Newest first, grouped by year. Search or filter by topic.
The catalog's finale: three child modules fanned out over locals maps turn AAD groups, APIM products and OpenAPI-imported APIs into reviewable code, map keys double as URL routing taxonomy, and policy XML gets environment-templated by a blunt string replace - plus a retrospective on what fifteen modules taught. Part 15 of the Terraform Module Catalog.
The public DNS template exposes every record type - A, AAAA, CAA, CNAME, MX, PTR, SRV, TXT - as an optional object list on a single module, and its twelve-kilobyte README quietly becomes the reference manual. When one module with optional shapes beats fifteen micro-modules, and when it stops being true. Part 13 of the Terraform Module Catalog.
The catalog's cautionary tale: an empty variables.tf, no platform JSON, UPDATE placeholders for every value, one pvars file for four declared workspaces, a subscription ID hardcoded into the provider, and a pipeline with a leftover debug step - what shipping a half-finished golden template does to the two hundred copies made from it, and a checklist for done. Part 14 of the Terraform Module Catalog.
The classic Front Door template does global entry properly - custom domains behind WAF policies, Key Vault TLS, HTTP-to-HTTPS redirect rules - and then teaches by counterexample: a hardcoded ARM resource ID where a lookup map should be, and a missing environment key silently swallowed by a forgiving default. Part 12 of the Terraform Module Catalog.
The catalog's most divergent template - a different module-source depth, extra pipeline-fed variables, a computed cluster name, CMK from a second Key Vault and a renamed provider alias - and what its dated Kubernetes pins say about version governance. Part 10 of the Terraform Module Catalog.
Inside the module with the biggest surface in the catalog: listener, pool, settings and probe objects cross-referenced by name, Key Vault TLS through a user-assigned identity, a private-by-default frontend - and a deliberately invalid placeholder IP that turns an unfilled template into a loud failure. Part 11 of the Terraform Module Catalog.
A search template that ships with "TBD" where partition and replica counts belong - so it cannot apply until someone makes a sizing decision - plus a three-way diagnostics choice documented entirely in commented-out code. Part 9 of the Terraform Module Catalog.
The smallest template in the catalog - a hundred lines of Redis cache config - as a study in what even the simplest secure-PaaS wrapper must still carry, and the one pipeline typo that quietly broke environment isolation. Part 8 of the Terraform Module Catalog.
A Data Factory template whose most important code is not HCL - after apply, an Azure CLI step finds the factory and a PowerShell step PATCHes the ARM resource to enable CMK and disable public network access, because the provider couldn't. Part 7 of the Terraform Module Catalog.
How one Terraform template models an entire Event Hubs estate as nested lookup maps - hubs, capture, boolean-triplet authorization rules and consumer groups - and the type-unification trap hiding in its empty environments. Part 6 of the Terraform Module Catalog.
The catalog's data-tier entry draws an unusually good boundary - the module owns the account and its security posture, raw resources own the data model - and its commented-out option menu doubles as accidental documentation.
The smallest module in the catalog teaches the two biggest lessons: strict lookups that refuse to pass null downstream, and shared plans as standalone stacks that dozens of apps reference by nothing but a name.
The storage catalog entry is really five templates over one base module - blob, file, queue, table and static website - and the least-used wrapper is where every copy-paste defect in the estate went to hide.
Reading the Function App module against its App Service sibling: the shared secure-hosting chassis, the runtime storage account and version knobs that are genuinely new, and what half-populated prod values teach about templates.
Opening the Terraform Module Catalog with the library's flagship: how an App Service module bundles VNet integration, dual managed identities and Key Vault TLS into a surface app teams can fill in but not opt out of.
The honest retrospective that closes the series - how template scaffolding metastasizes mistakes, why version pinning without governance curates a museum, what secrets in locals really cost, and the upgrade list I would run on this estate today. Part 12 of the Terraform on Azure series.
Three manually-run pipelines, one JSON config bag and a TDE certificate wrinkle - how live SQL Server databases moved into Azure SQL Managed Instance with LRS, and why all the project risk compresses into the sixty seconds around cutover. Part 11 of the Terraform on Azure series.
Azure Blueprints driven from Terraform with forty templated parameters, platform-level delete locks, twelve-hour timeouts and PowerShell bookends on both sides of the apply - how the estate's most dangerous resource got its most governed deployment. Part 10 of the Terraform on Azure series.
local-exec key minting, external data sources wrapping PowerShell, and a post-apply ARM PATCH - the imperative seams that held a declarative Azure estate together, and the idempotency, portability and security bills they ran up. Part 9 of the Terraform on Azure series.
Each Logic App in this Azure estate was split across four sibling stacks - runtime, workflows, APIM registration and service discovery - a clean lifecycle separation that quadrupled the folder, pipeline and state count per integration. Part 8 of the Terraform on Azure series.
The most-consumed custom module in an Azure Terraform estate wrote one Key Vault secret per service - a JSON record carrying a URL, a credential and a type - and quietly became the runtime service registry for scores of Function Apps and Logic App workflows. How it worked, what it got right, and where a registry with no registry starts to strain. Part 6 of the Terraform on Azure series.
With no terraform_remote_state anywhere in 230 stacks, every cross-stack reference in this Azure estate was a literal name string - a taxonomy you could read from ls, a coupling with zero runtime dependencies, and a silent-drift hazard on every rename. Part 7 of the Terraform on Azure series.
Nine thin custom Terraform modules carried the entire platform-integration story of an Azure estate. This part dissects the APIM-publication half - key minting through local-exec, SAS-splitting through PowerShell, twin modules one hyphen apart, and a typo frozen into dozens of source strings. Part 5 of the Terraform on Azure series.
Two generations of Terraform pipeline in one Azure estate - manual parameterized plan-and-apply consoles beside gated plan-artifact promotion - and why applying the exact plan you approved is the rung that matters. Part 4 of the Terraform on Azure series.
Empty backend blocks, per-environment storage accounts and a state file for every stack-environment pair - how one Azure estate partitioned a thousand Terraform states for blast radius, and what that sprawl cost. Part 3 of the Terraform on Azure series.
