☁️ Azure API Management Custom Domain Terraform Module

Owns the custom host names on an Azure API Management service — gateway, portal, developer portal, management and SCM — and the certificate each presents. Targets hashicorp/azurerm ~> 4.0.

• 🌐 Owns the custom host names on an API Management service across all five endpoint types.
• 🔐 Attaches a certificate to each host name, from Key Vault (preferred) or an inline base-64 PFX.
• 🧨 States the blast radius up front: this record is a singleton, it is authoritative over the service's whole hostname array, and destroying it strips every custom host name from the service.
• ⛔ Refuses to expose the deprecated key_vault_id field, which maps to the same wire property and silently overrides its replacement.
• ⏱️ Explains why an apply here takes minutes — the provider waits for six consecutive healthy reads, before and after the write.
• 🏷️ Carries no tags — the resource has none. The universal tail is timeouts only.

💡 Why it matters: this is not an ordinary child resource. It has no Azure object of its own — it is a projection onto the parent service — so an ordinary-looking terraform destroy removes every custom host name from the service, including ones this configuration never created. That consequence is invisible in a destroy plan, which shows a single resource going away.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart TB
  rg["terraform-azurerm-resource-group"]
  kv["terraform-azurerm-key-vault"]
  uai["terraform-azurerm-user-assigned-identity"]
  ra["terraform-azurerm-role-assignments"]
  dns["terraform-azurerm-dns-zone"]
  apim["terraform-azurerm-api-management"]
  this["terraform-azurerm-api-management-custom-domain"]
  cert["terraform-azurerm-api-management-certificate"]
  gw["terraform-azurerm-api-management-gateway"]

  rg -->|"name"| apim
  apim -->|"id"| this
  kv -->|"secret identifier, versionless to follow the vault"| this
  uai -->|"client_id"| this
  uai -->|"principal_id"| ra
  ra -->|"Key Vault Secrets User on the vault"| kv
  dns -->|"CNAME or A record, not created here"| this
  apim -->|"its own hostname_configuration block writes the SAME property"| this
  cert -->|"separate store, used by the self-hosted gateway"| gw

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef keystone fill:#004578,stroke:#002b4d,color:#ffffff;
  classDef sib fill:#eef3f8,stroke:#b9c7d6,color:#1b2a3a;
  class this me;
  class apim keystone;
  class rg,kv,uai,ra,dns,cert,gw sib;

The API Management family is large, so this diagram names only this module's direct neighbours rather than every api-management-* module in the library. Note the edge from the service module back to this one: api-management exposes its own hostname_configuration block against the same service property, so the two are alternative owners of one array rather than complements. Note also what is not an input: DNS. Nothing here creates the record that makes a host name resolve.

flowchart TB
  subgraph inputs["Inputs"]
    svc["api_management_id, the only force-new field"]
    gw["gateway entries, plus default_ssl_binding"]
    other["portal, developer_portal, management, scm entries"]
  end

  this["azurerm_api_management_custom_domain.this"]
  prop["the service hostnameConfigurations property, replaced whole on every apply"]

  subgraph outputs["Outputs"]
    ohn["all_host_names, host_name_count_by_endpoint"]
    ocert["certificate_expiry_by_host_name, gateway_certificate_details"]
    opost["host_names_using_key_vault, host_names_with_an_inline_certificate"]
    ofact["destroying_this_removes_all_custom_host_names, this_resource_is_authoritative_over_service_host_names"]
  end

  svc --> this
  gw -->|"at least one of the five must be non-empty"| this
  other -->|"at least one of the five must be non-empty"| this
  this -->|"read, replace, write back"| prop
  this --> ohn
  this --> ocert
  this --> opost
  this --> ofact

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef keystone fill:#004578,stroke:#002b4d,color:#ffffff;
  classDef sib fill:#eef3f8,stroke:#b9c7d6,color:#1b2a3a;
  class this me;
  class prop keystone;
  class svc,gw,other,ohn,ocert,opost,ofact sib;

Resource inventory

Schema notes that bite

• It is a singleton. The Resource ID ends with the literal segment default; there is one per service and no Azure resource behind it.
• It is authoritative. Create and update read the whole service, replace hostnameConfigurations entirely, and write the service back. A host name on the service that is not listed here is removed.
• Destroy sets hostnameConfigurations to null on the whole service — every custom host name goes, not only those this record created.
• It collides with the api-management module's own hostname_configuration block. Two owners of one array means each apply reverts the other.
• Every write waits for Succeeded six consecutive times at one-minute intervals, before and after the write — and delete does the same. The provider's own timeouts here are 60 minutes rather than the 30 used elsewhere in this family.
• Only api_management_id is force-new. Every host-name field updates in place.
• certificate and key_vault_certificate_id are documented as mutually exclusive and are not enforced as such — there is no ConflictsWith, and the expand function sends both.
• certificate is checked only for being non-empty, not for base64 — unlike azurerm_api_management_certificate.data, which does check it.
• key_vault_certificate_id is Optional and Computed on the 4.x line, and its validator accepts any Key Vault item type. The 5.0 line restricts it to /secrets/ and drops the Computed flag.
• The deprecated key_vault_id maps to the same wire property and silently overrides key_vault_certificate_id. This module does not expose it.
• default_ssl_binding is gateway-only, Optional and Computed — the provider's own comment is that Azure's logic for it cannot be predicted.
• host_name is compared case-insensitively (the provider applies a case-difference diff suppression).
• No tags, no location. The universal tail is timeouts only.

• Microsoft.ApiManagement/service/write and Microsoft.ApiManagement/service/read on the API Management service. This is broader than the family's other child modules need, and unavoidably so: the resource has no sub-resource of its own, so writing a host name is a write against the whole service. API Management Service Contributor on the service is the smallest built-in role that covers it.
• No Key Vault permission is needed by the principal running Terraform. The vault is read at runtime by the API Management service's identity, not by the plan.

The identity that reads the vault is a separate principal, and this module grants it nothing:

• Key Vault Secrets User on the vault (RBAC), or an access policy granting GET and LIST on secrets, for the service's system-assigned identity or the user-assigned identity named in ssl_keyvault_identity_client_id. Microsoft's own pages disagree on the access-policy form -- the custom-domain guidance asks for GET and LIST, the troubleshooting article for GET alone -- so grant both, which the RBAC role already does.

🔒 Reading this resource returns the certificate metadata Azure computed — expiry, subject, thumbprint — and never the inline certificate or its password, which Azure does not return at all. Plan access here is not certificate-material access.

• An existing API Management service, and no other owner of its host names.
• DNS records pointing each configured host name at the service. Nothing here creates them, and without them the configuration is valid and unreachable.
• A certificate per host name: a Key Vault secret of type application/x-pkcs12 plus an identity with GET and LIST on secrets, or a base-64 PFX supplied inline. Azure's own requirements for the certificate itself: exported as PFX, encrypted with triple DES, a private key of at least 2048 bits, and the full chain including intermediates.
• An API Management SKU that offers the endpoints being configured — the Consumption tier does not offer the full set.
• The caller configures provider "azurerm" { features {} }, authentication and subscription.

terraform-azurerm-api-management-custom-domain/
├── providers.tf    # required_version + pinned azurerm; no provider block
├── variables.tf    # five endpoint lists, deeply typed; every shape enforced at plan time
├── main.tf         # the single keystone resource and its five dynamic blocks
├── outputs.tf      # id first, then host names, certificate metadata, and the blast-radius facts
├── README.md       # this document
├── SCOPE.md        # the cross-module contract
├── LICENSE         # MIT
└── .gitignore      # the canonical library ignore set

provider "azurerm" {
  features {}
}

module "apim_custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                = "api.contoso.com"
    key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
  }]
}

ℹ️ The caller configures the provider, including the mandatory features {} block. This module declares none.

⚠️ This call is authoritative: after it applies, api.contoso.com is the only custom host name on the service. Any other custom host name that existed there is gone.

Consumes

Emits

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                = "api.contoso.com"
    key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
  }]
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                       = "api.contoso.com"
    key_vault_certificate_id        = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
    ssl_keyvault_identity_client_id = module.apim_identity.client_id
    default_ssl_binding             = true
  }]
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [
    {
      host_name                = "api.contoso.com"
      key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
      default_ssl_binding      = true
    },
    {
      host_name                = "api-eu.contoso.com"
      key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api-eu-contoso-com"
    },
  ]
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway          = [{ host_name = "api.contoso.com", key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api" }]
  developer_portal = [{ host_name = "developer.contoso.com", key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/developer" }]
  portal           = [{ host_name = "portal.contoso.com", key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/portal" }]
  management       = [{ host_name = "mgmt.contoso.com", key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/mgmt" }]
  scm              = [{ host_name = "scm.contoso.com", key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/scm" }]
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name            = "api.contoso.com"
    certificate          = filebase64("${path.module}/certs/api-contoso-com.pfx")
    certificate_password = var.pfx_password
  }]
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                    = "api.contoso.com"
    key_vault_certificate_id     = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
    negotiate_client_certificate = true
  }]
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                = "api.contoso.com"
    key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api"
  }]

  management = [{
    host_name                    = "mgmt.contoso.com"
    key_vault_certificate_id     = "https://kv-platform.vault.azure.net/secrets/mgmt"
    negotiate_client_certificate = true
  }]

  scm = [{
    host_name                = "scm.contoso.com"
    key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/scm"
  }]
}

# key_vault_certificate_id is Optional AND Computed on the 4.x line, so an
# entry with no certificate source adopts whatever Azure already holds.
module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{ host_name = "api.contoso.com" }]
}

terraform import 'module.custom_domain.azurerm_api_management_custom_domain.this' \
  "/subscriptions/$SUB/resourceGroups/rg-platform-apim/providers/Microsoft.ApiManagement/service/apim-platform-prod/customDomains/default"

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                = "api.contoso.com"
    key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
  }]

  timeouts = {
    create = "90m"
    update = "90m"
    delete = "90m"
    read   = "10m"
  }
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                = "api.contoso.com"
    key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
  }]
}

# A lifecycle block cannot be added to a module call, so the protection goes
# on the SERVICE. A CanNotDelete lock prevents deletion, not replacement.
resource "azurerm_management_lock" "apim" {
  name       = "apim-no-delete"
  scope      = module.apim.id
  lock_level = "CanNotDelete"
  notes      = "Deleting the service, or the custom-domain record, strips every custom host name."
}

output "host_names_that_will_not_rotate" {
  value = {
    for k, m in module.custom_domains : k => m.host_names_pinned_to_a_key_vault_version
    if length(m.host_names_pinned_to_a_key_vault_version) > 0
  }
}

output "private_keys_in_state" {
  value = {
    for k, m in module.custom_domains : k => m.host_names_with_an_inline_certificate
    if length(m.host_names_with_an_inline_certificate) > 0
  }
}

output "expiry_calendar" {
  value = { for k, m in module.custom_domains : k => m.certificate_expiry_by_host_name }
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                = "api.contoso.com"
    key_vault_certificate_id = "https://kv-platform.vault.azure.net/secrets/api-contoso-com"
  }]
}

module "public_dns" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-dns-zone.git?ref=v1.0.0"

  name                = "contoso.com"
  resource_group_name = module.rg.name

  cname_records = {
    api = {
      name   = "api"
      record = trimprefix(module.apim.gateway_url, "https://")
    }
  }
}

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-platform-apim"
  location = "eastus2"
}

module "apim_identity" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-user-assigned-identity.git?ref=v1.0.0"

  name                = "id-apim-tls"
  resource_group_name = module.rg.name
  location            = module.rg.location
}

module "vault" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-key-vault.git?ref=v1.0.0"

  name                = "kv-platform-tls"
  resource_group_name = module.rg.name
  location            = module.rg.location
  tenant_id           = var.tenant_id
}

# The identity must be able to read the secret before any host name is created.
module "vault_roles" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.vault.id

  role_assignments = {
    apim_reads_tls_secret = {
      role_definition_name = "Key Vault Secrets User"
      principal_id         = module.apim_identity.principal_id
    }
  }
}

module "apim" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management.git?ref=v1.0.0"

  name                = "apim-platform-prod"
  resource_group_name = module.rg.name
  location            = module.rg.location
  publisher_name      = "Platform Engineering"
  publisher_email     = "platform-engineering@example.com"
  sku_name            = "Developer_1"

  identity = {
    type         = "UserAssigned"
    identity_ids = [module.apim_identity.id]
  }

  # Host names are owned by the custom-domain module below, so this block is
  # deliberately left unset. Setting both makes each apply revert the other.
}

module "custom_domain" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-api-management-custom-domain.git?ref=v1.0.0"

  api_management_id = module.apim.id

  gateway = [{
    host_name                       = "api.contoso.com"
    key_vault_certificate_id        = "https://${module.vault.name}.vault.azure.net/secrets/api-contoso-com"
    ssl_keyvault_identity_client_id = module.apim_identity.client_id
    default_ssl_binding             = true
  }]

  developer_portal = [{
    host_name                       = "developer.contoso.com"
    key_vault_certificate_id        = "https://${module.vault.name}.vault.azure.net/secrets/developer-contoso-com"
    ssl_keyvault_identity_client_id = module.apim_identity.client_id
  }]
}

module "public_dns" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-dns-zone.git?ref=v1.0.0"

  name                = "contoso.com"
  resource_group_name = module.rg.name

  cname_records = {
    api = {
      name   = "api"
      record = trimprefix(module.apim.gateway_url, "https://")
    }
    developer = {
      name   = "developer"
      record = trimprefix(module.apim.developer_portal_url, "https://")
    }
  }
}

api_management_id = string   # force-new; the SERVICE id, not its name, and not this record's own id

# All five endpoints share this entry shape; only `gateway` adds default_ssl_binding.
gateway = optional(list(object({
  host_name                       = string             # bare DNS name, no scheme and no port
  key_vault_certificate_id        = optional(string)   # data-plane URL; omit the version to follow the vault
  certificate                     = optional(string)   # sensitive at the provider; base64 PFX
  certificate_password            = optional(string)   # sensitive at the provider
  negotiate_client_certificate    = optional(bool, false)
  ssl_keyvault_identity_client_id = optional(string)   # GUID; null selects the system-assigned identity
  default_ssl_binding             = optional(bool)     # gateway only; Computed, so Azure decides when unset
})), [])

portal           = optional(list(object({ ... })), [])   # same shape, no default_ssl_binding
developer_portal = optional(list(object({ ... })), [])
management       = optional(list(object({ ... })), [])
scm              = optional(list(object({ ... })), [])

timeouts = optional(object({ create, read, update, delete }))

No certificate material is emitted. Expiry, subject and thumbprint are public metadata and deliberately not marked sensitive — redacting them would break plan review while protecting nothing.

This is not an ordinary child resource. There is no Azure object called a custom domain. The provider builds a Resource ID ending in the literal default and uses it to address the parent service's hostnameConfigurations property. Everything unusual about the resource follows from that: it is a singleton, it is authoritative, it needs service/write rather than a narrower permission, and it collides with anything else that writes the same property.

Authoritative means what it says. Every apply reads the whole service, replaces the entire hostname array with what is configured here, and writes the service back. There is no merge and no partial update. A host name added by hand between applies is removed by the next one, silently and without appearing as a change to anything but this resource.

Destroy is wider than the resource. The delete path sets hostnameConfigurations to null on the whole service — not only the entries this record created. Anything added by a script, by hand, or by the api-management module's own hostname_configuration block goes with it, and a destroy plan shows one resource being removed. Where that matters, put a CanNotDelete management lock on the service; a lifecycle block cannot be added to a module call.

Do not manage host names in two places. The api-management module writes the same property. Two owners means each apply reverts the other, both plans look correct in isolation, and the symptom is a host name that keeps disappearing.

Slowness here is structural, not a symptom. Every write waits for the service to report Succeeded six consecutive times at one-minute intervals — before the write and again after — and delete does the same. Twelve minutes is a normal apply. That is why the provider's timeouts here are 60 minutes and why shortening them is the wrong instinct.

The two certificate sources are not exclusive in code. The documentation calls them mutually exclusive; the schema declares no ConflictsWith, and the expand function sends both when both are set. This module reports the combination rather than refusing it, because the provider accepts it and a validation failure would block terraform destroy as well as apply.

One field is deliberately missing. The 4.x line still carries a deprecated key_vault_id on every entry. It maps to the same wire property as key_vault_certificate_id, overrides it when both are set, and is removed in the next major line. There is no configuration it makes possible, so this module does not accept it.

Configuring a host name does not publish it. No DNS record is created here. Until a CNAME or A record points at the service, the host name is configured, the certificate is valid, the apply succeeded, and nothing arrives.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module by immutable tag — ?ref=v1.0.0 — never a branch. This module is plan-only from the library's point of view: a human applies from CI against a reviewed plan. Budget the pipeline timeout generously; see an_apply_here_takes_minutes_by_construction.

Where each check actually fires, which is not one answer. Run from this module's own directory as the Runbook does, terraform validate evaluates no variables at all and therefore fires none of the checks below; it proves the configuration parses and is type-correct, and nothing more. On a calling configuration that supplies values, it fires the single-variable checks: the service-ID shape (including the mistake of passing this record's own /default ID) and, per entry, the host-name shape, the base64 and PEM checks on an inline certificate, the Key Vault identifier shape and the identity GUID. The at-least-one-endpoint rule is the exception: its condition reads all five endpoint variables, and Terraform skips a cross-variable condition at validate, so that one fires during variable evaluation at plan.

terraform console -no-color -var-file=<file> with an immediate end-of-input fires every one of them, including the cross-variable rule, and needs no credentials -- which is what makes it the harness to use here, since terraform plan against this provider does not run without them. Drive both a fully populated and a minimal fixture: a fully populated one is what catches a check that is wrong in the accepting direction, and Terraform skips a validation whose referenced variable has already failed, so a short error list is not proof a check is missing.

What only a real plan or apply reaches: whether the service exists, whether the SKU offers the endpoint, whether the identity can read the vault, and whether the certificate is genuinely a PFX. What nothing reaches, at any stage: whether the certificate covers the host name, whether DNS resolves it, and what else was on the service's hostname array before this configuration replaced it.

id                                    = ".../providers/Microsoft.ApiManagement/service/apim-platform-prod/customDomains/default"
api_management_id                     = ".../providers/Microsoft.ApiManagement/service/apim-platform-prod"
api_management_name                   = "apim-platform-prod"
resource_group_name                   = "rg-platform-apim"
gateway_host_names                    = ["api.contoso.com"]
developer_portal_host_names           = ["developer.contoso.com"]
all_host_names                        = [
  "api.contoso.com",
  "developer.contoso.com",
]
host_name_count_by_endpoint           = {
  "developer_portal" = 1
  "gateway"          = 1
  "management"       = 0
  "portal"           = 0
  "scm"              = 0
}
certificate_expiry_by_host_name       = {
  "api.contoso.com"       = "2027-04-18T23:59:59Z"
  "developer.contoso.com" = "2027-04-18T23:59:59Z"
}
default_ssl_binding_host_names        = ["api.contoso.com"]
host_names_using_key_vault            = [
  "api.contoso.com",
  "developer.contoso.com",
]
host_names_with_an_inline_certificate = []
host_names_pinned_to_a_key_vault_version = []
force_new_fields                      = ["api_management_id"]
destroying_this_removes_all_custom_host_names = true

• azurerm_api_management_custom_domain — provider resource reference
• Configure a custom domain name for Azure API Management — endpoints, certificates and DNS requirements
• Use managed identities in Azure API Management — the identity that reads a Key Vault certificate
• Sibling modules: terraform-azurerm-api-management, terraform-azurerm-api-management-certificate, terraform-azurerm-api-management-gateway, terraform-azurerm-key-vault, terraform-azurerm-user-assigned-identity, terraform-azurerm-role-assignments, terraform-azurerm-dns-zone
• This module's SCOPE.md — the cross-module contract, permissions and prerequisites

💙 "Infrastructure as Code should be standardized, consistent, and secure."