Terraform Azure Storage Account Module

This Terraform module is designed to create Azure Storage Accounts and its related resources, including blob containers, queues, tables, and file shares. It also supports the creation of a storage account private endpoint which provides secure and direct connectivity to Azure Storage over a private network.

• Create a storage account with various configuration options such as account kind, tier, replication type, network rules, and identity settings.
• Create blob containers, queues, tables, and file shares within the storage account.
• Support for customer-managed keys for encrypting the data in the storage account.
• Enable private endpoint for the storage account, providing secure access over a private network.

• The storage account name must be globally unique.
• The module creates resources in the same region as the storage account.

IMPORTANT This module manages the Storage Account itself, plus its child containers, queues, tables, file shares, private endpoints and role assignments, through the AzAPI provider, which always authenticates with Microsoft Entra ID and never requires a Storage shared key. We recommend leaving shared_access_key_enabled = false (the module default) so that any data-plane access from your own code is also Entra-ID-authenticated. If you also use the azurerm provider to manage Storage data-plane resources (for example azurerm_storage_blob), set storage_use_azuread = true in that provider block. Note that not every Storage service supports Microsoft Entra ID authentication; for those services you will need to enable shared-key access by setting shared_access_key_enabled = true on this module.

This module requires AzAPI provider version 2.11.0 or later within the 2.x series (>= 2.11.0, < 3.0.0). When upgrading to a module release with this requirement, update any AzAPI constraint in your root module that excludes version 2.11.0, then refresh the provider selections recorded in your dependency lock file:

terraform {
  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.11"
    }
  }
}

terraform init -upgrade

Version 0.7.0 moved containers, queues, shares, and tables from resources in the root module to separate child modules. Terraform cannot automatically move an arbitrary for_each key from a resource instance to a module instance. Without an explicit state migration, an upgrade can therefore plan to destroy and recreate these resources.

Before applying an upgrade from v0.6.x, add one moved block for each existing resource key to the root module that calls this module. For a module call named storage, the migrations for keys named logs, jobs, content, and metadata are:

moved {
  from = module.storage.azapi_resource.containers["logs"]
  to   = module.storage.module.containers["logs"].azapi_resource.this
}

moved {
  from = module.storage.azapi_resource.queue["jobs"]
  to   = module.storage.module.queues["jobs"].azapi_resource.this
}

moved {
  from = module.storage.azapi_resource.share["content"]
  to   = module.storage.module.shares["content"].azapi_resource.this
}

moved {
  from = module.storage.azapi_resource.table["metadata"]
  to   = module.storage.module.tables["metadata"].azapi_resource.this
}

The quoted values are the map keys supplied to the module, which can differ from the Azure resource names. Repeat the relevant block for every key. Replace module.storage with the actual module address; for example, include an outer for_each key as module.storage["app"].

Run terraform plan after adding the moves and do not apply if Terraform still proposes replacing these resources. Keep the moved blocks in configuration so the migration is applied consistently to every workspace.

If v0.7.x was already applied or an apply failed partway through, first save a backup and inspect the state:

terraform state pull > terraform-state-backup.json
terraform state list

Terraform state can contain sensitive values. Store the backup securely and delete it when it is no longer needed. A resource may already have the correct address, or it may have the incorrect intermediate address produced by v0.7.x:

module.storage.module.containers.azapi_resource.this["logs"]

Move an intermediate address to the configured address before applying:

terraform state mv 'module.storage.module.containers.azapi_resource.this["logs"]' 'module.storage.module.containers["logs"].azapi_resource.this'

Use the equivalent queues, shares, or tables address for the other resource types. Do not run a state move when the destination is already present. A state move only updates Terraform's bookkeeping; it cannot restore an Azure resource or its data if the resource was already deleted.

Upgrading from v0.6.x in a sovereign cloud such as US Gov can fail at terraform plan with NoRegisteredProviderFound, naming an API version that appears nowhere in your configuration:

No registered resource provider found for location 'usgovarizona' and API version
'2026-04-01' for type 'storageAccounts'.

The version in that message is not the version this module requests. Version 0.7.0 migrated the storage account from azurerm_storage_account to azapi_resource, and the module ships a moved block for that change. When Terraform applies the move, the AzAPI provider rebuilds the resource state from the ARM resource ID alone. An ARM resource ID does not record an API version, so the provider falls back to the newest version in its own embedded index. The read that follows the move uses that version, and sovereign clouds often lag behind it.

Overriding resource_types.storage_account does not help, because the provider cannot see that value while it is migrating state. This is tracked upstream as Azure/terraform-provider-azapi#1216.

To work around this, take the old address out of state and import the account with an explicit API version. Once the source address is gone, the module's moved block has nothing left to match and does nothing.

terraform state pull > terraform-state-backup.json
terraform state rm 'module.storage.azurerm_storage_account.this'

Then add an import block to the root module that calls this module, choosing an API version the target cloud supports:

import {
  to = module.storage.azapi_resource.this

  identity = {
    id   = "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<account-name>"
    type = "Microsoft.Storage/storageAccounts@2025-08-01"
  }
}

Replace module.storage with the actual module address. Run terraform plan and confirm it does not propose replacing the storage account before you apply. If your state still contains azurerm_storage_management_policy.this, it is exposed to the same failure and needs the same treatment.

The following requirements are needed by this module:

• terraform (>= 1.10.0)

• azapi (~> 2.12)

• modtm (~> 0.3)

• random (>= 3.5.0, < 4.0.0)

The following resources are used by this module:

• azapi_resource.lock (resource)
• azapi_resource.this (resource)
• azapi_update_resource.customer_managed_key (resource)
• modtm_telemetry.telemetry (resource)
• random_uuid.telemetry (resource)
• azapi_client_config.telemetry (data source)
• azapi_resource.customer_managed_key_vault (data source)
• modtm_module_source.telemetry (data source)

The following input variables are required:

Description: Azure region where the resource should be deployed.
If null, the location will be inferred from the resource group location.

Type: string

Description: The name of the resource.

Type: string

Description: The Azure resource ID of the parent resource group, in the form /subscriptions/{subscription_id}/resourceGroups/{resource_group_name}.

Type: string

The following input variables are optional (have default values):

Description: (Optional) Defines the access tier for BlobStorage, FileStorage and StorageV2 accounts. Valid options are Hot, Cool, Cold, Premium and Smart. Defaults to Hot.

Smart requires a Standard GPv2 (StorageV2) account using Standard_ZRS, Standard_GZRS or Standard_RAGZRS, and Storage API 2025-08-01 or newer. Smart only manages block blobs that inherit the account's default access tier; page blobs, append blobs and explicitly tiered blobs are not supported.

Type: string

Default: "Hot"

Description: (Optional) Defines the Kind of account. Valid options are BlobStorage, BlockBlobStorage, FileStorage, Storage and StorageV2. Defaults to StorageV2.

Type: string

Default: "StorageV2"

Description: [DEPRECATED] (Optional) Defines the type of replication to use for this storage account. Valid options are LRS, GRS, RAGRS, ZRS, GZRS and RAGZRS. Defaults to ZRS. This variable is only honoured when account_sku_name is set to null; otherwise account_sku_name wins. Prefer account_sku_name.

Type: string

Default: "ZRS"

Description: (Optional) Explicit storage account SKU name (e.g. Standard_LRS, Premium_ZRS, PremiumV2_LRS, StandardV2_GZRS). When set, this value is sent to Azure verbatim and overrides the SKU derived from account_tier, account_replication_type and provisioned_billing_model_version - those variables are only honoured when account_sku_name is explicitly set to null. Defaults to Standard_ZRS. Note: the *V2_* SKUs (e.g. StandardV2_ZRS, PremiumV2_ZRS) require account_kind = "FileStorage".

Type: string

Default: "Standard_ZRS"

Description: [DEPRECATED] (Optional) Defines the Tier to use for this storage account. Valid options are Standard and Premium. For BlockBlobStorage and FileStorage accounts only Premium is valid. Changing this forces a new resource to be created. Defaults to Standard. This variable is only honoured when account_sku_name is set to null; otherwise account_sku_name wins. Prefer account_sku_name.

Type: string

Default: "Standard"

Description: (Optional) Allow or disallow nested items within this Account to opt into being public. Defaults to false.

Type: bool

Default: false

Description: (Optional) Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet. Possible values are AAD and PrivateLink. Defaults to null (no restriction).

Type: string

Default: null

Description: Configures Azure Files identity-based authentication on the storage account. Defaults to null (no Files authentication configured).

• directory_type - (Optional) Specifies the directory service used. Possible values are AADDS, AD, and AADKERB. Defaults to AADKERB.
• default_share_level_permission - (Optional) Specifies the default share-level permission applied to all users. Possible values are StorageFileDataSmbShareReader, StorageFileDataSmbShareContributor, StorageFileDataSmbShareElevatedContributor, or None. Defaults to null.
• active_directory - (Optional) An Active Directory configuration block. Required when directory_type is AD. Defaults to null. Supports:
  • domain_guid - (Required) Specifies the domain GUID.
  • domain_name - (Required) Specifies the primary domain that the AD DNS server is authoritative for.
  • domain_sid - (Optional) Specifies the security identifier (SID). Required when directory_type is AD. Defaults to null.
  • forest_name - (Optional) Specifies the Active Directory forest. Required when directory_type is AD. Defaults to null.
  • netbios_domain_name - (Optional) Specifies the NetBIOS domain name. Required when directory_type is AD. Defaults to null.
  • storage_sid - (Optional) Specifies the security identifier (SID) for Azure Storage. Required when directory_type is AD. Defaults to null.

Type:

object({
    directory_type                 = optional(string, "AADKERB")
    default_share_level_permission = optional(string)

    active_directory = optional(object({
      domain_guid         = string
      domain_name         = string
      domain_sid          = optional(string)
      forest_name         = optional(string)
      netbios_domain_name = optional(string)
      storage_sid         = optional(string)
    }))
  })

Default: null

Description: Blob service-level settings for the storage account. Defaults to null (Azure platform defaults).

• automatic_snapshot_policy_enabled - (Optional) Deprecated; use versioning_enabled instead. Defaults to null.
• change_feed - (Optional) Blob change feed settings. Defaults to null.
  • enabled - (Optional) Enable the blob change feed. Defaults to null.
  • retention_in_days - (Optional) Retention period for the change feed in days (1–146000). null means infinite. Defaults to null.
• container_delete_retention_policy - (Optional) Container soft-delete retention policy. Defaults to null.
  • allow_permanent_delete - (Optional) Allow permanent delete of soft-deleted containers. Defaults to null.
  • days - (Optional) Number of days to retain deleted containers (1–365). Defaults to null.
  • enabled - (Optional) Enable container soft-delete. Defaults to null.
• cors_rules - (Optional) A list of CORS rules (maximum 5). Each entry supports:
  • allowed_headers - (Required) A list of headers allowed in cross-origin requests.
  • allowed_methods - (Required) A list of HTTP methods allowed. Valid values: DELETE, GET, HEAD, MERGE, POST, OPTIONS, PUT, PATCH.
  • allowed_origins - (Required) A list of origin domains allowed in cross-origin requests.
  • exposed_headers - (Required) A list of response headers exposed to CORS clients.
  • max_age_in_seconds - (Required) The number of seconds the browser should cache a preflight response.
• default_service_version - (Optional) Default Blob service API version for requests without a version. Defaults to null.
• delete_retention_policy - (Optional) Blob soft-delete retention policy. Defaults to null.
  • allow_permanent_delete - (Optional) Allow permanent delete of soft-deleted blobs and snapshots. Cannot be used with restore_policy. Defaults to null.
  • days - (Optional) Number of days to retain deleted blobs (1–365). Defaults to null.
  • enabled - (Optional) Enable blob soft-delete. Defaults to null.
• last_access_time_tracking_policy - (Optional) Last access time tracking policy. Defaults to null.
  • blob_type - (Optional) Blob types to track. Only ["blockBlob"] is supported (read-only). Defaults to null.
  • enable - (Required) Enable last access time tracking.
  • name - (Optional) Policy name. Must be "AccessTimeTracking" (read-only). Defaults to null.
  • tracking_granularity_in_days - (Optional) Granularity in days (read-only, always 1). Defaults to null.
• restore_policy - (Optional) Point-in-time restore policy. Requires versioning_enabled, change_feed.enabled, and delete_retention_policy.enabled. Defaults to null.
  • days - (Optional) Restore retention in days. Must be less than delete_retention_policy.days. Defaults to null.
  • enabled - (Required) Enable point-in-time restore.
• versioning_enabled - (Optional) Enable blob versioning. Defaults to null.

Type:

object({
    automatic_snapshot_policy_enabled = optional(bool)
    change_feed = optional(object({
      enabled           = optional(bool)
      retention_in_days = optional(number)
    }))
    container_delete_retention_policy = optional(object({
      allow_permanent_delete = optional(bool)
      days                   = optional(number)
      enabled                = optional(bool)
    }))
    cors_rules = optional(list(object({
      allowed_headers    = list(string)
      allowed_methods    = list(string)
      allowed_origins    = list(string)
      exposed_headers    = list(string)
      max_age_in_seconds = number
    })))
    default_service_version = optional(string)
    delete_retention_policy = optional(object({
      allow_permanent_delete = optional(bool)
      days                   = optional(number)
      enabled                = optional(bool)
    }))
    last_access_time_tracking_policy = optional(object({
      blob_type                    = optional(list(string))
      enable                       = bool
      name                         = optional(string)
      tracking_granularity_in_days = optional(number)
    }))
    restore_policy = optional(object({
      days    = optional(number)
      enabled = bool
    }))
    versioning_enabled = optional(bool)
  })

Default: null

Description: A map of containers to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to {} (no containers).

• name - (Required) The name of the Container which should be created within the Storage Account. Changing this forces a new resource to be created.
• public_access - (Optional) Specifies whether data in the container may be accessed publicly and the level of access. Possible values are Container, Blob, and None. Defaults to None. Changing this forces a new resource to be created.
• metadata - (Optional) A mapping of MetaData for this Container. All metadata keys should be lowercase. Defaults to null.
• default_encryption_scope - (Optional) The default encryption scope to use for blob operations on this container. Defaults to null.
• deny_encryption_scope_override - (Optional) When set to true, blocks blob uploads from specifying a different encryption scope. Defaults to null.
• enable_nfs_v3_all_squash - (Optional) Enable NFSv3 all squash (only valid for NFSv3 enabled accounts). Defaults to null.
• enable_nfs_v3_root_squash - (Optional) Enable NFSv3 root squash (only valid for NFSv3 enabled accounts). Defaults to null.
• immutable_storage_with_versioning - (Optional) Configures container-level immutability with version-level WORM. Defaults to null. Cannot be used together with blob_properties.restore_policy: Azure does not support point-in-time restore on an account that has version-level immutability on any container. Supports:
  • enabled - (Required) Whether immutable storage with versioning is enabled.
• role_assignments - (Optional) A map of role assignments to create on the container. Defaults to {}. See var.role_assignments for the attribute schema.
• timeouts - (Optional) Per-operation timeouts for the container resource. Defaults to null (uses provider defaults inherited from var.timeouts). Supports:
  • create - (Optional) Timeout for create operations.
  • delete - (Optional) Timeout for delete operations.
  • read - (Optional) Timeout for read operations.
  • update - (Optional) Timeout for update operations.

Type:

map(object({
    public_access                  = optional(string, "None")
    metadata                       = optional(map(string))
    name                           = string
    default_encryption_scope       = optional(string)
    deny_encryption_scope_override = optional(bool)
    enable_nfs_v3_all_squash       = optional(bool)
    enable_nfs_v3_root_squash      = optional(bool)
    immutable_storage_with_versioning = optional(object({
      enabled = bool
    }))

    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})

    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))

Default: {}

Description: (Optional) Should cross Tenant replication be enabled? Defaults to false.

Type: bool

Default: false

Description: Configures a custom domain for the storage account. Defaults to null (no custom domain).

• name - (Required) The Custom Domain Name to use for the Storage Account, which will be validated by Azure.
• use_subdomain - (Optional) Should the Custom Domain Name be validated by using indirect CNAME validation? Defaults to null.

Type:

object({
    name          = string
    use_subdomain = optional(bool)
  })

Default: null

Description: Defines a customer managed key to use for encryption. Defaults to null (Microsoft-managed keys).

• key_vault_resource_id - (Required) The full Azure Resource ID of the key vault where the customer managed key will be referenced from.
• key_name - (Required) The key name for the customer managed key in the key vault.
• key_version - (Optional) The version of the key to use. If null, the latest version is tracked automatically.
• user_assigned_identity - (Optional) A user assigned identity used to access the key vault. Defaults to null, in which case the storage account's system-assigned identity is used.
  • resource_id - (Required) The full Azure Resource ID of the user assigned identity.

The module does not create the Key Vault role assignment that permits the identity to use the key. Grant the identity Key Vault Crypto Service Encryption User on the vault before the storage account is created. Referencing the vault's resource ID does not make Terraform wait for that vault's role assignments to finish, so order the grant explicitly with depends_on on the module call. Alternatively, add a pattern such as Forbidden to retry.error_message_regex to retry while the assignment propagates.

Example Inputs:

customer_managed_key = {
  key_vault_resource_id = "/subscriptions/0000000-0000-0000-0000-000000000000/resourceGroups/test-resource-group/providers/Microsoft.KeyVault/vaults/example-key-vault"
  key_name              = "sample-customer-key"
}

Type:

object({
    key_vault_resource_id = string
    key_name              = string
    key_version           = optional(string, null)
    user_assigned_identity = optional(object({
      resource_id = string
    }), null)
  })

Default: null

Description: (Optional) Default to Azure Active Directory authorization in the Azure portal when accessing the Storage Account. Defaults to null (Azure platform default of false).

Type: bool

Default: null

Description: A map of diagnostic settings to create on the Blob Storage within Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from Azure/avm-utl-interfaces/azure, which fully supports all features of the Azure Diagnostic Settings API.

• name - (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.
• logs - (Optional) A set of log entries to enable. Each entry has the following attributes:
  • category - (Optional) The name of an individual log category (e.g. StorageWrite).
  • category_group - (Optional) The name of a log category group (e.g. allLogs, audit). Mutually exclusive with category.
  • enabled - (Optional) Whether the log entry is enabled. Defaults to true.
  • retention_policy - (Optional) Retention policy for the log entry. Object with days (default 0) and enabled (default false).
• metrics - (Optional) A set of metric entries to enable. Each entry has the following attributes:
  • category - (Optional) The name of the metric category (e.g. AllMetrics, Transaction).
  • enabled - (Optional) Whether the metric entry is enabled. Defaults to true.
  • retention_policy - (Optional) Retention policy for the metric entry. Object with days (default 0) and enabled (default false).
• log_analytics_destination_type - (Optional) The destination type for the diagnostic setting. Possible values are Dedicated and AzureDiagnostics. Defaults to Dedicated.
• workspace_resource_id - (Optional) The resource ID of the log analytics workspace to send logs and metrics to.
• storage_account_resource_id - (Optional) The resource ID of the storage account to send logs and metrics to.
• event_hub_authorization_rule_resource_id - (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.
• event_hub_name - (Optional) The name of the event hub. If none is specified, the default event hub will be selected.
• marketplace_partner_resource_id - (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs.

Type:

map(object({
    name = optional(string, null)
    logs = optional(set(object({
      category       = optional(string, null)
      category_group = optional(string, null)
      enabled        = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    metrics = optional(set(object({
      category = optional(string, null)
      enabled  = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

Description: A map of diagnostic settings to create on the Azure Files Storage within Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from Azure/avm-utl-interfaces/azure, which fully supports all features of the Azure Diagnostic Settings API.

See var.diagnostic_settings_blob for full attribute documentation; the schema is identical.

Type:

map(object({
    name = optional(string, null)
    logs = optional(set(object({
      category       = optional(string, null)
      category_group = optional(string, null)
      enabled        = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    metrics = optional(set(object({
      category = optional(string, null)
      enabled  = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

Description: A map of diagnostic settings to create on the Queue Storage within Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from Azure/avm-utl-interfaces/azure, which fully supports all features of the Azure Diagnostic Settings API.

See var.diagnostic_settings_blob for full attribute documentation; the schema is identical.

Type:

map(object({
    name = optional(string, null)
    logs = optional(set(object({
      category       = optional(string, null)
      category_group = optional(string, null)
      enabled        = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    metrics = optional(set(object({
      category = optional(string, null)
      enabled  = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

Description: A map of diagnostic settings to create on the Storage Account itself. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from Azure/avm-utl-interfaces/azure, which fully supports all features of the Azure Diagnostic Settings API.

Important: Diagnostic settings on the Storage Account resource itself support only metrics (logs are not supported by the Azure API at this scope). Supplying any logs entries here will be rejected by Azure. Supported metric categories are Capacity, Transaction, and AllMetrics.

See var.diagnostic_settings_blob for full attribute documentation; the schema is identical.

Type:

map(object({
    name = optional(string, null)
    logs = optional(set(object({
      category       = optional(string, null)
      category_group = optional(string, null)
      enabled        = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    metrics = optional(set(object({
      category = optional(string, null)
      enabled  = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

Description: A map of diagnostic settings to create on the Table Storage within the Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from Azure/avm-utl-interfaces/azure, which fully supports all features of the Azure Diagnostic Settings API.

See var.diagnostic_settings_blob for full attribute documentation; the schema is identical.

Type:

map(object({
    name = optional(string, null)
    logs = optional(set(object({
      category       = optional(string, null)
      category_group = optional(string, null)
      enabled        = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    metrics = optional(set(object({
      category = optional(string, null)
      enabled  = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

Description: (Optional) Specifies the Edge Zone within the Azure Region where this Storage Account should exist. Defaults to null. Changing this forces a new Storage Account to be created.

Type: string

Default: null

Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.

Type: bool

Default: true

Description: File service-level settings for the storage account. Defaults to null (Azure platform defaults).

• cors_rules - (Optional) A list of CORS rules for the file service. Defaults to null. Each entry supports:
  • allowed_headers - (Required) A list of headers allowed in cross-origin requests.
  • allowed_methods - (Required) A list of HTTP methods allowed.
  • allowed_origins - (Required) A list of origin domains allowed.
  • exposed_headers - (Required) A list of response headers exposed to CORS clients.
  • max_age_in_seconds - (Required) Seconds the browser should cache a preflight response.
• share_retention_policy - (Optional) File share soft-delete retention policy. Defaults to null.
  • days - (Optional) Number of days to retain soft-deleted shares. Between 1 and 365. Defaults to 7.
  • enabled - (Optional) Whether soft-delete is enabled. Defaults to true.
• smb - (Optional) SMB protocol settings. Defaults to null.
  • authentication_types - (Optional) Set of authentication types. Valid values: NTLMv2, Kerberos. Defaults to null.
  • channel_encryption_types - (Optional) Set of SMB channel encryption types. Valid values: AES-128-CCM, AES-128-GCM, AES-256-GCM. Defaults to null.
  • kerberos_ticket_encryption_type - (Optional) Set of Kerberos ticket encryption types. Valid values: RC4-HMAC, AES-256. Defaults to null.
  • multichannel_enabled - (Optional) Enable SMB multichannel (Premium file shares only). Defaults to null.
  • versions - (Optional) Set of SMB protocol versions. Valid values: SMB2.1, SMB3.0, SMB3.1.1. Defaults to null.

Type:

object({
    cors_rules = optional(list(object({
      allowed_headers    = list(string)
      allowed_methods    = list(string)
      allowed_origins    = list(string)
      exposed_headers    = list(string)
      max_age_in_seconds = number
    })))
    share_retention_policy = optional(object({
      days    = optional(number, 7)
      enabled = optional(bool, true)
    }))
    smb = optional(object({
      authentication_types            = optional(set(string))
      channel_encryption_types        = optional(set(string))
      kerberos_ticket_encryption_type = optional(set(string))
      multichannel_enabled            = optional(bool)
      versions                        = optional(set(string))
    }))
  })

Default: null

Description: (Optional) Boolean flag which forces HTTPS if enabled, see here for more information. Defaults to true.

Type: bool

Default: true

Description: Configures the account-level immutability policy. Defaults to null (no policy).

• allow_protected_append_writes - (Required) When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added; any existing blocks cannot be modified or deleted.
• period_since_creation_in_days - (Required) The immutability period for the blobs in the container since the policy creation, in days.
• state - (Required) The mode of the policy. Disabled disables the policy; Unlocked allows the immutability retention time to be increased or decreased and toggling allow_protected_append_writes; Locked only allows the immutability retention time to be increased. A policy may only be created in Disabled or Unlocked, may be toggled between those two, and Unlocked may transition to Locked (which cannot be reverted).

Type:

object({
    allow_protected_append_writes = bool
    period_since_creation_in_days = number
    state                         = string
  })

Default: null

Description: (Optional) Is infrastructure encryption enabled? Changing this forces a new resource to be created. Defaults to false.

Type: bool

Default: false

Description: (Optional) Is Hierarchical Namespace enabled? This can be used with Azure Data Lake Storage Gen 2 (see here for more information). Defaults to null (Azure platform default of false). Changing this forces a new resource to be created.

Type: bool

Default: null

Description: (Optional) Is large file share enabled? Defaults to null (Azure platform default of false).

Type: bool

Default: null

Description: A map of Storage Account Local Users to create. The map key is arbitrary; the value supports the following attributes. Defaults to {} (no local users).

• name - (Required) The name which should be used for this Storage Account Local User. Changing this forces a new Storage Account Local User to be created.
• home_directory - (Optional) The home directory of the Storage Account Local User. Defaults to null.
• ssh_key_enabled - (Optional) Specifies whether SSH Key Authentication is enabled. Defaults to null (Azure platform default of false).
• ssh_password_enabled - (Optional) Specifies whether SSH Password Authentication is enabled. Defaults to null (Azure platform default of false).
• permission_scope - (Optional) A list of permission scopes for the local user. Defaults to null. Each entry supports:
  • resource_name - (Required) The container name (when service is set to blob) or the file share name (when service is set to file).
  • service - (Required) The storage service used by this Storage Account Local User. Possible values are blob and file.
  • permissions - (Required) An object describing the permissions granted at this scope. Supports:
    • create - (Optional) Whether the local user has the create permission for this scope. Defaults to null (false).
    • delete - (Optional) Whether the local user has the delete permission for this scope. Defaults to null (false).
    • list - (Optional) Whether the local user has the list permission for this scope. Defaults to null (false).
    • read - (Optional) Whether the local user has the read permission for this scope. Defaults to null (false).
    • write - (Optional) Whether the local user has the write permission for this scope. Defaults to null (false).
• ssh_authorized_key - (Optional) A list of SSH authorized keys for the local user. Defaults to null. Each entry supports:
  • key - (Required) The public key value of this SSH authorized key.
  • description - (Optional) The description of this SSH authorized key. Defaults to null.
• timeouts - (Optional) Per-operation timeouts for the local user resource. Defaults to null (uses provider defaults inherited from var.timeouts). Supports:
  • create - (Optional) Timeout for create operations.
  • delete - (Optional) Timeout for delete operations.
  • read - (Optional) Timeout for read operations.
  • update - (Optional) Timeout for update operations.

Type:

map(object({
    home_directory       = optional(string)
    name                 = string
    ssh_key_enabled      = optional(bool)
    ssh_password_enabled = optional(bool)
    permission_scope = optional(list(object({
      resource_name = string
      service       = string
      permissions = object({
        create = optional(bool)
        delete = optional(bool)
        list   = optional(bool)
        read   = optional(bool)
        write  = optional(bool)
      })
    })))
    ssh_authorized_key = optional(list(object({
      description = optional(string)
      key         = string
    })))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))

Default: {}

Description: (Optional) Should Storage Account Local Users be enabled? Defaults to false.

Type: bool

Default: false

Description: Controls the management lock applied to the storage account. Defaults to null (no lock).

• kind - (Required) The kind of lock to apply. Possible values are CanNotDelete and ReadOnly.
• name - (Optional) The name of the lock. If not specified, a name will be generated.

Type:

object({
    name = optional(string, null)
    kind = string
  })

Default: null

Description: Controls the Managed Identity configuration on this resource. The following properties can be specified:

• system_assigned - (Optional) Specifies if the System Assigned Managed Identity should be enabled.
• user_assigned_resource_ids - (Optional) Specifies a list of User Assigned Managed Identity resource IDs to be assigned to this resource.

Type:

object({
    system_assigned            = optional(bool, false)
    user_assigned_resource_ids = optional(set(string), [])
  })

Default: {}

Description: (Optional) The minimum supported TLS version for the storage account. Possible values are TLS1_0, TLS1_1, and TLS1_2. Defaults to TLS1_2 for new storage accounts.

Type: string

Default: "TLS1_2"

Description: Network rules restricting access to the storage account. Defaults to {}, which applies the object's own per-attribute defaults (effectively default_action = "Deny" with bypass = ["AzureServices"]).

Note: the default value blocks all public access to the storage account. If you want to disable all network rules, set this value to null.

• bypass - (Optional) Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Valid options are any combination of Logging, Metrics, AzureServices, or None. Defaults to ["AzureServices"].
• default_action - (Optional) Specifies the default action of allow or deny when no other rules match. Valid options are Deny or Allow. Defaults to Deny.
• ip_rules - (Optional) List of public IP or IP ranges in CIDR format. Only IPv4 addresses are allowed. Private IP address ranges (as defined in RFC 1918) are not allowed. Defaults to [].
• virtual_network_subnet_ids - (Optional) A set of virtual network subnet IDs to secure the storage account. Defaults to [].
• private_link_access - (Optional) A list of private link access rules. Defaults to null. Each entry supports:
  • endpoint_resource_id - (Required) The resource ID of the resource access rule to be granted access.
  • endpoint_tenant_id - (Optional) The tenant ID of the resource of the resource access rule to be granted access. Defaults to the current tenant ID.
• timeouts - (Optional) Per-operation timeouts for the network rules resource. Defaults to null (uses provider defaults). Supports:
  • create - (Optional) Timeout for create operations.
  • delete - (Optional) Timeout for delete operations.
  • read - (Optional) Timeout for read operations.
  • update - (Optional) Timeout for update operations.

Type:

object({
    bypass                     = optional(set(string), ["AzureServices"])
    default_action             = optional(string, "Deny")
    ip_rules                   = optional(set(string), [])
    virtual_network_subnet_ids = optional(set(string), [])
    private_link_access = optional(list(object({
      endpoint_resource_id = string
      endpoint_tenant_id   = optional(string)
    })))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  })

Default: {}

Description: (Optional) Is NFSv3 protocol enabled? Changing this forces a new resource to be created. Defaults to false.

Type: bool

Default: false

Description: A map of private endpoints to create on the resource. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time. Defaults to {} (no private endpoints).

• subnet_resource_id - (Required) The resource ID of the subnet to deploy the private endpoint in.
• subresource_name - (Required) The service name of the private endpoint. Possible values are blob, dfs, file, queue, table, and web. Typed as optional to match the AVM private_endpoints interface, which allows resources with a single subresource to default it. A storage account exposes several, so this module cannot pick one for you and a validation rule requires it.
• name - (Optional) The name of the private endpoint. One will be generated if not set. The name must be set if multiple private endpoints are created to avoid conflicting resources.
• role_assignments - (Optional) A map of role assignments to create on the private endpoint. Defaults to {}. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time. Each value supports:
  • name - (Optional) The name of the role assignment. Must be a lowercase GUID. A random UUID is generated if not set. Defaults to null.
  • role_definition_id_or_name - (Required) The ID or name of the role definition to assign to the principal.
  • principal_id - (Required) The ID of the principal to assign the role to.
  • description - (Optional) The description of the role assignment. Defaults to null.
  • skip_service_principal_aad_check - (Optional) Retained for backwards compatibility with the legacy azurerm schema. Not honoured under AzAPI: the field is accepted but has no effect on the underlying role assignment. Defaults to false.
  • condition - (Optional) The condition which will be used to scope the role assignment. Defaults to null.
  • condition_version - (Optional) The version of the condition syntax. Valid value is 2.0. Defaults to null.
  • delegated_managed_identity_resource_id - (Optional) The resource ID of the delegated managed identity. Defaults to null.
  • principal_type - (Optional) The type of principal. One of User, Group, ServicePrincipal, ForeignGroup, Device. Defaults to null.
• lock - (Optional) The management lock to apply to the private endpoint. Defaults to null (no lock). Supports:
  • kind - (Required) The kind of lock. Possible values are CanNotDelete and ReadOnly.
  • name - (Optional) The name of the lock. Defaults to null (auto-generated).
  • notes - (Optional) A note describing why the lock exists. Defaults to null, which uses a note derived from kind.
• tags - (Optional) A mapping of tags to assign to the private endpoint. Defaults to null.
• private_dns_zone_group_name - (Optional) The name of the private DNS zone group. Defaults to default.
• private_dns_zone_resource_ids - (Optional) A set of resource IDs of private DNS zones to associate with the private endpoint. Defaults to []. If empty, no zone groups will be created and the private endpoint will not be associated with any private DNS zones; DNS records must be managed external to this module.
• application_security_group_associations - (Optional) A map of resource IDs of application security groups to associate with the private endpoint. Defaults to {}. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time; the value is the application security group resource ID.
• private_service_connection_name - (Optional) The name of the private service connection. One will be generated if not set. Defaults to null.
• network_interface_name - (Optional) The name of the network interface. One will be generated if not set. Defaults to null.
• location - (Optional) The Azure location where the resources will be deployed. Defaults to the location of the storage account.
• resource_group_name - (Optional) The resource group where the resources will be deployed. Defaults to the resource group of the storage account.
• ip_configurations - (Optional) A map of IP configurations to create on the private endpoint. Defaults to {} (the platform allocates IPs). The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time. Each value supports:
  • name - (Required) The name of the IP configuration.
  • private_ip_address - (Required) The private IP address of the IP configuration.
  • member_name - (Optional) The name of the group member the IP configuration targets. Defaults to null, which uses subresource_name. Set this when a subresource exposes several members, such as a Data Lake Storage Gen2 account serving both blob and dfs.

Type:

map(object({
    name = optional(string, null)
    role_assignments = optional(map(object({
      name                                   = optional(string, null)
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    lock = optional(object({
      kind  = string
      name  = optional(string, null)
      notes = optional(string, null)
    }), null)
    tags                                    = optional(map(string), null)
    subnet_resource_id                      = string
    subresource_name                        = optional(string, null)
    private_dns_zone_group_name             = optional(string, "default")
    private_dns_zone_resource_ids           = optional(set(string), [])
    application_security_group_associations = optional(map(string), {})
    private_service_connection_name         = optional(string, null)
    network_interface_name                  = optional(string, null)
    location                                = optional(string, null)
    resource_group_name                     = optional(string, null)
    ip_configurations = optional(map(object({
      name               = string
      private_ip_address = string
      member_name        = optional(string)
    })), {})
  }))

Default: {}

Description: Whether to manage private DNS zone groups with this module. Defaults to true. If set to false, you must manage private DNS zone groups externally, e.g. using Azure Policy.

Type: bool

Default: true

Description: [DEPRECATED] (Optional) Specifies the version of the provisioned billing model (e.g. when account_kind = "FileStorage" for Storage File). Possible value is V2. Defaults to null. Changing this forces a new resource to be created. This variable is only honoured when account_sku_name is set to null; otherwise account_sku_name wins. Prefer account_sku_name (use a *V2_* SKU such as StandardV2_ZRS or PremiumV2_ZRS).

Type: string

Default: null

Description: (Optional) Whether the public network access is enabled? Defaults to false.

Type: bool

Default: false

Description: (Optional) The encryption type of the queue service. Possible values are Service and Account. Defaults to null (Azure platform default of Service). Changing this forces a new resource to be created.

Type: string

Default: null

Description: Queue service-level settings for the storage account. Defaults to null (Azure platform defaults).

• cors_rules - (Optional) A list of CORS rules for the queue service. Defaults to null. Each entry supports:
  • allowed_headers - (Required) A list of headers allowed in cross-origin requests.
  • allowed_methods - (Required) A list of HTTP methods allowed.
  • allowed_origins - (Required) A list of origin domains allowed.
  • exposed_headers - (Required) A list of response headers exposed to CORS clients.
  • max_age_in_seconds - (Required) Seconds the browser should cache a preflight response.

Type:

object({
    cors_rules = optional(list(object({
      allowed_headers    = list(string)
      allowed_methods    = list(string)
      allowed_origins    = list(string)
      exposed_headers    = list(string)
      max_age_in_seconds = number
    })))
  })

Default: null

Description: A map of queues to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to {} (no queues).

• name - (Required) The name of the Queue which should be created within the Storage Account. Must be unique within the storage account. Changing this forces a new resource to be created.
• metadata - (Optional) A mapping of MetaData which should be assigned to this Storage Queue. Defaults to null.
• role_assignments - (Optional) A map of role assignments to create on the queue. Defaults to {}. See var.role_assignments for the attribute schema.
• timeouts - (Optional) Per-operation timeouts for the queue resource. Defaults to null (uses provider defaults inherited from var.timeouts). Supports:
  • create - (Optional) Timeout for create operations.
  • delete - (Optional) Timeout for delete operations.
  • read - (Optional) Timeout for read operations.
  • update - (Optional) Timeout for update operations.

Type:

map(object({
    metadata = optional(map(string))
    name     = string
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))

Default: {}

Description: Override the AzAPI <provider>/<resource>@<api-version> strings used by this module. Each key defaults to a tested value; supply only the keys you want to override. Useful when targeting a sovereign cloud with older API versions, or when opting into a newer preview API.

• storage_account - The storage account itself, used by both the create call and the customer-managed-key patch.
• customer_managed_key_vault - The Key Vault data source used to look up the vault URI when CMK is enabled.
• lock - Management lock applied to the storage account (and to private endpoints when configured).
• blob_container - Blob containers (also used by Data Lake Gen2 filesystems, which are blob containers in ARM).
• blob_service - The blobServices/default sub-resource, patched by the blob-service submodule.
• file_service - The fileServices/default sub-resource, patched by the file-service submodule for CORS, soft-delete, and SMB settings.
• queue - Storage queues.
• table - Storage tables.
• share - File shares.
• static_website - The blobServices/default sub-resource, patched by the static-website submodule. Pinned to a later API version than blob_service because properties.staticWebsite was only added to the blob service schema in 2025-08-01; earlier versions silently drop it.
• local_user - SFTP local users.
• management_policy - The lifecycle-management policy.
• queue_service - The queueServices/default sub-resource, patched by the queue-service-properties submodule.
• table_service - The tableServices/default sub-resource, patched by the table-service-properties submodule.
• private_endpoint - Private endpoints created for the storage account.
• private_dns_zone_group - The private DNS zone group resource attached to a private endpoint.

Type:

object({
    storage_account            = optional(string, "Microsoft.Storage/storageAccounts@2025-08-01")
    customer_managed_key_vault = optional(string, "Microsoft.KeyVault/vaults@2024-11-01")
    lock                       = optional(string, "Microsoft.Authorization/locks@2020-05-01")
    blob_container             = optional(string, "Microsoft.Storage/storageAccounts/blobServices/containers@2025-06-01")
    blob_service               = optional(string, "Microsoft.Storage/storageAccounts/blobServices@2025-06-01")
    file_service               = optional(string, "Microsoft.Storage/storageAccounts/fileServices@2025-06-01")
    queue                      = optional(string, "Microsoft.Storage/storageAccounts/queueServices/queues@2025-06-01")
    table                      = optional(string, "Microsoft.Storage/storageAccounts/tableServices/tables@2025-06-01")
    share                      = optional(string, "Microsoft.Storage/storageAccounts/fileServices/shares@2025-06-01")
    static_website             = optional(string, "Microsoft.Storage/storageAccounts/blobServices@2025-08-01")
    local_user                 = optional(string, "Microsoft.Storage/storageAccounts/localUsers@2025-06-01")
    management_policy          = optional(string, "Microsoft.Storage/storageAccounts/managementPolicies@2025-06-01")
    queue_service              = optional(string, "Microsoft.Storage/storageAccounts/queueServices@2025-06-01")
    table_service              = optional(string, "Microsoft.Storage/storageAccounts/tableServices@2025-06-01")
    private_endpoint           = optional(string, "Microsoft.Network/privateEndpoints@2025-05-01")
    private_dns_zone_group     = optional(string, "Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2025-05-01")
  })

Default: {}

Description: Retry configuration applied to every azapi resource managed by the module (root storage account and all submodules). By default, retries only the transient StorageAccountOperationInProgress error, starting at 5 seconds and capping the interval at 60 seconds.

• error_message_regex - (Optional) A list of regex patterns matching error messages that trigger a retry. Supplying this field replaces the default list; include StorageAccountOperationInProgress to retain the module's transient storage-operation retry.
• interval_seconds - (Optional) Initial interval between retries in seconds. Defaults to 5.
• max_interval_seconds - (Optional) Maximum interval between retries in seconds. Defaults to 60.

Set retry = null to disable custom retries. The default deliberately does not retry generic HTTP 403 or 409 responses, so authorization failures and permanent conflicts remain visible.

See https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource#retry for full semantics.

Type:

object({
    error_message_regex  = optional(list(string), ["StorageAccountOperationInProgress"])
    interval_seconds     = optional(number, 5)
    max_interval_seconds = optional(number, 60)
  })

Default: {}

Description: Whether the Azure/avm-utl-interfaces/azure module composed by the internal role_assignments submodule should resolve role definition names supplied via role_definition_id_or_name by querying the Azure Authorization API. Applies to every role assignment created by this module: the storage account scope (var.role_assignments), every container/queue/share/table scope and every private endpoint scope. Defaults to true.

Set to false if you only ever supply fully-qualified role definition resource IDs (/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/<guid>) in role_definition_id_or_name. Disabling the lookup avoids the API call, which is useful in air-gapped or permission-restricted environments where the calling identity lacks Microsoft.Authorization/roleDefinitions/read at the parent scope.

Type: bool

Default: true

Description: A map of role assignments to create on the resource. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time. Defaults to {}.

• role_definition_id_or_name - (Required) The ID or name of the role definition to assign to the principal.
• principal_id - (Required) The ID of the principal to assign the role to.
• description - (Optional) The description of the role assignment. Defaults to null.
• skip_service_principal_aad_check - (Optional) Retained for backwards compatibility with the legacy azurerm schema. Not honoured under AzAPI: the field is accepted but has no effect on the underlying role assignment. Defaults to false.
• condition - (Optional) The condition which will be used to scope the role assignment. Defaults to null.
• condition_version - (Optional) The version of the condition syntax. Valid value is 2.0. Defaults to null.
• delegated_managed_identity_resource_id - (Optional) The resource ID of the delegated managed identity. Defaults to null.
• principal_type - (Optional) The type of principal. One of User, Group, ServicePrincipal, ForeignGroup, Device. Defaults to null.

Type:

map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
    principal_type                         = optional(string, null)
  }))

Default: {}

Description: Configures the storage account routing preference. Defaults to null (Azure platform defaults).

• choice - (Optional) Specifies the kind of network routing opted by the user. Possible values are InternetRouting and MicrosoftRouting. Defaults to MicrosoftRouting.
• publish_internet_endpoints - (Optional) Should internet routing storage endpoints be published? Defaults to false.
• publish_microsoft_endpoints - (Optional) Should Microsoft routing storage endpoints be published? Defaults to false.

Type:

object({
    choice                      = optional(string, "MicrosoftRouting")
    publish_internet_endpoints  = optional(bool, false)
    publish_microsoft_endpoints = optional(bool, false)
  })

Default: null

Description: Configures the SAS policy on the storage account. Defaults to null (no SAS policy).

• expiration_period - (Required) The SAS expiration period in the format DD.HH:MM:SS.
• expiration_action - (Optional) The SAS expiration action. The only possible value is Log at this moment. Defaults to Log.

Type:

object({
    expiration_action = optional(string, "Log")
    expiration_period = string
  })

Default: null

Description: (Optional) Boolean, enable SFTP for the storage account. Defaults to false.

Type: bool

Default: false

Description: (Optional) Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). Defaults to false.

Type: bool

Default: false

Description: A map of file shares to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to {} (no shares).

• name - (Required) The name of the share. Must be unique within the storage account. Changing this forces a new resource to be created.
• quota - (Required) The maximum size of the share, in gigabytes. For Standard storage accounts, this must be 1 GB or higher and at most 5120 GB (5 TB). For Premium FileStorage accounts, this must be greater than 100 GB and at most 102400 GB (100 TB).
• provisioned_bandwidth_mibps - (Optional) The provisioned bandwidth of the share, in MiB/s. Only valid for Files Provisioned v2 accounts. Defaults to null.
• provisioned_iops - (Optional) The provisioned IOPS of the share. Only valid for Files Provisioned v2 accounts. Defaults to null.
• access_tier - (Optional) The access tier of the file share. Possible values are Hot, Cool, TransactionOptimized, Premium. Defaults to null (Azure platform default).
• enabled_protocol - (Optional) The protocol used for the share. Possible values are SMB and NFS. SMB indicates the share can be accessed by SMBv3.0, SMBv2.1 and REST. NFS indicates the share can be accessed by NFSv4.1. Defaults to null (Azure platform default of SMB). Changing this forces a new resource to be created.
• metadata - (Optional) A mapping of MetaData for this File Share. Defaults to null.
• root_squash - (Optional) The root squash behaviour for an NFS share. Possible values are NoRootSquash, RootSquash, AllSquash. Defaults to null.
• signed_identifiers - (Optional) A list of signed identifiers (stored access policies) to apply to the share. Defaults to null. Each entry supports:
  • id - (Required) The ID for this signed identifier. Maximum 64 characters.
  • access_policy - (Optional) The access policy for this identifier. Defaults to null. Supports:
    • expiry_time - (Required) The ISO8601 UTC time at which this access policy should expire.
    • permission - (Required) The permissions associated with this signed identifier. A combination of r (read), w (write), d (delete), and l (list).
    • start_time - (Required) The ISO8601 UTC time at which this access policy becomes valid.
• role_assignments - (Optional) A map of role assignments to create on the share. Defaults to {}. See var.role_assignments for the attribute schema.
• timeouts - (Optional) Per-operation timeouts for the share resource. Defaults to null (uses provider defaults inherited from var.timeouts). Supports:
  • create - (Optional) Timeout for create operations.
  • delete - (Optional) Timeout for delete operations.
  • read - (Optional) Timeout for read operations.
  • update - (Optional) Timeout for update operations.

Type:

map(object({
    access_tier                 = optional(string)
    enabled_protocol            = optional(string)
    metadata                    = optional(map(string))
    name                        = string
    quota                       = number
    provisioned_bandwidth_mibps = optional(number)
    provisioned_iops            = optional(number)
    root_squash                 = optional(string)
    signed_identifiers = optional(list(object({
      id = string
      access_policy = optional(object({
        expiry_time = string
        permission  = string
        start_time  = string
      }))
    })))
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))

Default: {}

Description: A map of static website configurations to apply to the storage account. Defaults to null (static website disabled). The map key is arbitrary; only the first entry is used by the underlying API.

• error_404_document - (Optional) The absolute path to a custom webpage that should be used when a request is made which does not correspond to an existing file. Defaults to null.
• index_document - (Optional) The webpage that Azure Storage serves for requests to the root of a website or any subfolder. For example, index.html. The value is case-sensitive. Defaults to null.

Type:

map(object({
    error_404_document = optional(string)
    index_document     = optional(string)
  }))

Default: null

Description: A map of Data Lake Gen2 filesystems to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to {} (no filesystems).

• name - (Required) The name of the Data Lake Gen2 File System which should be created within the Storage Account. Must be unique within the storage account. Changing this forces a new resource to be created.
• default_encryption_scope - (Optional) The default encryption scope to use for this filesystem. Defaults to null. Changing this forces a new resource to be created.
• properties - (Optional) A mapping of key/value pairs assigned to this filesystem (passed as ARM container metadata). Defaults to null.
• timeouts - (Optional) Per-operation timeouts for the filesystem resource. Defaults to null (uses provider defaults inherited from var.timeouts). Supports:
  • create - (Optional) Timeout for create operations.
  • delete - (Optional) Timeout for delete operations.
  • read - (Optional) Timeout for read operations.
  • update - (Optional) Timeout for update operations.

v1.0.0 BREAKING CHANGE: The owner, group and ace (POSIX ACL) fields, plus the standalone var.storage_data_lake_gen2_paths variable, are no longer supported. Those features required Data Lake DFS data-plane API calls which the AzAPI provider does not exercise. Manage them externally if required (see examples/data_lake_gen2/ for a recipe using azurerm_storage_data_lake_gen2_path alongside this module).

Type:

map(object({
    default_encryption_scope = optional(string)
    name                     = string
    properties               = optional(map(string))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))

Default: {}

Description: A map of management policy rules to apply to the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to {} (no rules).

• enabled - (Required) Boolean to specify whether the rule is enabled.
• name - (Required) The name of the rule. Rule name is case-sensitive. It must be unique within a policy.
• actions - (Required) An object describing the actions taken by the rule. Supports the following nested blocks (each optional, defaults to null):

base_blob block supports the following:

• auto_tier_to_hot_from_cool_enabled - (Optional) Whether a blob should automatically be tiered from cool back to hot if it is accessed again after being tiered to cool. Defaults to null (Azure platform default of false).
• delete_after_days_since_creation_greater_than - (Optional) The age in days after creation to delete the blob. Must be between 0 and 99999. Defaults to null (no policy applied).
• delete_after_days_since_last_access_time_greater_than - (Optional) The age in days after last access time to delete the blob. Must be between 0 and 99999. Defaults to null (no policy applied).
• delete_after_days_since_modification_greater_than - (Optional) The age in days after last modification to delete the blob. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_archive_after_days_since_creation_greater_than - (Optional) The age in days after creation to archive storage. Supports blob currently at Hot or Cool tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_archive_after_days_since_last_access_time_greater_than - (Optional) The age in days after last access time to tier blobs to archive storage. Supports blob currently at Hot or Cool tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_archive_after_days_since_last_tier_change_greater_than - (Optional) The age in days after last tier change to skip the blob being re-archived. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_archive_after_days_since_modification_greater_than - (Optional) The age in days after last modification to tier blobs to archive storage. Supports blob currently at Hot or Cool tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cold_after_days_since_creation_greater_than - (Optional) The age in days after creation to tier blobs to cold storage. Supports blob currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cold_after_days_since_last_access_time_greater_than - (Optional) The age in days after last access time to tier blobs to cold storage. Supports blob currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cold_after_days_since_modification_greater_than - (Optional) The age in days after last modification to tier blobs to cold storage. Supports blob currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cool_after_days_since_creation_greater_than - (Optional) The age in days after creation to tier blobs to cool storage. Supports blob currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cool_after_days_since_last_access_time_greater_than - (Optional) The age in days after last access time to tier blobs to cool storage. Supports blob currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cool_after_days_since_modification_greater_than - (Optional) The age in days after last modification to tier blobs to cool storage. Supports blob currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).

snapshot block supports the following:

• change_tier_to_archive_after_days_since_creation - (Optional) The age in days after creation to tier blob snapshot to archive storage. Must be between 0 and 99999. Defaults to null (no policy applied).
• change_tier_to_cool_after_days_since_creation - (Optional) The age in days after creation to tier blob snapshot to cool storage. Must be between 0 and 99999. Defaults to null (no policy applied).
• delete_after_days_since_creation_greater_than - (Optional) The age in days after creation to delete the blob snapshot. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_archive_after_days_since_last_tier_change_greater_than - (Optional) The age in days after last tier change to skip the snapshot being re-archived. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cold_after_days_since_creation_greater_than - (Optional) The age in days after creation to tier blob snapshots to cold storage. Supports snapshots currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).

version block supports the following:

• change_tier_to_archive_after_days_since_creation - (Optional) The age in days after creation to tier blob version to archive storage. Must be between 0 and 99999. Defaults to null (no policy applied).
• change_tier_to_cool_after_days_since_creation - (Optional) The age in days after creation to tier blob version to cool storage. Must be between 0 and 99999. Defaults to null (no policy applied).
• delete_after_days_since_creation - (Optional) The age in days after creation to delete the blob version. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_archive_after_days_since_last_tier_change_greater_than - (Optional) The age in days after last tier change to skip the blob version being re-archived. Must be between 0 and 99999. Defaults to null (no policy applied).
• tier_to_cold_after_days_since_creation_greater_than - (Optional) The age in days after creation to tier blob versions to cold storage. Supports versions currently at Hot tier. Must be between 0 and 99999. Defaults to null (no policy applied).

filters block (Required) supports the following:

• blob_types - (Required) A set of predefined values. Valid options are blockBlob and appendBlob.
• prefix_match - (Optional) A set of strings for prefixes to be matched. Defaults to null.
• match_blob_index_tag - (Optional) A set of blob index tag filters. Defaults to null. Each entry supports the attributes documented in the match_blob_index_tag block below.

match_blob_index_tag block supports the following:

• name - (Required) The filter tag name used for tag based filtering for blob objects.
• value - (Required) The filter tag value used for tag based filtering for blob objects.
• operation - (Optional) The comparison operator which is used for object comparison and filtering. Possible value is ==. Defaults to null (Azure platform default of ==).

Type:

map(object({
    enabled = bool
    name    = string
    actions = object({
      base_blob = optional(object({
        auto_tier_to_hot_from_cool_enabled                             = optional(bool)
        delete_after_days_since_creation_greater_than                  = optional(number)
        delete_after_days_since_last_access_time_greater_than          = optional(number)
        delete_after_days_since_modification_greater_than              = optional(number)
        tier_to_archive_after_days_since_creation_greater_than         = optional(number)
        tier_to_archive_after_days_since_last_access_time_greater_than = optional(number)
        tier_to_archive_after_days_since_last_tier_change_greater_than = optional(number)
        tier_to_archive_after_days_since_modification_greater_than     = optional(number)
        tier_to_cold_after_days_since_creation_greater_than            = optional(number)
        tier_to_cold_after_days_since_last_access_time_greater_than    = optional(number)
        tier_to_cold_after_days_since_modification_greater_than        = optional(number)
        tier_to_cool_after_days_since_creation_greater_than            = optional(number)
        tier_to_cool_after_days_since_last_access_time_greater_than    = optional(number)
        tier_to_cool_after_days_since_modification_greater_than        = optional(number)
      }))
      snapshot = optional(object({
        change_tier_to_archive_after_days_since_creation               = optional(number)
        change_tier_to_cool_after_days_since_creation                  = optional(number)
        delete_after_days_since_creation_greater_than                  = optional(number)
        tier_to_archive_after_days_since_last_tier_change_greater_than = optional(number)
        tier_to_cold_after_days_since_creation_greater_than            = optional(number)
      }))
      version = optional(object({
        change_tier_to_archive_after_days_since_creation               = optional(number)
        change_tier_to_cool_after_days_since_creation                  = optional(number)
        delete_after_days_since_creation                               = optional(number)
        tier_to_archive_after_days_since_last_tier_change_greater_than = optional(number)
        tier_to_cold_after_days_since_creation_greater_than            = optional(number)
      }))
    })
    filters = object({
      blob_types   = set(string)
      prefix_match = optional(set(string))
      match_blob_index_tag = optional(set(object({
        name      = string
        operation = optional(string)
        value     = string
      })))
    })
  }))

Default: {}

Description: Per-operation timeouts for the storage account management policy resource. Defaults to null (uses provider defaults).

• create - (Optional) Timeout for create operations. Defaults to null.
• delete - (Optional) Timeout for delete operations. Defaults to null.
• read - (Optional) Timeout for read operations. Defaults to null.
• update - (Optional) Timeout for update operations. Defaults to null.

Type:

object({
    create = optional(string)
    delete = optional(string)
    read   = optional(string)
    update = optional(string)
  })

Default: null

Description: (Optional) The encryption type of the table service. Possible values are Service and Account. Defaults to null (Azure platform default of Service). Changing this forces a new resource to be created.

Type: string

Default: null

Description: Table service-level settings for the storage account. Defaults to null (Azure platform defaults).

• cors_rules - (Optional) A list of CORS rules for the table service. Defaults to null. Each entry supports:
  • allowed_headers - (Required) A list of headers allowed in cross-origin requests.
  • allowed_methods - (Required) A list of HTTP methods allowed.
  • allowed_origins - (Required) A list of origin domains allowed.
  • exposed_headers - (Required) A list of response headers exposed to CORS clients.
  • max_age_in_seconds - (Required) Seconds the browser should cache a preflight response.

Type:

object({
    cors_rules = optional(list(object({
      allowed_headers    = list(string)
      allowed_methods    = list(string)
      allowed_origins    = list(string)
      exposed_headers    = list(string)
      max_age_in_seconds = number
    })))
  })

Default: null

Description: (Optional) Duration to wait after the table service CORS PATCH before allowing dependents to refresh, expressed as a Go duration string (e.g. 2m, 90s). Defaults to "2m".

The ARM GET on tableServices/default is eventually consistent: immediately after a successful PATCH the read can omit the corsRules that were just applied, which causes a follow-up terraform plan (and the post-apply idempotency check) to see false drift. The read-back stabilises after roughly two minutes. Set to "0s" to disable the wait entirely (not recommended when table_properties.cors_rules is set).

Type: string

Default: "2m"

Description: A map of tables to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to {} (no tables).

• name - (Required) The name of the storage table. Only alphanumeric characters allowed, starting with a letter. Must be unique within the storage account. Changing this forces a new resource to be created.
• signed_identifiers - (Optional) A list of signed identifiers (stored access policies) to apply to the table. Defaults to null. Each entry supports:
  • id - (Required) The ID for this signed identifier. Maximum 64 characters.
  • access_policy - (Optional) The access policy for this identifier. Defaults to null. Supports:
    • expiry_time - (Required) The ISO8601 UTC time at which this access policy should expire.
    • permission - (Required) The permissions associated with this signed identifier. A combination of r (read), a (add), u (update), and d (delete).
    • start_time - (Required) The ISO8601 UTC time at which this access policy becomes valid.
• role_assignments - (Optional) A map of role assignments to create on the table. Defaults to {}. See var.role_assignments for the attribute schema.
• timeouts - (Optional) Per-operation timeouts for the table resource. Defaults to null (uses provider defaults inherited from var.timeouts). Supports:
  • create - (Optional) Timeout for create operations.
  • delete - (Optional) Timeout for delete operations.
  • read - (Optional) Timeout for read operations.
  • update - (Optional) Timeout for update operations.

Type:

map(object({
    name = string
    signed_identifiers = optional(list(object({
      id = string
      access_policy = optional(object({
        expiry_time = string
        permission  = string
        start_time  = string
      }))
    })))

    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})

    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))

Default: {}

Description: Custom tags to apply to the resource.

Type: map(string)

Default: null

Description: Default per-operation timeouts applied to every azapi resource managed by the module. Defaults to null (provider defaults). Each value is a Go duration string (e.g. 30m, 1h).

• create - (Optional) Timeout for create operations. Defaults to null.
• read - (Optional) Timeout for read operations. Defaults to null.
• update - (Optional) Timeout for update operations. Defaults to null.
• delete - (Optional) Timeout for delete operations. Defaults to null.

The root storage account uses these values directly. Submodules (containers, queues, shares, tables, diagnostic settings, private endpoints, management policy, local users, role assignments, Data Lake Gen2 filesystems) use these as a default that can be overridden per-item via the item's own timeouts field.

Type:

object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })

Default: null

The following outputs are exported:

Description: Map of storage containers that are created.

Description: Map of Data Lake Gen2 filesystems that are created.

Description: Fqdns for storage services. Hostnames come from the endpoints Azure returns for the account, so they carry the DNS suffix of the target cloud (for example core.usgovcloudapi.net in Azure US Government).

Description: A map of Storage Account Local Users. The map key matches var.local_user.

The map value contains the following attributes:

• id - The ID of the Storage Account Local User.
• name - The name of the Storage Account Local User.
• home_directory - The home directory of the Storage Account Local User.
• sid - The unique Security Identifier (SID) of the Storage Account Local User.
• ssh_key_enabled - Specifies whether SSH Key authentication is enabled.
• ssh_password_enabled - Specifies whether SSH password authentication is enabled.

NOTE: The local user password attribute is no longer exported. The Storage RP
only returns the password from the regeneratePassword ARM action (the listKeys action returns an empty body because the password is not persisted
server-side). Declare a managed azapi_resource_action resource with action = "regeneratePassword" and response_export_values = ["sshPassword"]
in the consuming root module; the default apply_after_create behavior calls
the action exactly once at create so the password is stable. Pipe the result
through value_wo on azurerm_key_vault_secret to keep it out of state.

Description: The name of the storage account.

Description: A map of private endpoints created by the module. The map key matches var.private_endpoints.

Each value is an object with:

• id - The resource ID of the private endpoint.
• name - The name of the private endpoint.
• edge_zone - The Edge Zone the private endpoint was placed in, inherited from var.edge_zone, or null when the private endpoint is regional.
• private_dns_zone_group_id - The resource ID of the managed private DNS zone group, or null if not managed by this module.
• role_assignments - Map of role assignments created at the private endpoint scope.

Description: Map of storage queues that are created.

Description: The full Storage Account azapi_resource.

Description: The ID of the Storage Account.

Description: Map of storage file shares that are created.

Description: Map of storage tables that are created.

The following Modules are called:

Source: ./modules/blob_service

Version:

Source: ./modules/container

Version:

Source: ./modules/data_lake_filesystem

Version:

Source: ./modules/diagnostic_setting

Version:

Source: ./modules/diagnostic_setting

Version:

Source: ./modules/diagnostic_setting

Version:

Source: ./modules/diagnostic_setting

Version:

Source: ./modules/diagnostic_setting

Version:

Source: ./modules/file_service

Version:

Source: ./modules/local_user

Version:

Source: ./modules/management_policy

Version:

Source: ./modules/private_endpoint

Version:

Source: ./modules/queue_service

Version:

Source: ./modules/queue

Version:

Source: ./modules/role_assignments

Version:

Source: ./modules/share

Version:

Source: ./modules/static_website

Version:

Source: ./modules/table_service

Version:

Source: ./modules/table

Version:

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.