☁️ Azure NetApp Capacity Pool Terraform Module

Provisions one Azure NetApp Files capacity pool (azurerm_netapp_pool) — the billing and performance boundary that volumes carve their quota out of. Targets hashicorp/azurerm ~> 4.0.

• 🗄️ Provisions one capacity pool — where NetApp Files capacity is actually bought — as a keystone resource named this.
• 💰 size_in_tb is the billed quantity, not the sum of what the volumes inside consume. An oversized pool costs the same empty as full.
• 🔒 Documents which choices are durable: service_level and encryption_type are force-new, and cool_access_enabled is effectively one-way.
• ✅ Validates the three enums, the 1–2048 size range, and the Flexible + Manual pairing that custom_throughput_mibps requires — all at plan.
• ⚠️ Explains why the schema's minimum size misleads: one volume on Basic network features raises the pool's floor from 2 TiB to 4 TiB.
• 📤 Emits the cost and posture facts — size_in_tb, service_level, encryption_type, cool_access_enabled — so a review reads them from state.

💡 Why it matters: Almost nothing about a pool can be changed in place. The service level is force-new, double encryption cannot be retrofitted, and cool access cannot be switched back off without rebuilding the pool and migrating every volume in it. So the useful thing a module can do here is not to offer more knobs — it is to be clear about which decisions you are making permanently, and which one you are being billed for.

If this module saves you time, please consider supporting its continued development:

• ⭐ Star the repository on GitHub.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart LR
  rg["terraform-azurerm-resource-group"]
  kv["terraform-azurerm-key-vault"]
  vnet["terraform-azurerm-virtual-network: subnet delegated to Microsoft.NetApp/volumes"]
  acct["terraform-azurerm-netapp-account"]
  enc["terraform-azurerm-netapp-account-encryption: who holds the key"]
  pool["terraform-azurerm-netapp-pool: the BILLED capacity"]
  vol["terraform-azurerm-netapp-volume: what clients mount"]
  snap["terraform-azurerm-netapp-snapshot: one on-demand, in the pool"]
  spol["terraform-azurerm-netapp-snapshot-policy: the schedule"]
  vault["terraform-azurerm-netapp-backup-vault: the destination"]
  bpol["terraform-azurerm-netapp-backup-policy: the retention"]
  vghana["terraform-azurerm-netapp-volume-group-sap-hana"]
  vgora["terraform-azurerm-netapp-volume-group-oracle"]

  rg -->|"resource_group_name, location"| acct
  kv -->|"encryption_key URI"| enc
  acct -->|"id, BY ID"| enc
  acct -->|"account_name, BY NAME"| pool
  acct -->|"account_name, BY NAME"| vault
  acct -->|"account_name, BY NAME"| bpol
  acct -->|"account_name, BY NAME"| spol
  acct -->|"account_name, BY NAME"| vghana
  acct -->|"account_name, BY NAME"| vgora
  pool -->|"pool_name, BY NAME"| vol
  pool -->|"capacity_pool_id, BY ID"| vghana
  pool -->|"capacity_pool_id, BY ID"| vgora
  vnet -->|"subnet_id, must be delegated"| vol
  vol -->|"name plus pool_name, BY NAME"| snap
  spol -->|"snapshot_policy_id, BY ID"| vol
  vault -->|"backup_vault_id, BY ID"| vol
  bpol -->|"backup_policy_id, BY ID"| vol

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class acct keystone;
  class enc,pool,vol,snap,spol,vault,bpol,vghana,vgora me;
  class rg,kv,vnet sib;

flowchart TB
  addr["name, resource_group_name, account_name, location: ALL force-new"]
  sl["service_level: force-new. Standard, Premium, Ultra, Flexible"]
  size["size_in_tb 1-2048: THE BILLED QUANTITY, updates in place"]
  floor["practical minimum is higher: a Basic-network volume raises the floor 2 to 4 TiB"]
  qos["qos_type Auto or Manual"]
  ct["custom_throughput_mibps: only Flexible plus Manual, min 128"]
  enc["encryption_type Single or Double: force-new, so Double cannot be retrofitted"]
  cool["cool_access_enabled: enabling is in place, DISABLING forces a new pool"]
  this["terraform-azurerm-netapp-pool"]
  pool["azurerm_netapp_pool.this"]
  out["outputs: id, name for volumes, size_in_tb, service_level, encryption_type, cool_access_enabled"]
  vols["volumes carve quota from this pool and reference it BY NAME"]

  addr -->|"identity"| this
  sl -->|"durable performance choice"| this
  size -->|"cost"| this
  floor -->|"why the schema minimum misleads"| size
  qos -->|"throughput distribution"| this
  ct -->|"validated pairing"| qos
  enc -->|"encryption at rest"| this
  cool -->|"one-way door"| this
  this -->|"creates"| pool
  pool -->|"emits"| out
  out -->|"pool_name"| vols

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class this me;
  class pool keystone;
  class addr,sl,size,floor,qos,ct,enc,cool,out,vols sib;

Resource inventory

Schema notes that bite (verified against the live provider schema):

• Force-new: name, resource_group_name, account_name, location, service_level, and encryption_type.
• cool_access_enabled is asymmetric. Enabling it is an in-place update; disabling it forces a new capacity pool — so a pool switched on for an experiment cannot be switched back without a rebuild and a volume migration.
• size_in_tb is the billed quantity. Billing follows provisioned size, not the sum of volume usage, so an oversized pool costs the same empty as full. It updates in place, so start close to the requirement and grow.
• The schema accepts size_in_tb = 1, but the practical minimum is higher: a 2 TiB pool requires every volume to use Standard network features, and one volume on Basic raises the floor to 4 TiB. A value the schema allows can still be rejected at apply.
• The maximum is governed by regional quota, which is a support request rather than a configuration change.
• custom_throughput_mibps is valid only when service_level is Flexible and qos_type is Manual, with a minimum of 128.
• On a Manual QoS pool, a volume that sets no throughput_in_mibps gets none — throughput is not distributed automatically.
• A pool cannot be deleted while it holds volumes, so a failing delete is usually reporting a volume the configuration does not know about.
• encryption_type = "Double" cannot be retrofitted — it is force-new, so adding it later means rebuilding the pool and migrating every volume.
• The account is addressed by name, not by Resource ID — the pattern across the pool, volume, snapshot, and backup resources in this family.

• Contributor on the resource group holding the NetApp account, or a custom role covering Microsoft.NetApp/netAppAccounts/capacityPools/*.
• Read access on the NetApp account, so the pool can be created within it.
• No data-plane or Key Vault permission is needed here; the pool holds no credentials and no data.

• An existing NetApp account, in the same region as this pool.
• Sufficient regional capacity quota for size_in_tb. The provider accepts a value the subscription's quota does not allow, and the service rejects it at apply.
• For a 2 TiB pool: every volume in it must use Standard network features.
• For encryption_type = "Double": a region and service level that support double encryption at rest.
• The caller configures the provider "azurerm" { features {} } block, auth, and subscription.

terraform-azurerm-netapp-pool/
├── providers.tf   # required_version >= 1.12.0; azurerm ~> 4.0; no provider block
├── variables.tf   # validated enums, size range, the Flexible+Manual pairing, tags/timeouts tail
├── main.tf        # keystone azurerm_netapp_pool.this
├── outputs.tf     # id, name for volumes, cost and posture values
├── README.md      # this document
├── SCOPE.md       # cross-module contract
├── LICENSE        # MIT
└── .gitignore     # canonical library ignore set

provider "azurerm" {
  features {}
}

module "anf_pool" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-pool.git?ref=v1.0.0"

  name                = "pool-prod-01"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name # the NAME, not the id
  location            = module.anf_rg.location

  service_level = "Premium" # force-new — a durable choice
  size_in_tb    = 4         # THE BILLED QUANTITY

  tags = { workload = "records", cost_owner = "platform-storage" }
}

💰 size_in_tb is what you pay for regardless of volume usage. It updates in place, so starting at the requirement and growing is cheaper than provisioning headroom.

ℹ️ The caller owns the provider, its authentication, and the mandatory features {} block. This module never declares them.

Consumes

Emits

Values these examples reference but do not create are declared inputs:

variable "subnet_id" {
  description = "subnet id of an existing resource these examples reference."
  type        = string
}

module "anf_pool" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-pool.git?ref=v1.0.0"

  name                = "pool-prod-01"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  location            = module.anf_rg.location

  service_level = "Premium"
  size_in_tb    = 4
}

size_in_tb = 2 # requires EVERY volume in the pool to use Standard network features

size_in_tb = 4 # the floor once any volume uses Basic network features

service_level = "Ultra" # force-new

qos_type = "Manual"

# Then every volume must set its own throughput:
module "anf_volume" {
  # ...
  throughput_in_mibps = 128
}

service_level           = "Flexible"
qos_type                = "Manual"
custom_throughput_mibps = 256

service_level           = "Premium" # ❌
qos_type                = "Manual"
custom_throughput_mibps = 256

Error: Invalid value for variable

  custom_throughput_mibps is only valid when service_level is "Flexible" AND qos_type is
  "Manual".

encryption_type = "Double" # force-new — cannot be added later

cool_access_enabled = true # enabling: in-place. DISABLING: forces a new pool.

service_level = "premium" # ❌ lowercase

Error: Invalid value for variable

  service_level must be one of: Standard, Premium, Ultra, Flexible.

size_in_tb = 4096 # ❌

Error: Invalid value for variable

  size_in_tb must be between 1 and 2048. Note the service minimum is higher than 1 in
  practice: a 2 TiB pool requires every volume to use Standard network features, and a
  volume on Basic raises the minimum to 4 TiB.

size_in_tb = 8 # was 4 — updates in place

module "anf_volume" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-volume.git?ref=v1.0.0"

  name                = "vol-records"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  pool_name           = module.anf_pool.name          # BY NAME, from the output
  location            = module.anf_pool.location
  service_level       = module.anf_pool.service_level # inherit the pool's tier
  storage_quota_in_gb          = 1
  subnet_id                    = var.subnet_id
  volume_path                  = "volume-path"
}

locals {
  pools = {
    "pool-prod-premium"  = { level = "Premium", size = 8 }
    "pool-prod-standard" = { level = "Standard", size = 4 }
  }
}

module "pools" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-pool.git?ref=v1.0.0"
  for_each = local.pools

  name                = each.key
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  location            = module.anf_rg.location

  service_level = each.value.level
  size_in_tb    = each.value.size
}

output "anf_capacity_cost_basis" {
  description = "Provisioned TiB per pool — the billed quantity, regardless of volume usage."
  value = {
    for k, m in module.pools : k => {
      provisioned_tb = m.size_in_tb
      tier           = m.service_level
      encryption     = m.encryption_type
      cool_access    = m.cool_access_enabled
    }
  }
}

Error: deleting NetApp Pool: pool contains volumes

provider "azurerm" {
  features {}
}

# 1 · The resource group.
module "anf_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-anf-eastus2"
  location = "eastus2"
}

# 2 · The NetApp account — the regional parent everything else is named against.
module "anf_account" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-account.git?ref=v1.0.0"

  name                = "anf-prod-eastus2"
  resource_group_name = module.anf_rg.name
  location            = module.anf_rg.location
}

# 3 · The delegated subnet the volumes will land in.
module "anf_vnet" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-virtual-network.git?ref=v1.0.0"

  name                = "vnet-anf-eastus2"
  resource_group_name = module.anf_rg.name
  location            = module.anf_rg.location
  address_space       = ["10.40.0.0/16"]

  subnets = {
    anf = {
      address_prefixes = ["10.40.1.0/24"]
      delegations = [{
        name = "netapp"
        service_delegation = {
          name    = "Microsoft.NetApp/volumes"
          actions = ["Microsoft.Network/networkinterfaces/*", "Microsoft.Network/virtualNetworks/subnets/join/action"]
        }
      }]
    }
  }
}

# 4 · The capacity pool — this module. Sized at the requirement, not padded.
module "anf_pool" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-pool.git?ref=v1.0.0"

  name                = "pool-prod-01"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  location            = module.anf_rg.location

  service_level = "Premium" # force-new
  size_in_tb    = 4         # billed; grow in place when needed

  # Left at defaults deliberately: qos_type Auto, encryption_type Single, cool access off.
  # encryption_type and cool_access_enabled are both effectively permanent — see examples 6 and 7.

  tags = { workload = "records", cost_owner = "platform-storage" }
}

# 5 · A volume drawing quota from the pool, referencing it BY NAME.
module "anf_volume" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-netapp-volume.git?ref=v1.0.0"

  name                = "vol-records"
  resource_group_name = module.anf_rg.name
  account_name        = module.anf_account.name
  pool_name           = module.anf_pool.name
  location            = module.anf_pool.location

  service_level       = module.anf_pool.service_level
  storage_quota_in_gb = 1024
  volume_path         = "records"
  subnet_id           = module.anf_vnet.subnet_ids["anf"]

  # The volume exports to nobody until a rule says otherwise.
  export_policy_rule = {
    app_tier = {
      rule_index      = 1
      allowed_clients = ["10.40.2.0/24"]
      protocol        = ["NFSv3"]
      unix_read_write = true
      # root_access_enabled defaults to false.
    }
  }
}

output "pool_cost_basis" {
  description = "What is actually billed, and the two choices that cannot be undone."
  value = {
    provisioned_tb = module.anf_pool.size_in_tb
    tier           = module.anf_pool.service_level
    encryption     = module.anf_pool.encryption_type
    cool_access    = module.anf_pool.cool_access_enabled
  }
}

Required: name, resource_group_name, account_name, location, service_level, size_in_tb.

Performance: qos_type (defaults Auto), custom_throughput_mibps.

Durable choices: encryption_type (defaults Single), cool_access_enabled (defaults false).

Universal tail: tags, timeouts.

variable "name" {
  # force-new. Volumes and snapshots reference the pool BY THIS NAME as a plain string with
  # no Terraform dependency — wire callers from the `name` output.
  type = string
}

variable "resource_group_name" { type = string } # force-new
variable "account_name"        { type = string } # force-new; the NAME, not the Resource ID
variable "location"            { type = string } # force-new; match the account's region

variable "service_level" {
  # Standard | Premium | Ultra | Flexible (validated).
  # ⚠️ FORCE-NEW — changing it means migrating every volume in the pool first.
  # Flexible is the only tier where custom_throughput_mibps applies.
  type = string
}

variable "size_in_tb" {
  # 1-2048 (validated). 💰 THE BILLED QUANTITY — billing follows provisioned size, not volume
  # usage, so an oversized pool costs the same empty as full. Updates in place, so grow rather
  # than pad.
  # ⚠️ The practical minimum is higher than 1: a 2 TiB pool needs EVERY volume on Standard
  #    network features; one volume on Basic raises the floor to 4 TiB. The ceiling is regional
  #    quota, which is a support request.
  type = number
}

variable "qos_type" {
  # Auto (default) distributes throughput by quota | Manual requires each volume to set its own
  # throughput_in_mibps — and a volume that sets none gets none. Validated.
  type    = string
  default = "Auto"
}

variable "custom_throughput_mibps" {
  # Min 128. Valid ONLY when service_level = "Flexible" AND qos_type = "Manual" — both checks
  # live on this variable and read the other two one-directionally, because Terraform rejects
  # validations that reference each other.
  type    = number
  default = null
}

variable "encryption_type" {
  # Single (default) | Double (validated). ⚠️ FORCE-NEW.
  # NOT defaulted to Double despite the stronger posture: it is region- and service-level
  # limited, so a default would fail the empty call where unavailable — with no recovery short
  # of rebuilding the pool and migrating its volumes. Set it at CREATION where warranted.
  type    = string
  default = "Single"
}

variable "cool_access_enabled" {
  # ⚠️ ASYMMETRIC: enabling is in-place, DISABLING forces a new pool. Effectively one-way.
  # Also incompatible with large volumes.
  type    = bool
  default = false
}

variable "tags"     { type = map(string), default = {} }
variable "timeouts" { type = object({ create = optional(string), read = optional(string), update = optional(string), delete = optional(string) }), default = null }

No secret is emitted; this resource carries none.

• The pool is where capacity is bought, and that frames everything else. size_in_tb is billed on provisioned size rather than volume consumption, so headroom is a standing cost rather than prudence — and since it grows in place in seconds, there is no operational reason to pad it. size_in_tb and service_level are emitted together because they are the cost basis.
• Three choices here are effectively permanent, and the module's job is to say which. service_level and encryption_type are force-new; cool_access_enabled is force-new in one direction only. That asymmetry is the subtlest of the three: enabling cool access looks like an ordinary toggle and reads as reversible, but reversing it costs a pool rebuild and a volume migration.
• encryption_type defaults to Single, and that is a deliberate departure from defaulting to the hardened value. Double encryption is limited by region and service level, so defaulting it would make the empty call fail where it is unavailable — and because it is force-new, the wrong choice cannot be corrected without rebuilding the pool and migrating its volumes. A default that sometimes fails irreversibly is worse than a documented decision.
• The schema's minimum size misleads, and the reason is that the constraint lives elsewhere. The real floor depends on the network features of the volumes in the pool, which this module cannot see: 2 TiB requires every volume on Standard, and one volume on Basic raises it to 4 TiB. The validation allows what the schema allows and the documentation carries the rest, because a stricter check would reject legitimate configurations.
• The account and this pool are addressed by name; volumes address this pool by name too. Those are plain strings with no Terraform dependency, which is why name is emitted with an explicit note — wiring from the output is what makes a rename a plan diff instead of a failed apply.
• Manual QoS shifts an obligation onto every volume. Throughput stops being distributed automatically, so a volume that sets no throughput_in_mibps gets none. qos_type is emitted so a composition can tell whether that obligation is in force.
• One pool per service level is the normal arrangement, and it follows from service_level being force-new: moving a volume between tiers means moving it to a pool that already exists at the target tier.
• A pool cannot be deleted while it holds volumes, and the most confusing case is a volume the configuration has lost track of — including one dropped from state by a volume migration (see terraform-azurerm-netapp-volume).
• features {} dependence. The module carries no provider {} block. If it appears not to initialize in isolation, the cause is a missing caller-side provider "azurerm" { features {} }.

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the module with ?ref=v1.0.0 — never a branch.
• This library is plan-only during authoring; a human runs terraform plan / apply from CI against real credentials.
• Before applying: confirm regional quota covers size_in_tb, and decide encryption_type and cool_access_enabled now — both are effectively permanent.
• Treat a service_level change as a planned migration of every volume in the pool, not an edit.
• Before destroying: enumerate the pool's volumes. A pool holding volumes cannot be deleted.

• terraform validate proves the configuration is internally consistent and type-correct against the pinned provider schema, and exercises every validation {} block: the service_level, qos_type, and encryption_type enums; the 1–2048 size_in_tb range; the 128 minimum on custom_throughput_mibps; and its Flexible + Manual pairing.
• terraform fmt -check enforces canonical formatting.
• Neither command calls Azure. Only terraform plan (run by a human, from CI) exercises the ARM API — the module ships without any cloud apply.
• What only apply exercises: whether regional quota covers size_in_tb, whether the region and tier support encryption_type = "Double", and whether the account exists in the named region.
• What nothing exercises: whether size_in_tb clears the real minimum, since that depends on the network features of volumes this module cannot see — a 2 TiB pool with one Basic volume fails at apply.

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

id                      = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-anf-eastus2/providers/Microsoft.NetApp/netAppAccounts/anf-prod-eastus2/capacityPools/pool-prod-01"
name                    = "pool-prod-01"
account_name            = "anf-prod-eastus2"
resource_group_name     = "rg-anf-eastus2"
location                = "eastus2"
service_level           = "Premium"
size_in_tb              = 4
qos_type                = "Auto"
custom_throughput_mibps = 0
encryption_type         = "Single"
cool_access_enabled     = false

• azurerm provider — azurerm_netapp_pool
• Set up a capacity pool for Azure NetApp Files
• Service levels for Azure NetApp Files
• Manage cool access in Azure NetApp Files
• Azure NetApp Files double encryption at rest
• Sibling modules: terraform-azurerm-netapp-account, terraform-azurerm-netapp-volume, terraform-azurerm-netapp-snapshot, terraform-azurerm-netapp-backup-vault, terraform-azurerm-netapp-backup-policy, terraform-azurerm-virtual-network, terraform-azurerm-monitor-diagnostic-setting, terraform-azurerm-role-assignments.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."