terraform-azurerm-avm-res-storage-storageaccount

KO | EN

gitlite — search

#typescript #ai-agents #ai #dsh-plugin #deepseek-harness #open-source #cli #claude-code #codex #developer-tools #react #windows

terraform-azurerm-avm-res-storage-storageaccount

★ 40 Open GitHub ↗

Terraform Azure Verified Resource Module for Storage Account

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Terraform Azure Storage Account Module

This Terraform module is designed to create Azure Storage Accounts and its related resources, including blob containers, queues, tables, and file shares. It also supports the creation of a storage account private endpoint which provides secure and direct connectivity to Azure Storage over a private network.

> [!WARNING]
> Major version Zero (0.y.z) is for initial development. Anything MAY change at any time. A module SHOULD NOT be considered stable till at least it is major version one (1.0.0) or greater. Changes will always be via new versions being published and no changes will be made to existing published versions. For more details please go to <https://semver.org/>

## Features

* Create a storage account with various configuration options such as account kind, tier, replication type, network rules, and identity settings.
* Create blob containers, queues, tables, and file shares within the storage account.
* Support for customer-managed keys for encrypting the data in the storage account.
* Enable private endpoint for the storage account, providing secure access over a private network.

## Limitations

* The storage account name must be globally unique.
* The module creates resources in the same region as the storage account.

> **IMPORTANT** This module manages the Storage Account itself, plus its child containers, queues, tables, file shares, private endpoints and role assignments, through the AzAPI provider, which always authenticates with Microsoft Entra ID and never requires a Storage shared key. We recommend leaving `shared_access_key_enabled = false` (the module default) so that any data-plane access from your own code is also Entra-ID-authenticated. If you also use the [`azurerm` provider](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs#storage_use_azuread) to manage Storage data-plane resources (for example `azurerm_storage_blob`), set `storage_use_azuread = true` in that provider block. Note that not every Storage service supports Microsoft Entra ID authentication; for those services you will need to enable shared-key access by setting `shared_access_key_enabled = true` on this module.

## Upgrading

### AzAPI provider version

This module requires AzAPI provider version 2.9.0 or later within the 2.x series (`>= 2.9.0, < 3.0.0`). When upgrading to a module release with this requirement, update any AzAPI constraint in your root module that excludes version 2.9.0, then refresh the provider selections recorded in your dependency lock file:

```terraform
terraform {
  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "~> 2.9"
    }
  }
}
```

```shell
terraform init -upgrade
```

### State migration from v0.6.x

Version 0.7.0 moved containers, queues, shares, and tables from resources in the root module to separate child modules. Terraform cannot automatically move an arbitrary `for_each` key from a resource instance to a module instance. Without an explicit state migration, an upgrade can therefore plan to destroy and recreate these resources.

Before applying an upgrade from v0.6.x, add one `moved` block for each existing resource key to the root module that calls this module. For a module call named `storage`, the migrations for keys named `logs`, `jobs`, `content`, and `metadata` are:

```hcl
moved {
  from = module.storage.azapi_resource.containers["logs"]
  to   = module.storage.module.containers["logs"].azapi_resource.this
}

moved {
  from = module.storage.azapi_resource.queue["jobs"]
  to   = module.storage.module.queues["jobs"].azapi_resource.this
}

moved {
  from = module.storage.azapi_resource.share["content"]
  to   = module.storage.module.shares["content"].azapi_resource.this
}

moved {
  from = module.storage.azapi_resource.table["metadata"]
  to   = module.storage.module.tables["metadata"].azapi_resource.this
}
```

The quoted values are the map keys supplied to the module, which can differ from the Azure resource names. Repeat the relevant block for every key. Replace `module.storage` with the actual module address; for example, include an outer `for_each` key as `module.storage["app"]`.

Run `terraform plan` after adding the moves and do not apply if Terraform still proposes replacing these resources. Keep the `moved` blocks in configuration so the migration is applied consistently to every workspace.

> [!WARNING]
> These moves cover only containers, queues, shares, and tables. Review the complete plan for other changes introduced in v0.7.0, including diagnostic settings and role assignments, before applying the upgrade.

If v0.7.x was already applied or an apply failed partway through, first save a backup and inspect the state:

```shell
terraform state pull > terraform-state-backup.json
terraform state list
```

Terraform state can contain sensitive values. Store the backup securely and delete it when it is no longer needed. A resource may already have the correct address, or it may have the incorrect intermediate address produced by v0.7.x:

```text
module.storage.module.containers.azapi_resource.this["logs"]
```

Move an intermediate address to the configured address before applying:

```shell
terraform state mv 'module.storage.module.containers.azapi_resource.this["logs"]' 'module.storage.module.containers["logs"].azapi_resource.this'
```
Use the equivalent `queues`, `shares`, or `tables` address for the other resource types. Do not run a state move when the destination is already present. A state move only updates Terraform's bookkeeping; it cannot restore an Azure resource or its data if the resource was already deleted.
Use the equivalent `queues`, `shares`, or `tables` address for the other resource types. Do not run a state move when the destination is already present. A state move only updates Terraform's bookkeeping; it cannot restore an Azure resource or its data if the resource was already deleted.

## Requirements

The following requirements are needed by this module:

- <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) (>= 1.10.0)

- <a name="requirement_azapi"></a> [azapi](#requirement\_azapi) (~> 2.9)

- <a name="requirement_modtm"></a> [modtm](#requirement\_modtm) (~> 0.3)

- <a name="requirement_random"></a> [random](#requirement\_random) (>= 3.5.0, < 4.0.0)

## Resources

The following resources are used by this module:

- [azapi_resource.lock](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource) (resource)
- [azapi_resource.this](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource) (resource)
- [azapi_update_resource.customer_managed_key](https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/update_resource) (resource)
- [modtm_telemetry.telemetry](https://registry.terraform.io/providers/Azure/modtm/latest/docs/resources/telemetry) (resource)
- [random_uuid.telemetry](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) (resource)
- [azapi_client_config.telemetry](https://registry.terraform.io/providers/Azure/azapi/latest/docs/data-sources/client_config) (data source)
- [azapi_resource.customer_managed_key_vault](https://registry.terraform.io/providers/Azure/azapi/latest/docs/data-sources/resource) (data source)
- [modtm_module_source.telemetry](https://registry.terraform.io/providers/Azure/modtm/latest/docs/data-sources/module_source) (data source)

## Required Inputs

The following input variables are required:

### <a name="input_location"></a> [location](#input\_location)

Description: Azure region where the resource should be deployed.  
If null, the location will be inferred from the resource group location.

Type: `string`

### <a name="input_name"></a> [name](#input\_name)

Description: The name of the resource.

Type: `string`

### <a name="input_parent_id"></a> [parent\_id](#input\_parent\_id)

Description: The Azure resource ID of the parent resource group, in the form `/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}`.

Type: `string`

## Optional Inputs

The following input variables are optional (have default values):

### <a name="input_access_tier"></a> [access\_tier](#input\_access\_tier)

Description: (Optional) Defines the access tier for BlobStorage, FileStorage and StorageV2 accounts. Valid options are Hot, Cool, Cold and Premium. Defaults to Hot.

Type: `string`

Default: `"Hot"`

### <a name="input_account_kind"></a> [account\_kind](#input\_account\_kind)

Description: (Optional) Defines the Kind of account. Valid options are `BlobStorage`, `BlockBlobStorage`, `FileStorage`, `Storage` and `StorageV2`. Defaults to `StorageV2`.

Type: `string`

Default: `"StorageV2"`

### <a name="input_account_replication_type"></a> [account\_replication\_type](#input\_account\_replication\_type)

Description: [DEPRECATED] (Optional) Defines the type of replication to use for this storage account. Valid options are `LRS`, `GRS`, `RAGRS`, `ZRS`, `GZRS` and `RAGZRS`. Defaults to `ZRS`. This variable is only honoured when `account_sku_name` is set to `null`; otherwise `account_sku_name` wins. Prefer `account_sku_name`.

Type: `string`

Default: `"ZRS"`

### <a name="input_account_sku_name"></a> [account\_sku\_name](#input\_account\_sku\_name)

Description: (Optional) Explicit storage account SKU name (e.g. `Standard_LRS`, `Premium_ZRS`, `PremiumV2_LRS`, `StandardV2_GZRS`). When set, this value is sent to Azure verbatim and overrides the SKU derived from `account_tier`, `account_replication_type` and `provisioned_billing_model_version` - those variables are only honoured when `account_sku_name` is explicitly set to `null`. Defaults to `Standard_ZRS`. Note: the `*V2_*` SKUs (e.g. `StandardV2_ZRS`, `PremiumV2_ZRS`) require `account_kind = "FileStorage"`.

Type: `string`

Default: `"Standard_ZRS"`

### <a name="input_account_tier"></a> [account\_tier](#input\_account\_tier)

Description: [DEPRECATED] (Optional) Defines the Tier to use for this storage account. Valid options are `Standard` and `Premium`. For `BlockBlobStorage` and `FileStorage` accounts only `Premium` is valid. Changing this forces a new resource to be created. Defaults to `Standard`. This variable is only honoured when `account_sku_name` is set to `null`; otherwise `account_sku_name` wins. Prefer `account_sku_name`.

Type: `string`

Default: `"Standard"`

### <a name="input_allow_nested_items_to_be_public"></a> [allow\_nested\_items\_to\_be\_public](#input\_allow\_nested\_items\_to\_be\_public)

Description: (Optional) Allow or disallow nested items within this Account to opt into being public. Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_allowed_copy_scope"></a> [allowed\_copy\_scope](#input\_allowed\_copy\_scope)

Description: (Optional) Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet. Possible values are `AAD` and `PrivateLink`. Defaults to `null` (no restriction).

Type: `string`

Default: `null`

### <a name="input_azure_files_authentication"></a> [azure\_files\_authentication](#input\_azure\_files\_authentication)

Description: Configures Azure Files identity-based authentication on the storage account. Defaults to `null` (no Files authentication configured).

- `directory_type` - (Optional) Specifies the directory service used. Possible values are `AADDS`, `AD`, and `AADKERB`. Defaults to `AADKERB`.
- `default_share_level_permission` - (Optional) Specifies the default share-level permission applied to all users. Possible values are `StorageFileDataSmbShareReader`, `StorageFileDataSmbShareContributor`, `StorageFileDataSmbShareElevatedContributor`, or `None`. Defaults to `null`.
- `active_directory` - (Optional) An Active Directory configuration block. Required when `directory_type` is `AD`. Defaults to `null`. Supports:
  - `domain_guid` - (Required) Specifies the domain GUID.
  - `domain_name` - (Required) Specifies the primary domain that the AD DNS server is authoritative for.
  - `domain_sid` - (Optional) Specifies the security identifier (SID). Required when `directory_type` is `AD`. Defaults to `null`.
  - `forest_name` - (Optional) Specifies the Active Directory forest. Required when `directory_type` is `AD`. Defaults to `null`.
  - `netbios_domain_name` - (Optional) Specifies the NetBIOS domain name. Required when `directory_type` is `AD`. Defaults to `null`.
  - `storage_sid` - (Optional) Specifies the security identifier (SID) for Azure Storage. Required when `directory_type` is `AD`. Defaults to `null`.

Type:

```hcl
object({
    directory_type                 = optional(string, "AADKERB")
    default_share_level_permission = optional(string)

active_directory = optional(object({
      domain_guid         = string
      domain_name         = string
      domain_sid          = optional(string)
      forest_name         = optional(string)
      netbios_domain_name = optional(string)
      storage_sid         = optional(string)
    }))
  })
```

Default: `null`

### <a name="input_blob_properties"></a> [blob\_properties](#input\_blob\_properties)

Description: Blob service-level settings for the storage account. Defaults to `null` (Azure platform defaults).

- `automatic_snapshot_policy_enabled` - (Optional) Deprecated; use `versioning_enabled` instead. Defaults to `null`.
- `change_feed` - (Optional) Blob change feed settings. Defaults to `null`.
  - `enabled` - (Optional) Enable the blob change feed. Defaults to `null`.
  - `retention_in_days` - (Optional) Retention period for the change feed in days (1–146000). `null` means infinite. Defaults to `null`.
- `container_delete_retention_policy` - (Optional) Container soft-delete retention policy. Defaults to `null`.
  - `allow_permanent_delete` - (Optional) Allow permanent delete of soft-deleted containers. Defaults to `null`.
  - `days` - (Optional) Number of days to retain deleted containers (1–365). Defaults to `null`.
  - `enabled` - (Optional) Enable container soft-delete. Defaults to `null`.
- `cors_rules` - (Optional) A list of CORS rules (maximum 5). Each entry supports:
  - `allowed_headers` - (Required) A list of headers allowed in cross-origin requests.
  - `allowed_methods` - (Required) A list of HTTP methods allowed. Valid values: `DELETE`, `GET`, `HEAD`, `MERGE`, `POST`, `OPTIONS`, `PUT`, `PATCH`.
  - `allowed_origins` - (Required) A list of origin domains allowed in cross-origin requests.
  - `exposed_headers` - (Required) A list of response headers exposed to CORS clients.
  - `max_age_in_seconds` - (Required) The number of seconds the browser should cache a preflight response.
- `default_service_version` - (Optional) Default Blob service API version for requests without a version. Defaults to `null`.
- `delete_retention_policy` - (Optional) Blob soft-delete retention policy. Defaults to `null`.
  - `allow_permanent_delete` - (Optional) Allow permanent delete of soft-deleted blobs and snapshots. Cannot be used with `restore_policy`. Defaults to `null`.
  - `days` - (Optional) Number of days to retain deleted blobs (1–365). Defaults to `null`.
  - `enabled` - (Optional) Enable blob soft-delete. Defaults to `null`.
- `last_access_time_tracking_policy` - (Optional) Last access time tracking policy. Defaults to `null`.
  - `blob_type` - (Optional) Blob types to track. Only `["blockBlob"]` is supported (read-only). Defaults to `null`.
  - `enable` - (Required) Enable last access time tracking.
  - `name` - (Optional) Policy name. Must be `"AccessTimeTracking"` (read-only). Defaults to `null`.
  - `tracking_granularity_in_days` - (Optional) Granularity in days (read-only, always `1`). Defaults to `null`.
- `restore_policy` - (Optional) Point-in-time restore policy. Requires `versioning_enabled`, `change_feed.enabled`, and `delete_retention_policy.enabled`. Defaults to `null`.
  - `days` - (Optional) Restore retention in days. Must be less than `delete_retention_policy.days`. Defaults to `null`.
  - `enabled` - (Required) Enable point-in-time restore.
- `versioning_enabled` - (Optional) Enable blob versioning. Defaults to `null`.

Type:

```hcl
object({
    automatic_snapshot_policy_enabled = optional(bool)
    change_feed = optional(object({
      enabled           = optional(bool)
      retention_in_days = optional(number)
    }))
    container_delete_retention_policy = optional(object({
      allow_permanent_delete = optional(bool)
      days                   = optional(number)
      enabled                = optional(bool)
    }))
    cors_rules = optional(list(object({
      allowed_headers    = list(string)
      allowed_methods    = list(string)
      allowed_origins    = list(string)
      exposed_headers    = list(string)
      max_age_in_seconds = number
    })))
    default_service_version = optional(string)
    delete_retention_policy = optional(object({
      allow_permanent_delete = optional(bool)
      days                   = optional(number)
      enabled                = optional(bool)
    }))
    last_access_time_tracking_policy = optional(object({
      blob_type                    = optional(list(string))
      enable                       = bool
      name                         = optional(string)
      tracking_granularity_in_days = optional(number)
    }))
    restore_policy = optional(object({
      days    = optional(number)
      enabled = bool
    }))
    versioning_enabled = optional(bool)
  })
```

Default: `null`

### <a name="input_containers"></a> [containers](#input\_containers)

Description: A map of containers to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to `{}` (no containers).

- `name` - (Required) The name of the Container which should be created within the Storage Account. Changing this forces a new resource to be created.
- `public_access` - (Optional) Specifies whether data in the container may be accessed publicly and the level of access. Possible values are `Container`, `Blob`, and `None`. Defaults to `None`. Changing this forces a new resource to be created.
- `metadata` - (Optional) A mapping of MetaData for this Container. All metadata keys should be lowercase. Defaults to `null`.
- `default_encryption_scope` - (Optional) The default encryption scope to use for blob operations on this container. Defaults to `null`.
- `deny_encryption_scope_override` - (Optional) When set to `true`, blocks blob uploads from specifying a different encryption scope. Defaults to `null`.
- `enable_nfs_v3_all_squash` - (Optional) Enable NFSv3 all squash (only valid for NFSv3 enabled accounts). Defaults to `null`.
- `enable_nfs_v3_root_squash` - (Optional) Enable NFSv3 root squash (only valid for NFSv3 enabled accounts). Defaults to `null`.
- `immutable_storage_with_versioning` - (Optional) Configures container-level immutability with version-level WORM. Defaults to `null`. Supports:
  - `enabled` - (Required) Whether immutable storage with versioning is enabled.
- `role_assignments` - (Optional) A map of role assignments to create on the container. Defaults to `{}`. See `var.role_assignments` for the attribute schema.
- `timeouts` - (Optional) Per-operation timeouts for the container resource. Defaults to `null` (uses provider defaults inherited from `var.timeouts`). Supports:
  - `create` - (Optional) Timeout for create operations.
  - `delete` - (Optional) Timeout for delete operations.
  - `read` - (Optional) Timeout for read operations.
  - `update` - (Optional) Timeout for update operations.

Type:

```hcl
map(object({
    public_access                  = optional(string, "None")
    metadata                       = optional(map(string))
    name                           = string
    default_encryption_scope       = optional(string)
    deny_encryption_scope_override = optional(bool)
    enable_nfs_v3_all_squash       = optional(bool)
    enable_nfs_v3_root_squash      = optional(bool)
    immutable_storage_with_versioning = optional(object({
      enabled = bool
    }))

role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})

timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
```

Default: `{}`

### <a name="input_cross_tenant_replication_enabled"></a> [cross\_tenant\_replication\_enabled](#input\_cross\_tenant\_replication\_enabled)

Description: (Optional) Should cross Tenant replication be enabled? Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_custom_domain"></a> [custom\_domain](#input\_custom\_domain)

Description: Configures a custom domain for the storage account. Defaults to `null` (no custom domain).

- `name` - (Required) The Custom Domain Name to use for the Storage Account, which will be validated by Azure.
- `use_subdomain` - (Optional) Should the Custom Domain Name be validated by using indirect CNAME validation? Defaults to `null`.

Type:

```hcl
object({
    name          = string
    use_subdomain = optional(bool)
  })
```

Default: `null`

### <a name="input_customer_managed_key"></a> [customer\_managed\_key](#input\_customer\_managed\_key)

Description: Defines a customer managed key to use for encryption. Defaults to `null` (Microsoft-managed keys).

- `key_vault_resource_id` - (Required) The full Azure Resource ID of the key vault where the customer managed key will be referenced from.
- `key_name` - (Required) The key name for the customer managed key in the key vault.
- `key_version` - (Optional) The version of the key to use. If `null`, the latest version is tracked automatically.
- `user_assigned_identity` - (Optional) A user assigned identity used to access the key vault. Defaults to `null`, in which case the storage account's system-assigned identity is used.
  - `resource_id` - (Required) The full Azure Resource ID of the user assigned identity.

Example Inputs:
```terraform
customer_managed_key = {
  key_vault_resource_id = "/subscriptions/0000000-0000-0000-0000-000000000000/resourceGroups/test-resource-group/providers/Microsoft.KeyVault/vaults/example-key-vault"
  key_name              = "sample-customer-key"
}
```

Type:

```hcl
object({
    key_vault_resource_id = string
    key_name              = string
    key_version           = optional(string, null)
    user_assigned_identity = optional(object({
      resource_id = string
    }), null)
  })
```

Default: `null`

### <a name="input_default_to_oauth_authentication"></a> [default\_to\_oauth\_authentication](#input\_default\_to\_oauth\_authentication)

Description: (Optional) Default to Azure Active Directory authorization in the Azure portal when accessing the Storage Account. Defaults to `null` (Azure platform default of `false`).

Type: `bool`

Default: `null`

### <a name="input_diagnostic_settings_blob"></a> [diagnostic\_settings\_blob](#input\_diagnostic\_settings\_blob)

Description: A map of diagnostic settings to create on the Blob Storage within Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from `Azure/avm-utl-interfaces/azure`, which fully supports all features of the Azure Diagnostic Settings API.

- `name` - (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.
- `logs` - (Optional) A set of log entries to enable. Each entry has the following attributes:
  - `category` - (Optional) The name of an individual log category (e.g. `StorageWrite`).
  - `category_group` - (Optional) The name of a log category group (e.g. `allLogs`, `audit`). Mutually exclusive with `category`.
  - `enabled` - (Optional) Whether the log entry is enabled. Defaults to `true`.
  - `retention_policy` - (Optional) Retention policy for the log entry. Object with `days` (default `0`) and `enabled` (default `false`).
- `metrics` - (Optional) A set of metric entries to enable. Each entry has the following attributes:
  - `category` - (Optional) The name of the metric category (e.g. `AllMetrics`, `Transaction`).
  - `enabled` - (Optional) Whether the metric entry is enabled. Defaults to `true`.
  - `retention_policy` - (Optional) Retention policy for the metric entry. Object with `days` (default `0`) and `enabled` (default `false`).
- `log_analytics_destination_type` - (Optional) The destination type for the diagnostic setting. Possible values are `Dedicated` and `AzureDiagnostics`. Defaults to `Dedicated`.
- `workspace_resource_id` - (Optional) The resource ID of the log analytics workspace to send logs and metrics to.
- `storage_account_resource_id` - (Optional) The resource ID of the storage account to send logs and metrics to.
- `event_hub_authorization_rule_resource_id` - (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.
- `event_hub_name` - (Optional) The name of the event hub. If none is specified, the default event hub will be selected.
- `marketplace_partner_resource_id` - (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs.

Type:

```hcl
map(object({
    name = optional(string, null)
    logs = optional(set(object({
      category       = optional(string, null)
      category_group = optional(string, null)
      enabled        = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    metrics = optional(set(object({
      category = optional(string, null)
      enabled  = optional(bool, true)
      retention_policy = optional(object({
        days    = optional(number, 0)
        enabled = optional(bool, false)
      }), {})
    })), [])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))
```

Default: `{}`

### <a name="input_diagnostic_settings_file"></a> [diagnostic\_settings\_file](#input\_diagnostic\_settings\_file)

Description: A map of diagnostic settings to create on the Azure Files Storage within Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from `Azure/avm-utl-interfaces/azure`, which fully supports all features of the Azure Diagnostic Settings API.

See `var.diagnostic_settings_blob` for full attribute documentation; the schema is identical.

Type:

Default: `{}`

### <a name="input_diagnostic_settings_queue"></a> [diagnostic\_settings\_queue](#input\_diagnostic\_settings\_queue)

Description: A map of diagnostic settings to create on the Queue Storage within Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from `Azure/avm-utl-interfaces/azure`, which fully supports all features of the Azure Diagnostic Settings API.

See `var.diagnostic_settings_blob` for full attribute documentation; the schema is identical.

Type:

Default: `{}`

### <a name="input_diagnostic_settings_storage_account"></a> [diagnostic\_settings\_storage\_account](#input\_diagnostic\_settings\_storage\_account)

Description: A map of diagnostic settings to create on the Storage Account itself. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from `Azure/avm-utl-interfaces/azure`, which fully supports all features of the Azure Diagnostic Settings API.

**Important:** Diagnostic settings on the Storage Account resource itself support only metrics (logs are not supported by the Azure API at this scope). Supplying any `logs` entries here will be rejected by Azure. Supported metric categories are `Capacity`, `Transaction`, and `AllMetrics`.

See `var.diagnostic_settings_blob` for full attribute documentation; the schema is identical.

Type:

Default: `{}`

### <a name="input_diagnostic_settings_table"></a> [diagnostic\_settings\_table](#input\_diagnostic\_settings\_table)

Description: A map of diagnostic settings to create on the Table Storage within the Storage Account. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

This variable uses the v2 diagnostic settings interface from `Azure/avm-utl-interfaces/azure`, which fully supports all features of the Azure Diagnostic Settings API.

See `var.diagnostic_settings_blob` for full attribute documentation; the schema is identical.

Type:

Default: `{}`

### <a name="input_edge_zone"></a> [edge\_zone](#input\_edge\_zone)

Description: (Optional) Specifies the Edge Zone within the Azure Region where this Storage Account should exist. Defaults to `null`. Changing this forces a new Storage Account to be created.

Type: `string`

Default: `null`

### <a name="input_enable_telemetry"></a> [enable\_telemetry](#input\_enable\_telemetry)

Description: This variable controls whether or not telemetry is enabled for the module.  
For more information see <https://aka.ms/avm/telemetryinfo>.  
If it is set to false, then no telemetry will be collected.

Type: `bool`

Default: `true`

### <a name="input_file_service_properties"></a> [file\_service\_properties](#input\_file\_service\_properties)

Description: File service-level settings for the storage account. Defaults to `null` (Azure platform defaults).

- `cors_rules` - (Optional) A list of CORS rules for the file service. Defaults to `null`. Each entry supports:
  - `allowed_headers` - (Required) A list of headers allowed in cross-origin requests.
  - `allowed_methods` - (Required) A list of HTTP methods allowed.
  - `allowed_origins` - (Required) A list of origin domains allowed.
  - `exposed_headers` - (Required) A list of response headers exposed to CORS clients.
  - `max_age_in_seconds` - (Required) Seconds the browser should cache a preflight response.
- `share_retention_policy` - (Optional) File share soft-delete retention policy. Defaults to `null`.
  - `days` - (Optional) Number of days to retain soft-deleted shares. Between 1 and 365. Defaults to `7`.
  - `enabled` - (Optional) Whether soft-delete is enabled. Defaults to `true`.
- `smb` - (Optional) SMB protocol settings. Defaults to `null`.
  - `authentication_types` - (Optional) Set of authentication types. Valid values: `NTLMv2`, `Kerberos`. Defaults to `null`.
  - `channel_encryption_types` - (Optional) Set of SMB channel encryption types. Valid values: `AES-128-CCM`, `AES-128-GCM`, `AES-256-GCM`. Defaults to `null`.
  - `kerberos_ticket_encryption_type` - (Optional) Set of Kerberos ticket encryption types. Valid values: `RC4-HMAC`, `AES-256`. Defaults to `null`.
  - `multichannel_enabled` - (Optional) Enable SMB multichannel (Premium file shares only). Defaults to `null`.
  - `versions` - (Optional) Set of SMB protocol versions. Valid values: `SMB2.1`, `SMB3.0`, `SMB3.1.1`. Defaults to `null`.

Type:

```hcl
object({
    cors_rules = optional(list(object({
      allowed_headers    = list(string)
      allowed_methods    = list(string)
      allowed_origins    = list(string)
      exposed_headers    = list(string)
      max_age_in_seconds = number
    })))
    share_retention_policy = optional(object({
      days    = optional(number, 7)
      enabled = optional(bool, true)
    }))
    smb = optional(object({
      authentication_types            = optional(set(string))
      channel_encryption_types        = optional(set(string))
      kerberos_ticket_encryption_type = optional(set(string))
      multichannel_enabled            = optional(bool)
      versions                        = optional(set(string))
    }))
  })
```

Default: `null`

### <a name="input_https_traffic_only_enabled"></a> [https\_traffic\_only\_enabled](#input\_https\_traffic\_only\_enabled)

Description: (Optional) Boolean flag which forces HTTPS if enabled, see [here](https://docs.microsoft.com/azure/storage/storage-require-secure-transfer/) for more information. Defaults to `true`.

Type: `bool`

Default: `true`

### <a name="input_immutability_policy"></a> [immutability\_policy](#input\_immutability\_policy)

Description: Configures the account-level immutability policy. Defaults to `null` (no policy).

- `allow_protected_append_writes` - (Required) When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added; any existing blocks cannot be modified or deleted.
- `period_since_creation_in_days` - (Required) The immutability period for the blobs in the container since the policy creation, in days.
- `state` - (Required) The mode of the policy. `Disabled` disables the policy; `Unlocked` allows the immutability retention time to be increased or decreased and toggling `allow_protected_append_writes`; `Locked` only allows the immutability retention time to be increased. A policy may only be created in `Disabled` or `Unlocked`, may be toggled between those two, and `Unlocked` may transition to `Locked` (which cannot be reverted).

Type:

```hcl
object({
    allow_protected_append_writes = bool
    period_since_creation_in_days = number
    state                         = string
  })
```

Default: `null`

### <a name="input_infrastructure_encryption_enabled"></a> [infrastructure\_encryption\_enabled](#input\_infrastructure\_encryption\_enabled)

Description: (Optional) Is infrastructure encryption enabled? Changing this forces a new resource to be created. Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_is_hns_enabled"></a> [is\_hns\_enabled](#input\_is\_hns\_enabled)

Description: (Optional) Is Hierarchical Namespace enabled? This can be used with Azure Data Lake Storage Gen 2 ([see here for more information](https://docs.microsoft.com/azure/storage/blobs/data-lake-storage-quickstart-create-account/)). Defaults to `null` (Azure platform default of `false`). Changing this forces a new resource to be created.

Type: `bool`

Default: `null`

### <a name="input_large_file_share_enabled"></a> [large\_file\_share\_enabled](#input\_large\_file\_share\_enabled)

Description: (Optional) Is large file share enabled? Defaults to `null` (Azure platform default of `false`).

Type: `bool`

Default: `null`

### <a name="input_local_user"></a> [local\_user](#input\_local\_user)

Description: A map of Storage Account Local Users to create. The map key is arbitrary; the value supports the following attributes. Defaults to `{}` (no local users).

- `name` - (Required) The name which should be used for this Storage Account Local User. Changing this forces a new Storage Account Local User to be created.
- `home_directory` - (Optional) The home directory of the Storage Account Local User. Defaults to `null`.
- `ssh_key_enabled` - (Optional) Specifies whether SSH Key Authentication is enabled. Defaults to `null` (Azure platform default of `false`).
- `ssh_password_enabled` - (Optional) Specifies whether SSH Password Authentication is enabled. Defaults to `null` (Azure platform default of `false`).
- `permission_scope` - (Optional) A list of permission scopes for the local user. Defaults to `null`. Each entry supports:
  - `resource_name` - (Required) The container name (when `service` is set to `blob`) or the file share name (when `service` is set to `file`).
  - `service` - (Required) The storage service used by this Storage Account Local User. Possible values are `blob` and `file`.
  - `permissions` - (Required) An object describing the permissions granted at this scope. Supports:
    - `create` - (Optional) Whether the local user has the create permission for this scope. Defaults to `null` (`false`).
    - `delete` - (Optional) Whether the local user has the delete permission for this scope. Defaults to `null` (`false`).
    - `list` - (Optional) Whether the local user has the list permission for this scope. Defaults to `null` (`false`).
    - `read` - (Optional) Whether the local user has the read permission for this scope. Defaults to `null` (`false`).
    - `write` - (Optional) Whether the local user has the write permission for this scope. Defaults to `null` (`false`).
- `ssh_authorized_key` - (Optional) A list of SSH authorized keys for the local user. Defaults to `null`. Each entry supports:
  - `key` - (Required) The public key value of this SSH authorized key.
  - `description` - (Optional) The description of this SSH authorized key. Defaults to `null`.
- `timeouts` - (Optional) Per-operation timeouts for the local user resource. Defaults to `null` (uses provider defaults inherited from `var.timeouts`). Supports:
  - `create` - (Optional) Timeout for create operations.
  - `delete` - (Optional) Timeout for delete operations.
  - `read` - (Optional) Timeout for read operations.
  - `update` - (Optional) Timeout for update operations.

Type:

```hcl
map(object({
    home_directory       = optional(string)
    name                 = string
    ssh_key_enabled      = optional(bool)
    ssh_password_enabled = optional(bool)
    permission_scope = optional(list(object({
      resource_name = string
      service       = string
      permissions = object({
        create = optional(bool)
        delete = optional(bool)
        list   = optional(bool)
        read   = optional(bool)
        write  = optional(bool)
      })
    })))
    ssh_authorized_key = optional(list(object({
      description = optional(string)
      key         = string
    })))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
```

Default: `{}`

### <a name="input_local_user_enabled"></a> [local\_user\_enabled](#input\_local\_user\_enabled)

Description: (Optional) Should Storage Account Local Users be enabled? Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_lock"></a> [lock](#input\_lock)

Description: Controls the management lock applied to the storage account. Defaults to `null` (no lock).

- `kind` - (Required) The kind of lock to apply. Possible values are `CanNotDelete` and `ReadOnly`.
- `name` - (Optional) The name of the lock. If not specified, a name will be generated.

Type:

```hcl
object({
    name = optional(string, null)
    kind = string
  })
```

Default: `null`

### <a name="input_managed_identities"></a> [managed\_identities](#input\_managed\_identities)

Description:   Controls the Managed Identity configuration on this resource. The following properties can be specified:

- `system_assigned` - (Optional) Specifies if the System Assigned Managed Identity should be enabled.
  - `user_assigned_resource_ids` - (Optional) Specifies a list of User Assigned Managed Identity resource IDs to be assigned to this resource.

Type:

```hcl
object({
    system_assigned            = optional(bool, false)
    user_assigned_resource_ids = optional(set(string), [])
  })
```

Default: `{}`

### <a name="input_min_tls_version"></a> [min\_tls\_version](#input\_min\_tls\_version)

Description: (Optional) The minimum supported TLS version for the storage account. Possible values are `TLS1_0`, `TLS1_1`, and `TLS1_2`. Defaults to `TLS1_2` for new storage accounts.

Type: `string`

Default: `"TLS1_2"`

### <a name="input_network_rules"></a> [network\_rules](#input\_network\_rules)

Description: Network rules restricting access to the storage account. Defaults to `{}`, which applies the object's own per-attribute defaults (effectively `default_action = "Deny"` with `bypass = ["AzureServices"]`).

> Note: the default value blocks all public access to the storage account. If you want to disable all network rules, set this value to `null`.

- `bypass` - (Optional) Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Valid options are any combination of `Logging`, `Metrics`, `AzureServices`, or `None`. Defaults to `["AzureServices"]`.
- `default_action` - (Optional) Specifies the default action of allow or deny when no other rules match. Valid options are `Deny` or `Allow`. Defaults to `Deny`.
- `ip_rules` - (Optional) List of public IP or IP ranges in CIDR format. Only IPv4 addresses are allowed. Private IP address ranges (as defined in [RFC 1918](https://tools.ietf.org/html/rfc1918#section-3)) are not allowed. Defaults to `[]`.
- `virtual_network_subnet_ids` - (Optional) A set of virtual network subnet IDs to secure the storage account. Defaults to `[]`.
- `private_link_access` - (Optional) A list of private link access rules. Defaults to `null`. Each entry supports:
  - `endpoint_resource_id` - (Required) The resource ID of the resource access rule to be granted access.
  - `endpoint_tenant_id` - (Optional) The tenant ID of the resource of the resource access rule to be granted access. Defaults to the current tenant ID.
- `timeouts` - (Optional) Per-operation timeouts for the network rules resource. Defaults to `null` (uses provider defaults). Supports:
  - `create` - (Optional) Timeout for create operations.
  - `delete` - (Optional) Timeout for delete operations.
  - `read` - (Optional) Timeout for read operations.
  - `update` - (Optional) Timeout for update operations.

Type:

```hcl
object({
    bypass                     = optional(set(string), ["AzureServices"])
    default_action             = optional(string, "Deny")
    ip_rules                   = optional(set(string), [])
    virtual_network_subnet_ids = optional(set(string), [])
    private_link_access = optional(list(object({
      endpoint_resource_id = string
      endpoint_tenant_id   = optional(string)
    })))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  })
```

Default: `{}`

### <a name="input_nfsv3_enabled"></a> [nfsv3\_enabled](#input\_nfsv3\_enabled)

Description: (Optional) Is NFSv3 protocol enabled? Changing this forces a new resource to be created. Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_private_endpoints"></a> [private\_endpoints](#input\_private\_endpoints)

Description: A map of private endpoints to create on the resource. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time. Defaults to `{}` (no private endpoints).

- `subnet_resource_id` - (Required) The resource ID of the subnet to deploy the private endpoint in.
- `subresource_name` - (Required) The service name of the private endpoint. Possible values are `blob`, `dfs`, `file`, `queue`, `table`, and `web`.
- `name` - (Optional) The name of the private endpoint. One will be generated if not set. The name must be set if multiple private endpoints are created to avoid conflicting resources.
- `role_assignments` - (Optional) A map of role assignments to create on the private endpoint. Defaults to `{}`. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time. Each value supports:
  - `role_definition_id_or_name` - (Required) The ID or name of the role definition to assign to the principal.
  - `principal_id` - (Required) The ID of the principal to assign the role to.
  - `description` - (Optional) The description of the role assignment. Defaults to `null`.
  - `skip_service_principal_aad_check` - (Optional) Retained for backwards compatibility with the legacy `azurerm` schema. Not honoured under AzAPI: the field is accepted but has no effect on the underlying role assignment. Defaults to `false`.
  - `condition` - (Optional) The condition which will be used to scope the role assignment. Defaults to `null`.
  - `condition_version` - (Optional) The version of the condition syntax. Valid value is `2.0`. Defaults to `null`.
  - `delegated_managed_identity_resource_id` - (Optional) The resource ID of the delegated managed identity. Defaults to `null`.
  - `principal_type` - (Optional) The type of principal. One of `User`, `Group`, `ServicePrincipal`, `ForeignGroup`, `Device`. Defaults to `null`.
- `lock` - (Optional) The management lock to apply to the private endpoint. Defaults to `null` (no lock). Supports:
  - `kind` - (Required) The kind of lock. Possible values are `CanNotDelete` and `ReadOnly`.
  - `name` - (Optional) The name of the lock. Defaults to `null` (auto-generated).
- `tags` - (Optional) A mapping of tags to assign to the private endpoint. Defaults to `null`.
- `private_dns_zone_group_name` - (Optional) The name of the private DNS zone group. Defaults to `default`.
- `private_dns_zone_resource_ids` - (Optional) A set of resource IDs of private DNS zones to associate with the private endpoint. Defaults to `[]`. If empty, no zone groups will be created and the private endpoint will not be associated with any private DNS zones; DNS records must be managed external to this module.
- `application_security_group_associations` - (Optional) A map of resource IDs of application security groups to associate with the private endpoint. Defaults to `{}`. The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time; the value is the application security group resource ID.
- `private_service_connection_name` - (Optional) The name of the private service connection. One will be generated if not set. Defaults to `null`.
- `network_interface_name` - (Optional) The name of the network interface. One will be generated if not set. Defaults to `null`.
- `location` - (Optional) The Azure location where the resources will be deployed. Defaults to the location of the storage account.
- `resource_group_name` - (Optional) The resource group where the resources will be deployed. Defaults to the resource group of the storage account.
- `ip_configurations` - (Optional) A map of IP configurations to create on the private endpoint. Defaults to `{}` (the platform allocates IPs). The map key is deliberately arbitrary to avoid issues where map keys may be unknown at plan time. Each value supports:
  - `name` - (Required) The name of the IP configuration.
  - `private_ip_address` - (Required) The private IP address of the IP configuration.

Type:

```hcl
map(object({
    name = optional(string, null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    lock = optional(object({
      kind = string
      name = optional(string, null)
    }), null)
    tags                                    = optional(map(string), null)
    subnet_resource_id                      = string
    subresource_name                        = string
    private_dns_zone_group_name             = optional(string, "default")
    private_dns_zone_resource_ids           = optional(set(string), [])
    application_security_group_associations = optional(map(string), {})
    private_service_connection_name         = optional(string, null)
    network_interface_name                  = optional(string, null)
    location                                = optional(string, null)
    resource_group_name                     = optional(string, null)
    ip_configurations = optional(map(object({
      name               = string
      private_ip_address = string
    })), {})
  }))
```

Default: `{}`

### <a name="input_private_endpoints_manage_dns_zone_group"></a> [private\_endpoints\_manage\_dns\_zone\_group](#input\_private\_endpoints\_manage\_dns\_zone\_group)

Description: Whether to manage private DNS zone groups with this module. Defaults to `true`. If set to `false`, you must manage private DNS zone groups externally, e.g. using Azure Policy.

Type: `bool`

Default: `true`

### <a name="input_provisioned_billing_model_version"></a> [provisioned\_billing\_model\_version](#input\_provisioned\_billing\_model\_version)

Description: [DEPRECATED] (Optional) Specifies the version of the provisioned billing model (e.g. when `account_kind = "FileStorage"` for Storage File). Possible value is `V2`. Defaults to `null`. Changing this forces a new resource to be created. This variable is only honoured when `account_sku_name` is set to `null`; otherwise `account_sku_name` wins. Prefer `account_sku_name` (use a `*V2_*` SKU such as `StandardV2_ZRS` or `PremiumV2_ZRS`).

Type: `string`

Default: `null`

### <a name="input_public_network_access_enabled"></a> [public\_network\_access\_enabled](#input\_public\_network\_access\_enabled)

Description: (Optional) Whether the public network access is enabled? Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_queue_encryption_key_type"></a> [queue\_encryption\_key\_type](#input\_queue\_encryption\_key\_type)

Description: (Optional) The encryption type of the queue service. Possible values are `Service` and `Account`. Defaults to `null` (Azure platform default of `Service`). Changing this forces a new resource to be created.

Type: `string`

Default: `null`

### <a name="input_queue_properties"></a> [queue\_properties](#input\_queue\_properties)

Description: Queue service-level settings for the storage account. Defaults to `null` (Azure platform defaults).

- `cors_rules` - (Optional) A list of CORS rules for the queue service. Defaults to `null`. Each entry supports:
  - `allowed_headers` - (Required) A list of headers allowed in cross-origin requests.
  - `allowed_methods` - (Required) A list of HTTP methods allowed.
  - `allowed_origins` - (Required) A list of origin domains allowed.
  - `exposed_headers` - (Required) A list of response headers exposed to CORS clients.
  - `max_age_in_seconds` - (Required) Seconds the browser should cache a preflight response.

Type:

Default: `null`

### <a name="input_queues"></a> [queues](#input\_queues)

Description: A map of queues to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to `{}` (no queues).

- `name` - (Required) The name of the Queue which should be created within the Storage Account. Must be unique within the storage account. Changing this forces a new resource to be created.
- `metadata` - (Optional) A mapping of MetaData which should be assigned to this Storage Queue. Defaults to `null`.
- `role_assignments` - (Optional) A map of role assignments to create on the queue. Defaults to `{}`. See `var.role_assignments` for the attribute schema.
- `timeouts` - (Optional) Per-operation timeouts for the queue resource. Defaults to `null` (uses provider defaults inherited from `var.timeouts`). Supports:
  - `create` - (Optional) Timeout for create operations.
  - `delete` - (Optional) Timeout for delete operations.
  - `read` - (Optional) Timeout for read operations.
  - `update` - (Optional) Timeout for update operations.

Type:

```hcl
map(object({
    metadata = optional(map(string))
    name     = string
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
```

Default: `{}`

### <a name="input_resource_types"></a> [resource\_types](#input\_resource\_types)

Description: Override the AzAPI `<provider>/<resource>@<api-version>` strings used by this module. Each key defaults to a tested value; supply only the keys you want to override. Useful when targeting a sovereign cloud with older API versions, or when opting into a newer preview API.

- `storage_account`            - The storage account itself, used by both the create call and the customer-managed-key patch.
- `customer_managed_key_vault` - The Key Vault data source used to look up the vault URI when CMK is enabled.
- `lock`                       - Management lock applied to the storage account (and to private endpoints when configured).
- `blob_container`             - Blob containers (also used by Data Lake Gen2 filesystems, which are blob containers in ARM).
- `blob_service`               - The `blobServices/default` sub-resource, patched by the static-website and blob-service submodules.
- `file_service`               - The `fileServices/default` sub-resource, patched by the file-service submodule for CORS, soft-delete, and SMB settings.
- `queue`                      - Storage queues.
- `table`                      - Storage tables.
- `share`                      - File shares.
- `local_user`                 - SFTP local users.
- `management_policy`          - The lifecycle-management policy.
- `queue_service`              - The `queueServices/default` sub-resource, patched by the queue-service-properties submodule.
- `table_service`              - The `tableServices/default` sub-resource, patched by the table-service-properties submodule.
- `private_endpoint`           - Private endpoints created for the storage account.
- `private_dns_zone_group`     - The private DNS zone group resource attached to a private endpoint.

Type:

```hcl
object({
    storage_account            = optional(string, "Microsoft.Storage/storageAccounts@2025-06-01")
    customer_managed_key_vault = optional(string, "Microsoft.KeyVault/vaults@2024-11-01")
    lock                       = optional(string, "Microsoft.Authorization/locks@2020-05-01")
    blob_container             = optional(string, "Microsoft.Storage/storageAccounts/blobServices/containers@2025-06-01")
    blob_service               = optional(string, "Microsoft.Storage/storageAccounts/blobServices@2025-06-01")
    file_service               = optional(string, "Microsoft.Storage/storageAccounts/fileServices@2025-06-01")
    queue                      = optional(string, "Microsoft.Storage/storageAccounts/queueServices/queues@2025-06-01")
    table                      = optional(string, "Microsoft.Storage/storageAccounts/tableServices/tables@2025-06-01")
    share                      = optional(string, "Microsoft.Storage/storageAccounts/fileServices/shares@2025-06-01")
    local_user                 = optional(string, "Microsoft.Storage/storageAccounts/localUsers@2025-06-01")
    management_policy          = optional(string, "Microsoft.Storage/storageAccounts/managementPolicies@2025-06-01")
    queue_service              = optional(string, "Microsoft.Storage/storageAccounts/queueServices@2025-06-01")
    table_service              = optional(string, "Microsoft.Storage/storageAccounts/tableServices@2025-06-01")
    private_endpoint           = optional(string, "Microsoft.Network/privateEndpoints@2025-05-01")
    private_dns_zone_group     = optional(string, "Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2025-05-01")
  })
```

Default: `{}`

### <a name="input_retry"></a> [retry](#input\_retry)

Description: Retry configuration applied to every `azapi` resource managed by the module (root storage account and all submodules). By default, retries only the transient `StorageAccountOperationInProgress` error, starting at 5 seconds and capping the interval at 60 seconds.

- `error_message_regex`  - (Optional) A list of regex patterns matching error messages that trigger a retry. Supplying this field replaces the default list; include `StorageAccountOperationInProgress` to retain the module's transient storage-operation retry.
- `interval_seconds`     - (Optional) Initial interval between retries in seconds. Defaults to `5`.
- `max_interval_seconds` - (Optional) Maximum interval between retries in seconds. Defaults to `60`.

Set `retry = null` to disable custom retries. The default deliberately does not retry generic HTTP 403 or 409 responses, so authorization failures and permanent conflicts remain visible.

See <https://registry.terraform.io/providers/Azure/azapi/latest/docs/resources/resource#retry> for full semantics.

Type:

```hcl
object({
    error_message_regex  = optional(list(string), ["StorageAccountOperationInProgress"])
    interval_seconds     = optional(number, 5)
    max_interval_seconds = optional(number, 60)
  })
```

Default: `{}`

### <a name="input_role_assignment_definition_lookup_enabled"></a> [role\_assignment\_definition\_lookup\_enabled](#input\_role\_assignment\_definition\_lookup\_enabled)

Description: Whether the `Azure/avm-utl-interfaces/azure` module composed by the internal `role_assignments` submodule should resolve role definition names supplied via `role_definition_id_or_name` by querying the Azure Authorization API. Applies to every role assignment created by this module: the storage account scope (`var.role_assignments`), every container/queue/share/table scope and every private endpoint scope. Defaults to `true`.

Set to `false` if you only ever supply fully-qualified role definition resource IDs (`/subscriptions/.../providers/Microsoft.Authorization/roleDefinitions/<guid>`) in `role_definition_id_or_name`. Disabling the lookup avoids the API call, which is useful in air-gapped or permission-restricted environments where the calling identity lacks `Microsoft.Authorization/roleDefinitions/read` at the parent scope.

Type: `bool`

Default: `true`

### <a name="input_role_assignments"></a> [role\_assignments](#input\_role\_assignments)

Description: A map of role assignments to create on the resource. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time. Defaults to `{}`.

- `role_definition_id_or_name` - (Required) The ID or name of the role definition to assign to the principal.
- `principal_id` - (Required) The ID of the principal to assign the role to.
- `description` - (Optional) The description of the role assignment. Defaults to `null`.
- `skip_service_principal_aad_check` - (Optional) Retained for backwards compatibility with the legacy `azurerm` schema. Not honoured under AzAPI: the field is accepted but has no effect on the underlying role assignment. Defaults to `false`.
- `condition` - (Optional) The condition which will be used to scope the role assignment. Defaults to `null`.
- `condition_version` - (Optional) The version of the condition syntax. Valid value is `2.0`. Defaults to `null`.
- `delegated_managed_identity_resource_id` - (Optional) The resource ID of the delegated managed identity. Defaults to `null`.
- `principal_type` - (Optional) The type of principal. One of `User`, `Group`, `ServicePrincipal`, `ForeignGroup`, `Device`. Defaults to `null`.

Type:

```hcl
map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
    principal_type                         = optional(string, null)
  }))
```

Default: `{}`

### <a name="input_routing"></a> [routing](#input\_routing)

Description: Configures the storage account routing preference. Defaults to `null` (Azure platform defaults).

- `choice` - (Optional) Specifies the kind of network routing opted by the user. Possible values are `InternetRouting` and `MicrosoftRouting`. Defaults to `MicrosoftRouting`.
- `publish_internet_endpoints` - (Optional) Should internet routing storage endpoints be published? Defaults to `false`.
- `publish_microsoft_endpoints` - (Optional) Should Microsoft routing storage endpoints be published? Defaults to `false`.

Type:

```hcl
object({
    choice                      = optional(string, "MicrosoftRouting")
    publish_internet_endpoints  = optional(bool, false)
    publish_microsoft_endpoints = optional(bool, false)
  })
```

Default: `null`

### <a name="input_sas_policy"></a> [sas\_policy](#input\_sas\_policy)

Description: Configures the SAS policy on the storage account. Defaults to `null` (no SAS policy).

- `expiration_period` - (Required) The SAS expiration period in the format `DD.HH:MM:SS`.
- `expiration_action` - (Optional) The SAS expiration action. The only possible value is `Log` at this moment. Defaults to `Log`.

Type:

```hcl
object({
    expiration_action = optional(string, "Log")
    expiration_period = string
  })
```

Default: `null`

### <a name="input_sftp_enabled"></a> [sftp\_enabled](#input\_sftp\_enabled)

Description: (Optional) Boolean, enable SFTP for the storage account.  Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_shared_access_key_enabled"></a> [shared\_access\_key\_enabled](#input\_shared\_access\_key\_enabled)

Description: (Optional) Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If `false`, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). Defaults to `false`.

Type: `bool`

Default: `false`

### <a name="input_shares"></a> [shares](#input\_shares)

Description: A map of file shares to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to `{}` (no shares).

- `name` - (Required) The name of the share. Must be unique within the storage account. Changing this forces a new resource to be created.
- `quota` - (Required) The maximum size of the share, in gigabytes. For Standard storage accounts, this must be `1` GB or higher and at most `5120` GB (5 TB). For Premium FileStorage accounts, this must be greater than 100 GB and at most `102400` GB (100 TB).
- `provisioned_bandwidth_mibps` - (Optional) The provisioned bandwidth of the share, in MiB/s. Only valid for Files Provisioned v2 accounts. Defaults to `null`.
- `provisioned_iops` - (Optional) The provisioned IOPS of the share. Only valid for Files Provisioned v2 accounts. Defaults to `null`.
- `access_tier` - (Optional) The access tier of the file share. Possible values are `Hot`, `Cool`, `TransactionOptimized`, `Premium`. Defaults to `null` (Azure platform default).
- `enabled_protocol` - (Optional) The protocol used for the share. Possible values are `SMB` and `NFS`. `SMB` indicates the share can be accessed by SMBv3.0, SMBv2.1 and REST. `NFS` indicates the share can be accessed by NFSv4.1. Defaults to `null` (Azure platform default of `SMB`). Changing this forces a new resource to be created.
- `metadata` - (Optional) A mapping of MetaData for this File Share. Defaults to `null`.
- `root_squash` - (Optional) The root squash behaviour for an NFS share. Possible values are `NoRootSquash`, `RootSquash`, `AllSquash`. Defaults to `null`.
- `signed_identifiers` - (Optional) A list of signed identifiers (stored access policies) to apply to the share. Defaults to `null`. Each entry supports:
  - `id` - (Required) The ID for this signed identifier. Maximum 64 characters.
  - `access_policy` - (Optional) The access policy for this identifier. Defaults to `null`. Supports:
    - `expiry_time` - (Required) The [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) UTC time at which this access policy should expire.
    - `permission` - (Required) The permissions associated with this signed identifier. A combination of `r` (read), `w` (write), `d` (delete), and `l` (list).
    - `start_time` - (Required) The [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) UTC time at which this access policy becomes valid.
- `role_assignments` - (Optional) A map of role assignments to create on the share. Defaults to `{}`. See `var.role_assignments` for the attribute schema.
- `timeouts` - (Optional) Per-operation timeouts for the share resource. Defaults to `null` (uses provider defaults inherited from `var.timeouts`). Supports:
  - `create` - (Optional) Timeout for create operations.
  - `delete` - (Optional) Timeout for delete operations.
  - `read` - (Optional) Timeout for read operations.
  - `update` - (Optional) Timeout for update operations.

Type:

```hcl
map(object({
    access_tier                 = optional(string)
    enabled_protocol            = optional(string)
    metadata                    = optional(map(string))
    name                        = string
    quota                       = number
    provisioned_bandwidth_mibps = optional(number)
    provisioned_iops            = optional(number)
    root_squash                 = optional(string)
    signed_identifiers = optional(list(object({
      id = string
      access_policy = optional(object({
        expiry_time = string
        permission  = string
        start_time  = string
      }))
    })))
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      principal_type                         = optional(string, null)
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
    })), {})
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
```

Default: `{}`

### <a name="input_static_website"></a> [static\_website](#input\_static\_website)

Description: A map of static website configurations to apply to the storage account. Defaults to `null` (static website disabled). The map key is arbitrary; only the first entry is used by the underlying API.

- `error_404_document` - (Optional) The absolute path to a custom webpage that should be used when a request is made which does not correspond to an existing file. Defaults to `null`.
- `index_document` - (Optional) The webpage that Azure Storage serves for requests to the root of a website or any subfolder. For example, `index.html`. The value is case-sensitive. Defaults to `null`.

Type:

```hcl
map(object({
    error_404_document = optional(string)
    index_document     = optional(string)
  }))
```

Default: `null`

### <a name="input_storage_data_lake_gen2_filesystems"></a> [storage\_data\_lake\_gen2\_filesystems](#input\_storage\_data\_lake\_gen2\_filesystems)

Description: A map of Data Lake Gen2 filesystems to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to `{}` (no filesystems).

- `name` - (Required) The name of the Data Lake Gen2 File System which should be created within the Storage Account. Must be unique within the storage account. Changing this forces a new resource to be created.
- `default_encryption_scope` - (Optional) The default encryption scope to use for this filesystem. Defaults to `null`. Changing this forces a new resource to be created.
- `properties` - (Optional) A mapping of key/value pairs assigned to this filesystem (passed as ARM container metadata). Defaults to `null`.
- `timeouts` - (Optional) Per-operation timeouts for the filesystem resource. Defaults to `null` (uses provider defaults inherited from `var.timeouts`). Supports:
  - `create` - (Optional) Timeout for create operations.
  - `delete` - (Optional) Timeout for delete operations.
  - `read` - (Optional) Timeout for read operations.
  - `update` - (Optional) Timeout for update operations.

> **v1.0.0 BREAKING CHANGE**: The `owner`, `group` and `ace` (POSIX ACL) fields, plus the standalone `var.storage_data_lake_gen2_paths` variable, are no longer supported. Those features required Data Lake DFS data-plane API calls which the AzAPI provider does not exercise. Manage them externally if required (see `examples/data_lake_gen2/` for a recipe using `azurerm_storage_data_lake_gen2_path` alongside this module).

Type:

```hcl
map(object({
    default_encryption_scope = optional(string)
    name                     = string
    properties               = optional(map(string))
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
```

Default: `{}`

### <a name="input_storage_management_policy_rule"></a> [storage\_management\_policy\_rule](#input\_storage\_management\_policy\_rule)

Description: A map of management policy rules to apply to the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to `{}` (no rules).

- `enabled` - (Required) Boolean to specify whether the rule is enabled.
- `name` - (Required) The name of the rule. Rule name is case-sensitive. It must be unique within a policy.
- `actions` - (Required) An object describing the actions taken by the rule. Supports the following nested blocks (each `optional`, defaults to `null`):

---
 `base_blob` block supports the following:
 - `auto_tier_to_hot_from_cool_enabled` - (Optional) Whether a blob should automatically be tiered from cool back to hot if it is accessed again after being tiered to cool. Defaults to `null` (Azure platform default of `false`).
 - `delete_after_days_since_creation_greater_than` - (Optional) The age in days after creation to delete the blob. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `delete_after_days_since_last_access_time_greater_than` - (Optional) The age in days after last access time to delete the blob. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `delete_after_days_since_modification_greater_than` - (Optional) The age in days after last modification to delete the blob. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_archive_after_days_since_creation_greater_than` - (Optional) The age in days after creation to archive storage. Supports blob currently at Hot or Cool tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_archive_after_days_since_last_access_time_greater_than` - (Optional) The age in days after last access time to tier blobs to archive storage. Supports blob currently at Hot or Cool tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_archive_after_days_since_last_tier_change_greater_than` - (Optional) The age in days after last tier change to skip the blob being re-archived. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_archive_after_days_since_modification_greater_than` - (Optional) The age in days after last modification to tier blobs to archive storage. Supports blob currently at Hot or Cool tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cold_after_days_since_creation_greater_than` - (Optional) The age in days after creation to tier blobs to cold storage. Supports blob currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cold_after_days_since_last_access_time_greater_than` - (Optional) The age in days after last access time to tier blobs to cold storage. Supports blob currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cold_after_days_since_modification_greater_than` - (Optional) The age in days after last modification to tier blobs to cold storage. Supports blob currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cool_after_days_since_creation_greater_than` - (Optional) The age in days after creation to tier blobs to cool storage. Supports blob currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cool_after_days_since_last_access_time_greater_than` - (Optional) The age in days after last access time to tier blobs to cool storage. Supports blob currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cool_after_days_since_modification_greater_than` - (Optional) The age in days after last modification to tier blobs to cool storage. Supports blob currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).

---
 `snapshot` block supports the following:
 - `change_tier_to_archive_after_days_since_creation` - (Optional) The age in days after creation to tier blob snapshot to archive storage. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `change_tier_to_cool_after_days_since_creation` - (Optional) The age in days after creation to tier blob snapshot to cool storage. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `delete_after_days_since_creation_greater_than` - (Optional) The age in days after creation to delete the blob snapshot. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_archive_after_days_since_last_tier_change_greater_than` - (Optional) The age in days after last tier change to skip the snapshot being re-archived. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cold_after_days_since_creation_greater_than` - (Optional) The age in days after creation to tier blob snapshots to cold storage. Supports snapshots currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).

---
 `version` block supports the following:
 - `change_tier_to_archive_after_days_since_creation` - (Optional) The age in days after creation to tier blob version to archive storage. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `change_tier_to_cool_after_days_since_creation` - (Optional) The age in days after creation to tier blob version to cool storage. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `delete_after_days_since_creation` - (Optional) The age in days after creation to delete the blob version. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_archive_after_days_since_last_tier_change_greater_than` - (Optional) The age in days after last tier change to skip the blob version being re-archived. Must be between `0` and `99999`. Defaults to `null` (no policy applied).
 - `tier_to_cold_after_days_since_creation_greater_than` - (Optional) The age in days after creation to tier blob versions to cold storage. Supports versions currently at Hot tier. Must be between `0` and `99999`. Defaults to `null` (no policy applied).

---
 `filters` block (Required) supports the following:
 - `blob_types` - (Required) A set of predefined values. Valid options are `blockBlob` and `appendBlob`.
 - `prefix_match` - (Optional) A set of strings for prefixes to be matched. Defaults to `null`.
 - `match_blob_index_tag` - (Optional) A set of blob index tag filters. Defaults to `null`. Each entry supports the attributes documented in the `match_blob_index_tag` block below.

---
 `match_blob_index_tag` block supports the following:
 - `name` - (Required) The filter tag name used for tag based filtering for blob objects.
 - `value` - (Required) The filter tag value used for tag based filtering for blob objects.
 - `operation` - (Optional) The comparison operator which is used for object comparison and filtering. Possible value is `==`. Defaults to `null` (Azure platform default of `==`).

Type:

```hcl
map(object({
    enabled = bool
    name    = string
    actions = object({
      base_blob = optional(object({
        auto_tier_to_hot_from_cool_enabled                             = optional(bool)
        delete_after_days_since_creation_greater_than                  = optional(number)
        delete_after_days_since_last_access_time_greater_than          = optional(number)
        delete_after_days_since_modification_greater_than              = optional(number)
        tier_to_archive_after_days_since_creation_greater_than         = optional(number)
        tier_to_archive_after_days_since_last_access_time_greater_than = optional(number)
        tier_to_archive_after_days_since_last_tier_change_greater_than = optional(number)
        tier_to_archive_after_days_since_modification_greater_than     = optional(number)
        tier_to_cold_after_days_since_creation_greater_than            = optional(number)
        tier_to_cold_after_days_since_last_access_time_greater_than    = optional(number)
        tier_to_cold_after_days_since_modification_greater_than        = optional(number)
        tier_to_cool_after_days_since_creation_greater_than            = optional(number)
        tier_to_cool_after_days_since_last_access_time_greater_than    = optional(number)
        tier_to_cool_after_days_since_modification_greater_than        = optional(number)
      }))
      snapshot = optional(object({
        change_tier_to_archive_after_days_since_creation               = optional(number)
        change_tier_to_cool_after_days_since_creation                  = optional(number)
        delete_after_days_since_creation_greater_than                  = optional(number)
        tier_to_archive_after_days_since_last_tier_change_greater_than = optional(number)
        tier_to_cold_after_days_since_creation_greater_than            = optional(number)
      }))
      version = optional(object({
        change_tier_to_archive_after_days_since_creation               = optional(number)
        change_tier_to_cool_after_days_since_creation                  = optional(number)
        delete_after_days_since_creation                               = optional(number)
        tier_to_archive_after_days_since_last_tier_change_greater_than = optional(number)
        tier_to_cold_after_days_since_creation_greater_than            = optional(number)
      }))
    })
    filters = object({
      blob_types   = set(string)
      prefix_match = optional(set(string))
      match_blob_index_tag = optional(set(object({
        name      = string
        operation = optional(string)
        value     = string
      })))
    })
  }))
```

Default: `{}`

### <a name="input_storage_management_policy_timeouts"></a> [storage\_management\_policy\_timeouts](#input\_storage\_management\_policy\_timeouts)

Description: Per-operation timeouts for the storage account management policy resource. Defaults to `null` (uses provider defaults).

- `create` - (Optional) Timeout for create operations. Defaults to `null`.
- `delete` - (Optional) Timeout for delete operations. Defaults to `null`.
- `read` - (Optional) Timeout for read operations. Defaults to `null`.
- `update` - (Optional) Timeout for update operations. Defaults to `null`.

Type:

```hcl
object({
    create = optional(string)
    delete = optional(string)
    read   = optional(string)
    update = optional(string)
  })
```

Default: `null`

### <a name="input_table_encryption_key_type"></a> [table\_encryption\_key\_type](#input\_table\_encryption\_key\_type)

Description: (Optional) The encryption type of the table service. Possible values are `Service` and `Account`. Defaults to `null` (Azure platform default of `Service`). Changing this forces a new resource to be created.

Type: `string`

Default: `null`

### <a name="input_table_properties"></a> [table\_properties](#input\_table\_properties)

Description: Table service-level settings for the storage account. Defaults to `null` (Azure platform defaults).

- `cors_rules` - (Optional) A list of CORS rules for the table service. Defaults to `null`. Each entry supports:
  - `allowed_headers` - (Required) A list of headers allowed in cross-origin requests.
  - `allowed_methods` - (Required) A list of HTTP methods allowed.
  - `allowed_origins` - (Required) A list of origin domains allowed.
  - `exposed_headers` - (Required) A list of response headers exposed to CORS clients.
  - `max_age_in_seconds` - (Required) Seconds the browser should cache a preflight response.

Type:

Default: `null`

### <a name="input_table_service_cors_propagation_wait"></a> [table\_service\_cors\_propagation\_wait](#input\_table\_service\_cors\_propagation\_wait)

Description: (Optional) Duration to wait after the table service CORS PATCH before allowing dependents to refresh, expressed as a Go duration string (e.g. `2m`, `90s`). Defaults to `"2m"`.

The ARM `GET` on `tableServices/default` is eventually consistent: immediately after a successful PATCH the read can omit the `corsRules` that were just applied, which causes a follow-up `terraform plan` (and the post-apply idempotency check) to see false drift. The read-back stabilises after roughly two minutes. Set to `"0s"` to disable the wait entirely (not recommended when `table_properties.cors_rules` is set).

Type: `string`

Default: `"2m"`

### <a name="input_tables"></a> [tables](#input\_tables)

Description: A map of tables to create on the storage account. The map key is arbitrary; the value supports the following attributes. Defaults to `{}` (no tables).

- `name` - (Required) The name of the storage table. Only alphanumeric characters allowed, starting with a letter. Must be unique within the storage account. Changing this forces a new resource to be created.
- `signed_identifiers` - (Optional) A list of signed identifiers (stored access policies) to apply to the table. Defaults to `null`. Each entry supports:
  - `id` - (Required) The ID for this signed identifier. Maximum 64 characters.
  - `access_policy` - (Optional) The access policy for this identifier. Defaults to `null`. Supports:
    - `expiry_time` - (Required) The ISO8601 UTC time at which this access policy should expire.
    - `permission` - (Required) The permissions associated with this signed identifier. A combination of `r` (read), `a` (add), `u` (update), and `d` (delete).
    - `start_time` - (Required) The ISO8601 UTC time at which this access policy becomes valid.
- `role_assignments` - (Optional) A map of role assignments to create on the table. Defaults to `{}`. See `var.role_assignments` for the attribute schema.
- `timeouts` - (Optional) Per-operation timeouts for the table resource. Defaults to `null` (uses provider defaults inherited from `var.timeouts`). Supports:
  - `create` - (Optional) Timeout for create operations.
  - `delete` - (Optional) Timeout for delete operations.
  - `read` - (Optional) Timeout for read operations.
  - `update` - (Optional) Timeout for update operations.

Type:

```hcl
map(object({
    name = string
    signed_identifiers = optional(list(object({
      id = string
      access_policy = optional(object({
        expiry_time = string
        permission  = string
        start_time  = string
      }))
    })))

timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
      read   = optional(string)
      update = optional(string)
    }))
  }))
```

Default: `{}`

### <a name="input_tags"></a> [tags](#input\_tags)

Description: Custom tags to apply to the resource.

Type: `map(string)`

Default: `null`

### <a name="input_timeouts"></a> [timeouts](#input\_timeouts)

Description: Default per-operation timeouts applied to every `azapi` resource managed by the module. Defaults to `null` (provider defaults). Each value is a Go duration string (e.g. `30m`, `1h`).

- `create` - (Optional) Timeout for create operations. Defaults to `null`.
- `read` - (Optional) Timeout for read operations. Defaults to `null`.
- `update` - (Optional) Timeout for update operations. Defaults to `null`.
- `delete` - (Optional) Timeout for delete operations. Defaults to `null`.

The root storage account uses these values directly. Submodules (containers, queues, shares, tables, diagnostic settings, private endpoints, management policy, local users, role assignments, Data Lake Gen2 filesystems) use these as a default that can be overridden per-item via the item's own `timeouts` field.

Type:

```hcl
object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
```

Default: `null`

## Outputs

The following outputs are exported:

### <a name="output_containers"></a> [containers](#output\_containers)

Description: Map of storage containers that are created.

### <a name="output_data_lake_gen2_filesystems"></a> [data\_lake\_gen2\_filesystems](#output\_data\_lake\_gen2\_filesystems)

Description: Map of Data Lake Gen2 filesystems that are created.

### <a name="output_fqdn"></a> [fqdn](#output\_fqdn)

Description: Fqdns for storage services.

### <a name="output_local_users"></a> [local\_users](#output\_local\_users)

Description: A map of Storage Account Local Users. The map key matches `var.local_user`.

The map value contains the following attributes:
- `id` - The ID of the Storage Account Local User.
- `name` - The name of the Storage Account Local User.
- `home_directory` - The home directory of the Storage Account Local User.
- `sid` - The unique Security Identifier (SID) of the Storage Account Local User.
- `ssh_key_enabled` - Specifies whether SSH Key authentication is enabled.
- `ssh_password_enabled` - Specifies whether SSH password authentication is enabled.

NOTE: The local user `password` attribute is no longer exported. The Storage RP  
only returns the password from the `regeneratePassword` ARM action (the
`listKeys` action returns an empty body because the password is not persisted  
server-side). Declare a managed `azapi_resource_action` resource with
`action = "regeneratePassword"` and `response_export_values = ["sshPassword"]`  
in the consuming root module; the default `apply_after_create` behavior calls  
the action exactly once at create so the password is stable. Pipe the result  
through `value_wo` on `azurerm_key_vault_secret` to keep it out of state.

### <a name="output_name"></a> [name](#output\_name)

Description: The name of the storage account.

### <a name="output_private_endpoints"></a> [private\_endpoints](#output\_private\_endpoints)

Description: A map of private endpoints created by the module. The map key matches `var.private_endpoints`.

Each value is an object with:
- `id` - The resource ID of the private endpoint.
- `name` - The name of the private endpoint.
- `edge_zone` - The Edge Zone the private endpoint was placed in, inherited from `var.edge_zone`, or `null` when the private endpoint is regional.
- `private_dns_zone_group_id` - The resource ID of the managed private DNS zone group, or `null` if not managed by this module.
- `role_assignments` - Map of role assignments created at the private endpoint scope.

### <a name="output_queues"></a> [queues](#output\_queues)

Description: Map of storage queues that are created.

### <a name="output_resource"></a> [resource](#output\_resource)

Description: The full Storage Account azapi\_resource.

### <a name="output_resource_id"></a> [resource\_id](#output\_resource\_id)

Description: The ID of the Storage Account.

### <a name="output_shares"></a> [shares](#output\_shares)

Description: Map of storage file shares that are created.

### <a name="output_tables"></a> [tables](#output\_tables)

Description: Map of storage tables that are created.

## Modules

The following Modules are called:

### <a name="module_blob_service"></a> [blob\_service](#module\_blob\_service)

Source: ./modules/blob_service

Version:

### <a name="module_containers"></a> [containers](#module\_containers)

Source: ./modules/container

Version:

### <a name="module_data_lake_filesystems"></a> [data\_lake\_filesystems](#module\_data\_lake\_filesystems)

Source: ./modules/data_lake_filesystem

Version:

### <a name="module_diagnostic_setting_blob"></a> [diagnostic\_setting\_blob](#module\_diagnostic\_setting\_blob)

Source: ./modules/diagnostic_setting

Version:

### <a name="module_diagnostic_setting_file"></a> [diagnostic\_setting\_file](#module\_diagnostic\_setting\_file)

Source: ./modules/diagnostic_setting

Version:

### <a name="module_diagnostic_setting_queue"></a> [diagnostic\_setting\_queue](#module\_diagnostic\_setting\_queue)

Source: ./modules/diagnostic_setting

Version:

### <a name="module_diagnostic_setting_storage_account"></a> [diagnostic\_setting\_storage\_account](#module\_diagnostic\_setting\_storage\_account)

Source: ./modules/diagnostic_setting

Version:

### <a name="module_diagnostic_setting_table"></a> [diagnostic\_setting\_table](#module\_diagnostic\_setting\_table)

Source: ./modules/diagnostic_setting

Version:

### <a name="module_file_service"></a> [file\_service](#module\_file\_service)

Source: ./modules/file_service

Version:

### <a name="module_local_users"></a> [local\_users](#module\_local\_users)

Source: ./modules/local_user

Version:

### <a name="module_management_policy"></a> [management\_policy](#module\_management\_policy)

Source: ./modules/management_policy

Version:

### <a name="module_private_endpoints"></a> [private\_endpoints](#module\_private\_endpoints)

Source: ./modules/private_endpoint

Version:

### <a name="module_queue_service"></a> [queue\_service](#module\_queue\_service)

Source: ./modules/queue_service

Version:

### <a name="module_queues"></a> [queues](#module\_queues)

Source: ./modules/queue

Version:

### <a name="module_role_assignments"></a> [role\_assignments](#module\_role\_assignments)

Source: ./modules/role_assignments

Version:

### <a name="module_shares"></a> [shares](#module\_shares)

Source: ./modules/share

Version:

### <a name="module_static_website"></a> [static\_website](#module\_static\_website)

Source: ./modules/static_website

Version:

### <a name="module_table_service"></a> [table\_service](#module\_table\_service)

Source: ./modules/table_service

Version:

### <a name="module_tables"></a> [tables](#module\_tables)

Source: ./modules/table

Version:

## Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at <https://go.microsoft.com/fwlink/?LinkID=824704>. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.

terraform-azurerm-avm-res-storage-storageaccount

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README