Skip to content

Commit 6beffe2

Browse files
brown9804brown9804
committed
synapse template
1 parent ed26e8d commit 6beffe2

8 files changed

Lines changed: 435 additions & 0 deletions

File tree

‎5_analytics-bigdata/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ Last updated: 2026-02-09
1515
## Templates available
1616

1717
- [Azure Data Factory](./data-factory)
18+
- [Azure Synapse Analytics (Workspace)](./synapse-analytics)
1819

1920
<!-- START BADGE -->
2021
<div align="center">

‎5_analytics-bigdata/synapse-analytics/README.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Terraform Template - Azure Synapse Analytics (Workspace)
2+
3+
Costa Rica
4+
5+
[![GitHub](https://img.shields.io/badge/--181717?logo=github&logoColor=ffffff)](https://github.com/)
6+
[brown9804](https://github.com/brown9804)
7+
8+
Last updated: 2026-02-11
9+
10+
------------------------------------------
11+
12+
> This template contains Terraform configurations to create an Azure Synapse Analytics workspace backed by an ADLS Gen2 filesystem.
13+
14+
> [!IMPORTANT]
15+
> This template creates the Storage Account and filesystem via the AzAPI provider (management plane) to avoid key-based Storage data-plane operations (common in environments where shared keys are disabled by policy).
16+
17+
> [!NOTE]
18+
> Synapse validates the default data lake storage using the DFS URL format: `https://<accountname>.dfs.core.windows.net/<filesystem>`. This template passes that format to `azurerm_synapse_workspace`.
19+
20+
## File Descriptions
21+
22+
- **main.tf**: Creates the Resource Group, Storage Account + filesystem (ADLS Gen2), and Synapse Workspace.
23+
- **variables.tf**: Defines the input variables used in the Terraform configuration.
24+
- **provider.tf**: Configures the AzureRM + AzAPI providers.
25+
- **terraform.tfvars**: Provides example values for the variables defined in `variables.tf`.
26+
- **outputs.tf**: Defines outputs such as the Synapse workspace ID.
27+
28+
## Variables
29+
30+
| Variable Name | Description | Type | Example Value |
31+
| --- | --- | --- | --- |
32+
| `resource_group_name` | Resource Group name to create/deploy into. | string | `"rg-analytics-dev"` |
33+
| `location` | Azure region for the deployment. | string | `"eastus"` |
34+
| `synapse_workspace_name` | Base Synapse workspace name. If suffix enabled, final is `<base>-<suffix>`. | string | `"synw-analytics-dev"` |
35+
| `managed_resource_group_name` | Base managed RG name for Synapse. If suffix enabled, final is `<base>-<suffix>`. | string | `"rg-synapse-managed-analytics-dev"` |
36+
| `storage_account_name` | Base storage account name. If suffix enabled, final is `<base><suffix>` (no dash). | string | `"stadlsanalyticsdev"` |
37+
| `filesystem_name` | ADLS Gen2 filesystem name (container). | string | `"synapse"` |
38+
| `sql_administrator_login` | Synapse SQL admin login. | string | `"sqladminuser"` |
39+
| `sql_administrator_password` | Synapse SQL admin password (prefer env var). | string | `"<set via TF_VAR_sql_administrator_password>"` |
40+
| `append_random_suffix` | Append a random suffix to avoid global collisions. | bool | `true` |
41+
| `random_suffix_length` | Length of the random suffix when enabled. | number | `6` |
42+
| `tags` | Tags applied to resources. | map(string) | `{ "env": "dev" }` |
43+
44+
## Usage
45+
46+
1. Authenticate:
47+
48+
```sh
49+
az login
50+
````
51+
52+
```sh
53+
az account show
54+
# If needed:
55+
az account set --subscription "<subscription-id-or-name>"
56+
```
57+
58+
3. Provide the SQL admin password without committing it:
59+
60+
PowerShell:
61+
62+
```powershell
63+
$env:TF_VAR_sql_administrator_password = "<your-strong-password>"
64+
```
65+
66+
4. Initialize:
67+
68+
```sh
69+
terraform init -upgrade
70+
```
71+
72+
5. Validate and plan:
73+
74+
```sh
75+
terraform validate
76+
terraform plan
77+
```
78+
79+
6. Apply:
80+
81+
```sh
82+
terraform apply -auto-approve
83+
```
84+
85+
> [!NOTE]
86+
> Synapse workspace names are globally unique. If you disable `append_random_suffix`, you may hit name collisions.
87+
88+
> [!NOTE]
89+
> The SQL admin password must meet complexity rules (at least 3 of: upper/lower/digit/special). Use `TF_VAR_sql_administrator_password` to avoid committing secrets.
90+
91+
<!-- START BADGE -->
92+
<div align="center">
93+
<img src="https://img.shields.io/badge/Total%20views-1706-limegreen" alt="Total views">
94+
<p>Refresh Date: 2026-02-11</p>
95+
</div>
96+
<!-- END BADGE -->
97+
98+
````

‎5_analytics-bigdata/synapse-analytics/main.tf‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# main.tf
2+
# Creates an Azure Synapse Analytics workspace backed by an ADLS Gen2 filesystem.
3+
# Storage resources are created via AzAPI (management plane) to avoid key-based data-plane operations.
4+
5+
resource "azurerm_resource_group" "rg" {
6+
name = var.resource_group_name
7+
location = var.location
8+
9+
tags = var.tags
10+
}
11+
12+
resource "random_string" "suffix" {
13+
length = var.random_suffix_length
14+
upper = false
15+
special = false
16+
numeric = true
17+
18+
keepers = {
19+
resource_group_name = var.resource_group_name
20+
location = var.location
21+
workspace_base = var.synapse_workspace_name
22+
storage_base = var.storage_account_name
23+
managed_rg_base = var.managed_resource_group_name
24+
}
25+
}
26+
27+
locals {
28+
suffix = var.append_random_suffix ? random_string.suffix.result : ""
29+
synapse_workspace_name = var.append_random_suffix ? "${var.synapse_workspace_name}-${local.suffix}" : var.synapse_workspace_name
30+
managed_rg_name = var.append_random_suffix ? "${var.managed_resource_group_name}-${local.suffix}" : var.managed_resource_group_name
31+
32+
# Storage Account names must be lowercase alphanumeric and cannot contain dashes.
33+
storage_account_name = var.append_random_suffix ? "${var.storage_account_name}${local.suffix}" : var.storage_account_name
34+
35+
# azurerm_synapse_workspace expects the Data Lake Gen2 filesystem id in DFS URL form.
36+
# Format: https://<accountname>.dfs.core.windows.net/<filesystem>
37+
dfs_filesystem_id = "https://${local.storage_account_name}.dfs.core.windows.net/${var.filesystem_name}"
38+
}
39+
40+
resource "azapi_resource" "storage_account" {
41+
type = "Microsoft.Storage/storageAccounts@2021-04-01"
42+
name = local.storage_account_name
43+
location = azurerm_resource_group.rg.location
44+
parent_id = azurerm_resource_group.rg.id
45+
46+
body = jsonencode({
47+
kind = "StorageV2"
48+
sku = {
49+
name = "Standard_LRS"
50+
}
51+
properties = {
52+
isHnsEnabled = true
53+
minimumTlsVersion = "TLS1_2"
54+
supportsHttpsTrafficOnly = true
55+
56+
# Often enforced by org policy; also avoids Terraform needing to use shared keys.
57+
allowSharedKeyAccess = false
58+
allowBlobPublicAccess = false
59+
}
60+
tags = var.tags
61+
})
62+
63+
response_export_values = [
64+
"id",
65+
"name"
66+
]
67+
}
68+
69+
resource "azapi_resource" "filesystem" {
70+
type = "Microsoft.Storage/storageAccounts/blobServices/containers@2022-09-01"
71+
name = var.filesystem_name
72+
73+
parent_id = "${azapi_resource.storage_account.id}/blobServices/default"
74+
75+
body = jsonencode({
76+
properties = {
77+
publicAccess = "None"
78+
}
79+
})
80+
81+
response_export_values = [
82+
"id",
83+
"name"
84+
]
85+
86+
depends_on = [
87+
azapi_resource.storage_account
88+
]
89+
}
90+
91+
resource "azurerm_synapse_workspace" "ws" {
92+
name = local.synapse_workspace_name
93+
resource_group_name = azurerm_resource_group.rg.name
94+
location = azurerm_resource_group.rg.location
95+
managed_resource_group_name = local.managed_rg_name
96+
storage_data_lake_gen2_filesystem_id = local.dfs_filesystem_id
97+
98+
sql_administrator_login = var.sql_administrator_login
99+
sql_administrator_login_password = var.sql_administrator_password
100+
101+
identity {
102+
type = "SystemAssigned"
103+
}
104+
105+
tags = var.tags
106+
107+
depends_on = [
108+
azapi_resource.filesystem
109+
]
110+
}

‎5_analytics-bigdata/synapse-analytics/outputs.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# outputs.tf
2+
3+
output "resource_group_id" {
4+
description = "The ID of the resource group."
5+
value = azurerm_resource_group.rg.id
6+
}
7+
8+
output "storage_account_id" {
9+
description = "The resource ID of the Storage Account backing Synapse."
10+
value = azapi_resource.storage_account.id
11+
}
12+
13+
output "filesystem_id" {
14+
description = "The ARM resource ID of the ADLS Gen2 filesystem (container)."
15+
value = azapi_resource.filesystem.id
16+
}
17+
18+
output "filesystem_dfs_url" {
19+
description = "The DFS URL format used by Synapse for the default data lake storage filesystem."
20+
value = "https://${azapi_resource.storage_account.name}.dfs.core.windows.net/${azapi_resource.filesystem.name}"
21+
}
22+
23+
output "synapse_workspace_id" {
24+
description = "The resource ID of the Synapse workspace."
25+
value = azurerm_synapse_workspace.ws.id
26+
}
27+
28+
output "synapse_workspace_name" {
29+
description = "The name of the Synapse workspace."
30+
value = azurerm_synapse_workspace.ws.name
31+
}

‎5_analytics-bigdata/synapse-analytics/provider.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# provider.tf
2+
# This file configures the Azure providers to interact with Azure resources.
3+
4+
terraform {
5+
required_version = ">= 1.8, < 2.0"
6+
7+
required_providers {
8+
azurerm = {
9+
source = "hashicorp/azurerm"
10+
version = "~> 3.116"
11+
}
12+
13+
azapi = {
14+
source = "Azure/azapi"
15+
version = "~> 1.13"
16+
}
17+
18+
random = {
19+
source = "hashicorp/random"
20+
version = "~> 3.6"
21+
}
22+
}
23+
}
24+
25+
provider "azurerm" {
26+
features {
27+
resource_group {
28+
prevent_deletion_if_contains_resources = false
29+
}
30+
}
31+
32+
# Uses the current Azure CLI context (az login + az account set)
33+
skip_provider_registration = false
34+
}
35+
36+
provider "azapi" {
37+
# Uses the current Azure CLI context (az login + az account set)
38+
}

‎5_analytics-bigdata/synapse-analytics/terraform.tfvars‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
resource_group_name = "rg-analytics-dev"
2+
location = "eastus"
3+
4+
# Synapse workspace names are globally unique.
5+
# This template appends a random suffix by default to reduce collisions.
6+
synapse_workspace_name = "synw-analytics-dev"
7+
managed_resource_group_name = "rg-synapse-managed-analytics-dev"
8+
9+
# Storage account names must be lowercase alphanumeric and globally unique.
10+
# This template appends a random suffix by default (without dashes).
11+
storage_account_name = "stadlsanalyticsdev"
12+
filesystem_name = "synapse"
13+
14+
sql_administrator_login = "sqladminuser"
15+
16+
# Do NOT commit real passwords. Prefer using:
17+
# $env:TF_VAR_sql_administrator_password = "<your-strong-password>"
18+
sql_administrator_password = "ChangeMe123!"
19+
20+
append_random_suffix = true
21+
random_suffix_length = 6
22+
23+
tags = {
24+
env = "dev"
25+
area = "analytics-bigdata"
26+
iac = "terraform"
27+
}

0 commit comments

Comments
 (0)