analytics/synapse¶

Overview¶

This page documents the Terraform module implementation, key configuration surfaces, and how it integrates with CAF.

Dependency diagram (Mermaid)¶

graph TD azurecaf_name.ws["azurecaf_name.ws"] azurerm_key_vault_secret.sql_admin["azurerm_key_vault_secret.sql_admin"] azurerm_key_vault_secret.sql_admin_password["azurerm_key_vault_secret.sql_admin_password"] azurerm_key_vault_secret.synapse_name["azurerm_key_vault_secret.synapse_name"] azurerm_key_vault_secret.synapse_rg_name["azurerm_key_vault_secret.synapse_rg_name"] azurerm_synapse_firewall_rule.wrkspc_firewall["azurerm_synapse_firewall_rule.wrkspc_firewall"] azurerm_synapse_firewall_rule.wrkspc_firewalls["azurerm_synapse_firewall_rule.wrkspc_firewalls"] azurerm_synapse_workspace.ws["azurerm_synapse_workspace.ws"] azurerm_synapse_workspace_aad_admin.wrkspc_aad_admin["azurerm_synapse_workspace_aad_admin.wrkspc_aad_admin"] module.private_endpoint["module.private_endpoint"] module.spark_pool["module.spark_pool"] module.sql_pool["module.sql_pool"] random_password.sql_admin["random_password.sql_admin"] azurerm_key_vault_secret.sql_admin --> azurerm_synapse_workspace.ws azurerm_key_vault_secret.sql_admin_password --> azurerm_synapse_workspace.ws azurerm_key_vault_secret.sql_admin_password --> random_password.sql_admin azurerm_key_vault_secret.synapse_name --> azurerm_synapse_workspace.ws azurerm_key_vault_secret.synapse_rg_name --> azurerm_synapse_workspace.ws azurerm_synapse_firewall_rule.wrkspc_firewall --> azurerm_synapse_workspace.ws azurerm_synapse_firewall_rule.wrkspc_firewalls --> azurerm_synapse_workspace.ws azurerm_synapse_workspace.ws --> azurecaf_name.ws azurerm_synapse_workspace.ws --> random_password.sql_admin azurerm_synapse_workspace_aad_admin.wrkspc_aad_admin --> azurerm_synapse_workspace.ws module.private_endpoint --> azurerm_synapse_workspace.ws module.spark_pool --> azurerm_synapse_workspace.ws module.sql_pool --> azurerm_synapse_workspace.ws

Module Reference¶

Category: analytics
Path: modules/analytics/synapse
Azure Resources: azurecaf_name, azurerm_key_vault_secret, azurerm_synapse_firewall_rule, azurerm_synapse_workspace, azurerm_synapse_workspace_aad_admin, random_password

Inputs¶

Name	Description	Type	Required	Default	Validation
`"settings"`	"<<DESCRIPTION Settings for an Azure Synapse workspace. Required: - name - Workspace name input used by CAF naming. O...	`object({name = string, resource_group...`	yes	`-`	"settings.key_vault_secret_tags accepts at most 15 entries because AzureRM limits Key Vault secret tags to 15."; "Configure sql_administrator_login or a customer-managed key."; "data_exfiltration_protection_enabled requires managed_virtual_network_enabled to be true."; "Configure at most one of azure_devops_repo and github_repo."; "identity.type must be SystemAssigned, UserAssigned, or SystemAssigned, UserAssigned."; "A user-assigned identity type requires identity_ids or managed identity keys."
`"global_settings"`	"Global CAF naming and tag settings."	`any`	yes	`-`	-
`"client_config"`	"Client configuration object used to resolve landing-zone references."	`any`	yes	`-`	-
`"remote_objects"`	"Remote CAF objects used for managed identity resolution."	`any`	no	`{}`	-
`"storage_data_lake_gen2_filesystem_id"`	"The ID of the Data Lake Storage Gen2 filesystem used by Synapse."	`string`	yes	`-`	-
`"keyvault_id"`	"The ID of the Key Vault used to store generated SQL administrator credentials."	`string`	no	`-`	-
`"vnets"`	"Combined virtual network objects used for subnet references."	`map(any)`	no	`{}`	-
`"private_endpoints"`	"Private endpoint configurations for the workspace."	`map(any)`	no	`{}`	-
`"private_dns"`	"Combined private DNS zone objects used by private endpoints."	`map(any)`	no	`{}`	-
`"location"`	"Azure location override for the workspace."	`string`	no	`-`	-
`"resource_group_name"`	"Resource group name override for the workspace."	`string`	no	`-`	-
`"resource_group"`	"Resolved resource group object for the workspace."	`any`	yes	`-`	-
`"base_tags"`	"Whether to inherit tags from global settings and the resource group."	`bool`	yes	`-`	-

Outputs¶

Name	Description	Sensitive	Value
`"id"`	"The ID of the Synapse Workspace."	-	`azurerm_synapse_workspace.ws.id`
`"connectivity_endpoints"`	"A list of Connectivity endpoints for this Synapse Workspace."	-	`azurerm_synapse_workspace.ws.connectivity_endpoints`
`"managed_resource_group_name"`	"Workspace managed resource group."	-	`azurerm_synapse_workspace.ws.managed_resource_group_name`
`"workspace_firewall"`	"The legacy single Synapse workspace firewall rule, when configured."	-	`azurerm_synapse_firewall_rule.wrkspc_firewall`
`"workspace_firewalls"`	"The Synapse workspace firewall rules configured as a map."	-	`azurerm_synapse_firewall_rule.wrkspc_firewalls`
`"aad_admin"`	"The Synapse workspace Microsoft Entra administrator, when configured."	-	`azurerm_synapse_workspace_aad_admin.wrkspc_aad_admin`
`"identity"`	"An identity block which contains the Managed Service Identity information for this Synapse Workspace. - type - The I...	-	`azurerm_synapse_workspace.ws.identity`
`"spark_pool"`	"Spark pool object"	-	`module.spark_pool`
`"sql_pool"`	"SQL pool object"	-	`module.sql_pool`
`"rbac_id"`		-	`azurerm_synapse_workspace.ws.identity[0].principal_id`

Sources¶

modules/analytics/synapse/locals.tf
modules/analytics/synapse/main.tf
modules/analytics/synapse/managed_identities.tf
modules/analytics/synapse/outputs.tf
modules/analytics/synapse/private_endpoints.tf
modules/analytics/synapse/spark_pool.tf
modules/analytics/synapse/sql_pool.tf
modules/analytics/synapse/variables.tf
modules/analytics/synapse/workspace.tf