☁️ Azure System Center VMM Availability Set Terraform Module

# ✅ THIS module — the VMM SERVER's Resource ID.
system_center_virtual_machine_manager_server_id = module.vmm.id

# ✅ Its three siblings — an INVENTORY ITEM id.
system_center_virtual_machine_manager_server_inventory_item_id = local.vmm_clouds["Production Cloud"]

# ❌ The natural mistake after writing the other three. Rejected at plan.
system_center_virtual_machine_manager_server_id = local.vmm_clouds["Production Cloud"]

resource "azurerm_management_lock" "avset_no_delete" {
  name       = "vmmas-app-no-delete"
  scope      = module.vmm_avset_app.id
  lock_level = "CanNotDelete"
  notes      = "Deleting this set changes placement for the VMs in it"
}

module "vmm_avset_app" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-availability-set.git?ref=v1.0.0"
  custom_location_id           = var.custom_location_id
  location                     = "eastus2"
  name                         = "vmm-avset-app-example"
  resource_group_name          = "rg-example"
  system_center_virtual_machine_manager_server_id = var.system_center_virtual_machine_manager_server_id
}

# FRAGMENT: only the membership argument is shown -- the instance's own required inputs
# (scoped_resource_id, custom_location_id, infrastructure) are in that module's Quick Start.
module "vm_instance_01" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-virtual-machine-instance.git?ref=v1.0.0"

  # ⚠️ THIS is where a VM joins the set.
  system_center_virtual_machine_manager_availability_set_ids = [module.vmm_avset_app.id]
  # ...
}

module "vmm_avset_web" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-availability-set.git?ref=v1.0.0"

  name                                            = "vmmas-web"
  resource_group_name                             = module.rg.name
  location                                        = module.vmm.location
  custom_location_id                              = module.vmm.custom_location_id
  system_center_virtual_machine_manager_server_id = module.vmm.id
}

module "vm_web_01" {
  # ...
  system_center_virtual_machine_manager_availability_set_ids = [module.vmm_avset_web.id]
}

module "vm_web_02" {
  # ...
  system_center_virtual_machine_manager_availability_set_ids = [module.vmm_avset_web.id]
}

locals {
  tiers = ["web", "app", "db"]
}

module "vmm_avset" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-availability-set.git?ref=v1.0.0"
  for_each = toset(local.tiers)

  name                                            = "vmmas-${each.key}"
  resource_group_name                             = module.rg.name
  location                                        = module.vmm.location
  custom_location_id                              = module.vmm.custom_location_id
  system_center_virtual_machine_manager_server_id = module.vmm.id

  tags = { tier = each.key }
}

# ✅
location           = module.vmm.location
custom_location_id = module.vmm.custom_location_id

# ⚠️ Works until someone changes one and not the other.
location           = "eastus"
custom_location_id = "/subscriptions/.../customLocations/cl-vmm-dc1"

tags = {
  tier  = "app"
  owner = "platform-virtualization"
}

output "avset_posture" {
  value = {
    id      = module.vmm_avset_app.id
    name    = module.vmm_avset_app.name                     # the VMM name too
    creates = module.vmm_avset_app.creates_an_object_in_vmm  # always true
    server  = module.vmm_avset_app.system_center_virtual_machine_manager_server_id
  }
}

# ⚠️ Membership is asserted on the VMs, not here -- these are the two instance modules from the
#    example above, each carrying this set's id.
# FRAGMENT: the instances' own required inputs are in that module's Quick Start.
module "vm_web_01" {
  source                                                     = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-virtual-machine-instance.git?ref=v1.0.0"
  system_center_virtual_machine_manager_availability_set_ids = [module.vmm_avset_web.id]
}

# FRAGMENT: as above.
module "vm_web_02" {
  source                                                     = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-virtual-machine-instance.git?ref=v1.0.0"
  system_center_virtual_machine_manager_availability_set_ids = [module.vmm_avset_web.id]
}

output "avset_members" {
  value = {
    web_01 = module.vm_web_01.is_in_availability_set
    web_02 = module.vm_web_02.is_in_availability_set
  }
}

provider "azurerm" {
  features {}
}

data "azurerm_client_config" "current" {}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-vmm-dc1"
  location = "eastus"
}

module "kv" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-key-vault.git?ref=v1.0.0"

  name                = "kv-vmm-dc1"
  resource_group_name = module.rg.name
  location            = module.rg.location
  tenant_id           = data.azurerm_client_config.current.tenant_id
}

data "azurerm_key_vault_secret" "vmm_password" {
  name         = "vmm-arc-svc-password"
  key_vault_id = module.kv.id
}

# ── The anchor ────────────────────────────────────────────────────────────────
module "vmm" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-server.git?ref=v1.0.0"

  name                = "vmm-contoso-dc1"
  resource_group_name = module.rg.name
  location            = module.rg.location
  custom_location_id  = var.custom_location_id
  fqdn                = "vmm.contoso.com"
  username            = var.vmm_admin_username
  password            = data.azurerm_key_vault_secret.vmm_password.value
}

# ── Projections take an INVENTORY ITEM… ───────────────────────────────────────
data "azurerm_system_center_virtual_machine_manager_inventory_items" "clouds" {
  inventory_type                                  = "Cloud"
  system_center_virtual_machine_manager_server_id = module.vmm.id
}

locals {
  vmm_clouds = { for i in data.azurerm_system_center_virtual_machine_manager_inventory_items.clouds.inventory_items : i.name => i.id }
}

module "vmm_cloud_prod" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-cloud.git?ref=v1.0.0"

  name                                                           = "vmmcloud-prod"
  resource_group_name                                            = module.rg.name
  location                                                       = module.vmm.location
  custom_location_id                                             = module.vmm.custom_location_id
  system_center_virtual_machine_manager_server_inventory_item_id = local.vmm_clouds["Production Cloud"]
}

# ── …while THIS module takes the SERVER id (example 1) ────────────────────────
module "vmm_avset" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-availability-set.git?ref=v1.0.0"
  for_each = toset(["web", "app"])

  name                = "vmmas-${each.key}"
  resource_group_name = module.rg.name
  location            = module.vmm.location
  custom_location_id  = module.vmm.custom_location_id

  system_center_virtual_machine_manager_server_id = module.vmm.id

  tags = { tier = each.key }
}

# ── Two VMs, so the set has something to separate (example 4) ─────────────────
module "vm_arc" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-arc-machine.git?ref=v1.0.0"
  for_each = toset(["vm-web-01", "vm-web-02"])

  name                = each.key
  resource_group_name = module.rg.name
  location            = module.rg.location
  kind                = "SCVMM"

  tags = { tier = "web" }
}

module "vm_web" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-system-center-virtual-machine-manager-virtual-machine-instance.git?ref=v1.0.0"
  for_each = toset(["vm-web-01", "vm-web-02"])

  scoped_resource_id = module.vm_arc[each.key].id
  custom_location_id = module.vmm.custom_location_id

  infrastructure = {
    system_center_virtual_machine_manager_template_id               = var.vmm_template_id
    system_center_virtual_machine_manager_cloud_id                  = module.vmm_cloud_prod.id
    system_center_virtual_machine_manager_virtual_machine_server_id = module.vmm.id
    checkpoint_type                                                 = "Production"
  }

  hardware = { cpu_count = 2, memory_in_mb = 4096 }

  # ⚠️ MEMBERSHIP IS EXPRESSED HERE, not in the availability-set module.
  system_center_virtual_machine_manager_availability_set_ids = [module.vmm_avset["web"].id]

  timeouts = { create = "2h" }
}

resource "azurerm_management_lock" "avset_no_delete" {
  for_each = module.vmm_avset

  name       = "${each.value.name}-no-delete"
  scope      = each.value.id
  lock_level = "CanNotDelete"
  notes      = "Deleting this set changes placement for the VMs in it"
}

output "avset_posture" {
  value = {
    for k, m in module.vmm_avset : k => {
      id      = m.id
      name    = m.name
      creates = m.creates_an_object_in_vmm # always true
    }
  }
}

# ⚠️ The membership check that the availability-set module cannot answer.
output "avset_members" {
  value = { for k, m in module.vm_web : k => m.is_in_availability_set }
}

variable "system_center_virtual_machine_manager_server_id" {
  type = string
  # The check that exists because of the FAMILY, not because of the field: three
  # near-identical siblings take an inventory item in this position.
  validation {
    condition     = can(regex("^/subscriptions/[^/]+/resourceGroups/[^/]+/providers/Microsoft[.]ScVmm/vmmServers/[^/]+$", var.system_center_virtual_machine_manager_server_id))
    error_message = "system_center_virtual_machine_manager_server_id must be a complete VMM server ID ... MATCHING THAT CAPITALISATION EXACTLY ... An inventory item ID is the other common mistake here …"
  }
}

variable "custom_location_id" {
  type = string
  validation {
    condition     = can(regex("(?i)/providers/Microsoft\\.ExtendedLocation/customLocations/", var.custom_location_id))
    error_message = "custom_location_id must be a Microsoft.ExtendedLocation/customLocations Resource ID."
  }
}