Backups that Survive Whoever Gets Into the Vault
Soft delete covers deletion; it does not cover somebody shortening a retention policy so every backup ages out on its own - which deletes nothing, so no soft-delete window opens. immutability is the control that refuses that edit, and it defaults to Disabled. Locked is irreversible and gets its own acknowledgement.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "backup" {
source = "www.iac-bazaar.com/iac-bazaar/azure-backup/azure"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
azure-backup
A Recovery Services vault whose backups survive whoever gets into it. Works with
Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.
immutability defaults to Disabled, and it is the setting that matters.
Soft delete buys fourteen days against a deletion, which is real protection and
is not the whole problem: somebody with permissions on the vault can shorten a
retention policy instead, and the backups age out on their own within the
hour. Nothing was deleted, so nothing triggers a soft-delete window and nothing
alerts. Immutability is what refuses that edit, and
backups_survive_a_retention_edit is the output to assert on.
Locked is irreversible. Not "hard to undo" - there is no path back, for
anybody, including Microsoft support. It is the right end state for a production
vault and the wrong thing to discover, so it has its own acknowledgement rather
than being the default. Unlocked here: it refuses the same edits and can still
be changed while you settle the retention policies.
cross_region_restore_enabled defaults to false, so a regional outage
leaves the backups intact and unreachable - which, on the morning you need them,
is the same as not having them. It requires GeoRedundant storage, and Azure
rejects the pair at apply with an error that does not name the dependency, so a
precondition checks them together.
public_network_access_enabled defaults to true. The vault's data plane is
reachable from the internet, authenticated, and it holds a copy of everything
you back up.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage