☁️ Azure Data Factory Integration Runtime — Azure (managed) Terraform Module

The managed, serverless compute a Data Factory uses for data flow activities, targeting hashicorp/azurerm ~> 4.0.

• ⚙️ Creates one azurerm_data_factory_integration_runtime_azure — the compute behind data flow activities, provisioned on demand.
• 🧭 location accepts a magic value that is not a region. AutoResolve makes Data Factory pick a region per activity, so the runtime has no fixed place.
• 🔢 core_count is a closed set, not a range — 8, 16, 32, 48, 80, 144, 272. A value like 12 or 64 is refused.
• ⏱️ time_to_live_min defaults to 0, so the cluster is torn down after every activity and the next data flow pays full startup again. Raising it keeps the cluster billed while idle.
• ✅ The provider's one cross-field rule fires at terraform plan and needs credentials. This module checks the same rule at terraform validate — offline.

💡 Why it matters: every argument except the name and the vnet toggle is a cost decision. None of them changes what a pipeline does; all of them change what it costs and how fast it starts.

If this module saved you time:

• ⭐ Star the repository — it is the cheapest signal that this work is worth continuing.
• 💼 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart TB
  RG["terraform-azurerm-resource-group"]
  ADF["terraform-azurerm-data-factory"]
  THIS["terraform-azurerm-data-factory-integration-runtime-azure"]
  SELF["azurerm_data_factory_integration_runtime_self_hosted, its own module"]
  SSIS["azurerm_data_factory_integration_runtime_azure_ssis, its own module"]
  LS["a linked service or activity"]
  FLOW["a data flow activity"]
  CLUSTER["a data flow cluster, provisioned on demand and billed while warm"]

  RG -->|"name"| ADF
  ADF -->|"id"| THIS
  ADF -->|"id"| SELF
  ADF -->|"id"| SSIS
  THIS -->|"name, referenced by NAME and never by id"| LS
  LS -->|"runs on"| FLOW
  FLOW -->|"starts and bills"| CLUSTER
  THIS -->|"no credential of its own"| CLUSTER
  SELF -->|"carries authorization keys a node registers with"| CLUSTER

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff,stroke-width:2px
  classDef keystone fill:#004578,stroke:#00243d,color:#ffffff,stroke-width:2px
  classDef sibling fill:#eef3f8,stroke:#b9c8d8,color:#1b2733
  class THIS this
  class ADF keystone
  class RG,SELF,SSIS,LS,FLOW,CLUSTER sibling

Two edges carry the point: this runtime is referenced by name, never by ID, and it holds no credential of its own — unlike the self-hosted runtime, whose authorization keys let a node register with the factory.

flowchart TB
  subgraph INPUTS["Inputs"]
    NAME["name (force-new)"]
    ADFID["data_factory_id (force-new)"]
    LOC["location (force-new), a region OR the magic value AutoResolve"]
    CLUSTER["compute_type, core_count, time_to_live_min, cleanup_enabled"]
    VNET["virtual_network_enabled (force-new) and the interactive authoring TTL"]
    DESC["description"]
  end

  THIS["azurerm_data_factory_integration_runtime_azure.this"]

  subgraph OUTPUTS["Outputs"]
    ONAME["name, the value linked services reference"]
    OAUTO["location_is_auto_resolve, and the data-residency consequence"]
    OCOST["cluster_stays_warm_and_billed, torn_down_after_every_activity, larger_than_default"]
    OPAIR["the pairing the PROVIDER checks at plan and this module checks at plan"]
    OFN["force_new_fields, which includes a boolean"]
    OFACTS["the constant facts, including no credential of its own"]
  end

  NAME --> THIS
  ADFID --> THIS
  LOC --> THIS
  CLUSTER --> THIS
  VNET --> THIS
  DESC --> THIS

  THIS --> ONAME
  LOC --> OAUTO
  CLUSTER --> OCOST
  VNET --> OPAIR
  VNET --> OFN
  THIS --> OFACTS

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff,stroke-width:2px
  classDef sibling fill:#eef3f8,stroke:#b9c8d8,color:#1b2733
  class THIS this
  class NAME,ADFID,LOC,CLUSTER,VNET,DESC,ONAME,OAUTO,OCOST,OPAIR,OFN,OFACTS sibling

Schema notes that bite — verified against the live provider source, not inferred from the schema:

• 🔴 The interactive-authoring pairing is enforced in a CustomizeDiff. Setting interactive_authoring_time_to_live_in_minutes requires virtual_network_enabled = true, and the provider checks it in a CustomizeDiff — which fires at terraform plan and needs credentials. Both operands are plain arguments, so this module also checks it in a validation {} at terraform validate, offline.
• 🔴 location accepts AutoResolve, which is not a region. An auto-resolve runtime picks a region per activity from the source and sink — so a data-residency requirement is not satisfied merely because the factory is in the right region.
• 🔴 core_count is a CLOSED SET: 8, 16, 32, 48, 80, 144, 272. An intermediate value is refused.
• 🔴 virtual_network_enabled is FORCE-NEW. It reads like a toggle and is a rebuild; any warm cluster is lost.
• ⚠️ compute_type is case-sensitive, one of General, ComputeOptimized, MemoryOptimized, defaulting to General.
• ⚠️ time_to_live_min defaults to 0. Non-zero keeps the cluster warm and billed whether or not work arrives.
• ⚠️ cleanup_enabled = false with time_to_live_min = 0 is accepted and close to meaningless.
• ⚠️ Setting the interactive TTL at all enables the feature — there is no separate switch.
• ⚠️ Timeouts default to 30m / 5m / 30m / 30m and bound Terraform's management of the record, not cluster startup or activity duration.
• ℹ️ The requires-import error names this resource correctly.

🔒 This runtime holds no credential of its own. It runs under the factory's identity and whatever the linked services carry, so nothing on this resource is secret and no output is sensitive. That is not true of the self-hosted runtime.

💰 Creating this resource provisions no cluster and starts no billing. Charges begin when a data flow activity runs, and continue for time_to_live_min afterwards.

⚠️ Delete is the operation to review. Linked services and activities select a runtime by name, and nothing points back from the runtime to them.

• An existing Data Factory, and its Resource ID.
• A decision about location: a real Azure region, or AutoResolve. They are different modes, not a value and a default.
• If interactive authoring is wanted, virtual_network_enabled = true.
• The Microsoft.DataFactory resource provider registered in the subscription.

terraform-azurerm-data-factory-integration-runtime-azure/
├── providers.tf    # required_version + the pinned azurerm; no provider block
├── variables.tf    # 11 typed inputs, 10 validations
├── main.tf         # the keystone, the cost-shaped locals, one dynamic block
├── outputs.tf      # 39 outputs; id first
├── README.md       # this file
├── SCOPE.md        # the cross-module contract
├── LICENSE         # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "data_flow_runtime" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-dataflow"
  data_factory_id = var.data_factory_id
  location        = "eastus"
}

ℹ️ The empty call gives you an 8-core General cluster with no warm window — cheap, and slow to start.

Consumes

Emits (selected — 39 in total)

module "runtime" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-dataflow"
  data_factory_id = var.data_factory_id
  location        = "eastus"
}

module "auto" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-autoresolve"
  data_factory_id = var.data_factory_id
  location        = "AutoResolve"
}

output "has_a_fixed_region" {
  value = !module.auto.location_is_auto_resolve # false
}

module "eu_only" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-eu"
  data_factory_id = var.data_factory_id
  location        = var.runtime_location
}

check "compute_has_a_fixed_region" {
  assert {
    condition     = !module.eu_only.location_is_auto_resolve
    error_message = "An auto-resolve runtime chooses a region per activity; it cannot satisfy a residency requirement."
  }
}

# ❌ NOT ACCEPTED — core_count is a closed set, not a range
module "wrong_size" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-wrong"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  core_count = 64 # 48 and 80 are legal; 64 is not
}

module "warm" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-warm"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  time_to_live_min = 15
}

output "billing_shape" {
  value = {
    warm_and_billed = module.warm.cluster_stays_warm_and_billed          # true
    torn_down       = module.warm.cluster_is_torn_down_after_every_activity # false
  }
}

module "meaningless" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-odd"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  cleanup_enabled  = false
  time_to_live_min = 0 # the provider's default
}

output "reported" {
  value = module.meaningless.cleanup_disabled_with_no_time_to_live # true
}

module "memory_heavy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-memory"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  compute_type     = "MemoryOptimized"
  core_count       = 48
  time_to_live_min = 10
}

check "cost_shape_is_intentional" {
  assert {
    condition     = module.memory_heavy.is_larger_than_the_default_cluster
    error_message = "Expected a larger-than-default cluster for this workload."
  }
}

# ❌ NOT ACCEPTED — the set is case-sensitive
module "wrong_case" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-wrong-case"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  compute_type = "general" # wants "General"
}

# ❌ NOT ACCEPTED — and refused at `terraform plan`, offline and without credentials
module "interactive_without_vnet" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-interactive"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  interactive_authoring_time_to_live_in_minutes = 30
  # virtual_network_enabled left at false
}

module "interactive" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-interactive"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  virtual_network_enabled                       = true
  interactive_authoring_time_to_live_in_minutes = 30 # 10, 30, 60 or 120
}

output "interactive_on" {
  value = module.interactive.interactive_authoring_enabled # true
}

module "runtime" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-dataflow"          # changing this REPLACES
  data_factory_id = var.data_factory_id    # changing this REPLACES
  location        = "eastus"               # changing this REPLACES
  virtual_network_enabled = true           # changing this ALSO REPLACES

  core_count = 16                          # changing this updates IN PLACE
}

output "what_forces_replacement" {
  value = module.runtime.force_new_fields
  # ["name", "data_factory_id", "location", "virtual_network_enabled"]
}

locals {
  runtimes = {
    small = { cores = 8, ttl = 0 }
    large = { cores = 48, ttl = 15 }
  }
}

module "runtimes" {
  for_each = local.runtimes

  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name             = "ir-${each.key}"
  data_factory_id  = var.data_factory_id
  location         = "eastus"
  core_count       = each.value.cores
  time_to_live_min = each.value.ttl
}

output "warm_runtimes" {
  value = [for k, m in module.runtimes : k if m.cluster_stays_warm_and_billed]
}

module "runtime" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-dataflow"
  data_factory_id = var.data_factory_id
  location        = "eastus"

  timeouts = {
    create = "45m"
    read   = "10m"
    update = "45m"
    delete = "45m"
  }
}

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-analytics-eastus"
  location = "eastus"
}

module "adf" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory.git?ref=v1.0.0"

  name                = "adf-analytics-eastus"
  resource_group_name = module.rg.name
  location            = module.rg.location

  managed_virtual_network_enabled = true

  identity = {
    type = "SystemAssigned"
  }
}

module "runtime" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-azure.git?ref=v1.0.0"

  name            = "ir-dataflow"
  data_factory_id = module.adf.id
  location        = module.rg.location # a real region, not AutoResolve

  compute_type     = "General"
  core_count       = 16
  time_to_live_min = 10

  virtual_network_enabled                       = true
  interactive_authoring_time_to_live_in_minutes = 30

  description = "Data flow compute for the curated pipelines."
}

check "runtime_is_what_we_intended" {
  assert {
    condition     = !module.runtime.location_is_auto_resolve
    error_message = "Compute must have a fixed region for this workload."
  }
  assert {
    condition     = module.runtime.cluster_stays_warm_and_billed
    error_message = "Expected a warm cluster; a TTL of 0 makes every data flow pay full startup."
  }
}

output "runtime_name" {
  value = module.runtime.name # linked services reference this, NOT the id
}

Required: name, data_factory_id, location. The cluster: compute_type, core_count, time_to_live_min, cleanup_enabled. The managed vnet: virtual_network_enabled, interactive_authoring_time_to_live_in_minutes. Metadata: description, timeouts. There is no tags variable — the resource supports none.

No output is sensitive, and none can be — every argument is a name, a size or a duration.

A cross-field rule moved from plan-time to validate-time. Interactive authoring requires virtual_network_enabled = true, and the provider enforces that in a CustomizeDiff — which is evaluated inside the provider and therefore needs credentials and a round trip. Both operands are plain top-level arguments, so this module also checks the pairing in a validation {}. Both refusals land at terraform plan, but this one is decided from the configuration alone — no credentials, no round trip. The check is placed on virtual_network_enabled and reads the other one-directionally, because a validation condition must reference its own variable and two variables validating each other is rejected as a cycle. The provider's check remains the authority; this one arrives earlier, and somewhere a caller without a subscription can reach — which is also the only place the improvement is demonstrable, and where the harness proves it.

location may not be a place. AutoResolve is a distinct mode, not a default: Data Factory chooses where each activity runs based on its source and sink. A data-residency requirement is therefore not satisfied by placing the factory correctly. The module reports the mode rather than refusing it, because auto-resolve is legitimate and common — and it does not validate against a region list, because the set of regions changes and a failing validation would block terraform destroy as well as apply. The report is case-insensitive and says so: this module has not verified whether Azure treats the magic value case-sensitively, so it does not claim either way.

Almost everything else is cost. compute_type and core_count select the VM family and size; time_to_live_min decides how long the cluster stays warm — and billed — after an activity finishes. The provider's default of 0 is the cheap, slow end: every data flow pays full cluster startup, typically several minutes. None of these arguments changes what a pipeline does. The module emits each consequence as a derived flag because none of them is visible in a plan.

One boolean is a rebuild. virtual_network_enabled is force-new. Moving an existing runtime into or out of the managed virtual network destroys and recreates it, losing any warm cluster — and it looks exactly like an in-place toggle.

References are by name. Linked services and activities select an integration runtime by name, not by Resource ID. So name is the output a composition consumes, the ID is for imports and RBAC scoping, and renaming the runtime breaks every reference — silently, in configuration this module cannot see.

lifecycle is not valid inside a module block, so a caller cannot add prevent_destroy. A CanNotDelete lock prevents deletion but not the replacement that editing name, location or virtual_network_enabled would cause.

🔒 There is no security toggle to close here: the resource holds no credential. The exposures are the delete, the silent rename, and the bill — the module documents the first two and reports the third.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module with ?ref=v1.0.0 — never a branch. This library is plan-only: a human applies from CI.

terraform plan and the module's own validation {} blocks cover, offline and without credentials:

• the interactive-authoring pairing — the rule the provider checks only inside a CustomizeDiff that needs credentials, refused here in both its failing forms (TTL with the flag unset, and TTL with the flag explicitly false);
• every legal core_count accepted and the intermediate values 12, 64 and 0 refused;
• every legal compute_type accepted and a lowercase one refused;
• all four interactive TTLs accepted when correctly paired, and 45 refused;
• AutoResolve accepted in both casings, alongside a real region;
• every derived flag — the warm/torn-down pair, cleanup_disabled_with_no_time_to_live, interactive_authoring_enabled, location_is_auto_resolve — each with one fixture per branch through terraform console;
• structural assertions that every output this README promises is actually declared.

⚠️ terraform validate reaches none of that through a module call. Validate evaluates no module variable values, so this module's validation {} blocks are never reached and it reports success. The refusals above land at plan — still offline and without credentials.

Only a real apply can tell you whether the factory has a managed virtual network, what a cluster actually costs, or what currently references the runtime by name.

runtime_name = "ir-dataflow"

id                                    = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-analytics-eastus/providers/Microsoft.DataFactory/factories/adf-analytics-eastus/integrationruntimes/ir-dataflow"
location                              = "eastus"
location_is_auto_resolve              = false
compute_type                          = "General"
core_count                            = 16
time_to_live_min                      = 10
cluster_stays_warm_and_billed         = true
cluster_is_torn_down_after_every_activity = false
is_larger_than_the_default_cluster    = true
interactive_authoring_enabled         = true
force_new_fields                      = ["name", "data_factory_id", "location", "virtual_network_enabled"]

• azurerm_data_factory_integration_runtime_azure
• azurerm_data_factory_integration_runtime_self_hosted — carries authorization keys
• Integration runtime concepts
• Data flow performance and cost
• SCOPE.md — this module's cross-module contract
• Sibling modules: terraform-azurerm-data-factory, terraform-azurerm-data-factory-dataset-delimited-text

💙 "Infrastructure as Code should be standardized, consistent, and secure."