🔴 F5 BIG-IP LTM SSL Persistence Profile Terraform Module

Manages a single bigip_ltm_persistence_profile_ssl — an SSL-session-ID-based persistence profile — against the F5Networks/bigip Terraform provider ~> 1.28, TMOS >= v12.1.1.

• 🔐 Manages one bigip_ltm_persistence_profile_ssl.this — a persistence mode that ties a client's subsequent connections to the same pool member based on the SSL session ID negotiated during the handshake, rather than source address or a cookie.
• 📐 A thin, total, one-to-one passthrough renderer — every provider argument on this resource is a flat scalar, so main.tf has no for_each, no dynamic blocks, and no child collections.
• 🔗 Emits name (the practical full-path cross-reference key) and id, consumed by terraform-bigip-ltm-virtual-server's persistence_profile_name input — this module never creates or owns a virtual server.
• 🧬 Requires an explicit defaults_from parent (typically the built-in /Common/ssl template, or a chained instance of this same module) — BIG-IP requires every persistence profile to declare a parent.
• 🚫 Leaves five Optional+Computed fields (match_across_pools, match_across_services, match_across_virtuals, mirror, override_conn_limit) unset (null) by default so the device's own server-side default applies, instead of this module inventing one.

💡 Why it matters: SSL persistence keeps a re-negotiated or re-encrypted session pinned to the same backend without relying on a cookie the client might not honor or a source address that might be shared behind NAT. Modeling it as an independently versioned, independently tested Terraform object — shared across many virtual servers by full-path name — keeps that decision out of any one virtual server's inline configuration.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart LR
 BUILTIN["/Common/ssl (built-in template)"]:::sibling
 SSLPERSIST["terraform-bigip-ltm-persistence-profile-ssl"]:::this
 VS["terraform-bigip-ltm-virtual-server"]:::keystone
 POOL["terraform-bigip-ltm-pool"]:::sibling
 SRCADDR["terraform-bigip-ltm-persistence-profile-srcaddr"]:::sibling
 DSTADDR["terraform-bigip-ltm-persistence-profile-dstaddr"]:::sibling
 COOKIE["terraform-bigip-ltm-persistence-profile-cookie"]:::sibling

 BUILTIN -- "defaults_from (full path)" --> SSLPERSIST
 SSLPERSIST -- "name (persistence_profile_name)" --> VS
 POOL -- "name (pool_name)" --> VS
 SSLPERSIST -.-> SRCADDR
 SSLPERSIST -.-> DSTADDR
 SSLPERSIST -.-> COOKIE

 classDef this fill:#E4002B,color:#ffffff,stroke:#7a0016,stroke-width:1px;
 classDef keystone fill:#000000,color:#ffffff,stroke:#000000,stroke-width:1px;
 classDef sibling fill:#D9D9D9,color:#000000,stroke:#999999,stroke-width:1px;

This module (red) is consumed by full-path name from terraform-bigip-ltm-virtual-server (black, the keystone target that assigns the persistence profile to a virtual server alongside its pool). It requires an explicit defaults_from parent, typically the built-in /Common/ssl template. The dotted edges to terraform-bigip-ltm-persistence-profile-srcaddr, -dstaddr, and -cookie mark sibling module families that configure the same BIG-IP concept (persistence) via a different matching strategy — they share no Terraform-level cross-reference with this module.

flowchart TD
 subgraph "Identity and Inheritance"
 ID["name, defaults_from, app_service"]
 end
 subgraph "Cross-Object Persistence Matching"
 XM["match_across_pools, match_across_services, match_across_virtuals"]
 end
 subgraph "HA and Connection Behavior"
 HA["mirror, override_conn_limit"]
 end
 subgraph "Timing"
 TM["timeout"]
 end

 RES(["bigip_ltm_persistence_profile_ssl.this"]):::keystone

 ID --> RES
 XM --> RES
 HA --> RES
 TM --> RES

 RES --> OUT_NAME["output: name"]
 RES --> OUT_ID["output: id"]

 classDef keystone fill:#000000,color:#ffffff,stroke:#000000,stroke-width:1px;

Resource inventory: exactly one resource, bigip_ltm_persistence_profile_ssl.this. No child resources, no for_each, no dynamic blocks — every one of the 9 module variables maps to a flat top-level argument on that single resource (see main.tf).

Schema notes that bite:

• name is full-path identity and is immutable — renaming the profile or moving it to a different partition forces destroy/recreate.
• defaults_from is required — BIG-IP requires an explicit parent for every persistence profile; there is no provider-side default.
• timeout's rendered provider doc prose reads "(enabled or disabled) Timeout... in seconds" — this is a documentation defect. The compiled schema confirms timeout is type = number (seconds) and Optional, not Computed. This module trusts the compiled schema over the rendered doc text.
• match_across_pools, match_across_services, match_across_virtuals, mirror, and override_conn_limit are all Optional+Computed — no Terraform-level default is encoded for any of them; left null by default so the device supplies its own server-side value.
• No tags block, no timeouts {} block — the compiled schema exposes neither, and BIG-IP persistence profiles carry no tagging concept.

Manager role scoped to the target partition is sufficient; Administrator is not required for this application-layer LTM object. See SCOPE.md for the full cross-module contract this was derived from.

• iControl REST enabled and reachable on the target device.
• TMOS >= v12.1.1.
• Target partition already exists (this module does not create partitions).
• The parent profile named in defaults_from (e.g. /Common/ssl, or a prior instance of this module for chained inheritance) already exists on the target device before this profile is applied.

terraform-bigip-ltm-persistence-profile-ssl/
├── providers.tf # required_version >= 1.12.0, F5Networks/bigip ~> 1.28, no provider {} block
├── variables.tf # 9 flat, 1:1-mapped provider arguments; validation{} on the five enabled/disabled fields
├── main.tf # bigip_ltm_persistence_profile_ssl.this — thin, total, one-to-one passthrough
├── outputs.tf # name (primary cross-reference key), id
├── SCOPE.md # cross-module contract (this module's lightweight SCOPE.md)
└── README.md # this file

module "ssl_persistence" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/my-ssl-persistence"
  defaults_from = "/Common/ssl"
}

The caller's root module configures the bigip provider (address/username/password or token_value) — this module never declares its own provider {} block and accepts no auth variables.

Consumes:

Emits:

module "ssl_persistence_basic" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-basic"
  defaults_from = "/Common/ssl"
}

module "ssl_persistence_tuned_timeout" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-180s"
  defaults_from = "/Common/ssl"
  timeout       = 180
}

module "ssl_persistence_mirrored" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-mirrored"
  defaults_from = "/Common/ssl"
  mirror        = "enabled"
}

module "ssl_persistence_no_mirror" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-no-mirror"
  defaults_from = "/Common/ssl"
  mirror        = "disabled"
}

module "ssl_persistence_cross_pool" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name               = "/Common/ssl-persistence-cross-pool"
  defaults_from      = "/Common/ssl"
  match_across_pools = "enabled"
}

module "ssl_persistence_cross_service" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name                  = "/Common/ssl-persistence-cross-service"
  defaults_from         = "/Common/ssl"
  match_across_services = "enabled"
}

module "ssl_persistence_cross_virtual" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name                  = "/Common/ssl-persistence-cross-virtual"
  defaults_from         = "/Common/ssl"
  match_across_virtuals = "enabled"
}

module "ssl_persistence_broad_match" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name                  = "/Common/ssl-persistence-broad"
  defaults_from         = "/Common/ssl"
  match_across_pools    = "enabled"
  match_across_services = "enabled"
  match_across_virtuals = "enabled"
}

module "ssl_persistence_override_conn_limit" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name                = "/Common/ssl-persistence-override-limit"
  defaults_from       = "/Common/ssl"
  override_conn_limit = "enabled"
}

module "ssl_persistence_base" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-base"
  defaults_from = "/Common/ssl"
  timeout       = 300
}

module "ssl_persistence_chained" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-chained"
  defaults_from = module.ssl_persistence_base.name
  mirror        = "enabled"
}

module "ssl_persistence_iapp" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-iapp-scoped"
  defaults_from = "/Common/ssl"
  app_service   = "/Common/my-iapp.app/my-iapp"
}

module "ssl_persistence_short_timeout" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/ssl-persistence-short"
  defaults_from = "/Common/ssl"
  timeout       = 30
}

module "ssl_persistence_full" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name                  = "/Common/ssl-persistence-full"
  defaults_from         = "/Common/ssl"
  match_across_pools    = "disabled"
  match_across_services = "disabled"
  match_across_virtuals = "disabled"
  mirror                = "disabled"
  override_conn_limit   = "disabled"
  timeout               = 300
  app_service           = null
}

module "app_ssl_persistence" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-persistence-profile-ssl.git?ref=v1.0.0"

  name          = "/Common/app-ssl-persistence"
  defaults_from = "/Common/ssl"
  timeout       = 180
  mirror        = "enabled"
}

module "app_pool" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-pool.git?ref=v1.0.0"

  name          = "/Common/app-pool"
  monitor_names = ["/Common/app-http-monitor"]
  #...node/member wiring per terraform-bigip-ltm-pool's own README
}

module "app_virtual_server" {
  source = "git::https://github.com/microsoftexpert/terraform-bigip-ltm-virtual-server.git?ref=v1.0.0"

  name                     = "/Common/app-vs"
  pool_name                = module.app_pool.name
  persistence_profile_name = module.app_ssl_persistence.name
  destination              = "10.20.30.40:443"
  #...remaining virtual-server wiring per terraform-bigip-ltm-virtual-server's own README
}

Grouped summary (9 inputs total; only name and defaults_from are required):

• Flat passthrough, no rendering logic. main.tf maps every one of the 9 variables directly onto bigip_ltm_persistence_profile_ssl.this's matching argument — there is no for_each, no dynamic block, and no try wrapping, because every argument is a top-level scalar on this resource (unlike composite modules such as terraform-bigip-ltm-pool, which render nested member collections).
• Full-path identity drives replacement, not update. Because name encodes partition inline, changing partition or renaming the profile is a destroy/recreate, not an in-place change — any sibling module (e.g. terraform-bigip-ltm-virtual-server) still holding the old full path will fail to resolve it until its own persistence_profile_name input is updated in lockstep.
• Five fields are Optional+Computed, not merely Optional. match_across_pools, match_across_services, match_across_virtuals, mirror, and override_conn_limit are left null by default so the device supplies its own server-side default rather than this module guessing one — this also means terraform plan may show a computed value appear after the first apply even though the caller never set it.
• timeout's type is verified against the compiled schema, not the rendered doc. The registry's rendered prose describes timeout as "(enabled or disabled)," which is incorrect for this argument; variables.tf documents this discrepancy inline.
• No secret-shaped inputs. Unlike terraform-bigip-ltm-monitor (which carries a password), this resource's compiled schema exposes no credential-shaped argument, so no variable in this module is marked sensitive = true.

⚠️ Security trade-off called out explicitly: broadening match_across_pools, match_across_services, or match_across_virtuals (Examples 5–8) widens where a client's persistence record is honored across the device — beyond the single pool/service/virtual server that first created it. This module never enables that broadening implicitly; route any change to this posture for a production profile through the same Risk/Architecture review that would apply to any other traffic-scoping change, consistent with our regulated-environment posture.

cd C:\GitHubCode\newf5modules\bigip\terraform-bigip-ltm-persistence-profile-ssl
terraform init -backend=false
terraform validate
terraform fmt -check

Pin consumers to a released tag, e.g. ?ref=v1.0.0 — never to an unpinned branch.

This is an offline proof gate — it confirms the module is internally consistent, not that a real BIG-IP device accepts the configuration:

Only a real terraform plan/apply against an authenticated bigip provider instance exercises whether the target device actually accepts the chosen defaults_from parent, or how the five Optional+Computed fields resolve on that specific device/version — that step is a root-module/pipeline concern, not something this module's own offline gate can cover.

$ terraform apply

module.app_ssl_persistence.bigip_ltm_persistence_profile_ssl.this: Creating...
module.app_ssl_persistence.bigip_ltm_persistence_profile_ssl.this: Creation complete after 1s [id=/Common/app-ssl-persistence]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

name = "/Common/app-ssl-persistence"
id = "/Common/app-ssl-persistence"

• F5 Terraform provider reference: F5Networks/bigip bigip_ltm_persistence_profile_ssl resource, Terraform Registry.
• F5 clouddocs: persistence-profile role/permission model at clouddocs.f5.com.
• Sibling modules: terraform-bigip-ltm-virtual-server, terraform-bigip-ltm-pool, terraform-bigip-ltm-persistence-profile-srcaddr, terraform-bigip-ltm-persistence-profile-dstaddr, terraform-bigip-ltm-persistence-profile-cookie.
• This module's own SCOPE.md (cross-module contract).

💙 "Infrastructure as Code should be standardized, consistent, and secure."