Skip to content
/ terraform-azurerm-container-app-environment Public

This module manages the creation and configuration of an Azure Container App Environment. It supports network isolation, Azure Virtual Network integration, Dapr components,storage configuration, scaling, and secure communication for containerized applications.

License

Apache-2.0 license
0 stars 0 forks Branches Tags Activity
Star
Notifications You must be signed in to change notification settings

CloudAstro/terraform-azurerm-container-app-environment

BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
.github/workflows
.github/workflows
 
 
examples
examples
 
 
.commitlintrc.yml
.commitlintrc.yml
 
 
.gitignore
.gitignore
 
 
.pre-commit-config.yaml
.pre-commit-config.yaml
 
 
.release-please-manifest.json
.release-please-manifest.json
 
 
.templatesyncignore
.templatesyncignore
 
 
.terraform-docs.yml
.terraform-docs.yml
 
 
.tflint.hcl
.tflint.hcl
 
 
CHANGELOG.md
CHANGELOG.md
 
 
CONTRIBUTING.md
CONTRIBUTING.md
 
 
LICENSE
LICENSE
 
 
README.md
README.md
 
 
_footer.md
_footer.md
 
 
_header.md
_header.md
 
 
locals.tf
locals.tf
 
 
main.dapr_component.tf
main.dapr_component.tf
 
 
main.storage.tf
main.storage.tf
 
 
main.tf
main.tf
 
 
outputs.tf
outputs.tf
 
 
release-please-config.json
release-please-config.json
 
 
terraform.tf
terraform.tf
 
 
variables.dapr_component.tf
variables.dapr_component.tf
 
 
variables.storage.tf
variables.storage.tf
 
 
variables.tf
variables.tf
 
 

Repository files navigation

Azure Container Apps Environment Terraform Module

Changelog Notice MIT License OpenTofu Registry

This module manages the creation and configuration of an Azure Container App Environment. It supports network isolation, Azure Virtual Network integration, Dapr components,storage configuration, scaling, and secure communication for containerized applications.

Features

  • Managed Environment for Container Apps: Deploy and manage Azure Container Apps with minimal infrastructure overhead.
  • Dapr Component Integration: Register and manage Dapr components for building stateful and stateless microservices.
  • Networking and Security: Enable network isolation and Azure Virtual Network integration for secure connectivity and network policies.
  • Storage Configuration: Manage Azure Storage shares integrated into the environment for persistent storage needs.
  • Scalability and Monitoring: Support autoscaling of container workloads and integrate with monitoring solutions for enhanced insights.
  • Flexible Configurations: Configure custom tags, Dapr settings, and other options to tailor the environment to your needs.

Example Usage

This example provisions an Azure Container App Environment with Dapr enabled, storage configured and custom tags for environment tracking.

resource "azurerm_resource_group" "rg" {
  name     = "rg-container-app-example"
  location = "germanywestcentral"
}

resource "azurerm_user_assigned_identity" "this" {
  location            = azurerm_resource_group.rg.location
  name                = "example-user"
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_virtual_network" "this" {
  name                = "vnet-env"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_subnet" "this" {
  name                 = "snet-env"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = ["10.0.8.0/21"]

  delegation {
    name = "delegation-to-container-apps"

    service_delegation {
      name = "Microsoft.App/environments"

      actions = [
        "Microsoft.Network/virtualNetworks/subnets/action",
      ]
    }
  }
}

module "container_app_env" {
  source = "../.."

  name                               = "example-container-app-env"
  resource_group_name                = azurerm_resource_group.rg.name
  location                           = azurerm_resource_group.rg.location
  infrastructure_resource_group_name = "rg-infra-shared"
  mutual_tls_enabled                 = true
  tags = {
    environment = "dev"
    owner       = "team-x"
  }

  identity = {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.this.id]
  }

  infrastructure_subnet_id       = azurerm_subnet.this.id
  internal_load_balancer_enabled = true
  zone_redundancy_enabled        = true

  workload_profile = [
    {
      name                  = "custom-profile"
      workload_profile_type = "D4"
      minimum_count         = 1
      maximum_count         = 3
    }
  ]

  container_app_environment_storage = {
    "storage1" = {
      name         = "storage1"
      account_name = "mystorageaccount"
      access_key   = "testAccessKey"
      share_name   = "fileshare1"
      access_mode  = "ReadWrite"
    }
  }

  container_app_environment_dapr_component = {
    "dapr-component1" = {
      name           = "dapr-component1"
      component_type = "state.azure.blobstorage"
      version        = "v1"
      ignore_errors  = false
      init_timeout   = "30s"
      scopes         = ["myapp"]

      metadata = [
        {
          name  = "storageAccountName"
          value = "mystorageaccount"
        }
      ]

      secret = [
        {
          name  = "storageaccountkey"
          value = "Test!SecretKey"
        }
      ]
    }
  }
}

Requirements

Name Version
terraform ~> 1.9.0
azurerm >= 4.0.0

Providers

Name Version
azurerm >= 4.0.0

Resources

Name Type
azurerm_container_app_environment.this resource
azurerm_container_app_environment_certificate.this resource
azurerm_container_app_environment_custom_domain.this resource
azurerm_container_app_environment_dapr_component.this resource
azurerm_container_app_environment_storage.this resource
azurerm_management_lock.this resource
azurerm_role_assignment.this resource

Inputs

Name Description Type Default Required
location * location - (Required) Specifies the supported Azure location where the Container App Environment is to exist. Changing this forces a new resource to be created.

Example Input:
location = "westeurope"
 string n/a yes
name * name - (Required) The name of the Container Apps Managed Environment. Changing this forces a new resource to be created.

Example Input:
name = "container-app-environment-name"
 string n/a yes
resource_group_name * resource_group_name - (Required) The name of the resource group in which the Container App Environment is to be created. Changing this forces a new resource to be created.

Example Input:
resource_group_name = "container-app-environment-rg"
 string n/a yes
container_app_environment_certificate * container_app_environment_certificate - (Optional) A container_app_environment_certificate block as defined below.
* name - (Required) The name of the Container Apps Environment Certificate. Changing this forces a new resource to be created.
* container_app_environment_id - (Required) The Container App Managed Environment ID to configure this Certificate on. Changing this forces a new resource to be created.
* certificate_blob_base64 - (Required) The Certificate Private Key as a base64 encoded PFX or PEM. Changing this forces a new resource to be created.
* certificate_password - (Required) The password for the Certificate. Changing this forces a new resource to be created.

Example Input:
container_app_environment_certificate {
    environment_certificate = {
      name                         = "myfriendlyname"
      container_app_environment_id = azurerm_container_app_environment.example.id
      certificate_blob             = filebase64("path/to/certificate_file.pfx")
      certificate_password         = "$3cretSqu1rreL"
    }
  }
 
map(object({
    name                         = string
    container_app_environment_id = string
    certificate_blob_base64      = string
    certificate_password         = string
  }))
 null no
container_app_environment_custom_domain * container_app_environment_custom_domain - (Optional) A container_app_environment_custom_domain block as defined below.
* container_app_environment_id - (Required) The ID of the Container Apps Managed Environment. Changing this forces a new resource to be created.
* certificate_blob_base64 - (Required) The bundle of Private Key and Certificate for the Custom DNS Suffix as a base64 encoded PFX or PEM.
* certificate_password - (Required) The password for the Certificate bundle.
* dns_suffix - (Required) Custom DNS Suffix for the Container App Environment.

Example Input:
container_app_environment_custom_domain = {
    custom_domain_1 = {
      container_app_environment_id = azurerm_container_app_environment.example.id
      certificate_blob_base64      = filebase64("testacc.pfx")
      certificate_password         = "TestAcc"
      dns_suffix                   = "acceptancetest.contoso.com"
    }
  }
 
map(object({
    container_app_environment_id = string
    certificate_blob_base64      = string
    certificate_password         = string
    dns_suffix                   = string
  }))
 null no
container_app_environment_dapr_component * container_app_environment_dapr_component - (Optional) A container_app_environment_dapr_component block as defined below.
* name - (Required) The name for this Dapr component. Changing this forces a new resource to be created.
* container_app_environment_id - (Required) The ID of the Container App Managed Environment for this Dapr Component. Changing this forces a new resource to be created.
* secret_store_component - (Optional) Name of a Dapr component to retrieve component secrets from.
* component_type - (Required) The Dapr Component Type. For example state.azure.blobstorage. Changing this forces a new resource to be created.
* version - (Required) The version of the component.
* ignore_errors - (Optional) Should the Dapr sidecar to continue initialisation if the component fails to load. Defaults to false
* init_timeout - (Optional) The timeout for component initialisation as a ISO8601 formatted string. e.g. 5s, 2h, 1m. Defaults to 5s.
* scopes - (Optional) A list of scopes to which this component applies.

~> Note: See the official docs for more information at https://learn.microsoft.com/en-us/azure/container-apps/dapr-overview?tabs=bicep1%2Cyaml#component-scopes

* metadata - (Optional) A metadata block as defined below.
* name - (Required) The name of the Metadata configuration item.
* secret_name - (Optional) The name of a secret specified in the secrets block that contains the value for this metadata configuration item.
* value - (Optional) The value for this metadata configuration item.
* secret - (Optional) A secret block as defined below.
* name - (Required) The Secret name.
* value - (Required) The value for this secret.

Example Input:
container_app_environment_dapr_component = {
    component1 = {
      name                         = "example-dapr-component"
      container_app_environment_id = azurerm_container_app_environment.this.id
      component_type               = "state.azure.blobstorage"
      version                      = "v1"
      ignore_errors                = false
      init_timeout                 = "5s"
      scopes                       = ["app1", "app2"]

      metadata = [
        {
          name  = "accountName"
          value = "myBlobAccount"
        },
        {
          name        = "accountKey"
          secret_name = "blob-storage-key"
        }
      ]

      secret = [
        {
          name  = "blob-storage-key"
          value = "superSecretBlobKey"
        }
      ]
    }
  }
 
map(object({
    name           = string
    component_type = string
    version        = string
    ignore_errors  = optional(bool, false)
    init_timeout   = optional(string, "5s")
    metadata = optional(list(object({
      name        = string
      secret_name = optional(string)
      value       = optional(string)
    })))
    scopes = optional(list(string))
    secret = optional(set(object({
      name  = string
      value = string
    })))
  }))
 null no
container_app_environment_storage * container_app_environment_storage - (Optional) A container_app_environment_storage block as defined below.
* name - (Required) The name for this Container App Environment Storage. Changing this forces a new resource to be created.
* container_app_environment_id - (Required) The ID of the Container App Environment to which this storage belongs. Changing this forces a new resource to be created.
* account_name - (Required) The Azure Storage Account in which the Share to be used is located. Changing this forces a new resource to be created.
* access_key - (Required) The Storage Account Access Key.
* share_name - (Required) The name of the Azure Storage Share to use. Changing this forces a new resource to be created.
* access_mode - (Required) The access mode to connect this storage to the Container App. Possible values include ReadOnly and ReadWrite. Changing this forces a new resource to be created.
* nfs_server_url - (Optional) The NFS server to use for the Azure File Share, the format will be yourstorageaccountname.file.core.windows.net. Changing this forces a new resource to be created.

Example Input:
container_app_environment_storage = {
    storage1 = {
      name                         = "mycontainerappstorage"
      container_app_environment_id = azurerm_container_app_environment.this.id
      account_name                 = azurerm_storage_account.example.name
      access_key                   = azurerm_storage_account.example.primary_access_key
      share_name                   = azurerm_storage_share.example.name
      access_mode                  = "ReadOnly"
    }
  }
 
map(object({
    name           = string
    account_name   = string
    access_key     = string
    share_name     = string
    access_mode    = string
    nfs_server_url = optional(string)
  }))
 null no
dapr_application_insights_connection_string * dapr_application_insights_connection_string - (Optional) Application Insights connection string used by Dapr to export Service to Service communication telemetry. Changing this forces a new resource to be created.

Example Input:
dapr_application_insights_connection_string = "InstrumentationKey=00000000-0000-0000-0000-000000000000;IngestionEndpoint=https://.applicationinsights.azure.com/"
 string null no
identity * identity - (Optional) An identity block as detailed below.
* system_assigned - (Required) The type of managed identity to assign. Possible values are SystemAssigned, UserAssigned, and SystemAssigned, UserAssigned (to enable both).
* identity_ids - (Optional) - A list of one or more Resource IDs for User Assigned Managed identities to assign. Required when type is set to UserAssigned or SystemAssigned, UserAssigned.

Example Inputs:
managed_identities = {
    system_assigned            = true
    user_assigned_resource_ids = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-identity"
  }
 
object({
    type         = string
    identity_ids = optional(list(string))
  })
 null no
infrastructure_resource_group_name * infrastructure_resource_group_name - (Optional) Name of the platform-managed resource group created for the Managed Environment to host infrastructure resources. Changing this forces a new resource to be created.

~> Note: Only valid if a workload_profile is specified. If infrastructure_subnet_id is specified, this resource group will be created in the same subscription as infrastructure_subnet_id.

Example Input:
infrastructure_resource_group_name = "rg-platform-managed-infrastructure"
 string null no
infrastructure_subnet_id * infrastructure_subnet_id - (Optional) The existing Subnet to use for the Container Apps Control Plane. Changing this forces a new resource to be created.

~> Note: The Subnet must have a /21 or larger address space.

Example Input:
infrastructure_subnet_id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg-networking/providers/Microsoft.Network/virtualNetworks/vnet-main/subnets/snet-container-apps-control-plane"
 string null no
internal_load_balancer_enabled * internal_load_balancer_enabled - (Optional) Should the Container Environment operate in Internal Load Balancing Mode? Defaults to false. Changing this forces a new resource to be created.

~> Note: can only be set to true if infrastructure_subnet_id is specified.

Example Input:
internal_load_balancer_enabled = false
 bool null no
lock * lock - (Optional) A lock block as defined below.
* kind - (Required) The type of lock. Possible values are \"CanNotDelete\" and \"ReadOnly\".
* name - (Optional) The name of the lock. If not specified, a name will be generated based on the kind value. Changing this forces the creation of a new resource.

Example Input:
lock = {
  kind = "CanNotDelete"
  name = "my-resource-lock"
 }
 
object({
    kind = string
    name = optional(string, null)
  })
 null no
log_analytics_workspace_id * log_analytics_workspace_id - (Optional) The ID for the Log Analytics Workspace to link this Container Apps Managed Environment to.

~> Note: required if logs_destination is set to log-analytics. Cannot be set if logs_destination is set to azure-monitor.

Example Input:
log_analytics_workspace_id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/workspace-name"
 string null no
logs_destination * logs_destination -(Optional) Where the application logs will be saved for this Container Apps Managed Environment. Possible values include log-analytics and azure-monitor. Omitting this value will result in logs being streamed only.

Example Input:
logs_destination = "log-analytics"
 string null no
mutual_tls_enabled * mutual_tls_enabled - (Optional) Should mutual transport layer security (mTLS) be enabled? Defaults to false.

~> Note: This feature is in public preview. Enabling mTLS for your applications may increase response latency and reduce maximum throughput in high-load scenarios.

Example Input:
peer_authentication_enabled = false
 bool false no
role_assignments * role_assignments - (Optional) A role_assignments block as defined below.
* role_definition_id_or_name - The ID or name of the role definition to assign to the principal.
* principal_id - The ID of the principal to assign the role to.
* description - (Optional) The description of the role assignment.
* skip_service_principal_aad_check - (Optional) If set to true, skips the Azure Active Directory check for the service principal in the tenant. Defaults to false.
* condition - (Optional) The condition which will be used to scope the role assignment.
* condition_version - (Optional) The version of the condition syntax. Leave as null if you are not using a condition, if you are then valid values are '2.0'.
* delegated_managed_identity_resource_id - (Optional) The delegated Azure Resource Id which contains a Managed Identity. Changing this forces a new resource to be created. This field is only used in cross-tenant scenario.
* principal_type - (Optional) The type of the principal_id. Possible values are User, Group and ServicePrincipal. It is necessary to explicitly set this attribute when creating role assignments if the principal creating the assignment is constrained by ABAC rules that filters on the PrincipalType attribute.

~> Note: only set skip_service_principal_aad_check to true if you are assigning a role to a service principal.

Example Input:
role_assignments = {
  "assignment1" = {
    role_definition_id_or_name             = "Contributor"
    principal_id                           = "11111111-2222-3333-4444-555555555555"
    description                            = "Granting contributor access"
    skip_service_principal_aad_check       = false
    condition                              = null
    condition_version                      = null
    delegated_managed_identity_resource_id = null
    principal_type                         = "User"
  },
  "assignment2" = {
    role_definition_id_or_name             = "Reader"
    principal_id                           = "66666666-7777-8888-9999-000000000000"
    skip_service_principal_aad_check       = true
    principal_type                         = "ServicePrincipal"
  }
 }
 
map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    description                            = optional(string)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string)
    condition_version                      = optional(string)
    delegated_managed_identity_resource_id = optional(string)
  }))
 null no
tags * tags - (Optional) A map of tags to associate with the network and subnets.

Example Input:
tags = {
    "environment" = "production"
    "department"  = "IT"
  }
 map(string) null no
timeouts * timeouts - (Optional) A timeouts block as defined below.
* create - (Defaults to 30 minutes) Used when creating the Container App Environment.
* delete - (Defaults to 30 minutes) Used when deleting the Container App Environment.
* read - (Defaults to 5 minutes) Used when retrieving the Container App Environment.
* update -(Defaults to 30 minutes) Used when updating the Container App Environment.
Example Input:
timeouts = {
    create = "45m"
    delete = "30m"
    read   = "10m"
    update = "40m"
  }
 
object({
    create = optional(string, "30m")
    delete = optional(string, "30m")
    read   = optional(string, "5m")
    update = optional(string, "30m")
  })
 null no
workload_profile * workload_profile - (Optional) A workload_profile block as defined below.
* name - (Required) The name of the workload profile.
* workload_profile_type - (Required) Workload profile type for the workloads to run on. Possible values include Consumption, D4, D8, D16, D32, E4, E8, E16 and E32.

~> Note: A Consumption type must have a name of Consumption and an environment may only have one Consumption Workload Profile.

~> Note: Defining a Consumption profile is optional, however, Environments created without an initial Workload Profile cannot have them added at a later time and must be recreated. Similarly, an environment created with Profiles must always have at least one defined Profile, removing all profiles will force a recreation of the resource.

* maximum_count - (Required) The maximum number of instances of workload profile that can be deployed in the Container App Environment.
* minimum_count - (Required) The minimum number of instances of workload profile that can be deployed in the Container App Environment.

Example Input:
workload_profile = [
  {
    name                  = "default-workload"
    workload_profile_type = "D4"
    maximum_count         = 5
    minimum_count         = 1
  }
 ]
 
list(object({
    name                  = string
    workload_profile_type = string
    maximum_count         = number
    minimum_count         = number
  }))
 null no
zone_redundancy_enabled * zone_redundancy_enabled - (Optional) Should the Container App Environment be created with Zone Redundancy enabled? Defaults to false. Changing this forces a new resource to be created.

~> Note: can only be set to true if infrastructure_subnet_id is specified.

Example Input:
zone_redundancy_enabled = false
 bool false no

Outputs

Name Description
container_app_env * name - The name of the Container Apps Managed Environment.
* resource_group_name - The name of the Resource Group where this Container App Environment exists.
* location - The Azure Location where this Container App Environment exists.
* dapr_application_insights_connection_string - Application Insights connection string used by Dapr to export Service to Service communication telemetry.
* infrastructure_resource_group_name - Name of the platform-managed resource group created for the Managed Environment to host infrastructure resources.
~> Note: Only valid if a workload_profile is specified. If infrastructure_subnet_id is specified, this resource group will be created in the same subscription as infrastructure_subnet_id.

* infrastructure_subnet_id - The existing Subnet to use for the Container Apps Control Plane.
~> Note: The Subnet must have a /21 or larger address space.

* internal_load_balancer_enabled - Should the Container Environment operate in Internal Load Balancing Mode?
~> Note: can only be set to true if infrastructure_subnet_id is specified.

* zone_redundancy_enabled - Should the Container App Environment be created with Zone Redundancy enabled?
~> Note: can only be set to true if infrastructure_subnet_id is specified.

* log_analytics_workspace_id - The ID for the Log Analytics Workspace to link this Container Apps Managed Environment to.
~> Note: required if logs_destination is set to log-analytics. Cannot be set if logs_destination is set to azure-monitor.
* logs_destination - Where the application logs will be saved for this Container Apps Managed Environment. Possible values include log-analytics and azure-monitor.

* workload_profile - A workload_profile block as defined below.
* name - The name of the workload profile.
* workload_profile_type - Workload profile type for the workloads to run on. Possible values include Consumption, D4, D8, D16, D32, E4, E8, E16 and E32.
~> Note: A Consumption type must have a name of Consumption and an environment may only have one Consumption Workload Profile.

~> Note: Defining a Consumption profile is optional, however, Environments created without an initial Workload Profile cannot have them added at a later time and must be recreated. Similarly, an environment created with Profiles must always have at least one defined Profile, removing all profiles will force a recreation of the resource.

* maximum_count - The maximum number of instances of workload profile that can be deployed in the Container App Environment.
* minimum_count - The minimum number of instances of workload profile that can be deployed in the Container App Environment.

* mutual_tls_enabled - Should mutual transport layer security (mTLS) be enabled? Defaults to false.
~> Note: This feature is in public preview. Enabling mTLS for your applications may increase response latency and reduce maximum throughput in high-load scenarios.
* tags - A map of tags to associate with the network and subnets.

* container_app_environment_custom_domain - A container_app_environment_custom_domain block as defined below.
* container_app_environment_id - The ID of the Container Apps Managed Environment.
* certificate_blob_base64 - The bundle of Private Key and Certificate for the Custom DNS Suffix as a base64 encoded PFX or PEM.
* certificate_password - The password for the Certificate bundle.
* dns_suffix - Custom DNS Suffix for the Container App Environment.

* container_app_environment_certificate - A container_app_environment_certificate block as defined below.
* name - The name of the Container Apps Environment Certificate.
* container_app_environment_id - The Container App Managed Environment ID to configure this Certificate on.
* certificate_blob_base64 - The Certificate Private Key as a base64 encoded PFX or PEM.
* certificate_password - The password for the Certificate.

* lock - A lock block as defined below.
* kind - The type of lock. Possible values are \"CanNotDelete\" and \"ReadOnly\".
* name - The name of the lock. If not specified, a name will be generated based on the kind value.

* role_assignments - A role_assignments block as defined below.
* role_definition_id_or_name - The ID or name of the role definition to assign to the principal.
* principal_id - ID of the principal to assign the role to.
* description - The description of the role assignment.
* skip_service_principal_aad_check - If set to true, skips the Azure Active Directory check for the service principal in the tenant. Defaults to false.
* condition - The condition which will be used to scope the role assignment.
* condition_version - The version of the condition syntax. Leave as null if you are not using a condition, if you are then valid values are '2.0'.
* delegated_managed_identity_resource_id - The delegated Azure Resource Id which contains a Managed Identity. This field is only used in cross-tenant scenario.
* principal_type - The type of the principal_id. Possible values are User, Group and ServicePrincipal. It is necessary to explicitly set this attribute when creating role assignments if the principal creating the assignment is constrained by ABAC rules that filters on the PrincipalType attribute.
~> Note: only set skip_service_principal_aad_check to true if you are assigning a role to a service principal.

* timeouts - A timeouts block as defined below.
* create - (Defaults to 30 minutes) Used when creating the Container App.
* delete - (Defaults to 30 minutes) Used when deleting the Container App.
* read - (Defaults to 5 minutes) Used when retrieving the Container App.
* update -(Defaults to 30 minutes) Used when updating the Container App Environment Dapr Component.

Example output:
output "name" {
    value = module.module_name.container_app_env.name
  }
dapr_components * name - The name for this Dapr component.
* container_app_environment_id - The ID of the Container App Managed Environment for this Dapr Component.
* secret_store_component - Name of a Dapr component to retrieve component secrets from.
* component_type - The Dapr Component Type. For example state.azure.blobstorage.
* version - The version of the component.
* ignore_errors - Should the Dapr sidecar to continue initialisation if the component fails to load. Defaults to false
* init_timeout - The timeout for component initialisation as a ISO8601 formatted string. e.g. 5s, 2h, 1m. Defaults to 5s.
* scopes - A list of scopes to which this component applies.

* metadata - A metadata block as defined below.
* name - The name of the Metadata configuration item.
* secret_name - The name of a secret specified in the secrets block that contains the value for this metadata configuration item.
* value - The value for this metadata configuration item.

* secret - A secret block as defined below.
* name - The Secret name.
* value - The value for this secret.

Example output:
output "dapr_components" {
    value = module.module_name.dapr_components.name
  }
storage * name - The name for this Container App Environment Storage.
* container_app_environment_id - The ID of the Container App Environment to which this storage belongs.
* account_name - The Azure Storage Account in which the Share to be used is located.
* access_key - The Storage Account Access Key.
* share_name - The name of the Azure Storage Share to use.
* access_mode - The access mode to connect this storage to the Container App. Possible values include ReadOnly and ReadWrite.

Example output:
output "storage" {
    value = module.module_name.storage.name
  }

Modules

No modules.

Additional Information

For more details about Azure Container Apps and configuring managed environments, refer to the Azure Container Apps documentation. This module is designed to manage an Azure Container App Environment, a managed environment that enables deploying and managing containerized applications and Dapr components without needing direct infrastructure oversight.

Resources

Notes

  • Ensure container_app_environment_id matches the intended resource group and region for consistency.
  • Enable vnet_integration only when virtual network connectivity is required for secure communication.
  • Use dapr_enabled to support microservices with state management, pub/sub, or secure service-to-service communication.
  • Regularly monitor and validate environment settings, including networking, storage, and monitoring configurations, for optimal performance and security.
  • Apply least privilege principles by restricting network and role assignments to the minimum necessary.
  • Organize Dapr components, storage, and network resources efficiently to reduce deployment time and complexity.
  • Validate your Terraform configuration to ensure the Container App Environment and related resources are correctly created and integrated.

License

This module is licensed under the MIT License. See the LICENSE file for more details.

About

This module manages the creation and configuration of an Azure Container App Environment. It supports network isolation, Azure Virtual Network integration, Dapr components,storage configuration, scaling, and secure communication for containerized applications.

Resources

Readme

License

Apache-2.0 license

Contributing

Contributing
Activity
Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases 1

v1.0.0 Latest
Aug 21, 2025

Packages

No packages published

Languages