Module Catalogue¶

The library has 30 modules: 21 in both technologies, 5 only in Bicep and 4 only in Terraform. This page groups them by service. It summarises what each module deploys. The authoritative reference is the generated README in the folder of each module (parameters, outputs, resource types and a minimal example). The repository root also has a template index with links to these READMEs.

Reference list, your library may differ

The catalogue shows the modules of the reference repository at the time of writing. Your platform team delivers a copy of this repository, at a version of their choice. Check the tags and the module folders in your copy (Use Managed Templates). Module names are the folder names, and they are the same in both technologies.

How to read the tables¶

TF and Bicep show whether the module exists in that technology. A dash means it does not exist.
A module can differ in parameters between Terraform and Bicep. The names follow the conventions of each technology.
Most modules call a module of the Azure Verified Modules (AVM) project of Microsoft and add the platform standards on top. Exceptions are in the Notes column.
Where the resource type supports it, modules offer the usual options: tags, locks, role assignments, managed identities, diagnostic settings and private endpoints, and where the policies require it these are fixed or enforced (Policy compliance).

Identity and security¶

Module	What it deploys	TF	Bicep	Notes
`user_assigned_identity`	A user-assigned managed identity	Yes	Yes
`key_vault`	A Key Vault, with keys, secrets and role assignments	Yes	Yes	The Terraform module forces a default network action of deny, switches legacy access policies off and sends the audit logs and all metrics to diagnostics.
`disk_encryption_set`	A disk encryption set for customer-managed keys on disks	-	Yes	Tries to set the permissions on the given Key Vault for the used identity.

Compute¶

Module	What it deploys	TF	Bicep	Notes
`virtual_machine_windows`	A Windows VM with one or more network interfaces and optional public IP addresses	Yes	Yes	Applies the Windows baseline guest configuration and installs the extensions that policies expect. Needs encryption at host and Defender for Cloud on the subscription.
`virtual_machine_linux`	A Linux VM with one or more network interfaces and optional public IP addresses	-	Yes	Applies the Linux baseline guest configuration. Same prerequisites as the Windows module.

For fully managed VMs with backup, patching and access, use the Managed VM module of the platform. The VM modules of this library only deploy the VM.

Containers¶

Module	What it deploys	TF	Bicep	Notes
`container_registry`	An Azure Container Registry	Yes	Yes
`containerinstance_containergroup`	A container instance group	Yes	Yes	The Terraform module calls a fork of the AVM module that the maintainers keep (Decision 0007).
`containerservice_managedcluster`	A managed Kubernetes cluster (AKS)	Yes	Yes	The Terraform examples include a cluster with virtual network integration.
`container_app`	An Azure Container App	Yes	-	Does not call an AVM resource module: it owns its resource logic and uses the `azapi` provider. Changes made outside Terraform to the `template` are not detected.

App hosting¶

Module	What it deploys	TF	Bicep
`serverfarm`	An App Service plan	Yes	Yes
`app_service_site_linux`	A Linux web app, with slots	Yes	Yes
`app_service_site_windows`	A Windows web app, with slots	Yes	Yes
`app_service_function_linux`	A Linux function app, with slots	Yes	Yes
`app_service_function_windows`	A Windows function app, with slots	Yes	Yes
`static_web_app`	A static web app	Yes	-

The runtime version of web apps is not fixed by the modules, because the related policies have no default value. See Known findings.

Data and storage¶

Module	What it deploys	TF	Bicep	Notes
`storage_account`	A storage account with blob containers, queues, tables and file shares, and a private endpoint	Yes	Yes	Supports customer-managed keys. Terraform also supports Data Lake Gen2 file systems, management policies and local users. Has upgrade notes.
`ptn_storage_account`	A storage account with customer-managed encryption, as a pattern	Yes	-	Creates a resource group, a Log Analytics workspace, a user-assigned identity, and a Key Vault with a key when you do not supply them. It calls the `key_vault`, `log_analytics_workspace`, `storage_account` and `user_assigned_identity` modules of this library. Needs the `storage_use_azuread` setting on the `azurerm` provider.
`sql_server`	An Azure SQL logical server with databases, auditing, encryption and vulnerability assessment	Yes	Yes	Terraform also has elastic pools. Supports transparent data encryption with a customer-managed key. Has upgrade notes.
`postgresql_flexibleserver`	A PostgreSQL flexible server, and databases	Yes	Yes	Some parameters are fixed because of the policies. Has upgrade notes.

Integration and configuration¶

Module	What it deploys	TF	Bicep	Notes
`apim`	An API Management service	Yes	Yes
`event_hub_namespace`	An Event Hubs namespace, with event hubs	Yes	Yes
`servicebus_namespace`	A Service Bus namespace, with queues and topics	Yes	-
`app_configuration_store`	An App Configuration store	Yes	Yes	Terraform can also create key-values.

Monitoring¶

Module	What it deploys	TF	Bicep	Notes
`log_analytics_workspace`	A Log Analytics workspace	Yes	Yes
`application_insights`	An Application Insights component	Yes	Yes
`data_collection_endpoint`	A data collection endpoint	Yes	Yes
`data_collection_rule`	A data collection rule	-	Yes
`action_group`	An action group	-	Yes
`network_interface_diagnostic_settings`	Diagnostic settings for a network interface	-	Yes	A helper that other Bicep modules use for the network interface of a private endpoint.

Networking¶

Module	What it deploys	TF	Bicep	Notes
`network_security_group`	A network security group with rules	Yes	Yes	Flow logs on the group are no longer supported. Use virtual network flow logs. Has upgrade notes.

The library does not contain modules for virtual networks, firewalls, DNS or peering. The spoke network is part of the platform (What you get).

Find a module that is missing¶

Ask your platform team. A new module needs a module folder, an example and tests, and follows the same creation process as all others (Create and contribute modules).