1# Static Web Apps — Terraform Patterns — REFERENCE ONLY
2 
3> ⛔ **DO NOT COPY THIS CODE DIRECTLY**
4>
5> This file contains **reference patterns** for understanding Azure Static Web Apps Terraform structure.
6> Infrastructure for Static Web Apps must be composed using the Azure Prepare skill workflow, not copied directly from this reference.
7>
8> When composing infrastructure:
9> - Start from an approved base template for Static Web Apps defined by your platform or template team.
10> - Use `azurerm_static_web_app` — **NEVER** use Storage Account `static_website` for static web app hosting.
11>
12> Hand-writing Terraform from these patterns will result in missing tags, broken azd deploy, and policy violations.
13 
14> ⚠️ **WARNING: Do NOT use Storage Account static website hosting.**
15> Storage Account `static_website` requires anonymous blob access, which violates
16> enterprise Azure Policies (`RequestDisallowedByPolicy: "Anonymous blob access is not allowed"`).
17> Always use `azurerm_static_web_app` instead — it is fully managed and policy-compliant.
18 
19## Basic Resource
20 
21```hcl
22resource "azurerm_static_web_app" "web" {
23  name                = "swa-${var.environment_name}-${var.service_name}-${var.unique_hash}"
24  resource_group_name = azurerm_resource_group.main.name
25  location            = var.location
26 
27  # sku_tier defaults to "Free"; set to "Standard" for production features
28  sku_tier = "Standard"
29 
30  # Required for azd deploy to find this resource
31  tags = merge(var.tags, {
32    "azd-service-name" = var.service_name
33  })
34}
35```
36 
37> ⚠️ **Region availability is limited.** Check [region-availability.md](region-availability.md) before selecting a region.
38 
39> 💡 **Key Points:**
40> - No Storage Account, Service Plan, or other supporting resources required
41> - Static Web Apps is a fully managed service — storage is built-in
42> - The `azd-service-name` tag is **required** for `azd deploy` to locate the resource
43 
44## Custom Domain
45 
46```hcl
47resource "azurerm_static_web_app_custom_domain" "example" {
48  static_web_app_id = azurerm_static_web_app.web.id
49  domain_name       = "www.example.com"
50  validation_type   = "cname-delegation"
51}
52```
53 
54## Application Settings
55 
56For the integrated API backend:
57 
58```hcl
59resource "azurerm_static_web_app_function_app_registration" "api" {
60  static_web_app_id = azurerm_static_web_app.web.id
61  function_app_id   = azurerm_linux_function_app.api.id
62}
63```
64 
65Environment variables for the SWA (available to both frontend and managed Functions API):
66 
67```hcl
68resource "azurerm_static_web_app" "web" {
69  # ... (base configuration from above)
70 
71  app_settings = {
72    "DATABASE_URL" = "@Microsoft.KeyVault(VaultName=${azurerm_key_vault.kv.name};SecretName=db-url)"
73  }
74}
75```
76 
77## Outputs
78 
79```hcl
80output "WEB_URL" {
81  value = azurerm_static_web_app.web.default_host_name
82}
83 
84output "STATIC_WEB_APP_NAME" {
85  value = azurerm_static_web_app.web.name
86}
87```
88 
89> 💡 **Tip:** Output names in UPPERCASE are automatically set as azd environment variables.
90 
91## Deployment Token
92 
93> ⚠️ **Security Warning:** Do NOT expose deployment tokens in Terraform outputs.
94 
95See [deployment.md](deployment.md) for secure token handling.
96 
97## azure.yaml Integration
98 
99```yaml
100services:
101  web:
102    project: ./src/web
103    language: js
104    host: staticwebapp
105    dist: dist
106```
107 
108## References
109 
110- [AZD + Terraform](../../recipes/azd/terraform.md) — Full azd+Terraform project setup
111- [Region Availability](region-availability.md) — SWA is NOT available in all regions
112- [Routing and Auth](routing.md)
113- [Deployment](deployment.md)
114