Azure Verified Modules

Azure Verified Modules (Reference) Skill

This skill helps you learn from Azure Verified Modules (AVM) - Microsoft's official Terraform modules - to understand best practices, security patterns, and proper resource configuration when building your own custom modules.

When to Use This Skill

• Learning best practices for Azure resource configuration
• Researching security defaults that Microsoft recommends
• Understanding module structure and organization patterns
• Finding proper resource attributes and configurations
• Reference architecture for custom module development

How to Use AVM as Reference

AVM provides examples of:

• Security-first configurations (TLS versions, encryption, network rules)
• Proper variable validation patterns
• Output structure and naming conventions
• Dynamic blocks for optional resources
• Module organization and file structure

What are Azure Verified Modules?

Azure Verified Modules (AVM) are Microsoft's official Terraform modules that serve as reference implementations showing:

• Security best practices - Microsoft-recommended security configurations
• Proper resource patterns - How to structure and organize resources
• Validation rules - Input validation for Azure resource constraints
• Output conventions - Standard output naming and structure
• Testing patterns - How Microsoft tests infrastructure code

Finding AVM for Reference

Official AVM Catalog

Browse implementations: https://azure.github.io/Azure-Verified-Modules/

Terraform Registry

View source code: https://registry.terraform.io/namespaces/Azure AVM modules are prefixed with avm-, e.g., avm-res-storage-storageaccount. (https://registry.terraform.io/search/modules?q=avm)

Using Terraform MCP Tools

```bash

Use terraform MCP to find relevant AVM modules

search_modules("azure storage account verified")

View AVM implementation details

get_module_details("Azure/avm-res-storage-storageaccount/azurerm") ```

Key Learnings from AVM

1. Security Defaults

• Always enforce TLS 1.2 minimum
• Disable public access by default
• Use private endpoints for PaaS services
• Enable encryption at rest and in transit

2. Variable Design

• Add validation for Azure resource constraints
• Provide sensible defaults for optional values
• Use object types for complex configurations
• Document all variables with descriptions

3. Resource Organization

• Use `for_each` for child resources
• Implement dynamic blocks for optional configs
• Tag all resources consistently
• Name resources predictably

4. Output Structure

• Expose resource IDs
• Provide connection endpoints
• Mark sensitive values appropriately
• Use descriptive output names

What NOT to Do

❌ DON'T copy AVM by calling it as a module: ```hcl

This defeats the purpose - just creates a wrapper

module "storage_wrapper" { source = "Azure/avm-res-storage-storageaccount/azurerm" version = "0.2.0" name = var.name } ```

✅ DO learn patterns and implement resources directly: ```hcl

This is what we want - actual resource using AVM patterns

resource "azurerm_storage_account" "this" { name = var.name resource_group_name = var.resource_group_name location = var.location

Using security patterns learned from AVM

min_tls_version = "TLS1_2" https_traffic_only_enabled = true } ```

Additional Resources

For detailed code examples, security patterns, and module templates, see the reference guide.