Repository: JamieYnonan/terraform-azurerm-storage-account
Pull request #1: feat(main): storage account module
Author: login: JamieYnonan
Created: 2025-05-10T05:00:06Z | Merged: 2025-06-07T06:01:55Z



Diff:
diff --git a/.chevkov.yaml b/.checkov.yaml
similarity index 63%
rename from .chevkov.yaml
rename to .checkov.yaml
index 4dc9613..e79406a 100644
--- a/.chevkov.yaml
+++ b/.checkov.yaml
@@ -11,4 +11,14 @@ summary-position: top
 deep-analysis: true
 directory: .
 framework: terraform
-# skip-check:
+skip-check:
+  - CKV_TF_1
+  - CKV_TF_2
+  - CKV_AZURE_206
+  - CKV_AZURE_59
+  - CKV_AZURE_33
+  - CKV2_AZURE_40
+  - CKV2_AZURE_21
+  - CKV2_AZURE_1
+  - CKV2_AZURE_33
+  - CKV2_AZURE_41
diff --git a/README.md b/README.md
index b12154e..d0397fa 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,11 @@
+# terraform-azurerm-storage-account
+
+Este repositorio servirá de soporte a los posts en [Medium](https://medium.com/@jamieynonan) sobre Terraform e IaC.
+
+| Post | Branch |
+|------|--------|
+| [Módulos Remotos en GitHub Repository: Estructura y Estandarización](https://medium.com/@jamieynonan/modulos-remotos-en-github-repository-estructura-y-estandarizacion-169a3bb1dbdd) | feature/module |
+
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
 
@@ -20,15 +28,31 @@ No modules.
 
 | Name | Type |
 |------|------|
+| [azurerm_storage_account.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account) | resource |
+| [azurerm_storage_container.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_container) | resource |
 | [azurerm_resource_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_container_name"></a> [container\_name](#input\_container\_name) | The value must consist of lowercase letters and numbers, and have a length between 3 and 63 characters<br/><br/>  Changing this forces a new resource to be created. | `string` | n/a | yes |
 | <a name="input_rg_name"></a> [rg\_name](#input\_rg\_name) | The name of the resource group.<br/>  It must consist of lowercase letters and numbers, and have a length between 3 and 63 characters.<br/><br/>  Changing this forces a new resource to be created. | `string` | n/a | yes |
+| <a name="input_st_instance"></a> [st\_instance](#input\_st\_instance) | The storage account instance.<br/>  It must be greater than or equal to 1 and less than or equal to 999.<br/><br/>  Changing this forces a new resource to be created. | `number` | n/a | yes |
+| <a name="input_st_project"></a> [st\_project](#input\_st\_project) | The project name.<br/>  It must be lowercase and have a length between 3 and 18 characters.<br/><br/>  Changing this forces a new resource to be created. | `string` | n/a | yes |
+| <a name="input_account_kind"></a> [account\_kind](#input\_account\_kind) | The account kind.<br/>  It must be one of the following values: StorageV2, BlobStorage, FileStorage, BlockBlobStorage.<br/><br/>  Changing this forces a new resource to be created. | `string` | `"StorageV2"` | no |
+| <a name="input_account_replication_type"></a> [account\_replication\_type](#input\_account\_replication\_type) | The account replication type.<br/>  It must be one of the following values: LRS, GRS, RA-GRS, ZRS, GZRS, RA-GZRS.<br/><br/>  Changing this forces a new resource to be created. | `string` | `"LRS"` | no |
+| <a name="input_account_tier"></a> [account\_tier](#input\_account\_tier) | The account tier.<br/>  It must be one of the following values: Standard, Premium.<br/><br/>  Changing this forces a new resource to be created. | `string` | `"Standard"` | no |
+| <a name="input_blob_change_feed_retention_in_days"></a> [blob\_change\_feed\_retention\_in\_days](#input\_blob\_change\_feed\_retention\_in\_days) | The days for the change feed retention.<br/>  It must be greater than or equal to 3 and less than or equal to 30. | `number` | `7` | no |
+| <a name="input_blob_container_delete_retention_policy_days"></a> [blob\_container\_delete\_retention\_policy\_days](#input\_blob\_container\_delete\_retention\_policy\_days) | The days for the container delete retention policy.<br/>  It must be greater than or equal to 3 and less than or equal to 30. | `number` | `7` | no |
+| <a name="input_blob_delete_retention_policy_days"></a> [blob\_delete\_retention\_policy\_days](#input\_blob\_delete\_retention\_policy\_days) | The days for the blob delete retention policy.<br/>  It must be greater than or equal to 3 and less than or equal to 30. | `number` | `7` | no |
 
 ## Outputs
 
-No outputs.
-<!-- END_TF_DOCS -->
\ No newline at end of file
+| Name | Description |
+|------|-------------|
+| <a name="output_container_id"></a> [container\_id](#output\_container\_id) | value of the storage container id |
+| <a name="output_container_name"></a> [container\_name](#output\_container\_name) | value of the storage container name |
+| <a name="output_storage_account_id"></a> [storage\_account\_id](#output\_storage\_account\_id) | value of the storage account id |
+| <a name="output_storage_account_name"></a> [storage\_account\_name](#output\_storage\_account\_name) | value of the storage account name |
+<!-- END_TF_DOCS -->
diff --git a/examples/basic/main.tf b/examples/basic/main.tf
new file mode 100644
index 0000000..e738747
--- /dev/null
+++ b/examples/basic/main.tf
@@ -0,0 +1,22 @@
+terraform {
+  required_version = "~>1.10"
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~>4.3"
+    }
+  }
+  backend "azurerm" {}
+}
+
+provider "azurerm" {
+  features {}
+}
+
+module "sa" {
+  source         = "git::https://github.com/JamieYnonan/terraform-azurerm-storage-account.git?ref=v1"
+  rg_name        = "rg-abc123-001"
+  st_instance    = 1
+  st_project     = "abc"
+  container_name = "container"
+}
diff --git a/locals.tf b/locals.tf
index e69de29..a428fe9 100644
--- a/locals.tf
+++ b/locals.tf
@@ -0,0 +1,11 @@
+locals {
+  st_name                            = "st${var.st_project}${format("%03d", var.st_instance)}"
+  https_traffic_only_enabled         = true
+  min_tls_version                    = "TLS1_2"
+  allow_nested_items_to_be_public    = false
+  local_user_enabled                 = false
+  shared_access_key_enabled          = true
+  blob_properties_versioning_enabled = true
+  blob_propertieschange_feed_enabled = true
+  container_access_type              = "private"
+}
diff --git a/main.tf b/main.tf
index e69de29..6a3cf63 100644
--- a/main.tf
+++ b/main.tf
@@ -0,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
+
+resource "azurerm_storage_container" "this" {
+  depends_on            = [azurerm_storage_account.this]
+  name                  = var.container_name
+  storage_account_id    = azurerm_storage_account.this.id
+  container_access_type = local.container_access_type
+}
diff --git a/outputs.tf b/outputs.tf
index e69de29..5abc021 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -0,0 +1,19 @@
+output "storage_account_name" {
+  value       = azurerm_storage_account.this.name
+  description = "value of the storage account name"
+}
+
+output "storage_account_id" {
+  value       = azurerm_storage_account.this.id
+  description = "value of the storage account id"
+}
+
+output "container_name" {
+  value       = azurerm_storage_container.this.name
+  description = "value of the storage container name"
+}
+
+output "container_id" {
+  value       = azurerm_storage_container.this.id
+  description = "value of the storage container id"
+}
diff --git a/tests/default.tftest.hcl b/tests/default.tftest.hcl
new file mode 100644
index 0000000..671aac2
--- /dev/null
+++ b/tests/default.tftest.hcl
@@ -0,0 +1,135 @@
+provider "azurerm" {
+  features {}
+}
+
+variables {
+  rg_name        = "rg-exampleterraform-001"
+  st_project     = "exampleterraform"
+  st_instance    = 1
+  container_name = "examplecontainer"
+}
+
+run "lrs_account_replication_type" {
+  command = plan
+
+  assert {
+    condition     = azurerm_storage_account.this.account_replication_type == "LRS"
+    error_message = "The replication type is not correct"
+  }
+}
+
+run "https_traffic_only_enabled" {
+  command = plan
+
+  assert {
+    condition     = azurerm_storage_account.this.https_traffic_only_enabled == true
+    error_message = "HTTPS traffic is not enabled"
+  }
+}
+
+run "tls1_2_min_tls_version" {
+  command = plan
+
+  assert {
+    condition     = azurerm_storage_account.this.min_tls_version == "TLS1_2"
+    error_message = "The minimum TLS version is not correct"
+  }
+}
+
+run "allow_nested_items_to_be_public" {
+  command = plan
+
+  assert {
+    condition     = azurerm_storage_account.this.allow_nested_items_to_be_public == false
+    error_message = "Nested items should not be public"
+  }
+}
+
+run "staoragev2_account_kind" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.account_kind == "StorageV2"
+    error_message = "The account kind is not correct"
+  }
+}
+
+run "versioning_enabled" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.versioning_enabled == true
+    error_message = "Versioning is not enabled"
+  }
+}
+
+run "delete_retention_policy" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.delete_retention_policy.0.days == 7
+    error_message = "The delete retention policy is not correct"
+  }
+}
+
+run "delete_retention_policy_default_by_null" {
+  variables {
+    blob_delete_retention_policy_days = null
+  }
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.delete_retention_policy.0.days == 7
+    error_message = "The delete retention policy is not correct"
+  }
+}
+
+run "container_delete_retention_policy" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.container_delete_retention_policy.0.days == 7
+    error_message = "The container delete retention policy is not correct"
+  }
+}
+
+run "container_delete_retention_policy_default_by_null" {
+  variables {
+    blob_container_delete_retention_policy_days = null
+  }
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.container_delete_retention_policy.0.days == 7
+    error_message = "The container delete retention policy is not correct"
+  }
+}
+
+run "change_feed_enabled" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.change_feed_enabled == true
+    error_message = "Change feed is not enabled"
+  }
+}
+
+run "change_feed_retention_in_days" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.change_feed_retention_in_days == 7
+    error_message = "The change feed retention is not correct"
+  }
+}
+
+run "change_feed_retention_in_days_default_by_null" {
+  variables {
+    blob_change_feed_retention_in_days = null
+  }
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.change_feed_retention_in_days == 7
+    error_message = "The container delete retention policy is not correct"
+  }
+}
+
+run "private_container_access_type" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_container.this.container_access_type == "private"
+    error_message = "The container access type is not correct"
+  }
+}
diff --git a/tests/max_instances.tftest.hcl b/tests/max_instances.tftest.hcl
new file mode 100644
index 0000000..61eee18
--- /dev/null
+++ b/tests/max_instances.tftest.hcl
@@ -0,0 +1,27 @@
+provider "azurerm" {
+  features {}
+}
+
+variables {
+  rg_name        = "rg-exampleterraform-001"
+  st_project     = "exampleterraform"
+  st_instance    = 999
+  container_name = "examplecontainer"
+}
+
+run "min_st_instance" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.name == "stexampleterraform999"
+    error_message = "The container delete retention policy is not correct"
+  }
+}
+
+
+run "invalid_st_instance" {
+  variables {
+    st_instance = 1000
+  }
+  command         = plan
+  expect_failures = [var.st_instance]
+}
diff --git a/tests/max_retention.tftest.hcl b/tests/max_retention.tftest.hcl
new file mode 100644
index 0000000..5aaa7ed
--- /dev/null
+++ b/tests/max_retention.tftest.hcl
@@ -0,0 +1,61 @@
+provider "azurerm" {
+  features {}
+}
+
+variables {
+  rg_name                                     = "rg-exampleterraform-001"
+  st_project                                  = "exampleterraform"
+  st_instance                                 = 1
+  blob_delete_retention_policy_days           = 30
+  blob_container_delete_retention_policy_days = 30
+  blob_change_feed_retention_in_days          = 30
+  container_name                              = "examplecontainer"
+}
+
+run "max_delete_retention_policy" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.delete_retention_policy.0.days == 30
+    error_message = "The delete retention policy is not correct"
+  }
+}
+
+run "max_container_delete_retention_policy" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.container_delete_retention_policy.0.days == 30
+    error_message = "The container delete retention policy is not correct"
+  }
+}
+
+run "max_change_feed_retention_in_days" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.change_feed_retention_in_days == 30
+    error_message = "The change feed retention is not correct"
+  }
+}
+
+run "invalid_delete_retention_policy" {
+  variables {
+    blob_delete_retention_policy_days = 31
+  }
+  command         = plan
+  expect_failures = [var.blob_delete_retention_policy_days]
+}
+
+run "invalid_container_delete_retention_policy" {
+  variables {
+    blob_container_delete_retention_policy_days = 31
+  }
+  command         = plan
+  expect_failures = [var.blob_container_delete_retention_policy_days]
+}
+
+run "invalid_change_feed_retention_in_days" {
+  variables {
+    blob_change_feed_retention_in_days = 31
+  }
+  command         = plan
+  expect_failures = [var.blob_change_feed_retention_in_days]
+}
diff --git a/tests/min_instances.tftest.hcl b/tests/min_instances.tftest.hcl
new file mode 100644
index 0000000..0e6dc84
--- /dev/null
+++ b/tests/min_instances.tftest.hcl
@@ -0,0 +1,26 @@
+provider "azurerm" {
+  features {}
+}
+
+variables {
+  rg_name        = "rg-exampleterraform-001"
+  st_project     = "exampleterraform"
+  st_instance    = 1
+  container_name = "examplecontainer"
+}
+
+run "min_st_instance" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.name == "stexampleterraform001"
+    error_message = "The container delete retention policy is not correct"
+  }
+}
+
+run "invalid_st_instance" {
+  variables {
+    st_instance = 0
+  }
+  command         = plan
+  expect_failures = [var.st_instance]
+}
diff --git a/tests/min_retention.tftest.hcl b/tests/min_retention.tftest.hcl
new file mode 100644
index 0000000..ddb9f67
--- /dev/null
+++ b/tests/min_retention.tftest.hcl
@@ -0,0 +1,61 @@
+provider "azurerm" {
+  features {}
+}
+
+variables {
+  rg_name                                     = "rg-exampleterraform-001"
+  st_project                                  = "exampleterraform"
+  st_instance                                 = 1
+  blob_delete_retention_policy_days           = 3
+  blob_container_delete_retention_policy_days = 3
+  blob_change_feed_retention_in_days          = 3
+  container_name                              = "examplecontainer"
+}
+
+run "min_delete_retention_policy" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.delete_retention_policy.0.days == 3
+    error_message = "The delete retention policy is not correct"
+  }
+}
+
+run "min_container_delete_retention_policy" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.container_delete_retention_policy.0.days == 3
+    error_message = "The container delete retention policy is not correct"
+  }
+}
+
+run "min_change_feed_retention_in_days" {
+  command = plan
+  assert {
+    condition     = azurerm_storage_account.this.blob_properties.0.change_feed_retention_in_days == 3
+    error_message = "The change feed retention is not correct"
+  }
+}
+
+run "invalid_delete_retention_policy" {
+  variables {
+    blob_delete_retention_policy_days = 2
+  }
+  command         = plan
+  expect_failures = [var.blob_delete_retention_policy_days]
+}
+
+run "invalid_container_delete_retention_policy" {
+  variables {
+    blob_container_delete_retention_policy_days = 2
+  }
+  command         = plan
+  expect_failures = [var.blob_container_delete_retention_policy_days]
+}
+
+run "invalid_change_feed_retention_in_days" {
+  variables {
+    blob_change_feed_retention_in_days = 2
+  }
+  command         = plan
+  expect_failures = [var.blob_change_feed_retention_in_days]
+}
diff --git a/tests/naming.tftest.hcl b/tests/naming.tftest.hcl
new file mode 100644
index 0000000..1e41651
--- /dev/null
+++ b/tests/naming.tftest.hcl
@@ -0,0 +1,84 @@
+provider "azurerm" {
+  features {}
+}
+
+variables {
+  rg_name        = "rg-exampleterraform-001"
+  st_project     = "exampleterraform"
+  st_instance    = 5
+  container_name = "examplecontainer"
+}
+
+run "st_name" {
+  command = plan
+
+  assert {
+    condition     = azurerm_storage_account.this.name == "stexampleterraform005"
+    error_message = "The Storage Account name is not correct"
+  }
+}
+
+run "standard_accoumt_tier" {
+  command = plan
+
+  assert {
+    condition     = azurerm_storage_account.this.account_tier == "Standard"
+    error_message = "The Storage Account tier is not correct"
+  }
+}
+
+run "invalid_project_min_length" {
+  variables {
+    st_project = "ab"
+  }
+  command         = plan
+  expect_failures = [var.st_project]
+}
+
+run "invalid_project_max_length" {
+  variables {
+    st_project = "abcdabcdabcdabcdabcda"
+  }
+  command         = plan
+  expect_failures = [var.st_project]
+}
+
+run "invalid_alphanumeric_project" {
+  variables {
+    st_project = "ab12"
+  }
+  command         = plan
+  expect_failures = [var.st_project]
+}
+
+run "invalid_prefix_rg_name" {
+  variables {
+    st_project = "abcdefg001"
+  }
+  command         = plan
+  expect_failures = [var.st_project]
+}
+
+run "invalid_instance_rg_name" {
+  variables {
+    st_project = "abcdefg01"
+  }
+  command         = plan
+  expect_failures = [var.st_project]
+}
+
+run "invalid_container_name_min_length" {
+  variables {
+    st_project = "ab"
+  }
+  command         = plan
+  expect_failures = [var.st_project]
+}
+
+run "invalid_container_name_max_length" {
+  variables {
+    st_project = "abcdabcdabcdabcdabcda"
+  }
+  command         = plan
+  expect_failures = [var.st_project]
+}
diff --git a/variables.tf b/variables.tf
index 043ffcc..359ee61 100644
--- a/variables.tf
+++ b/variables.tf
@@ -13,3 +13,143 @@ variable "rg_name" {
     error_message = "The value must consist of lowercase letters and numbers, and have a length between 3 and 63 characters"
   }
 }
+
+variable "st_project" {
+  type        = string
+  description = <<DESCRIPTION
+  The project name.
+  It must be lowercase and have a length between 3 and 18 characters.
+
+  Changing this forces a new resource to be created.
+  DESCRIPTION
+  nullable    = false
+
+  validation {
+    condition     = can(regex("^[a-z]{3,18}$", var.st_project))
+    error_message = "The project name must be lowercase and have a length between 3 and 18 characters"
+  }
+}
+
+variable "st_instance" {
+  type        = number
+  description = <<DESCRIPTION
+  The storage account instance.
+  It must be greater than or equal to 1 and less than or equal to 999.
+
+  Changing this forces a new resource to be created.
+  DESCRIPTION
+  nullable    = false
+
+  validation {
+    condition     = var.st_instance >= 1 && var.st_instance <= 999
+    error_message = "The storage account instance must be greater than or equal to 1 and less than or equal to 999"
+  }
+}
+
+variable "blob_delete_retention_policy_days" {
+  type        = number
+  description = <<DESCRIPTION
+  The days for the blob delete retention policy.
+  It must be greater than or equal to 3 and less than or equal to 30.
+  DESCRIPTION
+  default     = 7
+  nullable    = false
+
+  validation {
+    condition     = var.blob_delete_retention_policy_days >= 3 && var.blob_delete_retention_policy_days <= 30
+    error_message = "The blob delete retention policy days must be greater than or equal to 3 and less than or equal to 30"
+  }
+}
+
+variable "blob_container_delete_retention_policy_days" {
+  type        = number
+  description = <<DESCRIPTION
+  The days for the container delete retention policy.
+  It must be greater than or equal to 3 and less than or equal to 30.
+  DESCRIPTION
+  default     = 7
+  nullable    = false
+
+  validation {
+    condition     = var.blob_container_delete_retention_policy_days >= 3 && var.blob_container_delete_retention_policy_days <= 30
+    error_message = "The container delete retention policy days must be greater than or equal to 3 and less than or equal to 30"
+  }
+}
+
+variable "blob_change_feed_retention_in_days" {
+  type        = number
+  description = <<DESCRIPTION
+  The days for the change feed retention.
+  It must be greater than or equal to 3 and less than or equal to 30.
+  DESCRIPTION
+  default     = 7
+  nullable    = false
+
+  validation {
+    condition     = var.blob_change_feed_retention_in_days >= 3 && var.blob_change_feed_retention_in_days <= 30
+    error_message = "The change feed retention in days must be greater than or equal to 3 and less than or equal to 30"
+  }
+}
+
+variable "account_tier" {
+  type        = string
+  description = <<DESCRIPTION
+  The account tier.
+  It must be one of the following values: Standard, Premium.
+
+  Changing this forces a new resource to be created.
+  DESCRIPTION
+  default     = "Standard"
+  nullable    = false
+  validation {
+    condition     = can(regex("^(Standard|Premium)$", var.account_tier))
+    error_message = "The account tier must be one of the following values: Standard, Premium"
+  }
+}
+
+variable "account_replication_type" {
+  type        = string
+  description = <<DESCRIPTION
+  The account replication type.
+  It must be one of the following values: LRS, GRS, RA-GRS, ZRS, GZRS, RA-GZRS.
+
+  Changing this forces a new resource to be created.
+  DESCRIPTION
+  default     = "LRS"
+  nullable    = false
+  validation {
+    condition     = can(regex("^(LRS|GRS|RA-GRS|ZRS|GZRS|RA-GZRS)$", var.account_replication_type))
+    error_message = "The account replication type must be one of the following values: LRS, GRS, RA-GRS, ZRS, GZRS, RA-GZRS"
+  }
+}
+
+variable "account_kind" {
+  type        = string
+  description = <<DESCRIPTION
+  The account kind.
+  It must be one of the following values: StorageV2, BlobStorage, FileStorage, BlockBlobStorage.
+
+  Changing this forces a new resource to be created.
+  DESCRIPTION
+  default     = "StorageV2"
+  nullable    = false
+  validation {
+    condition     = can(regex("^(StorageV2|BlobStorage|FileStorage|BlockBlobStorage)$", var.account_kind))
+    error_message = "The account kind must be one of the following values: StorageV2, BlobStorage, FileStorage, BlockBlobStorage"
+  }
+}
+
+variable "container_name" {
+  type        = string
+  description = <<DESCRIPTION
+  The value must consist of lowercase letters and numbers, and have a length between 3 and 63 characters
+
+  Changing this forces a new resource to be created.
+  DESCRIPTION
+  nullable    = false
+
+  validation {
+    condition     = can(regex("^[a-z0-9]{3,63}$", var.container_name))
+    error_message = "The value must consist of lowercase letters and numbers, and have a length between 3 and 63 characters"
+  }
+}


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-05-10T05:00:49Z
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-06-07T05:54:53Z

Review comments:
diff_hunk: @@ -0,0 +1,22 @@
+terraform {
+  required_version = "~>1.10"
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~>4.3"
+    }
+  }
+  backend "azurerm" {}
+}
+
+provider "azurerm" {
+  features {}
+}
+
+module "sa" {
+  source         = "git::https://github.com/JamieYnonan/terraform-azurerm-storage-account.git?ref=v1"
+  rg_name        = "rg-abc123-001"
+  st_instance    = 1
+  st_project     = "abc"
+  container_name = "container"
+}
path: examples/basic/main.tf
user: login: github-advanced-security[bot]
body: ## Ensure Terraform module sources use a commit hash

Ensure Terraform module sources use a commit hash

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/1)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -0,0 +1,22 @@
+terraform {
+  required_version = "~>1.10"
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~>4.3"
+    }
+  }
+  backend "azurerm" {}
+}
+
+provider "azurerm" {
+  features {}
+}
+
+module "sa" {
+  source         = "git::https://github.com/JamieYnonan/terraform-azurerm-storage-account.git?ref=v1"
+  rg_name        = "rg-abc123-001"
+  st_instance    = 1
+  st_project     = "abc"
+  container_name = "container"
+}
path: examples/basic/main.tf
user: login: github-advanced-security[bot]
body: ## Ensure Terraform module sources use a tag with a version number

Ensure Terraform module sources use a tag with a version number

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/2)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure Storage logging is enabled for Queue service for read, write and delete requests

Ensure Storage logging is enabled for Queue service for read, write and delete requests

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/3)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure that Storage Accounts use replication

Ensure that Storage Accounts use replication

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/4)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure that Storage accounts disallow public access

Ensure that Storage accounts disallow public access

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/5)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure storage account is configured with private endpoint

Ensure storage account is configured with private endpoint

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/7)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure storage for critical data are encrypted with Customer Managed Key

Ensure storage for critical data are encrypted with Customer Managed Key

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/8)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
+
+resource "azurerm_storage_container" "this" {
+  depends_on            = [azurerm_storage_account.this]
+  name                  = var.container_name
+  storage_account_id    = azurerm_storage_account.this.id
+  container_access_type = local.container_access_type
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure Storage logging is enabled for Blob service for read requests

Ensure Storage logging is enabled for Blob service for read requests

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/6)
created_at: 2025-05-10T05:00:49Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure storage account is not configured with Shared Key authorization

Ensure storage account is not configured with Shared Key authorization

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/9)
created_at: 2025-06-07T05:54:53Z
author_association: NONE
diff_hunk: @@ -1,0 +1,35 @@
+resource "azurerm_storage_account" "this" {
+  name                            = local.st_name
+  resource_group_name             = data.azurerm_resource_group.this.name
+  location                        = data.azurerm_resource_group.this.location
+  account_tier                    = var.account_tier
+  account_replication_type        = var.account_replication_type
+  account_kind                    = var.account_kind
+  https_traffic_only_enabled      = local.https_traffic_only_enabled
+  min_tls_version                 = local.min_tls_version
+  allow_nested_items_to_be_public = local.allow_nested_items_to_be_public
+  local_user_enabled              = local.local_user_enabled
+  shared_access_key_enabled       = local.shared_access_key_enabled
+
+  blob_properties {
+    versioning_enabled = local.blob_properties_versioning_enabled
+
+    delete_retention_policy {
+      days = var.blob_delete_retention_policy_days
+    }
+
+    container_delete_retention_policy {
+      days = var.blob_container_delete_retention_policy_days
+    }
+
+    change_feed_enabled           = local.blob_propertieschange_feed_enabled
+    change_feed_retention_in_days = var.blob_change_feed_retention_in_days
+  }
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Ensure storage account is configured with SAS expiration policy

Ensure storage account is configured with SAS expiration policy

[Show more details](https://github.com/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning/10)
created_at: 2025-06-07T05:54:53Z
author_association: NONE

PR comments:
user: login: github-advanced-security[bot]
created_at: 2025-05-10T05:00:27Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning?query=pr%3A1+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: NONE
user: login: github-advanced-security[bot]
created_at: 2025-05-10T05:00:27Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/JamieYnonan/terraform-azurerm-storage-account/security/code-scanning?query=pr%3A1+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: NONE