main.tf

# AVM Interfaces module for locks, role assignments, diagnostic settings, and managed identities
module "avm_interfaces" {
  source  = "Azure/avm-utl-interfaces/azure"
  version = "0.5.0"

  diagnostic_settings_v2                    = var.diagnostic_settings
  enable_telemetry                          = var.enable_telemetry
  lock                                      = var.lock
  managed_identities                        = var.managed_identities
  role_assignment_definition_lookup_enabled = true
  role_assignment_definition_scope          = "/subscriptions/${data.azapi_client_config.this.subscription_id}"
  role_assignments                          = var.role_assignments
}

resource "azapi_resource" "this" {
  location  = var.location
  name      = var.name
  parent_id = var.parent_id
  type      = var.server_farm_resource_type
  body = {
    kind = local.kind
    properties = merge({
      asyncScalingEnabled       = null
      freeOfferExpirationTime   = null
      isCustomMode              = var.os_type == "WindowsManagedInstance"
      isSpot                    = null
      isXenon                   = null
      kubeEnvironmentProfile    = null
      elasticScaleEnabled       = local.elastic_scale_enabled
      hostingEnvironmentProfile = var.app_service_environment_id != null ? { id = var.app_service_environment_id } : null
      hyperV                    = var.os_type == "WindowsContainer"
      installScripts = var.os_type == "WindowsManagedInstance" && var.install_scripts != null ? [
        for script in var.install_scripts : {
          name = script.name
          source = {
            type      = script.source.type
            sourceUri = script.source.source_uri
          }
        }
      ] : null
      network = var.virtual_network_subnet_id != null ? {
        virtualNetworkSubnetId = var.virtual_network_subnet_id
      } : null
      perSiteScaling = var.per_site_scaling_enabled
      rdpEnabled     = var.os_type == "WindowsManagedInstance" ? var.rdp_enabled : null
      storageMounts = var.os_type == "WindowsManagedInstance" && var.storage_mounts != null ? [
        for mount in var.storage_mounts : {
          name            = mount.name
          type            = mount.type
          source          = mount.source
          destinationPath = mount.destination_path
          credentialsKeyVaultReference = {
            secretUri = mount.credentials_key_vault_reference.secret_uri
          }
        }
      ] : null
      planDefaultIdentity = var.os_type == "WindowsManagedInstance" && var.plan_default_identity != null ? {
        identityType                   = var.plan_default_identity.identity_type
        userAssignedIdentityResourceId = var.plan_default_identity.user_assigned_identity_resource_id
      } : null
      registryAdapters = var.os_type == "WindowsManagedInstance" && var.registry_adapters != null ? [
        for adapter in var.registry_adapters : {
          registryKey = adapter.registry_key
          type        = adapter.type
          keyVaultSecretReference = {
            secretUri = adapter.key_vault_secret_reference.secret_uri
          }
        }
      ] : null
      spotExpirationTime = null
      reserved           = var.os_type == "Linux"
      targetWorkerCount  = null
      targetWorkerSizeId = null
      workerTierName     = null
      zoneRedundant      = var.zone_balancing_enabled
      },
      # FC1 (Flex Consumption) maximumElasticWorkerCount is managed by Azure; omit it so ignore_missing_property handles drift
      local.is_flex_consumption ? {} : {
        maximumElasticWorkerCount = local.maximum_elastic_worker_count
      }
    )
    sku = {
      name     = var.sku_name
      capacity = local.sku_capacity
      family   = null
      size     = null
      tier     = null
    }
  }
  create_headers            = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  delete_headers            = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  read_headers              = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  response_export_values    = []
  retry                     = var.retry
  schema_validation_enabled = false
  tags                      = var.tags
  update_headers            = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null

  dynamic "identity" {
    for_each = module.avm_interfaces.managed_identities_azapi != null ? { this = module.avm_interfaces.managed_identities_azapi } : {}

    content {
      type         = identity.value.type
      identity_ids = identity.value.identity_ids
    }
  }
  dynamic "timeouts" {
    for_each = var.timeouts != null ? { this = var.timeouts } : {}

    content {
      create = timeouts.value.create
      delete = timeouts.value.delete
      read   = timeouts.value.read
      update = timeouts.value.update
    }
  }

  lifecycle {
    ignore_changes = [
      body.properties.asyncScalingEnabled,
      body.properties.freeOfferExpirationTime,
      body.properties.isSpot,
      body.properties.isXenon,
      body.properties.kubeEnvironmentProfile,
      body.properties.spotExpirationTime,
      body.properties.targetWorkerCount,
      body.properties.targetWorkerSizeId,
      body.properties.workerTierName,
      body.sku.family,
      body.sku.size,
      body.sku.tier
    ]

    precondition {
      condition     = !local.validate_flex_consumption_zone_redundancy || contains(local.flex_consumption_zone_redundant_locations, local.normalized_location)
      error_message = "Flex Consumption (sku_name = \"FC1\") zone redundancy (zone_balancing_enabled = true) is not available in region \"${var.location}\". Choose a region that supports zone-redundant Flex Consumption (supported: ${join(", ", local.flex_consumption_zone_redundant_locations)}), or set zone_balancing_enabled = false."
    }
  }
}

moved {
  from = azurerm_service_plan.this
  to   = azapi_resource.this
}

moved {
  from = azurerm_management_lock.this
  to   = azapi_resource.lock
}

moved {
  from = azurerm_role_assignment.this
  to   = azapi_resource.role_assignment
}

data "azapi_client_config" "this" {}

# FC1 (Flex Consumption) zone redundancy is region-restricted. This data source is only evaluated
# when FC1 is combined with zone_balancing_enabled, and feeds the precondition on azapi_resource.this.
# Reference: https://github.com/Azure/terraform-azurerm-avm-res-web-serverfarm/issues/133
data "azapi_resource_action" "flex_consumption_geo_regions" {
  count = local.validate_flex_consumption_zone_redundancy ? 1 : 0

  action                 = "geoRegions"
  method                 = "GET"
  query_parameters       = { sku = ["FlexConsumption"] }
  resource_id            = "/subscriptions/${data.azapi_client_config.this.subscription_id}/providers/Microsoft.Web"
  type                   = "Microsoft.Web@2024-11-01"
  response_export_values = ["value"]
}

# Lock
resource "azapi_resource" "lock" {
  count = var.lock != null ? 1 : 0

  name                   = module.avm_interfaces.lock_azapi.name
  parent_id              = azapi_resource.this.id
  type                   = module.avm_interfaces.lock_azapi.type
  body                   = module.avm_interfaces.lock_azapi.body
  create_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  delete_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  read_headers           = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  response_export_values = []
  retry                  = var.retry
  update_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null

  dynamic "timeouts" {
    for_each = var.timeouts != null ? { this = var.timeouts } : {}

    content {
      create = timeouts.value.create
      delete = timeouts.value.delete
      read   = timeouts.value.read
      update = timeouts.value.update
    }
  }

  depends_on = [
    azapi_resource.diagnostic_setting,
    azapi_resource.role_assignment
  ]
}

# Role Assignments
resource "azapi_resource" "role_assignment" {
  for_each = module.avm_interfaces.role_assignments_azapi

  name                   = each.value.name
  parent_id              = azapi_resource.this.id
  type                   = each.value.type
  body                   = each.value.body
  create_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  delete_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  read_headers           = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  response_export_values = []
  retry                  = var.retry
  update_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null

  dynamic "timeouts" {
    for_each = var.timeouts != null ? { this = var.timeouts } : {}

    content {
      create = timeouts.value.create
      delete = timeouts.value.delete
      read   = timeouts.value.read
      update = timeouts.value.update
    }
  }
}

# Diagnostic Settings
resource "azapi_resource" "diagnostic_setting" {
  for_each = module.avm_interfaces.diagnostic_settings_azapi_v2

  name                   = each.value.name
  parent_id              = azapi_resource.this.id
  type                   = each.value.type
  body                   = each.value.body
  create_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  delete_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  ignore_null_property   = true
  read_headers           = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null
  response_export_values = []
  retry                  = var.retry
  update_headers         = var.enable_telemetry ? { "User-Agent" : local.avm_azapi_header } : null

  dynamic "timeouts" {
    for_each = var.timeouts != null ? { this = var.timeouts } : {}

    content {
      create = timeouts.value.create
      delete = timeouts.value.delete
      read   = timeouts.value.read
      update = timeouts.value.update
    }
  }
}