~> 0.13"
23    }
24    tls = {
25      source  = "hashicorp/tls"
26      version = "~> 4.1"
27    }
28  }
29}
30
31provider "azurerm" {
32  features {
33  }
34}

Conclusion

Congratulations on successfully implementing a solution using Azure Verified Modules! You were able to build out our sample architecture using module documentation and taking advantage of features like standard interfaces and pre-defined defaults to simplify the development experience.

Note

This was a long exercise and mistakes can happen. If you’re getting errors or a resource is incomplete and you want to see the final main.tf, expand the following code block to see the full file.

➕ Expand Code

  1module "avm-res-resources-resourcegroup" {
  2  source  = "Azure/avm-res-resources-resourcegroup/azurerm"
  3  version = "0.2.1"
  4
  5  name = "${var.name_prefix}-rg"
  6  location = var.location
  7  tags = var.tags
  8}
  9
 10module "avm-res-operationalinsights-workspace" {
 11  source  = "Azure/avm-res-operationalinsights-workspace/azurerm"
 12  version = "0.4.2"
 13
 14  enable_telemetry                          = true
 15  location                                  = module.avm-res-resources-resourcegroup.resource.location
 16  resource_group_name                       = module.avm-res-resources-resourcegroup.name
 17  name                                      = "${var.name_prefix}-law"
 18  log_analytics_workspace_retention_in_days = 30
 19  log_analytics_workspace_sku               = "PerGB2018"
 20}
 21
 22data "azurerm_client_config" "this" {}
 23
 24resource "random_string" "name_suffix" {
 25  length  = 4
 26  special = false
 27  upper   = false
 28}
 29
 30module "avm-res-keyvault-vault" {
 31  source  = "Azure/avm-res-keyvault-vault/azurerm"
 32  version = "0.10.0"
 33
 34  enable_telemetry    = true
 35  location            = module.avm-res-resources-resourcegroup.resource.location
 36  resource_group_name = module.avm-res-resources-resourcegroup.name
 37  name                = "${var.name_prefix}-kv-${random_string.name_suffix.result}"
 38  tenant_id           = data.azurerm_client_config.this.tenant_id
 39  network_acls        = null
 40
 41  diagnostic_settings = {
 42    to_la = {
 43      name                  = "${var.name_prefix}-kv-diags"
 44      workspace_resource_id = module.avm-res-operationalinsights-workspace.resource_id
 45    }
 46  }
 47
 48  role_assignments = {
 49    deployment_user_kv_admin = {
 50      role_definition_id_or_name = "Key Vault Administrator"
 51      principal_id               = data.azurerm_client_config.this.object_id
 52    }
 53  }
 54}
 55
 56module "avm-res-network-natgateway" {
 57  source  = "Azure/avm-res-network-natgateway/azurerm"
 58  version = "0.2.1"
 59
 60  name                = "${var.name_prefix}-natgw"
 61  enable_telemetry    = true
 62  location            = module.avm-res-resources-resourcegroup.resource.location
 63  resource_group_name = module.avm-res-resources-resourcegroup.name
 64
 65  public_ips = {
 66    public_ip_1 = {
 67      name = "${var.name_prefix}-natgw-pip"
 68    }
 69  }
 70}
 71
 72module "avm-res-network-virtualnetwork" {
 73  source  = "Azure/avm-res-network-virtualnetwork/azurerm"
 74  version = "0.8.1"
 75
 76  resource_group_name = module.avm-res-resources-resourcegroup.name
 77  location            = module.avm-res-resources-resourcegroup.resource.location
 78  name                = "${var.name_prefix}-vnet"
 79
 80  address_space = [var.virtual_network_cidr]
 81
 82  subnets = {
 83    subnet0 = {
 84      name                            = "${var.name_prefix}-vm-subnet"
 85      default_outbound_access_enabled = false
 86      address_prefixes = [cidrsubnet(var.virtual_network_cidr, 1, 0)]
 87      nat_gateway = {
 88        id = module.avm-res-network-natgateway.resource_id
 89      }
 90      network_security_group = {
 91        id = module.avm-res-network-networksecuritygroup.resource_id
 92      }
 93    }
 94    bastion = {
 95      name                            = "AzureBastionSubnet"
 96      default_outbound_access_enabled = false
 97      address_prefixes = [cidrsubnet(var.virtual_network_cidr, 1, 1)]
 98    }
 99  }
100
101  diagnostic_settings = {
102    sendToLogAnalytics = {
103      name                           = "${var.name_prefix}-vnet-diagnostic"
104      workspace_resource_id          = module.avm-res-operationalinsights-workspace.resource_id
105      log_analytics_destination_type = "Dedicated"
106    }
107  }
108}
109
110module "avm-res-network-bastionhost" {
111  source  = "Azure/avm-res-network-bastionhost/azurerm"
112  version = "0.7.2"
113
114  name                = "${var.name_prefix}-bastion"
115  resource_group_name = module.avm-res-resources-resourcegroup.name
116  location            = module.avm-res-resources-resourcegroup.resource.location
117  ip_configuration = {
118    subnet_id = module.avm-res-network-virtualnetwork.subnets["bastion"].resource_id
119  }
120
121  diagnostic_settings = {
122    sendToLogAnalytics = {
123      name                           = "${var.name_prefix}-bastion-diagnostic"
124      workspace_resource_id          = module.avm-res-operationalinsights-workspace.resource_id
125      log_analytics_destination_type = "Dedicated"
126    }
127  }
128}
129
130module "avm-res-network-networksecuritygroup" {
131  source  = "Azure/avm-res-network-networksecuritygroup/azurerm"
132  version = "0.4.0"
133  resource_group_name = module.avm-res-resources-resourcegroup.name
134  name                = "${var.name_prefix}-vm-subnet-nsg"
135  location            = module.avm-res-resources-resourcegroup.resource.location
136
137  security_rules = {
138    "rule01" = {
139      name                       = "${var.name_prefix}-ssh"
140      access                     = "Allow"
141      destination_address_prefix = "*"
142      destination_port_ranges    = ["22"]
143      direction                  = "Inbound"
144      priority                   = 200
145      protocol                   = "Tcp"
146      source_address_prefix      = "*"
147      source_port_range          = "*"
148    }
149  }
150}
151
152module "avm-res-compute-virtualmachine" {
153  source  = "Azure/avm-res-compute-virtualmachine/azurerm"
154  version = "0.19.1"
155
156  enable_telemetry    = true
157  location            = module.avm-res-resources-resourcegroup.resource.location
158  resource_group_name = module.avm-res-resources-resourcegroup.name
159  name                = "${var.name_prefix}-vm"
160  os_type             = "Linux"
161  sku_size            = "Standard_D2s_v5"
162  zone                = 1
163
164  source_image_reference = {
165    publisher = "Canonical"
166    offer     = "0001-com-ubuntu-server-focal"
167    sku       = "20_04-lts-gen2"
168    version   = "latest"
169  }
170
171  network_interfaces = {
172    network_interface_1 = {
173      name = "${var.name_prefix}-nic-${random_string.name_suffix.result}"
174      ip_configurations = {
175        ip_configuration_1 = {
176          name                          = "${var.name_prefix}-ipconfig-${random_string.name_suffix.result}"
177          private_ip_subnet_resource_id = module.avm-res-network-virtualnetwork.subnets["subnet0"].resource_id
178        }
179      }
180    }
181  }
182
183  diagnostic_settings = {
184    sendToLogAnalytics = {
185      name                           = "${var.name_prefix}-vm-diagnostic"
186      workspace_resource_id          = module.avm-res-operationalinsights-workspace.resource_id
187      log_analytics_destination_type = "Dedicated"
188    }
189  }
190}

AVM modules provide several key advantages over writing raw Terraform templates:

Simplified Resource Configuration: AVM modules handle much of the complex configuration work behind the scenes
Built-in Recommended Practices: The modules implement many of Microsoft’s recommended practices by default
Consistent Outputs: Each module exposes a consistent set of outputs that can be easily referenced
Reduced Boilerplate Code: What would normally require hundreds of lines of Terraform code can be accomplished in a fraction of the space

Additional exercises

For additional learning, it can be helpful to experiment with modifying this solution. Here are some ideas you can try if you have time and would like to experiment further.

Use the managed_identities interface to add a system assigned managed identity to the virtual machine and give it Key Vault Administrator rights on the Key Vault.
Use the tags interface to assign tags directly to one or more resources.
Add an Azure Monitoring Agent extension to the virtual machine resource.
Add additional inputs like VM sku to your module to make it more customizable. Be sure to update the code and tfvars files to match.

Clean up your environment

Once you have completed this set of exercises, it is a good idea to clean up your resources to avoid incurring costs for them. This can be done typing terraform destroy -var-file=development.tfvars and entering yes when prompted.

Solution Development

Considerations and steps of Solution Development

Decide on the IaC language (Bicep or Terraform)
Decide on the module sourcing method (public registry, private registry, inner-sourcing)
Decide on the orchestration method (template or pipeline)
Identify the resources needed for the solution (are they all available in AVM?)
Implement, validate, deploy, test the solution

Questions to cover on this page

Pick a realistically complex solution and demonstrate how to build it using AVM modules
Best practices for coding (link to official language specific guidance AND AVM specs where/if applicable)
Best practices for input and output parameters

Next steps

To be covered in separate, future articles.

To make this solution enterprise-ready, you need to consider the following:

Deploy with DevOps tools and practices (e.g., CI/CD in Azure DevOps, GitHub Actions, etc.)
Deploy into Azure Landing Zones (ALZ)
Make sure the solution follows the recommendations of the Well-Architected Framework (WAF) and it’s compliant with and integrates into your organization’s policies and standards, e.g.:
- Security & Identity (e.g., RBAC, Entra ID, service principals, secrets management, MFA, etc.)
- Networking (e.g., Azure Firewall, NSGs, etc.)
- Monitoring (e.g., Azure Monitor, Log Analytics, etc.)
- Cost management (e.g., Azure Cost Management, budgets, etc.)
- Governance (e.g., Azure Policy, etc.)

Other recommendations

Don’t use latest, but a specific version of the module
Don’t expose secrets in output parameters/command line/logs/etc.
Don’t use hard-coded values, but use parameters and variables

Quickstart Guide

This QuickStart guide offers step-by-step instructions for integrating Azure Verified Modules (AVM) into your solutions. It includes the initial setup, essential tools, and configurations required to deploy and manage your Azure resources efficiently using AVM.

The AVM Key Vault resource module, used as an example in this chapter, simplifies the deployment and management of Azure Key Vaults, ensuring secure storage and access to your secrets, keys, and certificates.

Leveraging Azure Verified Modules

Using AVM ensures that your infrastructure-as-code deployments follow Microsoft’s best practices and guidelines, providing a consistent and reliable foundation for your cloud solutions. AVM helps accelerate your development process, reduce the risk of misconfigurations, and enhance the security and compliance of your applications.

Using default values

The default values provided by AVM are generally safe, as they follow best practices and ensure a secure and reliable setup. However, it is important to review these values to ensure they meet your specific requirements and compliance needs. Customizing the default values may be necessary to align with your organization’s policies and the specific needs of your solution.

Exploring examples and module features

You can find examples and detailed documentation for each AVM module in their respective code repository’s README.MD file, which details features, input parameters, and outputs. The module’s documentation also provides comprehensive usage examples, covering various scenarios and configurations. Additionally, you can explore the module’s source code repository. This information will help you understand the full capabilities of the module and how to effectively integrate it into your solutions.

Bicep Quickstart Guide

Introduction

This guide explains how to use an Azure Verified Modules (AVM) in your Bicep workflow. By leveraging AVM modules, you can rapidly deploy and manage Azure infrastructure without having to write extensive code from scratch.

In this guide, you will deploy a Key Vault resource and a Personal Access Token as a secret.

This article is intended for a typical ‘infra-dev’ user (cloud infrastructure professional) who has a basic understanding of Azure and Bicep but is new to Azure Verified Modules and wants to learn how to deploy a module in the easiest way using AVM.

For additional Bicep learning resources use the Bicep documentation on the Microsoft Learn platform, or leverage the Fundamentals of Bicep learning path.

Prerequisites

You will need the following tools and components to complete this guide:

Visual Studio Code (VS Code) to develop your solution.
Bicep Visual Studio Code Extension to author your Bicep template and explore modules published in the Registry.
One of the following command line tools:
- PowerShell AND Azure PowerShell
- Azure CLI to deploy your solution.
Bicep CLI
Azure Subscription to deploy your Bicep templates.

Make sure you have these tools set up before proceeding.

Module Discovery

Find your module

In this scenario, you need to deploy a Key Vault resource and some of its child resources, such as a secret. Let’s find the AVM module that will help us achieve this.

There are two primary ways for locating published Bicep Azure Verified Modules:

Option 1 (preferred): Using IntelliSense in the Bicep extension of Visual Studio Code, and
Option 2: browsing the AVM Bicep module index.

Option 1: Use the Bicep Extension in VS Code

In VS Code, create a new file called main.bicep.
Start typing module, then give your module a symbolic name, such as myModule.
Use IntelliSense to select br/public.
The list of all AVM modules published in the Bicep Public Registry will show up. Use this to explore the published modules.
Note
The Bicep VSCode extension is reading metadata through this JSON file. All modules are added to this file, as part of the publication process. This lists all the modules marked as Published or Orphaned on the AVM Bicep module index pages.
Select the module you want to use and the version you want to deploy. Note how you can type full or partial module names to filter the list.
Right click on the module’s path and select Go to definition or hit F12 to see the module’s source code. You can toggle between the Bicep and the JSON view.
Hover over the module’s symbolic name to view its documentation URL. By clicking on it, you will be directed to the module’s GitHub folder in the bicep-registry-modules (BRM) repository. There, you can access the source code and documentation, as illustrated below.

Option 2: Use the AVM Bicep Module Index

Searching the Azure Verified Modules indexes is the most complete way to discover published as well as planned (proposed) modules. As shown in the video above, use the following steps to locate a specific module on the AVM website:

Open the AVM website in your favorite web browser: https://aka.ms/avm.
Expand the Module Indexes menu item and select the Bicep sub-menu item.
Select the menu item for the module type you are searching for: Resource, Pattern, or Utility.
Note
Since the Key Vault module used as an example in this guide is published as an AVM resource module, it can be found under the resource modules section in the AVM Bicep module index.
A detailed description of module classification types can be found under the related section here.
Select the Published modules link from the table of contents at the top of the page.
Use the in-page search feature of your browser. In most Windows browsers you can access it using the CTRL + F keyboard shortcut.
Enter a search term to find the module you are looking for - e.g., Key Vault.
Move through the search results until you locate the desired module. If you are unable to find a published module, return to the table of contents and expand the All modules link to search both published and proposed modules - i.e., modules that are planned, likely in development but not published yet.
After finding the desired module, click on the module’s name. This link will lead you to the module’s folder in the bicep-registry-modules (BRM) repository, where the module’s source code and documentation can be found, including usage examples.

Module details and examples

In the module’s documentation, you can find detailed information about the module’s functionality, components, input parameters, outputs and more. The documentation also provides comprehensive usage examples, covering various scenarios and configurations.

Explore the Key Vault module’s documentation for usage examples and to understand its functionality, input parameters, and outputs.

Note the mandatory and optional parameters in the Parameters section.
Review the Usage examples section. AVM modules include multiple tests that can be found under the tests folder. These tests are also used as the basis of the usage examples ensuring they are always up-to-date and deployable.

In this example, you will deploy a secret in a new Key Vault instance with minimal input. AVM provides default parameter values with security and reliability being core principles. These settings apply the recommendations of the Well Architected Framework where possible and appropriate.

Note how Example 2 does most of what you need to achieve.

Create your new solution using AVM

In this section, you will develop a Bicep template that references the AVM Key Vault module and its child resources and features. These include secret and role based access control configurations that grant permissions to a user.

Start VSCode (make sure the Bicep extension is installed) and open a folder in which you want to work.
Create a main.bicep and a dev.bicepparam file, which will hold parameters for your Key Vault deployment.
Copy the content below into your main.bicep file. We have included comments to distinguish between the two different occurrences of the names attribute.

module myKeyVault 'br/public:avm/res/key-vault/vault:0.11.0' = {
  name: // the name of the module's deployment
  params: {
    name: '<keyVaultName>' // the name of the Key Vault instance - length and character limits apply
  }
}

Note

For Azure Key Vaults, the name must be globally unique. When you deploy the Key Vault, ensure you select a name that is alphanumeric, twenty-four characters or less, and unique enough to ensure no one else has used the name for their Key Vault. If the name has been previously taken, you will get an error.

After setting the values for the required properties, the module can be deployed. This minimal configuration automatically applies the security and reliability recommendations of the Well Architected Framework where possible and appropriate. These settings can be overridden if needed.

Bicep-specific configuration

It is recommended to create a bicepconfig.json file, and enable use-recent-module-versions, which warns you to use the latest available version of the AVM module.

// This is a Bicep configuration file. It can be used to control how Bicep operates and to customize
// validation settings for the Bicep linter. The linter relies on these settings when evaluating your
// Bicep files for best practices. For further information, please refer to the official documentation at:
// https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-config
{
  "analyzers": {
    "core": {
      "rules": {
        "use-recent-module-versions": {
          "level": "warning",
          "message": "The module version is outdated. Please consider updating to the latest version."
        }
      }
    }
  }
}

Define the Key Vault instance

In this scenario - and every other real-world setup - there is more that you need to configure. You can open the module’s documentation by hovering over its symbolic name to see all of the module’s capabilities - including supported parameters.

Note

The Bicep extension facilitates code-completion, enabling you to easily locate and utilize the Azure Verified Module. This feature also provides the necessary properties for a module, allowing you to begin typing and leverage IntelliSense for completion.

Add parameters and values to the main.bicep file to customize your configuration. These parameters are used for passing in the Key Vault name and enabling purge protection. You might not want to enable the latter in a non-production environment, as it makes it harder to delete and recreate resources.

The main.bicep file will now look like this:

// the scope, the deployment deploys resources to
targetScope = 'resourceGroup'

// parameters and default values
param keyVaultName string

@description('Disable for development deployments.')
param enablePurgeProtection bool = true

// the resources to deploy
module myKeyVault 'br/public:avm/res/key-vault/vault:0.11.0' = {
  name: 'key-vault-deployment'
  params: {
    name: keyVaultName
    enablePurgeProtection: enablePurgeProtection
    // more properties are not needed, as AVM provides default values
  }
}

Note that the Key Vault instance will be deployed within a resource group scope in our example.

Create a dev.bicepparam file (this is optional) and set parameter values for your environment. You can now pass these values by referencing this file at the time of deployment (using PowerShell or Azure CLI).

using 'main.bicep'

// environment specific values
param keyVaultName = '<keyVaultName>'
param enablePurgeProtection = false

Create a secret and set permissions

Add a secret to the Key Vault instance and grant permissions to a user to work with the secret. Sample role assignments can be found in Example 3: Using large parameter set. See Parameter: roleAssignments for a list of pre-defined roles that you can reference by name instead of a GUID. This is a key benefit of using AVM, as the code is easy to read and increases the maintainability.

You can also leverage User-defined data types and simplify the parameterization of the modules instead of guessing or looking up parameters. Therefore, first import UDTs from the Key Vault and common types module and leverage the UDTs in your Bicep and parameter files.

For a role assignment, the principal ID is needed, that will be granted a role (specified by its name) on the resource. Your own ID can be found out with az ad signed-in-user show --query id.

// the scope, the deployment deploys resources to
targetScope = 'resourceGroup'

// parameters and default values
param keyVaultName string
// the PAT token is a secret and should not be stored in the Bicep(parameter) file.
// It can be passed via the commandline, if you don't use a parameter file.
@secure()
param patToken string = newGuid()

@description('Enabled by default. Disable for development deployments')
param enablePurgeProtection bool = true

import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.4.0'
// the role assignments are optional in the Key Vault module
param roleAssignments roleAssignmentType[]?

// the resources to deploy
module myKeyVault 'br/public:avm/res/key-vault/vault:0.11.0' = {
  name: 'key-vault-deployment'
  params: {
    name: keyVaultName
    enablePurgeProtection: enablePurgeProtection
    secrets: [
      {
        name: 'PAT'
        value: patToken
      }
    ]
    roleAssignments: roleAssignments
  }
}

The secrets parameter references a UDT (User-defined data type) that is part of the Key Vault module and enables code completion for easy usage. There is no need to look up what attributes the secret object might have. Start typing and tab-complete what you need from the content offered by the Bicep extension’s integration with AVM.

The bicep parameter file now looks like this:

// reference to the Bicep file to set the context
using 'main.bicep'

// environment specific values
param keyVaultName = '<keyVaultName>'
param enablePurgeProtection = false
// for security reasons, the secret value must not be stored in this file.
// You can change it later in the deployed Key Vault instance, where you also renew it after expiration.

param roleAssignments = [
  {
    principalId: '<principalId>'
    // using the name of the role instead of looking up the GUID (which can also be used)
    roleDefinitionIdOrName: 'Key Vault Secrets Officer'
  }
]

Note

The display names for roleDefinitionIdOrName can be acquired the following two ways:

From the parameters section of the module’s documentation.
From the builtInRoleNames variable in the module’s source code. To get there, hit F12 while the cursor is on the part of the module path starting with br/public:.

Boost your development with VS Code IntelliSense

Leverage the IntelliSense feature in VS Code to speed up your development process. IntelliSense provides code completion, possible parameter values and structure. It helps you write code more efficiently by providing context-aware suggestions as you type.

Here is how quickly you can deliver the solution detailed in this section:

Deploy your solution

Now that your template and parameter file is ready, you can deploy your solution to Azure. Use PowerShell or the Azure CLI to deploy your solution.

Deploy with

# Log in to Azure
Connect-AzAccount

# Select your subscription
Set-AzContext -SubscriptionId '<subscriptionId>'

# Deploy a resource group
New-AzResourceGroup -Name 'avm-quickstart-rg' -Location 'germanywestcentral'

# Invoke your deployment
New-AzResourceGroupDeployment -DeploymentName 'avm-quickstart-deployment' -ResourceGroupName 'avm-quickstart-rg' -TemplateParameterFile 'dev.bicepparam' -TemplateFile 'main.bicep'

# Log in to Azure
az login

# Select your subscription
az account set --subscription '<subscriptionId>'

# Deploy a resource group
az group create --name 'avm-quickstart-rg' --location 'germanywestcentral'

# Invoke your deployment
az deployment group create --name 'avm-quickstart' --resource-group 'avm-quickstart-rg' --template-file 'main.bicep' --parameters 'dev.bicepparam'

Use the Azure portal, Azure PowerShell, or the Azure CLI to verify that the Key Vault instance and secret have been successfully created with the correct configuration.

Clean up your environment

When you are ready, you can remove the infrastructure deployed in this example. The following commands will remove all resources created by your deployment:

Clean up with

# Delete the resource group
Remove-AzResourceGroup -Name "avm-quickstart-rg" -Force

# Purge the Key Vault
Remove-AzKeyVault -VaultName "<keyVaultName>" -Location "germanywestcentral" -InRemovedState -Force

# Delete the resource group
az group delete --name 'avm-quickstart-rg' --yes --no-wait

# Purge the Key Vault
az keyvault purge --name '<keyVaultName>' --no-wait

Congratulations, you have successfully leveraged an AVM Bicep module to deploy resources in Azure!

Tip

We welcome your contributions and feedback to help us improve the AVM modules and the overall experience for the community!

Next Steps

For developing a more advanced solution, please see the lab titled “Introduction to using Azure Verified Modules for Bicep”.

Terraform Quickstart Guide

Introduction

This guide explains how to use an Azure Verified Modules (AVM) in your Terraform workflow. With AVM modules, you can quickly deploy and manage Azure infrastructure without writing extensive code from scratch.

In this guide, you will deploy a Key Vault resource and generate and store a key.

This article is intended for a typical ‘infra-dev’ user (cloud infrastructure professional) who is new to Azure Verified Modules and wants to learn how to deploy a module in the easiest way using AVM. The user has a basic understanding of Azure and Terraform.

For additional Terraform resources, try a tutorial on the HashiCorp website or study the detailed documentation.

Prerequisites

You will need the following tools and components to complete this guide:

Visual Studio Code (VS Code) to develop your solution.
Terraform CLI to deploy your Terraform modules. Make sure you have a recent version installed.
Azure CLI to authenticate to Azure.
Azure Subscription to deploy your resources.

Before you begin, ensure you have these tools installed in your development environment.

Module Discovery

Find your module

In this scenario, you need to deploy a Key Vault resource and some of its child resources, such as a key. Let’s find the AVM module that will help us achieve this.

There are two primary ways for locating published Terraform Azure Verified Modules:

Searching the official Terraform Registry, and
Browsing theAVM Terraform module index.

Use the Terraform Registry

The easiest way to find published AVM Terraform modules is by searching the Terraform Registry. Follow these steps to locate a specific module, as shown in the video above.

Use your web browser to go to the HashiCorp Terraform Registry
In the search bar at the top of the screen type avm. Optionally, append additional search terms to narrow the search results. (e.g., avm key vault for AVM modules with Key Vault in the name.)
Select see all to display the full list of published modules matching your search criteria.
Find the module you wish to use and select it from the search results.

Note

It is possible to discover other unofficial modules with avm in the name using this search method. Look for the Partner tag in the module title to determine if the module is part of the official set.

Use the AVM Terraform Module Index

Searching the Azure Verified Modules indexes is the most complete way to discover published as well as planned modules - shown as proposed. As presented in the video above, use the following steps to locate a specific module on the AVM website:

Use your web browser to open the AVM website at https://aka.ms/avm.
Expand the Module Indexes menu item and select the Terraform sub-menu item.
Select the menu item for the module type you are searching for: Resource, Pattern, or Utility.
Note
Since the Key Vault module used as an example in this guide is published as an AVM resource module, it can be found under the resource modules section in the AVM Terraform module index.
A detailed description of each module classification type can be found under the related section here.
Select the Published modules link from the table of contents at the top of the page.
Use the in-page search feature of your browser (in most Windows browsers you can access it using the CTRL + F keyboard shortcut).
Enter a search term to find the module you are looking for - e.g., Key Vault.
Move through the search results until you locate the desired module. If you are unable to find a published module, return to the table of contents and expand the All modules link to search both published and proposed modules - i.e., modules that are planned, likely in development but not published yet.
After finding the desired module, click on the module’s name. This link will lead you to the official HashiCorp Terraform Registry page for the module where you can find the module’s documentation and examples.

Module details and examples

Once you have identified the AVM module in the Terraform Registry you can find detailed information about the module’s functionality, components, input parameters, outputs and more. The documentation also provides comprehensive usage examples, covering various scenarios and configurations.

Explore the Key Vault module’s documentation and usage examples to understand its functionality, input variables, and outputs.

Note the Examples drop-down list and explore each example
Review the Readme tab to see module provider minimums, a list of resources and data sources used by the module, a nicely formatted version of the inputs and outputs, and a reference to any submodules that may be called.
Explore the Inputs tab and observe how each input has a detailed description and a type definition for you to use when adding input values to your module configuration.
Explore the Outputs tab and review each of the outputs that are exported by the AVM module for use by other modules in your deployment.
Finally, review the Resources tab to get a better understanding of the resources defined in the module.

In this example, you will deploy a secret in a new Key Vault instance without needing to provide other parameters. The AVM Key Vault resource module provides these capabilities and does so with security and reliability being core principles. The default settings of the module also apply the recommendations of the Well Architected Framework where possible and appropriate.

Note how the create-key example seems to do what you need to achieve.

Create your new solution using AVM

Now that you have found the module details, you can use the content from the Terraform Registry to speed up your development in the following ways:

Option 1: Create a solution using AVM module examples: duplicate a module example and edit it for your needs. This is useful if you are starting without any existing infrastructure and need to create supporting resources like resource groups as part of your deployment.
Option 2: Create a solution by changing the AVM module input values: add the AVM module to an existing solution that already includes other resources. This method requires some knowledge of the resource(s) being deployed so that you can make choices about optional features configured in your solution’s version of the module.

Each deployment method includes a section below so that you can choose the method which best fits your needs.

Note

Option 1: Create a solution using AVM module examples

Leverage the following steps as a template for how to leverage examples for bootstrapping your new solution code. The Key Vault resource module is used here as an example, but in practice you may choose any module that applies to your scenario.

Locate and select the Examples drop down menu in the middle of the Key Vault module page.
From the drop-down list select an example whose name most closely aligns with your scenario - e.g., create-key.
When the example page loads, read the example description to determine if this is the desired example. If it is not, return to the module main page, and select a different example until you are satisfied that the example covers the scenario you are trying to deploy. If you are unable to find a suitable example, leverage the last two steps in the option 2 instructions to modify the inputs of the selected example to match your requirements.
Scroll to the code block for the example and select the Copy button on the top right of the block to copy the content to the clipboard.

➕ Click here to copy the sample code from the video.

provider "azurerm" {
  features {}
}

terraform {
  required_version = "~> 1.9"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.71"
    }
    http = {
      source  = "hashicorp/http"
      version = "~> 3.4"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"
    }
  }
}

module "regions" {
  source  = "Azure/avm-utl-regions/azurerm"
  version = "0.1.0"
}

# This allows us to randomize the region for the resource group.
resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

# This ensures you have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "this" {
  location = module.regions.regions[random_integer.region_index.result].name
  name     = module.naming.resource_group.name_unique
}

# Get current IP address for use in KV firewall rules
data "http" "ip" {
  url = "https://api.ipify.org/"
  retry {
    attempts     = 5
    max_delay_ms = 1000
    min_delay_ms = 500
  }
}

data "azurerm_client_config" "current" {}

module "key_vault" {
  source                        = "Azure/avm-res-keyvault-vault/azurerm"
  name                          = module.naming.key_vault.name_unique
  location                      = azurerm_resource_group.this.location
  enable_telemetry              = var.enable_telemetry
  resource_group_name           = azurerm_resource_group.this.name
  tenant_id                     = data.azurerm_client_config.current.tenant_id
  public_network_access_enabled = true
  keys = {
    cmk_for_storage_account = {
      key_opts = [
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey"
      ]
      key_type: "RSA"
      name     = "cmk-for-storage-account"
      key_size = 2048
    }
  }
  role_assignments = {
    deployment_user_kv_admin = {
      role_definition_id_or_name = "Key Vault Administrator"
      principal_id               = data.azurerm_client_config.current.object_id
    }
  }
  wait_for_rbac_before_key_operations = {
    create = "60s"
  }
  network_acls = {
    bypass   = "AzureServices"
    ip_rules = ["${data.http.ip.response_body}/32"]
  }
}

In your IDE - Visual Studio Code in our example - create the main.tf file for your new solution.
Paste the content from the clipboard into main.tf.
AVM examples frequently use naming and/or region selection AVM utility modules to generate deployment region and/or naming values as well as any default values for required fields. If you want to use a specific region name or other custom resource values, remove the existing region and naming module calls and replace example input values with the new desired custom input values.
Once supporting resources such as resource groups have been modified, locate the module call for the AVM module - i.e., module "keyvault".
AVM module examples use dot notation for a relative reference that is useful during module testing. However, you will need to replace the relative reference with a source reference that points to the Terraform Registry source location. In most cases, this source reference has been left as a comment in the module example to simplify replacing the existing source dot reference. Perform the following two actions to update the source:
- Delete the existing source definition that uses a dot reference - i.e., source = "../../".
- Uncomment the Terraform Registry source reference by deleting the # sign at the start of the commented source line - i.e., source = "Azure/avm-res-keyvault-vault/azurerm".
Note
If the module example does not include a commented Terraform Registry source reference, you will need to copy it from the module’s main documentation page. Use the following steps to do so:
- Use the breadcrumbs to leave the example documentation and return to the module’s primary Terraform Registry documentation page.
- Locate the Provision Instructions box on the right side of the module’s Terraform Registry page in your web browser.
- Select the second line that starts with source = from the code block - e.g., source = "Azure/avm-res-keyvault-vault/azurerm". Copy it onto the clipboard.
- Return to your code solution and Paste the clipboard’s content where you previously deleted the source dot reference - e.g., source = "../../".
AVM module examples use a variable to enable or disable the telemetry collection. Update the enable_telemetry input value to true or false. - e.g. enable_telemetry = true
Save your main.tf file changes and then proceed to the guide section for running your solution code.

Option 2: Create a solution by changing the AVM module input values

Click here to copy the sample code from the video.

module "avm-res-keyvault-vault" {
  source                        = "Azure/avm-res-keyvault-vault/azurerm"
  version                       = "0.9.1"
  name                          = "<custom_name_here>"
  resource_group_name           = azurerm_resource_group.this.name
  location                      = azurerm_resource_group.this.location
  tenant_id                     = data.azurerm_client_config.this.tenant_id

  keys = {
    cmk_for_storage_account = {
      key_opts = [
        "decrypt",
        "encrypt",
        "sign",
        "unwrapKey",
        "verify",
        "wrapKey"
      ]
      key_type: "RSA"
      name     = "cmk-for-storage-account"
      key_size = 2048
    }
  }
  role_assignments = {
    deployment_user_kv_admin = {
      role_definition_id_or_name = "Key Vault Administrator"
      principal_id               = data.azurerm_client_config.current.object_id
    }
  }
  wait_for_rbac_before_key_operations = {
    create = "60s"
  }
}

Use the following steps as a guide for the custom implementation of an AVM Module in your solution code. This instruction path assumes that you have an existing Terraform file that you want to add the AVM module to.

Locate the Provision Instructions box on the right side of the module’s Terraform Registry page in your web browser.
Select the module template code from the code block and Copy it onto the clipboard.
Switch to your IDE and Paste the contents of the clipboard into your solution’s .tf Terraform file - main.tf in our example.
Return to the module’s Terraform Registry page in the browser and select the Inputs tab.
Review each input and add the inputs with the desired target value to the solution’s code - i.e., name = "custom_name".
Once you are satisfied that you have included all required inputs and any optional inputs, Save your file and continue to the next section.

Deploy your solution

After completing your solution development, you can move to the deployment stage. Follow these steps for a basic Terraform workflow:

Open the command line and login to Azure using the Azure cli
```
az login
```
If your account has access to multiple tenants, you may need to modify the command to az login --tenant <tenant id> where “<tenant id>” is the guid for the target tenant.
After logging in, select the target subscription from the list of subscriptions that you have access to.
Change the path to the directory where your completed terraform solution files reside.
Note
Many AVM modules depend on the AzureRM 4.0 Terraform provider which mandates that a subscription id is configured. If you receive an error indicating that subscription_id is a required provider property, you will need to set a subscription id value for the provider. For Unix based systems (Linux or MacOS) you can configure this by running export ARM_SUBSCRIPTION_ID=<your subscription guid> on the command line. On Microsoft Windows, you can perform the same operation by running set ARM_SUBSCRIPTION_ID="<your subscription guid>" from the Windows command prompt or by running $env:ARM_SUBSCRIPTION_ID="<your subscription guid>" from a powershell prompt. Replace the “<your subscription id>” notation in each command with your Azure subscription’s unique id value.
Initialize your Terraform project. This command downloads the necessary providers and modules to the working directory.
```
terraform init
```
Before applying the configuration, it is good practice to validate it to ensure there are no syntax errors.
```
terraform validate
```
Create a deployment plan. This step shows what actions Terraform will take to reach the desired state defined in your configuration.
```
terraform plan
```
Review the plan to ensure that only the desired actions are in the plan output.
Apply the configuration and create the resources defined in your configuration file. This command will prompt you to confirm the deployment prior to making changes. Type yes to create your solution’s infrastructure.
```
terraform apply
```
Info
If you are confident in your changes, you can add the -auto-approve switch to bypass manual approval: terraform apply -auto-approve
Once the deployment completes, validate that the infrastructure is configured as desired.
Info
A local terraform.tfstate file and a state backup file have been created during the deployment. The use of local state is acceptable for small temporary configurations, but production or long-lived installations should use a remote state configuration where possible. Configuring remote state is out of scope for this guide, but you can find details on using an Azure storage account for this purpose in the Microsoft Learn documentation.

Clean up your environment

When you are ready, you can remove the infrastructure deployed in this example. Use the following command to delete all resources created by your deployment:

terraform destroy

Note

Most Key Vault deployment examples activate soft-delete functionality as a default. The terraform destroy command will remove the Key Vault resource but does not purge a soft-deleted vault. You may encounter errors if you attempt to re-deploy a Key Vault with the same name during the soft-delete retention window. If you wish to purge the soft-delete for this example you can run az keyvault purge -n <keyVaultName> -l <regionName> using the Azure CLI, or Remove-AzKeyVault -VaultName "<keyVaultName>" -Location "<regionName>" -InRemovedState using Azure PowerShell.

Congratulations, you have successfully leveraged Terraform and AVM to deploy resources in Azure!

Tip

We welcome your contributions and feedback to help us improve the AVM modules and the overall experience for the community!

Next Steps

For developing a more advanced solution, please see the lab titled “Introduction to using Azure Verified Modules for Terraform”.

Specifications & Definitions

Summary

This section lists AVM’s Specifications & Definitions.

Module Specifications

This section documents all the specifications for Azure Verified Modules (AVM) and their respective IaC languages.

Specifications by IaC Language

Category	Bicep			Terraform
Category	Resource	Pattern	Utility	Resource	Pattern	Utility
Contribution/Support	9	8	8	9	8	8
Telemetry	4	3	4	2	2	2
Naming/Composition	25	18	9	17	12	7
CodeStyle	2	2	2	29	29	29
Inputs/Outputs	14	11	10	8	6	5
Testing	14	13	13	10	10	9
Documentation	5	5	5	4	4	4
Release/Publishing	5	5	5	4	4	4
Summary	78	65	56	83	75	68

What changed recently?

No specifications were changed in the last 30 days.

How to navigate the specifications?

The “Module Specifications” section uses tags to dynamically render content based on the selected attributes, such as the IaC language, module classification, category, severity and more. The tags are defined in header of each specification page.

To make it easier for module owners and contributors to navigate the documentation, the specifications are grouped to distinct pages by the IaC language (Bicep | Terraform) and module classification ( resource | pattern | utility). The specifications on each page are further ordered by the category (e.g., Composition, CodeStyle, Testing, etc.), severity of the requirements (MUST | SHOULD | MAY) and at what stage of the module’s lifecycle the specification is typically applicable (Initial | BAU | EOL).

To find what you need, simply decide which IaC language you’d like develop in and what classification your module falls under, then navigate to the respective page to find the specifications that are relevant to you.

Info

All specifications have a 4-9 character long unique ID - a combination of letters and numbers. These letters only carry legacy meaning only leveraged by the AVM core team and are no longer used to group the specifications in any visible way. The ID is used to reference the specification in the code, documentation, and discussions.

Specification Tags

The following tags are used to qualify the specifications:

Key	Allowed Values	Multiple/Single
Language	Bicep, Terraform	Multiple
Class	Resource, Pattern, Utility	Multiple
Type	Functional, NonFunctional	Single
Category	Testing, Telemetry, Contribution/Support, Documentation, CodeStyle, Naming/Composition, Inputs/Outputs, Release/Publishing	Single
Severity	MUST, SHOULD, MAY	Single
Persona	Owner, Contributor	Multiple
Lifecycle	Initial, BAU, EOL	Single
Validation	Bicep: BCP/Manual, BCP/CI/Informational, BCP/CI/Enforced Terraform: TF/Manual, TF/CI/Informational, TF/CI/Enforced	Single per language

Each tag is a concatenation of exactly one of the keys and one of the values, e.g., Language-Bicep, Class-Resource, Type-Functional, etc. When it’s marked as Multiple, it means that the tag can have multiple values, e.g., Language-Bicep, Language-Terraform, or Persona-Owner, Persona-Contributor, etc. When it’s marked as Single, it means that the tag can have only one value, e.g., Type-Functional, Lifecycle-Initial, etc.

➕ Click here to see the definition of the Severity, Persona, Lifecycle and Validation tags...

Severity

What’s the severity or importance of this specification? See “How to read the specifications?” section for more details.

Persona

Who is this specification for? The Owner is the module owner, while the Contributor is anyone who contributes to the module.

Lifecycle

When is this specification mostly relevant?

The Initial stage is when the module is being developed first - e.g., naming related specs are labeled with Lifecycle-Initial as the naming of the module only happens once: at the beginning of their life.
The BAU (business as usual) stage is at any time during the module’s typical lifecycle - e.g., specs that describe coding standards are relevant throughout the module’s life, for any time a new module version is released.
The EOL (end of life) stage is when the module is being decommissioned - e.g., specs describing how a module should be retired are labeled with Lifecycle-EOL.

Validation

How is this specification checked/validated/enforced?

Manual means that the specification is manually enforced at the time of the module review (at the time of the first or any subsequent module version release).
CI/Informational means that the module is checked against the specification by a CI pipeline, but the failure is only informational and doesn’t block the module release.
CI/Enforced means that the specification is automatically enforced by a CI pipeline, and the failure blocks the module release.

Note: the BCP/ or TF/ prefix is required as shared (language-agnostic) specifications may have different level of validation/enforcement per each language - e.g., it is possible that a specification is enforced by a CI pipeline for Bicep modules, while it is manually enforced for Terraform modules.

Why are there language specific specifications?

While every effort is being made to standardize requirements and implementation details across all languages (and most specifications in fact, are applicable to all), it is expected that some of the specifications will be different between their respective languages to ensure we follow the best practices and leverage features of each language.

How to read the specifications?

Important

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119.

As you’re developing/maintaining a module as a module owner or contributor, you need to ensure that your module adheres to the specifications outlined in this section. The specifications are designed to ensure that all AVM modules are consistent, secure, and compliant with best practices.

There are 3 levels of specifications:

MUST: These are mandatory requirements that MUST be followed.
SHOULD: These are recommended requirements that SHOULD be followed, unless there are good reasons for not to.
MAY: These are optional requirements that MAY be followed at the module owner’s/contributor’s discretion.

Bicep Specifications

Specifications by Category and Module Classification

Category	Resource	Pattern	Utility
Contribution/Support	9	8	8
Telemetry	4	3	4
Naming/Composition	25	18	9
CodeStyle	2	2	2
Inputs/Outputs	14	11	10
Testing	14	13	13
Documentation	5	5	5
Release/Publishing	5	5	5
Summary	78	65	56

How to propose changes to the specifications?

Important

Any updates to existing or new specifications for Bicep must be submitted as a draft for review by the AVM core team(@Azure/avm-core-team).

What changed recently?

No specifications were changed in the last 30 days.

Bicep Interfaces

This chapter details the interfaces/schemas for the AVM Resource Modules features/extension resources as referenced in RMFR4 and RMFR5.

Diagnostic Settings

Important

Allowed values for logs and metric categories or category groups MUST NOT be specified to keep the module implementation evergreen for any new categories or category groups added by RPs, without module owners having to update a list of allowed values and cut a new release of their module.

Diagnostic Settings

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { diagnosticSettingFullType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The diagnostic settings of the service. If neither metrics nor logs are specified, all metrics & logs are configured by default. If only one of them is specified, the other one will not be configured.')
  param diagnosticSettings diagnosticSettingFullType[]?
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType<_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for (diagnosticSetting, index) in (diagnosticSettings ?? []): {
    name: diagnosticSetting.?name ?? '${name}-diagnosticSettings'
    properties: {
      storageAccountId: diagnosticSetting.?storageAccountResourceId
      workspaceId: diagnosticSetting.?workspaceResourceId
      eventHubAuthorizationRuleId: diagnosticSetting.?eventHubAuthorizationRuleResourceId
      eventHubName: diagnosticSetting.?eventHubName
      metrics: [
        for group in (diagnosticSetting.?metricCategories ?? (empty(diagnosticSetting.?logCategoriesAndGroups)
          ? [{ category: 'AllMetrics' }]
          : [])): {
          category: group.category
          enabled: group.?enabled ?? true
          timeGrain: null
        }
      ]
      logs: [
        for group in (diagnosticSetting.?logCategoriesAndGroups ?? (empty(diagnosticSetting.?metricCategories)
          ? [{ categoryGroup: 'allLogs' }]
          : [])): {
          categoryGroup: group.?categoryGroup
          category: group.?category
          enabled: group.?enabled ?? true
        }
      ]
      marketplacePartnerId: diagnosticSetting.?marketplacePartnerResourceId
      logAnalyticsDestinationType: diagnosticSetting.?logAnalyticsDestinationType
    }
    scope: >singularMainResourceType<
  }]

  diagnosticSettings: [
    {
      name: 'diagSetting1'
      logCategoriesAndGroups: [
        {
          category: 'AzurePolicyEvaluationDetails'
        }
        {
          category: 'AuditEvent'
        }
      ]
      metricCategories: [
        {
          category: 'AllMetrics'
        }
      ]
      logAnalyticsDestinationType: 'Dedicated'
      workspaceResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}'
      storageAccountResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}'
      eventHubAuthorizationRuleResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.EventHub/namespaces/{namespaceName}/eventhubs/{eventHubName}/authorizationrules/{authorizationRuleName}'
      eventHubName: '{eventHubName}'
      marketplacePartnerResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{partnerResourceProvider}/{partnerResourceType}/{partnerResourceName}'
    }
  ]

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { diagnosticSettingMetricsOnlyType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The diagnostic settings of the service.')
  param diagnosticSettings diagnosticSettingMetricsOnlyType[]?
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType<_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for (diagnosticSetting, index) in (diagnosticSettings ?? []): {
    name: diagnosticSetting.?name ?? '${name}-diagnosticSettings'
    properties: {
      storageAccountId: diagnosticSetting.?storageAccountResourceId
      workspaceId: diagnosticSetting.?workspaceResourceId
      eventHubAuthorizationRuleId: diagnosticSetting.?eventHubAuthorizationRuleResourceId
      eventHubName: diagnosticSetting.?eventHubName
      metrics: [for group in (diagnosticSetting.?metricCategories ?? [ { category: 'AllMetrics' } ]): {
        category: group.category
        enabled: group.?enabled ?? true
        timeGrain: null
      }]
      marketplacePartnerId: diagnosticSetting.?marketplacePartnerResourceId
      logAnalyticsDestinationType: diagnosticSetting.?logAnalyticsDestinationType
    }
    scope: >singularMainResourceType<
  }]

  diagnosticSettings: [
    {
      name: 'diagSetting1'
      metricCategories: [
        {
          category: 'AllMetrics'
        }
      ]
      logAnalyticsDestinationType: 'Dedicated'
      workspaceResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}'
      storageAccountResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}'
      eventHubAuthorizationRuleResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.EventHub/namespaces/{namespaceName}/eventhubs/{eventHubName}/authorizationrules/{authorizationRuleName}'
      eventHubName: '{eventHubName}'
      marketplacePartnerResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{partnerResourceProvider}/{partnerResourceType}/{partnerResourceName}'
    }
  ]

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { diagnosticSettingLogsOnlyType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The diagnostic settings of the service.')
  param diagnosticSettings diagnosticSettingLogsOnlyType[]?
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType<_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for (diagnosticSetting, index) in (diagnosticSettings ?? []): {
    name: diagnosticSetting.?name ?? '${name}-diagnosticSettings'
    properties: {
      storageAccountId: diagnosticSetting.?storageAccountResourceId
      workspaceId: diagnosticSetting.?workspaceResourceId
      eventHubAuthorizationRuleId: diagnosticSetting.?eventHubAuthorizationRuleResourceId
      eventHubName: diagnosticSetting.?eventHubName
      logs: [for group in (diagnosticSetting.?logCategoriesAndGroups ?? [ { categoryGroup: 'allLogs' } ]): {
        categoryGroup: group.?categoryGroup
        category: group.?category
        enabled: group.?enabled ?? true
      }]
      marketplacePartnerId: diagnosticSetting.?marketplacePartnerResourceId
      logAnalyticsDestinationType: diagnosticSetting.?logAnalyticsDestinationType
    }
    scope: >singularMainResourceType<
  }]

  diagnosticSettings: [
    {
      name: 'diagSetting1'
      logCategoriesAndGroups: [
        {
          category: 'AzurePolicyEvaluationDetails'
        }
        {
          category: 'AuditEvent'
        }
      ]
      logAnalyticsDestinationType: 'Dedicated'
      workspaceResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}'
      storageAccountResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}'
      eventHubAuthorizationRuleResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.EventHub/namespaces/{namespaceName}/eventhubs/{eventHubName}/authorizationrules/{authorizationRuleName}'
      eventHubName: '{eventHubName}'
      marketplacePartnerResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{partnerResourceProvider}/{partnerResourceType}/{partnerResourceName}'
    }
  ]

Note

In the provided example for Diagnostic Settings, both logs and metrics are enabled for the associated resource. However, it is IMPORTANT to note that certain resources may not support both diagnostic setting types/categories. In such cases, the resource configuration MUST be modified accordingly to ensure proper functionality and compliance with system requirements.

Role Assignments

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. Array of role assignments to create.')
  param roleAssignments roleAssignmentType[]?
  
  // ============= //
  //   Variables   //
  // ============= //
  
  var builtInRoleNames = {
    // Add other relevant built-in roles here for your resource as per BCPNFR5
    Contributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
    Owner: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')
    Reader: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')
    'Role Based Access Control Administrator (Preview)': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')
    'User Access Administrator': subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')
  }
  
  var formattedRoleAssignments = [
    for (roleAssignment, index) in (roleAssignments ?? []): union(roleAssignment, {
      roleDefinitionId: builtInRoleNames[?roleAssignment.roleDefinitionIdOrName] ?? (contains(roleAssignment.roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/')
            ? roleAssignment.roleDefinitionIdOrName
            : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName))
    })
  ]
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType<_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
    for (roleAssignment, index) in (formattedRoleAssignments ?? []): {
      name: roleAssignment.?name ?? guid(>singularMainResourceType<.id, roleAssignment.principalId, roleAssignment.roleDefinitionId)
      properties: {
        roleDefinitionId: roleAssignment.roleDefinitionId
        principalId: roleAssignment.principalId
        description: roleAssignment.?description
        principalType: roleAssignment.?principalType
        condition: roleAssignment.?condition
        conditionVersion: !empty(roleAssignment.?condition) ? (roleAssignment.?conditionVersion ?? '2.0') : null // Must only be set if condtion is set
        delegatedManagedIdentityResourceId: roleAssignment.?delegatedManagedIdentityResourceId
      }
      scope: >singularMainResourceType<
    }
  ]

  roleAssignments: [
    {
      roleDefinitionIdOrName: 'Owner'
      principalId: nestedDependencies.outputs.managedIdentityPrincipalId
      principalType: 'ServicePrincipal'
    }
    {
      roleDefinitionIdOrName: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
      principalId: nestedDependencies.outputs.managedIdentityPrincipalId
      principalType: 'ServicePrincipal'
    }
    {
      roleDefinitionIdOrName: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')
      principalId: nestedDependencies.outputs.managedIdentityPrincipalId
      principalType: 'ServicePrincipal'
    }
    {
      name: guid('Custom role assignment name seed')
      roleDefinitionIdOrName: 'Storage Blob Data Reader'
      principalId: '00000000-0000-0000-0000-000000000000'
      principalType: 'Group'
      description: 'Group with read-only access'
      condition: '@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase 'foo_storage_container''
      conditionVersion: '2.0'
    }
  ]

Details on child, extension and cross-referenced resources:

Modules MUST support Role Assignments on child, extension and cross-referenced resources as well as the primary resource via parameters/variables

Resource Locks

  // ============== //
  //   Parameters   //
  // ============== //
  
  import { lockType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The lock settings of the service.')
  param lock lockType?
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType<_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') {
    name: lock.?name ?? 'lock-${name}'
    properties: {
      level: lock.?kind ?? ''
      notes: lock.?notes ?? (lock.?kind == 'CanNotDelete'
        ? 'Cannot delete resource or child resources.'
        : 'Cannot delete or modify the resource or child resources.')
    }
    scope: >singularMainResourceType<
  }

  lock: {
    kind: 'CanNotDelete'
    name: 'myCustomLockName'
    notes: 'This is a custom lock note.'
  }

Details on child and extension resources:

Locks SHOULD be able to be set for child resources of the primary resource in resource modules

Details on cross-referenced resources:

Locks MUST be automatically applied to cross-referenced resources if the primary resource has a lock applied.
- This MUST also be able to be turned off for each of the cross-referenced resources by the module consumer via a parameter/variable if they desire

An example of this is a Key Vault module that has a Private Endpoints enabled. If a lock is applied to the Key Vault via the lock parameter/variable then the lock should also be applied to the Private Endpoint automatically, unless the privateEndpointLock/private_endpoint_lock (example name) parameter/variable is set to None

Managed Identities

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { managedIdentityAllType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The managed identity definition for this resource.')
  param managedIdentities managedIdentityAllType?
  
  // ============= //
  //   Variables   //
  // ============= //
  
  var formattedUserAssignedIdentities = reduce(map((managedIdentities.?userAssignedResourceIds ?? []), (id) => { '${id}': {} }), {}, (cur, next) => union(cur, next)) // Converts the flat array to an object like { '${id1}': {}, '${id2}': {} }
  var identity = !empty(managedIdentities) ? {
    type: (managedIdentities.?systemAssigned ?? false) ? (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned,UserAssigned' : 'SystemAssigned') : (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : null)
    userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
  } : null
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType< '>providerNamespace</>resourceType<@>apiVersion<' = {
    name: name
    identity: identity
    properties: {
      ... // other properties
    }
  }
  
  // =========== //
  //   Outputs   //
  // =========== //
  
  @description('The principal ID of the system assigned identity.')
  output systemAssignedMIPrincipalId string? = >singularMainResourceType<.?identity.?principalId

  managedIdentities: {
    systemAssigned: true
    userAssignedResourceIds: [
      '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'
      '/subscriptions/{subscriptionId2}/resourceGroups/{resourceGroupName2}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName2}'
    ]
  }

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { managedIdentityOnlySysAssignedType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The managed identity definition for this resource.')
  param managedIdentities managedIdentityOnlySysAssignedType?
  
  // ============= //
  //   Variables   //
  // ============= //
  
  var identity = !empty(managedIdentities)
    ? {
        type: (managedIdentities.?systemAssigned ?? false) ? 'SystemAssigned' : null
      }
    : null
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType< '>providerNamespace</>resourceType<@>apiVersion<' = {
    name: name
    identity: identity
    properties: {
      ... // other properties
    }
  }
  
  // =========== //
  //   Outputs   //
  // =========== //
  
  @description('The principal ID of the system assigned identity.')
  output systemAssignedMIPrincipalId string? = >singularMainResourceType<.?identity.?principalId

  managedIdentities: {
    systemAssigned: true
  }

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { managedIdentityOnlyUserAssignedType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The managed identity definition for this resource.')
  param managedIdentities managedIdentityOnlyUserAssignedType?
  
  // ============= //
  //   Variables   //
  // ============= //
  
  var formattedUserAssignedIdentities = reduce(map((managedIdentities.?userAssignedResourceIds ?? []), (id) => { '${id}': {} }), {}, (cur, next) => union(cur, next)) // Converts the flat array to an object like { '${id1}': {}, '${id2}': {} }
  var identity = !empty(managedIdentities)
    ? {
        type: !empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : 'None'
        userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
      }
    : null
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType< '>providerNamespace</>resourceType<@>apiVersion<' = {
    name: name
    identity: identity
    properties: {
      ... // other properties
    }
  }

  managedIdentities: {
    userAssignedResourceIds: [
      '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'
      '/subscriptions/{subscriptionId2}/resourceGroups/{resourceGroupName2}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName2}'
    ]
  }

Reason for differences in User Assigned data type in languages:

We do not foresee the Managed Identity Resource Provider team to ever add additional properties within the empty object ({}) value required on the input of a User Assigned Managed Identity.
In Bicep we therefore have removed the need for this to be declared and just converted it to a simple array of Resource IDs

Private Endpoints

E.g., for services that only have one private endpoint type.

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
  param privateEndpoints privateEndpointSingleServiceType[]?
  
  var enableReferencedModulesTelemetry = false // resource module
  
  // ============= //
  //   Resources   //
  // ============= //
  
  module >singularMainResourceType<_privateEndpoints 'br/public:avm/res/network/private-endpoint:>version<' = [for (privateEndpoint, index) in (privateEndpoints ?? []): {
    name: '${uniqueString(deployment().name, location)}->singularMainResourceType<-PrivateEndpoint-${index}'
    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[4]
    )
    params: {
      // Variant 1: A default service can be assumed (i.e., for services that only have one private endpoint type)
      name: privateEndpoint.?name ?? 'pep-${last(split(>singularMainResourceType<.id, '/'))}-${privateEndpoint.?service ?? '>defaultServiceName<'}-${index}'
      privateLinkServiceConnections: privateEndpoint.?isManualConnection != true ? [
        {
          name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(>singularMainResourceType<.id, '/'))}-${privateEndpoint.?service ?? '>defaultServiceName<'}-${index}'
          properties: {
            privateLinkServiceId: >singularMainResourceType<.id
            groupIds: [
              privateEndpoint.?service ?? '>defaultServiceName<'
            ]
          }
        }
      ] : null
      manualPrivateLinkServiceConnections: privateEndpoint.?isManualConnection == true ? [
        {
          name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(>singularMainResourceType<.id, '/'))}-${privateEndpoint.?service ?? '>defaultServiceName<'}-${index}'
          properties: {
            privateLinkServiceId: >singularMainResourceType<.id
            groupIds: [
              privateEndpoint.?service ?? '>defaultServiceName<'
            ]
            requestMessage: privateEndpoint.?manualConnectionRequestMessage ?? 'Manual approval required.'
          }
        }
      ] : null
      subnetResourceId: privateEndpoint.subnetResourceId
      enableTelemetry: enableReferencedModulesTelemetry // resource module
      enableTelemetry: privateEndpoint.?enableTelemetry ?? enableTelemetry // pattern / utility module
      location: privateEndpoint.?location ?? reference(split(privateEndpoint.subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location
      lock: privateEndpoint.?lock ?? lock
      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
      roleAssignments: privateEndpoint.?roleAssignments
      tags: privateEndpoint.?tags ?? tags
      customDnsConfigs: privateEndpoint.?customDnsConfigs
      ipConfigurations: privateEndpoint.?ipConfigurations
      applicationSecurityGroupResourceIds: privateEndpoint.?applicationSecurityGroupResourceIds
      customNetworkInterfaceName: privateEndpoint.?customNetworkInterfaceName
    }
  }]
  
  @description('The private endpoints of the resource.')
  output privateEndpoints privateEndpointOutputType[] = [
    for (pe, index) in (privateEndpoints ?? []): {
      name: >singularMainResourceType<_privateEndpoints[index].outputs.name
      resourceId: >singularMainResourceType<_privateEndpoints[index].outputs.resourceId
      groupId: >singularMainResourceType<_privateEndpoints[index].outputs.?groupId!
      customDnsConfigs: >singularMainResourceType<_privateEndpoints[index].outputs.customDnsConfigs
      networkInterfaceResourceIds: >singularMainResourceType<_privateEndpoints[index].outputs.networkInterfaceResourceIds
    }
  ]
  
  // =============== //
  //   Definitions   //
  // =============== //
  
  @export()
  type privateEndpointOutputType = {
    @description('The name of the private endpoint.')
    name: string
  
    @description('The resource ID of the private endpoint.')
    resourceId: string
  
    @description('The group Id for the private endpoint Group.')
    groupId: string?
  
    @description('The custom DNS configurations of the private endpoint.')
    customDnsConfigs: {
      @description('FQDN that resolves to private endpoint IP address.')
      fqdn: string?
  
      @description('A list of private IP addresses of the private endpoint.')
      ipAddresses: string[]
    }[]
  
    @description('The IDs of the network interfaces associated with the private endpoint.')
    networkInterfaceResourceIds: string[]
  }

  privateEndpoints: {
    {
      name: 'myPeName'
      privateLinkServiceConnectionName: 'myPrivateLinkConnectionName'
      lock: 'CanNotDelete'
      tags: {
        'hidden-title': 'This is visible in the resource name'
      }
      subnetResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mysubnet'
      resourceGroupResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg'
      applicationSecurityGroupResourceIds: [
        '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg/providers/Microsoft.Network/applicationSecurityGroups/myAsg'
      ]
      privateDnsZoneGroup: {
        privateDnsZoneGroupConfigs: [
          {
            name: 'config'
            privateDnsZoneResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg/providers/Microsoft.Network/privateDnsZones/myZone'
          }
        ]
      }
      customDnsConfigs: [
        {
          fqdn: 'fqdn1.example.com'
          ipAddresses: [
            '10.0.0.1',
            '10.0.0.2'
          ]
        }
      ]
      networkInterfaceName: 'nic1'
      ipConfigurations: [
        {
          name: 'ipconfig1'
          groupId: 'vault'
          memberName: 'default'
          privateIpAddress: '10.0.0.7'
        }
      ]
      roleAssignments: [
        {
          roleDefinitionIdOrName: 'Owner'
          principalId: '11111111-1111-1111-1111-111111111111'
          principalType: 'ServicePrincipal'
        }
        {
          roleDefinitionIdOrName: subscriptionResourceId('Microsoft.Authorization/roleDefinitions','acdd72a7-3385-48ef-bd42-f606fba81ae7')
          principalId: '11111111-1111-1111-1111-111111111111'
          principalType: 'ServicePrincipal'
        }
      ]
    }
  }

E.g., for services that have more than one private endpoint type, like a Storage Account (blob, file, etc.)

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  import { privateEndpointMultiServiceType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
  param privateEndpoints privateEndpointMultiServiceType[]?
  
  var enableReferencedModulesTelemetry = false // resource module
  
  // ============= //
  //   Resources   //
  // ============= //
  
  module >singularMainResourceType<_privateEndpoints 'br/public:avm/res/network/private-endpoint:>version<' = [for (privateEndpoint, index) in (privateEndpoints ?? []): {
    name: '${uniqueString(deployment().name, location)}->singularMainResourceType<-PrivateEndpoint-${index}'
    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[4]
    )
    params: {
      // Variant 2: A default service cannot be assumed (i.e., for services that have more than one private endpoint type, like Storage Account)
      name: privateEndpoint.?name ?? 'pep-${last(split(>singularMainResourceType<.id, '/'))}-${privateEndpoint.service}-${index}'
      privateLinkServiceConnections: privateEndpoint.?isManualConnection != true ? [
        {
          name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(>singularMainResourceType<.id, '/'))}-${privateEndpoint.service}-${index}'
          properties: {
            privateLinkServiceId: >singularMainResourceType<.id
            groupIds: [
              privateEndpoint.service
            ]
          }
        }
      ] : null
      manualPrivateLinkServiceConnections: privateEndpoint.?isManualConnection == true ? [
        {
          name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(>singularMainResourceType<.id, '/'))}-${privateEndpoint.service}-${index}'
          properties: {
            privateLinkServiceId: >singularMainResourceType<.id
            groupIds: [
              privateEndpoint.service
            ]
            requestMessage: privateEndpoint.?manualConnectionRequestMessage ?? 'Manual approval required.'
          }
        }
      ] : null
      subnetResourceId: privateEndpoint.subnetResourceId
      enableTelemetry: enableReferencedModulesTelemetry // resource module
      enableTelemetry: privateEndpoint.?enableTelemetry ?? enableTelemetry // pattern / utility module
      location: privateEndpoint.?location ?? reference(split(privateEndpoint.subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location
      lock: privateEndpoint.?lock ?? lock
      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
      roleAssignments: privateEndpoint.?roleAssignments
      tags: privateEndpoint.?tags ?? tags
      customDnsConfigs: privateEndpoint.?customDnsConfigs
      ipConfigurations: privateEndpoint.?ipConfigurations
      applicationSecurityGroupResourceIds: privateEndpoint.?applicationSecurityGroupResourceIds
      customNetworkInterfaceName: privateEndpoint.?customNetworkInterfaceName
    }
  }]
  
  @description('The private endpoints of the resource.')
  output privateEndpoints privateEndpointOutputType[] = [
    for (pe, index) in (privateEndpoints ?? []): {
      name: >singularMainResourceType<_privateEndpoints[index].outputs.name
      resourceId: >singularMainResourceType<_privateEndpoints[index].outputs.resourceId
      groupId: >singularMainResourceType<_privateEndpoints[index].outputs.?groupId!
      customDnsConfigs: >singularMainResourceType<_privateEndpoints[index].outputs.customDnsConfigs
      networkInterfaceResourceIds: >singularMainResourceType<_privateEndpoints[index].outputs.networkInterfaceResourceIds
    }
  ]
  
  // =============== //
  //   Definitions   //
  // =============== //
  
  @export()
  type privateEndpointOutputType = {
    @description('The name of the private endpoint.')
    name: string
  
    @description('The resource ID of the private endpoint.')
    resourceId: string
  
    @description('The group Id for the private endpoint Group.')
    groupId: string?
  
    @description('The custom DNS configurations of the private endpoint.')
    customDnsConfigs: {
      @description('FQDN that resolves to private endpoint IP address.')
      fqdn: string?
  
      @description('A list of private IP addresses of the private endpoint.')
      ipAddresses: string[]
    }[]
  
    @description('The IDs of the network interfaces associated with the private endpoint.')
    networkInterfaceResourceIds: string[]
  }

  privateEndpoints: {
    {
      name: 'myPeName'
      privateLinkServiceConnectionName: 'myPrivateLinkConnectionName'
      lock: 'CanNotDelete'
      tags: {
        'hidden-title': 'This is visible in the resource name'
      }
      service: 'blob'
      subnetResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mysubnet'
      resourceGroupResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg'
      applicationSecurityGroupResourceIds: [
        '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg/providers/Microsoft.Network/applicationSecurityGroups/myAsg'
      ]
      privateDnsZoneGroup: {
        privateDnsZoneGroupConfigs: [
          {
            name: 'config'
            privateDnsZoneResourceId: '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myRg/providers/Microsoft.Network/privateDnsZones/myZone'
          }
        ]
      }
      customDnsConfigs: [
        {
          fqdn: 'fqdn1.example.com'
          ipAddresses: [
            '10.0.0.1',
            '10.0.0.2'
          ]
        }
      ]
      networkInterfaceName: 'nic1'
      ipConfigurations: [
        {
          name: 'ipconfig1'
          groupId: 'blob'
          memberName: 'default'
          privateIpAddress: '10.0.0.7'
        }
      ]
      roleAssignments: [
        {
          roleDefinitionIdOrName: 'Owner'
          principalId: '11111111-1111-1111-1111-111111111111'
          principalType: 'ServicePrincipal'
        }
        {
          roleDefinitionIdOrName: subscriptionResourceId('Microsoft.Authorization/roleDefinitions','acdd72a7-3385-48ef-bd42-f606fba81ae7')
          principalId: '11111111-1111-1111-1111-111111111111'
          principalType: 'ServicePrincipal'
        }
      ]
    }
  }

Notes:

The properties defined in the schema above are the minimum amount of properties expected to be exposed for Private Endpoints in AVM Resource Modules.
- A module owner MAY chose to expose additional properties of the Private Endpoint resource
  - However, module owners considering this SHOULD contact the AVM core team first to consult on how the property should be exposed to avoid future breaking changes to the schema that may be enforced upon them
Module owners MAY chose to define a list of allowed value for the ‘service’ (a.k.a. groupIds) property
- However, they should do so with caution as should a new service appear for their resource module, a new release will need to be cut to add this new service to the allowed values
  - Whereas not specifying allowed values will allow flexibility from day 0 without the need for any changes and releases to be made

Customer Managed Keys

  // ============== //
  //   Parameters   //
  // ============== //
  
  import { customerManagedKeyType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The customer managed key definition.')
  param customerManagedKey customerManagedKeyType?
  
  // ============= //
  //   Variables   //
  // ============= //
  
  // If user-assiged identities are supported => Adds any user assigned identity specified in the customer managed key definition to the general managed-identity spcification
  var formattedUserAssignedIdentities = reduce(
    map(
      union(
        (managedIdentities.?userAssignedResourceIds ?? []),
        (!empty(customerManagedKey.?userAssignedIdentityResourceId)
          ? [customerManagedKey.?userAssignedIdentityResourceId]
          : [])
      ),
      (id) => { '${id}': {} }
    ),
    {},
    (cur, next) => union(cur, next)
  ) // Converts the flat array to an object like { '${id1}': {}, '${id2}': {} }
  
  var identity = !empty(managedIdentities) || !empty(formattedUserAssignedIdentities) 
    ? {
        type: (managedIdentities.?systemAssigned ?? false)
          ? (!empty(formattedUserAssignedIdentities) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
          : (!empty(formattedUserAssignedIdentities) ? 'UserAssigned' : null)
        userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
      }
    : null
  
  var isHSMManagedCMK = split(customerManagedKey.?keyVaultResourceId ?? '', '/')[?7] == 'managedHSMs'
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource cMKKeyVault 'Microsoft.KeyVault/vaults@2025-05-01' existing = if (!empty(customerManagedKey) && !isHSMManagedCMK) {
    name: last(split((customerManagedKey!.?keyVaultResourceId!), '/'))
    scope: resourceGroup(
      split(customerManagedKey!.?keyVaultResourceId!, '/')[2],
      split(customerManagedKey!.?keyVaultResourceId!, '/')[4]
    )
  
    resource cMKKey 'keys@2025-05-01' existing = if (!empty(customerManagedKey) && !isHSMManagedCMK) {
      name: customerManagedKey!.?keyName!
    }
  }
  
  resource cMKUserAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = if (!empty(customerManagedKey.?userAssignedIdentityResourceId)) {
    name: last(split(customerManagedKey!.?userAssignedIdentityResourceId!, '/'))
    scope: resourceGroup(
      split(customerManagedKey!.?userAssignedIdentityResourceId!, '/')[2],
      split(customerManagedKey!.?userAssignedIdentityResourceId!, '/')[4]
    )
  }
  
  resource >singularMainResourceType< '>providerNamespace</>resourceType<@>apiVersion<' = {
    name: '>exampleResource<'
    properties: {
      ... // other properties
      encryption: !empty(customerManagedKey)
        ? {
            keySource: 'Microsoft.KeyVault'
            keyVaultProperties: {
              keyVaultUri: !isHSMManagedCMK
                  ? cMKKeyVault!.properties.vaultUri
                  : 'https://${last(split((customerManagedKey!.keyVaultResourceId), '/'))}.managedhsm.azure.net/'
              keyName: customerManagedKey!.keyName
              keyVersion: !empty(customerManagedKey!.?keyVersion)
                ? customerManagedKey!.keyVersion!
                : (!isHSMManagedCMK
                  ? last(split(cMKKeyVault::cMKKey!.properties.keyUriWithVersion, '/'))
                  : fail('Managed HSM CMK encryption requires specifying the \'keyVersion\'.'))
              keyIdentifier: !empty(customerManagedKey!.?keyVersion)
                ? ( !isHSMManagedCMK
                  ? '${cMKKeyVault::cMKKey!.properties.keyUri}/${customerManagedKey!.keyVersion!}'
                  : 'https://${last(split((customerManagedKey!.keyVaultResourceId), '/'))}.managedhsm.azure.net/keys/${customerManagedKey!.keyName}/${customerManagedKey!.keyVersion!}')
                : ( !isHSMManagedCMK
                  ? cMKKeyVault::cMKKey!.properties.keyUriWithVersion
                  : fail('Managed HSM CMK encryption requires specifying the \'keyVersion\'.'))
              identityClientId: !empty(customerManagedKey!.?userAssignedIdentityResourceId)
                ? cMKUserAssignedIdentity!.properties.clientId
                : null
              identity: !empty(customerManagedKey!.?userAssignedIdentityResourceId)
                ? {
                    userAssignedIdentity: cMKUserAssignedIdentity!.id
                  }
                : null
            }
          }
        : null
    }
  }

  customerManagedKey: {
    keyVaultResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{keyVaultName}'
    keyName: '{keyName}'
    keyVersion: '{keyVersion}'
    userAssignedIdentityResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{uamiName}'
  }

  // ============== //
  //   Parameters   //
  // ============== //
  import { customerManagedKeyWithAutoRotateType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Optional. The customer managed key definition.')
  param customerManagedKey customerManagedKeyWithAutoRotateType?
  
  // ============= //
  //   Variables   //
  // ============= //
  
  // If user-assiged identities are supported => Adds any user assigned identity specified in the customer managed key definition to the general managed-identity spcification
  var formattedUserAssignedIdentities = reduce(
    map(
      union(
        (managedIdentities.?userAssignedResourceIds ?? []),
        (!empty(customerManagedKey.?userAssignedIdentityResourceId)
          ? [customerManagedKey.?userAssignedIdentityResourceId]
          : [])
      ),
      (id) => { '${id}': {} }
    ),
    {},
    (cur, next) => union(cur, next)
  ) // Converts the flat array to an object like { '${id1}': {}, '${id2}': {} }
  
  var identity = !empty(managedIdentities) || !empty(formattedUserAssignedIdentities) 
    ? {
        type: (managedIdentities.?systemAssigned ?? false)
          ? (!empty(formattedUserAssignedIdentities) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
          : (!empty(formattedUserAssignedIdentities) ? 'UserAssigned' : null)
        userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
      }
    : null
    
  var isHSMManagedCMK = split(customerManagedKey.?keyVaultResourceId ?? '', '/')[?7] == 'managedHSMs'
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource cMKKeyVault 'Microsoft.KeyVault/vaults@2025-05-01' existing = if (!empty(customerManagedKey) && !isHSMManagedCMK) {
    name: last(split((customerManagedKey!.?keyVaultResourceId!), '/'))
    scope: resourceGroup(
      split(customerManagedKey!.?keyVaultResourceId!, '/')[2],
      split(customerManagedKey!.?keyVaultResourceId!, '/')[4]
    )
  
    resource cMKKey 'keys@2025-05-01' existing = if (!empty(customerManagedKey) && !isHSMManagedCMK) {
      name: customerManagedKey!.?keyName!
    }
  }
  
  resource cMKUserAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = if (!empty(customerManagedKey.?userAssignedIdentityResourceId)) {
    name: last(split(customerManagedKey!.?userAssignedIdentityResourceId!, '/'))
    scope: resourceGroup(
      split(customerManagedKey!.?userAssignedIdentityResourceId!, '/')[2],
      split(customerManagedKey!.?userAssignedIdentityResourceId!, '/')[4]
    )
  }
  
  resource >singularMainResourceType< '>providerNamespace</>resourceType<@>apiVersion<' = {
    name: '>exampleResource<'
    properties: {
      ... // other properties
      encryption: !empty(customerManagedKey)
        ? {
            keySource: 'Microsoft.KeyVault'
            keyVaultProperties: {
              keyVaultUri: !isHSMManagedCMK
                  ? cMKKeyVault!.properties.vaultUri
                  : 'https://${last(split((customerManagedKey!.keyVaultResourceId), '/'))}.managedhsm.azure.net/'
              keyName: customerManagedKey!.keyName
              keyVersion: !empty(customerManagedKey!.?keyVersion)
                  ? customerManagedKey!.keyVersion!
                  : (customerManagedKey!.?autoRotationEnabled ?? true)
                      ? null
                      : (!isHSMManagedCMK
                          ? last(split(cMKKeyVault::cMKKey!.properties.keyUriWithVersion, '/'))
                          : fail('Managed HSM CMK encryption requires either specifying the \'keyVersion\' or omitting the \'autoRotationEnabled\' property. Setting \'autoRotationEnabled\' to false without a \'keyVersion\' is not allowed.'))
              keyIdentifier: !empty(customerManagedKey!.?keyVersion)
                ? (!isHSMManagedCMK
                  ? '${cMKKeyVault::cMKKey!.properties.keyUri}/${customerManagedKey!.keyVersion!}'
                  : 'https://${last(split((customerManagedKey!.keyVaultResourceId), '/'))}.managedhsm.azure.net/keys/${customerManagedKey!.keyName}/${customerManagedKey!.keyVersion!}')
                : (customerManagedKey!.?autoRotationEnabled ?? true)
                  ? (!isHSMManagedCMK
                    ? cMKKeyVault::cMKKey!.properties.keyUri
                    : 'https://${last(split((customerManagedKey!.keyVaultResourceId), '/'))}.managedhsm.azure.net/keys/${customerManagedKey!.keyName}')
                  : (!isHSMManagedCMK
                    ? cMKKeyVault::cMKKey!.properties.keyUriWithVersion
                    : fail('Managed HSM CMK encryption requires either specifying the \'keyVersion\' or omitting the \'autoRotationEnabled\' property. Setting \'autoRotationEnabled\' to false without a \'keyVersion\' is not allowed.'))
              identityClientId: !empty(customerManagedKey!.?userAssignedIdentityResourceId)
                ? cMKUserAssignedIdentity!.properties.clientId
                : null
              identity: !empty(customerManagedKey!.?userAssignedIdentityResourceId)
                ? {
                    userAssignedIdentity: cMKUserAssignedIdentity!.id
                  }
                : null
            }
          }
        : null
    }
  }

  customerManagedKey: {
    keyVaultResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{keyVaultName}'
    keyName: '{keyName}'
    autoRotationEnabled: {true|false}
    userAssignedIdentityResourceId: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{uamiName}'
  }

Secrets export (DEPRECATED)

Important

Since version Bicep 0.35.1, it is possible to export secrets securely using the secure() annotation.

As this approach is fairly simple compared with the below workaround it is highly recommended to use it instead.

Example

@secure()
@description('The primary connection string of the service bus namespace.')
output primaryConnectionString string = listkeys(
  '${serviceBusNamespace.id}/AuthorizationRules/RootManageSharedAccessKey',
  '2024-01-01'
).primaryConnectionString

@secure()
@description('The primary key of the service bus namespace.')
output primaryKey string = listkeys(
  '${serviceBusNamespace.id}/AuthorizationRules/RootManageSharedAccessKey',
  '2024-01-01'
).primaryKey

Secrets used inside a module can be exported to a Key Vault reference provided as per the below schema.
This implementation provides a secure way around the current limitation of Bicep on providing a secure template output (that can be used for secrets).

The user MUST

provide the resource Id to a Key Vault. The principal used for the deployment MUST be allowed to set secrets in this Key Vault.
provide a name for each secret they want to store (opt-in). The module will suggest which secrets are available via the implemented user-defined type.

The module returns an output table where the key is the name of the secret the user provided, and the value contains both the secret’s resource Id and URI.

Important

The feature MUST be implemented as per the below schema. Diversions are only allowed in places marked as >text< to ensure a consistent user experience across modules.

User Defined Type, Parameter & Resource Example

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  @description('Optional. Key vault reference and secret settings for the module\'s secrets export.')
  param secretsExportConfiguration secretsExportConfigurationType?
  
  // ============= //
  //   Resources   //
  // ============= //
  
  module secretsExport 'modules/keyVaultExport.bicep' = if (secretsExportConfiguration != null) {
    name: '${uniqueString(deployment().name, location)}-secrets-kv'
    scope: resourceGroup(
      split(secretsExportConfiguration.?keyVaultResourceId, '/')[2],
      split(secretsExportConfiguration.?keyVaultResourceId, '/')[4]
    )
    params: {
      keyVaultName: last(split(secretsExportConfiguration.?keyVaultResourceId, '/'))
      secretsToSet: union(
        [],
        contains(secretsExportConfiguration!, '>secretToExport1<Name')
          ? [
              {
                name: secretsExportConfiguration!.?>secretToExport1<Name
                value: >secretReference1< // e.g., >singularMainResourceType<.listKeys().primaryMasterKey
              }
            ]
          : [],
        contains(secretsExportConfiguration!, '>secretToExport2<Name')
          ? [
              {
                name: secretsExportConfiguration!.?>secretToExport2<Name
                value:>secretReference2<  // e.g., >singularMainResourceType<.listKeys().secondaryMasterKey
              }
            ]
          : []
          // (...)
      )
    }
  }
  
  // =========== //
  //   Outputs   //
  // =========== //
  
  import { secretsOutputType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret\'s name.')
  output exportedSecrets secretsOutputType = (secretsExportConfiguration != null)
    ? toObject(secretsExport.outputs.secretsSet, secret => last(split(secret.secretResourceId, '/')), secret => secret)
    : {}
  
  // =============== //
  //   Definitions   //
  // =============== //
  
  @export()
  type secretsExportConfigurationType = {
    @description('Required. The resource ID of the key vault where to store the secrets of this module.')
    keyVaultResourceId: string
  
    @description('Optional. The >secretToExport1< secret name to create.')
    >secretToExport1<Name: string?
  
    @description('Optional. The >secretToExport2< secret name to create.')
    >secretToExport2<Name: string?
  
    // (...)
  }

Input Example with Values

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  @description('Optional. Key vault reference and secret settings for the module\'s secrets export.')
  param secretsExportConfiguration secretsExportConfigurationType?
  
  // ============= //
  //   Resources   //
  // ============= //
  
  module secretsExport 'modules/keyVaultExport.bicep' = if (secretsExportConfiguration != null) {
    name: '${uniqueString(deployment().name, location)}-secrets-kv'
    scope: resourceGroup(
      split(secretsExportConfiguration.?keyVaultResourceId, '/')[2],
      split(secretsExportConfiguration.?keyVaultResourceId, '/')[4]
    )
    params: {
      keyVaultName: last(split(secretsExportConfiguration.?keyVaultResourceId, '/'))
      secretsToSet: union(
        [],
        contains(secretsExportConfiguration!, '>secretToExport1<Name')
          ? [
              {
                name: secretsExportConfiguration!.?>secretToExport1<Name
                value: >secretReference1< // e.g., >singularMainResourceType<.listKeys().primaryMasterKey
              }
            ]
          : [],
        contains(secretsExportConfiguration!, '>secretToExport2<Name')
          ? [
              {
                name: secretsExportConfiguration!.?>secretToExport2<Name
                value:>secretReference2<  // e.g., >singularMainResourceType<.listKeys().secondaryMasterKey
              }
            ]
          : []
          // (...)
      )
    }
  }
  
  // =========== //
  //   Outputs   //
  // =========== //
  
  import { secretsOutputType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret\'s name.')
  output exportedSecrets secretsOutputType = (secretsExportConfiguration != null)
    ? toObject(secretsExport.outputs.secretsSet, secret => last(split(secret.secretResourceId, '/')), secret => secret)
    : {}
  
  // =============== //
  //   Definitions   //
  // =============== //
  
  @export()
  type secretsExportConfigurationType = {
    @description('Required. The resource ID of the key vault where to store the secrets of this module.')
    keyVaultResourceId: string
  
    @description('Optional. The >secretToExport1< secret name to create.')
    >secretToExport1<Name: string?
  
    @description('Optional. The >secretToExport2< secret name to create.')
    >secretToExport2<Name: string?
  
    // (...)
  }

[modules/keyVaultExport.bicep] file

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  @description('Required. The name of the Key Vault to set the secrets in.')
  param keyVaultName string
  
  import { secretToSetType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('Required. The secrets to set in the Key Vault.')
  param secretsToSet secretToSetType[]
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
    name: keyVaultName
  }
  
  resource secrets 'Microsoft.KeyVault/vaults/secrets@2023-07-01' = [
    for secret in secretsToSet: {
      name: secret.name
      parent: keyVault
      properties: {
        value: secret.value
      }
    }
  ]
  
  // =========== //
  //   Outputs   //
  // =========== //
  
  import { secretSetOutputType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('The references to the secrets exported to the provided Key Vault.')
  output secretsSet secretSetOutputType[] = [
    #disable-next-line outputs-should-not-contain-secrets // Only returning the references, not a secret value
    for index in range(0, length(secretsToSet ?? [])): {
      secretResourceId: secrets[index].id
      secretUri: secrets[index].properties.secretUri
      secretUriWithVersion: secrets[index].properties.secretUriWithVersion
    }
  ]

Output Usage Example

When using a module that implements the above interface, you can access its outputs for example in the following ways:

  
  // ============== //
  //   Parameters   //
  // ============== //
  
  @description('Optional. Key vault reference and secret settings for the module\'s secrets export.')
  param secretsExportConfiguration secretsExportConfigurationType?
  
  // ============= //
  //   Resources   //
  // ============= //
  
  module secretsExport 'modules/keyVaultExport.bicep' = if (secretsExportConfiguration != null) {
    name: '${uniqueString(deployment().name, location)}-secrets-kv'
    scope: resourceGroup(
      split(secretsExportConfiguration.?keyVaultResourceId, '/')[2],
      split(secretsExportConfiguration.?keyVaultResourceId, '/')[4]
    )
    params: {
      keyVaultName: last(split(secretsExportConfiguration.?keyVaultResourceId, '/'))
      secretsToSet: union(
        [],
        contains(secretsExportConfiguration!, '>secretToExport1<Name')
          ? [
              {
                name: secretsExportConfiguration!.?>secretToExport1<Name
                value: >secretReference1< // e.g., >singularMainResourceType<.listKeys().primaryMasterKey
              }
            ]
          : [],
        contains(secretsExportConfiguration!, '>secretToExport2<Name')
          ? [
              {
                name: secretsExportConfiguration!.?>secretToExport2<Name
                value:>secretReference2<  // e.g., >singularMainResourceType<.listKeys().secondaryMasterKey
              }
            ]
          : []
          // (...)
      )
    }
  }
  
  // =========== //
  //   Outputs   //
  // =========== //
  
  import { secretsOutputType } from 'br/public:avm/utl/types/avm-common-types:>version<'
  @description('A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret\'s name.')
  output exportedSecrets secretsOutputType = (secretsExportConfiguration != null)
    ? toObject(secretsExport.outputs.secretsSet, secret => last(split(secret.secretResourceId, '/')), secret => secret)
    : {}
  
  // =============== //
  //   Definitions   //
  // =============== //
  
  @export()
  type secretsExportConfigurationType = {
    @description('Required. The resource ID of the key vault where to store the secrets of this module.')
    keyVaultResourceId: string
  
    @description('Optional. The >secretToExport1< secret name to create.')
    >secretToExport1<Name: string?
  
    @description('Optional. The >secretToExport2< secret name to create.')
    >secretToExport2<Name: string?
  
    // (...)
  }

Which returns a JSON-formatted output like:

  {
    "exportedSecrets": {
      "Type": "Object",
      "Value": {
        ">secretToExportName1<": {
          "secretResourceId": "/subscriptions/<subId>/resourceGroups/<rgName>providers/Microsoft.KeyVault/vaults/<vaultName>/secrets/>secretToExportName1<",
          "secretUri": "https://<vaultName>.vault.azure.net/secrets/>secretToExportName1<"
        },
        ">secretToExportName2<": {
          "secretResourceId": "/subscriptions/<subId>/resourceGroups/<rgName>providers/Microsoft.KeyVault/vaults/<vaultName>/secrets/>secretToExportName2<",
          "secretUri": "https://<vaultName>.vault.azure.net/secrets/>secretToExportName2<"
        }
      }
    },
    "specificSecret": {
      "Type": "String",
      "Value": "/subscriptions/<subId>/resourceGroups/<rgName>providers/Microsoft.KeyVault/vaults/<vaultName>/secrets/>secretToExportName1<"
    },
    "exportedSecretResourceIds": {
      "Type": "Array",
      "Value": [
        "/subscriptions/<subId>/resourceGroups/<rgName>providers/Microsoft.KeyVault/vaults/<vaultName>/secrets/>secretToExportName1<",
        "/subscriptions/<subId>/resourceGroups/<rgName>providers/Microsoft.KeyVault/vaults/<vaultName>/secrets/>secretToExportName2<"
      ]
    }
  }

Azure Monitor Alerts

Note

This interface is a SHOULD instead of a MUST and therefore the AVM core team have not mandated a interface schema to use.

Zonal & zone-redundant resources

Many Azure resources can be deployed into specific availability zones. Depending on whether a resource is ‘zonal’ (i.e., deploys a single instance into a single zone) or ‘zone-redundant’ (i.e., spreads multiple of its instances across the configured zones), implementing a different interface is required. Simply put, the zone of a zonal resource must be a required parameter (but give the user the option to ‘opt-out’), while zone-redundant resources must span all available zones by default, but still give the user the option to ‘opt-out’. Please note that the support for Availability Zones may differ from region to region.

  // ============== //
  //   Parameters   //
  // ============== //
  
  @description('Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones).')
  @allowed([
    -1
    1
    2
    3
  ])
  param availabilityZone int
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType< '>providerNamespace</>resourceType<@>apiVersion<' = {
    name: '>exampleResource<'
    properties: {
      ... // other properties
      zones: availabilityZone != -1 ? array(string(availabilityZone)) : null // If expecting an array
      // Or
      availabilityZone: availabilityZone != -1 ? string(availabilityZone) : null // If expecting a single value
    }
  }

  availabilityZone: -1 // Deploy into no zone
  availabilityZone: 1 // Deploy into zone 1

  // ============== //
  //   Parameters   //
  // ============== //
  
  @description('Optional. The list of Availability zones to use for the zone-redundant resources.')
  @allowed([
    1
    2
    3
  ])
  param availabilityZones int[] = [1, 2, 3]
  
  // ============= //
  //   Resources   //
  // ============= //
  
  resource >singularMainResourceType< '>providerNamespace</>resourceType<@>apiVersion<' = {
    name: '>exampleResource<'
    properties: {
      ... // other properties
      zones: map(availabilityZones, zone => '${zone}')
    }
  }

  availabilityZones: [] // Deploy into no zone
  availabilityZones: [1, 2] // Deploy into zone 1 & 2

Bicep Pattern Module Specifications

Contribution / Support

The content below is listed based on the following tags

Category-Contribution/SupportClass-PatternLanguage-Bicep

#	ID	Title	Severity	Persona	Lifecycle
1	SNFR8	Module Owner(s) GitHub	MUST	Owner	Initial
2	SNFR20	GitHub Teams Only	MUST	Owner	Initial
3	SNFR9	AVM & PG Teams GitHub Repo Permissions	MUST	Owner	Initial
4	SNFR10	MIT Licensing	MUST	Owner	Initial
5	SNFR11	Issues Response Times	MUST	OwnerContributor	BAU
6	SNFR12	Versions Supported	MUST	Owner	BAU
7	SNFR23	GitHub Repo Labels	MUST	Owner	BAU
8	BCPNFR15	AVM Module Issue template file	MUST	Owner	BAU

➕ See Specifications for this category

Name	Description	HEX
AZD 🧑‍💻	These modules are requested/used by the AZD team.	`E0BFFA`
Needs: Attention 👋	Reply has been added to issue, maintainer to review	`E99695`
Needs: Immediate Attention ‼️	Immediate attention of module owner / AVM team is needed	`FF0000`
Needs: Author Feedback 👂	Awaiting feedback from the issue/PR author	`F18A07`
Needs: External Changes ⚒️	When an issue/PR requires changes that are outside of the control of the module. e.g. to an RP.	`DE389D`
Needs: More Evidence ⚖	We are looking for more evidence to make a decision on this	`F64872`
Needs: Triage 🔍	Maintainers need to triage still	`FBCA04`
Needs: Module Owner 📣	In the AVM repository: this module needs an owner to develop or maintain it. In the BRM repository: the module owner needs to review a PR.	`FF0019`
Needs: Module Contributor 📣	This module needs secondary owner(s) or contributor(s) to develop or maintain it	`C95474`
Needs: Core Team 🧞‍♂️	This item needs the AVM Core Team to review it	`DB4503`
Status: Awaiting Release To Be Cut ✂️	This is fixed in the main branch but not in the latest release, will be fixed with next release cut	`800080`
Status: Do Not Merge ⛔	Do not merge PRs with this label attached as they are not ready or aligned to future direction etc.	`8B4513`
Status: External Contribution 🌍	This is being worked on by someone outside of the AVM module owners/contributors or AVM core team	`D8FA2C`
Status: Fixed ✅	Auto label applied when issue fixed by merged PR	`90EE90`
Status: Help Wanted 🆘	Extra attention is needed	`FF4500`
Status: In Triage 🔍	Picked up for triaging by an AVM core team member	`D4AF37`
Status: In PR 👉	This is when an issue is due to be fixed in an open PR	`EDEDED`
Status: Invalid ❌	This doesn't seem right	`E4E669`
Status: Long Term ⏳	We will do it, but will take a longer amount of time due to complexity/priorities	`B60205`
Status: No Recent Activity 💤	When an issue/PR has not been modified for X amount of days	`808080`
Status: Won't Fix 💔	This will not be worked on	`FFFFFF`
Status: Owners Identified 🤘	This module has its owners identified	`FBEF2A`
Status: Module Available 🟢	The module is published	`C8E6C9`
Status: Module Deprecated 🔴	This is a request to deprecate a module	`000000`
Status: Module Orphaned 🟡	The module has no owner and is therefore orphaned at this time	`F4A460`
Status: Ready For Repository Creation 📝	This module is approved and the owner is ready for the repository to be created (Terraform)	`136A41`
Status: Repository Created 📄	This module has had it's repository created and configured ready for owner contribution (Terraform)	`27AB03`
Status: Response Overdue 🚩	When an issue/PR has not been responded to for X amount of days	`850000`
Status: Looking For Assistance 🦆	This item is looking for anyone to help develop the code and submit a PR for resolution	`03FCC2`
Type: Bug 🐛	Something isn't working	`D73A4A`
Type: CI 🚀	This issue is related to the AVM CI	`74CFB0`
Type: Documentation 📄	Improvements or additions to documentation	`0075CA`
Type: Duplicate 🤲	This issue or pull request already exists	`CFD3D7`
Type: Feature Request ➕	New feature or request	`A2EEEF`
Type: Hygiene 🧹	things related to testing, issue triage etc.	`17016A`
Type: New Module Proposal 💡	A new module for AVM is being proposed	`ADD8E6`
Type: Question/Feedback 🙋‍♀️	Further information is requested or just some feedback	`CB6BA2`
Type: Security Bug 🔒	This is a security bug	`FFFF00`
Type: AVM 🅰️ ✌️ ⓜ️	This is an AVM related issue	`F0FFFF`
Language: Terraform 🌐	This is related to the Terraform IaC language	`7740B6`
Language: Bicep 💪	This is related to the Bicep IaC language	`1D73B3`
Class: Resource Module 📦	This is a resource module	`D3D3D3`
Class: Pattern Module 📦	This is a pattern module	`A9A9A9`
Class: Utility Module 📦	This is a utility module	`CAD1DE`
Class: Child Module 📦	This is a child module	`5E5186`

#	ID	Title	Severity	Persona	Lifecycle
1	SFR3	Deployment/Usage Telemetry	MUST	Owner	Initial
2	SFR4	Telemetry Enablement Flexibility	MUST	Owner	Initial
3	BCPFR4	Telemetry Enablement	MUST	OwnerContributor	BAU

#	ID	Title	Severity	Persona	Lifecycle
1	SFR1	Preview Services	MUST	Owner	BAU
2	SFR2	WAF Aligned	SHOULD	Owner	BAU
3	SFR5	Availability Zones	MUST	Owner	Initial
4	SFR6	Data Redundancy	MUST	Owner	Initial
5	SNFR25	Resource Naming	MUST	Owner	Initial
6	PMFR1	Resource Group Creation	MAY	OwnerContributor	BAU
7	PMNFR1	Module Naming	MUST	Owner	Initial
8	PMNFR2	Use Resource Modules to Build a Pattern Module	MUST	OwnerContributor	BAU
9	PMNFR3	Use other Pattern Modules to Build a Pattern Module	MUST	OwnerContributor	BAU
10	BCPFR1	Cross-Referencing Modules	MAY	OwnerContributor	BAU
11	BCPFR2	Role Assignments Role Definition Mapping	MUST	OwnerContributor	BAU
12	BCPFR6	Cross-Referencing Child-Modules	MUST	OwnerContributor	BAU
13	BCPNFR19	User-defined types - Naming	MUST	OwnerContributor	BAU
14	BCPNFR23	Module composition	MUST	OwnerContributor	BAU
15	BCPNFR24	Deterministic Deployment Names	MUST	OwnerContributor	BAU
16	BCPNFR5	Role Assignments Role Definition Mapping Limits	SHOULD	OwnerContributor	BAU
17	BCPNFR6	Role Assignments Role Definition Mapping Compulsory Roles	MUST	OwnerContributor	BAU
18	BCPNFR14	Versioning	MUST	OwnerContributor	BAU

Segment	Description
`uniqueString(<parentResource>.id, location)`	A deterministic hash derived from the parent resource’s resource ID and deployment location. This is both unique per resource instance and stable across deployments.
`<ChildModuleDescriptor>`	A short, human-readable label identifying the child module being deployed (e.g., `DB`, `Subnet`, `FederatedIdentityCred`).
`${index}`	The loop index variable, included when deploying in a loop. Omit for single (non-looped) deployments.

Approach	Deterministic?	Collision-free?	Issue
`deployment().name`	❌	✅	Changes every deployment; hits 800-limit
`utcNow()` / timestamps	❌	✅	Changes every deployment; hits 800-limit
`subscription().id` + `resourceGroup().id`	✅	❌	Same hash for all resources in the same RG; collisions when deploying multiple instances
`<parentResource>.id, location`	✅	✅	Recommended — stable and unique per instance

#	ID	Title	Severity	Persona	Lifecycle
1	SNFR14	Data Types	SHOULD	OwnerContributor	BAU
2	SNFR22	Parameters/Variables for Resource IDs	MUST	OwnerContributor	BAU
3	SNFR26	Output - Parameters - Decorators	MUST	OwnerContributor	BAU
4	PMNFR5	Parameter/Variable Naming	SHOULD	OwnerContributor	BAU
5	BCPNFR1	Complex data types - General	MUST	OwnerContributor	BAU
6	BCPNFR9	Inputs - Decorators	MUST	OwnerContributor	BAU
7	BCPNFR18	User-defined types - Specification	MUST	OwnerContributor	BAU
8	BCPNFR19	User-defined types - Naming	MUST	OwnerContributor	BAU
9	BCPNFR20	User-defined types - Export	MUST	OwnerContributor	BAU
10	BCPNFR21	User-defined types - Decorators	MUST	OwnerContributor	BAU
11	BCPNFR7	Parameter Requirement Types	MUST	OwnerContributor	BAU

Parameter Requirement Type	Definition	Example Description Decorator
Required	The parameter value must be provided. The parameter does not have a default value and hence the module expects and requires an input.	`@description('Required. <PARAMETER DESCRIPTION HERE...>')`
Conditional	The parameter value can be optional or required based on a condition, mostly based on the value provided to other parameters. Should contain a sentence starting with ‘Required if (…).’ to explain the condition.	`@description('Conditional. <PARAMETER DESCRIPTION HERE...>')`
Optional	The parameter value is not mandatory. The module provides a default value for the parameter.	`@description('Optional. <PARAMETER DESCRIPTION HERE...>')`
Generated	The parameter value is generated within the module and should not be specified as input in most cases. A common example of this is the `utcNow()` function that is only supported as the input for a parameter value, and not inside a variable.	`@description('Generated. <PARAMETER DESCRIPTION HERE...>')`

#	ID	Title	Severity	Persona	Lifecycle
1	SNFR1	Prescribed Tests	MUST	OwnerContributor	BAU
2	SNFR2	E2E Testing	MUST	OwnerContributor	BAU
3	SNFR3	AVM Compliance Tests	MUST	OwnerContributor	Initial
4	SNFR4	Unit Tests	SHOULD	OwnerContributor	BAU
5	SNFR5	Upgrade Tests	SHOULD	OwnerContributor	BAU
6	SNFR6	Static Analysis/Linting Tests	MUST	OwnerContributor	BAU
7	SNFR7	Idempotency Tests	MUST	OwnerContributor	BAU
8	SNFR24	Testing Child, Extension & Interface Resources	MUST	OwnerContributor	BAU
9	BCPNFR10	Test Bicep File Naming	MUST	OwnerContributor	BAU
10	BCPNFR11	Test Tooling	MUST	OwnerContributor	BAU
11	BCPNFR12	Deployment Test Naming	MUST	OwnerContributor	BAU
12	BCPNFR13	Test file metadata	MUST	OwnerContributor	BAU
13	BCPNFR16	Post-deployment tests	MUST	OwnerContributor	BAU

#	ID	Title	Severity	Persona	Lifecycle
1	SNFR15	Automatic Documentation Generation	MUST	OwnerContributor	BAU
2	SNFR16	Examples/E2E	MUST	OwnerContributor	BAU
3	BCPNFR2	Module Documentation Generation	MUST	OwnerContributor	BAU
4	BCPNFR3	Usage Example formats	MUST	OwnerContributor	BAU
5	BCPNFR4	Parameter Input Examples	MAY	OwnerContributor	BAU

#	ID	Title	Severity	Persona	Lifecycle
1	SNFR17	Semantic Versioning	MUST	OwnerContributor	BAU
2	SNFR18	Breaking Changes	SHOULD	OwnerContributor	BAU
3	SNFR19	Registries Targeted	MUST	OwnerContributor	BAU
4	SNFR21	Cross Language Collaboration	SHOULD	OwnerContributor	BAU
5	BCPNFR22	Bicep Module Changelog	MUST	OwnerContributor	BAU

#	ID	Title	Severity	Persona	Lifecycle
1	BCPNFR8	Code Styling - lower camelCasing	SHOULD	OwnerContributor	BAU
2	BCPNFR17	Code Styling - Type casting	SHOULD	OwnerContributor	BAU

Optional Features/Extension Resources	Bicep Parameter Name	Terraform Variable Name	MUST/SHOULD
Diagnostic Settings	`diagnosticSettings`	`diagnostic_settings`	MUST
Role Assignments	`roleAssignments`	`role_assignments`	MUST
Resource Locks	`lock`	`lock`	MUST
Tags	`tags`	`tags`	MUST
Managed Identities (System / User Assigned)	`managedIdentities`	`managed_identities`	MUST
Private Endpoints	`privateEndpoints`	`private_endpoints`	MUST
Customer Managed Keys	`customerManagedKey`	`customer_managed_key`	MUST
Azure Monitor Alerts	`alerts`	`alerts`	SHOULD

Output	Bicep Output Name	Terraform Output Name
Resource Name	`name`	`name`
Resource ID	`resourceId`	`resource_id`
System Assigned Managed Identity Principal ID (if supported by module)	`systemAssignedMIPrincipalId`	`system_assigned_mi_principal_id`

#	ID	Title	Severity	Persona	Lifecycle
1	TFNFR6	Resource & Data Order	SHOULD	OwnerContributor	BAU
2	TFNFR7	Count & for_each Use	MUST	OwnerContributor	BAU
3	TFNFR8	Resource & Data Block Orders	SHOULD	OwnerContributor	BAU
4	TFNFR9	Module Block Order	SHOULD	OwnerContributor	BAU
5	TFNFR10	No Double Quotes in ignore_changes	MUST	OwnerContributor	BAU
6	TFNFR11	Null Comparison Toggle	SHOULD	OwnerContributor	BAU
7	TFNFR12	Dynamic for Optional Nested Objects	MUST	OwnerContributor	BAU
8	TFNFR13	Default Values with coalesce/try	SHOULD	OwnerContributor	BAU
9	TFNFR16	Variable Naming Rules	SHOULD	OwnerContributor	BAU
10	TFNFR17	Variables with Descriptions	SHOULD	OwnerContributor	BAU
11	TFNFR18	Variables with Types	MUST	OwnerContributor	BAU
12	TFNFR19	Sensitive Data Variables	SHOULD	OwnerContributor	BAU
13	TFNFR20	Non-Nullable Defaults for collection values	SHOULD	OwnerContributor	BAU
14	TFNFR21	Discourage Nullability by Default	MUST	OwnerContributor	BAU
15	TFNFR22	Avoid sensitive = false	MUST	OwnerContributor	BAU
16	TFNFR23	Sensitive Default Value Conditions	MUST	OwnerContributor	BAU
17	TFNFR24	Handling Deprecated Variables	MUST	OwnerContributor	BAU
18	TFNFR25	Verified Modules Requirements	MUST	OwnerContributor	BAU
19	TFNFR26	Providers in required_providers	MUST	OwnerContributor	BAU
20	TFNFR27	Provider Declarations in Modules	MUST	OwnerContributor	BAU
22	TFNFR30	Handling Deprecated Outputs	MUST	OwnerContributor	BAU
23	TFNFR31	locals.tf for Locals Only	MAY	OwnerContributor	BAU
25	TFNFR33	Precise Local Types	SHOULD	OwnerContributor	BAU
26	TFNFR34	Using Feature Toggles	MUST	OwnerContributor	BAU
27	TFNFR35	Reviewing Potential Breaking Changes	MUST	OwnerContributor	BAU
28	TFNFR36	Setting prevent_deletion_if_contains_resources	SHOULD	OwnerContributor	BAU
29	TFNFR37	Tool Usage by Module Owner	MAY	OwnerContributor	BAU

Azure Verified Modules

Introduction

Value Proposition

Modules

Next Steps

Subsections of Azure Verified Modules

Overview

Summary

Subsections of Overview

Introduction

What is Azure Verified Modules?

Definition of “Verified” Summary

Why Azure Verified Modules?

How will we create, support and enforce Azure Verified Modules?

Module Indexes

Summary

Subsections of Module Indexes

Bicep Modules

Summary

Status Badges

Subsections of Bicep

Bicep Resource Modules

Module catalog

Published modules - 🟢 & 🟡

Proposed modules - ⚪

Deprecated modules - 🔴

All modules - 📇

Module Publication History - 📅

Modules published in May 2026

Modules published in April 2026

Modules published in March 2026

Modules published in January 2026

Modules published in December 2025

Modules published in November 2025

Modules published in September 2025

Modules published in August 2025

Modules published in July 2025

Modules published in June 2025

Modules published in May 2025

Modules published in March 2025

Modules published in February 2025

Modules published in January 2025

Modules published in December 2024

Modules published in October 2024

Modules published in September 2024

Modules published in June 2024

Modules published in May 2024

Modules published in April 2024

Modules published in March 2024

Modules published in February 2024

Modules published in January 2024

Modules published in December 2023

Modules published in November 2023

Modules published in October 2023

Consistent Features & Extension Resources (Interfaces)

For Module Owners & Contributors

Module name, Telemetry ID prefix, GitHub Teams for Owners

Bicep Pattern Modules

Module catalog

Published modules - 🟢 & 🟡

Proposed modules - ⚪

Deprecated modules - 🔴

All modules - 📇

Module Publication History - 📅

Modules published in April 2026

Modules published in September 2025

Modules published in August 2025

Modules published in July 2025

Modules published in June 2025

Modules published in April 2025

Modules published in March 2025

Modules published in February 2025

Modules published in December 2024

Modules published in October 2024

Modules published in September 2024

Modules published in August 2024

Modules published in July 2024

Modules published in June 2024

Modules published in May 2024

Modules published in April 2024