☁️ Azure Automation Connection Type Terraform Module

Defines a custom Azure Automation connection type — the field schema a connection is built from. It creates no connection and holds no credentials. Targets hashicorp/azurerm ~> 4.0.

• ☁️ Creates one azurerm_automation_connection_type (the keystone this) — a reusable field schema for connections in one Automation Account.
• 🧬 Takes field as a map keyed by field name, so duplicate names are impossible to express rather than something a validation has to catch.
• 🔴 Every argument is force-new, including the whole field set. This resource has no in-place edit and no update timeout.
• 🔒 Rejects a field whose name says secret while is_encrypted is left false — the one half of that decision a module can see.
• 📋 Emits the field contract (field_names, required_field_names, plaintext_field_names) so a connection can be checked against it, since Terraform cannot.

💡 Why it matters: a connection type is a schema, not a connection. Nothing it creates authenticates to anything — and the connections built on it reference it by a bare string, so the one thing that must never change is its name.

If this module saves you time:

• ⭐ Star the repository — it helps others find it.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart TB
  rg["terraform-azurerm-resource-group"]
  aa["terraform-azurerm-automation-account"]
  mod["terraform-azurerm-automation-connection-type"]
  untyped["terraform-azurerm-automation-connection  the ONLY consumer, via type equals this name"]
  rb["terraform-azurerm-automation-runbook"]
  builtin["Built-in types Azure, AzureClassicCertificate, AzureServicePrincipal"]
  typed["The three typed connection modules  they use the built-in types, never this one"]

  rg -->|"name"| aa
  aa -->|"automation_account_name"| mod
  mod -->|"name as type, a STRING with no dependency edge"| untyped
  untyped -->|"resolved by name at execution time"| rb
  builtin -->|"hard-coded, not defined here"| typed
  typed -->|"resolved by name at execution time"| rb

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef keystone fill:#004578,stroke:#00243c,color:#ffffff;
  classDef neutral fill:#F3F2F1,stroke:#8A8886,color:#201F1E;
  class mod this;
  class aa keystone;
  class rg,untyped,rb,builtin,typed neutral;

This module sits on the producing side of the connection family. The three typed connection modules hard-code Azure's built-in types and never reference this resource; the only module that can consume what this defines is terraform-azurerm-automation-connection, the untyped form, via type = "<this name>" — a string, with no dependency edge for Terraform to see.

flowchart TB
  subgraph inputs["Inputs"]
    n["name  the type string a connection names, force-new"]
    rgn["resource_group_name  force-new"]
    aan["automation_account_name  force-new, by name not id"]
    f["field  map keyed by field name, min 1, force-new"]
    ig["is_global  force-new"]
  end

  res["azurerm_automation_connection_type.this"]

  subgraph outputs["Outputs"]
    onm["name  compose with THIS, not id"]
    ofn["field_names  the contract a connection must satisfy"]
    oreq["required_field_names"]
    oenc["encrypted_field_names"]
    opln["plaintext_field_names  scrutinise this one"]
    ouq["field_types_that_look_like_unqualified_primitives  reported, not rejected"]
    odef["this_defines_a_type_it_does_not_create_a_connection"]
    ofn2["nothing_updates_in_place_every_argument_is_force_new"]
  end

  n --> res
  rgn --> res
  aan --> res
  f --> res
  ig --> res
  res --> onm
  res --> ofn
  res --> oreq
  res --> oenc
  res --> opln
  res --> ouq
  res --> odef
  res --> ofn2

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef neutral fill:#F3F2F1,stroke:#8A8886,color:#201F1E;
  class res this;
  class n,rgn,aan,f,ig,onm,ofn,oreq,oenc,opln,ouq,odef,ofn2 neutral;

Five arguments, all five force-new. The field block is rendered from a keyed map, so the useful outputs describe the schema rather than echoing the inputs.

Schema notes that bite:

• 🔴 Every argument is force-new — name, resource_group_name, automation_account_name, field and is_global. There is no in-place edit at all.
• 🔴 So the field set is a one-time decision. Adding one field replaces the connection type, and connections referencing it by name are left naming nothing during the window.
• 🔴 There is no update timeout, only create, read and delete. A four-key timeouts object silently drops update — object conversion discards undeclared attributes without an error.
• 🔴 field requires at least one entry (the provider sets min = 1).
• 🔴 Connections reference the type by NAME, as a string. No Terraform dependency exists in either direction.
• ⚠️ There is no description argument — unlike all three typed connection resources, which take one. So there is nowhere on this resource to record why it exists.
• ⚠️ No tags attribute either.
• ⚠️ The provider documents is_global as "whether the connection type is global" and nothing more, so this module reports it and declines to describe behaviour it cannot confirm.
• ⚠️ No closed set of field type values is published. Azure Automation conventionally uses .NET type names such as System.String; this module reports suspicious values rather than rejecting them.
• ⚠️ lifecycle is not valid inside a module block, so a caller cannot add prevent_destroy.

🔒 Nothing here is sensitive, because a schema holds no values. This resource declares that a field called ApiSecret exists and should be encrypted; the secret itself only ever lives in a connection built from the type. So an identity that can read this resource learns your field names and nothing more.

⚠️ is_encrypted is a promise about connections, not protection of anything here. It is the flag that decides whether Automation stores a connection's value for that field encrypted — set it correctly at definition time, because the field set cannot be changed afterwards.

• An existing Automation Account, and its name plus resource group. Nothing here can confirm the two agree.
• A settled list of fields, since the set is force-new and connections depend on the type by name.
• A decision per field on is_encrypted, which the module cannot make for you.
• A name that is not one of Azure's built-in types — Azure, AzureClassicCertificate and AzureServicePrincipal are rejected.
• The caller configures the provider "azurerm" { features {} } block, auth, and subscription; this module declares none of these.

terraform-azurerm-automation-connection-type/
├── providers.tf     # required_version + pinned azurerm; no provider block
├── variables.tf     # 6 inputs: name, resource_group_name, automation_account_name,
│                    #           field, is_global, timeouts
├── main.tf          # the keystone `this` + the derived field-schema locals
├── outputs.tf       # id first, then the field contract, then the facts that produce no error
├── README.md        # this file
├── SCOPE.md         # the cross-module contract
├── LICENSE          # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "contoso_api_connection_type" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection-type.git?ref=v1.0.0"

  name                    = "ContosoApi"
  resource_group_name     = "rg-automation-prod"
  automation_account_name = "aa-prod"

  field = {
    ApiEndpoint = { type = "System.String" }
    ApiSecret   = { type = "System.String", is_encrypted = true }
    Retries     = { type = "System.Int32", is_optional = true }
  }
}

💡 The map key is the field name, which is how a runbook addresses it — $Conn.ApiEndpoint.

⚠️ Get the field set right first time. It is force-new, and replacing the type breaks every connection that names it.

Consumes

Emits

module "connection_type" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection-type.git?ref=v1.0.0"

  name                    = "ContosoApi"
  resource_group_name     = "rg-automation-prod"
  automation_account_name = "aa-prod"

  field = {
    ApiEndpoint = { type = "System.String" }
  }
}

module "connection_type" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection-type.git?ref=v1.0.0"

  name                    = "ContosoApi"
  resource_group_name     = "rg-automation-prod"
  automation_account_name = "aa-prod"

  field = {
    ApiEndpoint = { type = "System.String" }
    ApiSecret   = { type = "System.String", is_encrypted = true }
    Retries     = { type = "System.Int32", is_optional = true }
  }
}

output "connection_must_supply" {
  value = module.connection_type.required_field_names
}

output "connection_may_supply" {
  value = module.connection_type.optional_field_names
}

output "stored_encrypted" {
  value = module.connection_type.encrypted_field_names
}

output "stored_in_the_clear" {
  value = module.connection_type.plaintext_field_names
}

connection_must_supply = ["ApiEndpoint", "ApiSecret"]
connection_may_supply  = ["Retries"]
stored_encrypted       = ["ApiSecret"]
stored_in_the_clear    = ["ApiEndpoint", "Retries"]

# Rejected — the name says secret, the flag says plaintext.
field = {
  ApiSecret = { type = "System.String" }
}

# Accepted.
field = {
  ApiSecret = { type = "System.String", is_encrypted = true }
}

# Accepted — and reported, because Azure Automation conventionally uses .NET type names.
field = {
  ApiEndpoint = { type = "string" }
  Port        = { type = "int" }
}

output "worth_one_look" {
  value = module.connection_type.field_types_that_look_like_unqualified_primitives
}

worth_one_look = ["int", "string"]

# Rejected — Azure's own built-in connection type names.
name = "Azure"
name = "AzureClassicCertificate"
name = "AzureServicePrincipal"

# Rejected — a Resource ID.
name = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg"

# Accepted.
name = "ContosoApi"

# Rejected — no fields at all.
field = {}

# Rejected — an empty map key. The key IS the field name.
field = { "" = { type = "System.String" } }

# Rejected — a field name with a space cannot be read as $Conn.<name>.
field = { "Api Endpoint" = { type = "System.String" } }

# Rejected — an empty type, and a type that is a Resource ID.
field = { ApiEndpoint = { type = "" } }
field = { ApiEndpoint = { type = "/subscriptions/x" } }

# Accepted.
field = { ApiEndpoint = { type = "System.String" } }

# This module's shape: uniqueness by construction.
field = {
  ApiEndpoint = { type = "System.String" }
  ApiSecret   = { type = "System.String", is_encrypted = true }
}

dynamic "field" {
  for_each = var.field
  content {
    name         = field.key
    type         = field.value.type
    is_encrypted = field.value.is_encrypted
    is_optional  = field.value.is_optional
  }
}

module "connection_type" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection-type.git?ref=v1.0.0"

  name                    = "ContosoApi"
  resource_group_name     = "rg-automation-prod"
  automation_account_name = "aa-prod"

  # Adding ONE field here REPLACES the connection type.
  field = {
    ApiEndpoint = { type = "System.String" }
    ApiSecret   = { type = "System.String", is_encrypted = true }
    ApiVersion  = { type = "System.String" } # <-- this is a destroy and create
  }
}

output "read_before_editing_fields" {
  value = module.connection_type.nothing_updates_in_place_every_argument_is_force_new
}

module "connection_type" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection-type.git?ref=v1.0.0"

  name                    = "ContosoApi"
  resource_group_name     = "rg-automation-prod"
  automation_account_name = "aa-prod"

  field = {
    ApiEndpoint = { type = "System.String" }
  }
}

# `lifecycle` is not valid inside a `module` block, so `prevent_destroy` is
# unavailable to a caller. A lock on the parent account is the route that works.
resource "azurerm_management_lock" "automation_account" {
  name       = "no-delete-automation-assets"
  scope      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-automation-prod/providers/Microsoft.Automation/automationAccounts/aa-prod"
  lock_level = "CanNotDelete"
  notes      = "Connection types are force-new; replacing one breaks the connections that name it."
}

variable "connection_types" {
  type = map(object({
    field = map(object({
      type         = string
      is_encrypted = optional(bool, false)
      is_optional  = optional(bool, false)
    }))
  }))
  default = {}
}

module "connection_type" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection-type.git?ref=v1.0.0"
  for_each = var.connection_types

  name                    = each.key
  resource_group_name     = "rg-automation-prod"
  automation_account_name = "aa-prod"

  field = each.value.field
}

output "type_contracts" {
  description = "What each type's connections must supply."
  value       = { for key, mod in module.connection_type : key => mod.required_field_names }
}

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-automation-prod"
  location = "eastus2"

  tags = { environment = "prod" }
}

# 1 · The Automation Account. Tag here; neither asset below has tags.
module "automation_account" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-account.git?ref=v1.0.0"

  name                = "aa-prod"
  resource_group_name = module.rg.name
  location            = "eastus2"

  tags = { environment = "prod" }
}

# 2 · This module. The schema — no values, no credentials.
module "connection_type" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection-type.git?ref=v1.0.0"

  name                    = "ContosoApi"
  resource_group_name     = module.rg.name
  automation_account_name = module.automation_account.name

  field = {
    ApiEndpoint = { type = "System.String" }
    ApiSecret   = { type = "System.String", is_encrypted = true }
    Retries     = { type = "System.Int32", is_optional = true }
  }
}

# 3 · A connection of that custom type. The untyped module is the ONLY one that
#     can consume a custom type -- the three typed modules cover built-ins only.
module "contoso_api_connection" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-connection.git?ref=v1.0.0"

  name                    = "ContosoApiProd"
  resource_group_name     = module.rg.name
  automation_account_name = module.automation_account.name

  # Wiring the OUTPUT rather than repeating the literal "ContosoApi" is what
  # creates an ordering dependency -- the type has no other link to the connection.
  type = module.connection_type.name

  values = {
    ApiEndpoint = "https://api.contoso.example"
    ApiSecret   = var.contoso_api_secret
    Retries     = "3"
  }
}

# 4 · The runbook that reads it. Note it references the connection by NAME in its
#     own code, so there is no edge here either.
module "sync_runbook" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-automation-runbook.git?ref=v1.0.0"

  name                    = "Invoke-ContosoSync"
  resource_group_name     = module.rg.name
  location                = "eastus2"
  automation_account_name = module.automation_account.name
  runbook_type            = "PowerShell"
}

output "contract_the_connection_must_satisfy" {
  value = module.connection_type.required_field_names
}

output "fields_stored_in_the_clear" {
  value = module.connection_type.plaintext_field_names
}

# Rejects the three built-in type names and a Resource ID.
variable "name" { type = string }

variable "resource_group_name" { type = string }

variable "automation_account_name" { type = string }

# The map key is the field NAME, which makes duplicates impossible to express.
variable "field" {
  type = map(object({
    type         = string
    is_encrypted = optional(bool, false)
    is_optional  = optional(bool, false)
  }))
}

variable "is_global" {
  type    = bool
  default = false
}

# NOTE three keys, not four -- this resource has no update.
variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    delete = optional(string)
  })
  default = null
}

🔒 Nothing is sensitive, because a schema holds no values. is_encrypted is a promise about how a connection's value will be stored, not protection of anything in this resource.

A connection type is a schema, and that is the thing most likely to be misread about it. It declares which fields a connection may carry — names, types, whether each is encrypted or optional — and nothing else. It holds no endpoint, no credential and no value, so creating one connects to nothing and authenticates to nothing. The payoff comes only when a connection is built from it.

It also sits on the opposite side of the family from the three typed connection modules. azurerm_automation_connection_certificate and its two siblings hard-code Azure's built-in types (Azure, AzureClassicCertificate, AzureServicePrincipal) and never reference this resource. The only module in this library that can use a custom type is terraform-azurerm-automation-connection, the untyped form, via type = "<name>". So this module produces what that one consumes, and the three typed modules are unrelated to both.

The link between the two is a bare string, which makes name an interface. A connection names its type; nothing in Terraform expresses that dependency. Renaming this type — or changing any field, since the whole set is force-new — replaces the resource, and the connections built on it keep naming a type that no longer exists, with no plan diff, no warning and no error. It works in reverse too: a connection can name a type that was never created. The practical mitigation is composition rather than validation — pass this module's name output into the connection instead of repeating the literal string, which is the only thing that gives Terraform an ordering edge.

Every argument is force-new, which is unusual enough to state plainly. name, resource_group_name, automation_account_name, field and is_global all replace the resource. There is no in-place edit, which is also why the provider gives it only three timeouts — and that in turn creates the one input this module accepts silently and wrongly: a four-key timeouts object drops update without an error, because object-type conversion discards attributes the type does not declare.

field is typed as a map keyed by field name rather than a list, and the reasoning is worth stating because the provider models it as a repeatable block. Field names must be unique within a connection type. A map makes a duplicate impossible to express, where a list would need a validation to catch one — so the type system does the work instead of an error message. The cost is that map iteration does not preserve the provider's ordering, which is acceptable here because fields are addressed by name in a runbook ($Conn.ApiEndpoint) and never by position, so nothing observable depends on order.

Encryption is a per-field decision the module cannot make, so it validates the detectable half and reports the rest. A connection type routinely mixes credentials with plain identifiers, so defaulting is_encrypted to true would hide identifiers for no benefit and defaulting it to false — the provider's own default — leaves the judgement with the caller. What is detectable is a field whose name says secret while the flag says plaintext, so ApiSecret without is_encrypted = true is rejected with a message admitting it is a name-based guess. Everything else is surfaced through plaintext_field_names, because a field called ConnectionString can carry a credential without announcing it.

Field types are reported rather than rejected, and that is a deliberate limit on validation. Azure Automation conventionally uses .NET type names such as System.String, but the provider publishes no closed set — so a check refusing string might refuse something the API accepts. Rather than invent that constraint, the module emits field_types_that_look_like_unqualified_primitives and leaves the judgement to a reviewer. Where a probable mistake cannot be safely rejected, surfacing it beats blocking it.

There is nowhere on this resource to record why it exists. No tags, and — unlike all three typed connection resources — no description either. Both absences are in the provider's schema rather than in this module, and the consequence is that documentation for a custom connection type has to live outside Azure.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module with ?ref=v1.0.0 — never a branch. Plan-only; a human applies from CI.

After the apply, confirm the contract Terraform cannot check:

# What fields does the type actually declare?
az automation connection-type show \
  --automation-account-name "aa-prod" --resource-group "rg-automation-prod" \
  --name "ContosoApi" --query "fieldDefinitions"

# Do any connections name this type?
az automation connection list \
  --automation-account-name "aa-prod" --resource-group "rg-automation-prod" \
  --query "[?connectionType.name=='ContosoApi'].name"

The second command is the closest thing to a dependency check that exists — Terraform has none.

What the offline gate proves: that the configuration parses against the pinned provider, that formatting is canonical, and — via terraform console with variables files — that every validation {} fires on the input it targets. Proved with a failing value each: a Resource ID in name, resource_group_name and automation_account_name; an empty string in each of those three; a built-in type name in name; an empty field map; an empty map key; an empty field type; a Resource ID as a field type; a field name containing a space; and a secret-named field left unencrypted. Proved as accepted: that same field with is_encrypted = true, and a complete three-field type.

The derived outputs were evaluated rather than assumed. A three-field type produced the expected splits — required = ["ApiEndpoint","ApiSecret"], optional = ["Retries"], encrypted = ["ApiSecret"], plaintext = ["ApiEndpoint","Retries"], types = ["System.Int32","System.String"] — and field_types_that_look_like_unqualified_primitives was empty. A separate case using string and int confirmed the report-not-reject design in both directions: zero validation errors, and ["int","string"] in the report.

What only an apply exercises: whether the Automation Account exists in that resource group, whether Azure accepts the field types, and whether the caller holds Contributor.

What no Terraform run exercises at all: whether any connection names this type, whether a connection's values keys match these fields, and whether the fields left in the clear should have been encrypted.

Outputs:

automation_account_name = "aa-prod"
connections_reference_this_type_by_name_with_no_terraform_dependency = true
encrypted_field_names = [
  "ApiSecret",
]
field_count = 3
field_names = [
  "ApiEndpoint",
  "ApiSecret",
  "Retries",
]
field_types_in_use = [
  "System.Int32",
  "System.String",
]
field_types_that_look_like_unqualified_primitives = []
has_no_encrypted_fields = false
id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-automation-prod/providers/Microsoft.Automation/automationAccounts/aa-prod/connectionTypes/ContosoApi"
is_global = false
name = "ContosoApi"
nothing_updates_in_place_every_argument_is_force_new = true
optional_field_names = [
  "Retries",
]
plaintext_field_names = [
  "ApiEndpoint",
  "Retries",
]
required_field_names = [
  "ApiEndpoint",
  "ApiSecret",
]
resource_group_name = "rg-automation-prod"
this_defines_a_type_it_does_not_create_a_connection = true
this_resource_carries_no_tags = true

• azurerm_automation_connection_type provider reference
• Microsoft Learn — Manage connections in Azure Automation
• Parent: terraform-azurerm-automation-account — supplies automation_account_name.
• terraform-azurerm-automation-connection — the untyped connection module, and the only consumer of a custom type: pass this module's name as its type.
• Sibling: terraform-azurerm-automation-connection-certificate — the built-in Azure type. Hard-codes its type and does not use this resource.
• Sibling: terraform-azurerm-automation-connection-service-principal — the built-in AzureServicePrincipal type, the one member of that trio still targeting Azure Resource Manager.
• Sibling: terraform-azurerm-automation-connection-classic-certificate — the built-in AzureClassicCertificate type.
• Sibling: terraform-azurerm-automation-runbook — reads a connection by name at execution time.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."