Module Specifications

This section documents all the specifications for Azure Verified Modules (AVM) and their respective IaC languages.

Specifications by IaC Language

CategoryBicepTerraform
ResourcePatternUtilityResourcePatternUtility
Contribution/Support988988
Telemetry434222
Naming/Composition2518920149
CodeStyle222303030
Inputs/Outputs1411101298
Testing14131310109
Documentation555444
Release/Publishing555444
Summary786556918174

What changed recently?

See what specifications changed in the last 30 days...

#IDLast Modified (UTC)Git HistoryLast Commit
1TFRMNFR12026-05-29 10:34:42All Commits5807d20
2PMNFR12026-05-26 15:12:56All Commitsb7412ee
3RMFR32026-05-26 15:12:56All Commitsb7412ee
4RMNFR12026-05-26 15:12:56All Commitsb7412ee
5SNFR122026-05-26 15:12:56All Commitsb7412ee
6SNFR22026-05-26 15:12:56All Commitsb7412ee
7SNFR262026-05-26 15:12:56All Commitsb7412ee
8UMNFR12026-05-26 15:12:56All Commitsb7412ee
9TFRMFR12026-05-26 15:12:56All Commitsb7412ee
10TFRMNFR22026-05-26 15:12:56All Commitsb7412ee
11TFFR12026-05-26 15:12:56All Commitsb7412ee
12TFFR22026-05-26 15:12:56All Commitsb7412ee
13TFFR32026-05-26 15:12:56All Commitsb7412ee
14TFFR42026-05-26 15:12:56All Commitsb7412ee
15TFFR52026-05-26 15:12:56All Commitsb7412ee
16TFFR62026-05-26 15:12:56All Commitsb7412ee
17TFFR72026-05-26 15:12:56All Commitsb7412ee
18TFNFR112026-05-26 15:12:56All Commitsb7412ee
19TFNFR122026-05-26 15:12:56All Commitsb7412ee
20TFNFR172026-05-26 15:12:56All Commitsb7412ee
21TFNFR182026-05-26 15:12:56All Commitsb7412ee
22TFNFR212026-05-26 15:12:56All Commitsb7412ee
23TFNFR232026-05-26 15:12:56All Commitsb7412ee
24TFNFR252026-05-26 15:12:56All Commitsb7412ee
25TFNFR262026-05-26 15:12:56All Commitsb7412ee
26TFNFR272026-05-26 15:12:56All Commitsb7412ee
27TFNFR292026-05-26 15:12:56All Commitsb7412ee
28TFNFR342026-05-26 15:12:56All Commitsb7412ee
29TFNFR362026-05-26 15:12:56All Commitsb7412ee
30TFNFR382026-05-26 15:12:56All Commitsb7412ee
31TFNFR392026-05-26 15:12:56All Commitsb7412ee
32TFNFR52026-05-26 15:12:56All Commitsb7412ee
33TFNFR72026-05-26 15:12:56All Commitsb7412ee
34TFNFR82026-05-26 15:12:56All Commitsb7412ee

How to navigate the specifications?

The “Module Specifications” section uses tags to dynamically render content based on the selected attributes, such as the IaC language, module classification, category, severity and more. The tags are defined in header of each specification page.

To make it easier for module owners and contributors to navigate the documentation, the specifications are grouped to distinct pages by the IaC language (Bicep | Terraform) and module classification ( resource | pattern | utility). The specifications on each page are further ordered by the category (e.g., Composition, CodeStyle, Testing, etc.), severity of the requirements (MUST | SHOULD | MAY) and at what stage of the module’s lifecycle the specification is typically applicable (Initial | BAU | EOL).

To find what you need, simply decide which IaC language you’d like develop in and what classification your module falls under, then navigate to the respective page to find the specifications that are relevant to you.

Info

All specifications have a 4-9 character long unique ID - a combination of letters and numbers. These letters only carry legacy meaning only leveraged by the AVM core team and are no longer used to group the specifications in any visible way. The ID is used to reference the specification in the code, documentation, and discussions.

Specification Tags

The following tags are used to qualify the specifications:

KeyAllowed ValuesMultiple/Single
LanguageBicep, TerraformMultiple
ClassResource, Pattern, UtilityMultiple
TypeFunctional, NonFunctionalSingle
CategoryTesting, Telemetry, Contribution/Support, Documentation, CodeStyle, Naming/Composition, Inputs/Outputs, Release/PublishingSingle
SeverityMUST, SHOULD, MAYSingle
PersonaOwner, ContributorMultiple
LifecycleInitial, BAU, EOLSingle
ValidationBicep: BCP/Manual, BCP/CI/Informational, BCP/CI/Enforced
Terraform: TF/Manual, TF/CI/Informational, TF/CI/Enforced
Single per language

Each tag is a concatenation of exactly one of the keys and one of the values, e.g., Language-Bicep, Class-Resource, Type-Functional, etc. When it’s marked as Multiple, it means that the tag can have multiple values, e.g., Language-Bicep, Language-Terraform, or Persona-Owner, Persona-Contributor, etc. When it’s marked as Single, it means that the tag can have only one value, e.g., Type-Functional, Lifecycle-Initial, etc.

➕ Click here to see the definition of the Severity, Persona, Lifecycle and Validation tags...

Severity

What’s the severity or importance of this specification? See “How to read the specifications?” section for more details.

Persona

Who is this specification for? The Owner is the module owner, while the Contributor is anyone who contributes to the module.

Lifecycle

When is this specification mostly relevant?

  • The Initial stage is when the module is being developed first - e.g., naming related specs are labeled with Lifecycle-Initial as the naming of the module only happens once: at the beginning of their life.
  • The BAU (business as usual) stage is at any time during the module’s typical lifecycle - e.g., specs that describe coding standards are relevant throughout the module’s life, for any time a new module version is released.
  • The EOL (end of life) stage is when the module is being decommissioned - e.g., specs describing how a module should be retired are labeled with Lifecycle-EOL.

Validation

How is this specification checked/validated/enforced?

  • Manual means that the specification is manually enforced at the time of the module review (at the time of the first or any subsequent module version release).
  • CI/Informational means that the module is checked against the specification by a CI pipeline, but the failure is only informational and doesn’t block the module release.
  • CI/Enforced means that the specification is automatically enforced by a CI pipeline, and the failure blocks the module release.

Note: the BCP/ or TF/ prefix is required as shared (language-agnostic) specifications may have different level of validation/enforcement per each language - e.g., it is possible that a specification is enforced by a CI pipeline for Bicep modules, while it is manually enforced for Terraform modules.

Why are there language specific specifications?

While every effort is being made to standardize requirements and implementation details across all languages (and most specifications in fact, are applicable to all), it is expected that some of the specifications will be different between their respective languages to ensure we follow the best practices and leverage features of each language.

How to read the specifications?

Important

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119.

As you’re developing/maintaining a module as a module owner or contributor, you need to ensure that your module adheres to the specifications outlined in this section. The specifications are designed to ensure that all AVM modules are consistent, secure, and compliant with best practices.

There are 3 levels of specifications:

  • MUST: These are mandatory requirements that MUST be followed.
  • SHOULD: These are recommended requirements that SHOULD be followed, unless there are good reasons for not to.
  • MAY: These are optional requirements that MAY be followed at the module owner’s/contributor’s discretion.