### Terraform Module Source from GitHub

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/AGENTS.md

This is an example of a Terraform module source URL pointing to a GitHub repository for an AVM module.

```terraform
source = "https://github.com/Azure/terraform-azurerm-avm-{type}-{service}-{resource}"
```

--------------------------------

### Terraform Module Source from Registry

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/AGENTS.md

This is an example of a Terraform module source URL pointing to the Terraform Registry for an AVM module.

```terraform
source = "https://registry.terraform.io/modules/Azure/{module}/azurerm/latest"
```

--------------------------------

### Configure MongoDB Database and Collections

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Example configuration for a MongoDB database with collections, specifying throughput, default TTL, shard key, and indexing. Ensure throughput is set upon creation for databases and collections to avoid manual destroy-apply.

```hcl
database_collection = {
  name       = "database_mongoDb_collections"
  throughput = 400

  collections = {
    "collection" = {
      name                = "MongoDBcollection"
      default_ttl_seconds = "3600"
      shard_key           = "_id"
      throughput          = 400

      index = {
        keys   = ["_id"]
        unique = true
      }
    }
  }
}
```

--------------------------------

### Replacing Local Source with Registry Source in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/AGENTS.md

When copying examples from module documentation, replace the local source path (e.g., "../../") with the appropriate Terraform Registry source.

```terraform
source = "../../"
```

--------------------------------

### Assign Tags to Cosmos DB Resource

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Example of how to define tags for a Cosmos DB resource. These tags will propagate to child resources unless overridden.

```hcl
tags = {
  environment = "testing"
}
```

--------------------------------

### Configure Diagnostic Settings for Cosmos DB

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Example of how to configure diagnostic settings for a Cosmos DB account. This includes specifying log and metric categories, as well as destinations like Log Analytics, Storage Accounts, or Event Hubs. Ensure resource IDs are correctly formatted.

```hcl
diagnostic_settings = {
  diagnostic1 = {
    event_hub_name                           = "hub-name"
    log_analytics_destination_type           = "Dedicated"
    name                                     = "diagnostics"
    event_hub_authorization_rule_resource_id = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.EventHub/namespaces/{eventHubNamespaceName}/authorizationRules/{authorizationRuleName}"

    #log_categories = ["DataPlaneRequests", "MongoRequests", "CassandraRequests",  "GremlinRequests", "QueryRuntimeStatistics", "PartitionKeyStatistics", "PartitionKeyRUConsumption", "ControlPlaneRequests",  "TableApiRequests"]

    metric_categories           = ["AllMetrics"]
    log_groups                  = ["allLogs", "audit"]
    workspace_resource_id       = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}"
    storage_account_resource_id = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}"
  }
}
```

--------------------------------

### Terraform Configuration for Gremlin API

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/gremlin/README.md

This configuration sets up the necessary Terraform providers and modules, defines resource groups, and configures a Cosmos DB account with the Gremlin API enabled. It includes examples of creating databases and graphs with various settings like autoscale, fixed throughput, TTL, analytical storage, partition keys, index policies, conflict resolution, and unique keys.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

locals {
  prefix = "gremlin"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = "0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "spaincentral"
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "cosmos" {
  source = "../../"

  location                   = azurerm_resource_group.example.location
  name                       = "${module.naming.cosmosdb_account.name_unique}-${local.prefix}"
  resource_group_name        = azurerm_resource_group.example.name
  analytical_storage_enabled = true
  capabilities = [{
    name = "EnableGremlin"
  }]
  gremlin_databases = {
    empty_database = {
      name       = "empty_database"
      throughput = 400
    }

    database_autoscale_throughput = {
      name = "database_autoscale_throughput"

      autoscale_settings = {
        max_throughput = 4000
      }
    }

    database_with_fixed_throughput = {
      name       = "database_with_fixed_throughput"
      throughput = 400
    }

    database_with_graphs = {
      name       = "database_with_graphs"
      throughput = 400

      graphs = {
        "graph_fixed_throughput" = {
          name               = "graph_fixed_throughput"
          partition_key_path = "/partitionKey"
          throughput         = 400
        }

        "graph_autoscale" = {
          name               = "graph_autoscale"
          partition_key_path = "/partitionKey"

          autoscale_settings = {
            max_throughput = 4000
          }
        }

        "graph_with_ttl" = {
          name               = "graph_with_ttl"
          partition_key_path = "/partitionKey"
          default_ttl        = 3600
        }

        "graph_with_analytical_storage" = {
          name                   = "graph_with_analytical_storage"
          partition_key_path     = "/partitionKey"
          analytical_storage_ttl = -1
        }

        "graph_with_partition_key_v2" = {
          name                  = "graph_with_partition_key_v2"
          partition_key_path    = "/largePartitionKey"
          partition_key_version = "2"
        }

        "graph_with_index_policy" = {
          name               = "graph_with_index_policy"
          partition_key_path = "/partitionKey"

          index_policy = {
            automatic      = true
            indexing_mode  = "consistent"
            included_paths = ["/", "/included/*"]
            excluded_paths = ["/excluded/*"]

            composite_index = [
              {
                index = [
                  {
                    path  = "/name"
                    order = "Ascending"
                  },
                  {
                    path  = "/age"
                    order = "Descending"
                  }
                ]
              }
            ]

            spatial_index = [
              {
                path = "/location/*"
              }
            ]
          }
        }

        "graph_with_conflict_resolution" = {
          name               = "graph_with_conflict_resolution"
          partition_key_path = "/partitionKey"

          conflict_resolution_policy = {
            mode                     = "LastWriterWins"
            conflict_resolution_path = "/_ts"
          }
        }

        "graph_with_unique_key" = {
          name               = "graph_with_unique_key"
          partition_key_path = "/partitionKey"

          unique_key = {
            paths = ["/uniqueField"]
          }
        }
      }
    }
  }
}
```

--------------------------------

### Terraform Configuration for Max Example

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/max-account/README.md

This Terraform configuration deploys an Azure DocumentDB Database Account with extensive settings. It includes provider requirements, resource group, log analytics workspace, and the main cosmosdb module with various options enabled.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "max"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = "0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "northeurope"
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

resource "azurerm_log_analytics_workspace" "example" {
  location            = azurerm_resource_group.example.location
  name                = module.naming.log_analytics_workspace.name_unique
  resource_group_name = azurerm_resource_group.example.name
  retention_in_days   = 30
  sku                 = "PerGB2018"
}

module "cosmos" {
  source = "../../"

  location                           = azurerm_resource_group.example.location
  name                               = "${module.naming.cosmosdb_account.name_unique}-${local.prefix}"
  resource_group_name                = azurerm_resource_group.example.name
  access_key_metadata_writes_enabled = true
  analytical_storage_config = {
    schema_type = "WellDefined"
  }
  analytical_storage_enabled = true
  automatic_failover_enabled = false
  backup = {
    retention_in_hours  = 8
    interval_in_minutes = 1440
    storage_redundancy  = "Geo"
    type                = "Periodic"
  }
  capacity = {
    total_throughput_limit = 10000
  }
  consistency_policy = {
    consistency_level = "Session"
  }
  cors_rule = {
    max_age_in_seconds = 3600
    allowed_origins    = ["*"]
    exposed_headers    = ["*"]
    allowed_headers    = ["Authorization"]
    allowed_methods    = ["GET", "POST", "PUT"]
  }
  diagnostic_settings = {
    cosmosdb = {
      name                  = "diag"
      workspace_resource_id = azurerm_log_analytics_workspace.example.id
      metric_categories     = ["SLI", "Requests"]
    }
  }
  enable_telemetry = false
  geo_locations = [
    {
      failover_priority = 0
      zone_redundant    = false
      location          = azurerm_resource_group.example.location
    }
  ]
  local_authentication_disabled = false
  lock = {
    kind = "CanNotDelete"
    name = "Testing name CanNotDelete"
  }
  multiple_write_locations_enabled = true
  partition_merge_enabled          = false
  public_network_access_enabled    = false
  role_assignments = {
    key = {
      skip_service_principal_aad_check = false
      role_definition_id_or_name       = "Contributor"
      description                      = "This is a test role assignment"
      principal_id                     = data.azurerm_client_config.current.object_id
    }
  }
  tags = {
    environment = "testing"
    department  = "engineering"
  }
}

```

--------------------------------

### Using Pessimistic Constraints for Providers in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/AGENTS.md

For providers, it is recommended to use pessimistic version constraints to ensure compatibility and avoid unexpected upgrades. This example shows the syntax.

```terraform
version = "~> 1.0"
```

--------------------------------

### Configure Gremlin Databases and Graphs in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Example of defining Gremlin databases and their associated graphs within an Azure Cosmos DB account using Terraform. Includes settings for name, throughput, partition key, TTL, and autoscale.

```hcl
gremlin_databases = {
  "database_name" = {
    name = "database_gremlin"
    throughput = 400

    graphs = {
      "graph" = {
        name = "graph"
        partition_key_path = "/myPartitionKey"
        partition_key_version = "1"
        throughput = 400
        default_ttl = 3600
        analytical_storage_ttl = -1
        autoscale_settings = {
          max_throughput = 1000
        }
      }
    }
  }
}
```

--------------------------------

### Pinning AVM Module Version in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/AGENTS.md

When using AVM modules, it's crucial to pin to a specific version for predictable deployments. This example shows how to specify the version.

```terraform
version = "1.2.3"
```

--------------------------------

### Terraform Configuration for Private Endpoint Example

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/private-endpoints-unmanaged-dns-records/README.md

This HCL code block defines the Terraform configuration, including required providers and resources for deploying Azure Cosmos DB with private endpoints. It sets up networking, private DNS zones, and the Cosmos DB module itself, with public network access disabled and DNS zone management turned off.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "pe-umg"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = "0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "spaincentral"
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

resource "azurerm_virtual_network" "example" {
  location            = azurerm_resource_group.example.location
  name                = "${module.naming.virtual_network.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_subnet" "example" {
  address_prefixes     = ["10.0.0.0/24"]
  name                 = module.naming.subnet.name_unique
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
}

resource "azurerm_private_dns_zone" "example" {
  name                = "privatelink.documents.azure.com"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "private_links" {
  name                  = "vnet-link"
  private_dns_zone_name = azurerm_private_dns_zone.example.name
  resource_group_name   = azurerm_resource_group.example.name
  virtual_network_id    = azurerm_virtual_network.example.id
}

resource "azurerm_application_security_group" "example" {
  location            = azurerm_resource_group.example.location
  name                = "tf-appsecuritygroup-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
}

module "cosmos" {
  source = "../../"

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.cosmosdb_account.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  private_endpoints = {
    max = {
      name                            = "max"
      subresource_name                = "SQL"
      network_interface_name          = "max_nic1"
      private_dns_zone_group_name     = "max_dns_group"
      private_service_connection_name = "max_connection"
      subnet_resource_id              = azurerm_subnet.example.id
      private_dns_zone_resource_ids   = [azurerm_private_dns_zone.example.id]

      role_assignments = {
        key = {
          role_definition_id_or_name = "Contributor"
          description                = "This is a test role assignment"
          principal_id               = data.azurerm_client_config.current.object_id
        }
      }

      lock = {
        kind = "CanNotDelete"
        name = "Testing name CanNotDelete"
      }

      tags = {
        environment = "testing"
        department  = "engineering"
      }

      application_security_group_associations = {
        asg1 = azurerm_application_security_group.example.id
      }
    }

    noDnsGroup = {
      name               = "no-dns-group"
      subresource_name   = "SQL"
      subnet_resource_id = azurerm_subnet.example.id
    }

    withDnsGroup = {
      name                          = "with-dns-group"
      subresource_name              = "SQL"
      subnet_resource_id            = azurerm_subnet.example.id
      private_dns_zone_resource_ids = [azurerm_private_dns_zone.example.id]
    }
  }
  private_endpoints_manage_dns_zone_group = false
  public_network_access_enabled           = false
}
```

--------------------------------

### Configure Periodic Backup

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Set up periodic backups with specified storage redundancy, interval, and retention period. Ensure the interval is between 60 and 1440 minutes, and retention is between 8 and 720 hours.

```hcl
backup = {
  type                = "Periodic"
  storage_redundancy  = "Geo"
  interval_in_minutes = 240
  retention_in_hours  = 8
}
```

--------------------------------

### Configure Cosmos DB Account with Containers

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/sql/README.md

Defines a Cosmos DB SQL API account with multiple containers, each having specific configurations like partition keys and indexing policies.

```terraform
resource "azurerm_resource_group" "rg" {
  name     = "rg-cosmosdb-example"
  location = "West Europe"
}

resource "azurerm_cosmosdb_account" "example" {
  name                = "cosmosdb-account-example"
  location            = azurermerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  offer_type             = "Standard"
  kind                   = "GlobalDocumentDB"

  capabilities {
    name = "EnableServerless"
  }

  capabilities {
    name = "EnableFreeTier"
  }

  analytical_storage_mode = "Default"

  identity {
    type = "SystemAssigned"
  }

  backup_policy {
    type = "Periodic"

    periodic_mode_properties {
      backup_interval_in_minutes = 60
      backup_retention_in_hours  = 8
    }
  }

  consistency_policy {
    consistency_level = "BoundedStaleness"
    max_staleness_prefix = 10
    max_interval_in_seconds = 300
  }

  geo_location {
    location          = "West US"
    failover_priority = 0
  }

  geo_location {
    location          = "East US"
    failover_priority = 1
  }

  tags = {
    environment = "dev"
  }
}

resource "azurerm_cosmosdb_sql_container" "example" {
  name                  = "container_with_functions"
  database_name         = azurerm_cosmosdb_account.example.name
  resource_group_name   = azurerm_resource_group.rg.name
  partition_key_path    = "/id"
  throughput              = 400

  indexing_policy = jsonencode({
    indexingMode = "consistent"
    automatic    = true
    includedPaths = [
      {
        path = "/path1/?"
      },
      {
        path = "/path2"
      }
    ]
    excludedPaths = [
      {
        path = "/path3/_all"
      }
    ]
  })

  conflict_resolution_policy {
    mode = "LastWriterWins"
    path = "/_ts"
  }

  unique_key {
    paths = ["/uniqueKey1", "/uniqueKey2"]
  }
}

resource "azurerm_cosmosdb_sql_container" "container_with_stored_procedures" {
  name                = "container_with_stored_procedures"
  database_name       = azurerm_cosmosdb_account.example.name
  resource_group_name = azurerm_resource_group.rg.name
  partition_key_paths = ["/id"]

  stored_procedures = {
    empty = {
      name = "empty"
      body = <<BODY
        function empty() { }
      BODY
    }
  }
}

resource "azurerm_cosmosdb_sql_container" "container_with_triggers" {
  name                = "container_with_triggers"
  database_name       = azurerm_cosmosdb_account.example.name
  resource_group_name = azurerm_resource_group.rg.name
  partition_key_paths = ["/id"]

  triggers = {
    testTrigger = {
      name      = "testTrigger"
      body      = "function testTrigger(){}"
      operation = "Delete"
      type      = "Post"
    }
  }
}

resource "azurerm_cosmosdb_sql_container" "container_with_none_index_policy" {
  name                = "container_with_none_index_policy"
  database_name       = azurerm_cosmosdb_account.example.name
  resource_group_name = azurerm_resource_group.rg.name
  partition_key_paths = ["/id"]

  indexing_policy = {
    indexing_mode = "none"
  }
}

resource "azurerm_cosmosdb_sql_container" "container_with_consistent_index_policy" {
  name                = "container_with_consistent_index_policy"
  database_name       = azurerm_cosmosdb_account.example.name
  resource_group_name = azurerm_resource_group.rg.name
  partition_key_paths = ["/id"]

  indexing_policy = {
    indexing_mode = "consistent"

    included_paths = [
      {
        path = "/hola/?"
      }
    ]
    excluded_paths = [
      {
        path = "/*"
      }
    ]
    spatial_indexes = [
      {
        path = "/field2/?"
      }
    ]
    composite_indexes = [
      {
        indexes = [
          {
            path  = "/field3"
            order = "Ascending"
          },
          {
            path  = "/field4"
            order = "Descending"
          }
        ]
      }
    ]
  }
}

resource "azurerm_cosmosdb_sql_dedicated_gateway" "sql_dedicated_gateway" {
  cosmosdb_account_id = azurerm_cosmosdb_account.example.id
  instance_count      = 1
  instance_size       = "Cosmos.D4s"
}

```

--------------------------------

### Configure Minimal TLS Version for Cosmos DB

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Set the minimum allowed TLS version for the Cosmos DB account. Only 'Tls12' is supported.

```hcl
minimal_tls_version = "Tls12"
```

--------------------------------

### Configure Cosmos DB Firewall Rules

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Specify IP addresses or ranges for allowed client access. To enable Azure portal access, include the IPs from the documentation. To allow access from public Azure datacenters, add '0.0.0.0'.

```hcl
ip_range_filter = [
  "192.168.1.1",
  "10.0.0.0/8",
  "0.0.0.0"
]
```

--------------------------------

### Configure Analytical Storage

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Set the schema type for analytical storage. Use 'WellDefined' for a predefined schema or 'FullFidelity' for a schema that mirrors the NoSQL data.

```hcl
analytical_storage_config = {
  schema_type = "WellDefined"
}
```

--------------------------------

### Terraform Configuration for Default Cosmos DB Account

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/default/README.md

This configuration sets up the necessary Terraform providers, defines local variables, and calls helper modules for naming and regions. It then creates a resource group and deploys the Cosmos DB account module within it. Ensure Terraform version 1.9+ and AzureRM provider version 4.0+ are used.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

locals {
  prefix = "default"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = "0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "spaincentral"
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "cosmos" {
  source = "../../"

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.cosmosdb_account.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
}
```

--------------------------------

### Configure Continuous Backup

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Enable continuous backup for the Cosmos DB account, specifying the retention tier. 'Continuous30Days' is the default and recommended tier.

```hcl
backup = {
  type = "Continuous"
  tier = "Continuous30Days"
}
```

--------------------------------

### Configure Customer-Managed Key for DocumentDB

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Sets up a customer-managed key for encryption of a CosmosDB account. Requires specifying the key name, key vault resource ID, and a user-assigned identity with appropriate permissions. Ensure the Key Vault has soft delete and purge protection enabled.

```hcl
customer_managed_key = {
    key_name               = "sample-customer-key"
    key_vault_resource_id  = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{keyVaultName}"
    
    user_assigned_identity {
      resource_id = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managedIdentityName}"
    }
  }
```

--------------------------------

### Configure SQL Databases and Containers in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Use this snippet to define SQL databases and their associated containers, including partition keys, throughput, TTL, unique keys, functions, stored procedures, triggers, conflict resolution, and indexing policies.

```hcl
sql_databases = {
  database1 = {
    name       = "database1"
    throughput = 400

    # autoscale_settings = {
    #   max_throughput = 4000
    # }

    containers = {
      container1 = {
        partition_key_paths = ["/id"]
        name               = "container1"
        throughput         = 400
        default_ttl        = 1000
        analytical_storage_ttl = 1000

        unique_keys = [
          {
            paths = ["/field1", "/field2"]
          }
        ]

        # autoscale_settings = {
        #   max_throughput = 4000
        # }

        functions = {
          function1 = {
            name = "functionName"
            body = "function function1() { }"
          }
        }

        stored_procedures = {
          stored1 = {
            name = "storedName"
            body = "function stored1() { }"
          }
        }

        triggers = {
          trigger1 = {
            name      = "triggerName"
            body      = "function trigger1() { }"
            type      = "Pre"
            operation = "All"
          }
        }

        conflict_resolution_policy = {
          mode                     = "LastWriterWins"
          conflict_resolution_path = "/customProperty"
        }

        indexing_policy = {
          indexing_mode = "consistent"

          included_paths = [
            {
              path = "/*"
            }
          ]

          excluded_paths = [
            {
              path = "/excluded/*"
            }
          ]

          composite_indexes = [
            {
              indexes = [
                {
                  path  = "/field1"
                  order = "ascending"
                }
              ]
            }
          ]

          spatial_indexes = [
            {
              path = "/location/*"
            }
          ]
        }
      }
    }
  }
}
```

--------------------------------

### Configure SQL Dedicated Gateway for Cosmos DB

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Use this configuration to manage a SQL Dedicated Gateway within a Cosmos DB Account. Specify instance size and count. Changing these values will force a new resource to be created.

```hcl
sql_dedicated_gateway = {
  instance_count = 1
  instance_size  = "Cosmos.D4s"
}
```

--------------------------------

### Configure SQL Databases for DocumentDB Account

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Defines the properties for SQL databases within an Azure DocumentDB account, including indexing modes, included/excluded paths, composite indexes, and spatial indexes. Ensure correct syntax for path definitions.

```terraform
indexing_mode = string

included_paths = optional(set(object({
  path = string
})), [])

excluded_paths = optional(set(object({
  path = string
})), [])

composite_indexes = optional(set(object({
  indexes = set(object({
    path  = string
    order = string
  }))
})), [])

spatial_indexes = optional(set(object({
  path = string
})), [])
      }), null)

    })
  }))
```

Default: `{}`
```

--------------------------------

### Configure Role Assignments for Cosmos DB

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Use this block to define role assignments for principals on the Cosmos DB account. Ensure `principal_id` and `role_definition_id_or_name` are provided. The `skip_service_principal_aad_check` should only be set to true when assigning roles to a service principal.

```hcl
role_assignments = {
  "key" = {
    skip_service_principal_aad_check = false
    role_definition_id_or_name       = "Contributor"
    description                      = "This is a test role assignment"
    principal_id                     = "eb5260bd-41f3-4019-9e03-606a617aec13"
  }
}
```

--------------------------------

### Terraform Configuration for Mongo API

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/mongo/README.md

This Terraform configuration sets up Azure resources including resource groups, and configures a Cosmos DB account with the Mongo API. It demonstrates defining databases and collections with different throughput and indexing options.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

locals {
  prefix = "mongo"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = "0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "spaincentral"
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "cosmos" {
  source = "../../"

  location                   = azurerm_resource_group.example.location
  name                       = "${module.naming.cosmosdb_account.name_unique}-${local.prefix}"
  resource_group_name        = azurerm_resource_group.example.name
  analytical_storage_enabled = true
  mongo_databases = {
    empty_database = {
      name       = "empty_database"
      throughput = 400
    }

    database_autoscale_througput = {
      name = "database_autoscale_througput"

      autoscale_settings = {
        max_throughput = 4000
      }
    }

    database_with_fixed_throughput = {
      name       = "database_with_fixed_throughput"
      throughput = 400
    }

    database_with_collections = {
      name       = "database_with_collections"
      throughput = 400

      collections = {
        "collection_fixed_throughput" = {
          name       = "collection_fixed_throughput"
          throughput = 400
        }

        "collection_autoscale" = {
          name = "collection_autoscale"

          autoscale_settings = {
            max_throughput = 4000
          }
        }

        "collections_with_ttl" = {
          name                = "collections_with_ttl"
          default_ttl_seconds = 3600
        }

        "collections_custom_shard_key" = {
          name      = "collections_custom_shard_key"
          shard_key = "_id"
        }

        "collections_index_keys_unique_false" = {
          name = "collections_index_keys_unique_false"

          index = {
            keys   = ["testproperty"]
            unique = false
          }
        }

        "collections_index_keys_unique_true" = {
          name = "collections_index_keys_unique_true"

          index = {
            keys   = ["testproperty"]
            unique = true
          }
        }
      }
    }
  }
  mongo_server_version = "3.6"
}

```

--------------------------------

### Enable a Specific Capability

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Enable a specific capability for the Cosmos DB account, such as 'DisableRateLimitingResponses'. Refer to the documentation for a full list of available capabilities.

```hcl
capabilities = [
  {
    name = "DisableRateLimitingResponses"
  }
]
```

--------------------------------

### Set Total Throughput Limit

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Configure a limit on the total throughput for the Cosmos DB account. A value of -1 indicates no limit.

```hcl
capacity = {
  total_throughput_limit = -1
}
```

--------------------------------

### Configure Geo-Locations for DocumentDB Database Account

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Use this block to specify replication regions for your CosmosDB Account. Set `failover_priority` to 0 for the primary write region. Defaults to `true` for `zone_redundant`.

```hcl
geo_locations = [
  {
    location          = "eastus"
    failover_priority = 0
    zone_redundant    = true
  },
  {
    location          = "westus"
    failover_priority = 1
    zone_redundant    = true
  }
]
```

--------------------------------

### Configure Cosmos DB Local Authentication

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Disable local authentication to enforce exclusive use of MSI and AAD. This setting is ignored for non-SQL API accounts and can only be set for SQL API accounts.

```hcl
local_authentication_disabled = false
```

--------------------------------

### Terraform Versions API Endpoint

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/AGENTS.md

This URL format is used to query the Versions API for AVM modules, typically for checking available versions.

```terraform
https://registry.terraform.io/v1/modules/Azure/{module}/[azurerm|azure]/versions
```

--------------------------------

### Terraform Configuration for CMK Cosmos DB

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/cmk-pin-key-version/README.md

This Terraform configuration sets up a Cosmos DB account with a customer-managed key. It includes provider requirements, resource group, Key Vault, user-assigned identity, and the Cosmos DB module itself. Ensure Key Vault RBAC is configured before key operations.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.12"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "cmk-pin"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = "0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "spaincentral"
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

resource "azurerm_user_assigned_identity" "example" {
  location            = azurerm_resource_group.example.location
  name                = "example-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_key_vault" "example" {
  location                   = azurerm_resource_group.example.location
  name                       = "${module.naming.key_vault.name_unique}${local.prefix}"
  resource_group_name        = azurerm_resource_group.example.name
  sku_name                   = "standard"
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  enable_rbac_authorization  = true
  purge_protection_enabled   = true
  soft_delete_retention_days = 7
}

resource "azurerm_key_vault_key" "example" {
  key_opts = [
    "wrapKey",
    "unwrapKey"
  ]
  key_type     = "RSA"
  key_vault_id = azurerm_key_vault.example.id
  name         = "customermanagedkey"
  key_size     = 4096

  depends_on = [time_sleep.wait_for_rbac_before_key_operations]
}

resource "azurerm_role_assignment" "crypto_officer" {
  principal_id         = data.azurerm_client_config.current.object_id
  scope                = azurerm_key_vault.example.id
  role_definition_name = "Key Vault Crypto Officer"
}

resource "azurerm_role_assignment" "crypto_service_encryption_user" {
  principal_id         = azurerm_user_assigned_identity.example.principal_id
  scope                = azurerm_key_vault.example.id
  role_definition_name = "Key Vault Crypto Service Encryption User"
}

time_sleep "wait_for_rbac_before_key_operations" {
  create_duration = "90s"

  depends_on = [azurerm_role_assignment.crypto_officer, azurerm_role_assignment.crypto_service_encryption_user]
}

module "cosmos" {
  source = "../../"

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.cosmosdb_account.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  customer_managed_key = {
    key_vault_resource_id = azurerm_key_vault.example.id
    key_name              = azurerm_key_vault_key.example.name

    user_assigned_identity = {
      resource_id = azurerm_user_assigned_identity.example.id
    }
  }
  managed_identities = {
    user_assigned_resource_ids = [azurerm_user_assigned_identity.example.id]
  }

  depends_on = [time_sleep.wait_for_rbac_before_key_operations]
}

```

--------------------------------

### Configure DocumentDB Consistency Policy

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/README.md

Defines the consistency policy for a CosmosDB account. Use when specific consistency levels like BoundedStaleness are required. Ensure max_interval_in_seconds is within the 5-86400 range and max_staleness_prefix is within 10-2147483647.

```hcl
consistency_policy = {
    consistency_level       = "BoundedStaleness"
    max_interval_in_seconds = 10
    max_interval_in_seconds = 100
  }
```

--------------------------------

### Terraform Configuration for Serverless Cosmos DB

Source: https://github.com/azure/terraform-azurerm-avm-res-documentdb-databaseaccount/blob/main/examples/serverless/README.md

This HCL code defines the Terraform configuration, including provider requirements, local variables, and resource definitions for deploying a serverless Cosmos DB account. It leverages Azure modules for resource group and naming.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

locals {
  prefix = "less"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = "0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "spaincentral"
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "cosmos" {
  source = "../../"

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.cosmosdb_account.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  capabilities = [
    {
      name = "EnableServerless"
    }
  ]
}

```