☁️ Azure Resource Group Template Deployment Terraform Module

Deploys an ARM template (or a Template Spec version) into one resource group, with the deployment_mode that can delete everything in it that the template does not declare. Targets hashicorp/azurerm ~> 4.0.

• 📦 Creates one azurerm_resource_group_template_deployment — an ARM deployment into one resource group, from inline JSON or a versioned Template Spec.
• 🔴 Carries deployment_mode, the only genuinely dangerous argument in this family: Complete deletes resources in the resource group that the template does not declare, and Azure performs that deletion, so it appears in no Terraform plan.
• 🔍 Parses parameters_content and reports which parameters carry a literal value (written to state, unredacted) versus a Key Vault reference (a pointer only).
• 🚩 Emits four constants for facts nothing in a plan shows: who performs Complete-mode deletion, that a destroy deletes what the template created unless the caller's provider block says otherwise, that parameter values are read back into state, and that output_content is recomputed on any template change.

💡 Why it matters: this resource is a hole in Terraform's model. The things it creates are not in your state — ARM owns them, Terraform owns only the deployment record. That is the trade-off you accept in exchange for deploying a template at all, and it means deployment_mode, destroy, and every parameter value behave in ways the surrounding configuration cannot see.

If this module saves you time:

• ⭐ Star the repository — it is the cheapest signal that the work is worth continuing.
• 💼 Connect on LinkedIn — linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee — buymeacoffee.com/microsoftexpert

flowchart TB
  RG["terraform-azurerm-resource-group, whose name is BOTH the target and the Complete-mode blast radius"]
  SPEC["Azure template spec version, an immutable artifact and the more auditable of the two sources"]
  KV["terraform-azurerm-key-vault, referenced by an ARM parameter so the secret never enters Terraform state"]
  THIS["terraform-azurerm-resource-group-template-deployment"]
  DEP["azurerm_resource_group_template_deployment: the DEPLOYMENT RECORD"]
  ARM["ARM creates everything the template declares. Those resources are NOT in this state -- the central trade-off of any template-deployment module."]
  DELETED["Complete mode: resources in the resource group the template does not declare, DELETED BY AZURE, in no plan"]
  TYPED["terraform-azurerm-storage-account and other typed modules, preferred wherever a typed resource exists"]
  SUBTD["terraform-azurerm-subscription-template-deployment: the same deployment one scope wider"]
  MGTD["terraform-azurerm-management-group-template-deployment"]
  TENTD["terraform-azurerm-tenant-template-deployment"]

  RG -->|"resource_group_name"| THIS
  SPEC -->|"template_spec_version_id, exclusive with template_content"| THIS
  KV -->|"ARM parameter reference resolved at deploy time"| DEP
  THIS -->|"creates"| DEP
  DEP -->|"deploys"| ARM
  DEP -->|"deployment_mode Complete also destroys"| DELETED
  TYPED -->|"preferred where a typed resource exists"| ARM
  THIS -->|"wider scope, and Complete mode does not exist there"| SUBTD
  SUBTD --> MGTD
  MGTD --> TENTD

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff
  classDef keystone fill:#004578,stroke:#002438,color:#ffffff
  classDef sibling fill:#F3F6F9,stroke:#8A9BA8,color:#1B1F23
  class THIS me
  class DEP,ARM,DELETED keystone
  class RG,SPEC,KV,TYPED,SUBTD,MGTD,TENTD sibling

Two edges deserve attention. terraform-azurerm-key-vault connects to the deployment, not to this module — an ARM parameter reference is resolved by Azure at deploy time, which is how a secret reaches the template without passing through Terraform state. And the DELETED node exists only at this scope: the wider subscription, management-group and tenant deployments have no Complete mode at all.

flowchart TB
  VNAME["var.name, force-new, 1 to 64 chars"]
  VRG["var.resource_group_name, force-new"]
  VMODE["var.deployment_mode, REQUIRED, Incremental or Complete, updatable in place"]
  VTC["var.template_content, JSON"]
  VTS["var.template_spec_version_id"]
  VPC["var.parameters_content, free-form JSON that MAY carry secrets"]
  VDBG["var.debug_level, off by default"]
  THIS["azurerm_resource_group_template_deployment.this"]
  OID["output id"]
  ODEL["output deletes_resources_not_in_the_template"]
  OLIT["outputs parameters_with_literal_values and parameters_using_key_vault_references"]
  ODBG["output debug_logging_enabled"]
  OOUT["output output_content, a JSON string for jsondecode"]

  VNAME --> THIS
  VRG --> THIS
  VMODE -->|"Incremental is the safe value"| THIS
  VTC -->|"exactly one of these two"| THIS
  VTS -->|"exactly one of these two"| THIS
  VPC -->|"values are read back into state, unredacted"| THIS
  VDBG -->|"enabling it can log resolved secrets"| THIS
  THIS --> OID
  THIS --> OOUT
  VMODE -->|"named for the consequence, not the enum"| ODEL
  VPC -->|"derived from the JSON the module can actually parse"| OLIT
  VDBG --> ODBG

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff
  classDef keystone fill:#004578,stroke:#002438,color:#ffffff
  classDef sibling fill:#F3F6F9,stroke:#8A9BA8,color:#1B1F23
  class THIS keystone
  class OID,ODEL,OLIT,ODBG,OOUT me
  class VNAME,VRG,VMODE,VTC,VTS,VPC,VDBG sibling

Schema notes that bite:

• 🔴 deployment_mode is required, has no default, and is updatable in place. Flipping Incremental to Complete is not a replacement — the next apply just reconciles destructively.
• 🔴 Complete-mode deletion is performed by Azure, not Terraform. It appears in no plan, removes no state entry, and is not limited to resources this configuration created.
• 🔴 parameters_content values are read back into state and are not marked sensitive. The provider's read path strips only each parameter's type key and keeps its value.
• 🔴 terraform destroy deletes what the template created, unless the caller's provider block sets features { template_deployment { delete_nested_items_during_deletion = false } }. That is caller configuration no module can set, and both settings have sharp edges.
• ⚠️ template_content and template_spec_version_id are ExactlyOneOf. The binary schema records no such constraint, so this module re-expresses it — as a validation on template_content referencing the other variable one-directionally, since two variables validating each other is a cycle.
• ⚠️ A CustomizeDiff marks output_content unknown whenever the template or parameters change. The provider's own source notes the cost: any change to template_content also causes every resource referencing output_content to update.
• ⚠️ The provider's name check is looser than Azure's. Its regex has no length bound, while Azure documents 1–64 characters; and its error message omits parentheses, which the regex and Azure both allow. This module enforces the documented limit.
• ⚠️ Both content fields are Optional + Computed with a JSON-normalising StateFunc. Reformatting the same template produces no diff; omitting parameters_content is not the same as passing {}.
• ⚠️ Update always re-parses parameters_content, even when unchanged — so a syntax error there fails an update that did not touch parameters. And when template_content is unchanged, update re-exports the deployed template from Azure and resubmits it.
• ⚠️ Create runs an ARM validate call before the write, which is a distinct action from write.
• ℹ️ tags apply to the deployment record only — ARM does not propagate them to what the template creates.

🔴 The permission this module needs is unbounded, because the template's contents are unbounded. Unlike every other module in this library, the required grant cannot be enumerated from the resource type — it is a function of the JSON the caller supplies. Read the template before granting; a template deployment is an arbitrary-code-execution primitive with Azure Resource Manager as the interpreter.

⚠️ A plan reads more than it looks like. A refresh exports the deployed template and reads back the deployed parameters, so plan access here does expose parameter values — including any literal secret. That is unusual for this library, where plan access is normally not credential access.

• An existing resource group this configuration owns. In Complete mode everything else in it is at risk.
• A template: inline JSON, or a Template Spec version ID.
• Every resource provider the template uses, registered on the subscription — otherwise the deployment fails at ARM validation with an unhelpful API-version error. See terraform-azurerm-resource-provider-registration.
• For a secret parameter: an existing Key Vault with the secret in it, and the vault configured to permit template deployment reference (enabled_for_template_deployment).
• A decision about the provider's delete_nested_items_during_deletion setting, because both values have sharp edges — see the constants in Outputs.

terraform-azurerm-resource-group-template-deployment/
├── providers.tf    # required_version + the azurerm ~> 4.0 pin. No provider block.
├── variables.tf    # name, resource_group_name, deployment_mode, the two exclusive template sources,
│                   # parameters_content, debug_level, tags, timeouts
├── main.tf         # the keystone resource + a guarded jsondecode of the parameters + derived posture flags
├── outputs.tf      # id first, then the scope and mode, output_content, the derived flags, then four constants
├── README.md       # this file
├── SCOPE.md        # the cross-module contract
├── LICENSE         # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "vnet_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vnet"
  resource_group_name = var.app_resource_group_name

  # Incremental is the safe value. Complete DELETES resources the template does not declare.
  deployment_mode = "Incremental"

  template_content = file("${path.module}/templates/vnet.json")

  parameters_content = jsonencode({
    vnetName = { value = var.vnet_name }
  })
}

ℹ️ The caller owns provider configuration, authentication and the mandatory features {} block.

💡 file() or jsonencode() rather than a heredoc: a heredoc interpolates ${...}, and a template assembled from Terraform values acquires one easily. ARM's own expression syntax uses [...], so a static template is safe either way — but the habit is worth keeping.

Consumes

Emits

module "vnet_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vnet"
  resource_group_name = "rg-app"
  deployment_mode     = "Incremental"

  template_content = jsonencode({
    "$schema"      = "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#"
    contentVersion = "1.0.0.0"
    resources      = []
  })
}

module "app_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-app"
  location = "eastus"
}

module "vnet_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vnet"
  resource_group_name = module.app_rg.name
  deployment_mode     = "Incremental"

  template_content = file("${path.module}/templates/vnet.json")
}

module "vm_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vm"
  resource_group_name = var.app_resource_group_name
  deployment_mode     = "Incremental"

  template_content = file("${path.module}/templates/vm.json")

  parameters_content = jsonencode({
    # Fine: not a secret, and useful to see in a plan.
    vmName = { value = "vm-app-01" }

    # NOT fine: this value is written into Terraform state and shown in plan output.
    # adminPassword = { value = var.admin_password }

    # Fine: ARM resolves this at deploy time, so only the POINTER is in state.
    adminPassword = {
      reference = {
        keyVault   = { id = var.key_vault_id }
        secretName = "vm-admin-password"
      }
    }
  })
}

check "no_literal_parameters" {
  assert {
    condition     = module.vm_deployment.parameters_put_literal_values_in_state == false
    error_message = "A parameter was passed as a literal value, which puts it in Terraform state and plan output. Use an ARM Key Vault reference."
  }
}

output "parameter_secrecy_review" {
  value = {
    literal        = module.vm_deployment.parameters_with_literal_values
    kv_referenced  = module.vm_deployment.parameters_using_key_vault_references
  }
}

module "storage_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-storage"
  resource_group_name = var.app_resource_group_name
  deployment_mode     = "Incremental"

  template_content = file("${path.module}/templates/storage.json")
}

locals {
  deployment_outputs = jsondecode(module.storage_deployment.output_content)
  storage_account_id = local.deployment_outputs.storageAccountId.value
}

output "storage_account_id" {
  value = local.storage_account_id
}

module "baseline_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-baseline"
  resource_group_name = var.app_resource_group_name
  deployment_mode     = "Incremental"

  template_spec_version_id = var.baseline_template_spec_version_id

  parameters_content = jsonencode({
    environment = { value = "production" }
  })
}

# A resource group whose ENTIRE contents are described by this one template.
module "app_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-app-declarative"
  location = "eastus"
}

module "declarative_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-everything"
  resource_group_name = module.app_rg.name

  # Deliberate: this template is the sole description of the resource group's contents.
  deployment_mode = "Complete"

  template_content = file("${path.module}/templates/whole-environment.json")
}

check "deployment_is_additive_only" {
  assert {
    condition     = module.vnet_deployment.deletes_resources_not_in_the_template == false
    error_message = "This deployment is in Complete mode and will delete resources in rg-app that the template does not declare. Azure performs that deletion, so it appears in no plan."
  }
}

variable "debug_this_deployment" {
  description = "Temporarily log ARM request and response bodies. Leave false."
  type        = bool
  default     = false
}

module "vm_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vm"
  resource_group_name = var.app_resource_group_name
  deployment_mode     = "Incremental"

  template_content = file("${path.module}/templates/vm.json")

  debug_level = var.debug_this_deployment ? "requestContent, responseContent" : null
}

check "debug_logging_is_off" {
  assert {
    condition     = module.vm_deployment.debug_logging_enabled == false
    error_message = "ARM debug logging is enabled for this deployment. It can record resolved secrets into the resource group's deployment history."
  }
}

module "big_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-platform"
  resource_group_name = var.app_resource_group_name
  deployment_mode     = "Incremental"

  template_content = file("${path.module}/templates/platform.json")

  timeouts = {
    create = "5h"
    read   = "10m"
    update = "5h"
    delete = "5h"
  }
}

module "storage_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-storage"
  resource_group_name = var.app_resource_group_name
  deployment_mode     = "Incremental"

  template_content = file("${path.module}/templates/storage.json")
}

# Anything consuming an output will show as changing when the template changes.
module "app_config" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = jsondecode(module.storage_deployment.output_content).resourceGroupName.value
  location = "eastus"
}

provider "azurerm" {
  features {
    template_deployment {
      # Deliberate: a destroy of the deployment record leaves ARM's resources in place rather than
      # deleting them. Read the constants in this module's Outputs before choosing either value.
      delete_nested_items_during_deletion = false
    }
  }

  # Required by the resource-provider module below.
  resource_provider_registrations = "none"
}

data "azurerm_client_config" "current" {}

variable "template_takes_credentials" {
  description = "Whether this template has any parameter that must not be a literal value."
  type        = bool
  default     = true
}

module "app_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-app"
  location = "eastus"

  management_locks = {
    no_delete = {
      lock_level = "CanNotDelete"
      notes      = "Holds resources created by an ARM deployment and therefore absent from Terraform state."
    }
  }
}

# 1. The template needs Microsoft.Compute registered, or ARM validation fails with an API-version error
#    that names nothing useful.
module "compute_provider" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-provider-registration.git?ref=v1.0.0"

  name = "Microsoft.Compute"
}

# 2. The vault holding the admin password. Its secret is created out of band.
module "app_vault" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-key-vault.git?ref=v1.0.0"

  name                = "kv-app-prod"
  resource_group_name = module.app_rg.name
  location            = module.app_rg.location
  tenant_id           = data.azurerm_client_config.current.tenant_id

  # Required for an ARM parameter reference: without it Azure cannot read the secret at deploy time.
  enabled_for_template_deployment = true
}

# 3. The deployment. Incremental, because rg-app holds more than this template describes.
module "vm_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vm"
  resource_group_name = module.app_rg.name
  deployment_mode     = "Incremental"

  template_content = file("${path.module}/templates/vm.json")

  parameters_content = jsonencode({
    vmName = { value = "vm-app-01" }
    adminPassword = {
      reference = {
        keyVault   = { id = module.app_vault.id }
        secretName = "vm-admin-password"
      }
    }
  })

  tags = {
    owner = "platform"
  }

  depends_on = [module.compute_provider]
}

check "deployment_is_additive_only" {
  assert {
    condition     = module.vm_deployment.deletes_resources_not_in_the_template == false
    error_message = "rg-app holds resources this template does not declare. Complete mode would delete them, and Azure performs that deletion outside any Terraform plan."
  }
}

check "credentials_are_not_literal" {
  assert {
    condition     = var.template_takes_credentials == false || module.vm_deployment.parameters_put_literal_values_in_state == false || length(module.vm_deployment.parameters_using_key_vault_references) > 0
    error_message = "This template takes credentials but no parameter uses a Key Vault reference -- a literal secret would be written into Terraform state."
  }
}

check "debug_logging_is_off" {
  assert {
    condition     = module.vm_deployment.debug_logging_enabled == false
    error_message = "ARM debug logging is on, which can record resolved Key Vault values into the deployment history."
  }
}

output "deployment_posture" {
  value = {
    id              = module.vm_deployment.id
    subscription    = module.vm_deployment.subscription_id
    template_source = module.vm_deployment.template_source
    mode            = module.vm_deployment.deployment_mode
    literal_params  = module.vm_deployment.parameters_with_literal_values
    kv_params       = module.vm_deployment.parameters_using_key_vault_references
    vm_fqdn         = jsondecode(module.vm_deployment.output_content).fqdn.value
  }
}

module "vnet_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vnet"
  resource_group_name = "rg-app"
  deployment_mode     = "Incremental"

  template_content         = file("${path.module}/templates/vnet.json")
  template_spec_version_id = var.baseline_template_spec_version_id # <-- one too many
}

Error: Invalid value for variable
  Exactly one of template_content or template_spec_version_id must be set -- the provider
  declares them mutually exclusive and requires one.

import {
  to = module.vnet_deployment.azurerm_resource_group_template_deployment.this
  id = "/subscriptions/${var.subscription_id}/resourceGroups/rg-app/providers/Microsoft.Resources/deployments/deploy-vnet"
}

module "vnet_deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group-template-deployment.git?ref=v1.0.0"

  name                = "deploy-vnet"
  resource_group_name = "rg-app"

  # Match what the existing deployment actually used, or the next apply re-runs it destructively.
  deployment_mode = "Incremental"

  template_content = file("${path.module}/templates/vnet.json")
}

variable "deployment_mode" {
  type = string
}

variable "template_content" {
  type    = string
  default = null
}

variable "template_spec_version_id" {
  type    = string
  default = null
}

variable "parameters_content" {
  type    = string
  default = null
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
}

21 outputs: 7 passthrough, 10 derived, 4 constant. No output is marked sensitive, and that is a considered position rather than an omission — parameters_content and output_content can both carry secrets, the provider marks neither, and marking them here would redact plan output without encrypting state. See Design Principles.

The resources this module creates are not in your state. Terraform owns the deployment record; ARM owns everything the template declares. That is the trade-off you accept in exchange for deploying a template at all, and almost every surprise in this module follows from it. terraform destroy behaves according to a provider setting rather than state. terraform plan cannot show you drift in a VM the template created. A management lock is the only protection that reaches those resources. Where a typed azurerm resource exists, prefer it; use this where one does not, or where the template is an artifact you are obliged to deploy as-is.

Complete mode is the sharpest edge in this library. It is required, has no default, is updatable in place, and its effect is a deletion performed by Azure — so it appears in no plan, removes no state entry, and does not distinguish between resources this configuration created and resources someone else's did. This suite's secure-by-default rule cannot apply, because a required argument leaves no empty call to make safe. What the module does instead is name the safe value inside the variable's description and its error message, and emit the consequence as deletes_resources_not_in_the_template — a name a reviewer cannot skim past the way they skim past "Complete".

The permission this module needs cannot be enumerated. Every other module in this library has a bounded RBAC table derived from its resource type. Here the required grant is a function of the caller's JSON: a template that assigns roles needs User Access Administrator, one that creates a vault needs the Key Vault actions. A template deployment is an arbitrary-code-execution primitive with ARM as the interpreter, and the permissions table says so rather than pretending otherwise. Note also that create and update run an ARM validate call before the write, so a role granting only write fails at a step nothing in the schema mentions.

Parameter secrecy has a right answer, and it is not sensitive = true. The provider reads deployed parameters back into state, keeping each value and stripping only its type, and does not mark the attribute sensitive. Marking the module's variable sensitive would redact the entire parameters blob from every plan — costing the reviewability of every ordinary parameter — while leaving the value in state, which is where it matters. ARM's Key Vault reference form removes the secret instead: the pointer is in state and Azure resolves the value at deploy time. The module cannot tell which parameter names are secrets, so it reports what it can parse — parameters_with_literal_values and parameters_using_key_vault_references — and leaves the judgement to a reviewer or a check.

And debug_level undoes that mitigation. Microsoft's own wording is that logging request or response content "could potentially expose sensitive data that is retrieved through the deployment operations". That includes the value a Key Vault reference resolved to, written into a deployment history readable by anyone with Reader on the resource group. It is the one setting in this module that is safe by default and unsafe if forgotten, which is why debug_logging_enabled exists to be asserted.

Two constraints re-expressed, and one deliberately not. ExactlyOneOf on the two template sources is absent from the binary schema, so the module re-expresses it — placed on template_content and referencing the other variable one-directionally, since two variables validating each other is a cycle. The name length limit is enforced because Azure documents it and the provider's regex does not. But parameters_content is only checked for JSON validity and the parameter-wrapper shape: whether a given parameter exists in the template, or has the right type, is knowable only to ARM.

output_content churn is by design. A CustomizeDiff marks it unknown whenever the template or parameters change, comparing normalised JSON so a reformat alone is free. The provider's source calls the consequence "the adverse effect": everything referencing an output shows as changing too.

features {} is the caller's — and unusually, one of its sub-blocks changes what this module's destroy does.

🔴 This suite's secure-by-default rule genuinely cannot apply to deployment_mode, and the compensations are the three available. The restrictive value is named inside the variable's own description and inside the validation error message; the resulting posture is emitted positively as deletes_resources_not_in_the_template so a policy check can require it; and the fact that the deletion is invisible to Terraform is recorded as a constant rather than left in prose. Saying the rule does not apply is more useful than restating it.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the source at a tag — ?ref=v1.0.0 — never a branch. Everything here is plan-only; a human applies from CI.

Before the first apply: read the template. Confirm deployment_mode, confirm every resource provider it uses is registered, and confirm no parameter carries a literal secret.

What nothing static can prove, and it is a lot: whether the template is valid ARM, whether its parameters match, whether the identity can create what it declares, and what Complete mode would delete. The module validates the shape of the JSON it is given and nothing about its meaning.

complete_mode_deletion_is_performed_by_azure_and_appears_in_no_plan = true
debug_level = ""
debug_logging_enabled = false
deletes_resources_not_in_the_template = false
deployment_mode = "Incremental"
destroying_this_deletes_what_the_template_created_unless_the_provider_is_told_otherwise = true
id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-app/providers/Microsoft.Resources/deployments/deploy-vm"
is_complete_mode = false
name = "deploy-vm"
output_content = "{\"fqdn\":{\"type\":\"String\",\"value\":\"vm-app-01.eastus.cloudapp.azure.com\"}}"
output_content_is_recomputed_whenever_the_template_or_parameters_change = true
parameter_names = [
  "adminPassword",
  "vmName",
]
parameter_values_are_read_back_into_state_and_are_not_redacted = true
parameters_put_literal_values_in_state = true
parameters_using_key_vault_references = [
  "adminPassword",
]
parameters_with_literal_values = [
  "vmName",
]
resource_group_name = "rg-app"
subscription_id = "00000000-0000-0000-0000-000000000000"
tags = {
  "owner" = "platform"
}
template_source = "template_content"
uses_a_template_spec = false

• azurerm_resource_group_template_deployment — provider resource documentation
• Microsoft.Resources/deployments template reference — Microsoft Learn, source of the 1–64 name limit and the detailLevel warning quoted above
• Deployment modes — Microsoft Learn, on what Complete mode deletes
• Use Key Vault to pass a secure parameter value — Microsoft Learn
• terraform-azurerm-subscription-template-deployment / -management-group-template-deployment / -tenant-template-deployment — the same deployment at wider scopes, none of which has a Complete mode
• terraform-azurerm-resource-provider-registration — for a provider the template needs
• terraform-azurerm-key-vault — for a referenced secret parameter
• terraform-azurerm-resource-group — supplies resource_group_name
• This module's SCOPE.md

💙 "Infrastructure as Code should be standardized, consistent, and secure."