Skip to content

Storage Account

Storage accounts are defined with the storage_accounts variable. Each entry manages one azurerm_storage_account and, optionally, its Azure Files shares, network rules, and identity-based file authentication.

Storage Account Variables Example

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
storage_accounts = {
    files = {
        resource_group                = "sharedinfra"
        account_replication_type      = "LRS"
        public_network_access_enabled = false

        # Identity-based auth for Azure Files
        azure_files_authentication = {
            directory_type                 = "AADDS"
            default_share_level_permission = "StorageFileDataSmbShareElevatedContributor"
        }

        shares = {
            epic-files = {
                quota = "150"
            }
        }
    }
}

Storage Account Variable Reference

Field Type Description Default
name string Account name. Composed from name_prefixes/name_suffixes and the map key when omitted. null
resource_group string Key of the rgs entry the account is created in. "sharedinfra"
account_tier string Standard or Premium. "Standard"
account_kind string Account kind. "StorageV2"
account_replication_type string Replication type (LRS, GRS, ...). "LRS"
public_network_access_enabled bool Allow access from public networks. true
min_tls_version string Minimum TLS version. "TLS1_2"
azure_files_authentication object Identity-based authentication for Azure Files, see below. null
network_rules object Default-deny network rules with subnet/IP exceptions. null
shares map(object) Azure Files shares keyed by name. {}
existing bool Reference an existing account instead of creating one. false
tags map(string) Merged with default_tags. {}

azure_files_authentication Reference

Field Type Description Default
directory_type string Directory service: AADDS (Entra Domain Services), AD (on-premises AD DS), or AADKERB. null
default_share_level_permission string Default identity-based share permission applied to all authenticated users when no explicit RBAC role assignment exists. One of StorageFileDataSmbShareReader, StorageFileDataSmbShareContributor, StorageFileDataSmbShareElevatedContributor, or None. null
active_directory object On-premises AD DS join properties. Required when directory_type = "AD"; see the reconciliation note below. null

The active_directory object carries domain_name, domain_guid, domain_sid, forest_name, netbios_domain_name, and storage_sid.

Identity-based share permissions

Setting default_share_level_permission grants every authenticated identity that mounts a share the named permission without a per-group RBAC assignment. This is the "Enable permissions for all authenticated users and groups" setting in the portal. Scope a group more tightly than the default by assigning a Storage File Data SMB Share * role on the individual share; the explicit assignment wins over the default.

Joining an existing AD domain (reconcile after the join)

For directory_type = "AD", the storage account is joined to an on-premises AD DS domain out of band with the Azure-provided Join-AzStorageAccount script (the AzFilesHybrid module). The script writes the account's active_directory properties (domain GUID/SID, forest, NetBIOS name, storage SID) directly in Azure.

This module manages the azure_files_authentication block, so after the manual join you must reconcile the join values back into the tfvars by populating the active_directory object to match what the script wrote:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
azure_files_authentication = {
    directory_type = "AD"
    active_directory = {
        domain_name         = "corp.example.com"
        domain_guid         = "<domain GUID>"
        domain_sid          = "<domain SID>"
        forest_name         = "corp.example.com"
        netbios_domain_name = "CORP"
        storage_sid         = "<storage account SID>"
    }
}

Read the values the join wrote from the live account (az storage account show ... --query azureFilesIdentityBasedAuthentication.activeDirectoryProperties, or the join script's own output) and copy them verbatim.

Note: If the active_directory object is left empty after a manual join, the next terraform apply removes those properties and unjoins the storage account from the domain. This module previously carried a lifecycle { ignore_changes = [azure_files_authentication] } that hid the join from Terraform; it was removed so that settings such as default_share_level_permission actually reconcile, which is what makes this manual reconciliation step necessary.

Note: AADDS (Entra Domain Services) does not use the active_directory block and does not require the join script or this reconciliation. Setting directory_type = "AADDS" is sufficient.