☁️ Azure Service Bus Namespace Authorization Rule Terraform Module

One SAS authorization rule scoped to an entire Service Bus namespace (azurerm_servicebus_namespace_authorization_rule), with all three permissions closed by default. Targets hashicorp/azurerm ~> 4.0.

• 🔑 Declares one SAS authorization rule scoped to a whole Service Bus namespace, as a keystone resource named this.
• 🔒 All three permissions default to false, so the empty call grants nothing and the caller must name the access needed.
• ⚠️ States the scope plainly: a namespace rule reaches every queue and topic, including ones created later — so a rule written for one queue silently widens as the namespace grows.
• 🧭 Points at the better options first: an entity-scoped rule where a client needs one queue or topic, and Entra ID with an RBAC role where the client can use it at all.
• ✅ Mirrors every constraint the provider actually enforces, read from its source: the rule-name pattern, an anchored namespace-ID pattern, at-least-one-permission, and the manage-requires-listen-and-send rule — the last two on one variable, to avoid Terraform's validation cycle.
• 📤 Emits listen / send / manage so a security review reads the grant from state; manage in particular is meant to be asserted false.

💡 Why it matters: manage is not "read-write plus" — it permits creating and deleting queues, topics and subscriptions, so a namespace-scoped manage key can destroy the messaging topology rather than merely read or write messages. And every key this module produces is a bearer credential that lands in Terraform state, whether or not anyone reads the output. Both facts argue for the narrowest rule you can get away with, or for skipping SAS entirely.

If this module saves you time, please consider supporting its continued development:

• ⭐ Star the repository on GitHub.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart LR
  rg["terraform-azurerm-resource-group"]
  kv["terraform-azurerm-key-vault"]
  ra["terraform-azurerm-role-assignments: the Entra ID alternative to SAS"]
  ns["terraform-azurerm-servicebus-namespace: composite, owns queues topics subscriptions rules"]
  nsar["terraform-azurerm-servicebus-namespace-authorization-rule: WHOLE namespace"]
  qar["terraform-azurerm-servicebus-queue-authorization-rule: one queue"]
  tar["terraform-azurerm-servicebus-topic-authorization-rule: one topic"]
  cmk["terraform-azurerm-servicebus-namespace-customer-managed-key: system-assigned identity path"]
  dr["terraform-azurerm-servicebus-namespace-disaster-recovery-config: creates the ALIAS"]
  pe["terraform-azurerm-private-endpoint: private connectivity to the namespace"]
  ns2["a SECOND namespace in another region, Premium and EMPTY"]
  clients["clients: prefer the alias endpoint so a failover needs no reconfiguration"]

  rg -->|"resource_group_name, location"| ns
  kv -->|"key_vault_key_id, BY ID"| cmk
  ns -->|"id, BY ID"| nsar
  ns -->|"id, BY ID"| cmk
  ns -->|"id, BY ID"| pe
  ns -->|"id as primary_namespace_id"| dr
  ns2 -->|"id as partner_namespace_id, updatable"| dr
  ns -->|"queue_ids, BY ID"| qar
  ns -->|"topic_ids, BY ID"| tar
  nsar -->|"id as alias_authorization_rule_id, else ROOT key is used"| dr
  dr -->|"alias connection strings"| clients
  qar -->|"least-privilege connection string"| clients
  tar -->|"least-privilege connection string"| clients
  ra -->|"Data Sender or Data Receiver: no key to leak"| ns

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class ns keystone;
  class nsar,qar,tar,cmk,dr me;
  class rg,kv,ra,ns2,clients,pe sib;

flowchart TB
  scope["scope: the WHOLE namespace, including entities created LATER"]
  prefer["prefer an entity-scoped rule where a client needs one queue or topic"]
  entra["prefer Entra ID plus an RBAC role over SAS entirely: no key exists to leak"]
  addr["name and namespace_id: both force-new"]
  newkeys["replacing the rule ISSUES NEW KEYS, so every client on the old string breaks"]
  listen["listen: default FALSE"]
  send["send: default FALSE"]
  manage["manage: default FALSE, and it permits DELETING queues topics subscriptions"]
  guards["both cross-field checks live on manage: at-least-one, and manage requires listen plus send"]
  this["terraform-azurerm-servicebus-namespace-authorization-rule"]
  res["azurerm_servicebus_namespace_authorization_rule.this"]
  posture["outputs listen, send, manage so a review reads the grant from state"]
  creds["6 SENSITIVE outputs: primary and secondary key, connection string, and the alias forms"]
  alias["the alias forms are EMPTY unless the namespace is geo-DR paired"]

  scope -->|"read this first"| this
  prefer -->|"narrower alternative"| scope
  entra -->|"stronger alternative"| this
  addr -->|"identity"| this
  newkeys -->|"cost of replacement"| addr
  listen -->|"closed by default"| this
  send -->|"closed by default"| this
  manage -->|"the dangerous one"| this
  guards -->|"enforced at plan"| manage
  this -->|"creates"| res
  res -->|"emits"| posture
  res -->|"emits"| creds
  alias -->|"a client on the non-alias string does not survive failover"| creds

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class this me;
  class res keystone;
  class scope,prefer,entra,addr,newkeys,listen,send,manage,guards,posture,creds,alias sib;

Resource inventory

Schema notes that bite (verified against the live provider schema):

• name and namespace_id are both force-new. Replacing the rule issues new keys, so every client using the old connection string stops working at that moment.
• The provider's name validator is weaker than its own error message. The pattern is ^[a-zA-Z0-9][-._a-zA-Z0-9]{0,48}([a-zA-Z0-9])?$, whose trailing alphanumeric group is optional — so a-, x. and x_ are all accepted, although the message says a name "must start and end with a letter or number". The true maximum is 50 characters, not "less the 50". This module mirrors the pattern, because a check written from the message would refuse names the provider accepts — and a failed validation {} blocks terraform destroy as well as apply.
• Do not name this rule RootManageSharedAccessKey. Azure creates a rule by that name on every namespace automatically, with all three permissions granted. Declaring it here has Terraform adopt or overwrite a rule it did not create, and destroying it removes the namespace's built-in administrative credential.
• The geo-DR replication wait is bounded by timeouts.update on create, update AND delete. Raising timeouts.delete does not extend the slowest part of a destroy. That wait happens only when the namespace is Premium and has exactly one disaster-recovery config; otherwise it returns immediately.
• This resource carries a state upgrader and its two siblings do not. It has a schema version, and state written by an older provider has its stored ID re-parsed case-insensitively and rewritten in canonical casing. The queue- and topic-scoped rules carry neither, so a mis-cased ID in their state is left as found. It is the one genuine behavioural difference between three otherwise near-identical resources, and it matters only when adopting old state.
• The provider's permission rules live in its CustomizeDiff, which runs inside the provider during plan and needs credentials; the module's own validation {} blocks move both refusals offline.
• All three permission booleans are optional to the provider, so a rule granting nothing is accepted. This module rejects that at plan.
• The service requires listen and send whenever manage is true; validated at plan here.
• manage permits creating and deleting queues, topics and subscriptions — not merely message access.
• The scope is the whole namespace including entities created later, so the grant widens as the namespace grows without anyone editing the rule.
• The *_connection_string_alias outputs are empty unless the namespace participates in a geo-DR pairing. A client using the non-alias string does not survive a failover.
• The namespace is addressed by Resource ID, so the reference creates a real Terraform dependency (unlike the Event Hubs equivalents, which take names). The module's check on it is anchored with $, which matters more here than on the queue- and topic-scoped siblings: every Service Bus child ID extends the namespace ID, so an unanchored pattern would accept a queue ID, a topic ID or this rule's own ID and silently scope the rule elsewhere.
• Deleting the rule invalidates its keys immediately — a client-visible event.
• This resource type has no tags surface.

• Contributor on the namespace's resource group, or a custom role covering Microsoft.ServiceBus/namespaces/authorizationRules/*.
• Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action to read the keys and connection strings this module emits.

⚠️ Note the operational consequence: whoever can apply this configuration can mint a namespace-wide credential — and if they set manage, one that can delete every queue and topic in the namespace. Scope the role accordingly.

• An existing Service Bus namespace.
• A decision about whether SAS is needed at all. If the client can use Entra ID with an RBAC role (Azure Service Bus Data Sender / Data Receiver), that is the stronger option and this module is unnecessary.
• The caller configures the provider "azurerm" { features {} } block, auth, and subscription.

terraform-azurerm-servicebus-namespace-authorization-rule/
├── providers.tf   # required_version >= 1.12.0; azurerm ~> 4.0; no provider block
├── variables.tf   # three permissions closed by default; both guards on `manage`; timeouts tail
├── main.tf        # keystone azurerm_servicebus_namespace_authorization_rule.this
├── outputs.tf     # id, name, the permission trio, and 6 sensitive credentials
├── README.md      # this document
├── SCOPE.md       # cross-module contract
├── LICENSE        # MIT
└── .gitignore     # canonical library ignore set

provider "azurerm" {
  features {}
}

# A producer that publishes across the namespace.
module "sb_publisher_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-authorization-rule.git?ref=v1.0.0"

  name         = "publisher"
  namespace_id = module.sb_namespace.id # BY ID — a real dependency

  send = true
  # listen and manage stay false.
}

🔒 Nothing is granted unless you type it. And consider whether this client could use Entra ID instead — see example 3.

ℹ️ The caller owns the provider, its authentication, and the mandatory features {} block. This module never declares them.

Consumes

Emits

The examples below reference existing resources by ID or name rather than creating them; this module owns only its own resource. Those references are declared inputs:

variable "app_identity_principal_id" {
  description = "identity principal id of an existing app that these examples reference but do not create."
  type        = string
}

variable "orders_app_identity_principal_id" {
  description = "identity principal id of an existing orders app that these examples reference but do not create."
  type        = string
}

variable "sb_namespace_dr_id" {
  description = "id of an existing sb namespace dr that these examples reference but do not create."
  type        = string
}

module "sb_publisher_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-authorization-rule.git?ref=v1.0.0"

  name         = "publisher"
  namespace_id = module.sb_namespace.id

  send = true
}

module "sb_consumer_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-authorization-rule.git?ref=v1.0.0"

  name         = "consumer"
  namespace_id = module.sb_namespace.id

  listen = true
}

module "sb_data_sender" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.sb_namespace.id

  role_assignments = {
    app_sender = {
      role_definition_name = "Azure Service Bus Data Sender"
      principal_id         = var.app_identity_principal_id
    }
  }
}

module "orders_queue_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-queue-authorization-rule.git?ref=v1.0.0"

  name     = "orders-consumer"
  queue_id = module.sb_namespace.queue_ids["orders"]

  listen = true
}

module "sb_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-authorization-rule.git?ref=v1.0.0"

  name         = "useless"
  namespace_id = module.sb_namespace.id
  # ❌ no permissions
}

Error: Invalid value for variable

  At least one of listen, send, or manage must be true — a rule with no permissions is
  accepted by neither the service nor any useful client.

manage = true # ❌ on its own

Error: Invalid value for variable

  When manage is true, both listen and send must also be true — the service requires it.

# ✅ The shape the service accepts:
listen = true
send   = true
manage = true

listen = true
send   = true
manage = true # 🔒 can DELETE queues, topics and subscriptions

output "sb_rule_grants" {
  description = "Any manage = true here is a rule that can delete the messaging topology."
  value = {
    for k, m in module.sb_rules : k => {
      listen = m.listen
      send   = m.send
      manage = m.manage
    }
  }
}

# All six are marked sensitive = true.
module.sb_publisher_rule.primary_connection_string
module.sb_publisher_rule.primary_key

primary_key    ← in use
secondary_key  ← standby

output "publisher_endpoint" {
  # Empty string unless the namespace is in a geo-DR pairing.
  value     = module.sb_publisher_rule.primary_connection_string_alias
  sensitive = true
}

module "sb_dr" {
  source                      = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-disaster-recovery-config.git?ref=v1.0.0"

  name                        = "orders-alias"
  primary_namespace_id        = module.sb_namespace.id
  partner_namespace_id        = var.sb_namespace_dr_id
  alias_authorization_rule_id = module.sb_publisher_rule.id # ← this module's id
}

locals {
  rules = {
    publisher = { listen = false, send = true }
    consumer  = { listen = true, send = false }
  }
}

module "sb_rules" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-authorization-rule.git?ref=v1.0.0"
  for_each = local.rules

  name         = each.key
  namespace_id = module.sb_namespace.id

  listen = each.value.listen
  send   = each.value.send
}

name = "publisher-v2" # forces replacement → NEW KEYS

provider "azurerm" {
  features {}
}

# 1 · The resource group.
module "sb_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-messaging-eastus2"
  location = "eastus2"
}

# 2 · The namespace, with its queues. Premium so geo-DR is available later.
module "sb_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace.git?ref=v1.0.0"

  name                = "sbns-orders-eastus2"
  resource_group_name = module.sb_rg.name
  location            = module.sb_rg.location
  sku                 = "Premium"

  queues = {
    orders = {
      name               = "orders"
      max_delivery_count = 10
    }
  }
}

# 3 · The PREFERRED path for anything that can use it: Entra ID, no key at all.
module "sb_app_sender" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.sb_namespace.id

  role_assignments = {
    app_sender = {
      role_definition_name = "Azure Service Bus Data Sender"
      principal_id         = var.orders_app_identity_principal_id
    }
  }
}

# 4 · SAS for the client that cannot use Entra ID — scoped to ONE queue, not the namespace.
module "orders_queue_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-queue-authorization-rule.git?ref=v1.0.0"

  name     = "partner-feed"
  queue_id = module.sb_namespace.queue_ids["orders"]

  send = true
}

# 5 · A namespace-scoped rule — this module — used where it is genuinely warranted:
#     backing the geo-DR alias in step 6 with something other than the root manage key.
module "sb_alias_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-authorization-rule.git?ref=v1.0.0"

  name         = "alias-endpoint"
  namespace_id = module.sb_namespace.id

  listen = true
  send   = true
  # manage stays FALSE — the alias needs message access, not the power to delete queues.
}

# 6 · The pairing. Without step 5's id, these alias strings would carry the ROOT manage key.
module "sb_dr" {
  source                      = "git::https://github.com/microsoftexpert/terraform-azurerm-servicebus-namespace-disaster-recovery-config.git?ref=v1.0.0"

  name                        = "orders-alias"
  primary_namespace_id        = module.sb_namespace.id
  partner_namespace_id        = var.sb_namespace_dr_id
  alias_authorization_rule_id = module.sb_alias_rule.id
}

output "messaging_access_review" {
  description = "Every SAS grant in one place. manage should be false throughout."
  value = {
    alias_rule = {
      listen = module.sb_alias_rule.listen
      send   = module.sb_alias_rule.send
      manage = module.sb_alias_rule.manage # expect false
    }
    alias_uses_root_key = module.sb_dr.uses_root_manage_key # expect false
  }
}

Required (both force-new): name, namespace_id.

Permissions — all default false, at least one required: listen, send, manage.

Universal tail: timeouts. This resource type does not support tags.

variable "name" {
  # force-new. Replacing the rule ISSUES NEW KEYS, so every client on the old connection
  # string stops working at that moment.
  type = string
}

variable "namespace_id" {
  # force-new. The namespace's RESOURCE ID — so the reference creates a real Terraform
  # dependency (unlike the Event Hubs equivalents, which take names).
  type = string
}

variable "listen" {
  # Receive access across the WHOLE namespace, including entities created later.
  type    = bool
  default = false
}

variable "send" {
  # Send access across the WHOLE namespace, including entities created later.
  type    = bool
  default = false
}

variable "manage" {
  # 🔒 NOT "read-write plus": manage permits creating and DELETING queues, topics and
  #    subscriptions. A namespace-scoped manage key can destroy the messaging topology.
  #
  # BOTH cross-field checks live HERE, reading listen/send one-directionally, because
  # Terraform rejects validations that reference each other:
  #   - at least one of listen / send / manage must be true (the provider accepts none)
  #   - when manage is true, listen and send must also be true (the service requires it)
  type    = bool
  default = false
}

variable "timeouts" {
  # ⚠️ Deleting the rule invalidates its keys immediately — a client-visible event.
  type    = object({ create = optional(string), read = optional(string), update = optional(string), delete = optional(string) })
  default = null
}

Six outputs are credentials and all are marked sensitive. They are in Terraform state whether or not a consumer reads them.

• The scope is the headline fact. A namespace-scoped rule reaches every queue and topic in the namespace including ones created later, so a rule written for one queue becomes an over-privileged credential as the namespace grows, without anyone editing it. That is why the documentation points at the entity-scoped siblings before describing its own fields.
• manage is the field to be careful with, and its name undersells it: it permits creating and deleting queues, topics and subscriptions, so a holder can destroy the messaging topology rather than merely read or write messages. It defaults to false and is emitted as an output specifically so a review can assert it stays false.
• The module argues for Entra ID rather than presenting SAS as neutral. A SAS key is a bearer credential that lands in Terraform state; an RBAC role assignment is not. Where a client can authenticate with a managed identity, the role is strictly better — and a module that quietly offers only the weaker mechanism is doing its reader a disservice.
• Both cross-field validations live on manage. Terraform rejects validations that reference each other, so a matching check on listen or send would create a cycle — the same trap already hit on the Event Hubs authorization rules and kusto-script. Consolidating them on one variable is the established fix in this library.
• All three permissions default closed, following terraform-azurerm-eventhub-namespace-authorization-rule. The empty call grants nothing, so access is always something a caller typed.
• Sensitive marking is not confidentiality. It keeps keys out of console output and CI logs; the values still sit in plaintext in state. Saying so is more useful than implying the outputs are safe.
• Rotation is a data-plane operation. The service maintains a primary/secondary pair so a client can be migrated between them; regenerating a key happens outside Terraform. This module deliberately has no "rotate" input, because adding one would misrepresent where the operation lives.
• The namespace is consumed by Resource ID, unlike the Event Hubs equivalents which take names — so ordering is implicit here and a rename surfaces as a plan diff rather than a run-time failure.
• The alias outputs are empty absent a geo-DR pairing, which is documented because an empty credential output otherwise reads as a defect. The consequential half is that a client on the non-alias string does not survive a failover.
• features {} dependence. The module carries no provider {} block. If it appears not to initialize in isolation, the cause is a missing caller-side provider "azurerm" { features {} }.

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the module with ?ref=v1.0.0 — never a branch.
• This library is plan-only during authoring; a human runs terraform plan / apply from CI against real credentials.
• Before applying: confirm the client genuinely cannot use Entra ID, and that a namespace-scoped rule is needed rather than an entity-scoped one.
• Treat a plan that replaces this rule as a coordinated client rollout — new keys are issued and every client on the old string breaks.
• For a geo-DR paired namespace, hand clients the alias connection string, not the namespace-specific one.

• terraform validate proves the configuration is internally consistent and type-correct against the pinned provider schema. The module carries seven validation {} blocks — the rule-name pattern and a not-a-Resource-ID check on name, an anchored pattern and a shape check on namespace_id, at-least-one-permission, manage requiring listen and send, and a Go-duration check on timeouts. Through a module call they are evaluated at plan; what matters is that none of them needs credentials.
• terraform fmt -check enforces canonical formatting.
• Neither command calls Azure. Only terraform plan (run by a human, from CI) exercises the ARM API — the module ships without any cloud apply.
• What only apply exercises: whether the namespace exists, and whether the deploying identity may list keys.
• What nothing exercises: whether the grant is appropriate — whether this client needed namespace scope rather than one queue, and whether it needed SAS rather than an RBAC role. Those are review questions, which is why the permission booleans are emitted as outputs rather than left implicit in configuration.

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

id                                = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-messaging-eastus2/providers/Microsoft.ServiceBus/namespaces/sbns-orders-eastus2/authorizationRules/alias-endpoint"
name                              = "alias-endpoint"
namespace_id                      = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-messaging-eastus2/providers/Microsoft.ServiceBus/namespaces/sbns-orders-eastus2"
listen                            = true
send                              = true
manage                            = false
primary_key                       = (sensitive value)
secondary_key                     = (sensitive value)
primary_connection_string         = (sensitive value)
secondary_connection_string       = (sensitive value)
primary_connection_string_alias   = (sensitive value)
secondary_connection_string_alias = (sensitive value)

• azurerm provider — azurerm_servicebus_namespace_authorization_rule
• Service Bus authentication and authorization
• Authenticate with shared access signatures
• Authenticate with Microsoft Entra ID and Azure RBAC
• Service Bus geo-disaster recovery
• Sibling modules: terraform-azurerm-servicebus-namespace, terraform-azurerm-servicebus-queue-authorization-rule, terraform-azurerm-servicebus-topic-authorization-rule, terraform-azurerm-servicebus-namespace-disaster-recovery-config, terraform-azurerm-servicebus-namespace-customer-managed-key, terraform-azurerm-role-assignments.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."