☁️ Azure Disk Backup Policy Terraform Module

Manages one azurerm_data_protection_backup_policy_disk — the schedule and retention rules governing managed-disk backups in a Backup Vault. Targets hashicorp/azurerm ~> 4.0.

• 🎯 Creates one disk backup policy inside an existing Backup Vault.
• 🕒 Takes the schedule as ISO 8601 repeating intervals (R/<start>/P1D) and the fallback retention as a plain ISO 8601 duration (P30D) — two different grammars, easily swapped.
• 🗂️ Accepts one or more retention rules, keyed by rule name.
• 🧊 Every argument is force-new and there is no update function — this policy can never be edited.
• 🚫 Carries no tags — the resource exposes none.

💡 Why it matters: you do not edit a backup policy. All six arguments are force-new and the provider declares no update function, so any change destroys and recreates it — taking with it every backup instance that still references the old ID. The intended way to change retention is to create a new policy and repoint the instances, because backup_policy_id on azurerm_data_protection_backup_instance_disk is deliberately the one argument in this pair that updates in place.

If this module saves you time:

• ⭐ Star the repository
• 💼 Connect on LinkedIn
• ☕ Buy me a coffee

flowchart TB
  RG["azurerm_resource_group"]
  VAULT["azurerm_data_protection_backup_vault"]
  DISK["azurerm_managed_disk"]
  SNAPRG["snapshot resource group"]
  ROLE["role assignments for the vault identity"]
  POL["backup_policy_disk"]
  INS["backup_instance_disk"]

  RG -->|"resource group"| VAULT
  VAULT -->|"vault_id, FORCE-NEW"| POL
  VAULT -->|"vault_id, FORCE-NEW"| INS
  POL -->|"backup_policy_id, the ONLY updatable argument"| INS
  DISK -->|"disk_id, FORCE-NEW"| INS
  INS -->|"snapshots written to"| SNAPRG
  ROLE -.->|"required BEFORE protection can start, not created here"| INS

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff
  classDef key fill:#004578,stroke:#002b47,color:#ffffff
  classDef ext fill:#F0F3F6,stroke:#9AA5B1,color:#1F2933
  class POL,INS me
  class VAULT key
  class RG,DISK,SNAPRG,ROLE ext

The policy is referenced by the instance, never the other way round — and that single edge is the one thing in this pair that can change without replacing anything.

flowchart TB
  VN["name, vault_id, intervals, retention_duration, retention_rule, time_zone"]
  ALLFN["ALL SIX are FORCE-NEW, and there is NO update function"]
  R["azurerm_data_protection_backup_policy_disk.this"]
  NEWPOL["To change retention: create a NEW policy, repoint the instance, drop the old one"]
  OID["id, name, retention_rule_names"]
  OFLAG["retention_rule_count, rules_without_criteria"]
  OWARN["a_repeating_interval_is_not_a_duration"]

  VN --> ALLFN
  ALLFN --> R
  R -->|"never edited, only replaced"| NEWPOL
  R --> OID
  R --> OFLAG
  R --> OWARN

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff
  classDef key fill:#004578,stroke:#002b47,color:#ffffff
  classDef ext fill:#F0F3F6,stroke:#9AA5B1,color:#1F2933
  class R key
  class ALLFN,NEWPOL me
  class VN,OID,OFLAG,OWARN ext

Schema notes that bite — each verified against the provider source and cross-checked against the provider's own documentation:

• 🔴 No update function, and all six arguments force-new. The docs agree on every one: "Changing this forces a new Backup Policy Disk to be created."
• 🔴 The nested retention fields are individually force-new too — eleven ForceNew markers for six arguments.
• 🔴 retention_rule is NOT capped at one. It is a list with no MaxItems; the MaxItems: 1 belongs to the nested criteria block. The docs say "One or more retention_rule blocks".
• ✅ The Timeouts block correctly declares no update, so Terraform rejects the key outright. Not universal in this service — azurerm_data_protection_resource_guard declares one its code never reads.
• The two duration fields are genuinely parsed; backup_repeating_time_intervals has no validator at all.
• absolute_criteria is a closed, case-sensitive set from the SDK's own PossibleValuesForAbsoluteMarker().
• time_zone is checked only for non-emptiness and takes a Windows identifier, not IANA.
• The name pattern ^[-a-zA-Z0-9]{3,150}$ permits a name that is entirely hyphens.
• No CustomizeDiff, no version gate, no tags.

⚠️ Creating a policy grants nothing and protects nothing. The permissions that matter at backup time belong to the vault's managed identity, on the disk and the snapshot resource group, and are granted alongside the backup instance — not here.

• Microsoft.DataProtection registered in the subscription.
• An existing Backup Vault.
• Nothing else. A policy is inert until a backup instance references it.

terraform-azurerm-data-protection-backup-policy-disk/
├── providers.tf    # required_version + the pinned azurerm; no provider block
├── variables.tf    # 7 typed inputs, 13 validations, a THREE-key timeouts object
├── main.tf         # locals + the single keystone resource
├── outputs.tf      # 31 outputs; id first, then name, then the derived facts
├── README.md       # this file
├── SCOPE.md        # the cross-module contract
├── LICENSE         # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "disk_policy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-daily"
  vault_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-backup-eastus/providers/Microsoft.DataProtection/backupVaults/bv-corp"

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P30D"
}

⚠️ Note the two grammars. The schedule is a repeating interval beginning R/; the retention is a bare duration. Swapping them puts an unvalidated value in the field the provider does not check.

Consumes

Emits

module "disk_policy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-daily"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P30D"
}

module "weekly" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-weekly"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = ["R/2026-09-06T02:00:00+00:00/P1W"]
  default_retention_duration      = "P90D"
}

module "twice_daily" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-twice-daily"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = [
    "R/2026-09-01T11:00:00+00:00/P1D",
    "R/2026-09-01T23:00:00+00:00/P1D",
  ]

  default_retention_duration = "P7D"
}

module "with_yearly" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-daily-plus-yearly"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P30D"

  retention_rule = {
    "yearly" = {
      duration          = "P7Y"
      priority          = 20
      absolute_criteria = "FirstOfYear"
    }
  }
}

module "tiered" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-tiered"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P30D"

  retention_rule = {
    "weekly" = { duration = "P1Y", priority = 10, absolute_criteria = "FirstOfWeek" }
    "yearly" = { duration = "P7Y", priority = 20, absolute_criteria = "FirstOfYear" }
  }
}

module "no_criteria" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-loose"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P30D"

  retention_rule = {
    "long" = { duration = "P7Y", priority = 10 }
  }
}

# The complete, CASE-SENSITIVE set, read from the SDK's own PossibleValuesForAbsoluteMarker():
#
#   AllBackup      FirstOfDay      FirstOfWeek      FirstOfMonth      FirstOfYear
#
# "firstofday" is refused. The module emits the list so a composition can assert on it:

output "legal_criteria" {
  value = module.disk_policy.the_absolute_criteria_set_is_closed_and_case_sensitive
}

module "with_tz" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-local"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P30D"
  time_zone                       = "Eastern Standard Time"
}

# There is none, because it is not possible. All six arguments are force-new and
# the provider has no update function -- changing a retention duration, a
# schedule or a time zone destroys and recreates the policy.
#
# The intended sequence for changing retention is:
#
#   1. create a NEW policy alongside the old one
#   2. update backup_policy_id on the instances -- an IN-PLACE change
#   3. remove the old policy
#
# Doing it by editing this module's inputs instead destroys the policy and
# leaves every instance still referencing the old ID pointing at nothing.

module "disk_policy_v2" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-daily-v2" # a NEW name, alongside the old policy
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P90D" # the change
}

locals {
  tiers = {
    "gold"   = { interval = "R/2026-09-01T23:00:00+00:00/P1D", retain = "P365D" }
    "silver" = { interval = "R/2026-09-06T02:00:00+00:00/P1W", retain = "P90D" }
    "bronze" = { interval = "R/2026-09-06T02:00:00+00:00/P1W", retain = "P30D" }
  }
}

module "tiers" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"
  for_each = local.tiers

  name     = "bp-disk-${each.key}"
  vault_id = var.backup_vault_id

  backup_repeating_time_intervals = [each.value.interval]
  default_retention_duration      = each.value.retain
}

output "policy_review" {
  value = {
    schedules      = module.disk_policy.backup_repeating_time_intervals
    schedule_count = module.disk_policy.schedule_count
    default_retain = module.disk_policy.default_retention_duration
    rules          = module.disk_policy.retention_rule_names
    rule_count     = module.disk_policy.retention_rule_count
    loose_rules    = module.disk_policy.rules_without_criteria
    replace_on     = module.disk_policy.force_new_fields
  }
}

check "every_rule_selects_something" {
  assert {
    condition     = length(module.disk_policy.rules_without_criteria) == 0
    error_message = "A retention rule has no absolute_criteria and selects nothing in particular."
  }
}

provider "azurerm" {
  features {}
}

module "resource_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-backup-eastus"
  location = "eastus"
}

module "backup_vault" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-vault.git?ref=v1.0.0"

  name                = "bv-corp"
  resource_group_name = module.resource_group.name
  location            = module.resource_group.location

  datastore_type = "VaultStore"
  redundancy     = "LocallyRedundant"

  identity = {
    type = "SystemAssigned"
  }
}

module "disk_policy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-policy-disk.git?ref=v1.0.0"

  name     = "bp-disk-daily"
  vault_id = module.backup_vault.id

  backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
  default_retention_duration      = "P30D"

  retention_rule = {
    "yearly" = { duration = "P7Y", priority = 20, absolute_criteria = "FirstOfYear" }
  }
}

module "disk_backup" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-data-protection-backup-instance-disk.git?ref=v1.0.0"

  name     = "bi-disk-data-01"
  location = module.resource_group.location
  vault_id = module.backup_vault.id

  disk_id                      = var.managed_disk_id
  snapshot_resource_group_name = "rg-snapshots-eastus"
  backup_policy_id             = module.disk_policy.id
}

output "policy_id" {
  value = module.disk_policy.id
}

Required: name, vault_id, backup_repeating_time_intervals, default_retention_duration.

Optional: retention_rule, time_zone, timeouts.

Nothing is sensitive: this resource carries no credential.

This policy can never be updated. All six arguments are force-new and the provider declares no update function at all — the Resource struct has Create, Read and Delete and nothing else. The nested retention fields are marked force-new individually as well, which is why the file carries eleven ForceNew markers for six arguments. Consequently there is no counterpart list of updatable fields in the outputs: there are none.

So retention changes are a create-and-repoint, never an edit. Create the new policy alongside the old, update backup_policy_id on each instance — an in-place change that disturbs no data — then remove the old policy. Editing this module's inputs instead destroys the policy, and any instance still referencing the old ID is left pointing at nothing.

retention_rule is not capped, and that is easy to get backwards. The provider models it as a list with no MaxItems; the MaxItems: 1 belongs to the nested criteria block. So several rules are legal — a common shape is one keeping the first backup of each week for a year and another keeping the first of each year for seven — while each individual rule carries exactly one absolute_criteria. This module takes a map keyed by rule name so the names are unique by construction, and refuses duplicate priority values, which the provider does not check and which leave two rules with no defined order.

Two grammars, both called ISO 8601. backup_repeating_time_intervals takes R/<start instant>/<period>; default_retention_duration and each rule's duration take a bare P… duration. The durations are genuinely parsed by the provider and a malformed one is refused. The repeating intervals carry no validator at all, so a malformed schedule is accepted by Terraform and rejected by Azure — which is why this module adds shape checks of its own for exactly that field.

time_zone is barely validated and interacts with the schedule. It takes a Windows identifier, the provider checks only non-emptiness, and the repeating interval already carries its own UTC offset. Setting both is how a schedule fires at an unintended hour.

features {} dependence. As with every module in this suite, the caller supplies provider "azurerm" { features {} }.

Two rules govern the validations. Never invent a constraint that could reject legal input — a validation {} failure blocks terraform destroy as well as apply, which is why the loose name pattern is reproduced rather than tightened. And enforce a configuration rule, report a service one — the interval's shape and the criteria set are enforced; a criteria-less rule is reported.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module with ?ref=v1.0.0 — never a branch. This module is plan-only; a human applies from CI.

Know which command reaches which check. terraform validate on a configuration that CALLS this module checks types and syntax only: it evaluates none of the module's variable values. The 13 validation {} blocks are reached at terraform plan, and none of them needs credentials, because variable validation runs before the provider is configured. To exercise them without a plan, run the module as the root module and drive it through terraform console -var-file=....

Because this resource has no CustomizeDiff and no version gate, nothing is deferred to plan by the provider.

What no Terraform stage exercises: whether a repeating interval is one Azure will accept, whether the time zone identifier is real, and whether any backup instance uses this policy. The first two fail at apply; the third never fails at all — an unused policy is simply inert.

$ terraform output
id                              = "/subscriptions/.../backupVaults/bv-corp/backupPolicies/bp-disk-daily"
name                            = "bp-disk-daily"
vault_name                      = "bv-corp"
backup_repeating_time_intervals = ["R/2026-09-01T23:00:00+00:00/P1D"]
schedule_count                  = 1
default_retention_duration      = "P30D"
retention_rule_names            = ["yearly"]
retention_rule_count            = 1
rules_without_criteria          = []
force_new_fields                = ["name", "vault_id", "backup_repeating_time_intervals", "default_retention_duration", "retention_rule", "time_zone"]
this_policy_can_never_be_updated = true

• azurerm_data_protection_backup_policy_disk
• azurerm_data_protection_backup_instance_disk
• Microsoft Learn — Azure Disk Backup
• Sibling modules: terraform-azurerm-data-protection-backup-instance-disk, terraform-azurerm-data-protection-backup-vault
• This module's SCOPE.md

💙 "Infrastructure as Code should be standardized, consistent, and secure."