### Terraform Module Source - GitHub Example

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/AGENTS.md

This example demonstrates how to specify the source for an AVM module hosted on GitHub. Adjust the type, service, and resource parameters as needed.

```terraform
https://github.com/Azure/terraform-azurerm-avm-{type}-{service}-{resource}
```

--------------------------------

### Terraform Module Source - Registry Example

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/AGENTS.md

This example shows the format for referencing an AVM module from the Terraform Registry. Replace placeholders with your specific module details.

```terraform
https://registry.terraform.io/modules/Azure/{module}/azurerm/latest
```

--------------------------------

### Terraform Module Source - Versions API Example

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/AGENTS.md

This example shows the URL structure for querying the Terraform Versions API for AVM modules. This can be useful for programmatic version checking.

```terraform
https://registry.terraform.io/v1/modules/Azure/{module}/[azurerm|azure]/versions
```

--------------------------------

### Configure Service Bus Namespace Topics and Subscriptions

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Example of how to configure Service Bus topics with various settings including auto-delete, message TTL, duplicate detection, and partitioning. It also demonstrates nested subscription configurations with dead-lettering and session requirements.

```hcl
topics = {
  testTopic = {
    auto_delete_on_idle                     = "P7D"
    default_message_ttl                     = "PT5M"
    duplicate_detection_history_time_window = "PT5M"
    enable_batched_operations               = true
    enable_express                          = false
    enable_partitioning                     = true
    requires_duplicate_detection            = true
    max_message_size_in_kilobytes           = 1024
    max_size_in_megabytes                   = 1024
    status                                  = "Active"
    support_ordering                        = true

    subscriptions = {
      testSubscription = {
        dead_lettering_on_filter_evaluation_error = true
        dead_lettering_on_message_expiration      = true
        default_message_ttl                       = "PT5M"
        enable_batched_operations                 = true
        lock_duration                             = "PT1M"
        max_delivery_count                        = 100
        status                                    = "Active"
        auto_delete_on_idle                       = "P7D"
        requires_session                          = false
        forward_dead_lettered_messages_to         = "forwardTopic"
        forward_to                                = "forwardTopic"
      }
    }

    role_assignments = {
      "key" = {
        skip_service_principal_aad_check = false
        role_definition_id_or_name       = "Contributor"
        description                      = "This is a test role assignment"
        principal_id                     = "eb5260bd-41f3-4019-9e03-606a617aec13"
      }
    }
    
    authorization_rules = {
      testRule = {
        send   = true
        listen = true
        manage = true
      }
    }
  }
}
```

--------------------------------

### Pinning AVM Module Version in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/AGENTS.md

When using AVM modules, it's crucial to pin to a specific version for predictable deployments. This example shows how to specify the version.

```terraform
version = "1.2.3"
```

--------------------------------

### Example Service Bus Queue Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Defines a Service Bus Queue with various properties including auto-delete, dead-lettering, TTL, partitioning, and role assignments. Use this to configure specific queue behaviors and access controls.

```hcl
queues = {
  testQueue = {
    auto_delete_on_idle                     = "P7D"
    dead_lettering_on_message_expiration    = true
    default_message_ttl                     = "PT5M"
    duplicate_detection_history_time_window = "PT5M"
    enable_batched_operations               = true
    enable_express                          = true
    enable_partitioning                     = true
    lock_duration                           = "PT5M"
    requires_duplicate_detection            = true
    requires_session                        = false
    max_delivery_count                      = 10
    max_message_size_in_kilobytes           = 1024
    max_size_in_megabytes                   = 1024
    status                                  = "Active"
    forward_to                              = "forwardQueue"
    forward_dead_lettered_messages_to       = "forwardQueue"

    role_assignments = {
      "key" = {
        skip_service_principal_aad_check = false
        role_definition_id_or_name       = "Contributor"
        description                      = "This is a test role assignment"
        principal_id                     = "eb5260bd-41f3-4019-9e03-606a617aec13"
      }
    }

    authorization_rules = {
      testRule = {
        send   = true
        listen = true
        manage = true
      }
    }
  }
}
```

--------------------------------

### Using Pessimistic Constraints for Terraform Providers

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/AGENTS.md

When defining provider versions for AVM modules, use pessimistic version constraints to ensure compatibility while allowing for minor updates. This example uses a '~> 1.0' constraint.

```terraform
version = "~> 1.0"
```

--------------------------------

### Terraform Configuration for Service Bus Namespace with Topics

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/topics/README.md

This configuration deploys a Service Bus Namespace with various topic settings. It utilizes Azure modules for naming and region selection. Configure topics with custom properties like auto-delete, message TTL, partitioning, and role assignments. It also includes examples of subscriptions with forward-to and forward-dead-lettered-messages-to configurations, as well as authorization rules.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "topics"
  skus   = ["Standard", "Premium"]
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "servicebus" {
  source   = "../../"
  for_each = toset(local.skus)

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${each.value}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  sku                 = each.value
  topics = {
    forwardTopic = {
    }

    enableExpressTopic = {
      enable_express               = true
      requires_duplicate_detection = false
    }

    testTopic = {
      auto_delete_on_idle                     = "P7D"
      default_message_ttl                     = "PT5M"
      duplicate_detection_history_time_window = "PT5M"
      enable_batched_operations               = true
      enable_express                          = false
      enable_partitioning                     = true
      requires_duplicate_detection            = null
      max_message_size_in_kilobytes           = 1024
      max_size_in_megabytes                   = 1024
      status                                  = "Active"
      support_ordering                        = true

      role_assignments = {
        key = {
          skip_service_principal_aad_check = false
          role_definition_id_or_name       = "Contributor"
          description                      = "This is a test role assignment"
          principal_id                     = data.azurerm_client_config.current.object_id
        }
      }

      subscriptions = {
        testSubscription = {
          dead_lettering_on_filter_evaluation_error = true
          dead_lettering_on_message_expiration      = true
          default_message_ttl                       = "PT5M"
          enable_batched_operations                 = true
          lock_duration                             = "PT1M"
          max_delivery_count                        = 100
          status                                    = "Active"
          auto_delete_on_idle                       = "P7D"
          requires_session                          = true
        }

        fromForwardSubscription = {
          requires_session                  = false
          forward_to                        = "forwardTopic"
          forward_dead_lettered_messages_to = "forwardTopic"
        }
      }

      authorization_rules = {
        testRule = {
          send   = true
          listen = true
          manage = true
        }
      }
    }
  }
}

```

--------------------------------

### Terraform Configuration for Service Bus Private Endpoint

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/private-endpoints-managed-dns-records/README.md

This configuration sets up a Service Bus namespace with a private endpoint, enabling automatic DNS zone group management and disabling public network access. It includes definitions for the Service Bus module, private endpoint configurations (both 'max' and 'min' examples), and associated resources like virtual networks, subnets, and private DNS zones.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "pe-mng"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

resource "azurerm_virtual_network" "example" {
  location            = azurerm_resource_group.example.location
  name                = "${module.naming.virtual_network.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_subnet" "example" {
  address_prefixes     = ["10.0.0.0/24"]
  name                 = module.naming.subnet.name_unique
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
}

resource "azurerm_private_dns_zone" "example" {
  name                = "privatelink.servicebus.core.windows.net"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "private_links" {
  name                  = "vnet-link"
  private_dns_zone_name = azurerm_private_dns_zone.example.name
  resource_group_name   = azurerm_resource_group.example.name
  virtual_network_id    = azurerm_virtual_network.example.id
}

resource "azurerm_application_security_group" "example" {
  location            = azurerm_resource_group.example.location
  name                = "tf-appsecuritygroup-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
}

module "servicebus" {
  source = "../../"

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  private_endpoints = {
    max = {
      name                            = "max"
      network_interface_name          = "max_nic1"
      private_dns_zone_group_name     = "max_dns_group"
      private_service_connection_name = "max_connection"
      subnet_resource_id              = azurerm_subnet.example.id
      private_dns_zone_resource_ids   = [azurerm_private_dns_zone.example.id]

      ip_configurations = {
        staticIpConfig = {
          name               = "staticIpConfig"
          private_ip_address = "10.0.0.6"
        }
      }

      role_assignments = {
        key = {
          role_definition_id_or_name = "Contributor"
          description                = "This is a test role assignment"
          principal_id               = data.azurerm_client_config.current.object_id
        }
      }

      lock = {
        kind = "CanNotDelete"
        name = "Testing name CanNotDelete"
      }

      tags = {
        environment = "testing"
        department  = "engineering"
      }

      application_security_group_associations = {
        asg1 = azurerm_application_security_group.example.id
      }
    }

    min = {
      subnet_resource_id = azurerm_subnet.example.id
    }
  }
  private_endpoints_manage_dns_zone_group = true
  public_network_access_enabled           = false
  sku                                     = "Premium"
}

```

--------------------------------

### Service Bus Namespace Topics Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Defines the configuration for topics within an Azure Service Bus Namespace. Includes settings for batched operations, duplicate detection, partitioning, message size, TTL, auto-delete, and more. Authorization rules and subscriptions can also be defined within each topic.

```terraform
enable_batched_operations               = optional(bool, true)
requires_duplicate_detection            = optional(bool, false)
enable_partitioning                     = optional(bool, null)
enable_express                          = optional(bool, null)
support_ordering                        = optional(bool, false)
max_message_size_in_kilobytes           = optional(number, null)
default_message_ttl                     = optional(string, null)
auto_delete_on_idle                     = optional(string, null)
max_size_in_megabytes                   = optional(number, 1024)
duplicate_detection_history_time_window = optional(string, "PT10M")
status                                  = optional(string, "Active")

authorization_rules = optional(map(object({
  name   = optional(string, null)
  send   = optional(bool, false)
  listen = optional(bool, false)
  manage = optional(bool, false)
})), {})

subscriptions = optional(map(object({
  name                                      = optional(string, null)
  max_delivery_count                        = optional(number, 10)
  dead_lettering_on_filter_evaluation_error = optional(bool, true)
  enable_batched_operations                 = optional(bool, true)
  dead_lettering_on_message_expiration      = optional(bool, false)
  requires_session                          = optional(bool, false)
  forward_to                                = optional(string, null)
  forward_dead_lettered_messages_to         = optional(string, null)
  auto_delete_on_idle                       = optional(string, null)
  default_message_ttl                       = optional(string, null)
  lock_duration                             = optional(string, "PT1M")
  status                                    = optional(string, "Active")
})), {})

role_assignments = optional(map(object({
  role_definition_id_or_name = string
  principal_id               = string

  description                            = optional(string, null)
  skip_service_principal_aad_check       = optional(bool, false)
  delegated_managed_identity_resource_id = optional(string, null)
})), {})

```

--------------------------------

### Configure Service Bus Namespace Authorization Rules

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Define authorization rules for a Service Bus Namespace. Each rule can have send, listen, and manage permissions. If the name is null, the map key will be used.

```hcl
authorization_rules = {
  testRule = {
    send   = true
    listen = true
    manage = true
  }
}
```

--------------------------------

### Configure Resource Lock for Service Bus Namespace

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Use this block to control the Resource Lock configuration for the Service Bus Namespace. Specify 'kind' as 'CanNotDelete' or 'ReadOnly'. 'name' is optional; if omitted, it will be generated.

```hcl
lock = {
  kind = "CanNotDelete"
  name = "This resource cannot be deleted easily"
}
```

--------------------------------

### Configure Customer Managed Key for Service Bus Namespace Encryption

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Set up customer-managed keys for encrypting Service Bus Namespace data. Ensure the Key Vault has soft delete and purge protection enabled, and the managed identity has 'Key Vault Crypto Service Encryption User' permissions.

```hcl
customer_managed_key = {
  key_name               = "sample-customer-key"
  key_version            = 03c89971825b4a0d84905c3597512260
  key_vault_resource_id  = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{keyVaultName}"
  
  user_assigned_identity {
    resource_id = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managedIdentityName}"
  }
}
```

--------------------------------

### Configure Diagnostic Settings for Service Bus Namespace

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Use this snippet to define diagnostic settings for a Service Bus namespace, specifying log categories, metric categories, and destinations like Log Analytics, Storage Accounts, or Event Hubs. Ensure resource IDs for destinations are correctly provided.

```hcl
diagnostic_settings = {
  diagnostic1 = {
    event_hub_name                           = "hub-name"
    log_analytics_destination_type           = "Dedicated"
    name                                     = "diagnostics"
    event_hub_authorization_rule_resource_id = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.EventHub/namespaces/{eventHubNamespaceName}/authorizationRules/{authorizationRuleName}"

    #log_categories = ["ApplicationMetricsLogs", "RuntimeAuditLogs", "VNetAndIPFilteringLogs", "OperationalLogs"]

    metric_categories           = ["AllMetrics"]
    log_groups                  = ["allLogs", "audit"]
    workspace_resource_id       = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}"
    storage_account_resource_id = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}"
  }
}
```

--------------------------------

### Default Terraform Configuration for Service Bus Namespace

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/default/README.md

This configuration deploys the Service Bus Namespace module in its simplest form, setting up required providers, resource groups, and iterating through different SKU options.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

locals {
  prefix = "default"
  skus   = ["Basic", "Standard", "Premium"]
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "servicebus" {
  source   = "../../"
  for_each = toset(local.skus)

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${each.value}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  sku                 = each.value
}
```

--------------------------------

### Terraform Configuration for CMK Pinned Key Version

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/cmk-pin-key-version/README.md

This Terraform configuration sets up a Service Bus namespace with a customer-managed key pointing to a specific key version. It requires Azure, random, and time providers. Ensure Key Vault permissions are correctly assigned before key operations.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.11"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "cmk-pin"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

resource "azurerm_user_assigned_identity" "example" {
  location            = azurerm_resource_group.example.location
  name                = "example-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_key_vault" "example" {
  location                   = azurerm_resource_group.example.location
  name                       = "${module.naming.key_vault.name_unique}${local.prefix}"
  resource_group_name        = azurerm_resource_group.example.name
  sku_name                   = "standard"
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  enable_rbac_authorization  = true
  purge_protection_enabled   = true
  soft_delete_retention_days = 7
}

resource "azurerm_key_vault_key" "example" {
  key_opts = [
    "wrapKey",
    "unwrapKey"
  ]
  key_type     = "RSA"
  key_vault_id = azurerm_key_vault.example.id
  name         = "customermanagedkey"
  key_size     = 4096

  depends_on = [time_sleep.wait_for_rbac_before_key_operations]
}

resource "azurerm_role_assignment" "crypto_officer" {
  principal_id         = data.azurerm_client_config.current.object_id
  scope                = azurerm_key_vault.example.id
  role_definition_name = "Key Vault Crypto Officer"
}

resource "azurerm_role_assignment" "crypto_service_encryption_user" {
  principal_id         = azurerm_user_assigned_identity.example.principal_id
  scope                = azurerm_key_vault.example.id
  role_definition_name = "Key Vault Crypto Service Encryption User"
}

time_sleep "wait_for_rbac_before_key_operations" {
  create_duration = "90s"

  depends_on = [azurerm_role_assignment.crypto_officer, azurerm_role_assignment.crypto_service_encryption_user]
}

module "servicebus" {
  source = "../../"

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  customer_managed_key = {
    key_vault_resource_id = azurerm_key_vault.example.id
    key_name              = azurerm_key_vault_key.example.name
    key_version           = azurerm_key_vault_key.example.version

    user_assigned_identity = {
      resource_id = azurerm_user_assigned_identity.example.id
    }
  }
  infrastructure_encryption_enabled = false
  managed_identities = {
    user_assigned_resource_ids = [azurerm_user_assigned_identity.example.id]
  }
  sku = "Premium"

  depends_on = [time_sleep.wait_for_rbac_before_key_operations]
}

```

--------------------------------

### Configure Network Rules for Service Bus Namespace

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Define network access rules for the Service Bus Namespace. This includes allowing trusted Azure services, specifying IP/CIDR rules, setting the default action ('Allow' or 'Deny'), and configuring subnet-based network rules.

```hcl
network_rule_config = {
  trusted_services_allowed = true
  default_action           = "Allow"
  cidr_or_ip_rules         = ["79.0.0.0", "80.0.0.0/24"]

  network_rules = [
    {
      subnet_id = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}"
    }
  ]
}
```

--------------------------------

### Configure Managed Identities for Service Bus Namespace

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Enable and assign managed identities to the Service Bus Namespace. Set 'system_assigned' to true to enable the system-assigned identity, and provide a list of resource IDs for 'user_assigned_resource_ids'.

```hcl
managed_identities = {
  system_assigned            = true
  user_assigned_resource_ids = [
    "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managedIdentityName}"
  ]
}
```

--------------------------------

### Terraform Configuration for Service Bus Namespace with Diagnostic Settings

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/diagnostic-settings/README.md

This HCL code defines the Terraform configuration for deploying an Azure Service Bus Namespace with multiple diagnostic settings. It includes provider requirements, resource definitions for resource group, storage account, log analytics workspace, event hub, and the Service Bus module itself. The `diagnostic_settings` block within the module allows for granular control over log and metric collection.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

locals {
  prefix = "diag"
  skus   = ["Basic", "Standard", "Premium"]
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "westeurope" # This test case in Premium SKU is not supported in some of the recommended regions. Pinned to an specific one to make the test more reliable. #module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

resource "azurerm_storage_account" "example" {
  account_replication_type = "ZRS"
  account_tier             = "Standard"
  location                 = azurerm_resource_group.example.location
  name                     = "${module.naming.storage_account.name_unique}${local.prefix}"
  resource_group_name      = azurerm_resource_group.example.name
}

resource "azurerm_log_analytics_workspace" "example" {
  location            = azurerm_resource_group.example.location
  name                = "${module.naming.log_analytics_workspace.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_eventhub_namespace" "example" {
  location            = azurerm_resource_group.example.location
  name                = "${module.naming.eventhub_namespace.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "Basic"
}

resource "azurerm_eventhub" "example" {
  message_retention   = 1
  name                = "diagnosticshub"
  partition_count     = 2
  namespace_name      = azurerm_eventhub_namespace.example.name
  resource_group_name = azurerm_resource_group.example.name
}

module "servicebus" {
  source   = "../../"
  for_each = toset(local.skus)

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${each.value}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  diagnostic_settings = {
    diagnostic1 = {
      log_groups    = ["allLogs"]
      metric_groups = ["AllMetrics"]

      name                           = "diagtest1"
      log_analytics_destination_type = "Dedicated"
      workspace_resource_id          = azurerm_log_analytics_workspace.example.id
    }

    diagnostic2 = {
      log_groups    = ["audit"]
      metric_groups = ["AllMetrics"]

      name                                     = "diagtest2"
      log_analytics_destination_type           = "Dedicated"
      event_hub_name                           = azurerm_eventhub.example.name
      event_hub_authorization_rule_resource_id = "${azurerm_eventhub_namespace.example.id}/authorizationRules/RootManageSharedAccessKey"
    }

    diagnostic3 = {
      log_categories = ["ApplicationMetricsLogs", "RuntimeAuditLogs", "VNetAndIPFilteringLogs", "OperationalLogs"]
      metric_groups  = ["AllMetrics"]

      name                           = "diagtest3"
      log_analytics_destination_type = "Dedicated"
      storage_account_resource_id    = azurerm_storage_account.example.id
    }
  }
  sku = each.value
}

```

--------------------------------

### Mapping Enable Telemetry in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/AGENTS.md

To manage telemetry settings for AVM modules, map the 'enable_telemetry' variable to a root variable. This ensures consistent telemetry configuration across your infrastructure.

```terraform
enable_telemetry = var.enable_telemetry
```

--------------------------------

### Service Bus Namespace Queue Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Defines optional queue configurations, including skipping the Service Principal AAD check and specifying a delegated managed identity resource ID.

```hcl
      skip_service_principal_aad_check       = optional(bool, false)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})
```

--------------------------------

### Configure Role Assignments for Service Bus Namespace

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Defines role assignments for the Service Bus Namespace. Use this to grant specific permissions to principals. The `skip_service_principal_aad_check` should only be set to true if assigning a role to a service principal.

```hcl
role_assignments = {
  "key" = {
    skip_service_principal_aad_check = false
    role_definition_id_or_name       = "Contributor"
    description                      = "This is a test role assignment"
    principal_id                     = "eb5260bd-41f3-4019-9e03-606a617aec13"
  }
}
```

--------------------------------

### Terraform Configuration for Service Bus Namespace with Queues

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/queues/README.md

This HCL code defines the Terraform configuration for deploying an Azure Service Bus Namespace with multiple queues. It includes provider requirements, data sources, local variables, and module calls for naming, regions, and the Service Bus module itself. The 'queues' input to the servicebus module showcases various queue configurations.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "queues"
  skus   = ["Basic", "Standard", "Premium"]
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "servicebus" {
  source   = "../../"
  for_each = toset(local.skus)

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${each.value}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  queues = {
    forwardQueue = {

    }

    fromForwardQueue = {
      requires_session                  = false
      forward_to                        = "forwardQueue"
      forward_dead_lettered_messages_to = "forwardQueue"
    }

    enableExpressQueue = {
      enable_express               = true
      requires_duplicate_detection = false
    }

    testQueue = {
      auto_delete_on_idle                     = "P7D"
      dead_lettering_on_message_expiration    = true
      default_message_ttl                     = "PT5M"
      duplicate_detection_history_time_window = "PT5M"
      enable_batched_operations               = true
      enable_express                          = false
      enable_partitioning                     = true
      lock_duration                           = "PT1M"
      requires_duplicate_detection            = true
      requires_session                        = true
      max_delivery_count                      = 100
      max_message_size_in_kilobytes           = 1024
      max_size_in_megabytes                   = 1024
      status                                  = "Active"

      role_assignments = {
        key = {
          skip_service_principal_aad_check = false
          role_definition_id_or_name       = "Contributor"
          description                      = "This is a test role assignment"
          principal_id                     = data.azurerm_client_config.current.object_id
        }
      }

      authorization_rules = {
        testRule = {
          send   = true
          listen = true
          manage = true
        }
      }
    }
  }
  sku = each.value
}

```

--------------------------------

### Deploy Service Bus Namespace with CMK and Auto-Rotation

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/cmk-with-auto-rotate/README.md

This Terraform configuration deploys a Service Bus namespace with customer-managed key (CMK) support, configured for auto-rotation by not specifying a key version. It sets up a Key Vault, a key, a user-assigned identity, and grants necessary permissions before deploying the Service Bus module.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
    time = {
      source  = "hashicorp/time"
      version = "~> 0.11"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "cmk-auto"
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

resource "azurerm_user_assigned_identity" "example" {
  location            = azurerm_resource_group.example.location
  name                = "example-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_key_vault" "example" {
  location                   = azurerm_resource_group.example.location
  name                       = "${module.naming.key_vault.name_unique}${local.prefix}"
  resource_group_name        = azurerm_resource_group.example.name
  sku_name                   = "standard"
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  enable_rbac_authorization  = true
  purge_protection_enabled   = true
  soft_delete_retention_days = 7
}

resource "azurerm_key_vault_key" "example" {
  key_opts = [
    "wrapKey",
    "unwrapKey"
  ]
  key_type     = "RSA"
  key_vault_id = azurerm_key_vault.example.id
  name         = "customermanagedkey"
  key_size     = 4096

  depends_on = [time_sleep.wait_for_rbac_before_key_operations]
}

resource "azurerm_role_assignment" "crypto_officer" {
  principal_id         = data.azurerm_client_config.current.object_id
  scope                = azurerm_key_vault.example.id
  role_definition_name = "Key Vault Crypto Officer"
}

resource "azurerm_role_assignment" "crypto_service_encryption_user" {
  principal_id         = azurerm_user_assigned_identity.example.principal_id
  scope                = azurerm_key_vault.example.id
  role_definition_name = "Key Vault Crypto Service Encryption User"
}

time_sleep "wait_for_rbac_before_key_operations" {
  create_duration = "90s"

  depends_on = [azurerm_role_assignment.crypto_officer, azurerm_role_assignment.crypto_service_encryption_user]
}

module "servicebus" {
  source = "../../"

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  customer_managed_key = {
    key_vault_resource_id = azurerm_key_vault.example.id
    key_name              = azurerm_key_vault_key.example.name

    user_assigned_identity = {
      resource_id = azurerm_user_assigned_identity.example.id
    }
  }
  infrastructure_encryption_enabled = true
  managed_identities = {
    user_assigned_resource_ids = [azurerm_user_assigned_identity.example.id]
  }
  sku = "Premium"

  depends_on = [time_sleep.wait_for_rbac_before_key_operations]
}

```

--------------------------------

### Service Bus Queue Type Definition

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/README.md

Defines the expected structure and types for Service Bus Queue configurations, including nested authorization rules and role assignments. Ensure your input conforms to this schema for proper resource provisioning.

```hcl
map(object({
    name                                    = optional(string, null)
    max_delivery_count                      = optional(number, 10)
    enable_batched_operations               = optional(bool, true)
    requires_duplicate_detection            = optional(bool, false)
    requires_session                        = optional(bool, false)
    dead_lettering_on_message_expiration    = optional(bool, false)
    enable_partitioning                     = optional(bool, null)
    enable_express                          = optional(bool, null)
    max_message_size_in_kilobytes           = optional(number, null)
    default_message_ttl                     = optional(string, null)
    forward_to                              = optional(string, null)
    forward_dead_lettered_messages_to       = optional(string, null)
    auto_delete_on_idle                     = optional(string, null)
    max_size_in_megabytes                   = optional(number, 1024)
    lock_duration                           = optional(string, "PT1M")
    duplicate_detection_history_time_window = optional(string, "PT10M")
    status                                  = optional(string, "Active")

    authorization_rules = optional(map(object({
      name   = optional(string, null)
      send   = optional(bool, false)
      listen = optional(bool, false)
      manage = optional(bool, false)
    })), {})

    role_assignments = optional(map(object({
      role_definition_id_or_name = string
      principal_id               = string

      description                            = optional(string, null)

```

--------------------------------

### Terraform Configuration for Max Namespace

Source: https://github.com/azure/terraform-azurerm-avm-res-servicebus-namespace/blob/main/examples/max-namespace/README.md

This HCL code block defines the Terraform configuration, including required providers and the deployment of a Service Bus namespace with diverse settings.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.14"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

data "azurerm_client_config" "current" {}

locals {
  prefix = "max"
  skus   = ["Basic", "Standard", "Premium"]
}

module "regions" {
  source  = "Azure/regions/azurerm"
  version = ">= 0.3.0"

  recommended_regions_only = true
}

resource "random_integer" "region_index" {
  max = length(module.regions.regions) - 1
  min = 0
}

module "naming" {
  source  = "Azure/naming/azurerm"
  version = ">= 0.3.0"
}

resource "azurerm_resource_group" "example" {
  location = "spaincentral" # This test case in Premium SKU is not supported in some of the recommended regions. Pinned to an specific one to make the test more reliable. #module.regions.regions[random_integer.region_index.result].name
  name     = "${module.naming.resource_group.name_unique}-${local.prefix}"
}

module "servicebus" {
  source   = "../../"
  for_each = toset(local.skus)

  location            = azurerm_resource_group.example.location
  name                = "${module.naming.servicebus_namespace.name_unique}-${each.value}-${local.prefix}"
  resource_group_name = azurerm_resource_group.example.name
  authorization_rules = {
    testRule = {
      send   = true
      listen = true
      manage = true
    }
  }
  capacity           = 2
  enable_telemetry   = true
  local_auth_enabled = true
  lock = {
    kind = "CanNotDelete"
    name = "Testing name CanNotDelete"
  }
  minimum_tls_version                     = "1.2"
  premium_messaging_partitions            = 2
  private_endpoints_manage_dns_zone_group = true
  public_network_access_enabled           = true
  role_assignments = {
    key = {
      skip_service_principal_aad_check = false
      role_definition_id_or_name       = "Contributor"
      description                      = "This is a test role assignment"
      principal_id                     = data.azurerm_client_config.current.object_id
    }
  }
  sku = each.value
  tags = {
    environment = "testing"
    department  = "engineering"
  }
}
```