Azure Infrastructure-as-Code modules
37 verified terraform modules for Azure, spanning Azure. Every artifact is statically validated (tofu validate + tflint + Checkov) and passes the publish gate before it appears here. Each ships an annotated terraform.tfvars.example and a perpetual licence with 12 months of updates.
36 of 37 Azure modules are live-tested - really applied to a cloud account, verified, then destroyed. The remaining 1 are static-validated, live-test pending. We never label a module “live-tested” unless it actually passed apply→verify→destroy.
All Azure modules
API Management (Consumption tier)
An API Management gateway tuned for the serverless Consumption tier - scale-to-zero, billed per call - with a system-assigned managed identity, TLS hardening, and HTTP/2 enabled.
Application Gateway v2 + WAF
Regional L7 load balancer with WAF v2 policy, TLS termination from Key Vault, autoscaling and health probes.
Azure App Service (Linux Web App)
App Service plan + Linux web app with deployment slots, custom domain + managed TLS, VNet integration and autoscale.
Azure Bastion + Hardened Jumpbox
Bastion (Developer/Basic/Standard SKU) with optional hardened Linux VM, JIT-style NSG rules and boot diagnostics for secure VM access without public IPs.
Azure Cache for Redis
Azure Cache for Redis done cheap by default - the Basic C0 tier with TLS 1.2 minimum and the non-SSL port disabled - scaling cleanly up to Standard and Premium via precondition-guarded inputs.
Azure Container Apps Environment
Container Apps environment with workload profiles, Dapr, KEDA scale rules, ACR pull identity and custom domain.
Azure Container Instances (ACI)
Runs one or more containers on Azure Container Instances without VMs or an orchestrator - secure by default with no privileged containers, redacted secret fields, and an optional managed identity.
Azure Container Registry
ACR with geo-replication, retention/trust policies, private endpoint and AcrPull role wiring for AKS/Container Apps.
Azure Cosmos DB Account
Cosmos DB (NoSQL or MongoDB API) with multi-region failover, autoscale throughput, private endpoint and backup policy.
Azure DevOps Project + Repo + Pipeline
Bootstraps an Azure DevOps project with an initialized Git repository and a YAML build pipeline - repeatable team setup as code.
Azure Front Door (Std/Premium) + WAF
Global entry point: Front Door profile, endpoints, origin groups, custom domains with managed TLS and WAF policy.
Azure Functions App
Function app (Flex Consumption or Premium) with storage, Application Insights, managed identity and VNet integration.
Azure Key Vault
RBAC-mode Key Vault with private endpoint, diagnostics, and managed keys/secrets/certificates scaffolding.
Azure Kubernetes Service Cluster
Hardened AKS with system/user node pools, workload identity, Entra RBAC integration, Azure CNI overlay, and Container Insights wired in.
Azure Landing Zone Core
Management-group hierarchy, policy baseline (ALZ-aligned), centralized logging and RBAC scaffolding - the flagship enterprise starter.
Azure Linux VM Scale Set (Uniform)
A self-contained Linux VM Scale Set (Uniform orchestration) on Azure - one apply creates the resource group, VNet, subnet, NSG and an SSH-key-only scale set with deny-all-inbound and no public IPs.
Azure Linux Virtual Machine (self-contained)
A fully self-contained general-purpose Linux VM on Azure - one apply creates the resource group, VNet, subnet, NSG, NIC, optional public IP and an SSH-key-only VM with a system-assigned identity.
Azure Monitor & Log Analytics Baseline
Central Log Analytics workspace, diagnostic-settings-everywhere pattern, action groups and starter alert pack (metric + log + activity).
Azure Private DNS Zone
A self-contained Azure Private DNS zone with virtual-network links and optional record sets for private name resolution across VNets and Private Endpoints - VM auto-registration off by default.
Azure Private Endpoint (Private Link)
An Azure Private Endpoint giving a target PaaS resource a private IP inside your VNet so traffic stays on the Microsoft backbone - wire to existing subnet/target or run fully self-contained.
Azure Public DNS Zone & Records
An Azure public DNS zone plus a map-driven set of record sets - A, AAAA, CNAME, TXT, MX, NS, CAA and SRV - with relative naming, verbatim TXT values, and apex footgun guards.
Azure SQL Database
Logical SQL server + database with Entra-only auth, firewall/private endpoint, auditing, TDE and failover-group option.
Azure Standard Load Balancer (L4)
An Azure Standard L4 load balancer with a self-created static public IP frontend, a backend address pool, health probes and load-balancing rules - Standard SKU throughout.
Azure Static Web App
Globally distributed hosting for static sites and SPAs on Azure Static Web Apps with optional serverless APIs, free auto-renewing TLS, and a built-in global CDN - defaulting to the cost-free Free SKU.
Azure Storage Account (secure-by-default)
Storage account with containers/file shares, lifecycle rules, network rules, CMK encryption and private endpoint options - Azure's most-deployed resource done right.
Azure Traffic Manager Profile
Global, DNS-based load balancing with a Traffic Manager profile and map-driven external endpoints - Performance, Priority, Weighted, Geographic, Subnet or MultiValue routing with an HTTPS health probe.
Azure Virtual Network (hub-ready)
Production VNet with subnets, NSGs, route tables, peering and optional NAT Gateway - the network backbone every Azure deployment starts with.
Entra ID Workload Identity Baseline
App registrations, service principals, groups and federated credentials (OIDC for GitHub/Terraform) - the identity plumbing every Azure org rebuilds by hand.
Event Grid Topic & Subscriptions
An Event Grid custom topic plus event subscriptions with an optional in-module Storage Queue target - SAS auth off (Entra ID), a system-assigned identity, and HTTPS-only TLS 1.2+ storage.
Event Hubs Namespace & Hubs
An Event Hubs namespace plus hubs, each with consumer groups and least-privilege SAS rules for high-throughput (Kafka-compatible) ingestion - TLS 1.2 floor and optional default-deny networking.
Jenkins Controller on Azure (VM)
Self-hosted Jenkins on a hardened Azure Linux VM - self-contained vnet/subnet/NSG, SSH-key auth only, managed-disk encryption, Jenkins installed via cloud-init.
Logic App (Consumption) Workflow
An Azure Logic App (Consumption) workflow with a built-in Recurrence trigger - serverless pay-per-execution automation with a system-assigned managed identity and inbound IP allowlists.
MySQL Flexible Server
Azure Database for MySQL Flexible Server with TLS required by default, correct delegated-subnet + private DNS zone ordering, an Entra administrator, databases, and cheapest-by-default Burstable sizing.
PostgreSQL Flexible Server
Flexible Server with HA option, private VNet delegation, Entra auth, firewall and tuned server parameters.
Resource Group + Naming/Tagging Baseline
Opinionated resource group factory with CAF-compliant naming, mandatory tags, locks and budget alert.
Service Bus Namespace, Queues & Topics
An Azure Service Bus namespace with queues, topics and subscriptions on the Standard SKU - SAS local auth off (Entra ID + RBAC), TLS 1.2+ minimum, and dead-lettering of expired messages.
User-Assigned Managed Identities
A map-driven module creating one or many user-assigned managed identities, each with optional workload identity federation (OIDC) and least-privilege RBAC role assignments - no secrets to rotate.
Azure reference architectures
All stacks →Curated stacks of these verified modules, in the order they wire together.
Compare across clouds
All solutions →See how the services Azure covers here compare on other providers.