Sometimes we notice that the name of certain output is not appropriate anymore, however, since we have to ensure forward compatibility in the same major version, its name MUST NOT be changed directly. It MUST be moved to an independent deprecated_outputs.tf file, then redefine a new output in output.tf and make sure it’s compatible everywhere else in the module.

In locals.tf, file we could declare multiple locals blocks, but only locals blocks are allowed.

You MAY declare locals blocks next to a resource block or data block for some advanced scenarios, like making a fake module to execute some light-weight tests aimed at the expressions.

Expressions in locals block MUST be arranged alphabetically.

Good examples:

locals {
  name = coalesce(var.name, "name")
  tags = merge(var.tags, {
    env = "prod"
  })
}

locals {
  tags = merge(var.tags, {
    env = "prod"
  })
}

locals {
  name = coalesce(var.name, "name")
}

Precise local types SHOULD be used.

Good example:

{
  name = "John"
  age  = 52
}

Bad example:

{
  name = "John"
  age  = "52" # age should be number
}

A toggle variable MUST be used to allow users to avoid the creation of a new resource block by default if it is added in a minor or patch version.

Potential breaking(surprise) changes introduced by resource block

1. Adding a new resource without count or for_each for conditional creation, or creating by default
2. Adding a new argument assignment with a value other than the default value provided by the provider’s schema
3. Adding a new nested block without making it dynamic or omitting it by default
4. Renaming a resource block without one or more corresponding moved blocks
5. Change resource’s count to for_each, or vice versa

Terraform moved block could be your cure.

From Terraform AzureRM 3.0, the default value of prevent_deletion_if_contains_resources in provider block is true. This will lead to an unstable test because the test subscription has some policies applied, and they will add some extra resources during the run, which can cause failures during destroy of resource groups.

newres is a command-line tool that generates Terraform configuration files for a specified resource type. It automates the process of creating variables.tf and main.tf files, making it easier to get started with Terraform and reducing the time spent on manual configuration.

Module owners MUST use lower snake_casing for naming the following:

• Locals
• Variables
• Outputs
• Resources (symbolic names)
• Modules (symbolic names)

For example: snake_casing_example (every word in lowercase, with each word separated by an underscore _)

Module owners MUST use the below tooling for unit/linting/static/security analysis tests. These are also used in the AVM Compliance Tests.

• Terraform
  • terraform <validate/fmt/test>
• terrafmt
• Checkov
• tflint (with azurerm ruleset)
• Go
  • Some tests are provided as part of the AVM Compliance Tests, but you are free to also use Go for your own tests.