{"id":29403518,"url":"https://github.com/webstean/terraform-azurerm-compute-function-app","last_synced_at":"2026-05-05T18:33:34.968Z","repository":{"id":303807713,"uuid":"1016771188","full_name":"webstean/terraform-azurerm-compute-function-app","owner":"webstean","description":"Andrew's Terraform module for creating an Azure Function App","archived":false,"fork":false,"pushed_at":"2025-07-09T14:41:36.000Z","size":0,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-09T14:52:27.858Z","etag":null,"topics":["azure","cac","configuration","github","iac","module","reusable","terraform"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/webstean.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-09T13:54:01.000Z","updated_at":"2025-07-09T14:41:39.000Z","dependencies_parsed_at":"2025-07-09T14:52:36.380Z","dependency_job_id":"5e202948-1e9e-461e-bdbd-bab22ce40409","html_url":"https://github.com/webstean/terraform-azurerm-compute-function-app","commit_stats":null,"previous_names":["webstean/terraform-azurerm-compute-function-app"],"tags_count":0,"template":false,"template_full_name":"DontShaveTheYak/terraform-module-template","purl":"pkg:github/webstean/terraform-azurerm-compute-function-app","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fterraform-azurerm-compute-function-app","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fterraform-azurerm-compute-function-app/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fterraform-azurerm-compute-function-app/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fterraform-azurerm-compute-function-app/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/webstean","download_url":"https://codeload.github.com/webstean/terraform-azurerm-compute-function-app/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/webstean%2Fterraform-azurerm-compute-function-app/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264637851,"owners_count":23642062,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","cac","configuration","github","iac","module","reusable","terraform"],"created_at":"2025-07-10T19:00:32.120Z","updated_at":"2025-10-12T21:56:38.001Z","avatar_url":"https://github.com/webstean.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- BEGIN_TF_DOCS --\u003e\n# Andrew's Terraform module for creating an Azure Function App\nFunction as a Service (FaaS) with Azure, you'll need to specify runtime, such as support python, etc.. The default is \"powershell\"\n\n[GitHub Repository](https://github.com/webstean/terraform-azurerm-compute-function-app)\n\n[Terraform Registry for this module](https://github.com/webstean/terraform-azurerm-compute-function-app)\n\n[Terraform Registry Home - my other modules](https://registry.terraform.io/namespaces/webstean)\n\n[![Python][terraform-shield]][tf-version]\n[![Latest][version-shield]][release-url]\n[![Tests][test-shield]][test-url]\n[![License][license-shield]][license-url]\n\u003c!-- [![Contributors][contributors-shield]][contributors-url]\n[![Forks][forks-shield]][forks-url]\n[![Stargazers][stars-shield]][stars-url]\n[![Issues][issues-shield]][issues-url] --\u003e  \n\nThis module is intended to be an **example** of how you can use Terraform Azure modules in a enterprise like environment.\n\n\u003e [!IMPORTANT]\n\u003e This module is **NOT** intended to be used directly. You should fork them and then customise to your own purposes.\n\u003e\n\n\u003e [!NOTE]\n\u003e At the moment, these modules only support deployment into the Australia regions (australiaeast, australiasoutheast, australiacentral)\n\u003e And, they don't support any value for the SKU variable other than \"free\", this is to avoid the deployment of super expensive resources.\n\u003e Plus, the variable: private\\_endpoints\\_always\\_deployed must be false, to prevent Private Endpoint from being created and costing you money.\n\u003e\n\u003e You'll need to fork and customise files like region.tf, main.tf, variables.tf and redeploy into your own Terraform repository (public or private)\n\nThe real work is done by the Microsoft supplied and supported **Azure Verified Modules**. So as things change, you can rely on the Microsoft Azure Verified Modules (AVM) to do the heavy lifting for you and you can just concentre on the high-level.\n\nFor more information on **Azure Verified Modules**, please visit the [AVM portal](https://aka.ms/AVM).\n\nThis module is ultimately, just boilerplate, validation and some opinions on some of input variables into the Microsoft AVM's should be.\nAlthough, if you don't like these choices, you can simple edit this module to suit your own needs.\n\nAnother intention of this module, is to be permit to be called via the [Azure Deployment Environment via the extensiblity model](https://learn.microsoft.com/en-us/azure/deployment-environments/how-to-configure-extensibility-model-custom-image?tabs=custom-script%2Cterraform-script%2Cprivate-registry\u0026pivots=terraform), although is currently a work in prgoress is not currently supported.\n\n\u003e [!IMPORTANT]\n\u003e This modules assigns permissions to these resources it creates. Non-Humans are assigned user-assigned permission, whilst actual humans that are members of an Entra ID groups can review the resources and most of its contents.\n\u003e One goal of these modules is that changes should be done by these modules, not by manually by humans. So the assigned permsisions are very low to what you would typically see. The permissions are generally just \"Reader and Data Access\".\n\u003e\n\n```shell\n# Example of how to create a release of any module\ngh release create v0.0.1 --title \"v0.0.1\" --notes \"Initial release\"\ngh release delete v0.0.1 --cleanup-tag -yes\n\ngh release create v0.0.2 --title \"v0.0.2\" --notes \"New release\"\n\n```\n\nExample:\n```hcl\nmodule \"function_app\" {\n  source  = \"webstean/compute-function-app/azurerm\"\n  version = \"~\u003e0.0, \u003c 1.0\"\n\n  ## identity\n  entra_group_unified_id         = module.application_landing_zone.entra_group_unified_id         ## services/applications\n  entra_group_pag_id             = module.application_landing_zone.entra_group_pag_id             ## services/applications\n  user_assigned_identity_name    = module.application_landing_zone.user_assigned_identity_name    ## humans/admin users\n  ## naming\n  resource_group_name = module.application_landing_zone.resource_group_name\n  landing_zone_name   = module.application_landing_zone.landing_zone_name\n  project_name        = \"main\"\n  application_name    = \"webstean\"\n  ## sizing\n  sku_name            = \"free\"          ## other options are: basic, standard, premium or isolated\n  size_name           = \"small\"         ## other options are: medium, large or x-large\n  location_key        = \"australiaeast\" ## other supported options are: australiasoutheast, australiacentral\n  private_endpoints_always_deployed = false ## other option is: true\n  ## these are just use for the tags to be applied to each resource\n  owner_service        = \"unknown@myorg.com\"          ## business owner  - email address, used for visbility \u0026 alerts\n  owner_tech           = \"unknown@myorg.com\"          ## business owner  - email address, used for visbility \u0026 alerts\n  cost_centre          = \"unknown\"                    ## from the accountants, its the owner's cost centre. Freeform text\n  monitoring           = \"not-monitored\"              ## other options are: 24-7 or 8-5\n  ##\n  subscription_id     = data.azurerm_client_config.current.subscription_id\n\n  ## Specific to Azure Functions    \n  runtime            = \"python\" ## supported runtimes are: python, nodejs, .net, java, powershell, custom. Defaults to powershell\n\n}\n```\n---\n## License\n\nDistributed under the Mozilla Public License Version 2.0 License. See [LICENSE](./LICENSE) for more information.\n\n\u003c!-- markdownlint-disable MD033 --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | ~\u003e1.0, \u003c 2.0 |\n| \u003ca name=\"requirement_acme\"\u003e\u003c/a\u003e [acme](#requirement\\_acme) | ~\u003e2.0, \u003c 3.0 |\n| \u003ca name=\"requirement_alz\"\u003e\u003c/a\u003e [alz](#requirement\\_alz) | ~\u003e0.0, \u003c 1.0 |\n| \u003ca name=\"requirement_azapi\"\u003e\u003c/a\u003e [azapi](#requirement\\_azapi) | ~\u003e 2.0, \u003c 3.0 |\n| \u003ca name=\"requirement_azuread\"\u003e\u003c/a\u003e [azuread](#requirement\\_azuread) | ~\u003e 3.0, \u003c 4.0 |\n| \u003ca name=\"requirement_azurerm\"\u003e\u003c/a\u003e [azurerm](#requirement\\_azurerm) | ~\u003e4.0, \u003c 5.0 |\n| \u003ca name=\"requirement_random\"\u003e\u003c/a\u003e [random](#requirement\\_random) | ~\u003e3.0, \u003c 4.0 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [azuread_service_principal.existing-apim](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource |\n| [azuread_service_principal.existing-dynamicserp](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource |\n| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/resources/service_principal) | resource |\n| [random_string.naming_seed](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |\n| [azuread_application_published_app_ids.well_known](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/application_published_app_ids) | data source |\n| [azuread_client_config.current](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/client_config) | data source |\n| [azuread_domains.admin](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.default](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.initial](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.root](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_domains.unmanaged](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/domains) | data source |\n| [azuread_group.this](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/group) | data source |\n| [azuread_service_principal.existing-apim](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source |\n| [azuread_service_principal.existing-dynamicserp](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source |\n| [azuread_service_principal.msgraph](https://registry.terraform.io/providers/hashicorp/azuread/latest/docs/data-sources/service_principal) | data source |\n| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |\n| [azurerm_dns_zone.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/dns_zone) | data source |\n| [azurerm_management_group.root](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/management_group) | data source |\n| [azurerm_resource_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |\n| [azurerm_role_definition.blob_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.blob_owner](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.blob_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.file_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.owner](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_processor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.queue_sender](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.reader_and_access](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.smb_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.smb_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.storage_defender](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.table_contributor](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_role_definition.table_reader](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/role_definition) | data source |\n| [azurerm_subscription.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |\n| [azurerm_subscriptions.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscriptions) | data source |\n| [azurerm_user_assigned_identity.graph](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/user_assigned_identity) | data source |\n| [azurerm_user_assigned_identity.lz](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/user_assigned_identity) | data source |\n\n\u003c!-- markdownlint-disable MD013 --\u003e\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_dns_zone_name\"\u003e\u003c/a\u003e [dns\\_zone\\_name](#input\\_dns\\_zone\\_name) | This variable provides the name public (future maybe private) DNS zone for the landing zone. The landing zone module will create this DNS zone and two sub-zones for the application (appi) and apis (api)\u003cbr/\u003eAny custom names will be defined with this DNS zone, so that the DNS zone can be used to resolve the names of the resources in the landing zone. | `string` | n/a | yes |\n| \u003ca name=\"input_entra_group_pag_id\"\u003e\u003c/a\u003e [entra\\_group\\_pag\\_id](#input\\_entra\\_group\\_pag\\_id) | The existing Entra ID Workforce group id (a UUID) that will be given full-ish permissions to the resource.\u003cbr/\u003eThis is intended for humans, not applications, so that they can access and perform some manage the resources.\u003cbr/\u003eOne of the intention of this module, is to only allow very limit admin access, so they everything can be managed by the module. (ie by code)\u003cbr/\u003eTherefore you'll tpyically see that reosurce creates won't give high-level priviledge like Owner, Contributor to users. | `string` | n/a | yes |\n| \u003ca name=\"input_org_fullname\"\u003e\u003c/a\u003e [org\\_fullname](#input\\_org\\_fullname) | The full name (long form) for your organisation. This is used for more , for use in descriptive and display names.\u003cbr/\u003eThis is intended to be a human readable name, so that it can be used in the Azure | `string` | n/a | yes |\n| \u003ca name=\"input_org_shortname\"\u003e\u003c/a\u003e [org\\_shortname](#input\\_org\\_shortname) | The short name (abbreviation) of the entire organisation, use for naming Azure resources.\u003cbr/\u003eAvoid using exotic characters, so that it can be used in all sorts of places, like DNS names, Azure resource names, Azure AD display names etc... | `string` | n/a | yes |\n| \u003ca name=\"input_resource_group_name\"\u003e\u003c/a\u003e [resource\\_group\\_name](#input\\_resource\\_group\\_name) | (Required) The name of the resource group to deploy the resources into. This resource group needs to be already exist! | `string` | n/a | yes |\n| \u003ca name=\"input_subscription_id\"\u003e\u003c/a\u003e [subscription\\_id](#input\\_subscription\\_id) | The Azure Subscription ID for the AzureRM, AzureAD, AzApi providers to use for their deployment.\u003cbr/\u003eThis is the subscription where the resources will be deployed and whoever is running the module (terraform code) must have high-level permission to this subscription.\u003cbr/\u003eTypically this needs to be the following Azure RBAC roles: User Access Administrator and Contributor permissions.\u003cbr/\u003eIf you using GitHub / Azure DevOps (ADO), then you should leverage OIDC to provide federation, instead of having to maintain secrets, which can be compromised. | `string` | n/a | yes |\n| \u003ca name=\"input_user_assigned_identity_landing_zone_name\"\u003e\u003c/a\u003e [user\\_assigned\\_identity\\_landing\\_zone\\_name](#input\\_user\\_assigned\\_identity\\_landing\\_zone\\_name) | The Entra ID / Azure Managed Identity that will give access to this resource.\u003cbr/\u003eNote, that Managed Identities can be created in either Entra ID (azuread\\_application) or Azure ()\u003cbr/\u003eUnless you need a secret for things, like external authentication, then you should use the Azure variety.\u003cbr/\u003eThis module only support user-assigned managed identities, not system-assigned managed identities. | `string` | n/a | yes |\n| \u003ca name=\"input_application_name\"\u003e\u003c/a\u003e [application\\_name](#input\\_application\\_name) | (Required) application\\_name (freeform) so we can tell what each resource is being used for\u003cbr/\u003eThis should be a readily recongnisable name for you organisation, and is intended to be a large group of resources that comprise that application.\u003cbr/\u003eA common mistake with Azure (and other clouds), is creating too many \"applications\", like spliting thing into integration, website, database etc...\u003cbr/\u003eThis usually just makes it harder to manage, so we recommend that you create a single application for each \"application\" that you are deploying.\u003cbr/\u003eUnlike what you may have experience on-premises, put the components like a frontend and database in the same namespace (like as application) you can still every securely separate them from both a security and opertational perspecitve.\u003cbr/\u003eThe default is \"main\". Another good options would be \"default\" but even better would be your internal application name. | `string` | `\"main\"` | no |\n| \u003ca name=\"input_bypass_ip_cidr\"\u003e\u003c/a\u003e [bypass\\_ip\\_cidr](#input\\_bypass\\_ip\\_cidr) | (Required) bypass\\_ip\\_cidr (CIDR notation) is a list of IP addresses or CIDR ranges that should be allowed to bypass the firewall for Azure PaaS service like storage accounts, sql servers etc..\u003cbr/\u003e  This is typically used for management purposes, such as allowing access from a specific IP address or range of IP addresses, such as a management workstation or a specific network. | `list(string)` | `[]` | no |\n| \u003ca name=\"input_cost_centre\"\u003e\u003c/a\u003e [cost\\_centre](#input\\_cost\\_centre) | Cost Centre for assigning resource costs, can be be anything number or string or combination (perhaps consider using an email address | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_data_phi\"\u003e\u003c/a\u003e [data\\_phi](#input\\_data\\_phi) | (Required) data\\_phi (true or false) These resources will contain and/or process Personally Health Information (PHI)\u003cbr/\u003eNote, this WILL NOT enable priivate endppoints, since is conntrolled via the var.always\\_enable\\_private\\_endpoints variable.\u003cbr/\u003eHowever, is does enable a lot of security services, that are typcially called \"Defender\" by Microsoft.\u003cbr/\u003eThese services add a lot of values, such as vulnerability scanning, threat detection, security alerts, and more.\u003cbr/\u003eBut, they come at a cost, so you need to be aware of that. | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_data_pii\"\u003e\u003c/a\u003e [data\\_pii](#input\\_data\\_pii) | (Required) data\\_pii (true or false) These resources will contain and/or process Personally Identifiable Information (PII)\u003cbr/\u003eNote, this WILL NOT enable priivate endppoints, since is conntrolled via the var.always\\_enable\\_private\\_endpoints variable.\u003cbr/\u003eHowever, is does enable a lot of security services, that are typcially called \"Defender\" by Microsoft.\u003cbr/\u003eThese services add a lot of values, such as vulnerability scanning, threat detection, security alerts, and more.\u003cbr/\u003eBut, they come at a cost, so you need to be aware of that. | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_enable_telemetry\"\u003e\u003c/a\u003e [enable\\_telemetry](#input\\_enable\\_telemetry) | This variable controls whether or not Microsoft telemetry is enabled for the AVM modules, that this module will ultimately call.\u003cbr/\u003eFor more information see https://aka.ms/avm/telemetryinfo.\u003cbr/\u003eIf it is set to false, then no telemetry will be collected.\u003cbr/\u003eThe default is true. | `bool` | `false` | no |\n| \u003ca name=\"input_entra_group_unified_id\"\u003e\u003c/a\u003e [entra\\_group\\_unified\\_id](#input\\_entra\\_group\\_unified\\_id) | The Entra ID Workforce group id (a UUID) that will be given full-ish permissions to the resource.\u003cbr/\u003eThis is intended for humans, not applications, so that they can access and perform some management of the created resources.\u003cbr/\u003eOne of the intention of this module, is to only allow very limit admin access, so they everything can be managed by the module. (ie by code)\u003cbr/\u003eTherefore you'll typically see that module wwill NOT grant high-level priviledge like Owner, Contributor to users. | `string` | `null` | no |\n| \u003ca name=\"input_landing_zone_name\"\u003e\u003c/a\u003e [landing\\_zone\\_name](#input\\_landing\\_zone\\_name) | (Required) environment\\_name (freeform) must be one of (\"core\", \"platform\", \"play\", \"dev\", \"test\", \"mvp\", \"uat\", \"sit\", \"preprod\", \"prod\", \"production\", \"live\") so we can tell what each resource is being used for\u003cbr/\u003eThis also coressponds to the Application Landing Zone that the resource/resources will be deployed into.\u003cbr/\u003eAn application landing zone consist of a set of secure, compliant and container type resources, intended to support many applications, web sites and databases.\u003cbr/\u003eSome people in our opinion, over use landing zones and create too many of them, which makes it harder to manage.\u003cbr/\u003eWe would suggest, you consider a landing\\_zone as what you might call an environment: DEV, TEST, UAT, PreProd etc...\u003cbr/\u003eThe default is \"test\" | `string` | `\"test\"` | no |\n| \u003ca name=\"input_location_key\"\u003e\u003c/a\u003e [location\\_key](#input\\_location\\_key) | The Azure location where the resource is to be deployed into. This is a key into the local.regions map (see locals.tf), which contains the applicable Azure region information.\u003cbr/\u003eThe local.tf is used to map the location\\_key to the actual Azure region name, so that it can be used in the azurerm/azapi providers.\u003cbr/\u003eUnless you are using Australian regions, then you will need to customise the local.regions map to include your region amd alter the validation statements below, since they initially only support the Australia regions (australieast, australiasoutheast, australiacentral) | `string` | `\"australiaeast\"` | no |\n| \u003ca name=\"input_monitoring\"\u003e\u003c/a\u003e [monitoring](#input\\_monitoring) | Set the resource tags for all the resources, so you know what sort of monitoring the resources will be eligible for.\u003cbr/\u003eYou can even use these tags, to only enrolled resources in certain monitoring solutions and what time alerts should be generated (anytime, office hours only).\u003cbr/\u003eYou'll typically need to be comply with ITIL and other opertional frameworks and potentially enteprise requirements.\u003cbr/\u003elike Azure Monitor, Azure Log Analytics, Azure Application Insights etc...\u003cbr/\u003eThe supported values are\"24-7\", \"8-5\" or \"not-monitored\"\u003cbr/\u003eThe default is \"not-monitored\" which means that the resources will not be enrolled in any monitoring solution. | `string` | `\"not-monitored\"` | no |\n| \u003ca name=\"input_owner_service\"\u003e\u003c/a\u003e [owner\\_service](#input\\_owner\\_service) | The name (preferably email address) of the service owner for contacting in a disaster or seeking guiandance.\u003cbr/\u003eThis is intended to assist in complying with frameworks like ITIL, COBIT, ISO27001, NIST etc...\u003cbr/\u003eHe basically tell who is responsible for the resource, so that if when these is a problem, we know who to contact.\u003cbr/\u003eThis will appear in the owner tag of the resource, so that it can be easily found. | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_owner_tech\"\u003e\u003c/a\u003e [owner\\_tech](#input\\_owner\\_tech) | The name (preferably email address) of the technicalwner for contacting in a disaster or seeking guiandance.\u003cbr/\u003eThis is intended to assist in complying with frameworks like ITIL, COBIT, ISO27001, NIST etc...\u003cbr/\u003eHe basically tell who is responsible for the resource, so that if when these is a problem, we know who to contact.\u003cbr/\u003eThis will appear in the owner tag of the resource, so that it can be easily found. | `string` | `\"unknown\"` | no |\n| \u003ca name=\"input_private_endpoints_always_deployed\"\u003e\u003c/a\u003e [private\\_endpoints\\_always\\_deployed](#input\\_private\\_endpoints\\_always\\_deployed) | (Required) private\\_endpoints\\_always\\_deployed (true or false) If private endpoints should be deployed, where available. This requires the sku\\_name to be either \"premium\" or \"isolated\"\u003cbr/\u003eThe use of Private Endpoints is typically a hardcore requirement for hosting real data. Any PEN test will almost always want Private Endpoints everywhere.\u003cbr/\u003eLooking at the Azure Pricing, you might think that Private Endpoints arn't that expensive. But you would be WROMG!\u003cbr/\u003eYou are paying for the private endpoint basically for every second that it exists. It does not take long for these costs to add up.\u003cbr/\u003eUnless you are hosting real data (PII and PHI) then you should not use Private Endpoints, unless you want to waste money, and for really large organisation this might not be a concern.\u003cbr/\u003eWe have as a separate configuration option for private endpoints, because sometimes people want to test private endpoints in DEV scenarios.\u003cbr/\u003eTechnically private endpoint should never be needed, as any Azure endpoint is protected via Entra ID authentcation/authorisation, but this is a single point of failure. If Entra was misconfigured for example, your data would potneitally be exposed.\u003cbr/\u003eHence, Prviate Endpoints are a good idea, by providing a 2nd layer of security (look up the swiss cheese approach to security. But they ultimately NOT CHEAP\u003cbr/\u003eThe default is false And, it can only be set to true, unless the sku\\_name is set to either \"premium\" or \"isolated\".\u003cbr/\u003eThis is because Private Endpoints are typically only available for the higher end skus | `bool` | `false` | no |\n| \u003ca name=\"input_private_endpoints_subnet_name\"\u003e\u003c/a\u003e [private\\_endpoints\\_subnet\\_name](#input\\_private\\_endpoints\\_subnet\\_name) | (Required) private\\_endpoints\\_subnet\\_name (string) the name of the Azure VNet subnet, you want the Private Endpoint created in | `string` | `null` | no |\n| \u003ca name=\"input_private_endpoints_vnet_name\"\u003e\u003c/a\u003e [private\\_endpoints\\_vnet\\_name](#input\\_private\\_endpoints\\_vnet\\_name) | (Required) private\\_endpoints\\_subnet\\_name (string) the name of the Azure VNet subnet, you want the Private Endpoint created in | `string` | `null` | no |\n| \u003ca name=\"input_project_name\"\u003e\u003c/a\u003e [project\\_name](#input\\_project\\_name) | (Required) project\\_name (freeform) is used in special cases, where you want to deploy two or more applications, with the same name in the same landing zone.\u003cbr/\u003eThis would be usualy, typically you would only deploy the application once per landing zone, once in UAT, once in DEV and once in SIT etc..\u003cbr/\u003eHowever, sometimes in DEV for example, you need to support multiple developer teams, working on the same code or different parts of the project and they historically clash.\u003cbr/\u003eThe default is \"default\" and we recommend you pick a project\\_name and stick to the same one. \u003cbr/\u003eIt should only be changed, when in the special case of deploying the same app in the same landing zone more than once. | `string` | `\"default\"` | no |\n| \u003ca name=\"input_size_name\"\u003e\u003c/a\u003e [size\\_name](#input\\_size\\_name) | (Required) The size\\_name (only specific values) for the size of resources to be deployed.\u003cbr/\u003eThis is an option for some resources, in addition to the SKU and the module makes decisions, which obviously just our opinion.\u003cbr/\u003eFeel free to adjust the module as you see fit, but we are pretty confident our resources are pretty reasonable for most circumstances.\u003cbr/\u003eThe support vaalues are \"small\", \"medium\", \"large\" or \"x-large\"\u003cbr/\u003eNote: The larger the size the higher the cost! These cost differecnes can be very significant, so please be careful.\u003cbr/\u003eCurrently the validation only support the use of the \"small\" SKU, please edit to use the others. | `string` | `\"small\"` | no |\n| \u003ca name=\"input_sku_name\"\u003e\u003c/a\u003e [sku\\_name](#input\\_sku\\_name) | (Required) The sku\\_name (only specific values) of the resource to be created (free, basic, standard, premium or isolated)\u003cbr/\u003eThe higher the sku, the more capabilities such as high availability and auto scalling are available.\u003cbr/\u003eThese modules, determine which sku\\_name corresponds to which actual Azure SKU, that you would like to deploy.\u003cbr/\u003eObviously, this is subject to opinion, so whilst we are configdent our choices work well in most environments, you are free to adjust this module to so that you can use the same sku\\_name across all modules.\u003cbr/\u003eThe higher end skus (premium, isolated) are typically very expensive and totaly overkill for most applications.\u003cbr/\u003eNote: The free sku is only applicable to some resources and in some cases the resources created with the \"free\" sku may not actually be free, but should be very minimal cost.\u003cbr/\u003eThe validation rules, only permit the use of the \"free\" and \"basic\" sku to prevent unintended consequences (ie a huge bill at the end of the month)\u003cbr/\u003eThe module will happily create these higher SKU resource, so simply edit the validation rule (below) to leverage them. | `string` | `\"free\"` | no |\n| \u003ca name=\"input_user_assigned_identity_graph_name\"\u003e\u003c/a\u003e [user\\_assigned\\_identity\\_graph\\_name](#input\\_user\\_assigned\\_identity\\_graph\\_name) | The Entra ID / Azure Managed Identity that will give access to this resource.\u003cbr/\u003eNote, that Managed Identities (as they known in Azure portal) can be created in either within Entra ID (with azuread\\_application) or within Azure (with azurerm\\_user\\_assigned\\_identity)\u003cbr/\u003eUnless you need a secret for things, like external authentication, then is generally better to use the Azure variety.\u003cbr/\u003eThis module only support user-assigned managed identities, not system-assigned managed identities. | `string` | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_application_name\"\u003e\u003c/a\u003e [application\\_name](#output\\_application\\_name) | (Required) application name (freeform) so we can tell what each resource is being used for\u003cbr/\u003eThis also coressponds to the Application Landing Zone that the resource/resources will be deployed into.\u003cbr/\u003eThis is ignored, when creatting an Application Landing Zone, as the name is derived from the environment\\_name. |\n| \u003ca name=\"output_cost_centre\"\u003e\u003c/a\u003e [cost\\_centre](#output\\_cost\\_centre) | Cost Centre for assigning resource costs, can be be anything number or string or combination (perhaps consider using an email address |\n| \u003ca name=\"output_data_phi\"\u003e\u003c/a\u003e [data\\_phi](#output\\_data\\_phi) | (Required) These resources will contain and/or process Personally Health Information (PHI) |\n| \u003ca name=\"output_data_pii\"\u003e\u003c/a\u003e [data\\_pii](#output\\_data\\_pii) | (Required) These resources will contain and/or process Personally Identifiable Information (PII) |\n| \u003ca name=\"output_landing_zone_name\"\u003e\u003c/a\u003e [landing\\_zone\\_name](#output\\_landing\\_zone\\_name) | (Required) environment\\_name must be one of (\"core\", \"platform\", \"play\", \"dev\", \"test\", \"uat\", \"sit\", \"preprod\", \"prod\", \"live\") so we can tell what each resource is being used for\u003cbr/\u003eThis also coressponds to the Application Landing Zone that the resource/resources will be deployed into. |\n| \u003ca name=\"output_location_key\"\u003e\u003c/a\u003e [location\\_key](#output\\_location\\_key) | The Azure location where the resource is to be deployed into. This is a key into the local.regions map, which contains the applicable Azure region information. |\n| \u003ca name=\"output_monitoring\"\u003e\u003c/a\u003e [monitoring](#output\\_monitoring) | Set the tags, that defines what sort of monitoring the resources will be eligible for |\n| \u003ca name=\"output_owner_service\"\u003e\u003c/a\u003e [owner\\_service](#output\\_owner\\_service) | The name (preferably email address) of the resource owner for contacting in a disaster or seeking guiandance |\n| \u003ca name=\"output_owner_tech\"\u003e\u003c/a\u003e [owner\\_tech](#output\\_owner\\_tech) | The name (preferably email address) of the resource owner for contacting in a disaster or seeking guiandance |\n| \u003ca name=\"output_private_endpoints_always_deployed\"\u003e\u003c/a\u003e [private\\_endpoints\\_always\\_deployed](#output\\_private\\_endpoints\\_always\\_deployed) | (Required) If private endpoints should be deployed, where available. Requires the cost to be set to High |\n| \u003ca name=\"output_project_name\"\u003e\u003c/a\u003e [project\\_name](#output\\_project\\_name) | (Required) project name used to distinguish that exist to enable the rare case where you want the same application deployed\u003cbr/\u003emultiple times (as a different) projects within the same application landing zone. |\n| \u003ca name=\"output_region_lake_containers\"\u003e\u003c/a\u003e [region\\_lake\\_containers](#output\\_region\\_lake\\_containers) | n/a |\n| \u003ca name=\"output_size_name\"\u003e\u003c/a\u003e [size\\_name](#output\\_size\\_name) | (Required) The size of the resultant resource/resources (small, medium, large or x-large).\u003cbr/\u003eNote: The larger the size the higher the cost! |\n| \u003ca name=\"output_sku_name\"\u003e\u003c/a\u003e [sku\\_name](#output\\_sku\\_name) | (Required) The sku\\_name of the resource to be created (for example, free, basic, standard, premium or isolated)\u003cbr/\u003eThe higher the sku, the more capabilities such as high availability and auto scalling are available. |\n| \u003ca name=\"output_subscription_display_name\"\u003e\u003c/a\u003e [subscription\\_display\\_name](#output\\_subscription\\_display\\_name) | Azure Subscription Display Name |\n| \u003ca name=\"output_subscription_id\"\u003e\u003c/a\u003e [subscription\\_id](#output\\_subscription\\_id) | Azure Subscription ID |\n| \u003ca name=\"output_tenant_id\"\u003e\u003c/a\u003e [tenant\\_id](#output\\_tenant\\_id) | Azure Tenant ID |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_naming-application\"\u003e\u003c/a\u003e [naming-application](#module\\_naming-application) | Azure/naming/azurerm | ~\u003e0.0, \u003c 1.0 |\n\n---\n\n## Additional References\n\n\u003cdetails\u003e\n\u003csummary\u003eClick to expand\u003c/summary\u003e\n\n- [Terraform Download](https://www.terraform.io/downloads.html)\n- [Visual Code Download](https://code.visualstudio.com/Download)\n- [Powershell VS Code Extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode.PowerShell)\n- [HashiCorp Terraform VS Code Extension](https://marketplace.visualstudio.com/items?itemName=HashiCorp.terraform)\n- [Azure Terraform VS Code Extension Name](https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-azureterraform)\n- [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-windows?tabs=azure-cli)\n- [Configure the Azure Terraform Visual Studio Code extension](https://docs.microsoft.com/en-us/azure/developer/terraform/configure-vs-code-extension-for-terraform)\n- [Setup video](https://youtu.be/YmbmpGdhI6w)\n\n\u003c/details\u003e\n\nGenerated with [terraform-docs](https://terraform-docs.io/)\n\u003c!-- END_TF_DOCS --\u003e","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwebstean%2Fterraform-azurerm-compute-function-app","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwebstean%2Fterraform-azurerm-compute-function-app","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwebstean%2Fterraform-azurerm-compute-function-app/lists"}