Azure Verified Module for Azure Data Protection Backup Vault

This module provides a generic way to create and manage an Azure Data Protection Backup Vault resource.

To use this module in your Terraform configuration, you'll need to provide values for the required variables.

Features

Deploys an Azure Data Protection Backup Vault with support for private endpoints, diagnostic settings, managed identities, resource locks, and role assignments.
Supports AVM telemetry and tagging.
Flexible configuration for private DNS zone group management.

Deprecated: PostgreSQL Single Server Backup

Azure Database for PostgreSQL Single Server was retired on 2025-03-28. The postgresql backup type in this module targets the retired Single Server service and can no longer be used for new deployments.

For new PostgreSQL backups, use the postgresql_flexible backup type which targets PostgreSQL Flexible Server. See the postgres_flexible_backup example.
For legacy Single Server backup support, use v1.2.0 of this module.

Example Usage

Here is an example of how you can use this module in your Terraform configuration:

module "backup_vault" {
  source              = "Azure/avm-res-dataprotection-backupvault/azurerm"
  name                = "my-backupvault"
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name

  enable_telemetry = true

  # Optional: configure private endpoints, diagnostic settings, managed identities, etc.
  # private_endpoints = { ... }
  # diagnostic_settings = { ... }
  # managed_identities = { ... }
  # tags = { environment = "production" }
}

AVM Versioning Notice

Major version Zero (0.y.z) is for initial development. Anything MAY change at any time. The module SHOULD NOT be considered stable till at least it is major version one (1.0.0) or greater. Changes will always be via new versions being published and no changes will be made to existing published versions. For more details please go to https://semver.org/

Requirements

The following requirements are needed by this module:

terraform (>= 1.9, < 2.0)
azapi (~> 2.5)
azurerm (>= 4.2, < 6.0)
modtm (~> 0.3)
random (>= 3.5.0, < 4.0)
time (>= 0.9.0)

Resources

The following resources are used by this module:

azapi_resource.backup_instance_adls_storage (resource)
azapi_resource.backup_instance_blob_storage (resource)
azapi_resource.backup_instance_disk (resource)
azapi_resource.backup_instance_kubernetes_cluster (resource)
azapi_resource.backup_instance_postgresql (resource)
azapi_resource.backup_instance_postgresql_flexible_server (resource)
azapi_resource.backup_policy_adls_storage (resource)
azapi_resource.backup_policy_blob_storage (resource)
azapi_resource.backup_policy_disk (resource)
azapi_resource.backup_policy_kubernetes_cluster (resource)
azapi_resource.backup_policy_postgresql (resource)
azapi_resource.backup_policy_postgresql_flexible_server (resource)
azapi_resource.backup_vault (resource)
azapi_resource.diagnostic_settings (resource)
azapi_resource.lock (resource)
azapi_resource.resource_guard (resource)
azapi_resource.role_assignments (resource)
azapi_resource.vault_resource_guard_association (resource)
azapi_update_resource.cmk (resource)
modtm_telemetry.telemetry (resource)
random_uuid.telemetry (resource)
time_sleep.wait_for_backup_instance_adls_storage (resource)
time_sleep.wait_for_backup_instance_blob_storage (resource)
time_sleep.wait_for_backup_instance_disk (resource)
azapi_client_config.telemetry (data source)
azurerm_client_config.current (data source)
azurerm_role_definition.role_defs (data source)
modtm_module_source.telemetry (data source)

Required Inputs

The following input variables are required:

datastore_type

Description: Specifies the type of the datastore. Changing this forces a new resource to be created.
Valid options: ArchiveStore, OperationalStore, SnapshotStore, VaultStore.
Note: When ArchiveStore is specified, a VaultStore entry is automatically included in storageSettings as required by the Azure API.

Type: string

location

Description: Azure region where the resource should be deployed.

Type: string

name

Description: The name of this resource. Must be between 5 and 50 characters long.

Type: string

redundancy

Description: Specifies the backup storage redundancy. Changing this forces a new resource to be created.
Valid options: GeoRedundant, LocallyRedundant, ZoneRedundant.

Type: string

resource_group_name

Description: The resource group where the resources will be deployed.

Type: string

Optional Inputs

The following input variables are optional (have default values):

alerts_for_all_job_failures

Description: Azure Monitor alert setting for all job failures. Valid options: "Enabled", "Disabled". Defaults to null (not set).
When set, configures monitoringSettings.azureMonitorAlertSettings.alertsForAllJobFailures on the vault.

Type: string

Default: null

backup_instances

Description: Map of backup instances to create. Each instance references a backup policy via backup_policy_key.

Supported types: "disk", "blob", "adls", "kubernetes", "postgresql", "postgresql_flexible"

Common settings:

name: Display name for the backup instance
backup_policy_key: Reference to a key in backup_policies map

Type-specific settings:

Disk: disk_id, snapshot_resource_group_name
Blob: storage_account_id, storage_account_container_names
ADLS (Azure Data Lake Storage Gen2): storage_account_id, storage_account_container_names
AKS: kubernetes_cluster_id, backup_datasource_parameters
PostgreSQL: postgresql_server_id, postgresql_database_id, postgresql_key_vault_secret_id
PostgreSQL Flexible: postgresql_flexible_server_id, postgresql_flexible_database_id, postgresql_flexible_key_vault_secret_id

Type:

map(object({
    type              = string # "disk", "blob", "adls", "kubernetes", "postgresql", "postgresql_flexible"
    name              = string
    backup_policy_key = string # References key from backup_policies map

    # Disk-specific settings
    disk_id                      = optional(string)
    snapshot_resource_group_name = optional(string)

    # Blob-specific settings
    storage_account_id              = optional(string)
    storage_account_container_names = optional(list(string), [])

    # AKS-specific settings
    kubernetes_cluster_id = optional(string)
    backup_datasource_parameters = optional(object({
      excluded_namespaces              = optional(list(string), [])
      included_namespaces              = optional(list(string), [])
      excluded_resource_types          = optional(list(string), [])
      included_resource_types          = optional(list(string), [])
      label_selectors                  = optional(list(string), [])
      cluster_scoped_resources_enabled = optional(bool, false)
      volume_snapshot_enabled          = optional(bool, false)
    }))

    # PostgreSQL-specific settings
    postgresql_server_id           = optional(string)
    postgresql_database_id         = optional(string)
    postgresql_key_vault_secret_id = optional(string)

    # PostgreSQL Flexible-specific settings
    postgresql_flexible_server_id           = optional(string)
    postgresql_flexible_database_id         = optional(string)
    postgresql_flexible_key_vault_secret_id = optional(string)
  }))

Default: {}

backup_policies

Description: Map of backup policies to create. Each policy can be referenced by backup instances.
Key is used as reference identifier for backup instances.

Supported types: "disk", "blob", "adls", "kubernetes", "postgresql", "postgresql_flexible"

Common settings:

backup_repeating_time_intervals: List of ISO8601 backup schedule intervals
default_retention_duration: Default retention period in ISO8601 format
time_zone: Time zone for backup schedules
retention_rules: List of retention rules with criteria and lifecycle

Type-specific settings:

Blob: operational_default_retention_duration, vault_default_retention_duration
ADLS (Azure Data Lake Storage Gen2): operational_default_retention_duration, vault_default_retention_duration
AKS: default_retention_life_cycle with data_store_type and duration

Type:

map(object({
    type = string # "disk", "blob", "adls", "kubernetes", "postgresql", "postgresql_flexible"
    name = string

    # Common policy settings
    backup_repeating_time_intervals = optional(list(string), [])
    default_retention_duration      = optional(string, "P30D")
    time_zone                       = optional(string, "UTC")

    # Disk-specific settings
    # (all settings are shared with other types for consistency)

    # Blob-specific settings
    operational_default_retention_duration = optional(string)
    vault_default_retention_duration       = optional(string)

    # AKS-specific settings
    default_retention_life_cycle = optional(object({
      data_store_type = optional(string, "OperationalStore")
      duration        = optional(string, "P14D")
    }))

    # Retention rules (common to all types)
    retention_rules = optional(list(object({
      name     = string
      priority = number
      duration = optional(string, "P30D")
      criteria = list(object({
        absolute_criteria      = optional(string)
        days_of_month          = optional(list(number))
        days_of_week           = optional(list(string))
        months_of_year         = optional(list(string))
        scheduled_backup_times = optional(list(string))
        weeks_of_month         = optional(list(string))
      }))
      # Life cycle (for blob policies)
      life_cycle = optional(list(object({
        data_store_type = string
        duration        = string
      })), [])
    })), [])
  }))

Default: {}

backup_vault_resource_type

Description: The resource type for the backup vault including API version. Override this if you need to match a different casing for import scenarios, e.g. Microsoft.DataProtection/BackupVaults@2025-09-01.

Type: string

Default: "Microsoft.DataProtection/backupVaults@2025-09-01"

cross_region_restore_enabled

Description: Whether to enable cross-region restore for the Backup Vault. Can only be enabled with GeoRedundant redundancy.

Type: bool

Default: false

cross_subscription_restore_state

Description: Cross-subscription restore state for the Backup Vault.
Valid options: "Enabled", "Disabled", "PermanentlyDisabled". Defaults to null (not set).

Type: string

Default: null

customer_managed_key

Description: Customer-managed key configuration for encrypting the Backup Vault, following the AVM interface.

key_vault_resource_id: The resource ID of the Key Vault containing the key.
key_name: The name of the Key Vault key.
key_version: (Optional) Specific key version. If omitted, the service uses the latest.
user_assigned_identity: (Optional) For future compatibility where UA-MI is supported.

Type:

object({
    key_vault_resource_id = string
    key_name              = string
    key_version           = optional(string, null)
    user_assigned_identity = optional(object({
      resource_id = string
    }), null)
  })

Default: null

diagnostic_settings

Description: A map of diagnostic settings to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

name - (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.
log_categories - (Optional) A set of log categories to send to the log analytics workspace. Defaults to [].
log_groups - (Optional) A set of log groups to send to the log analytics workspace. Defaults to ["allLogs"].
metric_categories - (Optional) A set of metric categories to send to the log analytics workspace. Defaults to ["AllMetrics"].
log_analytics_destination_type - (Optional) The destination type for the diagnostic setting. Possible values are Dedicated and AzureDiagnostics. Defaults to Dedicated.
workspace_resource_id - (Optional) The resource ID of the log analytics workspace to send logs and metrics to.
storage_account_resource_id - (Optional) The resource ID of the storage account to send logs and metrics to.
event_hub_authorization_rule_resource_id - (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.
event_hub_name - (Optional) The name of the event hub. If none is specified, the default event hub will be selected.
marketplace_partner_resource_id - (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic LogsLogs.

Type:

map(object({
    name                                     = optional(string, null)
    log_categories                           = optional(set(string), [])
    log_groups                               = optional(set(string), ["allLogs"])
    metric_categories                        = optional(set(string), ["AllMetrics"])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

enable_telemetry

Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.

Type: bool

Default: true

immutability

Description: Immutability state: Disabled, Locked, or Unlocked.

Type: string

Default: "Disabled"

lock

Description: Controls the Resource Lock configuration for this resource. The following properties can be specified:

kind - (Required) The type of lock. Possible values are \"CanNotDelete\" and \"ReadOnly\".
name - (Optional) The name of the lock. If not specified, a name will be generated based on the kind value. Changing this forces the creation of a new resource.

Type:

object({
    kind = string
    name = optional(string, null)
  })

Default: null

managed_identities

Description: Controls the Managed Identity configuration on this resource. The following properties can be specified:

system_assigned - (Optional) Specifies if the System Assigned Managed Identity should be enabled.
user_assigned_resource_ids - (Optional) Specifies a list of User Assigned Managed Identity resource IDs to be assigned to this resource.

Type:

object({
    system_assigned            = optional(bool, false)
    user_assigned_resource_ids = optional(set(string), [])
  })

Default: {}

permanent_delete_on_destroy

Description: Whether backup instances should be permanently deleted on destroy by setting the permanent=true query parameter. Set to false to use service default delete behavior.

Type: bool

Default: true

replicated_regions

Description: List of replicated regions for the Backup Vault. Only applicable for GeoRedundant vaults.

Type: list(string)

Default: []

resource_guard_enabled

Description: Controls whether a Resource Guard is associated with the backup vault. When true and resource_guard_resource_id is null, a new Resource Guard is created in the same resource group. When true and resource_guard_resource_id is provided, the existing external guard is associated instead.

Type: bool

Default: false

resource_guard_name

Description: The name of the Resource Guard. If not specified, will use the backup vault name with '-guard' suffix. Only used when creating a new resource guard (i.e., when resource_guard_resource_id is null).

Type: string

Default: null

resource_guard_resource_id

Description: The resource ID of an existing Resource Guard to associate with the backup vault. When provided (with resource_guard_enabled = true), no new guard is created — the existing one is used directly.

Type: string

Default: null

retention_duration_in_days

Description: The soft delete retention duration for this Backup Vault. Valid values are between 14 and 180. Defaults to 14.

Type: number

Default: 14

role_assignments

Description: A map of role assignments to create on resources. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

role_definition_id_or_name - The ID or name of the role definition to assign to the principal.
principal_id - The ID of the principal to assign the role to.
scope - (Optional) The scope at which the role assignment applies to. Defaults to the backup vault resource ID.
description - (Optional) The description of the role assignment.
skip_service_principal_aad_check - (Optional) If set to true, skips the Azure Active Directory check for the service principal in the tenant. Defaults to false.
condition - (Optional) The condition which will be used to scope the role assignment.
condition_version - (Optional) The version of the condition syntax. Leave as null if you are not using a condition, if you are then valid values are '2.0'.
delegated_managed_identity_resource_id - (Optional) The delegated Azure Resource Id which contains a Managed Identity.
principal_type - (Optional) The type of the principal_id. Possible values are User, Group and ServicePrincipal.

Type:

map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    scope                                  = optional(string)
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
    principal_type                         = optional(string, null)
  }))

Default: {}

soft_delete

Description: The state of soft delete for this Backup Vault.
API version 2025-09-01 requires AlwaysOn soft delete. Defaults to AlwaysOn and cannot be changed.

Type: string

Default: "AlwaysOn"

timeout_create

Description: The timeout duration for creating resources.

Type: string

Default: "30m"

timeout_delete

Description: The timeout duration for deleting resources.

Type: string

Default: "30m"

timeout_read

Description: The timeout duration for reading resources.

Type: string

Default: "5m"

timeout_update

Description: The timeout duration for updating resources.

Type: string

Default: "30m"

vault_critical_operation_exclusion_list

Description: A list of the critical operations which are not protected by Resource Guard.
By default, all critical operations are protected. Only exclude operations that you want to allow without additional protection.
Possible values include: "Delete", "Update", "DisableSoftDelete", and "ChangeBackupProperties".

Type: list(string)

Default: []

wait_for_backup_instance_configure_duration

Description: Additional wait after backup instance creation to allow protection status to leave ConfiguringProtection before destroy.

Type: string

Default: "180s"

Outputs

The following outputs are exported:

adls_backup_instance_ids

Description: Map of ADLS backup instance IDs by instance key.

adls_backup_policy_ids

Description: Map of ADLS backup policy IDs by policy key.

backup_instance_ids

Description: Map of backup instance IDs by instance key.

backup_policy_ids

Description: Map of backup policy IDs by policy key.

backup_vault_id

Description: The ID of the Backup Vault.

backup_vault_name

Description: The name of the Backup Vault.

blob_backup_instance_id

Description: (DEPRECATED) The ID of the Blob Backup Instance. Use backup_instance_ids instead.

blob_backup_instance_ids

Description: Map of blob backup instance IDs by instance key.

blob_backup_policy_ids

Description: Map of blob backup policy IDs by policy key.

customer_managed_key_id

Description: The ID of the Customer Managed Key configuration (if enabled)

disk_backup_instance_ids

Description: Map of disk backup instance IDs by instance key.

disk_backup_policy_ids

Description: Map of disk backup policy IDs by policy key.

identity_principal_id

Description: The Principal ID for the Service Principal associated with the Identity of this Backup Vault.

identity_tenant_id

Description: The Tenant ID for the Service Principal associated with the Identity of this Backup Vault.

kubernetes_backup_instance_ids

Description: Map of Kubernetes backup instance IDs by instance key.

kubernetes_backup_policy_ids

Description: Map of Kubernetes backup policy IDs by policy key.

lock_id

Description: The resource ID of the management lock (if created)

postgresql_backup_instance_ids

Description: Map of PostgreSQL backup instance IDs by instance key.

postgresql_backup_policy_ids

Description: Map of PostgreSQL backup policy IDs by policy key.

postgresql_flexible_backup_instance_id

Description: (DEPRECATED) The ID of the created PostgreSQL Flexible Server Backup Instance. Use backup_instance_ids instead.

postgresql_flexible_backup_instance_ids

Description: Map of PostgreSQL Flexible backup instance IDs by instance key.

postgresql_flexible_backup_policy_id

Description: (DEPRECATED) The ID of the created PostgreSQL Flexible Server Backup Policy. Use backup_policy_ids instead.

postgresql_flexible_backup_policy_ids

Description: Map of PostgreSQL Flexible backup policy IDs by policy key.

resource_guard_id

Description: The ID of the Resource Guard (created or external)

resource_guard_name

Description: The name of the Resource Guard (if enabled)

resource_id

Description: The ID of the Backup Vault

vault_id

Description: The resource ID of the Backup Vault

Modules

No modules.

Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.

Name		Name	Last commit message	Last commit date
.avm		.avm
.devcontainer		.devcontainer
.github		.github
.vscode		.vscode
examples		examples
modules		modules
tests		tests
.editorconfig		.editorconfig
.gitattributes		.gitattributes
.gitignore		.gitignore
.terraform-docs.yml		.terraform-docs.yml
AGENTS.md		AGENTS.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
SUPPORT.md		SUPPORT.md
_footer.md		_footer.md
_header.md		_header.md
avm		avm
avm.bat		avm.bat
avm.tflint.hcl		avm.tflint.hcl
avm.tflint.override.hcl		avm.tflint.override.hcl
avm.tflint_example.hcl		avm.tflint_example.hcl
avm.tflint_module.hcl		avm.tflint_module.hcl
avmmakefile		avmmakefile
locals.tf		locals.tf
main.adls_backup.tf		main.adls_backup.tf
main.aks_backup.tf		main.aks_backup.tf
main.blob_backup.tf		main.blob_backup.tf
main.customer_managed_key.tf		main.customer_managed_key.tf
main.disk_backup.tf		main.disk_backup.tf
main.postgres_backup.tf		main.postgres_backup.tf
main.postgresflexible_backup.tf		main.postgresflexible_backup.tf
main.resource_guard.tf		main.resource_guard.tf
main.telemetry.tf		main.telemetry.tf
main.tf		main.tf
outputs.tf		outputs.tf
terraform.tf		terraform.tf
variables.resourceguard.tf		variables.resourceguard.tf
variables.tf		variables.tf

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

Azure Verified Module for Azure Data Protection Backup Vault

Features

Deprecated: PostgreSQL Single Server Backup

Example Usage

AVM Versioning Notice

Requirements

Resources

Required Inputs

Optional Inputs

Outputs

Modules

Data Collection

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Packages

Used by

Contributors

Languages