Naming and Terraform State

Name parts

Part	Variable (<env-folder>/global.auto.tfvars or <region>/global.auto.tfvars)	Example
<company>	scaffold_company_short_name	demo
<env>	scaffold_environment	canary, prod
<envshort>	scaffold_environment_short_name	cnry, prod
<region>	scaffold_location_short_name (region file)	weu
region name	scaffold_location (region file)	westeurope

Most names can be overridden with an overwrite_* variable in the same layer. Names that appear in this guide:

Resource	Default name	Source
Connectivity resource group	rg-<company>-connectivity-<env>-<region>-001	infra/deploy/firewall/locals.tf, connectivity/locals.tf
Firewall policy	afwp-<company>-connectivity-<env>-<region>-001	infra/deploy/firewall/locals.tf
App Gateway resource group	rg-<company>-appgw-<env>-<region>-001	infra/deploy/connectivity/locals.tf
WAF policy resource group	rg-<company>-agw-<env>-<region>-001	infra/templates/web_application_firewall_policy/main.tf
App Gateway Key Vault	kv<company>agw<envshort><region>001	infra/templates/application_gateway/main.tf
App Gateway identity / public IP	uai-<company>-agw-<env>-<region>-001 / pip-<company>-agw-<env>-<region>-001	same
Platform action groups	ag-<company>-mgmtgeneral-<env>-<region>-001, ag-<company>-mgmtxpirit-<env>-<region>-001	infra/templates/monitor/main.tf
Hub 24/7 action group / rule	ag-<company>-hub247-<env>-<region>-001 / apr-<company>-hub247-<env>-<region>-001	infra/deploy/connectivity/main.tf
Alert initiative assignments	alerting_servicehealth, alerting_management, alerting_landingzone, alerting_identity, alerting_connectivity	infra/deploy/postdeployment/main_policies_alerts.tf

Spoke names (spoke-canvas/deploy/spoke/locals.tf)

Resource	Default name
Resource group	rg-canvas-<wl>-<env>-<region>-001
Log Analytics	log-<wl>-<env>-<region>-001
Key Vault	kv<wl><env><region>001
Storage account	st<wl><env><region>001
Hub connection	The VNet name with vnet- replaced by con-, unless overwritePeeringConnectionName is set (modules/virtual_network/locals.tf)
Entra ID groups	<GroupnamePrefix><wl>_<env>_Owners / _Contributors / _Readers / _Support
Service principal	<SPNNamePrefix><wl>-<env>

<wl> and <env> are the lower-cased workloadShortName and environment from the spoke JSON. The Key Vault and the storage account names must be globally unique in Azure.

Terraform state

What	Storage (mcp.json)	Key
Hub layer	Azure.TerraformState.Hub	<env>-<region>-<layer>.tfstate
Spoke subscription layer	Azure.TerraformState.Spoke	<wl>_<env>_Subscription.tfstate
Spoke canvas layer	Azure.TerraformState.Spoke	spoke_<wl>_<env>.tfstate

<env> in the hub key is the name of the folder that holds mcp.json. The backend is azurerm with use_azuread_auth=true (src/Xebia.Mcp/Functions/Private/Terraform/Invoke-XebiaTerraformBackend.ps1).

Stuck state lock

A cancelled run can leave a blob lease on a state file. Symptom: Error acquiring the state lock.

• Locally, in the dev container (see Run a single layer locally): Unlock-XebiaLocal -Config $config -DeployName <layer> -Region <region> for a hub layer, or Unlock-XebiaLocal -Config $config -SpokeFilePaths @('<file>') for a spoke. The spoke unlock only acts when $WhatIfPreference is $false; the hub unlock also works in WhatIf mode.
• Portal: storage account → container → state blob → Break lease.

Only break a lease when you are sure no run is still active.