Back to skills
SKILL.md
2654 04 Preflight Check 22be87df
ASecurity   <details open> <summary><strong>π Pre-Flight Contents</strong></summary> - [π― Purpose](#-purpose) - [β AVM Schema Validation Results](#-avm-schema-validation-results) - [οΏ½ Provider Version Resolution](#-provider-version-resolution) - [π Parameter Type Anal...
- 9 stars
- 0 votes
- 0 copies
- 0 views
- Added October 11, 2026
Works with
Security analysis
100/100npx -y skills add tools-only/X-Skills --skill 2654-04-preflight-check_22be87df --agent claude-codeAre you the author of 2654 04 Preflight Check 22be87df?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/tools-only-2654-04-preflight-check-22be87df)# β
Step 4b: Pre-Flight AVM-TF Check - terraform-e2e
<details open>
<summary><strong>π Pre-Flight Contents</strong></summary>
- [π― Purpose](#-purpose)
- [β
AVM Schema Validation Results](#-avm-schema-validation-results)
- [οΏ½ Provider Version Resolution](#-provider-version-resolution)
- [π Parameter Type Analysis](#-parameter-type-analysis)
- [π Variable Schema Cross-Validation](#-variable-schema-cross-validation)
- [π Region Limitations Identified](#-region-limitations-identified)
- [β οΈ Pitfalls Checklist](#-pitfalls-checklist)
- [π Ready for Implementation](#-ready-for-implementation)
</details>
> Generated by terraform-code agent | 2026-02-26
> Source: Terraform Registry MCP (`search_modules` β `get_module_details` β `get_latest_module_version`)
> Status: **PASS**
| β¬
οΈ Previous | π Index | Next β‘οΈ |
| ------------------------------------------------------ | ------------------- | ---------------------------------------------------------------- |
| [04-implementation-plan.md](04-implementation-plan.md) | [README](README.md) | [05-implementation-reference.md](05-implementation-reference.md) |
## π― Purpose
> [!IMPORTANT]
> This checkpoint validates AVM-TF module schemas BEFORE Terraform code generation
> by querying the Terraform Registry for latest versions and variable schemas.
Prevents:
- Variable type mismatches (e.g., `parent_id` vs `resource_group_name`)
- Deprecated variable usage
- Region availability issues
- Missing required variables
- Version constraint drift
## β
AVM Schema Validation Results
```mermaid
%%{init: {'theme':'neutral'}}%%
flowchart LR
A["Discover AVM-TF\nModules"] --> B["Validate\nSchema"]
B --> C["Check\nVariables"]
C --> D["Verify\nRegions"]
D --> E{"Pass?"}
E -- Yes --> F["β
Ready"]
E -- No --> G["β Blocked"]
style F fill:#107C10,color:#fff
style G fill:#D83B01,color:#fff
```
| Resource | AVM-TF Module | Pinned | Latest | Match | Verified | Published |
| --------------------- | ----------------------------------------------------- | --------- | -------- | ----- | -------- | ---------- |
| Log Analytics | `Azure/avm-res-operationalinsights-workspace/azurerm` | `~> 0.5` | `0.5.1` | β
| β
| 2025-12-23 |
| Application Insights | `Azure/avm-res-insights-component/azurerm` | `~> 0.3` | `0.3.0` | β
| β
| 2026-02-19 |
| Key Vault | `Azure/avm-res-keyvault-vault/azurerm` | `~> 0.10` | `0.10.2` | β
| β
| 2025-10-14 |
| SQL Server + Database | `Azure/avm-res-sql-server/azurerm` | `~> 0.1` | `0.1.6` | β
| β
| 2025-10-06 |
| App Service Plan | `Azure/avm-res-web-serverfarm/azurerm` | `~> 2.0` | `2.0.2` | β
| β
| 2026-02-20 |
| App Service (BE+FE) | `Azure/avm-res-web-site/azurerm` | `~> 0.21` | `0.21.0` | β
| β
| 2026-02-19 |
> **Version Match**: All `~>` pessimistic version constraints resolve to latest available versions within their bands.
### Download Counts (Module Adoption)
| Module | Downloads |
| ------------------------------------- | --------: |
| avm-res-keyvault-vault | 1,879,954 |
| avm-res-operationalinsights-workspace | 577,656 |
| avm-res-web-site | 329,353 |
| avm-res-insights-component | 222,142 |
| avm-res-web-serverfarm | 209,042 |
| avm-res-sql-server | 174,107 |
## π Provider Version Resolution
| Provider | Pinned | Latest | Match | Source |
| ------------------- | -------- | -------- | ----- | -------- |
| `hashicorp/azurerm` | `~> 4.0` | `4.61.0` | β
| Registry |
| `hashicorp/random` | `~> 3.0` | `3.8.1` | β
| Registry |
## π Parameter Type Analysis
### Required Variables per Module (Registry-Sourced)
<details open>
<summary><strong>Log Analytics (avm-res-operationalinsights-workspace v0.5.1)</strong></summary>
| Variable | Type | Required | In Code | Status |
| --------------------- | -------- | -------- | ------- | ------ |
| `name` | `string` | β
| β
| β
|
| `resource_group_name` | `string` | β
| β
| β
|
| `location` | `string` | β
| β
| β
|
Optional variables used:
| Variable | Type | Default | In Code | Status |
| ------------------------------------------- | ------------- | ------- | ------- | ------ |
| `log_analytics_workspace_retention_in_days` | `number` | `null` | `30` | β
|
| `tags` | `map(string)` | `null` | β
| β
|
</details>
<details open>
<summary><strong>Application Insights (avm-res-insights-component v0.3.0)</strong></summary>
| Variable | Type | Required | In Code | Status |
| --------------------- | -------- | -------- | ------- | ------ |
| `name` | `string` | β
| β
| β
|
| `resource_group_name` | `string` | β
| β
| β
|
| `location` | `string` | β
| β
| β
|
| `workspace_id` | `string` | β
| β
| β
|
> **β οΈ Pitfall Avoided**: Variable is `workspace_id` β NOT `workspace_resource_id`.
Optional variables used:
| Variable | Type | Default | In Code | Status |
| ------------------ | ------------- | ------- | ------- | ------ |
| `application_type` | `string` | `"web"` | `"web"` | β
|
| `tags` | `map(string)` | `null` | β
| β
|
</details>
<details open>
<summary><strong>Key Vault (avm-res-keyvault-vault v0.10.2)</strong></summary>
| Variable | Type | Required | In Code | Status |
| --------------------- | -------- | -------- | ------- | ------ |
| `name` | `string` | β
| β
| β
|
| `resource_group_name` | `string` | β
| β
| β
|
| `location` | `string` | β
| β
| β
|
| `tenant_id` | `string` | β
| β
| β
|
> **β οΈ Pitfall Avoided**: No `enable_rbac_authorization` variable exists.
> RBAC is the default when `legacy_access_policies_enabled = false` (module default).
Optional variables used:
| Variable | Type | Default | In Code | Status |
| ---------------------------- | ------------- | ----------- | ------------ | ------ |
| `purge_protection_enabled` | `bool` | `true` | `true` | β
|
| `soft_delete_retention_days` | `number` | (7β90) | `90` | β
|
| `sku_name` | `string` | `"premium"` | `"standard"` | β
|
| `tags` | `map(string)` | `null` | β
| β
|
> **β οΈ Pitfall Avoided**: Variable is `soft_delete_retention_days` β NOT `soft_delete_retention_in_days`.
</details>
<details open>
<summary><strong>SQL Server (avm-res-sql-server v0.1.6)</strong></summary>
| Variable | Type | Required | In Code | Status |
| --------------------- | -------- | -------- | -------- | ------ |
| `resource_group_name` | `string` | β
| β
| β
|
| `location` | `string` | β
| β
| β
|
| `server_version` | `string` | β
| `"12.0"` | β
|
> **β οΈ Pitfall Avoided**: `minimum_tls_version` is hardcoded to `"1.2"` in the AVM module β NOT a variable.
Optional variables used:
| Variable | Type | Default | In Code | Status |
| ----------------------- | -------------------- | ------- | --------------------- | ------ |
| `administrator_login` | `string` | `null` | `null` (AD-only auth) | β
|
| `azuread_administrator` | `object({...})` | `null` | β
(3 fields) | β
|
| `databases` | `map(object({...}))` | `{}` | β
(1 database) | β
|
| `tags` | `map(string)` | `null` | β
| β
|
</details>
<details open>
<summary><strong>App Service Plan (avm-res-web-serverfarm v2.0.2)</strong></summary>
| Variable | Type | Required | In Code | Status |
| ----------- | -------- | -------- | -------------------------------- | ------ |
| `name` | `string` | β
| β
| β
|
| `parent_id` | `string` | β
| `azurerm_resource_group.this.id` | β
|
| `location` | `string` | β
| β
| β
|
| `os_type` | `string` | β
| `"Linux"` | β
|
> **β οΈ Pitfall Avoided**: Uses `parent_id` (resource group ID) β NOT `resource_group_name`.
Optional variables used:
| Variable | Type | Default | In Code | Status |
| ---------- | ------------- | -------- | ------- | ------ |
| `sku_name` | `string` | `"P1v2"` | `"B1"` | β
|
| `tags` | `map(string)` | `null` | β
| β
|
</details>
<details open>
<summary><strong>App Service β BE + FE (avm-res-web-site v0.21.0)</strong></summary>
| Variable | Type | Required | In Code | Status |
| -------------------------- | -------- | -------- | -------------------------------- | ------ |
| `name` | `string` | β
| β
| β
|
| `parent_id` | `string` | β
| `azurerm_resource_group.this.id` | β
|
| `location` | `string` | β
| β
| β
|
| `service_plan_resource_id` | `string` | β
| `module.app_service_plan[0]...` | β
|
> **β οΈ Pitfall Avoided**: Uses `parent_id` (resource group ID) β NOT `resource_group_name`.
Optional variables used:
| Variable | Type | Default | In Code | Status |
| ---------------------------------------- | ------------- | --------- | ------------------------ | ------ |
| `kind` | `string` | (varies) | `"webapp"` | β
|
| `os_type` | `string` | `"Linux"` | `"Linux"` | β
|
| `https_only` | `bool` | `true` | `true` | β
|
| `managed_identities` | `object({})` | β | `system_assigned = true` | β
|
| `application_insights_connection_string` | `string` | `null` | β
| β
|
| `app_settings` | `map(string)` | `{}` | β
(BE only) | β
|
| `tags` | `map(string)` | `null` | β
| β
|
</details>
## π Variable Schema Cross-Validation
Cross-validation of every variable used in `main.tf` against registry-sourced module schemas:
| Module | Variables Set | Required Satisfied | Optional Valid | Unsupported Args | Result |
| ---------------- | :-----------: | :----------------: | :------------: | :--------------: | ------ |
| log_analytics | 5 | 3/3 | 2/2 | 0 | β
|
| app_insights | 5 | 4/4 | 1/1 + tags | 0 | β
|
| key_vault | 7 | 4/4 | 3/3 + tags | 0 | β
|
| sql_server | 7 | 3/3 | 4/4 + tags | 0 | β
|
| app_service_plan | 5 | 4/4 | 1/1 + tags | 0 | β
|
| app_service (BE) | 9 | 4/4 | 5/5 + tags | 0 | β
|
| app_service_fe | 7 | 4/4 | 3/3 + tags | 0 | β
|
### Local Validation
| Check | Result | Command |
| -------------------- | ------ | ----------------------------------- |
| `terraform fmt` | β
| `terraform fmt -check -recursive .` |
| `terraform init` | β
| `terraform init -backend=false` |
| `terraform validate` | β
| `terraform validate` |
## π Region Limitations Identified
| Resource | Default Region | Limitation | Action |
| -------------------- | -------------- | ---------- | --------- |
| Log Analytics | swedencentral | None | No action |
| Application Insights | swedencentral | None | No action |
| Key Vault | swedencentral | None | No action |
| SQL Server | swedencentral | None | No action |
| App Service Plan | swedencentral | None | No action |
| App Service | swedencentral | None | No action |
> All resources are available in `swedencentral`. No region overrides required.
## β οΈ Pitfalls Checklist
Based on AVM Known Pitfalls (terraform-patterns skill) and registry schema validation:
- [x] App Service Plan uses `parent_id` (resource group ID) β not `resource_group_name`
- [x] App Service uses `parent_id` (resource group ID) β not `resource_group_name`
- [x] App Insights uses `workspace_id` β not `workspace_resource_id`
- [x] Key Vault does NOT have `enable_rbac_authorization` β RBAC enabled via `legacy_access_policies_enabled = false` (default)
- [x] Key Vault uses `soft_delete_retention_days` β not `soft_delete_retention_in_days`
- [x] SQL Server requires `server_version = "12.0"` β `minimum_tls_version` is hardcoded in module
- [x] App Service uses `application_insights_connection_string` (not deprecated instrumentation key)
- [x] No Storage Account names contain hyphens
- [x] All `~>` version pins resolve to published versions within their constraint bands
- [x] `azurerm` provider pinned `~> 4.0` β latest `4.61.0` compatible
## π Ready for Implementation
| Check | Status | Notes |
| ---------------------------- | ------ | ---------------------------------------------------- |
| All AVM-TF modules verified | β
| 6 modules confirmed via Terraform Registry MCP |
| Latest versions resolved | β
| All `~>` constraints match latest published versions |
| Variable types confirmed | β
| All `parent_id` vs `resource_group_name` resolved |
| Required variables satisfied | β
| 22/22 required variables across all modules |
| Optional variables validated | β
| All optional variables exist in registry schemas |
| Region limitations handled | β
| All resources available in swedencentral |
| Pitfalls addressed | β
| 10/10 known pitfalls checked and resolved |
| `terraform validate` | β
| Configuration is valid |
| `terraform fmt -check` | β
| Formatting passes |
> [!IMPORTANT]
> **Go / No-Go Verdict**
>
> | Signal | Status |
> | -------------------- | ------------ |
> | AVM Modules | β
|
> | Provider Versions | β
|
> | Variable Schemas | β
|
> | Regions | β
|
> | Pitfalls | β
|
> | `terraform validate` | β
|
> | **Overall** | **β
READY** |
---
_Pre-flight validation for terraform-e2e Terraform implementation._
_Registry data sourced via Terraform MCP: `get_latest_module_version`, `get_module_details`, `get_latest_provider_version`._
---
<div align="center">
| β¬
οΈ [04-implementation-plan.md](04-implementation-plan.md) | π [Project Index](README.md) | β‘οΈ [05-implementation-reference.md](05-implementation-reference.md) |
| --------------------------------------------------------- | ----------------------------- | ------------------------------------------------------------------- |
</div>
Attribution
Comments
Loading commentsβ¦
Newsletter
Get the weekly list of safe new skills, and the ones we pulled.