☁️ Azure Advisor Suppression Terraform Module

Records a governed waiver for an Azure Advisor recommendation as code — dismissing one recommendation on one target resource for a bounded, reviewable duration instead of clicking "Dismiss" in the portal. Targets hashicorp/azurerm ~> 4.0.

• 🔕 Creates one azurerm_advisor_suppression — a single dismissal of one Advisor recommendation on one target resource.
• 🎯 Binds three things: a chosen name (the waiver's own identity), a recommendation_id (the specific finding), and a resource_id (the target the finding is about).
• ⏳ Prefers a bounded ttl — a days:hours:minutes:seconds duration after which the recommendation resurfaces for review — so a waiver cannot silently mask a drifting resource forever.
• 🧾 Emits the suppression's Resource ID and the Advisor-assigned suppression_id, so the waiver is traceable back to both the finding and the resource.
• 🧱 Standalone primitive: it consumes the target resource by id and pairs with the azurerm_advisor_recommendations data source, which supplies the live recommendation_id.

💡 Why it matters: an Advisor recommendation you accept but never record keeps reappearing, and one you dismiss permanently in the portal disappears with no audit trail and no expiry. Expressing the waiver as code makes the decision reviewable, versioned, and — with a bounded ttl — self-expiring, so accepted risk is revisited on a schedule instead of forgotten.

If this module saves you time, please consider supporting the work:

• ⭐ Star the repository — it helps others find it.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart LR
  advisor["Azure Advisor<br/>(produces recommendations)"]
  recs["azurerm_advisor_recommendations<br/>(data source)"]
  target["Target resource<br/>(sibling module: storage / VM / SQL)"]
  sup["azurerm_advisor_suppression<br/>(this module)"]

  advisor -->|"raises recommendation on"| target
  target -->|"resource_id"| sup
  recs -->|"recommendation_id"| sup
  sup -->|"dismisses recommendation in"| advisor

  classDef this fill:#0078D4,stroke:#004578,color:#fff;
  classDef target fill:#004578,stroke:#004578,color:#fff;
  classDef ext fill:#F2F2F2,stroke:#8A8A8A,color:#222;
  class sup this;
  class target target;
  class advisor,recs ext;

The suppression sits between a target resource and Azure Advisor. It creates nothing on the resource itself; it tells Advisor to stop surfacing one recommendation about that resource for the life of the suppression.

flowchart LR
  subgraph inputs["Inputs"]
    n["name"]
    rid["recommendation_id"]
    resid["resource_id"]
    ttl["ttl<br/>(default null = never expires)"]
  end

  sup["azurerm_advisor_suppression.this"]

  subgraph outputs["Outputs"]
    oid["id"]
    onm["name"]
    osid["suppression_id"]
  end

  n -->|"name"| sup
  rid -->|"recommendation_id"| sup
  resid -->|"resource_id"| sup
  ttl -->|"ttl"| sup
  sup -->|"id"| oid
  sup -->|"name"| onm
  sup -->|"suppression_id"| osid

  classDef this fill:#0078D4,stroke:#004578,color:#fff;
  classDef target fill:#004578,stroke:#004578,color:#fff;
  classDef ext fill:#F2F2F2,stroke:#8A8A8A,color:#222;
  class sup this;
  class n,rid,resid,ttl,oid,onm,osid ext;

Resource inventory

Schema notes that bite (verified against the live provider schema):

• 🔁 Everything is force-new. Changing name, recommendation_id, resource_id, or ttl replaces the suppression. There is no in-place update path — the resource exposes only create, read, and delete.
• 🔀 recommendation_id is not stable forever. Advisor generates recommendation IDs per resource and regenerates them when a recommendation is refreshed. A suppression pinned to a stale ID no longer matches the live recommendation, so the finding can reappear under a new ID. Read the current value from the azurerm_advisor_recommendations data source rather than hard-coding it.
• ⏳ The ttl FORMAT IS NOT WHAT "DD:HH:MM:SS" SUGGESTS. The provider's validator is ^(?:[0-9]{1,2}:)?[0-9]{2}:[0-9]{2}:[0-9]{2}$ — the days field is OPTIONAL and at most two digits. So "12:00:00" (twelve hours, no days field) is legal, and "100:00:00:00" is not: no postponement longer than 99 days can be expressed. The provider's own error message says the days field "has to be omit" when it is 00, but its regex accepts "00:12:00:00" all the same — the message is advice, not the rule. This module mirrors the regex, not the message.
• ⏳ Omitting ttl is not a smaller version of setting it — it changes the KIND of suppression. In Advisor's own terms, a ttl makes this a postpone and its absence makes it a dismiss. Microsoft's documentation states that a postponed recommendation returns to the Active state automatically once the time elapses, and that dismissed recommendations are excluded from Advisor's completion-progress calculation. An indefinite suppression therefore hides the finding and removes it from the denominator the score is measured against — the posture improves because the question was withdrawn. Reported through the is_dismissal and excluded_from_advisor_completion_progress outputs.
• 🔴 A MANAGEMENT GROUP OR TENANT SCOPE IS UNREACHABLE THROUGH THIS RESOURCE. Microsoft's ARM reference lists Microsoft.Advisor/recommendations/suppressions as deployable at tenant, management group, subscription and resource group scope. The provider validates resource_id with a parser that requires a subscriptions path segment and fails with "no subscription ID found" without one, so neither broader scope can be reached at all. That is a provider limitation rather than an Azure one, and nothing in the provider documentation says the scope set is narrower than the API's.
• 🏷️ No tags, no location. Confirmed against the live provider schema, this resource type accepts neither, so the module deliberately omits both. It is not a regional resource — it lives under the target recommendation.
• ⌛ No update timeout. The timeouts block exposes only create, read, and delete; there is no update operation to time out.

• The Microsoft.Advisor/suppressions/write and Microsoft.Advisor/suppressions/delete actions at the scope of the target resource (or above). The built-in Contributor role at the target scope carries these, as does an equivalent custom role that includes the Microsoft.Advisor/suppressions/* actions.
• No tenant-wide privilege is required. Grant at the smallest scope that contains the target resource named by resource_id.

• The Microsoft.Advisor resource provider registered on the target subscription.
• An existing target resource (or subscription / resource-group scope) whose resource id is supplied as resource_id, and against which Advisor has produced the recommendation being suppressed.
• The live recommendation_id of the recommendation to suppress — read it from the azurerm_advisor_recommendations data source or the Advisor REST API rather than hard-coding a value that Advisor may have regenerated.
• The caller configures the provider "azurerm" { features {} } block, authentication, and subscription.

terraform-azurerm-advisor-suppression/
├── providers.tf   # required_version >= 1.12.0; azurerm ~> 4.0; no provider block
├── variables.tf   # deeply-typed inputs; name/recommendation_id/resource_id/ttl + timeouts tail
├── main.tf        # the single keystone azurerm_advisor_suppression.this
├── outputs.tf     # id first, then name, then suppression_id and the target references
├── README.md      # this document
├── SCOPE.md       # the cross-module contract
├── LICENSE        # MIT, Copyright (c) 2026 Casey Wood
└── .gitignore     # canonical library ignore set

The smallest real call — a bounded, thirty-day waiver on a resource, using a recommendation ID read from the data source:

provider "azurerm" {
  features {}
}

data "azurerm_advisor_recommendations" "example" {}

module "advisor_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "accepted-cost-tradeoff"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.storage.id
  ttl               = "30:00:00:00" # thirty days, then the recommendation resurfaces for review
}

ℹ️ The caller owns the provider, authentication, and the mandatory features {} block. Pin the module with ?ref=v1.0.0; never track a branch.

Consumes

Emits

The examples below reference existing resources by ID or name rather than creating them; this module owns only its own resource. Those references are declared inputs:

variable "storage_archive_id" {
  description = "id of an existing storage archive that these examples reference but do not create."
  type        = string
}

variable "storage_logs_id" {
  description = "id of an existing storage logs that these examples reference but do not create."
  type        = string
}

module "waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "accepted-cost-tradeoff"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.storage.id
  ttl               = "30:00:00:00"
}

data "azurerm_advisor_recommendations" "all" {
  filter_by_category        = ["Cost"]
  filter_by_resource_groups = ["rg-platform"]
}

module "waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "cost-waiver-first-match"
  recommendation_id = data.azurerm_advisor_recommendations.all.recommendations[0].recommendation_name
  resource_id       = data.azurerm_advisor_recommendations.all.recommendations[0].resource_name
  ttl               = "14:00:00:00"
}

module "cooling_off" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "post-deploy-cooling-off"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.vm.id
  ttl               = "07:00:00:00"
}

module "sprint_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "deferred-to-next-sprint"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.sql_server.id
  ttl               = "30:00:00:00"
}

module "permanent_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "waiver-CHG0012345-by-design"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.storage.id
  # ttl omitted → the suppression never expires
}

module "subscription_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "subscription-level-acceptance"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = "/subscriptions/00000000-0000-0000-0000-000000000000"
  ttl               = "30:00:00:00"
}

module "with_timeouts" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "accepted-cost-tradeoff"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.storage.id
  ttl               = "30:00:00:00"

  timeouts = {
    create = "10m"
    delete = "10m"
  }
}

locals {
  # A recommendation category accepted on several storage accounts, each with its own recommendation_id.
  waived_storage = {
    logs = {
      resource_id       = var.storage_logs_id
      recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
    }
    archive = {
      resource_id       = var.storage_archive_id
      recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[1].recommendation_name
    }
  }
}

module "storage_waivers" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"
  for_each = local.waived_storage

  name              = "cost-waiver-${each.key}"
  recommendation_id = each.value.recommendation_id
  resource_id       = each.value.resource_id
  ttl               = "30:00:00:00"
}

locals {
  waiver_register = {
    "sql-tls-accepted" = {
      resource_id       = module.sql_server.id
      recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
      ttl               = "30:00:00:00"
    }
    "vm-rightsizing-deferred" = {
      resource_id       = module.vm.id
      recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[1].recommendation_name
      ttl               = "14:00:00:00"
    }
  }
}

module "waivers" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"
  for_each = local.waiver_register

  name              = each.key
  recommendation_id = each.value.recommendation_id
  resource_id       = each.value.resource_id
  ttl               = each.value.ttl
}

# Preferred: an explicit reason in the name and a bounded ttl.
module "reviewable_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "waiver-INC0004521-accepted-until-remediation"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.storage.id
  ttl               = "30:00:00:00"
}

module "storage" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-storage-account.git?ref=v1.0.0"

  name                = "stplatformlogs"
  resource_group_name = module.rg.name
  location            = module.rg.location
}

module "storage_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "storage-cost-accepted"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.storage.id
  ttl               = "30:00:00:00"
}

module "nic_vm" {
  source              = "git::https://github.com/microsoftexpert/terraform-azurerm-network-interface.git?ref=v1.0.0"
  name                = "nic-vm"
  resource_group_name = module.rg.name
  location            = module.rg.location

  ip_configurations = [{
    name      = "internal"
    subnet_id = var.vm_subnet_id
  }]
}

module "vm" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-linux-virtual-machine.git?ref=v1.0.0"

  admin_username        = "azureadmin"

  network_interface_ids = [module.nic_vm.id]

  size                  = "Standard_D2s_v5"

  name                = "vm-batch-01"
  resource_group_name = module.rg.name
  location            = module.rg.location
  # ... size, image, and network inputs ...
}

module "vm_rightsizing_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "vm-rightsizing-deferred"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.vm.id
  ttl               = "14:00:00:00"
}

module "sql_server" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-mssql-server.git?ref=v1.0.0"

  azuread_administrator = {
    login_username = "sqladmin@contoso.example"
    object_id      = "00000000-0000-0000-0000-000000000000"
  }

  name                = "sql-platform-eus2"
  resource_group_name = module.rg.name
  location            = module.rg.location
}

module "sql_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "sql-recommendation-accepted"
  recommendation_id = data.azurerm_advisor_recommendations.example.recommendations[0].recommendation_name
  resource_id       = module.sql_server.id
  ttl               = "30:00:00:00"
}

provider "azurerm" {
  features {}
}

# 1. Resource group to hold the target resource.
module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-platform"
  location = "eastus2"
}

# 2. The target resource Advisor produces recommendations about.
module "storage" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-storage-account.git?ref=v1.0.0"

  name                = "stplatformlogs"
  resource_group_name = module.rg.name
  location            = module.rg.location
}

# 3. The live recommendations, filtered to the target's resource group and category.
data "azurerm_advisor_recommendations" "cost" {
  filter_by_category        = ["Cost"]
  filter_by_resource_groups = [module.rg.name]
}

# 4. The waiver — a bounded, named dismissal of one recommendation on the storage account.
module "storage_cost_waiver" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-advisor-suppression.git?ref=v1.0.0"

  name              = "storage-cost-accepted-Q3"
  recommendation_id = data.azurerm_advisor_recommendations.cost.recommendations[0].recommendation_name
  resource_id       = module.storage.id
  ttl               = "30:00:00:00"
}

Required

Optional

variable "name" {
  type = string
  # Non-empty. NO length ceiling: the provider publishes none, and a limit invented here would
  # refuse a name someone may already own - which would block `terraform destroy` as well as apply.
  # Rejected: a bare GUID (almost always recommendation_id misplaced) and a Resource ID.
  # Immutable: changing this forces replacement.
}

variable "recommendation_id" {
  type = string
  # A non-empty Advisor recommendation ID (read from the azurerm_advisor_recommendations data source).
  # Immutable: changing this forces replacement.
}

variable "resource_id" {
  type = string
  # A full Azure Resource ID beginning with /subscriptions/.
  # Immutable: changing this forces replacement.
}

variable "ttl" {
  type    = string
  default = null
  # null, or a duration matching the provider's own ^(?:[0-9]{1,2}:)?[0-9]{2}:[0-9]{2}:[0-9]{2}$ -
  # so the DAYS FIELD IS OPTIONAL and at most two digits: "12:00:00" is legal, "100:00:00:00" is not.
  # null / omitted -> a DISMISSAL rather than a postponement: indefinite, and excluded from Advisor's
  # completion-progress calculation. Immutable: changing this forces replacement.
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    delete = optional(string)
  })
  default = null
}

No secret is output — the resource stores none. Nothing here is marked sensitive.

• The whole resource is a dismissal record. There is no data plane, no network surface, and no secret. The only meaningful lever is how long — and how visibly — a finding is hidden, which is why ttl and a descriptive name carry the design weight.
• Every argument is force-new. Confirmed against the live provider schema, name, recommendation_id, resource_id, and ttl are all immutable in place — changing any of them recreates the suppression. There is no update operation, so the timeouts block omits update.
• recommendation_id drifts. Advisor regenerates recommendation IDs per resource. A literal that was valid at authoring time can go stale, after which the suppression targets a recommendation that no longer exists and the finding reappears under a new ID. Source the value from the azurerm_advisor_recommendations data source so it tracks the live recommendation.
• ttl is the safety control, and it selects the KIND of suppression. With a duration this is a postpone: Microsoft's documentation states the recommendation returns to Active automatically when the time elapses. Without one it is a dismiss: indefinite, and excluded from Advisor's completion-progress calculation — so the score improves because the finding left the denominator, not because anything was fixed. A bounded ttl is the documented posture; a permanent waiver is a deliberate opt-out (Example 5).
• Nothing here changes the resource. A suppression alters what Advisor displays. A suppressed availability recommendation leaves the resource exactly as unavailable as it was — which is worth saying because this module sits next to the resource, is named after the finding, and makes the finding disappear.
• The scope set is narrower than the API's. Tenant and management-group suppressions exist in ARM but cannot be created through this resource; the provider's resource_id validator requires a subscriptions segment. The failure reads as a parsing error rather than a scope one.
• Terraform cannot see the clock. When a postponement expires, nothing about the managed resource changes, so no drift is reported and no plan is produced. The record stays in state; only Advisor's display changes.
• for_each key stability. A recommendation accepted across several resources needs one suppression per resource. Key for_each by a stable identifier so adding or removing one waiver never re-indexes the others.
• No tags, no location. Confirmed against the live provider schema, this resource type accepts neither, so — unlike most azurerm modules — there is no tags tail here.
• features {} dependence. Like every azurerm resource, this will not plan without the caller's provider "azurerm" { features {} } block. That is expected; the module never declares a provider.

The empty call already produces the hardened resource. Each relaxation is an explicit caller opt-out.

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the module with ?ref=v1.0.0; never track a branch.
• Plan-only during authoring — a human runs terraform plan / apply from CI against real credentials.

The offline proof gate is what this module guarantees:

• terraform init -backend=false — resolves the pinned provider with no backend and no cloud call.
• terraform validate — proves the configuration is type-correct against the pinned provider schema, catching every typing mistake the input schemas surface, plus the resource_id Resource-ID check, the ttl duration-format check, and the non-empty name / recommendation_id validations.
• terraform fmt -check — enforces canonical formatting.

Only terraform plan (run by a human, from CI, against real credentials) reaches the Advisor API and proves the recommendation_id matches a live recommendation. This module is never applied during authoring.

$ terraform output
id                = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-platform/providers/Microsoft.Storage/storageAccounts/stplatformlogs/providers/Microsoft.Advisor/recommendations/9c1b2d3e-4f56-7890-abcd-ef1234567890/suppressions/storage-cost-accepted-Q3"
name              = "storage-cost-accepted-Q3"
suppression_id    = "1a2b3c4d-5e6f-7081-92a3-b4c5d6e7f809"
recommendation_id = "9c1b2d3e-4f56-7890-abcd-ef1234567890"
resource_id       = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-platform/providers/Microsoft.Storage/storageAccounts/stplatformlogs"
ttl               = "30:00:00:00"

• Provider resource: azurerm_advisor_suppression
• Provider data source: azurerm_advisor_recommendations
• Azure Advisor recommendation state management
• Sibling modules: terraform-azurerm-storage-account, terraform-azurerm-linux-virtual-machine, terraform-azurerm-mssql-server, terraform-azurerm-resource-group
• This module's SCOPE.md

💙 "Infrastructure as Code should be standardized, consistent, and secure."