Migrate root sandbox config to azurerm 5.0 - #591
Merged
Roger Doherty (MSFT) (doherty100) merged 2 commits intoAug 5, 2026
Conversation
Bump the azurerm provider constraint from ~> 4.81.0 to ~> 5.0.1 across the root module and all root-reachable child modules (modules/* and the extras/modules/* referenced by main.tf), and apply the required azurerm 5.0 code changes surfaced by terraform validate: - azurerm_private_dns_zone_virtual_network_link: use the required private_dns_zone_id argument instead of the removed resource_group_name + private_dns_zone_name pair (vnet-shared key_vault + ampls links; vnet-app three links). (#588) - azurerm_log_analytics_workspace: replace the removed internet_ingestion_enabled / internet_query_enabled booleans with internet_ingestion_access_type / internet_query_access_type and update the ignore_changes lifecycle accordingly (vnet-shared). The root azapi barrier is unaffected (it sets the raw ARM publicNetworkAccessForIngestion/Query properties). (#589) - azurerm_monitor_diagnostic_setting: remove the now-invalid lifecycle ignore_changes = [metric] (the metric block was removed in 5.0; this setting only enables audit logs, no metrics) (vnet-shared). - azurerm_container_registry: remove the removed trust_policy_enabled argument (ACR content trust was retired); it was disabled, so behavior is unchanged (vnet-app). Validated with terraform validate, terraform fmt, and tflint under azurerm v5.0.1. Supersedes Dependabot PRs #574, #575, #576, #577, #578, #579, #580, #582, #584, #585, #586. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
✅ Deployment + full test validation (azurerm 5.0.1)Deployed a fresh sandbox from scratch on this branch (all 6 base modules enabled) and ran the full automated test suite. Everything passed. Apply
All four 5.0 breaking-change fixes exercised live
The public-access barrier pattern also worked end-to-end (Key Vault / Storage / AMPLS / Log Analytics flipped to private after data-plane writes completed). Tests —
|
| Module | Result |
|---|---|
| vnet-shared | Passed=9 Failed=0 |
| vnet-app | Passed=18 Failed=0 |
| vm-jumpbox-linux | Passed=13 Failed=0 |
| vm-mssql-win | Passed=25 Failed=0 |
| mssql | Passed=5 Failed=0 |
| mysql | Passed=5 Failed=0 |
| vwan | Passed=5 Failed=0 |
| integration: SSH jumpwin1 → jumplinux1 | Passed=1 Failed=0 |
| integration: SQL jumpwin1 → mssqlwin1 | Passed=1 Failed=0 |
| integration: Azure SQL jumpwin1 → testdb | Passed=4 Failed=0 |
| integration: MySQL jumpwin1 → mysql | Passed=4 Failed=0 |
| integration: P2S VPN local → sandbox endpoints | Passed=12 Failed=0 |
AVD and on-prem integration tests were skipped (those modules aren't part of the base deployment).
Environment: deployed on an MCAPS tenant with an organization-specific exemption tag passed on every plan/apply. Branch was refreshed to current vnext before testing.
Roger Doherty (MSFT) (doherty100)
deleted the
azurerm-5-migration-root-sandbox
branch
August 5, 2026 23:11
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates the root sandbox configuration and all root-reachable child modules (
modules/*plus theextras/modules/*referenced bymain.tf) fromazurerm ~> 4.81.0to~> 5.0.1, including all code changes required by azurerm 5.0's breaking changes.This supersedes the 11 Dependabot PRs for these paths (#574, #575, #576, #577, #578, #579, #580, #582, #584, #585, #586), which only raise the version constraint. On their own they fail
terraform validateunder 5.0 — the provider bump and the code fixes are coupled (new syntax is 5.0-only, old syntax is 4.x-only), so they must land together in one change.Breaking changes addressed
azurerm_private_dns_zone_virtual_network_link(azurerm 5.0: azurerm_private_dns_zone_virtual_network_link requires private_dns_zone_id #588) — theresource_group_name+private_dns_zone_namepair was removed; the requiredprivate_dns_zone_idis now used instead.modules/vnet-shared/network.tf—key_vaultandamplslinksmodules/vnet-app/network.tf— the threefor_eachlinksazurerm_log_analytics_workspace(azurerm 5.0: azurerm_log_analytics_workspace removed internet_ingestion_enabled / internet_query_enabled #589) — theinternet_ingestion_enabled/internet_query_enabledbooleans were removed; replaced withinternet_ingestion_access_type/internet_query_access_type("Enabled"/"Disabled"), and theignore_changeslifecycle updated to match.modules/vnet-shared/main.tfazapi_update_resourcebarrier is unaffected — it sets the raw ARMpublicNetworkAccessForIngestion/publicNetworkAccessForQueryproperties, not the provider arguments.Additional breaking changes discovered during migration (not previously tracked)
azurerm_monitor_diagnostic_setting— themetricblock was removed in 5.0 (replaced byenabled_metric). The Key Vault "Audit Logs" setting inmodules/vnet-shared/main.tfonly enables audit logs (no metrics), so the now-invalidlifecycle { ignore_changes = [metric] }is simply removed.azurerm_container_registry— thetrust_policy_enabledargument was removed (ACR content trust retired). It was set tofalse(disabled) inmodules/vnet-app/main.tf, so removing it preserves behavior.Validation
terraform initresolvesazurerm v5.0.1.terraform validate(all modules) → Success! The configuration is valid.terraform fmt -recursive→ clean.tflint(recommended + azurerm ruleset), root and changed modules → no findings.Related