☁️ Azure Site Recovery Protection Container Terraform Module

Creates the bucket inside a Site Recovery fabric that replicated machines live in, targeting hashicorp/azurerm ~> 4.0.

• 📦 Manages azurerm_site_recovery_protection_container — the fabric's direct child, and where replicated machines live.
• 🔗 Consumes terraform-azurerm-site-recovery-fabric's name, so the fabric arrives as a bare string.
• 🧮 Reconstructs the container's, fabric's and vault's paths at plan time, in the form the fabric modules already emit.
• 🕳️ The create payload is completely empty. There is nothing to configure — only where the container is.
• 🔒 Nothing here can be edited. No Update function, so all four arguments are force-new and timeouts has three keys.
• ⚠️ Seven constants, including the one that makes this resource unlike three of its four siblings: it does not absorb the API's HTTP 400.

💡 Why it matters: the fabric arrives as a NAME, which means Terraform builds no ordering edge from a literal and a name matching somebody else's fabric is accepted without complaint. This module emits the fabric's path in the same form both fabric-creating modules emit, so a check block can prove the container landed where the composition intended.

If this module saved you time:

• ⭐ Star the repository — it helps others find it.
• 💼 Connect on LinkedIn — linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee — buymeacoffee.com/microsoftexpert

This module is terraform-azurerm-site-recovery-protection-container, one of the fourteen blue nodes — all fourteen authored site_recovery_* modules share this diagram. The dark node is not a module: it is the single ARM resource type that the fabric and Hyper-V site modules both write, which is why those two can silently collide.

flowchart TB
  RG["terraform-azurerm-resource-group"]
  VAULT["terraform-azurerm-recovery-services-vault"]
  FABRIC["terraform-azurerm-site-recovery-fabric"]
  HVS["terraform-azurerm-site-recovery-services-vault-hyperv-site"]
  PC["terraform-azurerm-site-recovery-protection-container"]
  POLICY["terraform-azurerm-site-recovery-replication-policy"]
  HVPOL["terraform-azurerm-site-recovery-hyperv-replication-policy"]
  VMPOL["terraform-azurerm-site-recovery-vmware-replication-policy"]
  PCM["terraform-azurerm-site-recovery-protection-container-mapping"]
  HVASSOC["terraform-azurerm-site-recovery-hyperv-replication-policy-association"]
  VMASSOC["terraform-azurerm-site-recovery-vmware-replication-policy-association"]
  NM["terraform-azurerm-site-recovery-network-mapping"]
  HVNM["terraform-azurerm-site-recovery-hyperv-network-mapping"]
  RVM["terraform-azurerm-site-recovery-replicated-vm"]
  RRP["terraform-azurerm-site-recovery-replication-recovery-plan"]
  ARMF["ONE ARM type, TWO resource types: vaults replicationFabrics. Same name plus same vault means one object, silently"]
  ARMP["ONE ARM type, THREE resource types: vaults replicationPolicies. A2A, Hyper-V and VMware policies are interchangeable at the API"]
  ARMM["ONE ARM type, THREE resource types: replicationProtectionContainerMappings. The hardest group to assert on"]
  VM["terraform-azurerm-linux-virtual-machine or windows-virtual-machine: wire its id, NOT its virtual_machine_id"]
  VNET["terraform-azurerm-virtual-network: the failover network, the test network and the source network"]
  RUNBOOK["an Azure Automation runbook: a plan action names it by id and it runs with the automation account's own permissions. NOT bounded by vault RBAC"]
  VMWVM["terraform-azurerm-site-recovery-vmware-replicated-vm"]
  HOSTS["the Hyper-V hosts themselves, registered with a five-day vault key. NO azurerm resource does this"]
  APPL["the VMware replication appliance, deployed on-premises and registered against the vault. NO azurerm resource does this either"]
  VMM["the System Center VMM server, registered by installing the Site Recovery Provider on it. NO azurerm resource does this either"]
  VCENTER["the vCenter machines and the credentials stored on the appliance. source_vm_name and physical_server_credential_name are FRIENDLY names matched at apply time, and that credential is root or admin ON the source machine"]

  RG -->|"resource_group_name and location"| VAULT
  VAULT -->|"name, NOT id, so there is no dependency edge from a literal"| FABRIC
  VAULT -->|"id, NOT name: this sibling takes the vault ID instead"| HVS
  VAULT -->|"name, and NO fabric: a policy belongs to the vault"| POLICY
  VAULT -->|"id, a second convention on the same parent"| HVPOL
  VAULT -->|"id, and the association takes the SAME vault argument"| VMPOL
  VAULT -->|"id: BOTH the fabric and the container are discovered under it at apply time"| VMASSOC
  VAULT -->|"name plus resource group, a third convention again"| RVM
  VAULT -->|"id: the ONLY Resource ID this module resolves anything from"| HVNM
  VAULT -->|"id, and BOTH fabrics as ids: a fourth convention"| RRP
  FABRIC -->|"hardcoded instance type: an Azure fabric"| ARMF
  HVS -->|"hardcoded instance type: HyperVSite, absent from Swagger"| ARMF
  POLICY -->|"hardcoded A2A payload"| ARMP
  HVPOL -->|"hardcoded Hyper-V to Azure payload"| ARMP
  VMPOL -->|"hardcoded InMageRcm payload: the MODERNIZED VMware provider"| ARMP
  PCM -->|"container taken by name and by id"| ARMM
  HVASSOC -->|"container discovered under the fabric at apply time"| ARMM
  VMASSOC -->|"fabric AND container both discovered under the vault"| ARMM
  FABRIC -->|"name, so a Hyper-V site's name is equally legal here"| PC
  FABRIC -->|"name, for BOTH sides: ARM names, not friendly names"| NM
  FABRIC -->|"id, for BOTH sides, and neither is compared to the vault"| RRP
  PC -->|"name for the source side, id for the target side"| PCM
  POLICY -->|"id, where the container beside it is taken by name"| PCM
  HVPOL -->|"id, the only consumer of a Hyper-V policy"| HVASSOC
  HVS -->|"id, and the protection container is discovered from it"| HVASSOC
  VMPOL -->|"id, the only consumer of a VMware policy"| VMASSOC
  VNET -->|"id, twice. Only the SOURCE id is parsed by the provider"| NM
  VNET -->|"id, the target only. The SOURCE network is a VMM friendly name"| HVNM
  FABRIC -->|"source fabric by NAME, target fabric by ID: one resource, two conventions"| RVM
  PC -->|"source container by NAME, target container by ID"| RVM
  POLICY -->|"id, and a Hyper-V or VMware policy id would also be accepted"| RVM
  VM -->|"the machine being protected"| RVM
  VNET -->|"the failover network and the test network, both Optional AND Computed"| RVM
  PCM -->|"makes a container pair eligible before any item can replicate"| RVM
  NM -->|"decides where an Azure-to-Azure failover lands"| RVM
  HVNM -->|"decides where a VMM Hyper-V failover lands, for every machine on the source network"| VMM
  RVM -->|"ids, into ORDERED boot groups: group 2 starts only after group 1 has finished"| RRP
  VMWVM -->|"ids, into the same ORDERED boot groups as the Azure-to-Azure items"| RRP
  VAULT -->|"id ALONE, a fifth convention: the fabric AND the container are discovered from it, and there must be exactly ONE container"| VMWVM
  VMPOL -->|"id, its second consumer: the policy this VMware item replicates under"| VMWVM
  VNET -->|"the failover network and the test network. test_network_id is read back and NEVER updated"| VMWVM
  VMASSOC -->|"makes the discovered container eligible before any VMware machine can replicate"| VMWVM
  RUNBOOK -->|"id, from a plan pre-action or post-action"| RRP
  APPL -->|"appliance_name is its FRIENDLY name, matched against the fabric process servers. Microsoft: it cannot be changed once set"| VMWVM
  VCENTER -->|"source_vm_name and physical_server_credential_name, both matched by name against records the appliance discovered"| VMWVM
  HOSTS -->|"register into the site out of band, invisible to Terraform"| HVS
  HOSTS -->|"registration is what creates the container this record needs"| HVASSOC
  APPL -->|"required before any VMware machine can be enrolled"| VMASSOC
  VMM -->|"the fabric AND the source network are found under it by FRIENDLY NAME at apply time"| HVNM

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff
  classDef keystone fill:#004578,stroke:#002438,color:#ffffff
  classDef sibling fill:#F3F6F9,stroke:#8A9BA8,color:#1B1F23
  class FABRIC,HVS,PC,POLICY,HVPOL,VMPOL,PCM,HVASSOC,VMASSOC,NM,HVNM,RVM,RRP,VMWVM me
  class ARMF,ARMP,ARMM keystone
  class RG,VAULT,VM,VNET,RUNBOOK,VCENTER,HOSTS,APPL,VMM sibling

⚠️ Read the arrows into this module. The fabric arrives as a name, and so does the vault — neither is an ID, so Terraform holds no dependency edge from a literal.

ℹ️ Because a Hyper-V site is the same ARM type as a fabric, its name is equally legal as recovery_fabric_name.

One keystone resource, no children, and an empty payload. The timeouts block has three keys, not four.

flowchart TB
  IN_ID["name plus recovery_fabric_name plus recovery_vault_name plus resource_group_name: which fabric, and what to call the container"]
  THIS["azurerm_site_recovery_protection_container.this"]
  EMPTY["the create payload: completely empty. This resource has no configuration at all"]
  OUT_PATHS["three subscription-less paths: the container, its fabric, its vault"]
  OUT_ID["id for a mapping's target side, name for its source side"]
  OUT_CONST["seven constants: no update path, an empty payload, and the one resource here that does not absorb a 400"]

  IN_ID --> THIS
  THIS --> EMPTY
  IN_ID -->|"recombined without the subscription, which a module cannot know"| OUT_PATHS
  THIS -->|"id, known only after apply"| OUT_ID
  THIS --> OUT_CONST
  OUT_PATHS -->|"compare the fabric path against a fabric module's own, since the fabric arrives as a bare NAME"| OUT_CONST

  classDef me fill:#0078D4,stroke:#004578,color:#ffffff
  classDef keystone fill:#004578,stroke:#002438,color:#ffffff
  classDef sibling fill:#F3F6F9,stroke:#8A9BA8,color:#1B1F23
  class THIS keystone
  class OUT_PATHS me
  class IN_ID,EMPTY,OUT_ID,OUT_CONST sibling

Resource inventory

ℹ️ This module does not share a shape diagram with any sibling. The replication policy has two configuration arguments and a rule between them; this one has no configuration at all.

Schema notes that bite

• 🔴 The create payload is completely empty — CreateProtectionContainerInput{Properties: &CreateProtectionContainerInputProperties{}}. The four arguments are not "the important ones", they are all of them.
• 🔴 All four arguments are force-new and there is no Update function. resource_group_name gets ForceNew invisibly from commonschema.ResourceGroupName().
• 🔴 This resource does not tolerate the API's HTTP 400 for a missing record. azurerm_site_recovery_fabric, azurerm_site_recovery_replication_policy and azurerm_site_recovery_network_mapping all guard with !WasNotFound(...) && !wasBadRequestWithNotExist(...); this one and azurerm_site_recovery_protection_container_mapping guard on WasNotFound alone.
• ⚠️ Two of four arguments are effectively unvalidated upstream. name and recovery_fabric_name get only StringIsNotEmpty, which accepts whitespace; recovery_vault_name and resource_group_name get real anchored validators.
• ⚠️ The fabric is referenced by NAME, so Terraform holds no ordering edge and a name matching a fabric the configuration does not own is accepted.
• ⚠️ A Hyper-V site's name is a legal recovery_fabric_name, because that resource creates the same ARM type as a fabric.
• ⚠️ The read sets every attribute from the parsed Resource ID, not from the response body — consistent with an empty payload, and it means drift beyond existence cannot be detected.
• ℹ️ There is no tags, no location and no SchemaVersion. Tag the vault instead.

• 🔒 Site Recovery Contributor cannot create or delete the vault, per Microsoft's own description of the role.
• 🔒 Site Recovery Operator and Site Recovery Reader are not sufficient. The Operator role explicitly cannot "register new infrastructure"; the Reader role is read-only.
• ⚠️ Backup Contributor is the wrong role, and it is an easy mistake — a Recovery Services vault serves both Azure Backup and Site Recovery, and Backup Contributor grants nothing over replicationFabrics.
• ✅ Plan access is not credential access. No secret is read or emitted, and no output is sensitive.

1. Microsoft.RecoveryServices registered in the subscription.
2. An existing Recovery Services vault.
3. An existing Site Recovery fabric, referenced here by name — a Hyper-V site counts.
4. A name unique within that fabric. Nothing enforces it across configurations.
5. An understanding that this container is empty and stays empty until mappings and replicated items fill it.

terraform-azurerm-site-recovery-protection-container/
├── providers.tf     # required_version + the pinned azurerm; no provider block
├── variables.tf     # 5 variables, 7 validations
├── main.tf          # 3 locals + the keystone azurerm_site_recovery_protection_container.this
├── outputs.tf       # 15 outputs: 5 passthrough, 3 derived, 7 constant
├── README.md        # this file
├── SCOPE.md         # the cross-module contract
├── LICENSE          # MIT
└── .gitignore

module "dr_container_primary" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container.git?ref=v1.0.0"

  name                 = "container-eastus"
  recovery_fabric_name = module.dr_fabric_primary.name
  recovery_vault_name  = module.dr_vault.name
  resource_group_name  = module.dr_rg.name
}

⚠️ Every argument is force-new. There is no in-place edit on this resource, and replacing a container affects the mappings that reference it and the replicated items inside it.

ℹ️ The caller configures the provider, its authentication and its features {} block. This module declares none of them.

Consumes

Emits

module "dr_container_primary" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container.git?ref=v1.0.0"

  name                 = "container-eastus"
  recovery_fabric_name = module.dr_fabric_primary.name
  recovery_vault_name  = module.dr_vault.name
  resource_group_name  = module.dr_rg.name
}

# There is no size, no tier, no policy, no network, no encryption setting.
# The provider sends: CreateProtectionContainerInputProperties{}

  # CORRECT -- creates a dependency edge, so Terraform orders the fabric first
  recovery_fabric_name = module.dr_fabric_primary.name

  # WRONG -- a literal gives Terraform nothing to order against
  # recovery_fabric_name = "fabric-eastus"

check "the_container_is_in_our_own_fabric" {
  assert {
    condition = (
      module.dr_container_primary.fabric_path_within_the_subscription
      == module.dr_fabric_primary.fabric_path_within_the_subscription
    )
    error_message = "The protection container's fabric is not the fabric this configuration declares."
  }
}

# The Hyper-V site. A DIFFERENT Terraform resource that writes the SAME ARM type as a fabric.
module "hyperv_site" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-services-vault-hyperv-site.git?ref=v1.0.0"

  name              = "contoso-hyperv-site"
  recovery_vault_id = module.dr_vault.id # note: the ID here, where the fabric module takes a name
}

module "hyperv_container" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container.git?ref=v1.0.0"

  name                 = "container-hyperv"
  recovery_fabric_name = module.hyperv_site.name # a Hyper-V site, not an "azurerm_site_recovery_fabric"
  recovery_vault_name  = module.hyperv_site.recovery_vault_name
  resource_group_name  = module.hyperv_site.resource_group_name
}

module "dr_mapping" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container-mapping.git?ref=v1.0.0"

  name                 = "mapping-primary-to-secondary"
  recovery_fabric_name = module.dr_container_primary.recovery_fabric_name
  recovery_vault_name  = module.dr_container_primary.recovery_vault_name
  resource_group_name  = module.dr_container_primary.resource_group_name

  # The SOURCE container by name, the TARGET container by id. Both from this module.
  recovery_source_protection_container_name = module.dr_container_primary.name
  recovery_target_protection_container_id   = module.dr_container_secondary.id
  recovery_replication_policy_id            = module.dr_policy.id
}

  # Changing ANY of these four destroys and recreates the container:
  name                 = "container-eastus"
  recovery_fabric_name = module.dr_fabric_primary.name
  recovery_vault_name  = module.dr_vault.name
  resource_group_name  = module.dr_rg.name

  timeouts = {
    create = "45m"
    read   = "10m"
    delete = "45m"
  }

  # WRONG, and it produces no error, no warning and no plan diff:
  # timeouts = { create = "45m", update = "45m" }

azurerm_site_recovery_fabric              !WasNotFound(...) && !wasBadRequestWithNotExist(...)
azurerm_site_recovery_replication_policy  !WasNotFound(...) && !wasBadRequestWithNotExist(...)
azurerm_site_recovery_network_mapping     !WasNotFound(...) && !wasBadRequestWithNotExist(...)
azurerm_site_recovery_protection_container   !WasNotFound(...)                        <-- this one
azurerm_site_recovery_protection_container_mapping  !WasNotFound(...)             <-- and this one

  name                 = "container-eastus"          # StringIsNotEmpty upstream -> 2 module rules
  recovery_fabric_name = module.dr_fabric_primary.name # StringIsNotEmpty upstream -> 2 module rules
  recovery_vault_name  = module.dr_vault.name        # anchored regex upstream    -> none, deliberately
  resource_group_name  = module.dr_rg.name           # three checks upstream      -> none, deliberately

check "no_two_containers_collide" {
  assert {
    condition = length(distinct([
      module.dr_container_primary.container_path_within_the_subscription,
      module.dr_container_secondary.container_path_within_the_subscription,
    ])) == 2
    error_message = "Two protection containers resolve to the same path, so they are one Azure object."
  }
}

locals {
  containers = {
    web = "container-web"
    db  = "container-db"
    app = "container-app"
  }
}

module "dr_containers" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container.git?ref=v1.0.0"
  for_each = local.containers

  name                 = each.value
  recovery_fabric_name = module.dr_fabric_primary.name
  recovery_vault_name  = module.dr_vault.name
  resource_group_name  = module.dr_rg.name
}

output "container_names" {
  value = { for k, m in module.dr_containers : k => m.name }
}

# There is no `tags` argument on this resource. Tag the vault instead:
module "dr_vault" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-recovery-services-vault.git?ref=v1.0.0"

  name                = "vault-dr-prod"
  location            = module.dr_rg.location
  resource_group_name = module.dr_rg.name
  sku                 = "Standard"

  tags = { environment = "prod", owner = "platform" }
}

module "dr_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-dr-prod"
  location = "eastus"

  tags = local.platform_tags
}

module "dr_vault" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-recovery-services-vault.git?ref=v1.0.0"

  name                = "vault-dr-prod"
  location            = module.dr_rg.location
  resource_group_name = module.dr_rg.name
  sku                 = "Standard"

  tags = local.platform_tags
}

# Both ends of the pair. These take the vault by NAME.
module "dr_fabric_primary" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-fabric.git?ref=v1.0.0"

  name                = "fabric-eastus"
  location            = "eastus"
  recovery_vault_name = module.dr_vault.name
  resource_group_name = module.dr_rg.name
}

module "dr_fabric_secondary" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-fabric.git?ref=v1.0.0"

  name                = "fabric-westus2"
  location            = "westus2"
  recovery_vault_name = module.dr_vault.name
  resource_group_name = module.dr_rg.name
}

# A container in each fabric. The source side of a mapping takes the name, the target side the id.
module "dr_container_primary" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container.git?ref=v1.0.0"

  name                 = "container-eastus"
  recovery_fabric_name = module.dr_fabric_primary.name
  recovery_vault_name  = module.dr_vault.name
  resource_group_name  = module.dr_rg.name
}

module "dr_container_secondary" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container.git?ref=v1.0.0"

  name                 = "container-westus2"
  recovery_fabric_name = module.dr_fabric_secondary.name
  recovery_vault_name  = module.dr_vault.name
  resource_group_name  = module.dr_rg.name
}

# The policy takes NO fabric -- it belongs to the vault, so it can be created alongside the fabrics.
module "dr_policy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-replication-policy.git?ref=v1.0.0"

  name                = "policy-24h"
  recovery_vault_name = module.dr_vault.name
  resource_group_name = module.dr_rg.name

  recovery_point_retention_in_minutes                  = 1440
  application_consistent_snapshot_frequency_in_minutes = 240
}

check "both_containers_are_in_our_own_fabrics" {
  assert {
    condition = (
      module.dr_container_primary.fabric_path_within_the_subscription == module.dr_fabric_primary.fabric_path_within_the_subscription
      && module.dr_container_secondary.fabric_path_within_the_subscription == module.dr_fabric_secondary.fabric_path_within_the_subscription
    )
    error_message = "A protection container is attached to a fabric this configuration does not declare."
  }
}

check "the_whole_topology_is_in_one_vault" {
  assert {
    condition = length(distinct([
      module.dr_fabric_primary.vault_path_within_the_subscription,
      module.dr_fabric_secondary.vault_path_within_the_subscription,
      module.dr_container_primary.vault_path_within_the_subscription,
      module.dr_container_secondary.vault_path_within_the_subscription,
      module.dr_policy.vault_path_within_the_subscription,
    ])) == 1
    error_message = "The replication topology spans more than one Recovery Services vault, which cannot work."
  }
}

Identity — name, recovery_fabric_name, recovery_vault_name, resource_group_name, all force-new. Universal tail — timeouts only. There is no tags and no location on this resource.

variable "name" { type = string }                 # REQUIRED, force-new
variable "recovery_fabric_name" { type = string } # REQUIRED, force-new -- a NAME, not an id
variable "recovery_vault_name" { type = string }  # REQUIRED, force-new
variable "resource_group_name" { type = string }  # REQUIRED, force-new via commonschema.ResourceGroupName()

variable "timeouts" {
  type = object({
    create = optional(string, "30m")
    read   = optional(string, "5m")
    delete = optional(string, "30m")
  })
  default = {}
} # THREE keys -- there is no update path

15 outputs: 5 passthrough, 3 derived, 7 constant. No output is sensitive.

ℹ️ The count is low on purpose. All four arguments are identity, the create payload is empty, and there is no update path — so there is no posture to derive. Padding the list would mean emitting values no input can change.

The empty payload is the organising fact. CreateProtectionContainerInputProperties{} carries nothing, so the only thing a caller can get wrong about a protection container is where it is. That shapes everything else in the module: the derived outputs are all locations, the constants are all lifecycle, and the read path sets every attribute from the parsed Resource ID rather than from the response body — which means drift beyond "does it exist" is undetectable by design rather than by omission.

The fabric arrives as a bare name, and that fails in two directions. Loudly, when a literal means Terraform builds no ordering edge and the apply hits a fabric that does not exist yet. Quietly, when a literal matches a fabric somebody else created and the container attaches to it without complaint. Only the first is a plan problem; the second is why this module reconstructs fabric_path_within_the_subscription in exactly the form both fabric-creating modules emit under the same name, so a one-line check can close it.

Two of four arguments are unvalidated upstream and two are well covered, which is why the module's rule list looks lopsided. StringIsNotEmpty on name and recovery_fabric_name accepts a whitespace-only string; validate.RecoveryServicesVaultName and resourcegroups.ValidateName are anchored, exclude the forward slash and state their whole rule. Adding rules to the latter two would buy wording, so they carry none — recorded as examined rather than left to look inconsistent.

A Hyper-V site is a fabric here, because it is a fabric everywhere. azurerm_site_recovery_services_vault_hyperv_site writes the same Microsoft.RecoveryServices/vaults/replicationFabrics type as azurerm_site_recovery_fabric, so its name is a legal recovery_fabric_name and nothing in this resource distinguishes the two. That is usually convenient; it is the same fact that lets those two modules silently collide with each other.

The 400-tolerance asymmetry is the sharpest sibling difference — and it is narrower than it looks. Six of the twelve resources in this service that perform an existence check reference the API's Bad Request at all, and this one does not. Five of those six call the service's wasBadRequestWithNotExist helper, which fires only for the SubscriptionIdNotRegisteredWithSrs detail code and only for a legacy autorest.DetailedError these clients do not return, so what they actually gain over this resource is close to nothing. The consequence is a first-apply failure whose message is about looking for the container, which is a different debugging path from a failure to create one. Nothing in the schema or the documentation shows it, and the workaround being present on four of the seven that check at all is what makes it look like an omission rather than a decision.

Nothing can be edited, and the replacement is not local. No Update function means all four arguments are force-new — three explicitly, one invisibly through a commonschema helper. Mappings reference this container and replicated items live inside it, so a one-character rename is the start of a much larger rebuild. The visible trace is the three-key timeouts block, which in turn is why this module's timeouts variable declares three keys: an object type silently discards an undeclared attribute, so a caller who supplies update loses it without being told.

There is nothing to harden, and that is the honest starting point. Four identity arguments and an empty create payload; the resource has no boolean, no enum, no network surface and no encryption setting. A secure-defaults table would be empty, so what follows records what was examined.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module at a tag, never a branch:

source = "git::https://github.com/microsoftexpert/terraform-azurerm-site-recovery-protection-container.git?ref=v1.0.0"

Everything above is plan-only static analysis. A human applies from CI.

What validate and fmt -check cover. Every type, the optional() defaults, all 7 validations as expressions, and the locals block's total-ness. The three derived paths were each evaluated offline and printed rather than read, across fixtures that vary the vault, the resource group, the fabric and the container name independently — so no value was confirmed by coincidence.

What only plan against a real subscription exercises. That the fabric exists and its name was spelled correctly; that Microsoft.RecoveryServices is registered; whether an existing container causes the create to fail or be overwritten; and whether the API answers 400 for a missing container in your region.

What no plan can show. That the fabric named here is one this configuration owns, and that replacing this container will cascade through every mapping and replicated item referencing it. Both are why the path outputs and the constants exist.

id = "/subscriptions/00000000-.../resourceGroups/rg-dr-prod/providers/Microsoft.RecoveryServices/vaults/vault-dr-prod/replicationFabrics/fabric-eastus/replicationProtectionContainers/container-eastus"
name = "container-eastus"
recovery_fabric_name = "fabric-eastus"
recovery_vault_name = "vault-dr-prod"
resource_group_name = "rg-dr-prod"
container_path_within_the_subscription = "/resourceGroups/rg-dr-prod/providers/Microsoft.RecoveryServices/vaults/vault-dr-prod/replicationFabrics/fabric-eastus/replicationProtectionContainers/container-eastus"
fabric_path_within_the_subscription = "/resourceGroups/rg-dr-prod/providers/Microsoft.RecoveryServices/vaults/vault-dr-prod/replicationFabrics/fabric-eastus"
vault_path_within_the_subscription = "/resourceGroups/rg-dr-prod/providers/Microsoft.RecoveryServices/vaults/vault-dr-prod"

• azurerm_site_recovery_protection_container — the provider resource
• azurerm_site_recovery_protection_container_mapping — the record that consumes both of this module's identity outputs
• Manage Site Recovery access with Azure RBAC — the three built-in roles
• Sibling modules: terraform-azurerm-site-recovery-fabric, terraform-azurerm-site-recovery-replication-policy, terraform-azurerm-site-recovery-services-vault-hyperv-site, terraform-azurerm-recovery-services-vault, terraform-azurerm-resource-group
• This module's SCOPE.md — the cross-module contract

💙 "Infrastructure as Code should be standardized, consistent, and secure."