Azure Storage Account (secure-by-default)
Storage account with containers/file shares, lifecycle rules, network rules, CMK encryption and private endpoint options - Azure's most-deployed resource done right.
Compare Object Storage across clouds →
Part of: Azure Production Landing Zone
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-06-29 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o azure-storage-account-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/azure-storage-account/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle azure-storage-account-1.0.0.sigstore.json \
azure-storage-account-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "d0885a0b6b18e27e1638d055a125aabde745773686d3735c6044ed55c497ce51 azure-storage-account-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "storage_account" {
source = "www.iac-bazaar.com/iac-bazaar/azure-storage-account/azure"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/azure-storage-account?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [Azure Storage Account (secure-by-default)](https://www.iac-bazaar.com/catalog/azure-storage-account?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "storage_account" {
source = "www.iac-bazaar.com/iac-bazaar/azure-storage-account/azure"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
azure-storage-account
Storage account with containers/file shares, lifecycle rules, network rules,
CMK encryption and private endpoint options — Azure's most-deployed resource
done right. Secure by default: HTTPS-only with TLS 1.2+, Entra-ID-first auth
(shared keys off), anonymous blob access off, network default-deny with
trusted-services bypass, infrastructure (double) encryption, blob versioning
and 7-day blob/container soft delete. Works with Terraform and OpenTofu
(>= 1.6), azurerm provider >= 4.0, < 5.0.
Requirements
| Requirement | Version |
|---|---|
| Terraform / OpenTofu | >= 1.6 |
hashicorp/azurerm | >= 4.0, < 5.0 |
License
Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
- Inputs
- Outputs
- Notes — the auth toggles that trip people up
Related modules
azure-file-share
A share inherits its security boundary from the storage account, which defaults to public access and TLS 1.0; the quota is the price on premium; and a share is backed up only when a Recovery Services vault protects it through a policy and an assignment. A private account with TLS 1.2, the quota deliberate, share soft delete on, vault, policy and protection created together (none by name).
azure-managed-disk
A managed disk's export SAS works from anywhere until public access is off; your key is a disk encryption set nobody creates; and Azure Backup for disks is a vault, a policy and an instance, where the instance is the assignment most vaults lack. Public export closed, the encryption set taken when given, and vault, policy, role assignments and backup instance created together (none by name).
azure-storage-mover
Azure Storage Mover from an NFS share to a blob container: the mover, project, endpoints and job definition, with the agent registered from its Arc machine and granted Storage Blob Data Contributor when its IDs are given. Additive copy mode; Mirror, which deletes at the target what the source no longer has, is accepted by name. The run itself is started outside Terraform.
azure-backup
Soft delete covers deletion; it does not cover somebody shortening a retention policy so every backup ages out on its own - which deletes nothing, so no soft-delete window opens. immutability is the control that refuses that edit, and it defaults to Disabled. Locked is irreversible and gets its own acknowledgement.
azure-managed-lustre
Azure Managed Lustre with the blob containers that make the data outlive the file system, root squash naming the clients that keep root, a customer-managed key through a user-assigned identity, and the capacity checked against the SKU's step before the plan. No blob integration, root on every client and the platform key are each accepted by name; the file system is zonal.
scaleway-object-bucket
Versioning is off by default and one-way; object lock can only be decided at creation; the bucket's own ACL attribute is deprecated, so a private ACL is written separately or never set; and abandoned uploads bill until a rule aborts them. Versioning on and off by name, lock with a default retention when asked, the private ACL explicit, incomplete uploads freed after a week, old versions expiring.