☁️ Azure Data Factory Linked Service — SQL Managed Instance Terraform Module

A Data Factory's stored definition of how to reach a SQL Managed Instance, targeting hashicorp/azurerm ~> 4.0.

• 🔌 Creates one azurerm_data_factory_linked_service_sql_managed_instance — the definition a dataset or copy activity uses to reach a SQL Managed Instance.
• 🔀 The only linked service in this family written on the provider's typed SDK — a model struct, one encode call, and no d.Set anywhere. Its import guard derives the resource name, so the wrong-name defect that affects a sibling is impossible here.
• ✅ The service-principal trio is bound mutually — id, key and tenant, all three or none. The Kusto sibling binds its tenant one-directionally and accepts a tenant-less principal.
• 🔴 A password inside an inline connection string cannot be rotated. The read refreshes that field and the shared suppressor strips the password before comparing, so a change produces no diff at all.
• ⚠️ There is no additional_properties argument — unique in this family, and an absence rather than a behaviour.

💡 Why it matters: three of those five are contrasts with siblings, not statements about this resource alone. Nothing about the family transfers here without checking.

If this module saved you time:

• ⭐ Star the repository — it is the cheapest signal that this work is worth continuing.
• 💼 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart TB
  RG["terraform-azurerm-resource-group"]
  ADF["terraform-azurerm-data-factory"]
  THIS["terraform-azurerm-data-factory-linked-service-sql-managed-instance"]
  KV["terraform-azurerm-data-factory-linked-service-key-vault"]
  VNETIR["terraform-azurerm-data-factory-integration-runtime-self-hosted"]
  MI["a SQL Managed Instance, normally inside a virtual network"]
  DS["a dataset, then a copy activity"]

  RG -->|"name"| ADF
  ADF -->|"id"| THIS
  ADF -->|"id"| KV
  KV -->|"name, for the connection string OR the password, independently"| THIS
  VNETIR -->|"name, and usually REQUIRED to reach a managed instance"| THIS
  THIS -->|"connects at pipeline runtime, never at apply"| MI
  THIS -->|"name, referenced BY NAME and never by id"| DS

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff,stroke-width:2px
  classDef keystone fill:#004578,stroke:#00243d,color:#ffffff,stroke-width:2px
  classDef sibling fill:#eef3f8,stroke:#b9c8d8,color:#1b2733
  class THIS this
  class ADF keystone
  class RG,KV,VNETIR,MI,DS sibling

The runtime edge matters more here than elsewhere: a SQL Managed Instance normally lives inside a virtual network, and the factory's default runtime is Microsoft-hosted with no route into one.

flowchart TB
  subgraph INPUTS["Inputs"]
    ID["name and data_factory_id, THE ONLY TWO FORCE-NEW FIELDS"]
    CS["EXACTLY ONE OF: connection_string, key_vault_connection_string"]
    KVP["key_vault_password, INDEPENDENT of that choice"]
    SP["service_principal_id, key and tenant, ALL THREE OR NONE"]
    META["description, integration_runtime_name, parameters, annotations"]
  end

  THIS["azurerm_data_factory_linked_service_sql_managed_instance.this"]

  subgraph OUTPUTS["Outputs"]
    TYPED["this resource uses the TYPED provider SDK, unlike its siblings"]
    IMPORT["the import guard CANNOT name the wrong resource"]
    MUTUAL["the provider binds all three service principal fields MUTUALLY"]
    NOROT["a password inside an inline connection string CANNOT be rotated"]
    ROT["password_is_rotatable, the flag to assert on"]
    NOAP["this resource has NO additional_properties escape hatch"]
  end

  ID --> THIS
  CS --> THIS
  KVP --> THIS
  SP --> THIS
  META --> THIS

  ID --> TYPED
  ID --> IMPORT
  SP --> MUTUAL
  CS --> NOROT
  KVP --> ROT
  META --> NOAP

  classDef this fill:#0078D4,stroke:#004578,color:#ffffff,stroke-width:2px
  classDef sibling fill:#eef3f8,stroke:#b9c8d8,color:#1b2733
  class THIS this
  class ID,CS,KVP,SP,META,TYPED,IMPORT,MUTUAL,NOROT,ROT,NOAP sibling

Schema notes that bite — verified against the live provider source:

• 🔀 The typed SDK. A model struct with tfschema tags, metadata.Encode(&state), and no d.Set calls at all — the only linked service in this family written this way.
• ✅ The requires-import error derives the resource name from r.ResourceType(), so it cannot name the wrong one. Several legacy siblings hardcode a string, and one gets it wrong.
• ✅ A mutual ExactlyOneOf binds connection_string and key_vault_connection_string, so the empty call is refused at terraform plan, offline and without credentials — unusual in this family.
• ✅ The service-principal trio is bound mutually by three RequiredWith declarations: all three or none.
• 🔴 The read refreshes connection_string. With the family's shared diff suppressor stripping the password segment from the configured value, a password inside it cannot be rotated — no diff, no plan, no update.
• ✅ The read never assigns the service principal key, so that one is rotatable, and its drift is invisible.
• ⚠️ No additional_properties argument exists. Every other linked service in the family has one.
• ⚠️ data_factory_id's ForceNew comes from commonschema.ResourceIDReferenceRequiredForceNew, not from the schema block — and the helper library offers a non-force-new variant of the same shape, so a grep for ForceNew alone would miss it.
• ✅ Exactly two Sensitive fields, and they are the two that carry a secret.
• ⚠️ The name validator is nearly inert.
• ℹ️ No CustomizeDiff and no version gate — every provider check is reachable offline.

⚠️ The SQL credential is governed by Azure not at all — whether a SQL login or a service principal, its blast radius is whatever that principal can do inside the instance.

✅ Terraform needs no access to the Key Vault secrets — it stores addresses, not values.

• An existing Data Factory.
• A reachable SQL Managed Instance — and, normally, a self-hosted or managed VNet integration runtime.
• For the Key Vault placements: a Key Vault linked service in the same factory, and the secrets in it.
• For the service-principal mode: an Entra ID application, its secret, its tenant, and a login for that principal inside the instance, which nothing here creates or verifies.

terraform-azurerm-data-factory-linked-service-sql-managed-instance/
├── providers.tf     # required_version + the pinned azurerm; no provider block
├── variables.tf     # 13 variables, 22 validations
├── main.tf          # the keystone, its three dynamic blocks, and the derived locals
├── outputs.tf       # 56 outputs: the id first, then the facts no plan shows
├── README.md        # this file
├── SCOPE.md         # the cross-module contract
├── LICENSE          # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "mi_link" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-linked-service-sql-managed-instance.git?ref=v1.0.0"

  name            = "ls-mi-sales"
  data_factory_id = module.data_factory.id

  # NOTE: no password in here.
  connection_string = "Data Source=mi-corp.public.abc.database.windows.net,3342;Initial Catalog=sales;User ID=svc;"

  key_vault_password = {
    linked_service_name = "ls-keyvault"
    secret_name         = "mi-sales-password"
  }

  integration_runtime_name = "ir-vnet-eastus"
}

🔴 The password is deliberately not in the connection string — put it there and it cannot be rotated.

⚠️ The runtime is named because a managed instance normally sits inside a VNet.

Consumes

Emits

connection_string = "Data Source=mi-corp.public.abc.database.windows.net,3342;Initial Catalog=sales;User ID=svc;"

key_vault_password = {
  linked_service_name = "ls-keyvault"
  secret_name         = "mi-sales-password"
}

connection_string = "Data Source=mi-corp...;User ID=svc;Password=hunter2;"

key_vault_connection_string = {
  linked_service_name = "ls-keyvault"
  secret_name         = "mi-sales-connection-string"
}

service_principal_id  = var.sp_application_id
service_principal_key = var.sp_client_secret
tenant                = var.tenant_id

check "mi_password_is_rotatable" {
  assert {
    condition     = module.mi_link.password_is_rotatable
    error_message = "This linked service has a password inside its connection string; it cannot be rotated."
  }
}

key_vault_connection_string = { linked_service_name = "ls-keyvault", secret_name = "mi-cs" }
key_vault_password          = { linked_service_name = "ls-keyvault", secret_name = "mi-pw" }

connection_string = "Data Source=my-password-host.database.windows.net,3342;Initial Catalog=sales;"
# => password_is_rotatable = true

output "credential" {
  value = {
    placement = module.mi_link.connection_string_placement
    auth      = module.mi_link.auth_mode
    rotatable = module.mi_link.password_is_rotatable
    has_sp_key = module.mi_link.has_service_principal_key
  }
}

output "import_guard" {
  value = module.mi_link.the_import_guard_cannot_name_the_wrong_resource
}

# additional_properties = { ... }   # NOT AVAILABLE on this resource

integration_runtime_name = "ir-vnet-eastus"

description = "Sales MI, read path"
parameters  = { env = "prod" }
annotations = ["owner:data-platform", "tier:gold"]

timeouts = {
  create = "45m"
  read   = "10m"
  update = "45m"
  delete = "45m"
}

# Refused at `terraform plan`, offline and without credentials:
#   neither connection-string placement, or both
#   any PARTIAL service-principal set (id alone, key alone, tenant alone, or any pair)
#   service_principal_id that is not a UUID
#   a Key Vault secret_name given as a full vault URI
#
# NOT refused, and reported instead:
#   a password inside an inline connection string -- which cannot be rotated

provider "azurerm" {
  features {}
}

module "resource_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-data-eastus"
  location = "eastus"
}

module "data_factory" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory.git?ref=v1.0.0"

  name                = "adf-corp-eastus"
  resource_group_name = module.resource_group.name
  location            = module.resource_group.location
}

module "key_vault_link" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-linked-service-key-vault.git?ref=v1.0.0"

  name            = "ls-keyvault"
  data_factory_id = module.data_factory.id
  key_vault_id    = var.key_vault_id
}

module "self_hosted_runtime" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-integration-runtime-self-hosted.git?ref=v1.0.0"

  name            = "ir-vnet-eastus"
  data_factory_id = module.data_factory.id
}

module "mi_link" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-factory-linked-service-sql-managed-instance.git?ref=v1.0.0"

  name              = "ls-mi-sales"
  data_factory_id   = module.data_factory.id
  connection_string = "Data Source=mi-corp.public.abc.database.windows.net,3342;Initial Catalog=sales;User ID=svc;"

  key_vault_password = {
    linked_service_name = module.key_vault_link.name
    secret_name         = "mi-sales-password"
  }

  integration_runtime_name = module.self_hosted_runtime.name

  description = "Sales MI, read path"
  annotations = ["owner:data-platform"]
}

check "mi_password_is_rotatable" {
  assert {
    condition     = module.mi_link.password_is_rotatable
    error_message = "This linked service has a password inside its connection string; it cannot be rotated."
  }
}

output "review" {
  value = {
    linked_service = module.mi_link.name
    placement      = module.mi_link.connection_string_placement
    auth           = module.mi_link.auth_mode
    rotatable      = module.mi_link.password_is_rotatable
    vnet_route     = !module.mi_link.runs_on_the_factory_default_integration_runtime
  }
}

Required: name, data_factory_id, plus exactly one of connection_string and key_vault_connection_string. Optional: key_vault_password, service_principal_id, service_principal_key, tenant, description, integration_runtime_name, parameters, annotations, timeouts. Not available: additional_properties — this resource has none.

variable "connection_string" {
  type      = string
  default   = null
  sensitive = true # marked by the provider too; a password inside it CANNOT be rotated
}

variable "key_vault_password" {
  type = object({
    linked_service_name = string
    secret_name         = string
  })
  default = null # INDEPENDENT of the connection-string ExactlyOneOf
}

variable "service_principal_key" {
  type      = string
  default   = null
  sensitive = true # bound mutually to service_principal_id and tenant
}

No output emits a secret. The full list, with the reasoning behind each constant, is in outputs.tf.

This resource is written differently from every other linked service in the family, and that explains several of its properties. It uses the provider's typed SDK: a model struct with tfschema tags, a read that builds that model and encodes it in a single call, and no d.Set calls at all. Its requires-import error derives the resource name from r.ResourceType() rather than repeating it as a string — so the wrong-resource-name defect that affects the Cosmos DB MongoDB API sibling cannot occur here.

The service-principal trio is bound mutually, which is worth stating because the Kusto linked service binds its tenant one-directionally and therefore accepts a service principal with no tenant, sending an empty one to Azure. Here it is all three or none, refused offline.

One thing it shares with the wrong half of the family: the read refreshes connection_string. With the shared diff suppressor stripping the password segment from the configured value before comparing, a password inside that string cannot be rotated — a change produces no diff at all. The MySQL and PostgreSQL linked services use the same suppressor and rotation works there, because their reads do not refresh the field. key_vault_password, a service principal, or a Key Vault connection-string reference are the placements that work here.

Two cross-field rules, two hubs. Terraform requires a validation to reference its own variable, so the connection-string rule lives on connection_string and the service-principal rule on service_principal_id — each on a field it actually mentions, which needs no synthetic weave.

data_factory_id's force-new comes from a shared helper, not from its schema block. The helper library offers a non-force-new variant of the same shape, so a ForceNew grep alone would have reported this field as mutable.

There is no additional_properties. An absence is easy to miss, and this one means a property the provider has not modelled cannot be passed through at all.

Sensitivity is contagious, including to scalars. Each flag derived from a secret is unwrapped individually with nonsensitive(); wrapping a constructed collection would not be enough.

The secure-by-default rule applies partly: the provider refuses a connection-string-less call, so there is no empty call to make safe. What the module adds is reporting whether the credential you chose can actually be rotated.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin ?ref=v1.0.0, never a branch. Plan-only; a human applies from CI.

terraform validate exercises the module's twenty-two validations and the provider's schema validators — including the connection-string ExactlyOneOf and all three RequiredWith declarations — offline, without credentials. This resource has no CustomizeDiff and no version gate, so every provider check is reachable offline, which is not true of every linked service in this family.

🔴 The rotation failure cannot be reproduced offline, because it needs a refresh against a real API response. It is asserted from the provider source instead: the harness proves the read assigns state.ConnectionString and never assigns state.ServicePrincipalKey.

What validate cannot reach: whether the instance exists, whether any credential works, whether the service principal has a login inside the instance, and whether the named runtime or Key Vault linked service exists.

id                          = "/subscriptions/.../linkedservices/ls-mi-sales"
name                        = "ls-mi-sales"
connection_string_placement = "inline"
auth_mode                   = "sql_login_with_key_vault_password"
password_is_rotatable       = true
has_service_principal_key   = false
force_new_fields            = ["name", "data_factory_id"]

• azurerm_data_factory_linked_service_sql_managed_instance
• azurerm_data_factory_linked_service_kusto — the sibling whose tenant binding is one-directional
• Azure Data Factory naming rules
• This module's SCOPE.md

💙 "Infrastructure as Code should be standardized, consistent, and secure."