https://github.com/launchbynttdata/tf-azurerm-module_primitive-function_app_slot

azure infrastructure-as-code platform-automation primitive terraform
Last synced: about 2 months ago
JSON representation
Host: GitHub
URL: https://github.com/launchbynttdata/tf-azurerm-module_primitive-function_app_slot
Owner: launchbynttdata
License: apache-2.0
Created: 2024-10-01T14:59:00.000Z (over 1 year ago)
Default Branch: main
Last Pushed: 2026-04-14T19:19:09.000Z (2 months ago)
Last Synced: 2026-04-14T21:22:27.172Z (2 months ago)
Topics: azure, infrastructure-as-code, platform-automation, primitive, terraform
Language: HCL
Size: 227 KB
Stars: 0
Watchers: 0
Forks: 1
Open Issues: 3
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: CODEOWNERS
- Notice: NOTICE
Awesome Lists containing this project

README

          # tf-azurerm-module_primitive-function_app_slot

[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

[![License: CC BY-NC-ND 4.0](https://img.shields.io/badge/License-CC_BY--NC--ND_4.0-lightgrey.svg)](https://creativecommons.org/licenses/by-nc-nd/4.0/)

## Overview

This terraform module provisions an Azure Function App with additional pre-requisite resources

## Pre-Commit hooks

[.pre-commit-config.yaml](.pre-commit-config.yaml) file defines certain `pre-commit` hooks that are relevant to terraform, golang and common linting tasks. There are no custom hooks added.

`commitlint` hook enforces commit message in certain format. The commit contains the following structural elements, to communicate intent to the consumers of your commit messages:

- **fix**: a commit of the type `fix` patches a bug in your codebase (this correlates with PATCH in Semantic Versioning).

- **feat**: a commit of the type `feat` introduces a new feature to the codebase (this correlates with MINOR in Semantic Versioning).

- **BREAKING CHANGE**: a commit that has a footer `BREAKING CHANGE:`, or appends a `!` after the type/scope, introduces a breaking API change (correlating with MAJOR in Semantic Versioning). A BREAKING CHANGE can be part of commits of any type.

footers other than BREAKING CHANGE:  may be provided and follow a convention similar to git trailer format.

- **build**: a commit of the type `build` adds changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)

- **chore**: a commit of the type `chore` adds changes that don't modify src or test files

- **ci**: a commit of the type `ci` adds changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)

- **docs**: a commit of the type `docs` adds documentation only changes

- **perf**: a commit of the type `perf` adds code change that improves performance

- **refactor**: a commit of the type `refactor` adds code change that neither fixes a bug nor adds a feature

- **revert**: a commit of the type `revert` reverts a previous commit

- **style**: a commit of the type `style` adds code changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)

- **test**: a commit of the type `test` adds missing tests or correcting existing tests

Base configuration used for this project is [commitlint-config-conventional (based on the Angular convention)](https://github.com/conventional-changelog/commitlint/tree/master/@commitlint/config-conventional#type-enum)

If you are a developer using vscode, [this](https://marketplace.visualstudio.com/items?itemName=joshbolduc.commitlint) plugin may be helpful.

`detect-secrets-hook` prevents new secrets from being introduced into the baseline. TODO: INSERT DOC LINK ABOUT HOOKS

In order for `pre-commit` hooks to work properly

- You need to have the pre-commit package manager installed. [Here](https://pre-commit.com/#install) are the installation instructions.

- `pre-commit` would install all the hooks when commit message is added by default except for `commitlint` hook. `commitlint` hook would need to be installed manually using the command below

```

pre-commit install --hook-type commit-msg

```

## To test the resource group module locally

1. For development/enhancements to this module locally, you'll need to install all of its components. This is controlled by the `configure` target in the project's [`Makefile`](./Makefile). Before you can run `configure`, familiarize yourself with the variables in the `Makefile` and ensure they're pointing to the right places.

```

make configure

```

This adds in several files and directories that are ignored by `git`. They expose many new Make targets.

2. _THIS STEP APPLIES ONLY TO MICROSOFT AZURE. IF YOU ARE USING A DIFFERENT PLATFORM PLEASE SKIP THIS STEP._ The first target you care about is `env`. This is the common interface for setting up environment variables. The values of the environment variables will be used to authenticate with cloud provider from local development workstation.

`make configure` command will bring down `azure_env.sh` file on local workstation. Devloper would need to modify this file, replace the environment variable values with relevant values.

These environment variables are used by `terratest` integration suit.

Service principle used for authentication(value of ARM_CLIENT_ID) should have below privileges on resource group within the subscription.

```

"Microsoft.Resources/subscriptions/resourceGroups/write"

"Microsoft.Resources/subscriptions/resourceGroups/read"

"Microsoft.Resources/subscriptions/resourceGroups/delete"

```

Then run this make target to set the environment variables on developer workstation.

```

make env

```

3. The first target you care about is `check`.

**Pre-requisites**

Before running this target it is important to ensure that, developer has created files mentioned below on local workstation under root directory of git repository that contains code for primitives/segments. Note that these files are `azure` specific. If primitive/segment under development uses any other cloud provider than azure, this section may not be relevant.

- A file named `provider.tf` with contents below

```

provider "azurerm" {

  features {}

}

```

- A file named `terraform.tfvars` which contains key value pair of variables used.

Note that since these files are added in `gitignore` they would not be checked in into primitive/segment's git repo.

After creating these files, for running tests associated with the primitive/segment, run

```

make check

```

If `make check` target is successful, developer is good to commit the code to primitive/segment's git repo.

`make check` target

- runs `terraform commands` to `lint`,`validate` and `plan` terraform code.

- runs `conftests`. `conftests` make sure `policy` checks are successful.

- runs `terratest`. This is integration test suit.

- runs `opa` tests

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | ~> 1.5 |

|  [azurerm](#requirement\_azurerm) | ~> 3.30 |

|  [null](#requirement\_null) | ~> 3.2 |

## Providers

| Name | Version |

|------|---------|

|  [azurerm](#provider\_azurerm) | 3.116.0 |

## Modules

No modules.

## Resources

| Name | Type |

|------|------|

| [azurerm_linux_function_app_slot.main](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_function_app_slot) | resource |

| [azurerm_windows_function_app_slot.main](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_function_app_slot) | resource |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [name](#input\_name) | (Required) Specifies the name of the Function App Slot. Changing this forces a new resource to be created. | `string` | n/a | yes |

|  [function\_app\_id](#input\_function\_app\_id) | (Required) Specifies the ID of the Function App in which to create the slot. Changing this forces a new resource to be created. | `string` | n/a | yes |

|  [resource\_group\_name](#input\_resource\_group\_name) | (Required) Specifies the name of the Resource Group in which to create the Function App Slot. | `string` | n/a | yes |

|  [site\_config](#input\_site\_config) | (Required) A site\_config block. | 
object({
    always_on             = optional(bool, false)
    api_definition_url    = optional(string)
    api_management_api_id = optional(string)
    app_command_line      = optional(string)
    app_scale_limit       = optional(number)
    app_service_logs = optional(object({
      disk_quota_mb         = optional(number, 35)
      retention_period_days = optional(number, 5)
    }))
    application_insights_connection_string = optional(string)
    application_insights_key               = optional(string)
    application_stack = optional(object({
      docker = optional(object({
        registry_url      = string
        image_name        = string
        image_tag         = string
        registry_username = optional(string)
        registry_password = optional(string)
      }))
      dotnet_version              = optional(string)
      java_version                = optional(string)
      node_version                = optional(string)
      powershell_core_version     = optional(string)
      python_version              = optional(string)
      use_custom_runtime          = optional(bool)
      use_dotnet_isolated_runtime = optional(bool)
    }))
    auto_swap_slot_name                           = optional(string)
    container_registry_managed_identity_client_id = optional(string)
    container_registry_use_managed_identity       = optional(bool)
    cors = optional(object({
      allowed_origins     = optional(list(string))
      support_credentials = optional(bool)
    }))
    default_documents                 = optional(list(string))
    detailed_error_logging_enabled    = optional(bool)
    ftps_state                        = optional(string)
    health_check_eviction_time_in_min = optional(number)
    health_check_path                 = optional(string)
    http2_enabled                     = optional(bool)
    ip_restriction = optional(list(object({
      action     = optional(string)
      ip_address = optional(string)
      headers = optional(object({
        x_azure_fdid      = optional(list(string), null)
        x_fd_health_probe = optional(list(string), null)
        x_forwarded_for   = optional(list(string), null)
        x_forwarded_host  = optional(list(string), null)
      }))
      name                      = optional(string)
      priority                  = optional(number)
      service_tag               = optional(string)
      virtual_network_subnet_id = optional(string)
    })))
    ip_restriction_default_action    = optional(string)
    linux_fx_version                 = optional(string)
    load_balancing_mode              = optional(string)
    managed_pipeline_mode            = optional(string)
    minimum_tls_version              = optional(string)
    pre_warmed_instance_count        = optional(number)
    remote_debugging_enabled         = optional(bool)
    remote_debugging_version         = optional(string)
    runtime_scale_monitoring_enabled = optional(bool)
    scm_ip_restriction = optional(object({
      action = optional(string)
      headers = optional(object({
        x_azure_fdid      = optional(list(string), null)
        x_fd_health_probe = optional(list(string), null)
        x_forwarded_for   = optional(list(string), null)
        x_forwarded_host  = optional(list(string), null)
      }))
      name                      = optional(string)
      priority                  = optional(number)
      service_tag               = optional(string)
      virtual_network_subnet_id = optional(string)
    }))
    scm_ip_restriction_default_action = optional(string)
    scm_minimum_tls_version           = optional(string)
    scm_type                          = optional(string)
    scm_use_main_ip_restriction       = optional(bool)
    use_32_bit_worker                 = optional(bool)
    vnet_route_all_enabled            = optional(bool)
    websockets_enabled                = optional(bool)
    worker_count                      = optional(number)
  }) | `null` | no |

|  [app\_settings](#input\_app\_settings) | (Optional) A key-value pair of App Settings. | `map(string)` | `null` | no |

|  [auth\_settings](#input\_auth\_settings) | (Optional) A auth\_settings block. | object({
    enabled = bool
    active_directory = optional(object({
      client_id                  = string
      allowed_audiences          = list(string)
      client_secret              = optional(string)
      client_secret_setting_name = optional(string)
    }))
    additional_login_parameters    = optional(list(map(any)))
    allowed_external_redirect_urls = optional(list(string))
    default_provider               = optional(string)
    facebook = optional(object({
      app_id                  = string
      app_secret              = optional(string)
      app_secret_setting_name = optional(string)
      oauth_scopes            = optional(list(string))
    }))
    github = optional(object({
      client_id                  = string
      client_secret              = optional(string)
      client_secret_setting_name = optional(string)
      oauth_scopes               = optional(list(string))
    }))
    google = optional(object({
      client_id                  = string
      client_secret              = optional(string)
      client_secret_setting_name = optional(string)
      oauth_scopes               = optional(list(string))
    }))
    issuer = optional(string)
    microsoft = optional(object({
      client_id                  = string
      client_secret              = optional(string)
      client_secret_setting_name = optional(string)
      oauth_scopes               = optional(list(string))
    }))
    runtime_version               = optional(string)
    token_refresh_extension_hours = optional(number)
    token_store_enabled           = optional(bool)
    twitter = optional(object({
      consumer_key                 = string
      consumer_secret              = optional(string)
      consumer_secret_setting_name = optional(string)
    }))
    unauthenticated_client_action = optional(string)
  }) | `null` | no |

|  [auth\_settings\_v2](#input\_auth\_settings\_v2) | (Optional) A auth\_settings\_v2 block. | object({
    auth_enabled                            = optional(bool)
    runtime_version                         = optional(string)
    config_file_path                        = optional(string)
    require_authentication                  = optional(bool)
    unauthenticated_action                  = optional(string)
    default_provider                        = optional(string)
    excluded_paths                          = optional(list(string))
    require_https                           = optional(bool)
    http_route_api_prefix                   = optional(string)
    forward_proxy_convention                = optional(string)
    forward_proxy_custom_host_header_name   = optional(string)
    forward_proxy_custom_scheme_header_name = optional(string)
    apple_v2 = optional(object({
      client_id                  = string
      client_secret_setting_name = optional(string)
      login_scopes               = optional(list(string))
    }))
    active_directory_v2 = optional(object({
      client_id                            = string
      tenant_auth_endpoint                 = optional(string)
      client_secret_setting_name           = optional(string)
      client_secret_certificate_thumbprint = optional(string)
      jwt_allowed_groups                   = optional(list(string))
      jwt_allowed_client_applications      = optional(list(string))
      www_authentication_disabled          = optional(bool)
      allowed_groups                       = optional(list(string))
      allowed_identities                   = optional(list(string))
      allowed_applications                 = optional(list(string))
      login_parameters                     = optional(map(any))
      allowed_audiences                    = optional(list(string))
    }))
    azure_static_web_app_v2 = optional(object({
      client_id = string
    }))
    custom_oidc_v2 = optional(object({
      name                          = string
      client_id                     = string
      openid_configuration_endpoint = string
      name_claim_type               = optional(string)
      scopes                        = optional(list(string))
      client_credential_method      = string
      client_secret_setting_name    = optional(string)
      authorisation_endpoint        = string
      token_endpoint                = string
      issuer_endpoint               = string
      certification_uri             = string
    }))
    facebook_v2 = optional(object({
      app_id                  = string
      app_secret_setting_name = string
      graph_api_version       = optional(string)
      login_scopes            = optional(list(string))
    }))
    github_v2 = optional(object({
      client_id                  = string
      client_secret_setting_name = string
      login_scopes               = optional(list(string))
    }))
    google_v2 = optional(object({
      client_id                  = string
      client_secret_setting_name = string
      allowed_audiences          = optional(list(string))
      login_scopes               = optional(list(string))
    }))
    microsoft_v2 = optional(object({
      client_id                  = string
      client_secret_setting_name = string
      allowed_audiences          = optional(list(string))
      login_scopes               = optional(list(string))
    }))
    twitter_v2 = optional(object({
      consumer_key                 = string
      consumer_secret_setting_name = string
    }))
    login = optional(object({
      logout_endpoint                   = optional(string)
      token_store_enabled               = optional(bool)
      token_refresh_extension_time      = optional(number)
      token_store_path                  = optional(string)
      token_store_sas_setting_name      = optional(string)
      preserve_url_fragments_for_logins = optional(bool)
      allowed_external_redirect_urls    = optional(list(string))
      cookie_expiration_convention      = optional(string)
      cookie_expiration_time            = optional(string)
      validate_nonce                    = optional(bool)
      nonce_expiration_time             = optional(string)
    }))
  }) | `null` | no |

|  [backup](#input\_backup) | (Optional) A backup block. | object({
    name = string
    schedule = object({
      frequency_interval       = number
      frequency_unit           = string
      keep_at_least_one_backup = optional(bool)
      retention_period_days    = optional(number)
      start_time               = optional(string)
      last_execution_time      = optional(string)
    })
    storage_account_url = string
    enabled             = optional(bool, true)
  }) | `null` | no |

|  [builtin\_logging\_enabled](#input\_builtin\_logging\_enabled) | (Optional) Specifies whether built-in logging is enabled. Defaults to true. | `bool` | `true` | no |

|  [client\_certificate\_enabled](#input\_client\_certificate\_enabled) | (Optional) Specifies whether client certificate authentication is enabled. Defaults to false. | `bool` | `false` | no |

|  [client\_certificate\_mode](#input\_client\_certificate\_mode) | (Optional) The mode of the Function App Slot's client certificates requirement for incoming requests. Possible values are Required, Optional, and OptionalInteractiveUser. Defaults to Optional. | `string` | `"Optional"` | no |

|  [client\_certificate\_exclusion\_paths](#input\_client\_certificate\_exclusion\_paths) | (Optional) A list of paths to exclude from client certificate authentication. Paths separated by ;. | `string` | `null` | no |

|  [connection\_string](#input\_connection\_string) | (Optional) A connection\_string block. | object({
    name  = string
    type  = string
    value = string
  }) | `null` | no |

|  [content\_share\_force\_disabled](#input\_content\_share\_force\_disabled) | (Optional) Specifies whether the content share feature is disabled. Defaults to false. | `bool` | `false` | no |

|  [daily\_memory\_time\_quota](#input\_daily\_memory\_time\_quota) | (Optional) The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. Defaults to 0. | `number` | `0` | no |

|  [enabled](#input\_enabled) | (Optional) Specifies whether the Function App Slot is enabled. Defaults to true. | `bool` | `true` | no |

|  [ftp\_publish\_basic\_authentication\_enabled](#input\_ftp\_publish\_basic\_authentication\_enabled) | (Optional) Specifies whether FTP deployment is enabled. Defaults to false. | `bool` | `false` | no |

|  [functions\_extension\_version](#input\_functions\_extension\_version) | (Optional) The version of the Azure Functions runtime to use. Defaults to ~4. | `string` | `"~4"` | no |

|  [https\_only](#input\_https\_only) | (Optional) Specifies whether the Function App Slot requires HTTPS only. Defaults to false. | `bool` | `false` | no |

|  [public\_network\_access\_enabled](#input\_public\_network\_access\_enabled) | (Optional) Specifies whether the Function App Slot is accessible from the public network. Defaults to true. | `bool` | `true` | no |

|  [identity](#input\_identity) | (Optional) A identity block. | object({
    type         = string
    identity_ids = optional(list(string))
  }) | `null` | no |

|  [key\_vault\_reference\_identity\_id](#input\_key\_vault\_reference\_identity\_id) | (Optional) The identity ID of the Key Vault reference. Required when identity.type is set to UserAssigned or SystemAssigned, UserAssigned. | `string` | `null` | no |

|  [service\_plan\_id](#input\_service\_plan\_id) | (Optional) Specifies the ID of the App Service Plan in which to create the Function App Slot. If not specified, the Function App Slot will be created in the same App Service Plan as the Function App. Changing this forces a new resource to be created. | `string` | `null` | no |

|  [storage\_account\_access\_key](#input\_storage\_account\_access\_key) | (Optional) The access key of the Storage Account to use for the Function App Slot. | `string` | `null` | no |

|  [storage\_account\_name](#input\_storage\_account\_name) | (Optional) The name of the Storage Account to use for the Function App Slot. | `string` | `null` | no |

|  [storage\_account](#input\_storage\_account) | (Optional) One or more storage\_account blocks. | list(object({
    access_key   = string
    account_name = string
    name         = string
    share_name   = string
    type         = string
    mount_path   = optional(string)
  })) | `null` | no |

|  [storage\_uses\_managed\_identity](#input\_storage\_uses\_managed\_identity) | (Optional) Specifies whether the Function App Slot uses a managed identity to access the Storage Account. Defaults to false. | `bool` | `false` | no |

|  [storage\_key\_vault\_secret\_id](#input\_storage\_key\_vault\_secret\_id) | (Optional) The ID of the Key Vault secret containing the Storage Account access key. | `string` | `null` | no |

|  [tags](#input\_tags) | (Optional) A mapping of tags to assign to the resource. | `map(string)` | `null` | no |

|  [virtual\_network\_subnet\_id](#input\_virtual\_network\_subnet\_id) | (Optional) The ID of the subnet in which to create the Function App Slot. | `string` | `null` | no |

|  [webdeploy\_publish\_basic\_authentication\_enabled](#input\_webdeploy\_publish\_basic\_authentication\_enabled) | (Optional) Specifies whether Web Deploy publishing is enabled. Defaults to false. | `bool` | `false` | no |

|  [os\_type](#input\_os\_type) | (Required) Specifies the operating system type of the Function App Slot. Value must be one of Windows or Linux. | `string` | n/a | yes |

## Outputs

| Name | Description |

|------|-------------|

|  [windows\_function\_app\_slot\_name](#output\_windows\_function\_app\_slot\_name) | n/a |

|  [windows\_function\_app\_slot\_id](#output\_windows\_function\_app\_slot\_id) | n/a |

|  [windows\_function\_app\_slot\_default\_hostname](#output\_windows\_function\_app\_slot\_default\_hostname) | n/a |

|  [windows\_function\_app\_slot\_possible\_outbound\_ip\_address\_list](#output\_windows\_function\_app\_slot\_possible\_outbound\_ip\_address\_list) | n/a |

|  [windows\_function\_app\_slot\_kind](#output\_windows\_function\_app\_slot\_kind) | n/a |

|  [windows\_function\_app\_slot\_custom\_domain\_verification\_id](#output\_windows\_function\_app\_slot\_custom\_domain\_verification\_id) | n/a |

|  [linux\_function\_app\_slot\_name](#output\_linux\_function\_app\_slot\_name) | n/a |

|  [linux\_function\_app\_slot\_id](#output\_linux\_function\_app\_slot\_id) | n/a |

|  [linux\_function\_app\_slot\_default\_hostname](#output\_linux\_function\_app\_slot\_default\_hostname) | n/a |

|  [linux\_function\_app\_slot\_possible\_outbound\_ip\_address\_list](#output\_linux\_function\_app\_slot\_possible\_outbound\_ip\_address\_list) | n/a |

|  [linux\_function\_app\_slot\_kind](#output\_linux\_function\_app\_slot\_kind) | n/a |

|  [linux\_function\_app\_slot\_custom\_domain\_verification\_id](#output\_linux\_function\_app\_slot\_custom\_domain\_verification\_id) | n/a |

|  [function\_app\_slot\_name](#output\_function\_app\_slot\_name) | The name of the Function App Slot. |

|  [function\_app\_slot\_id](#output\_function\_app\_slot\_id) | The ID of the Function App Slot. |

|  [function\_app\_slot\_default\_hostname](#output\_function\_app\_slot\_default\_hostname) | The default hostname of the Function App Slot. |

|  [function\_app\_slot\_possible\_outbound\_ip\_address\_list](#output\_function\_app\_slot\_possible\_outbound\_ip\_address\_list) | The possible outbound IP addresses of the Function App Slot. |

|  [function\_app\_slot\_kind](#output\_function\_app\_slot\_kind) | The kind of the Function App Slot. |

|  [function\_app\_slot\_custom\_domain\_verification\_id](#output\_function\_app\_slot\_custom\_domain\_verification\_id) | The custom domain verification ID of the Function App Slot. |
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/launchbynttdata/tf-azurerm-module_primitive-function_app_slot

Awesome Lists containing this project

README
