### Default Terraform Example for App Configuration Module

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/examples/default/README.md

This snippet shows the default deployment of the Azure App Configuration AVM module. It includes Terraform version, required providers (azapi, azurerm, random), resource group creation using azapi_resource, and the main module call for the App Configuration store.

```hcl
terraform {
  required_version = "~> 1.9"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"
    }
  }
}

provider "azurerm" {
  features {}
}

## Section to provide a random Azure region for the resource group
# This allows us to randomize the region for the resource group.
module "regions" {
  source  = "Azure/avm-utl-regions/azurerm"
  version = "0.3.0"

  enable_telemetry = var.enable_telemetry
}

# This allows us to randomize the region for the resource group.
resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}
## End of section to provide a random Azure region for the resource group

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "~> 0.4.2"
}

# This is required for resource modules
resource "azapi_resource" "rg" {
  location                  = module.regions.regions[random_integer.region_index.result].name
  name                      = module.naming.resource_group.name_unique
  type                      = "Microsoft.Resources/resourceGroups@2021-04-01"
  schema_validation_enabled = false
}

# This is the module call
# Do not specify location here due to the randomization above.
# Leaving location as `null` will cause the module to use the resource group location
# with a data source.
module "test" {
  source = "../../"

  # source             = "Azure/avm-<res/ptn>-<name>/azurerm"
  # ...
  location                        = azapi_resource.rg.location
  name                            = module.naming.app_configuration.name_unique
  resource_group_resource_id      = azapi_resource.rg.id
  azapi_schema_validation_enabled = false
  enable_telemetry                = var.enable_telemetry
}
```

--------------------------------

### Deploy App Configuration with CMK using Terraform

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/examples/customer-managed-key/README.md

This Terraform configuration demonstrates deploying an Azure App Configuration store with Customer Managed Key (CMK) enabled. It leverages AVM modules for resource naming and region selection, the `azapi` provider for creating resources like resource groups and managed identities, and the `random` provider for generating unique identifiers. The example also sets up a Key Vault to store the CMK and assigns necessary permissions.

```hcl
terraform {
  required_version = "~> 1.9"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"
    }
  }
}

provider "azurerm" {
  features {}
}

data "azapi_client_config" "current" {}

## Section to provide a random Azure region for the resource group
# This allows us to randomize the region for the resource group.
module "regions" {
  source  = "Azure/avm-utl-regions/azurerm"
  version = "0.3.0"

  enable_telemetry = var.enable_telemetry
}

# This allows us to randomize the region for the resource group.
resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}
## End of section to provide a random Azure region for the resource group

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "~> 0.4.2"
}

# This is required for resource modules
resource "azapi_resource" "rg" {
  location                  = module.regions.regions[random_integer.region_index.result].name
  name                      = module.naming.resource_group.name_unique
  type                      = "Microsoft.Resources/resourceGroups@2021-04-01"
  schema_validation_enabled = false
}

# user-assigned managed identity
resource "azapi_resource" "umi" {
  location  = azapi_resource.rg.location
  name      = module.naming.user_assigned_identity.name_unique
  parent_id = azapi_resource.rg.id
  type      = "Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30"
  response_export_values = [
    "properties.principalId",
    "properties.clientId",
  ]
  schema_validation_enabled = false
}

# key vault & key
module "key_vault" {
  source  = "Azure/avm-res-keyvault-vault/azurerm"
  version = "0.10.0"

  location            = azapi_resource.rg.location
  name                = module.naming.key_vault.name_unique
  resource_group_name = azapi_resource.rg.name
  tenant_id           = data.azapi_client_config.current.tenant_id
  keys = {
    cmk = {
      name     = "cmk"
      key_type = "RSA"
      key_size = 4096
      key_opts = ["wrapKey", "unwrapKey", "sign", "verify", "encrypt", "decrypt"]
      enabled  = true
    }
  }
  network_acls = {
    default_action = "Allow"
  }
  role_assignments = {
    admin = {
      principal_id               = data.azapi_client_config.current.object_id
      role_definition_id_or_name = "Key Vault Administrator"
    }
    umi = {
      principal_id               = azapi_resource.umi.output.properties.principalId
      role_definition_id_or_name = "Key Vault Crypto User"
      principal_type             = "ServicePrincipal"
    }
  }
}

# This is the module call
module "test" {
  source = "../../"

  # source             = "Azure/avm-<res/ptn>-<name>/azurerm"
  # ...
  location                        = azapi_resource.rg.location
  name                            = module.naming.app_configuration.name_unique
  resource_group_resource_id      = azapi_resource.rg.id
  azapi_schema_validation_enabled = false
  customer_managed_key = {
    key_name              = split("/", module.key_vault.keys.cmk.id)[4]
    key_vault_resource_id = module.key_vault.resource_id
    user_assigned_identity = {
      resource_id = azapi_resource.umi.id
    }
  }
  enable_telemetry = var.enable_telemetry
  managed_identities = {
    user_assigned_resource_ids = [
      azapi_resource.umi.id
    ]
  }
}

```

--------------------------------

### Module: naming

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/examples/default/README.md

This module is used for generating CAF compliant names for resources. It is sourced from 'Azure/naming/azurerm' and requires version '~> 0.4.2'.

```hcl
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "~> 0.4.2"
}
```

--------------------------------

### Module: regions

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/examples/default/README.md

This module is used to provide a random Azure region for the resource group. It is sourced from 'Azure/avm-utl-regions/azurerm' and requires version '0.3.0'.

```hcl
module "regions" {
  source  = "Azure/avm-utl-regions/azurerm"
  version = "0.3.0"

  enable_telemetry = var.enable_telemetry
}
```

--------------------------------

### Optional Input: enable_telemetry

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/examples/default/README.md

This variable controls whether telemetry is enabled for the module. If set to false, no telemetry will be collected. It accepts a boolean value and defaults to true.

```hcl
variable "enable_telemetry" {
  description = "This variable controls whether or not telemetry is enabled for the module.  
For more information see <https://aka.ms/avm/telemetryinfo>.  
If it is set to false, then no telemetry will be collected."
  type        = bool
  default     = true
}
```

--------------------------------

### Key-Value Pairs Configuration

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

A map for creating key-value pairs within the App Configuration. Each entry defines a key, its value, and optional attributes like content type, label, and tags.

```APIDOC
key_values:
  description: Map of objects containing App Configuration key-value attributes to create. The map key is deliberately arbitrary to ensure keys can always be known at plan time.
  properties:
    key:
      description: The key for the App Configuration entry.
      type: string
    value:
      description: The value associated with the key.
      type: string
    content_type:
      description: (Optional) The content type of the key-value pair.
      type: string
      optional: true
      default: null
    label:
      description: (Optional) The label for the key-value pair.
      type: string
      optional: true
      default: null
    tags:
      description: (Optional) A map of tags to associate with the key-value pair.
      type: map(string)
      optional: true
      default: null
  type: map(object({
    key          = string
    value        = string
    content_type = optional(string, null)
    label        = optional(string, null)
    tags         = optional(map(string), null)
  }))
  default: {}

```

--------------------------------

### Specify SKU for App Configuration (HCL)

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Defines the SKU (pricing tier) for the Azure App Configuration resource. Valid values include 'free', 'standard', and 'premium', determining the features and performance characteristics of the service.

```HCL
string
```

--------------------------------

### Terraform Module Resources

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Lists the Azure resources and data sources managed by this Terraform module. It utilizes the azapi provider for resource deployment and management, modtm for telemetry, and random for generating UUIDs.

```hcl
# Resources managed by the module
resource "azapi_resource" "diag_settings" {}
resource "azapi_resource" "lock" {}
resource "azapi_resource" "lock_pe" {}
resource "azapi_resource" "private_dns_zone_groups" {}
resource "azapi_resource" "private_endpoint_lock" {}
resource "azapi_resource" "private_endpoint_role_assignments" {}
resource "azapi_resource" "private_endpoints" {}
resource "azapi_resource" "role_assignments" {}
resource "azapi_resource" "role_assignments_pe" {}
resource "azapi_resource" "this" {}

resource "modtm_telemetry" "telemetry" {}
resource "random_uuid" "telemetry" {}

# Data sources used by the module
data "azapi_client_config" "telemetry" {}
data "modtm_module_source" "telemetry" {}
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Specifies the Terraform providers and their version constraints necessary for this module to function correctly. These include Terraform itself, azapi, modtm, and random.

```hcl
# Terraform Version Requirement
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
    modtm = {
      source  = "Azure/modtm"
      version = "~> 0.3"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.5"
    }
  }
}
```

--------------------------------

### Optional Input Variables

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Defines optional input variables for the Terraform module, which have default values or can be customized. This includes schema validation settings and customer-managed key configurations.

```hcl
variable "azapi_schema_validation_enabled" {
  description = "Enable or disable schema validation for AzAPI resources. Default is `true`. Disable this when certain known-after-apply values cause issues with schema validation."
  type        = bool
  default     = true
}

variable "customer_managed_key" {
  description = "A map describing customer-managed keys to associate with the resource. This includes the following properties:
    - `key_vault_resource_id` - The resource ID of the Key Vault where the key is stored.
    - `key_name` - The name of the key.
    - `key_version` - (Optional) The version of the key. If not specified, the latest version is used.
    - `user_assigned_identity` - (Optional) An object representing a user-assigned identity with the following properties:
      - `resource_id` - The resource ID of the user-assigned identity."
  type = object({
    key_vault_resource_id = string
    key_name              = string
    key_version           = optional(string, null)
    user_assigned_identity = optional(object({
      resource_id = string
    }), null)
  })
  default = null
}
```

--------------------------------

### Required Input Variables

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Defines the essential input variables that must be provided when using this Terraform module. These include the Azure region, resource name, and the resource group ID for deployment.

```hcl
variable "location" {
  description = "Azure region where the resource should be deployed."
  type        = string
}

variable "name" {
  description = "The name of the this resource."
  type        = string
}

variable "resource_group_resource_id" {
  description = "The resource group id where the resources will be deployed."
  type        = string
}
```

--------------------------------

### Terraform App Configuration Store Boolean Inputs

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Configuration options for managing DNS zone groups, public network access, and purge protection for an Azure App Configuration Store.

```hcl
private_endpoints_manage_dns_zone_group = bool
public_network_access_enabled = bool
purge_protection_enabled = bool
```

--------------------------------

### Define Tags for App Configuration (HCL)

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Assigns optional tags to the Azure App Configuration resource for organization and management. Tags are key-value pairs that can be used for filtering and categorizing resources.

```HCL
map(string)
```

--------------------------------

### Diagnostic Settings Configuration

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Defines diagnostic settings for sending logs and metrics from the App Configuration resource to various destinations like Log Analytics workspaces, storage accounts, or event hubs.

```APIDOC
diagnostic_settings:
  description: A map of diagnostic settings to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
  properties:
    name:
      description: (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.
      type: string
      optional: true
    log_categories:
      description: (Optional) A set of log categories to send to the log analytics workspace. Defaults to `[]`.
      type: set(string)
      optional: true
      default: []
    log_groups:
      description: (Optional) A set of log groups to send to the log analytics workspace. Defaults to `["allLogs"]`.
      type: set(string)
      optional: true
      default: ["allLogs"]
    metric_categories:
      description: (Optional) A set of metric categories to send to the log analytics workspace. Defaults to `["AllMetrics"]`.
      type: set(string)
      optional: true
      default: ["AllMetrics"]
    log_analytics_destination_type:
      description: (Optional) The destination type for the diagnostic setting. Possible values are `Dedicated` and `AzureDiagnostics`. Defaults to `Dedicated`.
      type: string
      optional: true
      default: "Dedicated"
    workspace_resource_id:
      description: (Optional) The resource ID of the log analytics workspace to send logs and metrics to.
      type: string
      optional: true
      default: null
    storage_account_resource_id:
      description: (Optional) The resource ID of the storage account to send logs and metrics to.
      type: string
      optional: true
      default: null
    event_hub_authorization_rule_resource_id:
      description: (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.
      type: string
      optional: true
      default: null
    event_hub_name:
      description: (Optional) The name of the event hub. If none is specified, the default event hub will be selected.
      type: string
      optional: true
      default: null
    marketplace_partner_resource_id:
      description: (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic LogsLogs.
      type: string
      optional: true
      default: null
  type: map(object({
    name                                     = optional(string, null)
    log_categories                           = optional(set(string), [])
    log_groups                               = optional(set(string), ["allLogs"])
    metric_categories                        = optional(set(string), ["AllMetrics"])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))
  default: {}

```

--------------------------------

### Terraform App Configuration Key Resource

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/modules/keyvalue/README.md

This Terraform configuration defines an Azure App Configuration key-value pair using the azurerm provider. It requires the App Configuration store resource ID, key name, and value. Optional parameters include content type, label, and tags.

```terraform
resource "azurerm_app_configuration_key" "this" {
  configuration_store_resource_id = var.configuration_store_resource_id
  key                         = var.key
  value                       = var.value
  content_type                = var.content_type
  label                       = var.label
  tags                        = var.tags
}

variable "configuration_store_resource_id" {
  description = "The resource ID of the App Configuration store."
  type        = string
}

variable "key" {
  description = "The key name for the App Configuration key."
  type        = string
}

variable "value" {
  description = "The value of the App Configuration key."
  type        = string
}

variable "content_type" {
  description = "The content type of the App Configuration key's value, e.g. `application/json` or `text/plain`."
  type        = string
  default     = null
}

variable "label" {
  description = "The label of the App Configuration key."
  type        = string
  default     = null
}

variable "tags" {
  description = "Tags to be applied to the App Configuration key."
  type        = map(string)
  default     = null
}

output "etag" {
  description = "The ETag of the App Configuration key. This is used to determine if the key has changed since it was last retrieved."
  value       = azurerm_app_configuration_key.this.etag
}

output "resource_id" {
  description = "The resource ID of the App Configuration key."
  value       = azurerm_app_configuration_key.this.id
}
```

--------------------------------

### Data Plane Proxy Configuration

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Configures the data plane proxy for accessing the App Configuration data plane via Azure Resource Manager. It specifies the authentication mode and private link delegation settings.

```APIDOC
data_plane_proxy:
  description: An object describing the data plane proxy configuration (access to the data plane via Azure Resource Manager).
  properties:
    authentication_mode:
      description: The authentication mode for the data plane proxy. Possible values are "Local" and "Pass-through". Defaults to "Pass-through".
      type: string
    private_link_delegation:
      description: The private link delegation setting for the data plane proxy. Possible values are "Enabled" and "Disabled". Defaults to "Disabled".
      type: string
  type: object
  default: null
```

--------------------------------

### Local Authentication Enablement

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Determines whether local authentication methods are enabled for the App Configuration. Setting this to `false` enforces Entra authentication only.

```APIDOC
local_auth_enabled:
  description: Whether to enable local authentication. Set to `false` to only allow Entra authentication, default is `false`.
  type: bool
  default: false
```

--------------------------------

### Azure App Configuration Key Data Source

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/modules/keyvalue-data/README.md

The `azurerm_app_configuration_key` data source retrieves a specific key-value pair from an Azure App Configuration store. It requires the store's resource ID and the key name, with an optional label. The output includes the key's value, content type, lock status, type (kv or vault), vault reference, tags, and etag.

```APIDOC
azurerm_app_configuration_key:
  description: Use this data source to access information about an existing App Configuration Key.
  attributes:
    configuration_store_resource_id: "The resource ID of the App Configuration store."
    key: "The key name for the App Configuration key."
    label: "The label of the App Configuration key. Defaults to null."
  outputs:
    resource_id: "The resource ID of the App Configuration key."
    value: "The value of the App Configuration key. The value is returned as a map with the following keys:
      - content_type: The content type of the key.
      - value: The value of the key.
      - locked: A boolean indicating if the key is locked.
      - type: The type of the key, either \"kv\" or \"vault\".
      - vault_key_reference: The vault reference if the key is of type \"vault\".
      - tags: The tags associated with the key.
      - etag: The entity tag for the key, this is used to determine if the key has changed since it was last retrieved."
```

--------------------------------

### Define Role Assignments for App Configuration (HCL)

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Configures role assignments for the Azure App Configuration resource. This input accepts a map where each entry defines a role assignment with details like role definition ID, principal ID, principal type, and optional conditions. It's crucial for managing access control to the configuration store.

```HCL
map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    principal_type                         = optional(string, null)
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
  }))
```

--------------------------------

### Terraform App Configuration Store Private Endpoints Configuration

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Defines the structure for configuring private endpoints for an Azure App Configuration Store. It includes details on name, role assignments, DNS zone groups, IP configurations, and associated resources.

```hcl
map(object({
    name = optional(string, null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})
    lock = optional(object({
      kind = string
      name = optional(string, null)
    }), null)
    tags                                    = optional(map(string), null)
    subnet_resource_id                      = string
    private_dns_zone_group_name             = optional(string, "default")
    private_dns_zone_resource_ids           = optional(set(string), [])
    application_security_group_associations = optional(map(string), {})
    private_service_connection_name         = optional(string, null)
    network_interface_name                  = optional(string, null)
    location                                = optional(string, null)
    resource_group_name                     = optional(string, null)
    ip_configurations = optional(map(object({
      name               = string
      private_ip_address = string
    })), {})
  }))
```

--------------------------------

### Telemetry Enablement

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Controls whether telemetry data collection is enabled for the module. Disabling telemetry prevents the collection of usage data.

```APIDOC
enable_telemetry:
  description: This variable controls whether or not telemetry is enabled for the module. For more information see <https://aka.ms/avm/telemetryinfo>. If it is set to false, then no telemetry will be collected.
  type: bool
  default: true
```

--------------------------------

### Set Soft Delete Retention for App Configuration (HCL)

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Specifies the number of days that items are retained before being permanently deleted from the Azure App Configuration store. The default retention period is 7 days.

```HCL
number
```

--------------------------------

### Terraform Input: lock Configuration

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Defines the resource lock configuration for an Azure App Configuration resource. It specifies the lock kind (CanNotDelete or ReadOnly) and an optional lock name. Changing the lock kind forces resource recreation.

```hcl
input "lock" {
  description = "Controls the Resource Lock configuration for this resource. The following properties can be specified:

- `kind` - (Required) The type of lock. Possible values are `"CanNotDelete"` and `"ReadOnly"`.
- `name` - (Optional) The name of the lock. If not specified, a name will be generated based on the `kind` value. Changing this forces the creation of a new resource."
  type = object({
    kind = string
    name = optional(string, null)
  })
  default = null
}
```

--------------------------------

### Terraform Input: managed_identities Configuration

Source: https://github.com/azure/terraform-azure-avm-res-appconfiguration-configurationstore/blob/main/README.md

Controls the Managed Identity configuration for an Azure App Configuration resource. It allows enabling system-assigned managed identity and assigning user-assigned managed identities via their resource IDs.

```hcl
input "managed_identities" {
  description = "Controls the Managed Identity configuration on this resource. The following properties can be specified:

- `system_assigned` - (Optional) Specifies if the System Assigned Managed Identity should be enabled.
- `user_assigned_resource_ids` - (Optional) Specifies a list of User Assigned Managed Identity resource IDs to be assigned to this resource."
  type = object({
    system_assigned            = optional(bool, false)
    user_assigned_resource_ids = optional(set(string), [])
  })
  default = {}
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.