Azure Function App

This Terraform module creates an Azure Function App with its App Service Plan, a consumption plan by default. A Storage Account and an Application Insights are required and are created if not provided. This module allows to deploy a application from a local or remote ZIP file that will be stored on the associated storage account.

You can create an Azure Function without plan by using the submodule modules/functionapp.

Azure Functions v3 are now supported by this module and is the default one.

Limitations

Based on a current limitation, you cannot mix Windows and Linux apps in the same resource group.

Limitations documentation: docs.microsoft.com/en-us/azure/app-service/containers/app-service-linux-intro#limitations

Global versioning rule for Claranet Azure modules

Module version	Terraform version	AzureRM version
>= 7.x.x	1.3.x	>= 3.0
>= 6.x.x	1.x	>= 3.0
>= 5.x.x	0.15.x	>= 2.0
>= 4.x.x	0.13.x / 0.14.x	>= 2.0
>= 3.x.x	0.12.x	>= 2.0
>= 2.x.x	0.12.x	< 2.0
< 2.x.x	0.11.x	< 2.0

Contributing

If you want to contribute to this repository, feel free to use our pre-commit git hook configuration which will help you automatically update and format some files for you by enforcing our Terraform code module best-practices.

More details are available in the CONTRIBUTING.md file.

Usage

This module is optimized to work with the Claranet terraform-wrapper tool which set some terraform variables in the environment needed by this module. More details about variables set by the terraform-wrapper available in the documentation.

module "azure_region" {
  source  = "claranet/regions/azurerm"
  version = "x.x.x"

  azure_region = var.azure_region
}

module "rg" {
  source  = "claranet/rg/azurerm"
  version = "x.x.x"

  location    = module.azure_region.location
  client_name = var.client_name
  environment = var.environment
  stack       = var.stack
}

module "logs" {
  source  = "claranet/run/azurerm//modules/logs"
  version = "x.x.x"

  client_name         = var.client_name
  environment         = var.environment
  stack               = var.stack
  location            = module.azure_region.location
  location_short      = module.azure_region.location_short
  resource_group_name = module.rg.resource_group_name
}

### Windows
module "function_app_windows" {
  source  = "claranet/function-app/azurerm"
  version = "x.x.x"

  client_name         = var.client_name
  environment         = var.environment
  stack               = var.stack
  location            = module.azure_region.location
  location_short      = module.azure_region.location_short
  resource_group_name = module.rg.resource_group_name

  name_prefix = "hello"

  os_type = "Windows"

  function_app_application_settings = {
    "tracker_id"      = "AJKGDFJKHFDS"
    "backend_api_url" = "https://backend.domain.tld/api"
  }

  storage_account_identity_type = "SystemAssigned"

  application_insights_log_analytics_workspace_id = module.logs.log_analytics_workspace_id

  logs_destinations_ids = [
    module.logs.logs_storage_account_id,
    module.logs.log_analytics_workspace_id
  ]

  extra_tags = {
    foo = "bar"
  }
}

### Linux
module "function_app_linux" {
  source  = "claranet/function-app/azurerm"
  version = "x.x.x"

  client_name         = var.client_name
  environment         = var.environment
  stack               = var.stack
  location            = module.azure_region.location
  location_short      = module.azure_region.location_short
  resource_group_name = module.rg.resource_group_name

  name_prefix = "hello"

  os_type              = "Linux"
  function_app_version = 4
  function_app_site_config = {
    application_stack = {
      python_version = "3.9"
    }
  }

  function_app_application_settings = {
    "tracker_id"      = "AJKGDFJKHFDS"
    "backend_api_url" = "https://backend.domain.tld/api"
  }

  storage_account_identity_type = "SystemAssigned"

  application_insights_log_analytics_workspace_id = module.logs.log_analytics_workspace_id

  logs_destinations_ids = [
    module.logs.logs_storage_account_id,
    module.logs.log_analytics_workspace_id
  ]

  extra_tags = {
    foo = "bar"
  }
}

Providers

No providers.

Modules

Name	Source	Version
linux_function	./modules/linux-function	n/a
service_plan	claranet/app-service-plan/azurerm	~> 6.5.0
windows_function	./modules/windows-function	n/a

Resources

No resources.

Inputs

Name	Description	Type	Default	Required
app_service_environment_id	ID of the App Service Environment to create this Service Plan in. Requires an Isolated SKU. Use one of I1, I2, I3 for azurerm_app_service_environment, or I1v2, I2v2, I3v2 for azurerm_app_service_environment_v3.	string	null	no
application_insights_custom_name	Custom name for application insights deployed with function app.	string	""	no
application_insights_daily_data_cap	Daily data volume cap (in GB) for Application Insights.	number	null	no
application_insights_daily_data_cap_notifications_disabled	Whether disable email notifications when data volume cap is met.	bool	null	no
application_insights_enabled	Whether Application Insights should be deployed.	bool	true	no
application_insights_extra_tags	Extra tags to add to Application Insights.	map(string)	{}	no
application_insights_force_customer_storage_for_profiler	Whether to enforce users to create their own Storage Account for profiling in Application Insights.	bool	false	no
application_insights_id	ID of the existing Application Insights to use instead of deploying a new one.	string	null	no
application_insights_internet_ingestion_enabled	Whether ingestion support from Application Insights component over the Public Internet is enabled.	bool	true	no
application_insights_internet_query_enabled	Whether querying support from Application Insights component over the Public Internet is enabled.	bool	true	no
application_insights_ip_masking_disabled	Whether IP masking in logs is disabled.	bool	false	no
application_insights_local_authentication_disabled	Whether Non-Azure AD based authentication is disabled.	bool	false	no
application_insights_log_analytics_workspace_id	ID of the Log Analytics Workspace to be used with Application Insights.	string	null	no
application_insights_name_prefix	Application Insights name prefix.	string	""	no
application_insights_retention	Retention period (in days) for logs.	number	90	no
application_insights_sampling_percentage	Percentage of data produced by the monitored application sampled for Application Insights telemetry.	number	null	no
application_insights_type	Application Insights type if need to be generated. See documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/application_insights#application_type	string	"web"	no
application_zip_package_path	Local or remote path of a zip package to deploy on the Function App.	string	null	no
authorized_ips	IPs restriction for Function in CIDR format. See documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#ip_restriction	list(string)	[]	no
authorized_service_tags	Service Tags restriction for Function App. See documentation https://www.terraform.io/docs/providers/azurerm/r/function_app.html#ip_restriction	list(string)	[]	no
authorized_subnet_ids	Subnets restriction for Function App. See documentation https://www.terraform.io/docs/providers/azurerm/r/function_app.html#ip_restriction	list(string)	[]	no
builtin_logging_enabled	Whether built-in logging is enabled.	bool	true	no
client_certificate_enabled	Whether the Function App uses client certificates.	bool	null	no
client_certificate_mode	The mode of the Function App's client certificates requirement for incoming requests. Possible values are Required, Optional, and OptionalInteractiveUser.	string	null	no
client_name	Client name/account used in naming.	string	n/a	yes
custom_diagnostic_settings_name	Custom name of the diagnostics settings, name will be 'default' if not set.	string	"default"	no
default_tags_enabled	Option to enable or disable default tags.	bool	true	no
environment	Project environment.	string	n/a	yes
extra_tags	Extra tags to add.	map(string)	{}	no
function_app_application_settings	Function App application settings.	map(string)	{}	no
function_app_application_settings_drift_ignore	Ignore drift from settings manually set.	bool	true	no
function_app_auth_settings_v2	Authentication settings V2. See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_function_app#auth_settings_v2	any	{}	no
function_app_custom_name	Custom name for function app.	string	""	no
function_app_extra_tags	Extra tags to add to Function App.	map(string)	{}	no
function_app_name_prefix	Function App name prefix.	string	""	no
function_app_site_config	Site config for Function App. See documentation https://www.terraform.io/docs/providers/azurerm/r/app_service.html#site_config. IP restriction attribute is not managed in this block.	any	{}	no
function_app_sticky_settings	Lists of connection strings and app settings to prevent from swapping between slots.	object({ app_setting_names = optional(list(string)) connection_string_names = optional(list(string)) })	null	no
function_app_version	Version of the function app runtime to use.	number	3	no
function_app_vnet_integration_subnet_id	ID of the subnet to associate with the Function App (Virtual Network integration).	string	null	no
https_only	Whether HTTPS traffic only is enabled.	bool	true	no
identity_ids	User Assigned Identities IDs to add to Function App. Mandatory if type is UserAssigned.	list(string)	null	no
identity_type	Add an Identity (MSI) to the function app. Possible values are SystemAssigned or UserAssigned.	string	"SystemAssigned"	no
ip_restriction_headers	IPs restriction headers for Function. See documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#headers	map(list(string))	null	no
location	Azure location for Function App and related resources.	string	n/a	yes
location_short	Short string for Azure location.	string	n/a	yes
logs_categories	Log categories to send to destinations.	list(string)	null	no
logs_destinations_ids	List of destination resources IDs for logs diagnostic destination. Can be Storage Account, Log Analytics Workspace and Event Hub. No more than one of each can be set. If you want to use Azure EventHub as destination, you must provide a formatted string with both the EventHub Namespace authorization send ID and the EventHub name (name of the queue to use in the Namespace) separated by the | character.	list(string)	n/a	yes
logs_metrics_categories	Metrics categories to send to destinations.	list(string)	null	no
maximum_elastic_worker_count	Maximum number of workers to use in an Elastic SKU Plan. Cannot be set unless using an Elastic SKU.	number	null	no
name_prefix	Optional prefix for the generated name.	string	""	no
name_suffix	Optional suffix for the generated name.	string	""	no
os_type	OS type for the Functions to be hosted in the Service Plan. Possible values include Windows, Linux, and WindowsContainer.	string	n/a	yes
per_site_scaling_enabled	Should per site scaling be enabled on the Service Plan.	bool	false	no
resource_group_name	Resource group name.	string	n/a	yes
scm_authorized_ips	SCM IPs restriction for Function App. See documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#scm_ip_restriction	list(string)	[]	no
scm_authorized_service_tags	SCM Service Tags restriction for Function App. See documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#scm_ip_restriction	list(string)	[]	no
scm_authorized_subnet_ids	SCM subnets restriction for Function App. See documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#scm_ip_restriction	list(string)	[]	no
scm_ip_restriction_headers	IPs restriction headers for Function App. See documentation https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#scm_ip_restriction	map(list(string))	null	no
service_plan_custom_name	Name of the App Service Plan, generated if not set.	string	""	no
service_plan_extra_tags	Extra tags to add to Service Plan.	map(string)	{}	no
sku_name	The SKU for the Service Plan. Possible values include B1, B2, B3, D1, F1, I1, I2, I3, I1v2, I2v2, I3v2, P1v2, P2v2, P3v2, P1v3, P2v3, P3v3, S1, S2, S3, SHARED, EP1, EP2, EP3, WS1, WS2, WS3, and Y1.	string	"Y1"	no
stack	Project stack name.	string	n/a	yes
staging_slot_custom_application_settings	Override staging slot with custom application settings.	map(string)	null	no
staging_slot_custom_name	Custom name of the Function App slot.	string	null	no
staging_slot_enabled	Create a staging slot alongside the Function App for blue/green deployment purposes.	bool	false	no
storage_account_authorized_ips	IPs restrictions for Function Storage Account in CIDR format.	list(string)	[]	no
storage_account_custom_name	Custom name of the Storage account to attach to function.	string	null	no
storage_account_enable_advanced_threat_protection	Whether advanced threat protection is enabled. See documentation: https://docs.microsoft.com/en-us/azure/storage/common/storage-advanced-threat-protection?tabs=azure-portal	bool	false	no
storage_account_enable_https_traffic_only	Whether HTTPS traffic only is enabled for Storage Account.	bool	true	no
storage_account_extra_tags	Extra tags to add to Storage Account.	map(string)	{}	no
storage_account_id	ID of the existing Storage Account to use.	string	null	no
storage_account_identity_ids	Specifies a list of User Assigned Managed Identity IDs to be assigned to the Storage Account.	list(string)	null	no
storage_account_identity_type	Type of Managed Service Identity that should be configured on the Storage Account.	string	null	no
storage_account_kind	Storage Account Kind.	string	"StorageV2"	no
storage_account_min_tls_version	Storage Account minimal TLS version.	string	"TLS1_2"	no
storage_account_name_prefix	Storage Account name prefix.	string	""	no
storage_account_network_bypass	Whether traffic is bypassed for Logging/Metrics/AzureServices. Valid options are any combination of Logging, Metrics, AzureServices, or None.	list(string)	[ "Logging", "Metrics", "AzureServices" ]	no
storage_account_network_rules_enabled	Whether to enable Storage Account network default rules for functions.	bool	true	no
storage_uses_managed_identity	Whether the Function App use Managed Identity to access the Storage Account. Caution This disable the storage keys on the Storage Account if created within the module.	bool	false	no
use_caf_naming	Use the Azure CAF naming provider to generate default resource name. custom_name override this if set. Legacy default name is used if this is set to false.	bool	true	no
use_existing_storage_account	Whether existing Storage Account should be used instead of creating a new one.	bool	false	no
worker_count	Number of Workers (instances) to be allocated.	number	null	no
zone_balancing_enabled	Should the Service Plan balance across Availability Zones in the region. Defaults to false because the default SKU Y1 for the App Service Plan cannot use this feature.	bool	false	no

Outputs

Name	Description
application_insights_app_id	App ID of the associated Application Insights
application_insights_application_type	Application Type of the associated Application Insights
application_insights_id	ID of the associated Application Insights
application_insights_instrumentation_key	Instrumentation key of the associated Application Insights
application_insights_name	Name of the associated Application Insights
function_app_connection_string	Connection string of the created Function App
function_app_default_hostname	Default hostname of the created Function App
function_app_id	ID of the created Function App
function_app_identity	Identity block output of the Function App
function_app_name	Name of the created Function App
function_app_outbound_ip_addresses	Outbound IP adresses of the created Function App
function_app_possible_outbound_ip_addresses	All possible outbound IP adresses of the created Function App
function_app_slot_default_hostname	Default hostname of the Function App slot
function_app_slot_identity	Identity block output of the Function App slot
function_app_slot_name	Name of the Function App slot
linux_function_app	Linux Function App output object if Linux is chosen. Please refer to ./modules/linux-function/README.md
os_type	The OS type for the Functions to be hosted in this plan.
service_plan_id	ID of the created Service Plan
service_plan_name	Name of the created Service Plan
storage_account_id	ID of the associated Storage Account, empty if connection string provided
storage_account_name	Name of the associated Storage Account, empty if connection string provided
storage_account_network_rules	Network rules of the associated Storage Account
storage_account_primary_access_key	Primary connection string of the associated Storage Account, empty if connection string provided
storage_account_primary_connection_string	Primary connection string of the associated Storage Account, empty if connection string provided
storage_account_secondary_access_key	Secondary connection string of the associated Storage Account, empty if connection string provided
storage_account_secondary_connection_string	Secondary connection string of the associated Storage Account, empty if connection string provided
windows_function_app	Windows Function App output object if Windows is chosen. Please refer to ./modules/windows-function/README.md

Related documentation

Microsoft Azure Functions documentation: github.com/Azure/Azure-Functions#documentation-1