Azure App Service (Linux Web App)
App Service plan + Linux web app with deployment slots, custom domain + managed TLS, VNet integration and autoscale.
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-08-04 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o azure-app-service-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/azure-app-service/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle azure-app-service-1.0.0.sigstore.json \
azure-app-service-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "caffe923c1a087e03907181373d1fed5766f382e1643c6717eb50e93e04a3635 azure-app-service-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "app_service" {
source = "www.iac-bazaar.com/iac-bazaar/azure-app-service/azure"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/azure-app-service?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [Azure App Service (Linux Web App)](https://www.iac-bazaar.com/catalog/azure-app-service?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "app_service" {
source = "www.iac-bazaar.com/iac-bazaar/azure-app-service/azure"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
azure-app-service
App Service plan + Linux web app with deployment slots, custom domain + managed
TLS, VNet integration and autoscale. Works with Terraform and OpenTofu
(>= 1.6), azurerm provider >= 4.0, < 5.0.
Secure defaults:
- HTTPS-only, minimum TLS 1.2, FTPS disabled, HTTP/2 enabled
- System-assigned managed identity on the app and every slot
- Diagnostics logging on by default: HTTP access logs (filesystem, 7 days / 35 MB, tunable), detailed error messages and failed-request tracing
- Custom hostname → managed certificate → SNI binding wired in the exact three-resource order azurerm requires (the classic ordering trap)
- CPU-based plan autoscale with a precondition guarding non-capable SKUs
Requirements
- Terraform or OpenTofu
>= 1.6 hashicorp/azurerm>= 4.0, < 5.0(built against 4.76)- Custom domains: DNS CNAME (or A + TXT
asuid.<domain>) must already point at the app before apply, or hostname binding fails. - Slots and autoscale need a Standard or better SKU.
Upgrade note: the app and every slot now enable diagnostics logging by
default (HTTP access logs to the app filesystem with
http_logs_retention_in_days / http_logs_retention_in_mb, plus detailed
error messages and failed-request tracing). Existing deployments will see an
in-place update adding the logs configuration on the next apply.
License
Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
- Inputs
- Outputs
Related modules
azure-container-apps
Container Apps environment with workload profiles, Dapr, KEDA scale rules, ACR pull identity and custom domain.
azure-container-instances
Runs one or more containers on Azure Container Instances without VMs or an orchestrator - secure by default with no privileged containers, redacted secret fields, and an optional managed identity.
azure-functions
Function app (Flex Consumption or Premium) with storage, Application Insights, managed identity and VNet integration.
azure-static-web-app
Globally distributed hosting for static sites and SPAs on Azure Static Web Apps with optional serverless APIs, free auto-renewing TLS, and a built-in global CDN - defaulting to the cost-free Free SKU.
azure-logic-app
An Azure Logic App (Consumption) workflow with a built-in Recurrence trigger - serverless pay-per-execution automation with a system-assigned managed identity and inbound IP allowlists.
aws-app-runner
auto_deployments takes every push to the image tag straight to production with no review, which quietly makes the deployment gate "who can push". Off by default, egress routed through your VPC, and the pull role kept separate from the run role.