Module Overview

This module provisions the Azure resource managed by this repository.

Usage

See examples/basic for a minimal working example.

Requirements

Name	Version
terraform	~> 1.5.7
azurerm	>= 4.0.0, < 5.0.0
random	>= 3.5.0

Providers

Name	Version
azurerm	4.71.0
random	3.8.1

Modules

No modules.

Resources

Name	Type
azurerm_key_vault_secret.db_pwd_secret	resource
azurerm_management_lock.managed_instance	resource
azurerm_management_lock.this	resource
azurerm_monitor_metric_alert.sql_cpu	resource
azurerm_monitor_metric_alert.sql_memory	resource
azurerm_monitor_metric_alert.sql_storage	resource
azurerm_mssql_database.this	resource
azurerm_mssql_managed_database.this	resource
azurerm_mssql_managed_instance.this	resource
azurerm_mssql_managed_instance_transparent_data_encryption.this	resource
azurerm_mssql_server.this	resource
azurerm_mssql_server_extended_auditing_policy.this	resource
azurerm_mssql_virtual_network_rule.this	resource
random_password.db_password	resource
azurerm_storage_account.audit	data source
azurerm_subnet.allowed	data source

Inputs

Name	Description	Type	Default	Required
action_group_id	Resource ID of an Azure Monitor Action Group for metric alerts.	string	null	no
admin_username	Administrator login name for the SQL server.	string	"dbadmin"	no
allowed_subnets	Map of subnets to allow access to the SQL server (service endpoint rules). Key is a label, value is the subnet object.	map(object({ vnet = string rg = string }))	{}	no
audit_log_storage_account	Storage account for server audit logs. Leave null to disable auditing.	object({ account_name = string account_rg = string retention_days = number })	null	no
autogenerate_password	Whether to generate a random administrator password. When false, existing_password must be supplied.	bool	true	no
backup_retention_days	Short-term backup retention period in days.	number	7	no
backup_storage_type	Storage type for backups. Valid values: local, zonal, geo, geozone.	string	"zonal"	no
collation	Database collation. Leave null to use the server default.	string	null	no
connection_policy	Connection policy. Valid values: Default, Proxy, Redirect. Only applies to sql_managed_instance.	string	"Default"	no
create_mode	Database creation mode. Valid values: Default, Copy, OnlineSecondary, PointInTimeRestore, Recovery, Restore, RestoreExternalBackup, RestoreExternalBackupSecondary, RestoreLongTermRetentionBackup, Secondary.	string	"Default"	no
enable_delete_lock	Whether to apply a CanNotDelete management lock to protect against accidental deletion.	bool	true	no
enable_ledger	Whether to enable ledger for the database. Only applies to sql_database.	bool	false	no
encryption_key_vault_key_id	Resource ID of a Key Vault key for Transparent Data Encryption (customer-managed key).	string	null	no
entra_admin	Entra ID (Azure AD) administrator for the SQL server.	object({ login_username = string object_id = string tenant_id = optional(string) })	null	no
environment	Deployment environment. Valid values: production, development, test, staging, uat, sandbox, poc.	string	n/a	yes
existing_password	Pre-defined administrator password. Only used when autogenerate_password is false.	string	null	no
identity_type	Managed identity type. Valid values: SystemAssigned, UserAssigned. Leave empty for none.	string	""	no
key_vault_id	Resource ID of a Key Vault where the auto-generated password will be stored as a secret.	string	null	no
location	Azure region where resources will be created (e.g., westeurope, eastus).	string	n/a	yes
managed_subnet_id	Subnet resource ID for the managed instance. Required for sql_managed_instance.	string	null	no
password_length	Length of the auto-generated password (8–128 characters).	number	20	no
password_secret_content_type	Content type assigned to the auto-generated Key Vault password secret.	string	"text/plain"	no
password_secret_expiration_hours	Lifetime in hours for the auto-generated Key Vault password secret expiration.	number	8760	no
public_network_access_enabled	Whether public network access to the server is allowed. Defaults to false.	bool	false	no
resource_group_name	Name of the resource group where the SQL resources will be deployed.	string	n/a	yes
server_sku	SKU for the server (e.g., GP_Gen5_4, GP_Serverless_Gen5_2, BC_Gen5_8).	string	n/a	yes
server_type	Type of SQL server to create. Valid values: sql_database, sql_managed_instance.	string	n/a	yes
server_version	SQL engine version. Only applies to sql_database. Currently only '12.0' is supported.	string	"12.0"	no
serverless_auto_pause_delay_minutes	Auto-pause delay in minutes for serverless databases. Leave null for no auto-pause.	number	null	no
serverless_min_capacity	Minimum vCPU capacity for serverless databases. Leave null for provisioned.	string	null	no
storage_gb	Storage allocated in GB.	number	n/a	yes
suffix	Optional suffix appended to the auto-generated name (e.g., '001').	string	null	no
tags	Additional tags to apply. Merged with module-managed tags (managed_by, environment, workload).	map(string)	{}	no
timezone_id	Timezone for the managed instance. Only applies to sql_managed_instance.	string	null	no
user_identity_ids	List of user-assigned managed identity resource IDs.	list(string)	[]	no
vcores	Number of vCores. Only applies to sql_managed_instance.	number	4	no
workload	Name of the workload or application. Used in resource naming and tagging.	string	n/a	yes
zone_redundant	Whether zone-redundant deployment is enabled. Not available on Basic or Standard tiers.	bool	false	no

Outputs

Name	Description
database_id	Resource ID of the SQL database. Null for managed instances.
managed_database_id	Resource ID of the managed database. Null for SQL Database.
password_secret_id	Resource ID of the Key Vault secret storing the auto-generated password. Null if key_vault_id was not provided.
server_fqdn	Fully Qualified Domain Name of the SQL server or managed instance.
server_id	Resource ID of the SQL server or managed instance.

Authors

Module managed by Zoi.

License

MIT License. See LICENSE for full details.