☁️ Azure Application Insights Workbook Template Terraform Module

Publishes a workbook template into an Azure Monitor gallery — a starting point colleagues instantiate, not a dashboard they share. Targets hashicorp/azurerm ~> 4.0.

• ☁️ Creates one azurerm_application_insights_workbook_template (the keystone this) — a gallery entry under microsoft.insights/workbooktemplates.
• 🔴 Draws the line that makes this resource easy to reach for by mistake: a template is instantiated and copied, a workbook is shared. Editing a template never changes copies already taken from it.
• 🗂️ Takes galleries as a keyed map — at least one is required, because a template with no gallery is published and invisible.
• 🔍 Reports embedded Resource IDs in the template content, which Microsoft documents as a common side effect of exporting workbook JSON — surfaced as a list, not rejected.
• ⚠️ States plainly that template_data is checked for JSON parseability and nothing more; the workbook content schema is not published in an enforceable form.

💡 Why it matters: a template is the low-risk way to share a diagnostic view — republishing it cannot break a dashboard someone is relying on. The trade-off is that a fix reaches only future users, and nothing tells you who already holds a copy.

If this module saves you time:

• ⭐ Star the repository — it helps others find it.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart TB
  rg["terraform-azurerm-resource-group"]
  mod["terraform-azurerm-application-insights-workbook-template"]
  entry["A gallery ENTRY, browsable by anyone with read access"]
  user["A colleague opens it and saves their OWN copy"]
  copy["An independent workbook, no longer linked to the template"]
  sib["terraform-azurerm-application-insights-workbook  a saved instance, takes data_json and source_id"]
  ai["Application Insights components  gallery resource_type microsoft.insights/components"]
  law["Log Analytics workspaces  gallery resource_type microsoft.operationalinsights/workspaces"]

  rg -->|"name and location"| mod
  mod -->|"publishes"| entry
  entry -->|"offered against"| ai
  entry -->|"offered against"| law
  entry -->|"instantiated by"| user
  user -->|"produces"| copy
  copy -.->|"editing the template does NOT update this"| mod

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef keystone fill:#004578,stroke:#00243c,color:#ffffff;
  classDef neutral fill:#F3F2F1,stroke:#8A8886,color:#201F1E;
  class mod this;
  class entry keystone;
  class rg,user,copy,sib,ai,law neutral;

The dotted edge is the one worth studying: a copy someone has saved is not linked back to the template. That is the whole difference between this module and terraform-azurerm-application-insights-workbook, and it is a property of the service rather than of the module.

flowchart TB
  inputs["name, resource_group_name, location  all force-new"]
  td["template_data  the Gallery Template JSON, parsed but never schema-checked"]
  gal["galleries  a keyed MAP, at least one required"]
  meta["author, localized, priority  optional"]
  tags["tags  in-place"]

  res["azurerm_application_insights_workbook_template.this"]

  oid["id  microsoft.insights/workbooktemplates"]
  ogal["gallery_count, gallery_names, gallery_categories  derived"]
  odisc["template_data_embeds_resource_ids  plus the subscription and resource group lists"]
  onote["a_template_is_a_gallery_entry_not_a_workbook"]

  inputs --> res
  td --> res
  gal --> res
  meta --> res
  tags --> res
  res --> oid
  res --> ogal
  td -->|"scanned for embedded resource IDs"| odisc
  res --> onote

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef neutral fill:#F3F2F1,stroke:#8A8886,color:#201F1E;
  class res this;
  class inputs,td,gal,meta,tags,oid,ogal,odisc,onote neutral;

Nine arguments plus timeouts. The galleries block is a list in the provider's schema and is exposed here as a keyed map.

Schema notes that bite:

• 🔴 A template is not a workbook. Different ARM type, different schema, different lifecycle. This resource has no display_name, no source_id and no identity; the workbook resource has all three and takes data_json rather than template_data.
• 🔴 galleries has a provider-enforced minimum of one. A template with none is accepted by the type system and rejected by the provider.
• 🔴 template_data is an opaque string to Azure. It is not compiled or schema-checked on the way in, so a document that applies cleanly can still render as an empty workbook.
• 🔴 Exported workbook JSON commonly embeds subscription IDs and resource group names. Microsoft documents this. It makes a template non-portable and discloses more than its author usually intends.
• ⚠️ Use the Advanced Editor's Gallery Template tab, not its ARM Template tab. The two emit different JSON, and only the first belongs in template_data.
• ⚠️ priority and a gallery's order are different fields, and order is the documented one for position within a category. Lower is earlier in both.
• ⚠️ Force-new: name, resource_group_name, location.
• ⚠️ All four timeouts exist. A misspelled timeouts key is still discarded silently by object conversion.
• ⚠️ lifecycle is not valid inside a module block, so a caller cannot add prevent_destroy.

ℹ️ The audience for a published template is wider than the identity that published it. Anyone with Reader on a resource of the matching resource_type sees the gallery entry — which is what makes the embedded-Resource-ID question in Architecture Notes a disclosure question rather than a tidiness one.

🔒 Nothing here is a credential, and nothing is marked sensitive. template_data is configuration; the concern it raises is information disclosure, not secret leakage.

• A resource group to hold the template record.
• microsoft.insights registered in the subscription.
• The workbook content, taken from the Advanced Editor's Gallery Template tab.
• At least one gallery decided: its category, and the resource_type whose gallery it belongs to.
• The caller configures the provider "azurerm" { features {} } block, auth, and subscription; this module declares none of these.

terraform-azurerm-application-insights-workbook-template/
├── providers.tf     # required_version + pinned azurerm; no provider block
├── variables.tf     # 10 inputs, 19 validations
├── main.tf          # the keystone `this` + the content-scanning locals
├── outputs.tf       # id first, then what the module cannot verify
├── README.md        # this file
├── SCOPE.md         # the cross-module contract
├── LICENSE          # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "workbook_template" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights-workbook-template.git?ref=v1.0.0"

  name                = "wbt-latency-triage"
  resource_group_name = module.rg.name
  location            = "eastus2"

  template_data = file("${path.module}/templates/latency-triage.json")

  galleries = {
    failures = {
      category      = "Failures"
      name          = "Latency Triage"
      resource_type = "microsoft.insights/components"
      type          = "tsg"
    }
  }

  tags = { environment = "prod" }
}

💡 file(...) rather than a heredoc. Workbook JSON is long, and keeping it as a .json file on disk keeps it reviewable — and avoids Terraform interpolating a literal ${...} that happens to appear inside the document.

Consumes

Emits

module "workbook_template" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights-workbook-template.git?ref=v1.0.0"

  name                = "wbt-basic"
  resource_group_name = module.rg.name
  location            = "eastus2"

  template_data = jsonencode({
    version = "Notebook/1.0"
    items = [{
      type    = 1
      content = { json = "## Latency triage\n\nStart here." }
      name    = "text - 0"
    }]
    styleSettings = {}
  })

  galleries = {
    failures = { category = "Failures" }
  }
}

module "workbook_template" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights-workbook-template.git?ref=v1.0.0"

  name                = "wbt-latency-triage"
  resource_group_name = module.rg.name
  location            = "eastus2"

  template_data = file("${path.module}/templates/latency-triage.json")

  galleries = {
    failures = { category = "Failures", name = "Latency Triage" }
  }
}

galleries = {
  ai_tsg = {
    category      = "Failures"
    name          = "Latency Triage"
    order         = 100
    resource_type = "microsoft.insights/components"
    type          = "tsg"
  }
  law_workbook = {
    category      = "Failures"
    name          = "Latency Triage"
    order         = 100
    resource_type = "microsoft.operationalinsights/workspaces"
    type          = "workbook"
  }
}

galleries = {
  # A diagnostic runbook belongs under Troubleshooting Guides.
  tsg = { category = "Failures", type = "tsg" }
}

# Rejected -- differs from a documented value only by case.
galleries = { g = { category = "Failures", type = "Workbook" } }

# Rejected -- same reason.
galleries = { g = { category = "Failures", type = "TSG" } }

# ACCEPTED -- unrecognised, so possibly a value Microsoft has added since.
galleries = { g = { category = "Failures", type = "somethingnew" } }

output "review_before_publishing" {
  value = {
    embeds          = module.workbook_template.template_data_embeds_resource_ids
    subscriptions   = module.workbook_template.template_data_embedded_subscription_ids
    resource_groups = module.workbook_template.template_data_embedded_resource_group_names
  }
}

review_before_publishing = {
  "embeds" = true
  "resource_groups" = ["rg-prod-obs", "rg-dev-obs"]
  "subscriptions" = [
    "11111111-1111-1111-1111-111111111111",
    "22222222-2222-2222-2222-222222222222",
  ]
}

module "workbook_template" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights-workbook-template.git?ref=v1.0.0"

  name                = "wbt-portable"
  resource_group_name = module.rg.name
  location            = "eastus2"

  # A resource-picker parameter instead of a hard-coded workspace.
  template_data = jsonencode({
    version = "Notebook/1.0"
    items = [
      { type = 9, content = { parameters = [{ name = "Workspace", type = 5 }] }, name = "parameters - 0" },
      { type = 3, content = { query = "requests | summarize count()" }, name = "query - 1" },
    ]
    styleSettings = {}
  })

  galleries = {
    failures = { category = "Failures", name = "Portable Triage" }
  }
}

template_data_embeds_resource_ids = false

# Rejected -- not JSON at all.
template_data = "{not json"

# Rejected -- valid JSON, but the ARM Template tab's shape: no top-level `items`.
template_data = "{\"resources\":[{\"type\":\"microsoft.insights/workbooktemplates\"}]}"

# ACCEPTED -- and may still render as an empty workbook.
template_data = "{\"items\":[]}"

module "workbook_template" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights-workbook-template.git?ref=v1.0.0"

  name                = "wbt-start-here"
  resource_group_name = module.rg.name
  location            = "eastus2"
  template_data       = file("${path.module}/templates/start-here.json")

  # Lower sorts earlier, so this one leads the category.
  priority = 1

  galleries = {
    failures = { category = "Failures", order = 1 }
  }
}

galleries = {
  # `name` supplied -- shown as "Latency Triage".
  failures = { category = "Failures", name = "Latency Triage" }

  # `name` omitted -- shown as "usage_view", which is probably not what you want.
  usage_view = { category = "Usage", type = "usage" }
}

output "check_what_colleagues_will_see" {
  value = module.workbook_template.gallery_names
}

check_what_colleagues_will_see = {
  "failures"   = "Latency Triage"
  "usage_view" = "usage_view"
}

output "which_resource_did_i_want" {
  value = module.workbook_template.a_template_is_a_gallery_entry_not_a_workbook
}

provider "azurerm" {
  features {}
}

variable "location" {
  type    = string
  default = "eastus2"
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-observability"
  location = var.location

  tags = { environment = "prod" }
}

module "law" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-log-analytics-workspace.git?ref=v1.0.0"

  name                = "law-prod"
  resource_group_name = module.rg.name
  location            = var.location
}

module "app_insights" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights.git?ref=v1.0.0"

  name                = "ai-prod"
  resource_group_name = module.rg.name
  location            = var.location
  workspace_id        = module.law.id
}

# A shared, editable dashboard -- one instance everybody opens.
module "live_dashboard" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights-workbook.git?ref=v1.0.0"

  name                = "11111111-2222-3333-4444-555555555555"
  resource_group_name = module.rg.name
  location            = var.location
  display_name        = "Production Service Health"
  data_json           = file("${path.module}/templates/service-health.json")
  source_id           = module.app_insights.id
}

# THIS MODULE: a starting point colleagues each copy. Parameterised, so it is
# portable and discloses no subscription IDs.
module "triage_template" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-application-insights-workbook-template.git?ref=v1.0.0"

  name                = "wbt-latency-triage"
  resource_group_name = module.rg.name
  location            = var.location
  template_data       = file("${path.module}/templates/latency-triage.json")

  author   = "Platform Observability"
  priority = 1

  galleries = {
    ai_tsg = {
      category      = "Failures"
      name          = "Latency Triage"
      order         = 1
      resource_type = "microsoft.insights/components"
      type          = "tsg"
    }
    law_workbook = {
      category      = "Failures"
      name          = "Latency Triage"
      order         = 1
      resource_type = "microsoft.operationalinsights/workspaces"
      type          = "workbook"
    }
  }

  tags = { environment = "prod" }
}

output "publish_review" {
  description = "Check these before anyone browses the gallery."
  value = {
    galleries       = module.triage_template.gallery_names
    embeds_ids      = module.triage_template.template_data_embeds_resource_ids
    subscriptions   = module.triage_template.template_data_embedded_subscription_ids
    content_unproven = module.triage_template.template_data_is_not_validated_against_the_workbook_schema
  }
}

variable "name" { type = string }
variable "resource_group_name" { type = string }
variable "location" { type = string }

# Checked for JSON parseability and a top-level `items` array. Nothing more is
# checkable -- the workbook content schema is not published.
variable "template_data" { type = string }

variable "galleries" {
  type = map(object({
    category      = string
    name          = optional(string) # defaults to the map key
    order         = optional(number)
    resource_type = optional(string)
    type          = optional(string) # workbook | tsg | usage, near-miss rejected
  }))
}

variable "author" {
  type    = string
  default = null
}

variable "localized" {
  type    = string
  default = null
}

variable "priority" {
  type    = number
  default = null
}

variable "tags" {
  type    = map(string)
  default = {}
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
}

🔒 Nothing is sensitive. Template content is configuration. The concern it raises is disclosure of resource names, not secrets.

A workbook template is a gallery entry, and that single fact drives everything else here. Publishing a template does not create something anyone is looking at — it adds an entry under a category, and a colleague who opens it receives their own independent copy to edit and save. So the ARM type is microsoft.insights/workbooktemplates rather than microsoft.insights/workbooks, there is no source_id naming an owning resource, and the template is offered against every resource of the matching resource_type instead of hanging off one of them.

The lifecycle consequence cuts both ways and neither direction is visible to Terraform. A template is copied at instantiation, not linked: changing template_data updates the gallery entry and leaves every existing copy untouched. That makes a template safe to iterate on — republishing cannot break a dashboard someone depends on, which is the opposite of a shared workbook's risk profile. It also means a fix reaches only future users, and Azure will not tell you how many copies exist or who holds them. If a template shipped a wrong query, correcting it here corrects nobody else's copy, and that has to be announced out of band.

template_data is checked for parseability and nothing more, and saying so precisely matters. The module confirms the string is JSON and carries a top-level items array. There is no offline schema for workbook content: Azure stores the document opaquely and does not compile it on the way in, and the item types, query syntax and parameter bindings inside it are not published in a form Terraform can check. So a template that parses, applies cleanly and renders as an empty workbook is entirely possible. The items check is a heuristic — its own error message says so — and it exists to catch one specific mistake: exporting from the Advanced Editor's ARM Template tab rather than its Gallery Template tab, which wraps the content in a resources array. It catches nothing else, and the only real proof is opening the template from the gallery after apply.

Embedded Resource IDs are reported rather than rejected, and the reasoning is a judgement about who can see the gallery. Microsoft documents that exported workbook JSON often contains fixed resource links carrying subscription IDs, resource group names and full Resource IDs. Pinning a template to a known Log Analytics workspace is sometimes deliberate, so refusing it would reject legitimate input — this module scans for /subscriptions/<guid> and emits both a flag and the actual lists. What makes it worth surfacing is that a gallery entry is visible to everyone with read access on the matching resource type, a wider audience than the workbook's author typically pictures, and an embedded ID also makes the template silently non-portable. This is information disclosure, not secret leakage: a Resource ID is not a credential, nothing is marked sensitive, and the question it raises is whether the template should be parameterised with a resource picker instead. Two distinct subscriptions in one document usually means it was assembled from exports taken in different places.

galleries is a keyed map where the provider has a list, and here that costs nothing. A map makes a duplicate key unrepresentable rather than merely discouraged, and adding or removing one gallery never re-indexes the rest. Normally that trades away ordering; in this case it does not, because display order is carried explicitly by each entry's order field, so the collection's own sequence never mattered. One wrinkle is worth watching: omitting a gallery's name does not leave it unnamed — it defaults to the map key, which is usually a short internal identifier rather than something you want a colleague to read, which is why gallery_names is emitted.

Two different fields control position. A gallery's order decides placement within a category and is the one Microsoft documents; the template's own priority is a separate property. Lower means earlier in both. Where both are available, set order.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module with ?ref=v1.0.0 — never a branch. Plan-only; a human applies from CI.

After the apply — the check no plan can make:

# Confirm the template exists and see its galleries.
az resource show --ids "<template id>" --query "properties.galleries"

Then open Azure Monitor → Workbooks (or the Troubleshooting Guides gallery for tsg), find the entry under its category, and open it. That is the only way to know the content renders.

What the offline gate proves: that the configuration parses against the pinned provider, that formatting is canonical, and — via terraform console with variables files — that all 19 validations fire on the input each targets. None of them references another variable, so validation suppression is not a factor here and a single group would have sufficed; they were split by intent instead.

Proved with a failing value each: a Resource ID in name and in resource_group_name; both of those empty; location empty, and "East US 2" producing two errors for the space and the casing independently; template_data empty (which fires both the empty check and the JSON check), malformed, and valid-but-without-items; an empty galleries map; a gallery with a blank category, one with a blank name, one with the near-miss type = "Workbook", and one with a Resource ID in resource_type; a whitespace author; a non-JSON localized; and priority = -1.5 producing two errors for the sign and the fraction.

The near-miss rule was proved in both directions: "Workbook" rejected, "somethingnew" accepted.

Every derived value was printed rather than reasoned about, against two shapes of content. With a template embedding two subscriptions: template_data_embeds_resource_ids = true, both GUIDs and both resource group names extracted, gallery_categories correctly deduplicating Failures across two galleries, gallery_count = 3, and gallery_names showing the map key used where name was omitted. With a parameterised template: false and two empty lists.

What only an apply exercises: whether the resource group exists, and whether Azure accepts the document.

What no Terraform run exercises at all: whether the workbook renders, whether its queries return anything, and who has already taken a copy.

Outputs:

a_template_is_a_gallery_entry_not_a_workbook = true
editing_this_template_does_not_change_workbooks_already_created_from_it = true
gallery_categories = [
  "Failures",
]
gallery_count = 2
gallery_names = {
  "ai_tsg" = "Latency Triage"
  "law_workbook" = "Latency Triage"
}
id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-observability/providers/microsoft.insights/workbooktemplates/wbt-latency-triage"
location = "eastus2"
name = "wbt-latency-triage"
resource_group_name = "rg-observability"
tags = {
  "environment" = "prod"
}
template_data_embedded_resource_group_names = []
template_data_embedded_subscription_ids = []
template_data_embeds_resource_ids = false
template_data_is_not_validated_against_the_workbook_schema = true

• azurerm_application_insights_workbook_template provider reference
• Microsoft Learn — Programmatically manage workbooks
• Microsoft Learn — Azure Workbooks overview
• Sibling: terraform-azurerm-application-insights-workbook — a saved workbook instance, taking data_json, display_name and source_id. Choose it when a team should share one view rather than each hold a copy.
• Prerequisite: terraform-azurerm-resource-group — supplies resource_group_name.
• Related: terraform-azurerm-application-insights and terraform-azurerm-log-analytics-workspace — the resource types whose galleries a template is published into.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."