[AVM Module Issue]: Feature request: SQL workload backup

[paul-e-martin]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Feature Request

(Optional) Module Version

No response

(Optional) Correlation Id

No response

Description

Hi, is it possible to get the azure_backup_configurations expanded to allow for sql workload backups please

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-terraform) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-terraform) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.

[lonegunmanb]

Thank you for this feature request, @paul-e-martin.

After investigating your request, we've determined that SQL workload backup is architecturally very different from the IaaS VM-level backup currently supported by this module, and it would be better served by the Recovery Services Vault (RSV) module.

Why this doesn't fit in the VM module

The current backup implementation in this module protects the entire VM as a single unit (protectedItemType = Microsoft.Compute/virtualMachines, container type iaasvmcontainerv2) — a single API call. SQL workload backup, on the other hand, operates at the individual database level inside the VM and requires a multi-step workflow:

1. Install the AzureBackupWindowsWorkload extension on the VM
2. Register the VM as a VMAppContainer (different container type)
3. Discover SQL Server instances and databases (async operation)
4. Create a workload-specific backup policy
5. Protect each discovered database individually (protectedItemType = AzureVmWorkloadSQLDatabaseProtectedItem)

These are fundamentally different API paths, container types, and protected item types — they cannot be added by simply extending the existing azure_backup_configurations variable.

Where this should live

In the Azure resource hierarchy, all backup resources (backupPolicies, protectedItems, protectionContainers) are child resources of Microsoft.RecoveryServices/vaults. Following AVM resource module conventions, they belong in the RSV module.

The Recovery Services Vault module (Azure/terraform-azurerm-avm-res-recoveryservices-vault) already has related infrastructure:

• A backup_protected_vm submodule for VM-level backup
• A workload_policy submodule using azurerm_backup_policy_vm_workload for SQL workload backup policies

Adding a backup_protected_workload submodule to the RSV module would be the natural next step. We'd encourage you to open a feature request in the RSV module repository for SQL workload backup support.

Workaround in the meantime

You can implement SQL workload backup outside this module today:

1. Use azurerm_backup_policy_vm_workload to create the backup policy
2. Use azapi_resource to call the Azure Backup REST API directly for container registration and database protection

Related: #203

Closing this issue as it falls outside the scope of this module. Thank you for your understanding!