Azpg provision iac

Provision Flexible Server as IaC

Stand up Azure Database for PostgreSQL — Flexible Server declaratively, with the security, DR, and networking posture chosen at creation rather than retrofitted. Three grounded paths: Terraform via Azure Verified Modules (AVM), Terraform via the raw azurerm_postgresql_flexible_server resource, and Bicep via AVM. A guarded az ... create helper covers the imperative quick-path.

This skill is read-write. Reading the target subscription, listing existing servers, and generating / reviewing IaC templates are safe and run automatically. Anything that actually provisions infrastructure (terraform apply, az deployment, az postgres flexible-server create) is a guarded write — present the plan, get explicit confirmation, and run the bundled scripts/ (dry-run capable) or terraform plan first. See Safety protocol.

Module sources, resource arguments, and CLI verbs in this skill are verified against the AVM registry and Microsoft Learn (2026-07). Do not substitute unverified argument names or SKU strings. For the full parameter map read reference.md; for creation-time-only limits read azure-constraints.md.

Live instance context (dynamic injection)

Ground the plan in the real subscription before writing templates, so region, naming, and provider state are correct rather than assumed. Assumes the Azure CLI is logged in. These are read-only and safe to auto-run.

• Target subscription / tenant: !az account show --query "{subscription:name, subscriptionId:id, tenant:tenantId}" -o json 2>/dev/null || echo "(not logged in — run 'az login')"
• Resource provider registration (must be 'Registered' to deploy): !az provider show -n Microsoft.DBforPostgreSQL --query registrationState -o tsv 2>/dev/null || echo "(unknown — run 'az provider register -n Microsoft.DBforPostgreSQL')"
• Existing Flexible Servers (avoid name collisions; names are globally unique): !az postgres flexible-server list --query "[].{name:name, rg:resourceGroup, region:location, version:version}" -o table 2>/dev/null || echo "(none or no access)"

If injection is unavailable, run scripts/show_provisioning_context.sh and read its output instead. Never assume a region default or that the provider is registered — verify.

When to use this skill

Trigger on: "provision a Postgres server", "write Terraform/Bicep for our database", "which AVM module for Flexible Server?", "stand up a dev/prod Postgres with HA", "set up private networking for Postgres", "enable Entra auth at creation", "we need geo-redundant backups", or any greenfield database infrastructure work. For changing an existing server's parameters use azpg-config-tuning; for scaling compute/storage use scaling-and-storage; for backup/restore of a running server use azpg-backup-pitr.

Decision flow

Work through these in order. Steps 1–3 are read/design (safe); step 4 is write/provision (guarded).

1. Inspect the subscription (section above). Confirm login, provider registration, target region, and that the intended server name is free.
2. Choose the IaC path. AVM Terraform is the recommended default (opinionated secure defaults, maintained); raw azurerm when you need full control or already have an azurerm codebase; Bicep AVM for Bicep shops. See the table below and reference.md.
3. Design creation-time decisions — these cannot be changed later without recreating the server. Pin them now (table below) and cross-wire the dependent azpg skills.
4. Provision (guarded write) — terraform plan → review → apply, or the guarded scripts/provision_server.sh (dry-run) → --apply. Then verify.

Choosing an IaC path (summary)

Path	Source	Best for	Notes
AVM Terraform	Azure/avm-res-dbforpostgresql-flexibleserver/azurerm	Most teams; secure-by-default	Pin a version; module is 0.x (pre-GA)
Raw azurerm	azurerm_postgresql_flexible_server	Full control / existing azurerm code	You own the secure defaults
AVM Bicep	br/public:avm/res/db-for-postgre-sql/flexible-server	Bicep shops	Consult AVM reference for exact params

Only these three are recommended. Full walkthrough: examples/terraform_avm.md.

Creation-time-only decisions (lock in before apply)

Getting these wrong means recreating the server later. Each wires into another azpg skill:

Decision	Argument (azurerm)	Why it's creation-time	Wires into
Server name	name	Globally unique; immutable	—
Geo-redundant backup	geo_redundant_backup_enabled	Forces new server to change	azpg-backup-pitr (geo-restore)
VNet injection	delegated_subnet_id + private_dns_zone_id	Forces new server; needs private DNS	networking
Public vs private access	public_network_access_enabled	Must be false with a delegated subnet	networking
Entra authentication	authentication.active_directory_auth_enabled	Set at/near creation; needs tenant_id	azpg-roles-rbac
Major version	version	Downgrade forces new server	upgrades

The sku_name (compute), storage_mb/storage_tier, backup_retention_days (7–35), and high_availability can be adjusted after creation with caveats — see azure-constraints.md. Extension allow-listing (azure.extensions) is a post-provision parameter step owned by the skill that needs the extension (e.g. azpg-pgvector-rag), but flag it here so it isn't forgotten.

Read / design steps (safe · auto)

These never provision anything. Run them freely.

• Provisioning context — scripts/show_provisioning_context.sh reports the subscription, region, provider registration, and existing servers so a new deployment doesn't collide or land in the wrong place.
• Preview a Terraform plan — terraform plan is read-only against Azure: it shows exactly what would be created without creating it. Always run it before apply and show the user the resource count and any forces replacement.
• What-if a Bicep/ARM deploy — az deployment group what-if previews changes without applying them.

Write / provision steps (explicit · guarded)

Do not run these without presenting the plan and getting explicit confirmation. Provisioning creates billable infrastructure and locks in the creation-time decisions above.

Path A · Terraform (AVM — recommended)

Reference the pinned AVM module; supply the three required inputs (name, location, resource_group_name) plus the secure-default overrides. Full module block with Entra auth, HA, and geo-redundancy is in examples/terraform_avm.md.

module "postgres" {
  source  = "Azure/avm-res-dbforpostgresql-flexibleserver/azurerm"
  version = "0.2.3"  # pin; module is pre-GA (0.x)

  name                = "myapp-pg-prod"
  location            = "swedencentral"
  resource_group_name = azurerm_resource_group.this.name

  server_version               = "16"
  sku_name                     = "GP_Standard_D2s_v3"
  storage_mb                   = 131072
  geo_redundant_backup_enabled = true      # creation-time only
}

Provision: terraform init && terraform plan → review → terraform apply.

Path B · Terraform (raw azurerm)

Use when you need full control. Required: name, resource_group_name, location. The sku_name follows the <tier>_<name> pattern (B_Standard_B1ms, GP_Standard_D2s_v3, MO_Standard_E4s_v3); version is one of 14–18 (supported). See reference.md for the full block including the authentication, high_availability, and VNet path.

resource "azurerm_postgresql_flexible_server" "this" {
  name                = "myapp-pg-prod"
  resource_group_name = azurerm_resource_group.this.name
  location            = "swedencentral"
  version             = "16"
  sku_name            = "GP_Standard_D2s_v3"
  storage_mb          = 131072

  authentication {
    active_directory_auth_enabled = true
    password_auth_enabled         = false
    tenant_id                     = data.azurerm_client_config.current.tenant_id
  }

  geo_redundant_backup_enabled = true
  backup_retention_days        = 14

  lifecycle {
    ignore_changes = [zone, high_availability[0].standby_availability_zone]
  }
}

ignore_changes on zone / standby zone prevents Terraform from fighting a post-failover zone swap. Verified guidance from the azurerm provider docs.

Path C · Bicep (AVM)

module postgres 'br/public:avm/res/db-for-postgre-sql/flexible-server:<version>' = {
  name: 'postgresDeploy'
  params: {
    name: 'myapp-pg-prod'
    location: resourceGroup().location
    // Consult the AVM reference for exact param names (skuName, storage, etc.)
  }
}

Pin <version> and consult the AVM Bicep reference for the exact parameter set (the Bicep module's param names differ from the Terraform module's).

Path D · Imperative (guarded az CLI)

For a quick, scripted create outside an IaC codebase, use scripts/provision_server.sh — it assembles an az postgres flexible-server create with secure defaults (Entra auth on, password auth off, geo-redundant backup), prints the exact command under --dry-run, and creates nothing until --apply.

Safety protocol

1. Inspect first. Confirm login, provider registration, region, and name availability before writing or applying anything.
2. Plan → confirm → execute. Always terraform plan / what-if / --dry-run and show the user what will be created (and its monthly cost ballpark) before apply.
3. Use the scripts / plan output, not blind applies. The guarded provision_server.sh is dry-run by default; IaC paths must show a plan first.
4. Lock creation-time decisions deliberately. Geo-redundancy, VNet injection, server name, and major version can't be changed in place — call these out explicitly in the plan so the user commits to them knowingly.
5. Secure by default. Prefer Entra auth (active_directory_auth_enabled) over password-only; keep secrets out of state (administrator_password_wo or Key Vault); enable private networking for anything non-dev.
6. Cross-wire the dependent skills. Provisioning is where DR (azpg-backup-pitr), auth (azpg-roles-rbac), and extension allow-listing (azpg-pgvector-rag and others) are set up front — hand off explicitly.
7. Contain blast radius. Run apply in a subagent where the harness supports it, and never commit terraform.tfstate or passwords.

Bundled files

• reference.md — full parameter map (SKU/tier, storage tiers, HA modes, networking, CMK/identity, maintenance window), the three IaC paths in depth, and cross-skill wiring.
• azure-constraints.md — creation-time-only decisions, storage/version scaling rules, provider registration, AVM 0.x maturity, no superuser at provision time.
• scripts/ — one read-only context reporter and one --dry-run guarded az ... create helper.
• examples/terraform_avm.md — end-to-end AVM Terraform deployment with secure defaults, HA, Entra auth, and outputs.