Azure Static Web App

azure-static-web-app

Status: static-validated, live-test pending. Ships under live-test quarantine until promoted by the Azure live lane. Schema is validated against the azurerm v4 provider docs.

Globally distributed hosting for static sites and single-page apps on Azure Static Web Apps, with optional serverless (managed-functions) APIs, free auto-renewing TLS on the *.azurestaticapps.net hostname, and a built-in global CDN. Defaults to the cost-free Free SKU. Consumes an existing resource group. Works with Terraform and OpenTofu (>= 1.6), azurerm provider >= 4.0, < 5.0.

Secure defaults

• HTTPS always on — the platform enforces free managed TLS and an HTTP→HTTPS redirect; there is no insecure mode to disable.
• No source secrets by default — no GitHub repository or token is wired in. Deploy via GitHub Actions or the SWA CLI using the api_key output, so no secret leaves the module unless you explicitly opt in.
• Footgun preconditions — sku_tier/sku_size must match; basic_auth, managed identity, and disabling public access are all Standard-tier features and fail fast at plan time if requested on the Free tier.
• Public access by design — serving public web content is the whole point, so public_network_access_enabled defaults to true. Lock it behind a private endpoint (= false) on the Standard SKU when needed.

Requirements

Requirement	Version
Terraform / OpenTofu	>= 1.6
hashicorp/azurerm	>= 4.0, < 5.0

Verification

Static-validated (tofu fmt, tofu validate, tflint, checkov). Live apply/verify/destroy testing pending an Azure sandbox subscription — see catalog status.

License

Commercial — LicenseRef-IaCBazaar-Commercial