☁️ Azure Local Instance (Stack HCI Cluster) Terraform Module

Registers one Azure Local (Azure Stack HCI) instance in Azure Resource Manager — the root of the Azure Local family — targeting hashicorp/azurerm ~> 4.0.

• 🏛️ Creates one azurerm_stack_hci_cluster named this — the ARM record for an Azure Local instance, and the root every other module in this family descends from.
• 🚨 States plainly, in an output, that creating this resource deploys nothing: no nodes joined, no storage, no networking, and no custom location. That is azurerm_stack_hci_deployment_setting's job.
• 🧭 Emits arc_setting_id — the <id>/arcSettings/default string the extension module needs — composed once, correctly, instead of by hand.
• 🔑 Emits resource_provider_object_id and explains that this, not the instance's own managed identity, is the principal that reads the deployment key vault. Both are GUIDs.
• 🪪 Takes the instance's Entra client_id as resource data, argues why that does not violate this suite's auth-is-the-caller's rule, and never accepts the application secret.
• 🏷️ Carries tags — and notes it is the only taggable resource in most of this family.

💡 Why it matters: the gap between "the apply went green" and "the instance works" is wider here than anywhere else in this library. A successful apply gives you a registered, empty cluster record. Everything a security review would want to see — BitLocker, SMB signing, Credential Guard, HVCI, drift control — lives on the deployment setting, and so does the custom location five sibling modules cannot function without.

If this module saved you time:

• ⭐ Star the repository — it is the cheapest possible thank-you.
• 💼 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart TB
  RG["terraform-azurerm-resource-group"]
  ARCM["Azure Arc machine resources (registered per node)"]
  CLU["terraform-azurerm-stack-hci-cluster"]
  DS["terraform-azurerm-stack-hci-deployment-setting"]
  ARC["arcSettings/default (created by the deployment)"]
  EXT["terraform-azurerm-stack-hci-extension"]
  CL["custom location (created by the deployment)"]
  CHILD["five custom-location children: logical-network, storage-path, marketplace-gallery-image, virtual-hard-disk, network-interface"]

  RG -->|"resource_group_name"| CLU
  ARCM -->|"arc_resource_ids"| DS
  CLU -->|"id as stack_hci_cluster_id"| DS
  DS -->|"deployment creates"| CL
  DS -->|"deployment creates"| ARC
  CLU -->|"id plus /arcSettings/default"| EXT
  ARC -->|"must exist first"| EXT
  CL -->|"custom_location_id"| CHILD

  style CLU fill:#0078D4,stroke:#004578,color:#ffffff
  style DS fill:#004578,stroke:#00335c,color:#ffffff
  style RG fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style ARCM fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style ARC fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style EXT fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style CL fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style CHILD fill:#f2f4f7,stroke:#98a2b3,color:#1d2939

Read the diagram outward from the highlighted node and the ownership boundaries fall out. This module creates the instance record. The deployment setting consumes its id and — as a side effect of deploying — brings the custom location and the Arc setting into existence. Only then can the five custom-location children and the extension be created. This module is the only one in the family that consumes nothing from it.

flowchart TB
  IN["required: name, resource_group_name, location"]
  IDENT["identity object: type -- only SystemAssigned is documented"]
  ENTRA["entra_application object: client_id, tenant_id -- the CLUSTER's app registration, not Terraform's credential"]
  AM["automanage_configuration_id -- hands part of the config to another service"]
  THIS["azurerm_stack_hci_cluster.this"]
  ARC["Azure Arc"]
  NODES["physical machines in your own datacentre"]
  OUTID["id -- Microsoft.AzureStackHCI/clusters"]
  COMPUTED["read back after apply: cloud_id, service_endpoint, resource_provider_object_id, identity principal_id, effective tenant_id"]
  DERIVED["derived: arc_setting_id, has_identity, uses_entra_application, entra_tenant_was_left_to_the_provider, is_automanaged"]
  NOTDEPLOYED["NOT created here: nodes joined, storage, networking, custom location"]

  IN --> THIS
  IDENT --> THIS
  ENTRA --> THIS
  AM --> THIS
  THIS -->|"registers through"| ARC
  ARC -->|"represents"| NODES
  THIS --> OUTID
  THIS --> COMPUTED
  THIS --> DERIVED
  THIS -.->|"a deployment setting does this, not this resource"| NOTDEPLOYED

  style THIS fill:#0078D4,stroke:#004578,color:#ffffff
  style OUTID fill:#004578,stroke:#00335c,color:#ffffff
  style IN fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style IDENT fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style ENTRA fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style AM fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style ARC fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style NODES fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style COMPUTED fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style DERIVED fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style NOTDEPLOYED fill:#f2f4f7,stroke:#98a2b3,color:#1d2939

Resource inventory

The dotted edge is the important one: it points at what this resource does not create.

Schema notes that bite — argument names, types and block cardinality from the pinned provider's binary schema; force-new facts from the provider's own resource documentation, because the binary schema carries no force-new marker at all; deployment behaviour from Microsoft's Azure Local documentation:

• 🔴 Creating this resource does not deploy anything. It is a registration. Microsoft documents the real deployment as taking 2.5–3 hours, with one step ("Deploy Moc and ARB Stack") accounting for 40–45 minutes — and none of that happens here.
• 🔴 The custom location the family's five children need is created by the deployment, not here. This resource has no custom-location argument and no custom-location output, and the ordering is not expressible as a Terraform dependency because the custom location is not a resource Terraform creates.
• 🔴 client_id and tenant_id are the instance's Entra application, not provider authentication. The provider's own wording is "used by" the cluster.
• ⚠️ tenant_id is optional and computed — omitted, it defaults to the provider's tenant. That is the one place provider configuration determines this resource's data, and it is force-new, so a pipeline authenticated against a different tenant replaces the instance rather than updating it.
• ⚠️ identity is max = 1 with a required type inside, and SystemAssigned is the only documented value. Modelled here as one optional object — but the resource attribute is still a list, so reading principal_id needs try(...identity[0].principal_id, null).
• ⚠️ Microsoft documents that the instance name must differ from every node name — unenforceable here, because the node names are inputs to the deployment setting. That module enforces it.
• ⚠️ A destroy is not a decommission. It removes the registration and leaves deployed software and Arc machine resources behind.
• ℹ️ cloud_id is not the ARM id — it is an immutable platform UUID, and the Resource ID is not immutable across a recreation.
• ℹ️ resource_provider_object_id is the resource provider's service principal, not the instance's managed identity. It is the one that reads the deployment key vault.
• ℹ️ Timeouts default to 30 minutes create/update/delete, 5 minutes read. Ample — the long work is elsewhere.
• ℹ️ The product is Azure Local; ARM and Terraform still say Stack HCI. A rename, not a deprecation, and this is the resource where the confusion costs most because it is what a policy definition targets.

🔒 Neither plan nor state access is credential access here. This resource has no secret-bearing attribute at all. client_id is an application ID — an identifier that appears in sign-in logs, deliberately not sensitive — and the application's secret is never accepted by this module, so it never enters this state file. resource_provider_object_id, identity.principal_id, cloud_id and tenant_id are likewise identifiers. That is a per-resource conclusion; the deployment setting, one step away, reaches a different one for a different reason.

⚠️ resource_provider_object_id versus identity_principal_id. Two different service principals are involved in an Azure Local deployment, both are GUIDs, and the key vault grant belongs to the resource provider's. Granting the wrong one produces a permissions failure that names neither.

🔴 What no Azure role constrains: a destroy here is not a decommission. Deleting this resource removes the Azure registration; it does not un-deploy software on the nodes, un-join them, or clean up the Arc machine resources. Whoever can delete it can strand a working instance in a state that is neither registered nor cleanly reusable.

• The Microsoft.AzureStackHCI resource provider registered on the subscription. Microsoft.ExtendedLocation and Microsoft.HybridCompute are needed for what follows.
• The physical machines registered with Azure Arc, all on the same OS version, with the same network adapter configuration, and with deployment permissions assigned. Microsoft treats this as a prerequisite of the deployment rather than of the record — but there is little point creating the record without it.
• A region where Azure Local is available. Not enforced here: Microsoft adds to that list, and a closed check would reject a newly supported region.
• An Entra application registration, if the instance is to use one. Created out of band; only its client ID comes in here.
• The caller configures provider "azurerm" { features {} }; this module declares no provider block.

terraform-azurerm-stack-hci-cluster/
├── providers.tf    # required_version >= 1.12.0, azurerm ~> 4.0. No provider block.
├── variables.tf    # 8 typed inputs, 13 validations, the tags + timeouts tail.
├── main.tf         # locals for every derived fact, then the single keystone resource.
├── outputs.tf      # id first, then the computed trio, the derived flags, and the constants.
├── README.md       # this file.
├── SCOPE.md        # the cross-module contract.
├── LICENSE         # MIT.
└── .gitignore      # the canonical library ignore file.

provider "azurerm" {
  features {}
}

module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = "rg-azlocal"
  location            = "eastus2"

  identity = {
    type = "SystemAssigned"
  }
}

ℹ️ The caller owns the provider block, authentication and the mandatory features {} — this module declares none of them.

🔴 That is a registration, not a deployment. After a green apply you have an empty cluster record. Add terraform-azurerm-stack-hci-deployment-setting to make it an instance — see example 12.

Consumes

Emits

module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = "rg-azlocal"
  location            = "eastus2"
}

module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = "rg-azlocal"
  location            = "eastus2"

  identity = {
    type = "SystemAssigned"
  }
}

output "instance_principal" {
  value = module.azlocal.identity_principal_id
}

module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = "rg-azlocal"
  location            = "eastus2"

  entra_application = {
    client_id = var.azlocal_app_client_id
    tenant_id = var.entra_tenant_id
  }
}

module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = "rg-azlocal"
  location            = "eastus2"

  entra_application = {
    client_id = var.azlocal_app_client_id
    # tenant_id deliberately omitted
  }
}

output "tenant_came_from_the_provider" {
  value = module.azlocal.entra_tenant_was_left_to_the_provider # true
}

output "effective_tenant" {
  value = module.azlocal.tenant_id # read back from the resource
}

module "monitor_agent" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-extension.git?ref=v1.0.0"

  name = "AzureMonitorWindowsAgent"

  # Composed once, correctly, by the cluster module.
  arc_setting_id = module.azlocal.arc_setting_id

  publisher = "Microsoft.Azure.Monitor"
  type      = "AzureMonitorWindowsAgent"
}

resource "azurerm_role_assignment" "rp_reads_deployment_secrets" {
  scope                = var.deployment_key_vault_id
  role_definition_name = "Key Vault Secrets User"

  # The RESOURCE PROVIDER's service principal -- not the instance's identity.
  principal_id = module.azlocal.resource_provider_object_id
}

module "azlocal" {
  source                      = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                        = "azlocal-cluster-01"
  resource_group_name         = "rg-azlocal"
  location                    = "eastus2"

  automanage_configuration_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-governance/providers/Microsoft.Automanage/configurationProfiles/prod-baseline"
}

output "also_managed_elsewhere" {
  value = module.azlocal.is_automanaged # true
}

module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = "rg-azlocal"
  location            = "eastus2"

  tags = {
    environment  = "production"
    platform     = "azure-local"
    cost_centre  = "infra-4102"
    data_class   = "internal"
  }
}

output "instance_facts" {
  value = {
    arm_id           = module.azlocal.id           # changes if recreated
    platform_uuid    = module.azlocal.cloud_id     # immutable
    data_endpoint    = module.azlocal.service_endpoint
    rp_principal     = module.azlocal.resource_provider_object_id
  }
}

module "azlocal_sites" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  for_each = {
    dc1 = "eastus2"
    dc2 = "centralus"
  }

  name                = "azlocal-${each.key}"
  resource_group_name = "rg-azlocal-${each.key}"
  location            = each.value

  identity = { type = "SystemAssigned" }

  tags = { site = each.key }
}

output "sites_missing_an_identity" {
  value = [for k, m in module.azlocal_sites : k if !m.has_identity]
}

# Rejected: the instance's own ID, pasted into the Automanage field.
automanage_configuration_id = module.azlocal.id

# Rejected: a custom location -- which is not an input to this resource at all.
automanage_configuration_id = var.custom_location_id

# Rejected: only "SystemAssigned" is documented, and the casing is checked.
identity = { type = "systemassigned" }

# Rejected: a tenant's domain name is not a tenant ID.
entra_application = { tenant_id = "contoso.onmicrosoft.com" }

# Rejected: a display name, and upper case.
location = "East US 2"

module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = "rg-azlocal"
  location            = "eastus2"
  identity            = { type = "SystemAssigned" }
}

# Without this, the instance above is an empty record forever.
module "deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-deployment-setting.git?ref=v1.0.0"

  stack_hci_cluster_id = module.azlocal.id
  arc_resource_ids     = var.arc_machine_ids
  deployment_version   = "10.0.0.0"

  scale_unit = [{
    active_directory_organizational_unit_path = "OU=azlocal,DC=contoso,DC=com"
    domain_fqdn                               = "contoso.com"
    name_prefix                               = "azl"
    secrets_location                          = "https://kv-azlocal-01.vault.azure.net/"

    cluster = {
      name                  = module.azlocal.name
      azure_service_endpoint = "core.windows.net"
      cloud_account_name     = "stazlocalwitness01"
      witness_type           = "Cloud"
      witness_path           = "\\\\fileserver\\witness"
    }

    optional_service = {
      # The custom location the five sibling modules need comes from HERE.
      custom_location = "cl-azlocal-eastus2"
    }

    storage = { configuration_mode = "Express" }

    physical_node = [
      { name = "azl-node-1", ipv4_address = "10.60.0.11" },
      { name = "azl-node-2", ipv4_address = "10.60.0.12" },
    ]

    infrastructure_network = [{
      gateway     = "10.60.0.1"
      subnet_mask = "255.255.255.0"
      dns_server  = ["10.60.1.10"]
      ip_pool     = [{ starting_address = "10.60.0.20", ending_address = "10.60.0.40" }]
    }]

    host_network = {
      intent = [{
        name         = "converged"
        adapter      = ["Port1", "Port2"]
        traffic_type = ["Compute", "Storage", "Management"]
      }]
      storage_network = [{
        name                 = "Storage1"
        network_adapter_name = "Port1"
        vlan_id              = "711"
      }]
    }
  }]
}

provider "azurerm" {
  features {}
}

variable "arc_machine_ids" {
  type        = list(string)
  description = "Microsoft.HybridCompute/machines IDs for the nodes, registered with Azure Arc beforehand."
}

variable "deployment_key_vault_id" {
  type        = string
  description = "The key vault holding the deployment secrets. Created out of band; only its ID and URI come in here."
}

variable "deployment_key_vault_uri" {
  type        = string
  description = "The vault URI, e.g. https://kv-azlocal-01.vault.azure.net/"
}

locals {
  # The resource group module takes tags as an input but does not emit them, so the
  # composition owns the canonical map. Neither the deployment setting nor the
  # extension accepts tags at all.
  common_tags = { environment = "production", platform = "azure-local" }
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-azlocal"
  location = "eastus2"

  tags = local.common_tags
}

# --- 1. The registration: this module. Fast, and deploys nothing. ---
module "azlocal" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-cluster.git?ref=v1.0.0"

  name                = "azlocal-cluster-01"
  resource_group_name = module.rg.name
  location            = "eastus2"

  identity = { type = "SystemAssigned" }

  tags = local.common_tags
}

# --- 2. The grant the deployment cannot proceed without. ---
resource "azurerm_role_assignment" "rp_reads_deployment_secrets" {
  scope                = var.deployment_key_vault_id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = module.azlocal.resource_provider_object_id
}

# --- 3. The deployment: 2.5-3 hours, and the source of the custom location. ---
module "deployment" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-deployment-setting.git?ref=v1.0.0"

  stack_hci_cluster_id = module.azlocal.id
  arc_resource_ids     = var.arc_machine_ids
  deployment_version   = "10.0.0.0"

  scale_unit = [{
    active_directory_organizational_unit_path = "OU=azlocal,DC=contoso,DC=com"
    domain_fqdn                               = "contoso.com"
    name_prefix                               = "azl"
    secrets_location                          = var.deployment_key_vault_uri

    # Security defaults, all explicit.
    bitlocker_boot_volume_enabled  = true
    bitlocker_data_volume_enabled  = true
    credential_guard_enabled       = true
    drtm_protection_enabled        = true
    hvci_protection_enabled        = true
    side_channel_mitigation_enabled = true
    smb_cluster_encryption_enabled = true
    smb_signing_enabled            = true
    wdac_enabled                   = true
    drift_control_enabled          = true

    cluster = {
      name                   = module.azlocal.name
      azure_service_endpoint = "core.windows.net"
      cloud_account_name     = "stazlocalwitness01"
      witness_type           = "Cloud"
      witness_path           = "\\\\fileserver\\witness"
    }

    optional_service = { custom_location = "cl-azlocal-eastus2" }
    storage          = { configuration_mode = "Express" }

    physical_node = [
      { name = "azl-node-1", ipv4_address = "10.60.0.11" },
      { name = "azl-node-2", ipv4_address = "10.60.0.12" },
    ]

    infrastructure_network = [{
      gateway     = "10.60.0.1"
      subnet_mask = "255.255.255.0"
      dns_server  = ["10.60.1.10", "10.60.1.11"]
      ip_pool     = [{ starting_address = "10.60.0.20", ending_address = "10.60.0.40" }]
    }]

    host_network = {
      intent = [{
        name         = "converged"
        adapter      = ["Port1", "Port2"]
        traffic_type = ["Compute", "Storage", "Management"]
      }]
      storage_network = [{
        name                 = "Storage1"
        network_adapter_name = "Port1"
        vlan_id              = "711"
      }]
    }
  }]

  timeouts = { create = "8h" }

  depends_on = [azurerm_role_assignment.rp_reads_deployment_secrets]
}

# --- 4. A cluster-level agent, on the Arc setting the deployment created. ---
module "monitor_agent" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-stack-hci-extension.git?ref=v1.0.0"

  name           = "AzureMonitorWindowsAgent"
  arc_setting_id = module.azlocal.arc_setting_id
  publisher      = "Microsoft.Azure.Monitor"
  type           = "AzureMonitorWindowsAgent"

  depends_on = [module.deployment]
}

output "azure_local_platform" {
  value = {
    instance_id   = module.azlocal.id
    platform_uuid = module.azlocal.cloud_id
    deployment_id = module.deployment.id

    # The name of a custom location that does not exist until the deployment finishes.
    custom_location_name = module.deployment.custom_location_name

    node_count        = module.deployment.node_count
    witness_in_use    = module.deployment.witness_in_use
    security_posture  = module.deployment.security_features_disabled

    agent = module.monitor_agent.extension_identifier
  }
}

Required — name, resource_group_name, location.

Optional — identity, entra_application, automanage_configuration_id, plus the universal tags and timeouts tail.

No output carries key material — the resource has none.

The most important property of this resource is what it does not do. azurerm_stack_hci_cluster creates an ARM record. After a successful apply there are no nodes joined, no storage pool, no networking, and no custom location. Microsoft documents the real deployment as taking 2.5 to 3 hours, with a single step accounting for 40 to 45 minutes of it — and none of that happens here. The provider's own 30-minute create default is the tell: the deployment setting's defaults to six hours for exactly this reason. So a green apply on this module proves the registration succeeded and essentially nothing about the instance.

The custom location is created by the deployment, and that breaks a dependency chain people expect to exist. Five modules in this family require a custom_location_id, and none of them can obtain it from this resource — this resource has no such argument and no such output. The custom location comes into being as a side effect of the deployment, whose scale_unit.optional_service.custom_location names it. Because Terraform never creates that resource, its ID is not an attribute of anything in the graph, so the ordering cannot be expressed as a dependency. In practice the five children are applied in a later run, or the ID is looked up with a data block once the deployment has finished. A composition that attempts everything in one apply fails on the children rather than on the deployment, which is a confusing place for it to fail.

Two of this resource's fields look like provider authentication and are not. client_id and tenant_id identify the Entra application the cluster uses to talk to Azure — the provider's wording is "used by" the cluster. This suite's rule that authentication is never a module variable is about the credential Terraform uses, and neither of these is it. The rule still bites in one place, though, and this module honours it absolutely: the application's secret is never accepted here. An application ID is an identifier and is deliberately not marked sensitive; the secret belongs in the key vault the deployment points at. The one genuine leak of provider configuration into resource data is tenant_id's default — omit it and the provider's tenant governs, which is usually right and is force-new, so a pipeline authenticated elsewhere replaces the instance rather than updating it.

Two service principals matter and both are GUIDs. identity_principal_id is the instance's own managed identity — what a diagnostic setting or policy assignment targets. resource_provider_object_id is the Azure Stack HCI resource provider's service principal, and it is what needs read access to the key vault holding the deployment secrets. Granting the wrong one produces a permissions failure that names neither, which is why the two outputs are named as differently as they are.

Two cross-field rules Microsoft publishes are enforced elsewhere, and the module says so rather than staying quiet. The instance name must differ from every node name — but the node names are inputs to azurerm_stack_hci_deployment_setting, so that module enforces the rule and this one reports it. This is the same asymmetry the network interface module documents about address containment: a rule gets enforced wherever both operands happen to be inputs, and reported wherever one of them is not. Saying it explicitly is what stops the weaker module reading as careless rather than differently placed.

Arc projection, and a destroy that is not a decommission. The record represents physical machines reached through Azure Arc, so ARM state can outlive the hardware — and on this resource that matters more than on its children, because the record carries the billing relationship. Deleting it removes the Azure registration; it does not un-deploy software on the nodes, un-join them from the cluster, or clean up the Arc machine resources. Running those steps in the wrong order leaves an instance that is neither registered nor cleanly reusable.

Secure-by-default has almost nothing to act on here, and pretending otherwise would be the misleading choice. Three arguments are required, so there is no meaningful empty call — and this resource has no exposure toggle, no network surface, no encryption argument and no authentication setting of its own. Everything a security review wants to see about an Azure Local instance — BitLocker on boot and data volumes, SMB signing and cluster encryption, Credential Guard, HVCI, WDAC, side-channel mitigation, drift control — lives on azurerm_stack_hci_deployment_setting.

The rule is therefore compensated:

The defaults that do exist:

🔒 The one posture decision this module declines to make is the identity. Assigning a system-assigned identity is almost always right, but creating a principal the caller did not ask for is not this suite's habit — so the default stands and has_identity reports the false with its cost attached.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin the module with ?ref=v1.0.0 — never a branch. This library is plan-only; a human applies from CI.

🔴 Do not read a green apply here as a working instance. Confirm the deployment setting applied, and confirm the custom location exists, before applying anything that depends on either.

⚠️ Review any plan touching this module for # forces replacement. Everything except tags is force-new, and replacing this record strands a deployed instance.

The offline gate proves the configuration and the type system, and nothing beyond it:

💡 terraform console fires root-module variable validations — terraform validate on a calling configuration does not. Feed it a deliberately bad .tfvars.

💡 Prove validations by line number, not by message text. Terraform hard-wraps error messages, so grepping for a phrase from an error_message silently matches nothing. Collect the variables.tf:<line> references instead and compare their union against the count of validation blocks.

⚠️ A short error list is not proof a check is missing. Terraform skips a validation whose referenced variable has itself failed. Every validation here references only its own variable, which is why client_id and tenant_id share one object.

Outputs:

id                            = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-azlocal/providers/Microsoft.AzureStackHCI/clusters/azlocal-cluster-01"
name                          = "azlocal-cluster-01"
resource_group_name           = "rg-azlocal"
location                      = "eastus2"
arc_setting_id                = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-azlocal/providers/Microsoft.AzureStackHCI/clusters/azlocal-cluster-01/arcSettings/default"

cloud_id                      = "7f3a1c88-2b45-4d6e-9f01-5c8a2e7b4d90"
service_endpoint              = "https://eastus2.dp.stackhci.azure.com"
resource_provider_object_id   = "1412d0e3-3f4b-4a1c-9d2e-6b7a8c9d0e1f"
tenant_id                     = "cccccccc-4444-5555-6666-dddddddddddd"
client_id                     = null

identity                      = {
  principal_id = "9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"
  tenant_id    = "cccccccc-4444-5555-6666-dddddddddddd"
  type         = "SystemAssigned"
}
identity_principal_id         = "9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d"

automanage_configuration_id   = null
automanage_configuration_name = null
tags                          = { "environment" = "production", "platform" = "azure-local" }

has_identity                          = true
uses_entra_application                = false
entra_tenant_was_left_to_the_provider = true
is_automanaged                        = false

creating_this_resource_does_not_deploy_anything = true
the_custom_location_its_children_consume_is_created_by_the_deployment_not_by_this_resource = true
the_node_names_live_on_the_deployment_setting_so_the_collision_check_lives_there = true
this_is_an_arc_projected_resource_so_azure_state_can_diverge_from_the_hardware = true
the_product_is_now_called_azure_local_but_arm_and_terraform_still_say_stack_hci = "Microsoft.AzureStackHCI/clusters"
secure_by_default_has_almost_nothing_to_act_on_here = true

🔑 Note resource_provider_object_id and identity_principal_id side by side. Two different principals, both GUIDs — the key vault grant belongs to the first.

• azurerm_stack_hci_cluster
• Azure Local documentation — the product's current name; the ARM namespace and the Terraform resources still read stack_hci.
• Register your machines with Azure Arc and assign deployment permissions
• Deploy Azure Local via an Azure Resource Manager template — the source of the deployment duration, the witness rule, and the instance-versus-node-name rule.
• Sibling modules: terraform-azurerm-stack-hci-deployment-setting, terraform-azurerm-stack-hci-extension, terraform-azurerm-stack-hci-logical-network, terraform-azurerm-stack-hci-storage-path, terraform-azurerm-stack-hci-marketplace-gallery-image, terraform-azurerm-stack-hci-virtual-hard-disk, terraform-azurerm-stack-hci-network-interface, terraform-azurerm-resource-group
• This module's SCOPE.md

💙 "Infrastructure as Code should be standardized, consistent, and secure."