In reading order.
Opening the Terraform Module Catalog with the library's flagship: how an App Service module bundles VNet integration, dual managed identities and Key Vault TLS into a surface app teams can fill in but not opt out of.
Reading the Function App module against its App Service sibling: the shared secure-hosting chassis, the runtime storage account and version knobs that are genuinely new, and what half-populated prod values teach about templates.
The smallest module in the catalog teaches the two biggest lessons: strict lookups that refuse to pass null downstream, and shared plans as standalone stacks that dozens of apps reference by nothing but a name.
The storage catalog entry is really five templates over one base module - blob, file, queue, table and static website - and the least-used wrapper is where every copy-paste defect in the estate went to hide.
The catalog's data-tier entry draws an unusually good boundary - the module owns the account and its security posture, raw resources own the data model - and its commented-out option menu doubles as accidental documentation.
How one Terraform template models an entire Event Hubs estate as nested lookup maps - hubs, capture, boolean-triplet authorization rules and consumer groups - and the type-unification trap hiding in its empty environments. Part 6 of the Terraform Module Catalog.
A Data Factory template whose most important code is not HCL - after apply, an Azure CLI step finds the factory and a PowerShell step PATCHes the ARM resource to enable CMK and disable public network access, because the provider couldn't. Part 7 of the Terraform Module Catalog.
The smallest template in the catalog - a hundred lines of Redis cache config - as a study in what even the simplest secure-PaaS wrapper must still carry, and the one pipeline typo that quietly broke environment isolation. Part 8 of the Terraform Module Catalog.
A search template that ships with "TBD" where partition and replica counts belong - so it cannot apply until someone makes a sizing decision - plus a three-way diagnostics choice documented entirely in commented-out code. Part 9 of the Terraform Module Catalog.
The catalog's most divergent template - a different module-source depth, extra pipeline-fed variables, a computed cluster name, CMK from a second Key Vault and a renamed provider alias - and what its dated Kubernetes pins say about version governance. Part 10 of the Terraform Module Catalog.
Inside the module with the biggest surface in the catalog: listener, pool, settings and probe objects cross-referenced by name, Key Vault TLS through a user-assigned identity, a private-by-default frontend - and a deliberately invalid placeholder IP that turns an unfilled template into a loud failure. Part 11 of the Terraform Module Catalog.
The classic Front Door template does global entry properly - custom domains behind WAF policies, Key Vault TLS, HTTP-to-HTTPS redirect rules - and then teaches by counterexample: a hardcoded ARM resource ID where a lookup map should be, and a missing environment key silently swallowed by a forgiving default. Part 12 of the Terraform Module Catalog.
The public DNS template exposes every record type - A, AAAA, CAA, CNAME, MX, PTR, SRV, TXT - as an optional object list on a single module, and its twelve-kilobyte README quietly becomes the reference manual. When one module with optional shapes beats fifteen micro-modules, and when it stops being true. Part 13 of the Terraform Module Catalog.
The catalog's cautionary tale: an empty variables.tf, no platform JSON, UPDATE placeholders for every value, one pvars file for four declared workspaces, a subscription ID hardcoded into the provider, and a pipeline with a leftover debug step - what shipping a half-finished golden template does to the two hundred copies made from it, and a checklist for done. Part 14 of the Terraform Module Catalog.
The catalog's finale: three child modules fanned out over locals maps turn AAD groups, APIM products and OpenAPI-imported APIs into reviewable code, map keys double as URL routing taxonomy, and policy XML gets environment-templated by a blunt string replace - plus a retrospective on what fifteen modules taught. Part 15 of the Terraform Module Catalog.
