azurermLinuxFunctionAppSlot
Manages a Linux Function App Slot.
Example Usage
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as azurerm from "./.gen/providers/azurerm";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: azurerm.
For a more precise conversion please use the --provider flag in convert.*/
new azurerm.provider.AzurermProvider(this, "azurerm", {
features: [{}],
});
const azurermResourceGroupExample = new azurerm.resourceGroup.ResourceGroup(
this,
"example",
{
location: "West Europe",
name: "example-resources",
}
);
const azurermServicePlanExample = new azurerm.servicePlan.ServicePlan(
this,
"example_2",
{
location: azurermResourceGroupExample.location,
name: "example-app-service-plan",
os_type: "Linux",
resource_group_name: azurermResourceGroupExample.name,
sku_name: "Y1",
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermServicePlanExample.overrideLogicalId("example");
const azurermStorageAccountExample = new azurerm.storageAccount.StorageAccount(
this,
"example_3",
{
account_replication_type: "LRS",
account_tier: "Standard",
location: azurermResourceGroupExample.location,
name: "linuxfunctionappsa",
resource_group_name: azurermResourceGroupExample.name,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermStorageAccountExample.overrideLogicalId("example");
const azurermLinuxFunctionAppExample =
new azurerm.linuxFunctionApp.LinuxFunctionApp(this, "example_4", {
location: azurermResourceGroupExample.location,
name: "example-linux-function-app",
resource_group_name: azurermResourceGroupExample.name,
service_plan_id: azurermServicePlanExample.id,
site_config: [{}],
storage_account_name: azurermStorageAccountExample.name,
});
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermLinuxFunctionAppExample.overrideLogicalId("example");
const azurermLinuxFunctionAppSlotExample =
new azurerm.linuxFunctionAppSlot.LinuxFunctionAppSlot(this, "example_5", {
function_app_id: azurermLinuxFunctionAppExample.id,
name: "example-linux-function-app-slot",
site_config: [{}],
storage_account_name: azurermStorageAccountExample.name,
});
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermLinuxFunctionAppSlotExample.overrideLogicalId("example");
Arguments Reference
The following arguments are supported:
-
name
- (Required) Specifies the name of the Function App Slot. Changing this forces a new resource to be created. -
functionAppId
- (Required) The ID of the Linux Function App this Slot is a member of. Changing this forces a new resource to be created. -
siteConfig
- (Required) asiteConfig
block as detailed below.
-
appSettings
- (Optional) A map of key-value pairs for App Settings and custom values. -
authSettings
- (Optional) anauthSettings
block as detailed below. -
authSettingsV2
- (Optional) anauthSettingsV2
block as detailed below. -
backup
- (Optional) abackup
block as detailed below. -
builtinLoggingEnabled
- (Optional) Should built in logging be enabled. ConfiguresazureWebJobsDashboard
app setting based on the configured storage setting. Defaults totrue
. -
clientCertificateEnabled
- (Optional) Should the Function App Slot use Client Certificates. -
clientCertificateMode
- (Optional) The mode of the Function App Slot's client certificates requirement for incoming requests. Possible values arerequired
,optional
, andoptionalInteractiveUser
. -
clientCertificateExclusionPaths
- (Optional) Paths to exclude when using client certificates, separated by ; -
connectionString
- (Optional) aconnectionString
block as detailed below. -
contentShareForceDisabled
- (Optional) Force disable the content share settings. -
dailyMemoryTimeQuota
- (Optional) The amount of memory in gigabyte-seconds that your application is allowed to consume per day. Setting this value only affects function apps in Consumption Plans. Defaults to0
. -
enabled
- (Optional) Is the Linux Function App Slot enabled. Defaults totrue
. -
functionsExtensionVersion
- (Optional) The runtime version associated with the Function App Slot. Defaults to~4
. -
httpsOnly
- (Optional) Can the Function App Slot only be accessed via HTTPS? -
identity
- (Optional) Anidentity
block as detailed below. -
keyVaultReferenceIdentityId
- (Optional) The User Assigned Identity ID used for accessing KeyVault secrets. The identity must be assigned to the application in theidentity
block. For more information see - Access vaults with a user-assigned identity -
servicePlanId
- (Optional) The ID of the Service Plan in which to run this slot. If not specified the same Service Plan as the Linux Function App will be used. -
storageAccountAccessKey
- (Optional) The access key which will be used to access the storage account for the Function App Slot. -
storageAccountName
- (Optional) The backend storage account name which will be used by this Function App Slot. -
storageAccount
- (Optional) One or morestorageAccount
blocks as defined below. -
storageUsesManagedIdentity
- (Optional) Should the Function App Slot use its Managed Identity to access storage.
\~> NOTE: One of storageAccountAccessKey
or storageUsesManagedIdentity
must be specified when using storageAccountName
.
storageKeyVaultSecretId
- (Optional) The Key Vault Secret ID, optionally including version, that contains the Connection String to connect to the storage account for this Function App.
\~> NOTE: storageKeyVaultSecretId
cannot be used with storageAccountName
.
\~> NOTE: storageKeyVaultSecretId
used without a version will use the latest version of the secret, however, the service can take up to 24h to pick up a rotation of the latest version. See the official docs for more information.
-
tags
- (Optional) A mapping of tags which should be assigned to the Linux Function App. -
virtualNetworkSubnetId
- (Optional) The subnet id which will be used by this Function App Slot for regional virtual network integration.
\~> NOTE on regional virtual network integration: The AzureRM Terraform provider provides regional virtual network integration via the standalone resource app_service_virtual_network_swift_connection and in-line within this resource using the virtualNetworkSubnetId
property. You cannot use both methods simultaneously. If the virtual network is set via the resource appServiceVirtualNetworkSwiftConnection
then ignoreChanges
should be used in the function app slot configuration.
\~> Note: Assigning the virtualNetworkSubnetId
property requires RBAC permissions on the subnet
an authSettings
block supports the following:
-
enabled
- (Required) Should the Authentication / Authorization feature be enabled? -
activeDirectory
- (Optional) anactiveDirectory
block as detailed below. -
additionalLoginParameters
- (Optional) Specifies a map of login Parameters to send to the OpenID Connect authorization endpoint when a user logs in. -
allowedExternalRedirectUrls
- (Optional) anallowedExternalRedirectUrls
block as detailed below. -
defaultProvider
- (Optional) The default authentication provider to use when multiple providers are configured. Possible values include:azureActiveDirectory
,facebook
,google
,microsoftAccount
,twitter
,github
.
\~> NOTE: This setting is only needed if multiple providers are configured, and the unauthenticatedClientAction
is set to "RedirectToLoginPage".
-
facebook
- (Optional) afacebook
block as detailed below. -
github
- (Optional) agithub
block as detailed below. -
google
- (Optional) agoogle
block as detailed below. -
issuer
- (Optional) The OpenID Connect Issuer URI that represents the entity which issues access tokens.
\~> NOTE: When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/.
-
microsoft
- (Optional) amicrosoft
block as detailed below. -
runtimeVersion
- (Optional) The RuntimeVersion of the Authentication / Authorization feature in use. -
tokenRefreshExtensionHours
- (Optional) The number of hours after session token expiration that a session token can be used to call the token refresh API. Defaults to72
hours. -
tokenStoreEnabled
- (Optional) Should the Linux Web App durably store platform-specific security tokens that are obtained during login flows? Defaults tofalse
. -
twitter
- (Optional) atwitter
block as detailed below. -
unauthenticatedClientAction
- (Optional) The action to take when an unauthenticated client attempts to access the app. Possible values include:redirectToLoginPage
,allowAnonymous
.
An authSettingsV2
block supports the following:
-
authEnabled
- (Optional) Should the AuthV2 Settings be enabled. Defaults tofalse
. -
runtimeVersion
- (Optional) The Runtime Version of the Authentication and Authorisation feature of this App. Defaults to~1
. -
configFilePath
- (Optional) The path to the App Auth settings. -
\~> Note: Relative Paths are evaluated from the Site Root directory.
-
requireAuthentication
- (Optional) Should the authentication flow be used for all requests. -
unauthenticatedAction
- (Optional) The action to take for requests made without authentication. Possible values includeredirectToLoginPage
,allowAnonymous
,return401
, andreturn403
. Defaults toredirectToLoginPage
. -
defaultProvider
- (Optional) The Default Authentication Provider to use when more than one Authentication Provider is configured and theunauthenticatedAction
is set toredirectToLoginPage
. -
excludedPaths
- (Optional) The paths which should be excluded from theunauthenticatedAction
when it is set toredirectToLoginPage
. -
requireHttps
- (Optional) Should HTTPS be required on connections? Defaults totrue
. -
httpRouteApiPrefix
- (Optional) The prefix that should precede all the authentication and authorisation paths. Defaults to/Auth
. -
forwardProxyConvention
- (Optional) The convention used to determine the url of the request made. Possible values includeforwardProxyConventionNoProxy
,forwardProxyConventionStandard
,forwardProxyConventionCustom
. Defaults toforwardProxyConventionNoProxy
. -
forwardProxyCustomHostHeaderName
- (Optional) The name of the custom header containing the host of the request. -
forwardProxyCustomSchemeHeaderName
- (Optional) The name of the custom header containing the scheme of the request. -
appleV2
- (Optional) AnappleV2
block as defined below. -
activeDirectoryV2
- (Optional) AnactiveDirectoryV2
block as defined below. -
azureStaticWebAppV2
- (Optional) AnazureStaticWebAppV2
block as defined below. -
customOidcV2
- (Optional) Zero or morecustomOidcV2
blocks as defined below. -
facebookV2
- (Optional) AfacebookV2
block as defined below. -
githubV2
- (Optional) AgithubV2
block as defined below. -
googleV2
- (Optional) AgoogleV2
block as defined below. -
microsoftV2
- (Optional) AmicrosoftV2
block as defined below. -
twitterV2
- (Optional) AtwitterV2
block as defined below. -
login
- (Optional) Alogin
block as defined below.
An appleV2
block supports the following:
-
clientId
- (Required) The OpenID Connect Client ID for the Apple web application. -
clientSecretSettingName
- (Required) The app setting name that contains theclientSecret
value used for Apple Login.
!> NOTE: A setting with this name must exist in appSettings
to function correctly.
loginScopes
- A list of Login Scopes provided by this Authentication Provider.
\~> NOTE: This is configured on the Authentication Provider side and is Read Only here.
An activeDirectoryV2
block supports the following:
-
clientId
- (Required) The ID of the Client to use to authenticate with Azure Active Directory. -
tenantAuthEndpoint
- (Required) The Azure Tenant Endpoint for the Authenticating Tenant. e.g.https://loginMicrosoftonlineCom/v20/{tenantGuid}/
-
clientSecretSettingName
- (Optional) The App Setting name that contains the client secret of the Client.
!> NOTE: A setting with this name must exist in appSettings
to function correctly.
clientSecretCertificateThumbprint
- (Optional) The thumbprint of the certificate used for signing purposes.
\~> NOTE: One of clientSecretSettingName
or clientSecretCertificateThumbprint
must be specified.
-
jwtAllowedGroups
- (Optional) A list of Allowed Groups in the JWT Claim. -
jwtAllowedClientApplications
- (Optional) A list of Allowed Client Applications in the JWT Claim. -
wwwAuthenticationDisabled
- (Optional) Should the www-authenticate provider should be omitted from the request? Defaults tofalse
-
allowedGroups
- (Optional) The list of allowed Group Names for the Default Authorisation Policy. -
allowedIdentities
- (Optional) The list of allowed Identities for the Default Authorisation Policy. -
allowedApplications
- (Optional) The list of allowed Applications for the Default Authorisation Policy. -
loginParameters
- (Optional) A map of key-value pairs to send to the Authorisation Endpoint when a user logs in. -
allowedAudiences
- (Optional) Specifies a list of Allowed audience values to consider when validating JWTs issued by Azure Active Directory.
\~> NOTE: This is configured on the Authentication Provider side and is Read Only here.
An azureStaticWebAppV2
block supports the following:
clientId
- (Required) The ID of the Client to use to authenticate with Azure Static Web App Authentication.
A customOidcV2
block supports the following:
name
- (Required) The name of the Custom OIDC Authentication Provider.
\~> NOTE: An appSetting
matching this value in upper case with the suffix of providerAuthenticationSecret
is required. e.g. myoidcProviderAuthenticationSecret
for a value of myoidc
.
-
clientId
- (Required) The ID of the Client to use to authenticate with the Custom OIDC. -
openidConfigurationEndpoint
- (Required) The app setting name that contains theclientSecret
value used for the Custom OIDC Login. -
nameClaimType
- (Optional) The name of the claim that contains the users name. -
scopes
- (Optional) The list of the scopes that should be requested while authenticating. -
clientCredentialMethod
- The Client Credential Method used. -
clientSecretSettingName
- The App Setting name that contains the secret for this Custom OIDC Client. This is generated fromname
above and suffixed withproviderAuthenticationSecret
. -
authorisationEndpoint
- The endpoint to make the Authorisation Request as supplied byopenidConfigurationEndpoint
response. -
tokenEndpoint
- The endpoint used to request a Token as supplied byopenidConfigurationEndpoint
response. -
issuerEndpoint
- The endpoint that issued the Token as supplied byopenidConfigurationEndpoint
response. -
certificationUri
- The endpoint that provides the keys necessary to validate the token as supplied byopenidConfigurationEndpoint
response.
A facebookV2
block supports the following:
-
appId
- (Required) The App ID of the Facebook app used for login. -
appSecretSettingName
- (Required) The app setting name that contains theappSecret
value used for Facebook Login.
!> NOTE: A setting with this name must exist in appSettings
to function correctly.
-
graphApiVersion
- (Optional) The version of the Facebook API to be used while logging in. -
loginScopes
- (Optional) The list of scopes that should be requested as part of Facebook Login authentication.
A githubV2
block supports the following:
-
clientId
- (Required) The ID of the GitHub app used for login.. -
clientSecretSettingName
- (Required) The app setting name that contains theclientSecret
value used for GitHub Login.
!> NOTE: A setting with this name must exist in appSettings
to function correctly.
loginScopes
- (Optional) The list of OAuth 2.0 scopes that should be requested as part of GitHub Login authentication.
A googleV2
block supports the following:
-
clientId
- (Required) The OpenID Connect Client ID for the Google web application. -
clientSecretSettingName
- (Required) The app setting name that contains theclientSecret
value used for Google Login.
!> NOTE: A setting with this name must exist in appSettings
to function correctly.
-
allowedAudiences
- (Optional) Specifies a list of Allowed Audiences that should be requested as part of Google Sign-In authentication. -
loginScopes
- (Optional) The list of OAuth 2.0 scopes that should be requested as part of Google Sign-In authentication.
A microsoftV2
block supports the following:
-
clientId
- (Required) The OAuth 2.0 client ID that was created for the app used for authentication. -
clientSecretSettingName
- (Required) The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication.
!> NOTE: A setting with this name must exist in appSettings
to function correctly.
-
allowedAudiences
- (Optional) Specifies a list of Allowed Audiences that will be requested as part of Microsoft Sign-In authentication. -
loginScopes
- (Optional) The list of Login scopes that should be requested as part of Microsoft Account authentication.
A twitterV2
block supports the following:
-
consumerKey
- (Required) The OAuth 1.0a consumer key of the Twitter application used for sign-in. -
consumerSecretSettingName
- (Required) The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in.
!> NOTE: A setting with this name must exist in appSettings
to function correctly.
A login
block supports the following:
-
logoutEndpoint
- (Optional) The endpoint to which logout requests should be made. -
tokenStoreEnabled
- (Optional) Should the Token Store configuration Enabled. Defaults tofalse
-
tokenRefreshExtensionTime
- (Optional) The number of hours after session token expiration that a session token can be used to call the token refresh API. Defaults to72
hours. -
tokenStorePath
- (Optional) The directory path in the App Filesystem in which the tokens will be stored. -
tokenStoreSasSettingName
- (Optional) The name of the app setting which contains the SAS URL of the blob storage containing the tokens. -
preserveUrlFragmentsForLogins
- (Optional) Should the fragments from the request be preserved after the login request is made. Defaults tofalse
. -
allowedExternalRedirectUrls
- (Optional) External URLs that can be redirected to as part of logging in or logging out of the app. This is an advanced setting typically only needed by Windows Store application backends.
\~> Note: URLs within the current domain are always implicitly allowed.
-
cookieExpirationConvention
- (Optional) The method by which cookies expire. Possible values include:fixedTime
, andidentityProviderDerived
. Defaults tofixedTime
. -
cookieExpirationTime
- (Optional) The time after the request is made when the session cookie should expire. Defaults to08:00:00
. -
validateNonce
- (Optional) Should the nonce be validated while completing the login flow. Defaults totrue
. -
nonceExpirationTime
- (Optional) The time after the request is made when the nonce should expire. Defaults to00:05:00
.
A backup
block supports the following:
-
name
- (Required) The name which should be used for this Backup. -
schedule
- (Required) aschedule
block as detailed below. -
storageAccountUrl
- (Required) The SAS URL to the container. -
enabled
- (Optional) Should this backup job be enabled? Defaults totrue
.
A connectionString
block supports the following:
-
name
- (Required) The name which should be used for this Connection. -
type
- (Required) Type of database. Possible values include:apiHub
,custom
,docDb
,eventHub
,mySql
,notificationHub
,postgreSql
,redisCache
,serviceBus
,sqlAzure
, andsqlServer
. -
value
- (Required) The connection string value.
An identity
block supports the following:
-
type
- (Required) Specifies the type of Managed Service Identity that should be configured on this Linux Function App Slot. Possible values aresystemAssigned
,userAssigned
,systemAssigned,UserAssigned
(to enable both). -
identityIds
- (Optional) A list of User Assigned Managed Identity IDs to be assigned to this Linux Function App Slot.
\~> NOTE: This is required when type
is set to userAssigned
or systemAssigned,UserAssigned
.
A siteConfig
block supports the following:
-
alwaysOn
- (Optional) If this Linux Web App is Always On enabled. Defaults tofalse
. -
apiDefinitionUrl
- (Optional) The URL of the API definition that describes this Linux Function App. -
apiManagementApiId
- (Optional) The ID of the API Management API for this Linux Function App. -
appCommandLine
- (Optional) The program and any arguments used to launch this app via the command line. (ExamplenodeMyappJs
). -
appScaleLimit
- (Optional) The number of workers this function app can scale out to. Only applicable to apps on the Consumption and Premium plan. -
appServiceLogs
- (Optional) anappServiceLogs
block as detailed below. -
applicationInsightsConnectionString
- (Optional) The Connection String for linking the Linux Function App to Application Insights. -
applicationInsightsKey
- (Optional) The Instrumentation Key for connecting the Linux Function App to Application Insights. -
applicationStack
- (Optional) anapplicationStack
block as detailed below. -
autoSwapSlotName
- (Optional) The name of the slot to automatically swap with when this slot is successfully deployed. -
containerRegistryManagedIdentityClientId
- (Optional) The Client ID of the Managed Service Identity to use for connections to the Azure Container Registry. -
containerRegistryUseManagedIdentity
- (Optional) Should connections for Azure Container Registry use Managed Identity. -
cors
- (Optional) acors
block as detailed below. -
defaultDocuments
- (Optional) adefaultDocuments
block as detailed below. -
detailedErrorLoggingEnabled
- Is detailed error logging enabled -
elasticInstanceMinimum
- (Optional) The number of minimum instances for this Linux Function App. Only affects apps on Elastic Premium plans. -
ftpsState
- (Optional) State of FTP / FTPS service for this function app. Possible values include:allAllowed
,ftpsOnly
anddisabled
. Defaults todisabled
. -
healthCheckEvictionTimeInMin
- (Optional) The amount of time in minutes that a node is unhealthy before being removed from the load balancer. Possible values are between2
and10
. Defaults to10
. Only valid in conjunction withhealthCheckPath
-
healthCheckPath
- (Optional) The path to be checked for this function app health. -
http2Enabled
- (Optional) Specifies if the HTTP2 protocol should be enabled. Defaults tofalse
. -
ipRestriction
- (Optional) anipRestriction
block as detailed below. -
linuxFxVersion
- The Linux FX Version -
loadBalancingMode
- (Optional) The Site load balancing mode. Possible values include:weightedRoundRobin
,leastRequests
,leastResponseTime
,weightedTotalTraffic
,requestHash
,perSiteRoundRobin
. Defaults toleastRequests
if omitted. -
managedPipelineMode
- (Optional) The Managed Pipeline mode. Possible values include:integrated
,classic
. Defaults tointegrated
. -
minimumTlsVersion
- (Optional) The configures the minimum version of TLS required for SSL requests. Possible values include:10
,11
, and12
. Defaults to12
. -
preWarmedInstanceCount
- (Optional) The number of pre-warmed instances for this function app. Only affects apps on an Elastic Premium plan. -
remoteDebuggingEnabled
- (Optional) Should Remote Debugging be enabled. Defaults tofalse
. -
remoteDebuggingVersion
- (Optional) The Remote Debugging Version. Possible values includevs2017
,vs2019
, andvs2022
-
runtimeScaleMonitoringEnabled
- (Optional) Should Functions Runtime Scale Monitoring be enabled.
\~> NOTE: Functions runtime scale monitoring can only be enabled for Elastic Premium Function Apps or Workflow Standard Logic Apps and requires a minimum prewarmed instance count of 1.
-
scmIpRestriction
- (Optional) ascmIpRestriction
block as detailed below. -
scmMinimumTlsVersion
- (Optional) Configures the minimum version of TLS required for SSL requests to the SCM site Possible values include:10
,11
, and12
. Defaults to12
. -
scmType
- The SCM Type in use by the Linux Function App. -
scmUseMainIpRestriction
- (Optional) Should the Linux Function AppipRestriction
configuration be used for the SCM also. -
use32BitWorker
- (Optional) Should the Linux Web App use a 32-bit worker. -
vnetRouteAllEnabled
- (Optional) Should all outbound traffic to have NAT Gateways, Network Security Groups and User Defined Routes applied? Defaults tofalse
. -
websocketsEnabled
- (Optional) Should Web Sockets be enabled. Defaults tofalse
. -
workerCount
- (Optional) The number of Workers for this Linux Function App.
A siteCredential
block supports the following:
-
name
- The Site Credentials Username used for publishing. -
password
- The Site Credentials Password used for publishing.
An activeDirectory
block supports the following:
-
clientId
- (Required) The ID of the Client to use to authenticate with Azure Active Directory. -
allowedAudiences
- (Optional) anallowedAudiences
block as detailed below.
\~> Note: The clientId
value is always considered an allowed audience.
-
clientSecret
- (Optional) The Client Secret for the Client ID. Cannot be used withclientSecretSettingName
. -
clientSecretSettingName
- (Optional) The App Setting name that contains the client secret of the Client. Cannot be used withclientSecret
.
A facebook
block supports the following:
-
appId
- (Required) The App ID of the Facebook app used for login. -
appSecret
- (Optional) The App Secret of the Facebook app used for Facebook login. Cannot be specified withappSecretSettingName
. -
appSecretSettingName
- (Optional) The app setting name that contains theappSecret
value used for Facebook login. Cannot be specified withappSecret
. -
oauthScopes
- (Optional) Specifies a list of OAuth 2.0 scopes to be requested as part of Facebook login authentication.
A github
block supports the following:
-
clientId
- (Required) The ID of the GitHub app used for login. -
clientSecret
- (Optional) The Client Secret of the GitHub app used for GitHub login. Cannot be specified withclientSecretSettingName
. -
clientSecretSettingName
- (Optional) The app setting name that contains theclientSecret
value used for GitHub login. Cannot be specified withclientSecret
. -
oauthScopes
- (Optional) Specifies a list of OAuth 2.0 scopes that will be requested as part of GitHub login authentication.
A google
block supports the following:
-
clientId
- (Required) The OpenID Connect Client ID for the Google web application. -
clientSecret
- (Optional) The client secret associated with the Google web application. Cannot be specified withclientSecretSettingName
. -
clientSecretSettingName
- (Optional) The app setting name that contains theclientSecret
value used for Google login. Cannot be specified withclientSecret
. -
oauthScopes
- (Optional) Specifies a list of OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. If not specified,openid
,profile
, andemail
are used as default scopes.
A microsoft
block supports the following:
-
clientId
- (Required) The OAuth 2.0 client ID that was created for the app used for authentication. -
clientSecret
- (Optional) The OAuth 2.0 client secret that was created for the app used for authentication. Cannot be specified withclientSecretSettingName
. -
clientSecretSettingName
- (Optional) The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication. Cannot be specified withclientSecret
. -
oauthScopes
- (Optional) Specifies a list of OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. If not specified,wlBasic
is used as the default scope.
A twitter
block supports the following:
-
consumerKey
- (Required) The OAuth 1.0a consumer key of the Twitter application used for sign-in. -
consumerSecret
- (Optional) The OAuth 1.0a consumer secret of the Twitter application used for sign-in. Cannot be specified withconsumerSecretSettingName
. -
consumerSecretSettingName
- (Optional) The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in. Cannot be specified withconsumerSecret
.
A schedule
block supports the following:
frequencyInterval
- (Required) How often the backup should be executed (e.g. for weekly backup, this should be set to7
andfrequencyUnit
should be set today
).
\~> NOTE: Not all intervals are supported on all Linux Function App SKUs. Please refer to the official documentation for appropriate values.
-
frequencyUnit
- (Required) The unit of time for how often the backup should take place. Possible values include:day
andhour
. -
keepAtLeastOneBackup
- (Optional) Should the service keep at least one backup, regardless of age of backup. Defaults tofalse
. -
retentionPeriodDays
- (Optional) After how many days backups should be deleted. Defaults to30
. -
startTime
- (Optional) When the schedule should start working in RFC-3339 format. -
lastExecutionTime
- The time the backup was last attempted.
An appServiceLogs
block supports the following:
-
diskQuotaMb
- (Optional) The amount of disk space to use for logs. Valid values are between25
and100
. Defaults to35
. -
retentionPeriodDays
- (Optional) The retention period for logs in days. Valid values are between0
and99999
.(never delete).
\~> NOTE: This block is not supported on Consumption plans.
An applicationStack
block supports the following:
-
docker
- (Optional) adocker
block as detailed below. -
dotnetVersion
- (Optional) The version of .Net. Possible values are31
,60
and70
. -
useDotnetIsolatedRuntime
- (Optional) Should the DotNet process use an isolated runtime. Defaults tofalse
. -
javaVersion
- (Optional) The version of Java to use. Possible values are8
,11
&17
(In-Preview). -
nodeVersion
- (Optional) The version of Node to use. Possible values include12
,14
,16
and18
-
powershellCoreVersion
- (Optional) The version of PowerShell Core to use. Possibles values are7
, and72
. -
pythonVersion
- (Optional) The version of Python to use. Possible values are310
,39
,38
and37
. -
useCustomRuntime
- (Optional) Should the Linux Function App use a custom runtime?
A cors
block supports the following:
-
allowedOrigins
- (Required) anallowedOrigins
block as detailed below. -
supportCredentials
- (Optional) Are credentials allowed in CORS requests? Defaults tofalse
.
A docker
block supports the following:
-
registryUrl
- (Required) The URL of the docker registry. -
imageName
- (Required) The name of the Docker image to use. -
imageTag
- (Required) The image tag of the image to use. -
registryUsername
- (Optional) The username to use for connections to the registry.
\~> NOTE: This value is required if containerRegistryUseManagedIdentity
is not set to true
.
registryPassword
- (Optional) The password for the account to use to connect to the registry.
\~> NOTE: This value is required if containerRegistryUseManagedIdentity
is not set to true
.
A headers
block supports the following:
\~> NOTE: Please see the official Azure Documentation for details on using header filtering.
-
xAzureFdid
- (Optional) Specifies a list of Azure Front Door IDs. -
xFdHealthProbe
- (Optional) Specifies if a Front Door Health Probe should be expected. The only possible value is1
. -
xForwardedFor
- (Optional) Specifies a list of addresses for which matching should be applied. Omitting this value means allow any. -
xForwardedHost
- (Optional) Specifies a list of Hosts for which matching should be applied.
An ipRestriction
block supports the following:
-
action
- (Optional) The action to take. Possible values areallow
ordeny
. -
headers
- (Optional) aheaders
block as detailed below. -
ipAddress
- (Optional) The CIDR notation of the IP or IP Range to match. For example:10000/24
or192168101/32
-
name
- (Optional) The name which should be used for thisipRestriction
. -
priority
- (Optional) The priority value of thisipRestriction
. Defaults to65000
. -
serviceTag
- (Optional) The Service Tag used for this IP Restriction. -
virtualNetworkSubnetId
- (Optional) The Virtual Network Subnet ID used for this IP Restriction.
\~> NOTE: One and only one of ipAddress
, serviceTag
or virtualNetworkSubnetId
must be specified.
A scmIpRestriction
block supports the following:
-
action
- (Optional) The action to take. Possible values areallow
ordeny
. -
headers
- (Optional) aheaders
block as detailed below. -
ipAddress
- (Optional) The CIDR notation of the IP or IP Range to match. For example:10000/24
or192168101/32
-
name
- (Optional) The name which should be used for thisipRestriction
. -
priority
- (Optional) The priority value of thisipRestriction
. Defaults to65000
. -
serviceTag
- (Optional) The Service Tag used for this IP Restriction. -
virtualNetworkSubnetId
- (Optional) The Virtual Network Subnet ID used for this IP Restriction.ENDEXPERIMENT
\~> NOTE: One and only one of ipAddress
, serviceTag
or virtualNetworkSubnetId
must be specified.
A storageAccount
block supports the following:
-
accessKey
- (Required) The Access key for the storage account. -
accountName
- (Required) The Name of the Storage Account. -
name
- (Required) The name which should be used for this Storage Account. -
shareName
- (Required) The Name of the File Share or Container Name for Blob storage. -
type
- (Required) The Azure Storage Type. Possible values includeazureFiles
andazureBlob
. -
mountPath
- (Optional) The path at which to mount the storage share.
Attributes Reference
In addition to the Arguments listed above - the following Attributes are exported:
-
id
- The ID of the Linux Function App Slot -
customDomainVerificationId
- The identifier used by App Service to perform domain ownership verification via DNS TXT record. -
defaultHostname
- The default hostname of the Linux Function App Slot. -
identity
- Anidentity
block as defined below. -
kind
- The Kind value for this Linux Function App Slot. -
outboundIpAddressList
- A list of outbound IP addresses. For example["5223253", "521434312"]
-
outboundIpAddresses
- A comma separated list of outbound IP addresses as a string. For example5223253,521434312
. -
possibleOutboundIpAddressList
- A list of possible outbound IP addresses, not all of which are necessarily in use. This is a superset ofoutboundIpAddressList
. For example["5223253", "521434312"]
. -
possibleOutboundIpAddresses
- A comma separated list of possible outbound IP addresses as a string. For example5223253,521434312,521434317
. This is a superset ofoutboundIpAddresses
. For example["5223253", "521434312","521434317"]
. -
siteCredential
- AsiteCredential
block as defined below.
An identity
block exports the following:
-
principalId
- The Principal ID associated with this Managed Service Identity. -
tenantId
- The Tenant ID associated with this Managed Service Identity.
A siteCredential
block exports the following:
-
name
- The Site Credentials Username used for publishing. -
password
- The Site Credentials Password used for publishing.
Timeouts
The timeouts
block allows you to specify timeouts for certain actions:
create
- (Defaults to 30 minutes) Used when creating the Linux Function App Slot.update
- (Defaults to 30 minutes) Used when updating the Linux Function App Slot.read
- (Defaults to 5 minutes) Used when retrieving the Linux Function App Slot.delete
- (Defaults to 30 minutes) Used when deleting the Linux Function App Slot.
Import
A Linux Function App Slot can be imported using the resourceId
, e.g.