### File Organization Structure

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/INDEX.md

This example displays the directory structure for the documentation files related to the Logic App workflow module.

```bash
output/
├── INDEX.md                                 # This file
├── 01-module-overview.md
├── 02-configuration.md
├── 03-resource-definitions.md
├── 04-usage-examples.md
├── 05-terraform-syntax-reference.md
├── 06-validation-and-constraints.md
├── 07-locals-and-telemetry.md
├── 08-outputs-and-integration.md
└── 09-quick-reference.md
```

--------------------------------

### Example Telemetry User-Agent Header

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/07-locals-and-telemetry.md

An example of the User-Agent header format used for telemetry, including the random ID and module source/version information.

```text
User-Agent: avm=true random_id=f47ac10b-58cc-4372-a567-0e02b2c3d479 avm_module_source=registry.terraform.io/Azure/avm-res-logic-workflow/azurerm avm_module_version=1.0.0
```

--------------------------------

### Example Valid Diagnostic Settings Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/06-validation-and-constraints.md

Demonstrates a valid configuration for diagnostic settings, specifying a Log Analytics workspace as the destination.

```hcl
diagnostic_settings = {
  primary = {
    # At least ONE of these must be set:
    workspace_resource_id = azurerm_log_analytics_workspace.example.id
    # storage_account_resource_id = ...
    # event_hub_authorization_rule_resource_id = ...
    # marketplace_partner_resource_id = ...
  }
}
```

--------------------------------

### Reference Logic App Details in Output

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

An example of creating a custom output object that includes specific details like ID, name, and location from the 'resource' output.

```hcl
output "workflow_details" {
  value = {
    id   = module.logic_app.resource.id
    name = module.logic_app.resource.name
    location = module.logic_app.resource.location
  }
}
```

--------------------------------

### Minimal Logic App Workflow Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/MANIFEST.txt

This example shows the most basic configuration to deploy an Azure Logic App workflow. It serves as a baseline for further customization.

```terraform
module "logic_app_workflow" {
  source = "git::https://github.com/Azure/terraform-azurerm-avm-res-logic-workflow.git"

  # Required variables
  name                = "my-logic-app-workflow"
  resource_group_name = "my-resource-group"
  location            = "eastus"
  workflow_name       = "my-workflow"

  tags = {
    environment = "dev"
    provisioner = "terraform"
  }
}
```

--------------------------------

### Complete Production Deployment of Logic App Workflow

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/MANIFEST.txt

This example demonstrates a comprehensive production-ready deployment of an Azure Logic App workflow, incorporating all relevant configurations for security, monitoring, and scalability. It serves as a template for robust deployments.

```terraform
module "logic_app_workflow" {
  source = "git::https://github.com/Azure/terraform-azurerm-avm-res-logic-workflow.git"

  # Required variables
  name                = "my-logic-app-workflow"
  resource_group_name = "my-resource-group"
  location            = "eastus"
  workflow_name       = "my-workflow"

  # Optional variables
  definition = {
    "$schema" = "https://schema.management.azure.com/providers/Microsoft.Logic/stable/ 2019-05-01/workflowdefinition.json"
    content   = {
      "actions" = {
        "Respond_a_HTTP_request"
          = {
          "inputs" = {
            "body" = {
              "message" = "Hello, world!"
            }
            "method" = "POST"
            "uri" = "@{triggerBody()}"
          }
          "kind" = "Http"
          "type" = "Response"
        }
      }
      "contentVersion" = "1.0.0.0"
      "outputs"      = {}
      "triggers" = {
        "When_a_HTTP_request_is_received"
          = {
          "inputs" = {
            "method" = "GET"
            "schema" = {}
          }
          "kind" = "Http"
          "type" = "Request"
        }
      }
    }
  }
  parameters = {
    "myParameter" = {
      "value" = "myValue"
    }
  }
  identity = {
    type = "SystemAssigned"
  }
  diagnostic_settings = [
    {
      name                       = "my-diagnostic-setting"
      log_analytics_workspace_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.OperationalInsights/workspaces/my-workspace"
      log_categories             = ["WorkflowRuntime", "HTTPLogs"]
      metric_categories          = ["Transactions"]
    }
  ]
  role_assignments = [
    {
      role_definition_id = "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleDefinitions/YOUR_ROLE_DEFINITION_ID"
      principal_id         = "00000000-0000-0000-0000-000000000000"
    }
  ]
  management_lock = {
    kind = "CanNotDelete"
  }
  encryption = {
    key_vault {
      key_name    = "my-key"
      key_version = "1.0.0"
      key_uri     = "https://my-key-vault.vault.azure.net/keys/my-key/1.0.0"
    }
  }

  tags = {
    environment = "prod"
    provisioner = "terraform"
  }
}
```

--------------------------------

### Telemetry Header for Forks

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/07-locals-and-telemetry.md

An example of the User-Agent header format when the module is forked, indicating `fork_avm=true` along with the random ID.

```text
User-Agent: fork_avm=true random_id=f47ac10b-58cc-4372-a567-0e02b2c3d479
```

--------------------------------

### Example: Telemetry Headers When Fork Detected

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/07-locals-and-telemetry.md

If the module is detected as a fork (indicated by `local.fork_avm`), only the `fork_avm` and a generated `random_id` are included in the telemetry headers.

```hcl
avm_azapi_headers = {
  fork_avm  = "true"
  random_id = "{uuid}"
}
```

--------------------------------

### Iterate Over Role Assignments with For Each Meta-Argument

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

This example demonstrates using the 'for_each' meta-argument to iterate over a map or set of role assignments. It shows how to access the key ('each.key') and value ('each.value') within the loop.

```hcl
for_each = var.role_assignments  # Map or set
```

--------------------------------

### Example: Telemetry Headers for Official AVM Module

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/07-locals-and-telemetry.md

For official AVM modules, this configuration includes `avm=true`, a unique `random_id`, the `avm_module_source`, and `avm_module_version` in the telemetry headers.

```hcl
avm_azapi_headers = {
  avm                = "true"
  random_id          = "{uuid}"
  avm_module_source  = "registry.terraform.io/Azure/avm-res-logic-workflow/azurerm"
  avm_module_version = "1.0.0"
}
```

--------------------------------

### Conditionally Create Resource with Count Meta-Argument

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

This example shows how to conditionally create a resource using the 'count' meta-argument. The resource is only created if the 'lock' variable is not null.

```hcl
count = var.lock != null ? 1 : 0
```

--------------------------------

### Logic App Workflow Definition Example

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/README.md

This JSON defines the structure of a Logic App workflow, including actions, content version, outputs, parameters, and triggers. It's used as input for the logic_app_definition variable.

```json
{
  "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
  "actions": {},
  "contentVersion": "1.0.0.0",
  "outputs": {},
  "parameters": {},
  "triggers": {}
}
```

--------------------------------

### Example: Telemetry Headers When Telemetry Disabled

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/07-locals-and-telemetry.md

When telemetry is explicitly disabled via `var.enable_telemetry`, this local variable results in an empty map, ensuring no telemetry headers are sent.

```hcl
avm_azapi_headers = {}  # No headers
```

--------------------------------

### Get Azure Client Configuration for Telemetry

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/07-locals-and-telemetry.md

A data source that conditionally fetches the Azure client configuration (subscription ID, tenant ID) when telemetry is enabled. It uses `count` for conditional creation and `one()` for accessing the result.

```hcl
data "azapi_client_config" "telemetry" {
  count = var.enable_telemetry ? 1 : 0
}
```

--------------------------------

### Invoke Logic App Module (Minimal Configuration)

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/09-quick-reference.md

This is the most basic configuration for the logic app module, using only required variables.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = var.location
  name                = var.name
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name
}
```

--------------------------------

### Minimal Logic App Deployment

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

Deploys a basic Logic App with a default empty workflow. Ensure Terraform, azurerm, and azapi providers are configured.

```hcl
terraform {
  required_version = ">= 1.9"
  
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  location = "eastus"
  name     = "rg-logic-app-demo"
}

module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-basic"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name
}

output "workflow_id" {
  value = module.logic_app.resource_id
}
```

--------------------------------

### Query Logic App State via CLI

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

Uses a `local-exec` provisioner to query the current state of a Logic App using the Azure CLI. This is useful for post-deployment verification or automation scripts.

```hcl
resource "null_resource" "get_workflow_details" {
  provisioner "local-exec" {
    command = "az rest --uri ${module.logic_app.resource_id}?api-version=2019-05-01 --query properties.state"
  }
}
```

--------------------------------

### Module Architecture Overview

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/01-module-overview.md

Illustrates the flow of resource creation and dependencies within the Logic App Workflow module, from input variables to module outputs.

```terraform
Module Input Variables
        ↓
Local Variables (telemetry header, role definition regex)
        ↓
Primary Resource Creation
    - azapi_resource.this (Logic App Workflow)
    - Managed Identity Configuration (dynamic block)
        ↓
Supporting Resources (conditional)
    - azurerm_management_lock.this (if lock specified)
    - azurerm_role_assignment.this (for each role assignment)
    - azurerm_monitor_diagnostic_setting.this (for each diagnostic setting)
        ↓
Telemetry (if enabled)
    - modtm_telemetry.telemetry
        ↓
Module Outputs
    - resource (full azapi_resource object)
    - resource_id (Logic App resource ID)
```

--------------------------------

### Example Terraform Validation Error for Workflow State

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/06-validation-and-constraints.md

Illustrates a typical error message generated by Terraform when an invalid state value is provided for a Logic App workflow variable.

```hcl
Error: Invalid state configuration

  on variables.tf line 224, in variable "state":
  224:    error_message = "The state. - NotSpecified, Completed, Enabled, Disabled, Deleted, Suspended."

The given value is not valid. State must be one of the predefined values.
Provided state "Paused" is not a valid Logic App workflow state.
```

--------------------------------

### Define 'resource' Output

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

This output provides the full configuration and state of the deployed Logic App resource.

```hcl
output "resource" {
  description = "This is the full output for the resource."
  value       = azapi_resource.this
}
```

--------------------------------

### Configure Logic App Module with Diagnostics

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/09-quick-reference.md

Sets up diagnostic settings for the logic app, directing logs and metrics to a Log Analytics workspace.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = var.location
  name                = var.name
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  diagnostic_settings = {
    logs = {
      workspace_resource_id = azurerm_log_analytics_workspace.example.id
      log_groups            = ["allLogs"]
      metric_categories     = ["AllMetrics"]
    }
  }
}
```

--------------------------------

### Nested Object Construction for API Payloads

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

Constructs a nested object structure, typically used for defining the payload of an Azure API call. This example shows a 'body' object with nested 'properties' containing 'parameters' and 'definition'.

```hcl
body = {
  properties = {
    parameters = var.workflow_parameters
    definition = var.logic_app_definition
  }
}
```

--------------------------------

### Deploy Logic App with Customer-Managed Encryption

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

This snippet demonstrates deploying a Logic App with customer-managed key encryption. It involves setting up a Key Vault, a Key Vault Key, and a user-assigned identity for access, then configuring the Logic App module to use these resources for encryption.

```hcl
resource "azurerm_key_vault" "example" {
  location            = azurerm_resource_group.example.location
  name                = "kvworkflow${random_string.key_vault_name.result}"
  resource_group_name = azurerm_resource_group.example.name
  sku_name            = "premium"
  tenant_id           = data.azurerm_client_config.current.tenant_id

  access_policy {
    object_id = data.azurerm_client_config.current.object_id
    tenant_id = data.azurerm_client_config.current.tenant_id

    key_permissions = [
      "Create",
      "Delete",
      "Get",
      "List",
      "Purge",
      "Recover",
      "UnwrapKey",
      "WrapKey",
      "GetRotationPolicy",
      "SetRotationPolicy",
    ]
  }
}

resource "azurerm_key_vault_key" "example" {
  key_vault_id = azurerm_key_vault.example.id
  name         = "key-logic-app"
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
}

resource "azurerm_user_assigned_identity" "cmk" {
  location            = azurerm_resource_group.example.location
  name                = "uai-cmk-access"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_key_vault_access_policy" "cmk" {
  key_vault_id       = azurerm_key_vault.example.id
  object_id          = azurerm_user_assigned_identity.cmk.principal_id
  tenant_id          = data.azurerm_client_config.current.tenant_id

  key_permissions = [
    "Get",
    "UnwrapKey",
    "WrapKey",
  ]
}

module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-encrypted"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  managed_identities = {
    user_assigned_resource_ids = [azurerm_user_assigned_identity.cmk.id]
  }

  customer_managed_key = {
    key_vault_resource_id = azurerm_key_vault.example.id
    key_name              = azurerm_key_vault_key.example.name
    key_version           = azurerm_key_vault_key.example.version
    user_assigned_identity = {
      resource_id = azurerm_user_assigned_identity.cmk.id
    }
  }

  logic_app_definition = jsondecode(file("${path.module}/workflow.json"))

  tags = {
    encryption = "customer-managed-key"
    compliance = "hipaa"
  }

  depends_on = [azurerm_key_vault_access_policy.cmk]
}
```

--------------------------------

### Get Module Source Information for Telemetry

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/07-locals-and-telemetry.md

A data source that conditionally retrieves the module's source path and version when telemetry is enabled. It's configured with the current module path and used for fork detection and reporting.

```hcl
data "modtm_module_source" "telemetry" {
  count = var.enable_telemetry ? 1 : 0

  module_path = path.module
}
```

--------------------------------

### Reference Logic App in Key Vault Access Policy

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

Grants access policies for a Logic App to interact with Azure Key Vault secrets, keys, or certificates. This example focuses on granting permissions to the workflow's identity.

```hcl
resource "azurerm_key_vault_access_policy" "workflow" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azurerm_client_config.current.object_id

  key_permissions    = ["Get", "List", "Decrypt"]
  secret_permissions = ["Get", "List"]

  # Note the workflow itself, not its output, but you'd use the ID from the module
}
```

--------------------------------

### Invoke Logic App Module (Minimal)

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/09-quick-reference.md

This snippet shows the basic invocation of the logic app module with required variables.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"
  
  location            = "eastus"
  name                = "workflow-name"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name
}
```

--------------------------------

### Define Logic App Workflow Definition

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/02-configuration.md

Load the complete workflow definition from a JSON file using `logic_app_definition` and `jsondecode(file(...))`. This definition includes triggers, actions, parameters, and outputs for the workflow.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"
  
  logic_app_definition = jsondecode(file("${path.module}/workflow.json"))
  # ... other variables
}
```

--------------------------------

### Configure Logic App Module with Custom Workflow Definition

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/09-quick-reference.md

Provides a custom workflow definition for the logic app by loading it from a JSON file.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = var.location
  name                = var.name
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  logic_app_definition = jsondecode(file("${path.module}/workflow.json"))
}
```

--------------------------------

### Logic App with Custom Workflow Definition

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

Deploys a Logic App with a workflow definition loaded from a JSON file. The `logic_app_definition` argument accepts a decoded JSON string.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-custom"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  # Load workflow definition from JSON file
  logic_app_definition = jsondecode(file("${path.module}/workflow-definition.json"))

  tags = {
    environment = "production"
    owner       = "integration-team"
  }
}
```

```json
{
  "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "ApiUrl": {
      "type": "String",
      "metadata": {
        "description": "Base URL for API calls"
      }
    }
  },
  "triggers": {
    "Recurrence": {
      "type": "Recurrence",
      "recurrence": {
        "frequency": "Hour",
        "interval": 1
      }
    }
  },
  "actions": {
    "CallAPI": {
      "type": "Http",
      "inputs": {
        "method": "GET",
        "uri": "@parameters('ApiUrl')/data"
      }
    }
  },
  "outputs": {}
}
```

--------------------------------

### Configure Logic App Module with Tags

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/09-quick-reference.md

Adds Azure resource tags to the logic app module for organization and management.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = var.location
  name                = var.name
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  tags = {
    environment = "production"
    owner       = "team-name"
  }
}
```

--------------------------------

### Logic App Workflow with Parameters

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/MANIFEST.txt

Configure a Logic App workflow that utilizes parameters, enabling dynamic behavior based on input values. Parameters must be defined within the workflow definition.

```terraform
module "logic_app_workflow" {
  source = "git::https://github.com/Azure/terraform-azurerm-avm-res-logic-workflow.git"

  # Required variables
  name                = "my-logic-app-workflow"
  resource_group_name = "my-resource-group"
  location            = "eastus"
  workflow_name       = "my-workflow"

  # Optional variables
  parameters = {
    "myParameter" = {
      "value" = "myValue"
    }
  }

  tags = {
    environment = "dev"
    provisioner = "terraform"
  }
}
```

--------------------------------

### Deploy Logic App with Diagnostics and Monitoring

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

This snippet shows how to enable comprehensive diagnostic logging and monitoring for a Logic App. It configures logs to be sent to both Log Analytics and Azure Storage, and sets up an alert rule for workflow execution failures.

```hcl
resource "azurerm_log_analytics_workspace" "example" {
  location            = azurerm_resource_group.example.location
  name                = "law-logic-app"
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
}

resource "azurerm_storage_account" "example" {
  account_replication_type = "LRS"
  account_tier             = "Standard"
  location                 = azurerm_resource_group.example.location
  name                     = "stlogicapp${random_string.storage_name.result}"
  resource_group_name      = azurerm_resource_group.example.name
}

module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-monitored"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  diagnostic_settings = {
    primary = {
      name                   = "diag-logs-analytics"
      workspace_resource_id  = azurerm_log_analytics_workspace.example.id
      log_groups             = ["allLogs"]
      metric_categories      = ["AllMetrics"]
    }
    
    secondary = {
      name                       = "diag-logs-storage"
      storage_account_resource_id = azurerm_storage_account.example.id
      log_categories             = ["WorkflowRuntime", "WorkflowTrigger"]
      metric_categories          = ["AllMetrics"]
    }
  }

  logic_app_definition = jsondecode(file("${path.module}/workflow.json"))

  tags = {
    monitoring = "enabled"
  }
}

# Create alert rule for workflow execution failures
resource "azurerm_monitor_metric_alert" "workflow_failures" {
  name                = "alert-workflow-failures"
  resource_group_name = azurerm_resource_group.example.name
  scopes              = [module.logic_app.resource_id]
  
  criteria {
    aggregation      = "Total"
    metric_name      = "RunsFailed"
    operator         = "GreaterThan"
    threshold        = 5
  }
}
```

--------------------------------

### Deploy Logic App with Managed Identities

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

This snippet shows how to deploy a Logic App with both system-assigned and user-assigned managed identities. It also includes granting these identities access to a Key Vault.

```hcl
resource "azurerm_user_assigned_identity" "workflow" {
  location            = azurerm_resource_group.example.location
  name                = "uai-workflow"
  resource_group_name = azurerm_resource_group.example.name
}

module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-with-identity"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  managed_identities = {
    system_assigned            = true
    user_assigned_resource_ids = [azurerm_user_assigned_identity.workflow.id]
  }

  logic_app_definition = jsondecode(file("${path.module}/workflow.json"))

  tags = {
    security = "managed-identity-enabled"
  }
}

# Grant Key Vault access to workflow identities
resource "azurerm_key_vault_access_policy" "workflow_system" {
  key_vault_id       = azurerm_key_vault.example.id
  tenant_id          = data.azurerm_client_config.current.tenant_id
  object_id          = module.logic_app.resource.identity[0].principal_id  # System-assigned
  
  key_permissions    = ["Get", "Decrypt"]
  secret_permissions = ["Get"]
}

resource "azurerm_key_vault_access_policy" "workflow_user" {
  key_vault_id       = azurerm_key_vault.example.id
  tenant_id          = data.azurerm_client_config.current.tenant_id
  object_id          = azurerm_user_assigned_identity.workflow.principal_id
  
  key_permissions    = ["Get", "Decrypt"]
  secret_permissions = ["Get"]
}
```

--------------------------------

### Minimal Logic App Workflow Deployment

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/README.md

Deploys a basic Azure Logic App workflow using the AVM module. Ensure you have an existing resource group for deployment.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = "eastus"
  name                = "workflow-name"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name
}

output "workflow_id" {
  value = module.logic_app.resource_id
}
```

--------------------------------

### Enable Diagnostics using Azure CLI and Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

This snippet demonstrates how to use a Terraform `null_resource` with a `local-exec` provisioner to call the Azure CLI. It references the Logic App workflow ID to enable diagnostic settings.

```hcl
resource "null_resource" "enable_diagnostics" {
  triggers = {
    workflow_id = module.logic_app.resource_id
  }

  provisioner "local-exec" {
    command = "az rest --uri '${self.triggers.workflow_id}/providers/Microsoft.Insights/diagnosticSettings/monitoring?api-version=2017-05-01-preview' --method GET"
  }
}
```

--------------------------------

### Minimal Logic App Workflow Deployment

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/INDEX.md

This snippet shows the basic Terraform configuration required to deploy a Logic App workflow using the azurerm and azapi providers. It includes setting up the resource group and defining the logic app module.

```hcl
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  location = "eastus"
  name     = "rg-logic-app"
}

module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "my-workflow"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name
}

output "workflow_id" {
  value = module.logic_app.resource_id
}
```

--------------------------------

### Logic App Workflow with Diagnostics and Monitoring

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/MANIFEST.txt

Configure diagnostic settings and monitoring for the Logic App workflow to track performance and troubleshoot issues. This involves setting up log analytics and event hubs.

```terraform
module "logic_app_workflow" {
  source = "git::https://github.com/Azure/terraform-azurerm-avm-res-logic-workflow.git"

  # Required variables
  name                = "my-logic-app-workflow"
  resource_group_name = "my-resource-group"
  location            = "eastus"
  workflow_name       = "my-workflow"

  # Optional variables
  diagnostic_settings = [
    {
      name                       = "my-diagnostic-setting"
      log_analytics_workspace_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.OperationalInsights/workspaces/my-workspace"
      log_categories             = ["WorkflowRuntime", "HTTPLogs"]
      metric_categories          = ["Transactions"]
    }
  ]

  tags = {
    environment = "dev"
    provisioner = "terraform"
  }
}
```

--------------------------------

### Enterprise Logic App with ISE and Integration Account

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

Deploys a Logic App for enterprise integration, specifying an Integration Service Environment (ISE) for private execution and an Integration Account for B2B scenarios. Assumes ISE and Integration Account resources already exist.

```hcl
# Assume ISE and Integration Account already exist
data "azurerm_integration_service_environment" "example" {
  name                = "ise-enterprise"
  resource_group_name = "rg-integration"
}

data "azurerm_logic_app_integration_account" "example" {
  name                = "intacc-b2b"
  resource_group_name = "rg-integration"
}

module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-enterprise"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  # Private execution in ISE
  integration_service_environment_id = data.azurerm_integration_service_environment.example.id

  # B2B integration
  integration_account_id = data.azurerm_logic_app_integration_account.example.id

  logic_app_definition = jsondecode(file("${path.module}/edi-workflow.json"))

  tags = {
    tier = "enterprise"
    sla  = "99.99"
  }
}
```

--------------------------------

### Configure Diagnostic Settings for Azure Resources

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

This snippet configures diagnostic settings for an Azure resource, allowing logs and metrics to be sent to various destinations. It uses 'for_each' to create settings for multiple configurations and dynamic blocks to specify log categories, groups, and metrics.

```hcl
resource "azurerm_monitor_diagnostic_setting" "this" {
  for_each = var.diagnostic_settings

  name                           = each.value.name != null ? each.value.name : "diag-${var.name}"
  target_resource_id             = azapi_resource.this.id
  eventhub_authorization_rule_id = each.value.event_hub_authorization_rule_resource_id
  eventhub_name                  = each.value.event_hub_name
  log_analytics_workspace_id     = each.value.workspace_resource_id
  partner_solution_id            = each.value.marketplace_partner_resource_id
  storage_account_id             = each.value.storage_account_resource_id

  dynamic "enabled_log" {
    for_each = each.value.log_categories
    content {
      category = enabled_log.value
    }
  }
  
  dynamic "enabled_log" {
    for_each = each.value.log_groups
    content {
      category_group = enabled_log.value
    }
  }
  
  dynamic "enabled_metric" {
    for_each = each.value.metric_categories
    content {
      category = enabled_metric.value
    }
  }
}
```

--------------------------------

### String Joining with Map Comprehension

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

Constructs a single string by joining elements of a map. A map comprehension is used to format each key-value pair into a string, which are then joined together with a space delimiter.

```hcl
avm_azapi_header = join(" ", [for k, v in local.avm_azapi_headers : "${k}=${v}"])
```

--------------------------------

### Multi-Entity Creation with for_each

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

Creates multiple resources based on a collection using the 'for_each' meta-argument. This is common for resources like role assignments where each item in a map or set results in a separate resource instance.

```hcl
for_each = var.role_assignments
principal_id = each.value.principal_id
scope = azapi_resource.this.id
```

--------------------------------

### Reference Output from Count Resource

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

This output block demonstrates how to reference the ID of a resource created with the 'count' meta-argument. It uses the 'try' function to safely access the first element of the resource list, returning null if it doesn't exist.

```hcl
output "lock_id" {
  value = try(azurerm_management_lock.this[0].id, null)
}
```

--------------------------------

### Conditional Resource Creation with Count

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/05-terraform-syntax-reference.md

Conditionally creates a resource by setting its 'count' meta-argument. If 'var.lock' is not null, the count is 1, creating the resource; otherwise, the count is 0, and the resource is not created.

```hcl
count = var.lock != null ? 1 : 0
lock_level = var.lock.kind
name = coalesce(var.lock.name, "lock-${var.lock.kind}")
```

--------------------------------

### Deploy Logic App with RBAC and Locking

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

This snippet shows how to deploy a Logic App with role-based access control and a resource lock to prevent accidental deletion. It configures owner, operator, and reader roles, and applies a 'CanNotDelete' lock.

```hcl
data "azurerm_client_config" "current" {}

resource "azurerm_user_assigned_identity" "admin" {
  location            = azurerm_resource_group.example.location
  name                = "uai-workflow-admin"
  resource_group_name = azurerm_resource_group.example.name
}

module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-controlled"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  role_assignments = {
    owner = {
      role_definition_name = "Logic App Contributor"
      principal_id         = data.azurerm_client_config.current.object_id
      description          = "Current user as workflow owner"
    }
    
    operator = {
      role_definition_name = "Logic App Operator"
      principal_id         = azurerm_user_assigned_identity.admin.principal_id
      principal_type       = "ServicePrincipal"
      description          = "Admin identity for workflow operations"
    }
    
    reader = {
      role_definition_name = "Reader"
      principal_id         = "00000000-0000-0000-0000-000000000000"  # Replace with actual group/user
      description          = "Audit reader"
    }
  }

  # Prevent accidental deletion in production
  lock = {
    kind = "CanNotDelete"
    name = "lock-production-workflow"
  }

  logic_app_definition = jsondecode(file("${path.module}/workflow.json"))

  state = "Enabled"

  tags = {
    environment = "production"
    protection  = "locked"
  }
}

output "workflow_id" {
  value = module.logic_app.resource_id
}

output "workflow_principal_id" {
  value       = module.logic_app.resource.identity[0].principal_id
  description = "System-assigned managed identity principal ID for granting additional permissions"
}
```

--------------------------------

### Configure Diagnostic Settings for Logging

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/02-configuration.md

Configure diagnostic settings to export logs and metrics. Specify log categories, groups, metric categories, and the desired destination (Log Analytics, Storage Account, or Event Hub).

```hcl
{
  name                                     = string         # Optional: Diagnostic setting name
  log_categories                           = set(string)    # Optional: Specific log categories
  log_groups                               = set(string)    # Optional: Log category groups
  metric_categories                        = set(string)    # Optional: Metric categories
  log_analytics_destination_type           = string         # Optional: "Dedicated" or "AzureDiagnostics"
  workspace_resource_id                    = string         # Optional: Log Analytics workspace ID
  storage_account_resource_id              = string         # Optional: Storage account ID
  event_hub_authorization_rule_resource_id = string         # Optional: Event Hub auth rule ID
  event_hub_name                           = string         # Optional: Event Hub name
  marketplace_partner_resource_id          = string         # Optional: Marketplace partner resource ID
}
```

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"
  
  diagnostic_settings = {
    primary = {
      name                   = "logic-app-diagnostics"
      workspace_resource_id  = azurerm_log_analytics_workspace.example.id
      log_groups             = ["allLogs"]
      metric_categories      = ["AllMetrics"]
    }
    secondary = {
      storage_account_resource_id = azurerm_storage_account.example.id
      log_categories              = ["WorkflowRuntime"]
    }
  }
  # ... other variables
}
```

--------------------------------

### Configure Telemetry Headers for AzAPI Resource

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/03-resource-definitions.md

Conditionally applies telemetry headers for User-Agent tracking in AzAPI resource operations. Enable telemetry via the 'enable_telemetry' variable.

```hcl
create_headers = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
delete_headers = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
read_headers   = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
update_headers = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
```

--------------------------------

### Logic App with Parameterized Workflow

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

Deploys a Logic App with parameterized triggers and actions. The `workflow_parameters` argument allows overriding default values defined in the `logic_app_definition`.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-parametrized"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  logic_app_definition = {
    "$schema" = "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#"
    contentVersion = "1.0.0.0"
    
    parameters = {
      ApiEndpoint = {
        type = "String"
        defaultValue = "https://api.example.com"
      }
      NotificationEmail = {
        type = "String"
        defaultValue = ""
      }
    }
    
    triggers = {
      Manual = {
        type = "Request"
        kind = "Http"
        inputs = {
          schema = {}
        }
      }
    }
    
    actions = {}
    outputs = {}
  }

  workflow_parameters = {
    "ApiEndpoint" = {
      type  = "String"
      value = "https://api.staging.example.com"
    }
    "NotificationEmail" = {
      type  = "String"
      value = "notifications@example.com"
    }
  }

  tags = {
    environment = "staging"
  }
}
```

--------------------------------

### Orchestrate Multiple Logic Apps with Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

Manages multiple Logic App workflows using Terraform's `for_each` meta-argument. This pattern allows for scalable deployment and management of related workflows.

```hcl
module "logic_apps" {
  for_each = var.workflows

  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = each.value.name
  resource_group_id   = azurerm_resource_group.example.resource_group_id
  resource_group_name = azurerm_resource_group.example.name

  logic_app_definition = jsondecode(file(each.value.definition_file))
}

output "workflow_ids" {
  value = { for k, v in module.logic_apps : k => v.resource_id }
}

output "workflow_resources" {
  value = { for k, v in module.logic_apps : k => v.resource }
}
```

--------------------------------

### Configure Workflow Parameters

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/02-configuration.md

Pass parameter values to the workflow definition at deployment time. These override default values and are useful for environment-specific configurations.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"
  
  workflow_parameters = {
    "WebsiteURL" = {
      type = "String"
      metadata = {
        description = "URL of website to monitor"
      }
      description = "The URL of the website to monitor."
      value       = "https://www.example.com"
    }
    "Products" = {
      type = "Array"
      metadata = {
        description = "Products to include"
      }
      description = "The products to include."
      value = [
        "ProductA",
        "ProductB"
      ]
    }
    "MaxRetries" = {
      type  = "Int"
      value = 3
    }
  }
  # ... other variables
}
```

--------------------------------

### Outputs for Logic App Workflow Module

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/INDEX.md

The module outputs include the full azapi_resource object and the ARM resource ID string for integration with other Terraform resources.

```hcl
resource    # Full azapi_resource object
resource_id # ARM resource ID string
```

--------------------------------

### Export Logic App Details to JSON Manifest

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

Generates a JSON file containing essential Logic App details like its ID, name, and location. This manifest can be used by external tools or for documentation purposes.

```hcl
resource "local_file" "deployment_manifest" {
  content = jsonencode({
    workflow_id   = module.logic_app.resource_id
    workflow_name = var.name
    location      = var.location
  })
  filename = "${path.module}/deployment-manifest.json"
}
```

--------------------------------

### Exporting Logic App Deployment Metadata

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/08-outputs-and-integration.md

Capture and export deployment metadata, including resource details, identities, and configuration settings, into JSON and Markdown files. This aids in documentation and auditing of deployed Logic Apps.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"
  # ... configuration
}

resource "local_file" "deployment_metadata" {
  content = jsonencode({
    module_version = "1.0.0"
    deployment_date = timestamp()
    resource = {
      id       = module.logic_app.resource_id
      name     = var.name
      location = var.location
      tags     = var.tags
    }
    identities = module.logic_app.resource.identity
  })
  
  filename = "${path.module}/deployment-metadata.json"
}

resource "local_file" "deployment_summary" {
  content = <<-EOT
# Logic App Deployment Summary

## Resource
- **ID:** ${module.logic_app.resource_id}
- **Name:** ${var.name}
- **Location:** ${var.location}
- **State:** ${var.state}

## Security
- **System-Assigned Identity:** ${var.managed_identities.system_assigned ? "Enabled" : "Disabled"}
- **User-Assigned Identities:** ${length(var.managed_identities.user_assigned_resource_ids)}
- **Role Assignments:** ${length(var.role_assignments)}
- **Resource Lock:** ${var.lock != null ? var.lock.kind : "None"}

## Monitoring
- **Diagnostic Settings:** ${length(var.diagnostic_settings)}
- **Telemetry:** ${var.enable_telemetry ? "Enabled" : "Disabled"}

## Integration
- **Integration Account:** ${var.integration_account_id != "" ? "Configured" : "Not configured"}
- **Integration Service Environment:** ${var.integration_service_environment_id != "" ? "Configured" : "Not configured"}
EOT

  filename = "${path.module}/DEPLOYMENT_SUMMARY.md"
}
```

--------------------------------

### Deploy Logic App with IP-based Access Control

Source: https://github.com/azure/terraform-azurerm-avm-res-logic-workflow/blob/main/_autodocs/04-usage-examples.md

This snippet demonstrates how to configure IP-based access restrictions for a Logic App. It specifies allowed IP address ranges for different access types like actions, contents, triggers, and workflow management.

```hcl
module "logic_app" {
  source = "Azure/avm-res-logic-workflow/azurerm"

  location            = azurerm_resource_group.example.location
  name                = "workflow-secured"
  resource_group_id   = azurerm_resource_group.example.id
  resource_group_name = azurerm_resource_group.example.name

  access_control = {
    actions = {
      allowedCallerIpAddresses = [
        {
          addressRange = "10.0.0.0/8"      # Internal network
        }
      ]
    }
    
    contents = {
      allowedCallerIpAddresses = [
        {
          addressRange = "10.1.0.0/16"     # Management network
        }
      ]
    }
    
    triggers = {
      allowedCallerIpAddresses = [
        {
          addressRange = "203.0.113.0/24"  # Partner IP range
        }
      ]
    }
    
    workflowManagement = {
      allowedCallerIpAddresses = [
        {
          addressRange = "10.2.0.0/16"     # Admin network
        }
      ]
    }
  }

  logic_app_definition = jsondecode(file("${path.module}/workflow.json"))

  tags = {
    security = "ip-restricted"
  }
}
```