### Install Scripts Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Specifies a list of install scripts to be executed on a Windows Managed Instance App Service Plan. Each script requires a name and a source configuration, defaulting to 'RemoteAzureBlob' type.

```hcl
list(object({
    name = string
    source = object({
      type       = optional(string, "RemoteAzureBlob")
      source_uri = string
    })
  }))
```

--------------------------------

### Terraform Module Source from GitHub

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/AGENTS.md

Example of how to reference an AVM module directly from GitHub. Replace placeholders with actual module details.

```terraform
source = "https://github.com/Azure/terraform-azurerm-avm-{type}-{service}-{resource}"
```

--------------------------------

### Terraform Module Source from Registry

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/AGENTS.md

Example of how to reference an AVM module from the Terraform Registry. Replace placeholders with actual module details.

```terraform
source = "https://registry.terraform.io/modules/Azure/{module}/azurerm/latest"
```

--------------------------------

### Terraform Versions API for Module Versions

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/AGENTS.md

Example of constructing a URL to query the Terraform Versions API for a specific module. This can be used for programmatic version checking.

```terraform
source = "https://registry.terraform.io/v1/modules/Azure/{module}/versions"
```

--------------------------------

### Terraform Module Call for App Service Managed Instance Plan

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This snippet demonstrates the module call to create an App Service Managed Instance plan with custom configurations. It includes settings for install scripts, managed identities, registry adapters, and storage mounts. Ensure the `os_type` is set to 'WindowsManagedInstance' and the SKU is a V4 type.

```terraform
module "test" {
  source = "../.."

  location         = azapi_resource.resource_group.location
  name             = module.naming.app_service_plan.name_unique
  os_type          = "WindowsManagedInstance"
  parent_id        = azapi_resource.resource_group.id
  enable_telemetry = var.enable_telemetry
  # Install scripts - references the scripts.zip blob in the storage account
  # The install script logs can be found in C:\\InstallScripts on the VM instances
  install_scripts = [
    {
      name = "CustomInstaller"
      source = {
        type       = "RemoteAzureBlob"
        source_uri = "https://${azapi_resource.storage_account.name}.blob.core.windows.net/${azapi_resource.blob_container.name}/scripts.zip"
      }
    }
  ]
  # Managed identities - the user-assigned identity must be attached to the plan
  managed_identities = {
    user_assigned_resource_ids = [azapi_resource.managed_identity.id]
  }
  # Plan default identity - used by the platform to pull install scripts
  plan_default_identity = {
    identity_type                      = "UserAssigned"
    user_assigned_identity_resource_id = azapi_resource.managed_identity.id
  }
  rdp_enabled = true
  # Registry adapters - configure Windows registry keys via Key Vault references
  registry_adapters = [
    {
      registry_key = "HKEY_LOCAL_MACHINE/SOFTWARE/MyApp1/RegistryAdapterString" # Registry key must start with HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, or HKEY_USERS and contain at least one forward slash.
      type         = "String"
      key_vault_secret_reference = {
        secret_uri = "https://${azapi_resource.key_vault.name}.vault.azure.net/secrets/${azurerm_key_vault_secret.registry_string.name}"
      }
    },
    {
      registry_key = "HKEY_LOCAL_MACHINE/SOFTWARE/MyApp1/RegistryAdapterDWORD" # Registry key must start with HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER, or HKEY_USERS and contain at least one forward slash.
      type         = "DWORD"
      key_vault_secret_reference = {
        secret_uri = "https://${azapi_resource.key_vault.name}.vault.azure.net/secrets/${azurerm_key_vault_secret.registry_dword.name}"
      }
    }
  ]
  sku_name = "P1v4" # V4 skus are required for Windows Managed Instance
  # Storage mount for G: drive
  storage_mounts = [
    {
      name             = "g-drive"
      type             = "LocalStorage"
      destination_path = "G:\\"
    },
    {
      name             = "h-drive"
      type             = "AzureFiles"
      source           = "\\\\${azapi_resource.storage_account.name}.file.core.windows.net\\${azapi_resource.file_share.name}"
      destination_path = "H:\\"
      credentials_key_vault_reference = {
        secret_uri = "https://${azapi_resource.key_vault.name}.vault.azure.net//secrets/${azurerm_key_vault_secret.storage_key.name}" # NOTE: the double slash after the vault URI is intentional to comply with Key Vault secret URI format for this resource
      }
    }
  ]
  virtual_network_subnet_id = azapi_resource.subnet.id
  worker_count              = 3

  depends_on = [azurerm_storage_blob.scripts_zip]
}

```

--------------------------------

### Pinning AVM Module Version in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/AGENTS.md

When using AVM modules, it's crucial to pin to a specific version for predictable deployments. This example shows how to specify the version.

```terraform
version = "1.2.3"
```

--------------------------------

### Terraform Configuration for Windows Managed Instance

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This Terraform configuration sets up the necessary providers, resources, and configurations for deploying a Windows Managed Instance App Service Plan. It includes resource group creation, a user-assigned managed identity, a storage account for install scripts, and a role assignment for the managed identity.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    archive = {
      source  = "hashicorp/archive"
      version = "~> 2.7"
    }
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0, < 5.0"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azapi" {}

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy          = false
      purge_soft_deleted_keys_on_destroy    = false
      purge_soft_deleted_secrets_on_destroy = false
    }
  }
  storage_use_azuread = true
}

resource "random_integer" "region_index" {
  max = length(local.test_regions) - 1
  min = 0
}

## End of section to provide a random Azure region for the resource group

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.2"
}

# This is required for resource modules
# Hardcoding location due to quota constraints
resource "azapi_resource" "resource_group" {
  location               = "australiaeast"
  name                   = module.naming.resource_group.name_unique
  type                   = "Microsoft.Resources/resourceGroups@2024-03-01"
  response_export_values = []
  tags = {
    SecurityControl = "Ignore" # Useful for test environments
  }
}

# A user assigned managed identity for the Managed Instance plan default identity
resource "azapi_resource" "managed_identity" {
  location               = azapi_resource.resource_group.location
  name                   = module.naming.user_assigned_identity.name_unique
  parent_id              = azapi_resource.resource_group.id
  type                   = "Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31"
  response_export_values = ["properties.principalId"]
}

# Storage account to host the install scripts package
resource "azapi_resource" "storage_account" {
  location  = azapi_resource.resource_group.location
  name      = module.naming.storage_account.name_unique
  parent_id = azapi_resource.resource_group.id
  type      = "Microsoft.Storage/storageAccounts@2023-05-01"
  body = {
    kind = "StorageV2"
    properties = {
      accessTier               = "Hot"
      allowBlobPublicAccess    = false
      allowSharedKeyAccess     = true
      minimumTlsVersion        = "TLS1_2"
      supportsHttpsTrafficOnly = true
      publicNetworkAccess      = "Enabled"
      networkAcls = {
        defaultAction = "Allow"
      }
    }
    sku = {
      name = "Standard_ZRS"
    }
  }
  response_export_values = []
}

# Blob container to hold scripts.zip
resource "azapi_resource" "blob_container" {
  name      = "scripts"
  parent_id = "${azapi_resource.storage_account.id}/blobServices/default"
  type      = "Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01"
  body = {
    properties = {
      publicAccess = "None"
    }
  }
  response_export_values = []
}

# Grant the managed identity "Storage Blob Data Reader" on the storage account
# so the plan can pull install scripts
resource "azapi_resource" "role_assignment_blob_reader" {
  name      = "7d2b4b60-b4a1-4e5e-a123-abcdef012345"
  parent_id = azapi_resource.storage_account.id
  type      = "Microsoft.Authorization/roleAssignments@2022-04-01"
  body = {
    properties = {
      principalId      = azapi_resource.managed_identity.output.properties.principalId
      principalType    = "ServicePrincipal"
      roleDefinitionId = "/subscriptions/${data.azapi_client_config.this.subscription_id}/providers/Microsoft.Authorization/roleDefinitions/2a2b9908-6ea1-4ae2-8e65-a410df84e7d1"
    }
  }
  response_export_values = []

  depends_on = [azapi_resource.blob_container]
}

data "azapi_client_config" "this" {}

# Virtual network for the Managed Instance App Service Plan
resource "azapi_resource" "virtual_network" {
  location  = azapi_resource.resource_group.location
  name      = module.naming.virtual_network.name_unique
  parent_id = azapi_resource.resource_group.id
  type      = "Microsoft.Network/virtualNetworks@2024-05-01"
  body = {
    properties = {
      addressSpace = {
        addressPrefixes = ["10.0.0.0/16"]
      }
    }
  }
  response_export_values = []
}

```

--------------------------------

### Default Terraform Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/default/README.md

This configuration deploys the module in its simplest form, setting up required providers and calling the module with basic parameters.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azapi" {}

resource "random_integer" "region_index" {
  max = length(local.test_regions) - 1
  min = 0
}

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.2"
}

# This is required for resource modules
# Hardcoding location due to quota constraints
resource "azapi_resource" "resource_group" {
  location               = "australiaeast"
  name                   = module.naming.resource_group.name_unique
  type                   = "Microsoft.Resources/resourceGroups@2024-03-01"
  response_export_values = []
}

moved {
  from = azurerm_resource_group.this
  to   = azapi_resource.resource_group
}

# This is the module call
module "test" {
  source = "../.."

  location         = azapi_resource.resource_group.location
  name             = module.naming.app_service_plan.name_unique
  os_type          = "Windows"
  parent_id        = azapi_resource.resource_group.id
  enable_telemetry = var.enable_telemetry
}
```

--------------------------------

### Registry Adapters Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Configures a list of registry adapters for a WindowsManagedInstance App Service Plan. Each adapter requires a registry key, type (DWORD or String), and a Key Vault secret reference.

```hcl
list(object({
    registry_key = string
    type         = string
    key_vault_secret_reference = object({
      secret_uri = string
    })
  }))
```

--------------------------------

### Storage Mounts Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Specifies a list of storage mounts for the App Service Plan, applicable when os_type is WindowsManagedInstance. Includes details like name, type, source, destination path, and optional Key Vault credentials.

```hcl
list(object({
    name             = string
    type             = optional(string, "LocalStorage")
    source           = optional(string, "")
    destination_path = string
    credentials_key_vault_reference = optional(object({
      secret_uri = optional(string)
    }), {}))
  }))
```

--------------------------------

### Terraform Configuration for Multi-kind App Service Plans

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/multi_kind/README.md

This Terraform configuration sets up the necessary providers and modules to deploy multiple App Service Plans with different SKU kinds. It includes resource group creation and the main module for deploying the plans.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azapi" {}

resource "random_integer" "region_index" {
  max = length(local.test_regions) - 1
  min = 0
}

## End of section to provide a random Azure region for the resource group

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.2"
}

# This is required for resource modules
# Hardcoding location due to quota constraints
resource "azapi_resource" "resource_group" {
  location               = "australiaeast"
  name                   = module.naming.resource_group.name_unique
  type                   = "Microsoft.Resources/resourceGroups@2024-03-01"
  response_export_values = []
}

# Deploy multiple App Service Plans with different SKU kinds
module "test" {
  source   = "../.."
  for_each = local.plans

  location               = azapi_resource.resource_group.location
  name                   = "${module.naming.app_service_plan.name_unique}-${each.key}"
  os_type                = each.value.os_type
  parent_id              = azapi_resource.resource_group.id
  enable_telemetry       = var.enable_telemetry
  sku_name               = each.value.sku_name
  worker_count           = each.value.worker_count
  zone_balancing_enabled = each.value.zone_balancing
}
```

--------------------------------

### Per Site Scaling Enabled

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Enables or disables per-site scaling for the App Service Plan. Defaults to false.

```hcl
bool
```

--------------------------------

### Create Subnet for App Service Plan Delegation

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This snippet creates a subnet within a virtual network and configures it for delegation to 'Microsoft.Web.serverFarms'. This is a prerequisite for certain App Service Plan configurations.

```terraform
resource "azapi_resource" "subnet" {
  name      = "default"
  parent_id = azapi_resource.virtual_network.id
  type      = "Microsoft.Network/virtualNetworks/subnets@2024-05-01"
  body = {
    properties = {
      addressPrefix = "10.0.0.0/24"
      delegations = [
        {
          name = "Microsoft.Web.serverFarms"
          properties = {
            serviceName = "Microsoft.Web/serverFarms"
          }
        }
      ]
    }
  }
  response_export_values = []
}
```

--------------------------------

### Create File Share for H: Drive Mount

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This snippet defines a file share resource named 'hshare' within a storage account. This is typically used for mounting as an H: drive for managed instances.

```terraform
resource "azapi_resource" "file_share" {
  name      = "hshare"
  parent_id = "${azapi_resource.storage_account.id}/fileServices/default"
  type      = "Microsoft.Storage/storageAccounts/fileServices/shares@2023-05-01"
  body = {
    properties = {
      shareQuota = 5
    }
  }
  response_export_values = []
}
```

--------------------------------

### Retrieve Storage Account Keys

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

Fetches the keys for a specified Azure storage account using the azapi_resource_action data source.

```terraform
data "azapi_resource_action" "storage_account_keys" {
  action                 = "listKeys"
  resource_id            = azapi_resource.storage_account.id
  type                   = "Microsoft.Storage/storageAccounts@2023-05-01"
  response_export_values = ["keys"]
}
```

--------------------------------

### Role Assignments Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Defines a map of role assignments for the resource. Each assignment specifies the role definition, principal ID, and optional parameters like description, condition, and delegated identity resource ID.

```hcl
map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
    principal_type                         = optional(string, null)
  }))
```

--------------------------------

### Terraform Configuration for Windows Container App Service Plan

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/windows_container/README.md

This Terraform configuration sets up the necessary providers and resources to deploy a Windows Container App Service Plan. It includes provider requirements, a random integer for region selection, a naming module for resource names, and the main module call for the App Service Plan.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azapi" {}

resource "random_integer" "region_index" {
  max = length(local.test_regions) - 1
  min = 0
}

## End of section to provide a random Azure region for the resource group

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.2"
}

# This is required for resource modules
# Hardcoding location due to quota constraints
resource "azapi_resource" "resource_group" {
  location               = "australiaeast"
  name                   = module.naming.resource_group.name_unique
  type                   = "Microsoft.Resources/resourceGroups@2024-03-01"
  response_export_values = []
}

# This is the module call
# Windows Container requires a Premium v3 or higher SKU
module "test" {
  source = "../.."

  location         = azapi_resource.resource_group.location
  name             = module.naming.app_service_plan.name_unique
  os_type          = "WindowsContainer"
  parent_id        = azapi_resource.resource_group.id
  enable_telemetry = var.enable_telemetry
  sku_name         = "P1v3"
}
```

--------------------------------

### Terraform Configuration for Linux App Service Plan

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/linux/README.md

This HCL code configures Terraform, defines required providers (azapi, random), and sets up resources for deploying a Linux App Service Plan. It utilizes the Azure/naming module for resource naming and the main module for the App Service Plan itself.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azapi" {}

resource "random_integer" "region_index" {
  max = length(local.test_regions) - 1
  min = 0
}

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.2"
}

# This is required for resource modules
# Hardcoding location due to quota constraints
resource "azapi_resource" "resource_group" {
  location               = "australiaeast"
  name                   = module.naming.resource_group.name_unique
  type                   = "Microsoft.Resources/resourceGroups@2024-03-01"
  response_export_values = []
}

# This is the module call
module "test" {
  source = "../.."

  location         = azapi_resource.resource_group.location
  name             = module.naming.app_service_plan.name_unique
  os_type          = "Linux"
  parent_id        = azapi_resource.resource_group.id
  enable_telemetry = var.enable_telemetry
}
```

--------------------------------

### Timeouts Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Configures timeout settings for azapi resource operations, including create, delete, read, and update operations with optional string values for durations.

```hcl
object({
    create = optional(string, null)
    delete = optional(string, null)
    read   = optional(string, null)
    update = optional(string, null)
  })
```

--------------------------------

### Archive Scripts Directory

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

Creates a zip archive of the specified scripts directory.

```terraform
data "archive_file" "scripts" {
  type             = "zip"
  source_dir       = "${path.module}/scripts"
  output_path      = "${path.module}/scripts.zip"
  output_file_mode = "0644"
}
```

--------------------------------

### Resource Lock Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Defines the configuration for a resource lock, specifying the lock kind ('CanNotDelete' or 'ReadOnly') and an optional name. Changing the name forces resource recreation.

```hcl
object({
    kind = string
    name = optional(string, null)
  })
```

--------------------------------

### Mapping Telemetry in AVM Modules

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/AGENTS.md

Map the 'enable_telemetry' variable to the root variable when using AVM modules. This ensures consistent telemetry settings across your infrastructure.

```terraform
enable_telemetry = var.enable_telemetry
```

--------------------------------

### Pessimistic Provider Version Constraints in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/AGENTS.md

Use pessimistic version constraints for providers when working with AVM modules to avoid unexpected breaking changes.

```terraform
version = "~> 1.0"
```

--------------------------------

### Diagnostic Settings Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Defines a map of diagnostic settings for an App Service Environment (ASE). Supports custom names, log and metric categories, and various destination types like Log Analytics, Storage Accounts, or Event Hubs.

```hcl
map(object({
    name = optional(string, null)
    logs = optional(set(object({
      category       = optional(string, null)
      category_group = optional(string, null)
      enabled        = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    metrics = optional(set(object({
      category = optional(string, null)
      enabled  = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))
```

--------------------------------

### Plan Default Identity Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Defines the default identity for a Managed Instance App Service Plan, applicable only when os_type is WindowsManagedInstance. Requires a user-assigned identity resource ID.

```hcl
object({
    identity_type                      = optional(string, "UserAssigned")
    user_assigned_identity_resource_id = string
  })
```

--------------------------------

### Terraform Resource for Web App on Managed Instance Plan

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This snippet defines an Azure Web App resource that will run on the previously configured Managed Instance plan. It specifies the .NET framework version and ensures the App Service Plan ID casing matches what Azure expects for readback.

```terraform
# Web App running .NET 10 on Windows, hosted on the Managed Instance plan
resource "azapi_resource" "web_app" {
  location  = azapi_resource.resource_group.location
  name      = module.naming.app_service.name_unique
  parent_id = azapi_resource.resource_group.id
  type      = "Microsoft.Web/sites@2024-04-01"
  body = {
    kind = "app"
    properties = {
      # Azure stores the App Service Plan ID with the lowercase `serverfarms`
      # segment, while the module's `resource_id` output uses the canonical
      # `serverFarms` casing for strict azurerm parsers (issue #129). Match the
      # stored casing here so azapi readback doesn't show a case-only diff.
      serverFarmId = replace(module.test.resource_id, "serverFarms", "serverfarms")
      siteConfig = {
        alwaysOn            = true # NOTE: If the web app is not deployed and running, you will not be able to RDP onto the instances
        netFrameworkVersion = "v10.0"
        metadata = [
          {
            name  = "CURRENT_STACK"
            value = "dotnet"
          }
        ]
      }
    }
  }
  response_export_values    = []
  schema_validation_enabled = false
}

```

--------------------------------

### Terraform Configuration for Complete App Service Plan Deployment

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/complete/README.md

This Terraform configuration deploys an Azure App Service Plan with advanced features. It includes setting up diagnostic settings to send metrics to a Log Analytics workspace, applying a management lock to prevent accidental deletion, and configuring role assignments for a managed identity. Ensure the 'azapi' and 'random' providers are configured.

```hcl
terraform {
  required_version = ">= 1.9, < 2.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.4"
    }
    random = {
      source  = "hashicorp/random"
      version = ">= 3.5.0, < 4.0.0"
    }
  }
}

provider "azapi" {}

resource "random_integer" "region_index" {
  max = length(local.test_regions) - 1
  min = 0
}

## End of section to provide a random Azure region for the resource group

# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.2"
}

# This is required for resource modules
# Hardcoding location due to quota constraints
resource "azapi_resource" "resource_group" {
  location               = "australiaeast"
  name                   = module.naming.resource_group.name_unique
  type                   = "Microsoft.Resources/resourceGroups@2024-03-01"
  response_export_values = []
}

# A Log Analytics workspace to send diagnostic logs to
resource "azapi_resource" "log_analytics_workspace" {
  location  = azapi_resource.resource_group.location
  name      = module.naming.log_analytics_workspace.name_unique
  parent_id = azapi_resource.resource_group.id
  type      = "Microsoft.OperationalInsights/workspaces@2023-09-01"
  body = {
    properties = {
      sku = {
        name = "PerGB2018"
      }
      retentionInDays = 30
    }
  }
  response_export_values = []
}

# A user assigned managed identity for role assignment demonstration
resource "azapi_resource" "managed_identity" {
  location               = azapi_resource.resource_group.location
  name                   = module.naming.user_assigned_identity.name_unique
  parent_id              = azapi_resource.resource_group.id
  type                   = "Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31"
  response_export_values = ["properties.principalId"]
}

# This is the module call
module "test" {
  source = "../.."

  location  = azapi_resource.resource_group.location
  name      = module.naming.app_service_plan.name_unique
  os_type   = "Linux"
  parent_id = azapi_resource.resource_group.id
  # Diagnostic settings - sends metrics to Log Analytics workspace
  diagnostic_settings = {
    to_law = {
      name                  = "diag-to-law"
      workspace_resource_id = azapi_resource.log_analytics_workspace.id
      metrics = [
        {
          category = "AllMetrics"
          enabled  = true
        }
      ]
    }
  }
  enable_telemetry = var.enable_telemetry
  # Management lock - prevents accidental deletion
  lock = {
    kind = "CanNotDelete"
    name = "lock-asp-complete"
  }
  # Managed identities
  managed_identities = {
    system_assigned            = true
    user_assigned_resource_ids = [azapi_resource.managed_identity.id]
  }
  # Role assignments - grant the managed identity Reader access
  role_assignments = {
    reader = {
      role_definition_id_or_name = "Reader"
      principal_id               = azapi_resource.managed_identity.output.properties.principalId
      principal_type             = "ServicePrincipal"
    }
  }
  # Tags
  tags = {
    environment = "complete-example"
  }
}

```

--------------------------------

### Upload Scripts Zip to Storage Blob

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

Uploads a zip archive of scripts to an Azure Storage Blob container. Requires MD5 hash for content validation.

```terraform
resource "azurerm_storage_blob" "scripts_zip" {
  name                   = "scripts.zip"
  storage_account_name   = azapi_resource.storage_account.name
  storage_container_name = azapi_resource.blob_container.name
  type                   = "Block"
  content_md5            = data.archive_file.scripts.output_md5
  source                 = data.archive_file.scripts.output_path

  depends_on = [azapi_resource.role_assignment_blob_reader, azapi_resource.role_assignment_blob_contributor_current_user]
}
```

--------------------------------

### Retry Configuration for Azapi Resources

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Defines retry logic for azapi resource operations, including matching error messages, interval, and maximum interval between retries. Defaults to retrying on 'ScopeLocked' errors.

```hcl
object({
    error_message_regex  = optional(list(string), ["ScopeLocked"])
    interval_seconds     = optional(number, null)
    max_interval_seconds = optional(number, null)
  })
```

--------------------------------

### Create Key Vault for Secrets Management

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This snippet creates an Azure Key Vault. It is configured with RBAC authorization enabled and soft-delete disabled. This Key Vault will store sensitive information like storage account keys.

```terraform
resource "azapi_resource" "key_vault" {
  location  = azapi_resource.resource_group.location
  name      = module.naming.key_vault.name_unique
  parent_id = azapi_resource.resource_group.id
  type      = "Microsoft.KeyVault/vaults@2023-07-01"
  body = {
    properties = {
      enablePurgeProtection        = null
      enableRbacAuthorization      = true
      enableSoftDelete             = false
      enabledForDeployment         = false
      enabledForTemplateDeployment = false
      sku = {
        family = "A"
        name   = "standard"
      }
      tenantId = data.azapi_client_config.this.tenant_id
    }
  }
  response_export_values = []
}
```

--------------------------------

### Managed Identities Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Configure system-assigned or user-assigned managed identities for an App Service Plan. System-assigned is enabled by default if not specified.

```hcl
object({
    system_assigned            = optional(bool, false)
    user_assigned_resource_ids = optional(set(string), [])
  })
```

--------------------------------

### Store String Secret in Key Vault

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

Stores a simple string value as a secret in Azure Key Vault.

```terraform
resource "azurerm_key_vault_secret" "registry_string" {
  key_vault_id = azapi_resource.key_vault.id
  name         = "registry-string-value"
  value        = "MyExampleStringValue"

  depends_on = [azapi_resource.role_assignment_kv_secrets_officer]
}
```

--------------------------------

### Store Storage Account Key in Key Vault

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

Creates an Azure Key Vault secret to store the connection string for a storage account, including its access key.

```terraform
resource "azurerm_key_vault_secret" "storage_key" {
  key_vault_id = azapi_resource.key_vault.id
  name         = "storage-account-key"
  value        = "DefaultEndpointsProtocol=https;AccountName=${azapi_resource.storage_account.name};AccountKey=${data.azapi_resource_action.storage_account_keys.output.keys[0].value};EndpointSuffix=core.windows.net"

  depends_on = [azapi_resource.role_assignment_kv_secrets_officer]
}
```

--------------------------------

### Maximum Elastic Worker Count

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/README.md

Sets the maximum number of total workers for an ElasticScaleEnabled App Service Plan. Defaults to 3.

```hcl
number
```

--------------------------------

### Grant Storage Blob Data Contributor Role

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

Assigns the 'Storage Blob Data Contributor' role to the current user on a storage account, enabling the provider to upload blobs via Azure AD authentication.

```terraform
resource "azapi_resource" "role_assignment_blob_contributor_current_user" {
  name      = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  parent_id = azapi_resource.storage_account.id
  type      = "Microsoft.Authorization/roleAssignments@2022-04-01"
  body = {
    properties = {
      principalId      = data.azapi_client_config.this.object_id
      roleDefinitionId = "/subscriptions/${data.azapi_client_config.this.subscription_id}/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe"
    }
  }
  response_export_values = []

  depends_on = [azapi_resource.blob_container]
}
```

--------------------------------

### Store DWORD Secret in Key Vault

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

Stores an integer value (DWORD) as a secret in Azure Key Vault. The value must be an integer.

```terraform
resource "azurerm_key_vault_secret" "registry_dword" {
  key_vault_id = azapi_resource.key_vault.id
  name         = "registry-dword-value"
  value        = "336" # Must be an Integer

  depends_on = [azapi_resource.role_assignment_kv_secrets_officer]
}
```

--------------------------------

### Grant Current User Key Vault Secrets Officer Role

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This snippet assigns the 'Key Vault Secrets Officer' role to the current user on the specified Key Vault. This permission is necessary to create secrets within the Key Vault.

```terraform
resource "azapi_resource" "role_assignment_kv_secrets_officer" {
  name      = "b1c2d3e4-f5a6-7890-abcd-ef1234567891"
  parent_id = azapi_resource.key_vault.id
  type      = "Microsoft.Authorization/roleAssignments@2022-04-01"
  body = {
    properties = {
      principalId      = data.azapi_client_config.this.object_id
      roleDefinitionId = "/subscriptions/${data.azapi_client_config.this.subscription_id}/providers/Microsoft.Authorization/roleDefinitions/b86a8fe4-44ce-4948-aee5-eccb2c155cd7"
    }
  }
  response_export_values = []
}
```

--------------------------------

### Grant Managed Identity Key Vault Secrets User Role

Source: https://github.com/azure/terraform-azurerm-avm-res-web-serverfarm/blob/main/examples/managed_instance/README.md

This snippet grants the 'Key Vault Secrets User' role to the managed identity of the App Service Plan. This allows the managed identity to read secrets from the Key Vault, which is required for registry adapters and storage mount credentials.

```terraform
resource "azapi_resource" "role_assignment_kv_secrets_user" {
  name      = "c2d3e4f5-a6b7-8901-bcde-f12345678902"
  parent_id = azapi_resource.key_vault.id
  type      = "Microsoft.Authorization/roleAssignments@2022-04-01"
  body = {
    properties = {
      principalId      = azapi_resource.managed_identity.output.properties.principalId
      principalType    = "ServicePrincipal"
      roleDefinitionId = "/subscriptions/${data.azapi_client_config.this.subscription_id}/providers/Microsoft.Authorization/roleDefinitions/4633458b-17de-408a-b874-0445c86b69e6"
    }
  }
  response_export_values = []
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.