Skip to content

Module Registry

The Module Registry page lists the Terraform modules that your organisation publishes in a private module registry, with their versions and download links. It lets a workload team find the approved module for a resource and pick a version without leaving the portal.

The page appears in the menu only when the feature flag features.moduleRegistry is on. The portal does not host the modules itself; it reads them from the registry you configure.

What you can do

Action Detail
Browse modules The list shows each module by namespace/name/provider
Look at versions Each module has a list of published versions, with README and changelog per version
Download A version downloads as <namespace>-<name>-<provider>-<version>.zip
Upload or delete a version Only when the second flag, features.moduleRegistryUpdate, is on. Otherwise the portal answers with HTTP 403

Read-only by default

Upload and delete are separate from browse. A team that only needs to look things up never needs the update flag.

How it works

The portal backend calls the registry with a bearer token. It requests the token with its own managed identity (DefaultAzureCredential) for the configured token scope. The backend then exposes two routes to the web app:

Route Purpose
GET /api/module-registry/terraform/modules List modules
GET .../terraform/modules/<ns>/<name>/<provider>/versions List versions of one module
GET .../terraform/modules/<ns>/<name>/<provider>/<version>/readme Read the README of a version
GET .../terraform/modules/<ns>/<name>/<provider>/<version>/changelog Read the changelog of a version
GET .../terraform/modules/<ns>/<name>/<provider>/<version>/download Download a version
POST and DELETE on .../<ns>/<name>/<provider>/<version> Upload or delete a version (needs the update flag)

The registry must therefore accept Entra ID tokens for the identity of the portal. Which registry product you use is outside the scope of this page; the portal talks to a registry that exposes the Terraform module registry protocol.

Setup

For the platform team. The configuration lives in the app settings of the environment:

Setting Purpose
features.moduleRegistry Shows the page and enables the backend
features.moduleRegistryUpdate Enables upload and delete
moduleRegistry.baseUrl (app setting MODULE_REGISTRY_BASE_URL) URL of the registry
moduleRegistry.tokenScope (app setting MODULE_REGISTRY_TOKEN_SCOPE) Scope for the token request
moduleRegistry.tenantId (app setting MODULE_REGISTRY_TENANT_ID, optional) Tenant to request the token from, when it differs from the home tenant

If the registry is reachable only over a private network, the App Service needs a route to it through the VNet integration of the environment. See Architecture.