ZPA App Connector

https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules
Admin
Terraform Reusable Modules for ZPA App Connector VMs on Azure
Tokens:18,323
Snippets:123
Trust Score:8.2
License:MIT
Update:1 year ago
Show doc for...
Tokens:
Raw
### Deploy Zscaler Base Type (Guided)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Execute the `zsac` bash script from the examples directory for a guided deployment. The script handles authentication, configuration, Terraform download, initialization, and application, requiring user confirmation.

```bash
./zsac up
```

--------------------------------

### Deploy Zscaler App Connector Cluster (Greenfield)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/README.md

This snippet outlines the steps for a greenfield deployment, suitable for building an entire cluster from scratch, such as for a Customer Demo/PoC or dev-test environment. It involves navigating to the examples directory, optionally configuring `terraform.tfvars`, and executing the `zsac up` script with the 'greenfield' option.

```bash
cd examples
Optional: Edit the terraform.tfvars file under your desired deployment type (ie: base_ac) to setup your App Connector Group (Details are documented inside the file)
- ./zsac up
- enter "greenfield"
- enter <desired deployment type>
- follow prompts for any additional configuration inputs. *keep in mind, any modifications done to terraform.tfvars first will override any inputs from the zsac script*
- script will detect client operating system and download/run a specific version of terraform in a temporary bin directory
- inputs will be validated and terraform init/apply will automatically exectute.
- verify all resources that will be created/modified and enter "yes" to confirm
```

--------------------------------

### Destroy Zscaler Base Type (Guided)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Initiate the guided destruction process by running the `zsac` bash script from the examples directory.

```bash
./zsac destroy
```

--------------------------------

### Deploy Zscaler App Connector Cluster (Brownfield)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/README.md

This snippet provides the steps for brownfield deployments, which are more suitable for production environments and offer extensive customization. It involves navigating to the examples directory, optionally configuring `terraform.tfvars`, and executing the `zsac up` script with the 'brownfield' option.

```bash
cd examples
Optional: Edit the terraform.tfvars file under your desired deployment type (ie: ac) to setup your App Connector (Details are documented inside the file)
- ./zsac up
- enter "brownfield"
- enter <desired deployment type>
- follow prompts for any additional configuration inputs. *keep in mind, any modifications done to terraform.tfvars first will override any inputs from the zsac script*
- script will detect client operating system and download/run a specific version of terraform in a temporary bin directory
- inputs will be validated and terraform init/apply will automatically exectute.
- verify all resources that will be created/modified and enter "yes" to confirm
```

--------------------------------

### Deploy Zscaler 'Base_ac' with Guided Script

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base_ac/README.md

Instructions for deploying the Zscaler 'Base_ac' environment using the `zsac` bash script, which automates authentication and configuration. The script guides the user through required inputs.

```Bash
./zsac up
```

--------------------------------

### Install Semantic Release Tools Globally

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/docs/contributing.md

Installs necessary Node.js packages globally for `semantic-release`, including core, git, exec plugins, and conventional changelog, required for testing and publishing releases.

```Shell
npm install -g semantic-release@^17.1.1 @semantic-release/git@^9.0.0 @semantic-release/exec@^5.0.0 conventional-changelog-conventionalcommits@^4.4.0
```

--------------------------------

### Deploy Zscaler App Connectors (Guided)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/ac/README.md

This option uses the `zsac` bash script to guide the user through the deployment process. It handles authentication, configuration, and automatically executes Terraform commands. Users will be prompted to confirm resource creation.

```Bash
./zsac up
# enter "brownfield"
# enter "ac"
# follow the remainder of the authentication and configuration input prompts.
# script will detect client operating system and download/run a specific version of terraform in a temporary bin directory
# inputs will be validated and terraform init/apply will automatically exectute.
# verify all resources that will be created/modified and enter "yes" to confirm
```

--------------------------------

### Zscaler App Connector Greenfield Deployment Types

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/README.md

This section defines the available deployment types for greenfield setups, detailing the Azure resources created by each. 'base' creates foundational networking and a bastion host without App Connectors, while 'base_ac' extends 'base' by adding an App Connector private subnet and VMs.

```APIDOC
Deployment Type: (base | base_ac )

**base**:
  - Creates: 1 Resource Group
  - Contains: 1 VNet w/ 1 subnet (public/bastion)
  - Includes: 1 Ubuntu Bastion Host w/ 1 PIP + 1 Network Interface + NSG
  - Generates: local key pair .pem file for ssh access
  - Note: This does NOT deploy any actual App Connectors.

**base_ac**:
  - Extends: Base deployment
  - Creates: 1 App Connector private subnet
  - Deploys: 2 App Connector VMs in an availability set (or zones if supported and specified) each with a single network interface and NIC NSG
```

--------------------------------

### Destroy Zscaler App Connector Cluster Resources

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/README.md

This snippet provides the command to destroy all resources associated with the Zscaler App Connector cluster deployed using the `zsac` script. Users must navigate to the examples directory and confirm the destruction process.

```bash
cd examples
- ./zsac destroy
- verify all resources that will be destroyed and enter "yes" to confirm
```

--------------------------------

### Destroy Zscaler App Connectors (Guided)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/ac/README.md

This option uses the `zsac` bash script to guide the user through the destruction process, removing all provisioned resources.

```Bash
./zsac destroy
```

--------------------------------

### Set AUTO_APPROVE Environment Variable

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/README.md

Instructions on how to set the `AUTO_APPROVE` environment variable to enable automatic approval for deployments. This variable, when set to `1`, streamlines the deployment process by bypassing manual approval steps.

```Shell
export AUTO_APPROVE=1
```

--------------------------------

### Zscaler App Connector Brownfield Deployment Types

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/README.md

This section describes the 'ac' brownfield deployment type, which creates a comprehensive App Connector setup including networking, VMs, and NAT Gateway. It highlights the significant customization options available through `terraform.tfvars` for integrating with existing Azure resources like Resource Groups, VNets, and subnets.

```APIDOC
Deployment Type: (ac)

**ac**:
  - Creates: 1 Resource Group
  - Contains: 1 VNet w/ 1 AC subnet
  - Deploys: 2 App Connectors in availability set (or zones if supported and enabled) with a single network interface and NIC NSG
  - Includes: 1 PIP + 1 NAT Gateway (or one per zone)
  - Generates: local key pair .pem file for ssh access
  - Customization: Number of App Connectors deployed and ability to use existing resources (resource group(s), VNet/Subnets, PIP, NAT GW) customizable within terraform.tfvars custom variables.

Custom Parameters (within terraform.tfvars):
  - BYO existing Resource Group
  - BYO existing PIPs
  - BYO existing NAT Gateways and associations
  - BYO existing VNet
  - BYO existing subnets
```

--------------------------------

### Configure Deployment Type with dtype Environment Variable

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/README.md

Guidance on defining the deployment type using the `dtype` environment variable. This allows specifying different deployment configurations, such as `base_ac` for a base application connector, to tailor the module's behavior.

```Shell
export dtype=base_ac
```

--------------------------------

### Destroy Zscaler 'Base_ac' with Guided Script

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base_ac/README.md

Instructions for destroying the Zscaler 'Base_ac' environment using the `zsac` bash script. This option simplifies the cleanup process.

```Bash
./zsac destroy
```

--------------------------------

### Terraform Module Inputs

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-bastion-azure/README.md

Defines the configurable input variables for this Terraform module, including their descriptions, types, default values, and whether they are required.

```APIDOC
bastion_nsg_source_prefix:
  Description: user input for locking down SSH access to bastion to a specific IP or CIDR range
  Type: string
  Default: "*"
  Required: no
global_tags:
  Description: Populate any custom user defined tags from a map
  Type: map(string)
  Default: "{}"
  Required: no
instance_image_offer:
  Description: The Bastion Host Ubuntu image offer
  Type: string
  Default: "0001-com-ubuntu-server-jammy"
  Required: no
instance_image_publisher:
  Description: The Bastion Host Ubuntu image publisher
  Type: string
  Default: "Canonical"
  Required: no
instance_image_sku:
  Description: The Bastion Host Ubuntu image sku
  Type: string
  Default: "22_04-lts"
  Required: no
instance_image_version:
  Description: The Bastion Host Ubuntu image version
  Type: string
  Default: "latest"
  Required: no
instance_size:
  Description: The Azure image type/size
  Type: string
  Default: "Standard_B1s"
  Required: no
location:
  Description: ZPA App Connector Azure Region
  Type: string
  Default: n/a
  Required: yes
name_prefix:
  Description: A prefix to associate to all the Bastion Host module resources
  Type: string
  Default: null
  Required: no
public_subnet_id:
  Description: The id of public subnet where the bastion host has to be attached
  Type: string
  Default: n/a
  Required: yes
resource_group:
  Description: Main Resource Group Name
  Type: string
  Default: n/a
  Required: yes
resource_tag:
  Description: A tag to associate to all the Bastion Host module resources
  Type: string
  Default: null
  Required: no
server_admin_username:
  Description: Username configured for the Bastion Host root/admin account
  Type: string
  Default: "ubuntu"
  Required: no
ssh_key:
  Description: SSH Key for instances
  Type: string
  Default: n/a
  Required: yes
```

--------------------------------

### Terraform Module Resources

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-bastion-azure/README.md

Details the Azure resources created and managed by this Terraform module, including their types and links to their documentation.

```APIDOC
azurerm_linux_virtual_machine.bastion_vm:
  Type: resource
azurerm_marketplace_agreement.bastion_agreement:
  Type: resource
azurerm_network_interface.bastion_nic:
  Type: resource
azurerm_network_interface_security_group_association.bastion_nic_association:
  Type: resource
azurerm_network_security_group.bastion_nsg:
  Type: resource
azurerm_public_ip.bastion_pip:
  Type: resource
```

--------------------------------

### Accept Azure Marketplace Terms for Zscaler App Connector VM Image

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-acvm-azure/README.md

This command-line interface (CLI) snippet demonstrates how to view and accept the Azure Marketplace terms for the Zscaler App Connector VM image. Accepting these terms is a prerequisite for deploying the App Connector VM in Azure. This operation can be performed via Azure Portal, Cloud Shell, or az CLI/PowerShell with appropriate administrative permissions.

```sh
az vm image terms show --urn zscaler:zscaler-private-access:zpa-con-azure:latest
az vm image terms accept --urn zscaler:zscaler-private-access:zpa-con-azure:latest
```

--------------------------------

### Terraform Module Providers

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-bastion-azure/README.md

Lists the Terraform providers utilized by this module.

```APIDOC
Name: azurerm
  Version: ~> 3.113.0
```

--------------------------------

### Deploy Zscaler Base Type (Manual)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Manually deploy by modifying `base/terraform.tfvars` and executing Terraform commands from the base directory. This involves initializing Terraform and applying the configuration.

```terraform
terraform init
terraform apply
```

--------------------------------

### Input Variable: name_prefix

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

A string prefix to associate with all network module resources created by this module. This helps in organizing and identifying resources. Defaults to `null`.

```APIDOC
name_prefix:
  Type: string
  Default: null
  Required: no
```

--------------------------------

### Terraform AzureRM ZPA App Connector Module Resources Overview

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/ac/README.md

This section provides a structured list of all Terraform resources configured for the AzureRM ZPA App Connector Modules. Each entry specifies the resource name, its type, and a direct link to the official HashiCorp Terraform Registry documentation for further details on its properties and usage.

```APIDOC
Resources:
  - Name: local_file.private_key
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file
  - Name: local_file.testbed
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file
  - Name: local_file.user_data_file
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file
  - Name: random_string.suffix
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string
  - Name: tls_private_key.key
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key
```

--------------------------------

### Terraform ZPA App Connector Provisioning Key Module Outputs

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zpa-provisioning-key/README.md

Describes the output values exposed by the ZPA App Connector Provisioning Key Terraform module, providing access to the created or referenced provisioning key details.

```APIDOC
Output Variables:
  provisioning_key:
    Description: ZPA Provisioning Key Output
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-bastion-azure/README.md

Specifies the minimum required versions for Terraform and the AzureRM provider for this module.

```APIDOC
Name: terraform
  Version: >= 0.13.7, < 2.0.0
Name: azurerm
  Version: ~> 3.113.0
```

--------------------------------

### Terraform Module Outputs

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-bastion-azure/README.md

Describes the output values exposed by this Terraform module upon successful deployment, providing information like the public IP address of the bastion host.

```APIDOC
public_ip:
  Description: Instance Public IP Address
```

--------------------------------

### Terraform Module Dependencies

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Lists the internal Terraform modules consumed by the Zscaler Base deployment, including their source paths.

```APIDOC
Modules:
  - Name: bastion
    Source: ../../modules/terraform-zsac-bastion-azure
    Version: n/a
  - Name: network
    Source: ../../modules/terraform-zsac-network-azure
    Version: n/a
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Lists the required Terraform versions and provider versions for the Zscaler Base deployment module.

```APIDOC
Requirements:
  - Name: terraform
    Version: ">= 0.13.7, < 2.0.0"
  - Name: azurerm
    Version: "~> 3.113.0"
  - Name: local
    Version: "~> 2.5.0"
  - Name: null
    Version: "~> 3.2.0"
  - Name: random
    Version: "~> 3.6.0"
  - Name: tls
    Version: "~> 4.0.0"
```

--------------------------------

### Terraform Module Resources

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Enumerates the specific Terraform resources managed by the Zscaler Base deployment, including their types and links to documentation.

```APIDOC
Resources:
  - Name: local_file.private_key
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file
  - Name: local_file.testbed
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file
  - Name: random_string.suffix
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string
  - Name: tls_private_key.key
    Type: resource
    Documentation: https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key
```

--------------------------------

### Terraform Azure NSG Module API Reference

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-nsg-azure/README.md

Comprehensive API documentation for the Terraform Azure NSG module, detailing its requirements, providers, resources, input variables, and output values. This reference outlines how to configure and interact with the module.

```APIDOC
Requirements:
  terraform: >= 0.13.7, < 2.0.0
  azurerm: ~> 3.113.0

Providers:
  azurerm: ~> 3.113.0

Resources:
  azurerm_network_security_group.ac_nsg: resource
  azurerm_network_security_group.ac_nsg_selected: data source

Inputs:
  byo_nsg:
    Description: Bring your own network security group for App Connector
    Type: bool
    Default: false
    Required: no
  byo_nsg_names:
    Description: Management Network Security Group ID for App Connector association
    Type: list(string)
    Default: null
    Required: no
  global_tags:
    Description: Populate any custom user defined tags from a map
    Type: map(string)
    Default: {}
    Required: no
  location:
    Description: App Connector Azure Region
    Type: string
    Default: n/a
    Required: yes
  name_prefix:
    Description: A prefix to associate to all the NSG module resources
    Type: string
    Default: null
    Required: no
  nsg_count:
    Description: Default number of network security groups to create
    Type: number
    Default: 1
    Required: no
  resource_group:
    Description: Main Resource Group Name
    Type: string
    Default: n/a
    Required: yes
  resource_tag:
    Description: A tag to associate to all the NSG module resources
    Type: string
    Default: null
    Required: no

Outputs:
  ac_nsg_id:
    Description: Network Security Group ID
```

--------------------------------

### Input Variable: bastion_enabled

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

Determines whether a Bastion/Public Subnet should be configured. Set to `true` to enable this feature. Defaults to `false`.

```APIDOC
bastion_enabled:
  Type: bool
  Default: false
  Required: no
```

--------------------------------

### Deploy Zscaler App Connectors (Manual)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/ac/README.md

This option requires manual modification of the `terraform.tfvars` file and direct execution of Terraform commands from the `ac` directory. It provides more control over the deployment process.

```Terraform
terraform init
terraform apply
```

--------------------------------

### Terraform Module Providers

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Details the Terraform providers used by the Zscaler Base deployment module and their versions.

```APIDOC
Providers:
  - Name: local
    Version: "~> 2.5.0"
  - Name: random
    Version: "~> 3.6.0"
  - Name: tls
    Version: "~> 4.0.0"
```

--------------------------------

### Input Variable: base_only

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

A boolean flag that, when set to `true`, configures a base deployment type including workload and bastion hosts but without App Connector resources. This setting will route workload traffic directly to the Internet. Defaults to `false`.

```APIDOC
base_only:
  Type: bool
  Default: false
  Required: no
```

--------------------------------

### Terraform ZPA App Connector Provisioning Key Module Inputs

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zpa-provisioning-key/README.md

Defines the configurable input variables for the ZPA App Connector Provisioning Key Terraform module. These variables control the creation and behavior of the provisioning key.

```APIDOC
Input Variables:
  app_connector_group_id:
    Description: ID of App Connector Group from zpa-app-connector-group module
    Type: string
    Default: null
    Required: no
  byo_provisioning_key:
    Description: Bring your own App Connector Provisioning Key. Setting this variable to true will effectively instruct this module to not create any resources and only reference data resources from values provided in byo_provisioning_key_name
    Type: bool
    Default: false
    Required: no
  byo_provisioning_key_name:
    Description: Existing App Connector Provisioning Key name
    Type: string
    Default: null
    Required: no
  enrollment_cert:
    Description: Get name of ZPA enrollment cert to be used for App Connector provisioning
    Type: string
    Default: "Connector"
    Required: no
  provisioning_key_association_type:
    Description: Specifies the provisioning key type for App Connectors or ZPA Private Service Edges. The supported values are CONNECTOR_GRP and SERVICE_EDGE_GRP
    Type: string
    Default: "CONNECTOR_GRP"
    Required: no
  provisioning_key_enabled:
    Description: Whether the provisioning key is enabled or not. Default: true
    Type: bool
    Default: true
    Required: no
  provisioning_key_max_usage:
    Description: The maximum number of instances where this provisioning key can be used for enrolling an App Connector or Service Edge
    Type: number
    Default: n/a
    Required: yes
  provisioning_key_name:
    Description: Name of the provisioning key
    Type: string
    Default: n/a
    Required: yes
```

--------------------------------

### Terraform Azure ZPA App Connector Module Inputs

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

Defines the configurable input variables for the Terraform Azure ZPA App Connector module. These variables allow users to customize network settings, resource tagging, and availability zone deployment.

```APIDOC
Module Inputs:
  network_address_space:
    Description: VNet IP CIDR Range. All subnet resources that might get created (public, app connector) are derived from this /16 CIDR. If you require creating a VNet smaller than /16, you may need to explicitly define all other subnets via public_subnets and ac_subnets, variables
    Type: string
    Default: "10.1.0.0/16"
    Required: no
  public_subnets:
    Description: Public/Bastion Subnets to create in VNet. This is only required if you want to override the default subnets that this code creates via network_address_space variable.
    Type: list(string)
    Default: null
    Required: no
  resource_tag:
    Description: A tag to associate to all the network module resources
    Type: string
    Default: null
    Required: no
  zones:
    Description: Specify which availability zone(s) to deploy VM resources in if zones_enabled variable is set to true
    Type: list(string)
    Default: ["1"]
    Required: no
  zones_enabled:
    Description: Determine whether to provision App Connector VMs explicitly in defined zones (if supported by the Azure region provided in the location variable). If left false, Azure will automatically choose a zone and module will create an availability set resource instead for VM fault tolerance
    Type: bool
    Default: false
    Required: no
```

--------------------------------

### Input Variable: global_tags

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

Allows populating any custom user-defined tags from a map. This enables adding metadata to resources created by the module. Defaults to an empty map.

```APIDOC
global_tags:
  Type: map(string)
  Default: {}
  Required: no
```

--------------------------------

### Merge Develop Branch into Master and Push

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/docs/contributing.md

Switches to the `master` branch, merges the `develop` branch into it, and then pushes the changes to the `origin` remote. This action triggers GitHub Actions for building and tagging the release.

```Shell
git checkout master
git merge develop
git push origin master
```

--------------------------------

### Synchronize Develop Branch with Master After Release

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/docs/contributing.md

Fetches all remote branches and tags, pulls changes from `origin/master`, switches to the `develop` branch, merges `master` into `develop`, and pushes the updated `develop` branch to `origin`. This ensures the `develop` branch includes any commits made by the release bot.

```Shell
git fetch --all --tags
git pull origin master
git checkout develop
git merge master
git push origin develop
```

--------------------------------

### Terraform Azure ZPA App Connector Module Outputs

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-acvm-azure/README.md

Lists the output values provided by the Zscaler App Connector Terraform module upon successful deployment. These outputs can be used by other Terraform modules or for reference.

```APIDOC
Outputs:
  ac_hostname:
    Description: Instance Host Name
  private_ip:
    Description: Instance Management Interface Private IP Address
```

--------------------------------

### Manually Deploy Zscaler 'Base_ac' with Terraform

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base_ac/README.md

Steps to manually initialize and apply the Terraform configuration for the 'Base_ac' deployment type. This requires modifying the `terraform.tfvars` file beforehand.

```Terraform
terraform init
terraform apply
```

--------------------------------

### Terraform Module Resources for ZPA App Connector Group

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zpa-app-connector-group/README.md

Lists the Zscaler ZPA resources managed by this Terraform module, specifically the `zpa_app_connector_group` resource.

```APIDOC
Resources:
  zpa_app_connector_group.app_connector_group: resource (https://registry.terraform.io/providers/zscaler/zpa/latest/docs/resources/app_connector_group)
```

--------------------------------

### Terraform Azure ZPA App Connector Module Inputs

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-acvm-azure/README.md

Defines the configurable input variables for the Zscaler App Connector Terraform module, including their types, default values, and whether they are required. These inputs allow customization of the App Connector deployment.

```APIDOC
Inputs:
  ac_count:
    Description: The number of App Connectors to deploy. Validation assumes max for /24 subnet but could be smaller or larger as long as subnet can accommodate
    Type: number
    Default: 1
    Required: no
  ac_nsg_id:
    Description: App Connector management interface nsg id
    Type: list(string)
    Default: n/a
    Required: yes
  ac_subnet_id:
    Description: App Connector subnet id
    Type: list(string)
    Default: n/a
    Required: yes
  ac_username:
    Description: Default App Connector admin/root username
    Type: string
    Default: "zsroot"
    Required: no
  acvm_image_offer:
    Description: Azure Marketplace Zscaler App Connector Image Offer
    Type: string
    Default: "zscaler-private-access"
    Required: no
  acvm_image_publisher:
    Description: Azure Marketplace Zscaler App Connector Image Publisher
    Type: string
    Default: "zscaler"
    Required: no
  acvm_image_sku:
    Description: Azure Marketplace Zscaler App Connector Image SKU
    Type: string
    Default: "zpa-con-azure"
    Required: no
  acvm_image_version:
    Description: Azure Marketplace App Connector Image Version
    Type: string
    Default: "latest"
    Required: no
  acvm_instance_type:
    Description: App Connector Image size
    Type: string
    Default: "Standard_D4s_v3"
    Required: no
  global_tags:
    Description: Populate any custom user defined tags from a map
    Type: map(string)
    Default: "{}"
    Required: no
  location:
    Description: App Connector Azure Region
    Type: string
    Default: n/a
    Required: yes
  name_prefix:
    Description: A prefix to associate to all the AC VM module resources
    Type: string
    Default: null
    Required: no
  resource_group:
    Description: Main Resource Group Name
    Type: string
    Default: n/a
    Required: yes
  resource_tag:
    Description: A tag to associate to all the AC VM module resources
    Type: string
    Default: null
    Required: no
  ssh_key:
    Description: SSH Key for instances
    Type: string
    Default: n/a
    Required: yes
  user_data:
    Description: Cloud Init data
    Type: string
    Default: n/a
    Required: yes
  zones:
    Description: Specify which availability zone(s) to deploy VM resources in if zones_enabled variable is set to true
    Type: list(string)
    Default: "[\n  \"1\"\n]"
    Required: no
  zones_enabled:
    Description: Determine whether to provision App Connector VMs explicitly in defined zones (if supported by the Azure region provided in the location variable). If left false, Azure will automatically choose a zone and module will create an availability set resource instead for VM fault tolerance
    Type: bool
    Default: false
    Required: no
```

--------------------------------

### Terraform Azure ZPA App Connector Module Input Variables

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/ac/README.md

Defines the configurable input parameters for the Zscaler Terraform Azure App Connector module. Each variable specifies a particular aspect of the module's deployment, including network settings, naming, and provisioning options, along with its data type, purpose, and default value.

```APIDOC
Input: existing_nat_gw_subnet_association
  Description: Set this to true only if both byo_nat_gws and byo_subnets variables are true. this implies that there are already NAT Gateway resources associated to subnets where App Connectors are being deployed to
  Type: bool
  Default: false
  Required: no
```

```APIDOC
Input: name_prefix
  Description: The name prefix for all your resources
  Type: string
  Default: "zsdemo"
  Required: no
```

```APIDOC
Input: network_address_space
  Description: VNet IP CIDR Range. All subnet resources that might get created (public, app connector) are derived from this /16 CIDR. If you require creating a VNet smaller than /16, you may need to explicitly define all other subnets via public_subnets and ac_subnets variables
  Type: string
  Default: "10.1.0.0/16"
  Required: no
```

```APIDOC
Input: owner_tag
  Description: Customer defined owner tag value. ie: Org, Dept, username, etc.
  Type: string
  Default: "zsac-admin"
  Required: no
```

```APIDOC
Input: provisioning_key_association_type
  Description: Specifies the provisioning key type for App Connectors or ZPA Private Service Edges. The supported values are CONNECTOR_GRP and SERVICE_EDGE_GRP
  Type: string
  Default: "CONNECTOR_GRP"
  Required: no
```

```APIDOC
Input: provisioning_key_enabled
  Description: Whether the provisioning key is enabled or not. Default: true
  Type: bool
  Default: true
  Required: no
```

```APIDOC
Input: provisioning_key_max_usage
  Description: The maximum number of instances where this provisioning key can be used for enrolling an App Connector or Service Edge
  Type: number
  Default: 10
  Required: no
```

```APIDOC
Input: public_subnets
  Description: Public/Bastion Subnets to create in VNet. This is only required if you want to override the default subnets that this code creates via network_address_space variable.
  Type: list(string)
  Default: null
  Required: no
```

```APIDOC
Input: reuse_nsg
  Description: Specifies whether the NSG module should create 1:1 network security groups per instance or 1 network security group for all instances
  Type: bool
  Default: "false"
  Required: no
```

```APIDOC
Input: tls_key_algorithm
  Description: algorithm for tls_private_key resource
  Type: string
  Default: "RSA"
  Required: no
```

```APIDOC
Input: zones
  Description: Specify which availability zone(s) to deploy VM resources in if zones_enabled variable is set to true
  Type: list(string)
  Default: [
  "1"
]
  Required: no
```

```APIDOC
Input: zones_enabled
  Description: Determine whether to provision App Connector VMs explicitly in defined zones (if supported by the Azure region provided in the location variable). If left false, Azure will automatically choose a zone and module will create an availability set resource instead for VM fault tolerance
  Type: bool
  Default: false
  Required: no
```

--------------------------------

### Terraform Provider Dependencies for Zscaler App Connector Modules

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/README.md

Lists the specific Terraform providers and their minimum required versions that are necessary for successfully deploying Zscaler App Connectors on Azure using these modules.

```APIDOC
Terraform Providers:
  - registry.terraform.io/hashicorp/azurerm: v3.113.x
  - registry.terraform.io/hashicorp/random: v3.6.x
  - registry.terraform.io/hashicorp/local: v2.5.x
  - registry.terraform.io/hashicorp/null: v3.2.x
  - registry.terraform.io/providers/hashicorp/tls: v4.0.x
  - registry.terraform.io/providers/zscaler/zpa: v3.31.x
```

--------------------------------

### Terraform Azure ZPA App Connector Module Input Variables

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base/README.md

Defines the configurable input variables for the Azure ZPA App Connector Terraform module, including their types, default values, and whether they are required. These variables allow customization of resource deployment, such as region, naming conventions, network addressing, and availability zone settings.

```APIDOC
Input Variables:
  arm_location:
    Description: The Azure Region where resources are to be deployed
    Type: string
    Default: "westus2"
    Required: no
  bastion_nsg_source_prefix:
    Description: User input for locking down SSH access to bastion to a specific IP or CIDR range. Defaults to any IP
    Type: string
    Default: "*"
    Required: no
  environment:
    Description: Customer defined environment tag. ie: Dev, QA, Prod, etc.
    Type: string
    Default: "Development"
    Required: no
  name_prefix:
    Description: The name prefix for all your resources
    Type: string
    Default: "zsdemo"
    Required: no
  network_address_space:
    Description: VNet IP CIDR Range. All subnet resources that might get created (public, app connector) are derived from this /16 CIDR. If you require creating a VNet smaller than /16, you may need to explicitly define all other subnets via public_subnets and ac_subnets variables
    Type: string
    Default: "10.1.0.0/16"
    Required: no
  owner_tag:
    Description: Customer defined owner tag value. ie: Org, Dept, username, etc.
    Type: string
    Default: "zsac-admin"
    Required: no
  public_subnets:
    Description: Public/Bastion Subnets to create in VNet. This is only required if you want to override the default subnets that this code creates via network_address_space variable.
    Type: list(string)
    Default: null
    Required: no
  tls_key_algorithm:
    Description: algorithm for tls_private_key resource
    Type: string
    Default: "RSA"
    Required: no
  zones:
    Description: Specify which availability zone(s) to deploy VM resources in if zones_enabled variable is set to true
    Type: list(string)
    Default: [
  "1"
]
    Required: no
  zones_enabled:
    Description: Determine whether to provision App Connector VMs explicitly in defined zones (if supported by the Azure region provided in the location variable). If left false, Azure will automatically choose a zone and module will create an availability set resource instead for VM fault tolerance
    Type: bool
    Default: false
    Required: no
```

--------------------------------

### Terraform Module Input Variables for ZPA App Connector Group

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zpa-app-connector-group/README.md

Defines the configurable input variables for the ZPA App Connector Group module, including their types, default values, and whether they are required for module instantiation.

```APIDOC
Inputs:
  app_connector_group_country_code:
    Description: Optional: Country code of this App Connector Group. example 'US'
    Type: string
    Default: ""
    Required: no
  app_connector_group_description:
    Description: Optional: Description of the App Connector Group
    Type: string
    Default: ""
    Required: no
  app_connector_group_dns_query_type:
    Description: Whether to enable IPv4 or IPv6, or both, for DNS resolution of all applications in the App Connector Group
    Type: string
    Default: "IPV4_IPV6"
    Required: no
  app_connector_group_enabled:
    Description: Whether this App Connector Group is enabled or not
    Type: bool
    Default: true
    Required: no
  app_connector_group_latitude:
    Description: Latitude of the App Connector Group. Integer or decimal. With values in the range of -90 to 90
    Type: string
    Default: n/a
    Required: yes
  app_connector_group_location:
    Description: location of the App Connector Group in City, State, Country format. example: 'San Jose, CA, USA'
    Type: string
    Default: n/a
    Required: yes
  app_connector_group_longitude:
    Description: Longitude of the App Connector Group. Integer or decimal. With values in the range of -90 to 90
    Type: string
    Default: n/a
    Required: yes
  app_connector_group_name:
    Description: Name of the App Connector Group
    Type: string
    Default: n/a
    Required: yes
  app_connector_group_override_version_profile:
    Description: Optional: Whether the default version profile of the App Connector Group is applied or overridden. Default: false
    Type: bool
    Default: true
    Required: no
  app_connector_group_upgrade_day:
    Description: Optional: App Connectors in this group will attempt to update to a newer version of the software during this specified day. Default value: SUNDAY. List of valid days (i.e., SUNDAY, MONDAY, etc)
    Type: string
    Default: "SUNDAY"
    Required: no
  app_connector_group_upgrade_time_in_secs:
    Description: Optional: App Connectors in this group will attempt to update to a newer version of the software during this specified time. Default value: 66600. Integer in seconds (i.e., 66600). The integer should be greater than or equal to 0 and less than 86400, in 15 minute intervals
    Type: string
    Default: "66600"
    Required: no
  app_connector_group_version_profile_id:
    Description: Optional: ID of the version profile. To learn more, see Version Profile Use Cases. https://help.zscaler.com/zpa/configuring-version-profile
    Type: string
    Default: "2"
    Required: no
```

--------------------------------

### Terraform Provider and Module Requirements

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base_ac/README.md

Lists the required Terraform versions and provider versions for the 'Base_ac' deployment. These dependencies ensure compatibility and proper functionality of the Terraform configuration.

```APIDOC
Requirements:
  terraform: >= 0.13.7, < 2.0.0
  azurerm: ~> 3.113.0
  local: ~> 2.5.0
  null: ~> 3.2.0
  random: ~> 3.6.0
  tls: ~> 4.0.0
  zpa: ~> 3.31.0
```

--------------------------------

### Perform a Dry Run of Semantic Release on Develop Branch

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/docs/contributing.md

Executes `semantic-release` in dry-run mode on the `develop` branch to verify the next version calculation and release notes generation without making actual changes. This step is crucial for validating the release configuration.

```Shell
semantic-release --dry-run --no-ci --branches=develop
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/ac/README.md

Lists the required Terraform providers and modules for the Zscaler App Connector deployment, specifying their names and version constraints. This section is crucial for setting up the development environment and ensuring compatibility.

```APIDOC
Requirements:
  terraform: Version >= 0.13.7, < 2.0.0
  azurerm: Version ~> 3.113.0
  local: Version ~> 2.5.0
  null: Version ~> 3.2.0
  random: Version ~> 3.6.0
  tls: Version ~> 4.0.0
  zpa: Version ~> 3.31.0

Providers:
  local: Version ~> 2.5.0
  random: Version ~> 3.6.0
  tls: Version ~> 4.0.0

Modules:
  ac_nsg:
    Source: ../../modules/terraform-zsac-nsg-azure
    Version: n/a
  ac_vm:
    Source: ../../modules/terraform-zsac-acvm-azure
    Version: n/a
  network:
    Source: ../../modules/terraform-zsac-network-azure
    Version: n/a
  zpa_app_connector_group:
    Source: ../../modules/terraform-zpa-app-connector-group
    Version: n/a
  zpa_provisioning_key:
    Source: ../../modules/terraform-zpa-provisioning-key
    Version: n/a
```

--------------------------------

### Terraform Input: app_connector_group_description (App Connector Group Description)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/base_ac/README.md

Optional: Provides a descriptive text for the App Connector Group.

```APIDOC
Name: app_connector_group_description
Description: Optional: Description of the App Connector Group
Type: string
Default: "This App Connector Group belongs to: "
Required: no
```

--------------------------------

### Input Variable: location

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

Specifies the Azure Region where the App Connector resources will be deployed. This is a mandatory input variable.

```APIDOC
location:
  Type: string
  Default: n/a
  Required: yes
```

--------------------------------

### Terraform Module Output Variables for ZPA App Connector Group

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zpa-app-connector-group/README.md

Describes the output variables provided by the ZPA App Connector Group module, which can be referenced by other Terraform configurations.

```APIDOC
Outputs:
  app_connector_group_id:
    Description: ZPA App Connector Group ID
```

--------------------------------

### Terraform Module Requirements

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

This section lists the minimum and maximum version requirements for Terraform and its associated providers that are necessary for this module to function correctly. These requirements ensure compatibility and stability across different environments.

```APIDOC
Name        Version
terraform   >= 0.13.7, < 2.0.0
azurerm     ~> 3.113.0
local       ~> 2.5.0
null        ~> 3.2.0
```

--------------------------------

### Input Variable: byo_nat_gws

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/modules/terraform-zsac-network-azure/README.md

A boolean flag to indicate whether to use existing Azure NAT Gateways. Set to `true` to bring your own NAT Gateways. Defaults to `false`.

```APIDOC
byo_nat_gws:
  Type: bool
  Default: false
  Required: no
```

--------------------------------

### Zscaler Private Access (ZPA) API Key Requirements for Automated Onboarding

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/README.md

Outlines the necessary Zscaler Private Access (ZPA) API credentials, including Client ID, Client Secret, and Customer ID, required for automated onboarding of App Connectors. It also mentions the optional use of an existing App Connector Group and Provisioning Key.

```APIDOC
Zscaler ZPA API Requirements:
  - Valid Zscaler Private Access subscription and portal access
  - ZPA API Keys:
    - Client ID
    - Client Secret
    - Customer ID
  - (Optional) Existing App Connector Group and Provisioning Key
```

--------------------------------

### Enable Bring Your Own App Connector Provisioning Key (Terraform)

Source: https://github.com/zscaler/terraform-azurerm-zpa-app-connector-modules/blob/master/examples/ac/README.md

A boolean flag to control whether the module should use an existing App Connector Provisioning Key. If set to `true`, the module will not create a new provisioning key and will instead reference the key specified by `byo_provisioning_key_name`. Defaults to `false`.

```Terraform
variable "byo_provisioning_key" {
  description = "Bring your own App Connector Provisioning Key. Setting this variable to true will effectively instruct this module to not create any resources and only reference data resources from values provided in byo_provisioning_key_name"
  type        = bool
  default     = false
  required    = false
}
```
Tokens:
Raw