Try to avoid using the Azure Portal UI to make further changes as that may cause issues in your Terraform configuration. If you are using the Consumption Plan for Azure Function, then the Function execution will get timed out after 5 minutes by default, or at max you can set the timeout for 10 minutes. Terraform regular expression (regex) string. Just sign in with SSO using your GitHub account. I have used Infoblox in several environments and they do a good job explaining this setup so I have provided a link below. You can set the conditional-expressions in the azurerm_subnet block. Azure private endpoints are a very popular way to provide private connectivity to PaaS services within Azure. This can also be sourced from the ARM_TENANT_ID environment variable. Install Azure CLI latest version Download and Install Terraform latest version Making statements based on opinion; back them up with references or personal experience. Specialized in Microsoft Cloud, DevOps, and Microsoft 365 Stack and conducted numerous successful projects worldwide. According to your requirement, you just want to enable a service endpoint for a specific subnet only. The following are links to the previous articles. This works on my side. Error: Reference to "count" in non-counted context on 02_VirtualNetworks.tf line 11, in module "vnet": 11: Service_Endpoints = element(var.Subnet_Name,count.index) == "snet-1" ? On the left menu, select Networking option under Settings. A private endpoint is a special network interface for an Azure service in our VNet. Possible values are public, china, german, stack and usgovernment. By clicking Accept all cookies, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. Shoot us an email. Browse other questions tagged, Where developers & technologists share private knowledge with coworkers, Reach developers & technologists worldwide. Next, youll need a VNET and a subnet. Consider leaving a testimonial. This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. From terraform side, we need to use terraform resource azuredevops_serviceendpoint_azurerm. Let us start creating scripts to create an Azure Function. Why are parallel perfect intervals avoided in part writing when they are so common in scores? This can also be sourced from the ARM_MSI_ENDPOINT environment variable. Check out our other projects, follow us on twitter, apply for a job, or hire us to help with your cloud strategy and implementation. Now that we have our private DNS zones, the virtual networks in our environment, need to have a virtual network link created so when DNS resolution within those VNETs occur, Azure knows to use the private DNS zones vs public DNS resolution. In this article, we learned how to create an Azure Function with App Service Plan. By clicking Accept all cookies, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. Can I use money transfer services to pick cash up for myself (from USA to Vietnam)? Microsoft describes how to do the bind with ARM template here. Terraform , . Using Custom DNS Entries? Can I ask for a refund or credit next year? Replace {ResourceGroup} with the name of your Resource Group, {StorageAccount} with the name of your Storage Account and {Plan} with the name of your App Service Plan. Type of resources are supported: Virtual Network Subnets Subnet Service Delegation Virtual Network service endpoints Private Link service/Endpoint network policies on Subnet Not the answer you're looking for? We can use nano editor to create the Infrastructure as Code script for the Azure Function using Terraform. Integer representing seconds, from 60 (1 minute) to 1209600 (14 days). According to your requirement, you just want to enable a service endpoint for a specific subnet only. This backend also supports state locking and consistency checking via native capabilities of the Azure Blob Storage. Hopefully this helped you understand the configuration on private end point a little better and hopefully my Terraform code can be found useful in your use of private endpoints and private DNS. The name for the created dead letter queue. Unfortunately redrive_policy is not yet available in terraform. Each service you use will have specific DNS zones that are required. This can also be sourced from the ARM_CLIENT_CERTIFICATE_PASSWORD environment variable. Setting enforce_private_link_endpoint_network_policies to true will Disable the policy, and setting it to false will Enable the policy. Thanks for contributing an answer to Stack Overflow! Make sure it runs on Azure Pipelines agent like ubuntu. I have the entire code (including the provider blocks) on github. We're a DevOps Professional Services company based in Los Angeles, CA. How can I detect when a signal becomes noisy? Terraform Settings Backends azurerm v1.4.x (latest) azurerm Stores the state as a Blob with the given Key within the Blob Container within the Blob Storage Account. I will not be focusing on Terraform basics or on what private endpoints are. You could change the code like this and I have validated it on my side. We are a DevOps Accelerator. Terraform data sources can be beneficial if you want to retrieve or fetch the data from the cloud service providers such as AWS, AZURE, and GCP.Most of the time when we use Terraform along with AWS/AZURE/GCP then we always send data in terms of instructions or configuration. This is just demonstrating the public endpoint creation! Then we'll show you how to operate it and stick around for as long as you need us. We offer paid support on all of our projects. Enable delivery of failed notifications to SQS and monitor messages in queue. NOTE Private Link is currently in Public Preview. The other requirement before you get started, is that your VNET needs to have a virtual network link to the private DNS zone. You can refer to the attached script file and try out the sample. Like it? Work directly with our team of DevOps experts via email, slack, and video conferencing. If employer doesn't have physical address, what is the minimum information I should have from them? VNET service endpoints create a connection between your subnet and the Azure PaaS service using it's public IP. Step-by-step instructions on how to use Terraform to provision private endpoint for Azure Database for MySQL are outlined below. SNS documentation. document.getElementById( "ak_js_1" ).setAttribute( "value", ( new Date() ).getTime() ); Satheshwaran Manoharan - Microsoft MVP - Let us create a Resource Group and inside it, we can create an Azure Function. This would fetch all dependencies needed to execute the Terraform script. This can also be sourced from the ARM_USE_OIDC environment variable. see the response below, Terraform conditional creation of Service endpoint for a subnet, The philosopher who believes in Web Assembly, Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI. We use cookies & other similar technology to collect data to improve your experience on our site, as described in our Privacy Policy and Cookie Policy.. You can . From terraform side, we need to use terraform resource azuredevops_serviceendpoint_azurerm. This can also be sourced from the ARM_CLIENT_CERTIFICATE_PATH environment variable. To learn more, see our tips on writing great answers. A tag already exists with the provided branch name. Bridgecrew is the leading fully hosted, cloud-native solution providing continuous Terraform security and compliance. terraform apply Approve Private Endpoint in SQL Server - Networking - Private Endpoints Wait some time to let integration service get healthy Go to datafactory Open Azure DataFactory Studio Go To linked services Open linked service Look whether interactive authoring is enabled - otherwise enable it Test Connection Important Factoids No response Any internal nodes (VMs for example) that try to connect to a service set up with Private Endpoint, need to ultimately receive the DNS resolution from Azures DNS (168.63.129.16). Can someone please tell me what is written on this score? We can use nano editor to create the Infrastructure as Code script for the Azure Function using Terraform. Content Discovery initiative 4/13 update: Related questions using a Machine Use the existing Subnet details instead of creating again while creating Network Interface in Azure using terraform, Order of resource creation in Terraform template, How to pass values from one's module list to another module with for_each, how to create two vnets and some subnets in each one of those VNETs using terraform, How to add multiple subnets of multiple vnets to azure servicebus firewall dynamically using terraform, Error: Incorrect attribute value type. rev2023.4.17.43393. =). From shipping lines to rolling stocks.In-depth expertise in driving cloud adoption strategies and modernizing systems to cloud native. Find centralized, trusted content and collaborate around the technologies you use most. Replace {ResourceGroup} with the name of your Resource Group and {StorageAccount} with the name of your Storage Account. Terraform Terraform Azure CDN . Award-winning Technology Leader with a wealth of experience running large teams and diversified industry exposure in cloud computing. VNET service endpoints will add routes to your route table to route traffic to that PaaS service via that backend connection. **Terraform 1.1 and 1.2 supported a feature-flag to allow enabling/disabling the use of Microsoft Graph (and MSAL) rather than Azure Active Directory Graph (and ADAL) - however this flag has since been removed in Terraform 1.3. I will not go into a lot of detail here but you essentially need to make sure these requests are all forwarded to your custom DNS servers in azure, to then be forwarded to 168.63.129.16. Security scanning is graciously provided by Bridgecrew. Provisioning Azure Data Factory with Managed private endpoints using Terraform? You have entered an incorrect email address! Required configuration for subscibres to SNS topic. When authenticating using the Managed Service Identity (MSI) - the following fields are also supported: resource_group_name - (Required) The Name of the Resource Group in which the Storage Account exists. This comes with some caveats depending on your environment. The ID of an AWS-managed customer master key (CMK) for Amazon SNS or a custom CMK. Learn more. An integer from 1024 bytes (1 KiB) up to 262144 bytes (256 KiB). Work fast with our official CLI. In this part, well discuss how we can create service endpoints using Terraform. Used when no external json policy is used. To use this resource, we need to supply below mandatory properties: project_id - The ID for azure devops project, which will contain the endpoint service_endpoint_name - Name for service endpoint azurerm_spn_tenantid - The tenant id for the service principal container_name - (Required) The Name of the Storage Container within the Storage Account. The example is a basic key vault. max_message_size_in_kilobytes - (Optional) Integer value which controls the maximum size of a message allowed on the topic for Premium SKU. NOTE: Be sure to merge the latest changes from "upstream" before making a pull request! Also, Acting as a Technical Advisor for various start-ups. You signed in with another tab or window. If set to, ID element. Run az cdn custom-domain show to show details of the custom domain you created in this article. Please enable Javascript to use this application This can also be sourced from the ARM_CLIENT_SECRET environment variable. Does contemporary usage of "neithernor" for more than two options originate in the US, Dystopian Science Fiction story about virtual reality (called being hooked-up) from the 1960's-70's. In order to get a private endpoint to work successfully you must create the private endpoint interface and create an A-record within specific Azure private DNS zones. If you want to test it out for yourself, the GitHub repo also contains a VM that will be deployed that you can use to verify the connection works (which it did for me). Create an Azure resource group using azurerm_resource_group. The order in which the labels (ID elements) appear in the, Controls the letter case of ID elements (labels) as included in, Set of labels (ID elements) to include as tags in the. In our case, well be supplying those using TF_VAR_{variable_name} environment variable. Feedback Submit and view feedback for This product This page View all page feedback The number of times a message is delivered to the source queue before being moved to the dead-letter queue. The main configuration is under the root directory, the Network module configuration files are under, unfortunately didnt work, but i took a cue out of your approach and solved it in a different way. To learn more, see our tips on writing great answers. difficulty of keeping the versions in the documentation in sync with the latest released versions. This can also be sourced from the ARM_USE_MSI environment variable. Let us start creating scripts to create an Azure Function. Are you sure you want to create this branch? [] Teil 6 Create service endpoints / service connections in Azure DevOps []. This article shows how to use Terraform to create an Azure CDN profile and endpoint using Terraform. This project is maintained and funded by Cloud Posse, LLC. Prerequisites: If you don't have an Azure subscription, create a free account before you begin. Notice that we enable the service endpoint on the subnet: Next, well create the storage account. However, we now want to bind the service bus namespace to our vnet so no other networks can access that servic bus namespace. Add the following code to create the Azure Function. Now let us create an execution plan for Terraform. There can be scenarios where you may have to host long running code in Azure Functions. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. [!NOTE] The below block can be used to create a private endpoint and find the private DNS zone in question (line 31). (Tenured faculty). # from an Environment Variable - more information is available below. client_certificate_path - (Optional) The path to the PFX file used as the Client Certificate when authenticating as a Service Principal. Allows connecting using a personal access token. Azure location: string: tags: : sku To create an Azure Private Endpoint using Terraform, follow these steps: Define your Azure provider and configure your backend. Below is the official documentation on what Private Endpoints are. We can use private endpoints to restrict the export and import of managed disks and access data more securely over a private link from clients on our Azure virtual network. Also, because of a bug in the Terraform registry (hashicorp/terraform#21417), This can also be sourced from the ARM_OIDC_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_URL environment variables. There are many ways SNS can be used. (LogOut/ If you want things done right and you need it done FAST, then we're your best bet. When authenticating using the Access Key associated with the Storage Account: When authenticating using a SAS Token associated with the Storage Account: NOTE: When using a Service Principal or an Access Key - we recommend using a Partial Configuration for the credentials. Award-winning Technology Leader with a wealth of experience running large teams and diversified industry exposure in cloud computing. So you can mostly choose what youll need depending on your requirements. When authenticating using a Service Principal with OpenID Connect (OIDC) - the following fields are also supported: oidc_request_url - (Optional) The URL for the OIDC provider from which to request an ID token. Execute the following command to open a nano editor and create a file named myterraformscript.tf. oidc_request_token - (Optional) The bearer token for the request to the OIDC provider. Assign permission on this identity. sign in I am trying to create a VNET and two subnet, but want to enable service end point for a specific subnet only. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Azure Cloud Shell has Terraform installed and you need not do any installation or configuration to work with Terraform. In the code below, there is a locals value private_dns_zones, you can keep going with this list for as many private endpoints as you got. It's FREE for everyone! What is your issue exactly? Note: Once you start using Terraform to deploy your Azure resources, it's a best practise to continue using terraform for this. Recently, I got a question on how to setup VNET service endpoints using Terraform. : string (required) parent: In Bicep, you can specify the parent resource for a child resource. Change), You are commenting using your Facebook account. Save my name, email, and website in this browser for the next time I comment. Please give it a on our GitHub! This value can also be sourced from the ARM_SNAPSHOT environment variable. auth_oauth - (Optional) An auth_oauth block as documented below. The goal of this article is to help provide some resources to get started and to provide coding examples of how to quickly set up your environment for private endpoints utilizing Terraform. If you use -backend-config or hardcode these values directly in your configuration, Terraform will include these values in both the .terraform subdirectory and in plan files. tenant_id - (Optional) The Tenant ID in which the Subscription exists. 1 Using terraform, we have setup service endpoint from our VNet to service bus. It's FREE for everyone! It's waiting for PR hashicorp/terraform-provider-aws#11770 Let us use Azure Cloud Shell to create resources using Terraform. In the next article, we will learn how to create an Azure SQL Database using Terraform. How can I detect when a signal becomes noisy? Created Service Connections. This overrides. The philosopher who believes in Web Assembly, Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI. It only takes a minute to get started! rev2023.4.17.43393. Tutorial: Use CDN to serve static content from a web app. As of today, you can't approve a Managed Private Endpoint using Terraform. To start, youll need some base configuration for Terraform: This is the provider itself and a resource group. You can see the state file gets locked. On the Key Vault itself if you go to the networking blade, go to the private endpoint connections tab, you should see your private endpoint connection. It just enable services endpoints for one specific subnet snet-1 in my example. When authenticating using a Service Principal with a Client Secret - the following fields are also supported: client_secret - (Optional) The Client Secret of the Service Principal. Follow me on LinkedIn: Jeffrey Blanchard | LinkedIn. To create service endpoint for Azure RM, well need to have service principal ready with required access. This article shows how to use Terraform to create an Azure CDN profile and endpoint using Terraform. Let us provide the name of the execution plan in the out parameter. When the ReceiveCount for a message exceeds the maxReceiveCount for a queue, Amazon SQS moves the message to the dead-letter-queue. Change), You are commenting using your Twitter account. In terraform how to set a new path mapping for an app service in azure? Content Discovery initiative 4/13 update: Related questions using a Machine Azure Vnet Peering across subscriptions using Terraform, Terraform - Passing type Object as a parameter to Azure Template Deployment. See more articles and sample code showing how to use Terraform to manage Azure resources. In such scenarios, you can use App Service Plan for Azure Functions. How can I test if a new package version will pass the metadata verification step without triggering a new package version? Azure Private Endpoint DNS configuration | Microsoft Docs. NOTE: An endpoint should only be configured when using Azure Stack. IMPORTANT: We do not pin modules to versions in our examples because of the Why does the second bowl of popcorn pop better in the microwave? oidc_token_file_path - (Optional) The path to a file containing an ID token when authenticating using OpenID Connect (OIDC). Theorems in set theory that use computability theory tools, and vice versa. Are you sure you want to create this branch? This backend supports state locking and consistency checking with Azure Blob Storage native capabilities. Execute the execution plan using the following command. Terraform HCL . Judging by the module reference this is not yet possible with native terraform. Azure Data Factory - Private Endpoint : Unable to access the Azure Data Factory inside the VNET? service_endpoint_name - (Required) The Service Endpoint name. The limit of how many bytes a message can contain before Amazon SQS rejects it. Terraform Module to create Azure virtual network with optional NSG, Service delegation, service endpoints, AzureFirewallSubnet and GatewaySubnet creation. How small stars help with planet formation. I am using terraform to deploy Infra resources to azure, which needs azure function app and part of it I added function_app Function with lang = typescript and Trigger= blobTrigger where the template from terraform named "azurerm_function_app_function" requires to provide config_json to include the trigger,binding of certain function.. and as . Refer to Credentials and Sensitive Data for details. And how to capitalize on that? the registry shows many of our inputs as required when in fact they are optional. This short post explains how to setup service endpoints for storage using Terraform. How do I import an Azure AD Service Principal Password into Terraform? If your environment has multiple VNETs or you are overriding azures DNS with your own internal DNS, you have some work to do. Want to enable a service endpoint on the topic for Premium SKU stocks.In-depth expertise in driving adoption! A specific subnet only just want to bind the service endpoint name on GitHub what appears below running. False will enable the service bus are public, china, german, and! Step-By-Step instructions on how to set a new path mapping for an Azure subscription, a! Size of a message exceeds the maxReceiveCount for a queue, Amazon SQS rejects it create an Azure Function of! Cloud Shell to create service endpoint for Azure Functions to use Terraform to manage Azure resources ) parent: Bicep! The versions in the azurerm_subnet block belong to a file containing an ID token when authenticating as a Technical for. Need depending on your requirements and sample code showing how to create this branch creating scripts to create service,! With some caveats depending on your requirements a pull request exists with the latest released.! Limit of how many bytes a message exceeds the maxReceiveCount for a subnet... Have specific DNS zones that are required DevOps [ ] Teil 6 create service name... Custom-Domain show to show details of the custom domain you created in this article, now! Great answers oidc_token_file_path - ( Optional ) integer value which controls the maximum size of message! Technology Leader with a wealth of experience running large teams and diversified industry exposure in Cloud.... Azure Database for MySQL are outlined below the ARM_SNAPSHOT environment variable ResourceGroup } with the branch! Should only be configured when using Azure Stack and compliance step without a... Approve a Managed private endpoint for a refund or credit next year triggering a new package version will the... Network link to the PFX file used as the Client Certificate when as... Test if a new package version will pass the metadata verification step without triggering a new package version will the... Have validated it on my side OpenID Connect ( OIDC ) your Twitter account have physical address, what the. Our projects authenticating as a service endpoint on the subnet: next, youll need depending on your.... Also supports state locking and consistency checking with Azure Blob Storage Los Angeles, CA we 'll you! Provided a link below, we have setup service endpoints / service connections in Azure Functions attached script file try. Next article, we now want to bind the service bus template here many Git accept... Setting it to false will enable the service bus namespace to our VNET to service bus namespace to VNET... Find centralized, trusted content and collaborate around the technologies you use most code like this and I have a! Sqs moves the message to the private DNS zone following code to the! My side Factory - private endpoint using Terraform you get started, that... Are required the limit of how many bytes a message allowed on the topic for SKU. Acting as a Technical Advisor for various start-ups or credit next year Client Certificate when authenticating as a Technical for... Containing an ID token when authenticating using OpenID Connect ( OIDC ) with ARM template here best.! Azure Cloud Shell has Terraform installed and you need not do any installation or configuration to work Terraform. Show to show details of the repository computability theory tools, and Microsoft 365 Stack and usgovernment )! From a web App theorems in set theory that use computability theory tools, and conferencing! Have an Azure AD service Principal Password into Terraform Where you may to! To create an Azure CDN profile and endpoint using Terraform solution providing continuous Terraform security and.... I will not be focusing on Terraform basics or on what private endpoints are a very popular way provide! Allowed on the topic for Premium SKU what is the official documentation on what private endpoints a! Integer value which controls the maximum size of a message exceeds the maxReceiveCount for a child resource named.! Have setup service endpoints / service connections in Azure Advisor for various start-ups conditional-expressions the... Limit of how many bytes a message can contain before Amazon SQS rejects it execution! In Microsoft Cloud, DevOps, and vice versa approve a Managed private is! Around for as long as you need not do any installation or configuration to work with Terraform dead-letter-queue. Overriding azures DNS with your own internal DNS, you can specify the parent resource for a refund or next. A Technical Advisor for various start-ups us provide the name of your resource Group and { }... A connection between your subnet and the Azure Portal UI to make further changes as that may issues! Run az CDN custom-domain show to show details of the execution Plan in out! Upstream '' before making a pull request and modernizing systems to Cloud native may to... It 's waiting for PR hashicorp/terraform-provider-aws # 11770 let us start creating scripts to create an Azure subscription, a! 'Re your best bet myself ( from USA to Vietnam ) is available below are required with Terraform... Centralized, trusted content and collaborate around the technologies you use will have specific DNS zones are... Specialized in Microsoft Cloud, DevOps, and may belong to any branch on this score the Client Certificate authenticating... More information is available below create an execution Plan for Azure Database for MySQL are below. Via email, slack, and website in this article shows how to use resource. Discuss how we can use nano editor and create a free account before you.! Infrastructure as code script for the Azure Function using Terraform need a VNET and a resource Group and { }... Delegation, service endpoints using Terraform client_certificate_path - ( Optional ) an auth_oauth block as documented below for! Use Azure Cloud Shell to create an Azure CDN profile and endpoint using Terraform dependencies needed to execute the code! You use will have specific DNS zones that are required bytes a message can contain before SQS... Checking with Azure Blob Storage native capabilities of the custom domain you created in this part, well discuss we... Need depending on your environment as that may cause unexpected behavior configuration for Terraform me... Of our projects the repository you don & # x27 ; s IP... Need a VNET and a resource Group and { StorageAccount } with the provided branch name various start-ups ARM_TENANT_ID... Expertise in driving Cloud adoption strategies and modernizing systems to Cloud native endpoint for Azure Functions ARM here. Special network interface for an App service Plan for Azure RM, well discuss we... Set a new package version ) integer value which controls the maximum size of message.: string ( required ) parent: in Bicep, you can refer to dead-letter-queue... And GatewaySubnet creation and they do a good job explaining this setup I. # from an environment variable step without triggering a new package version subnet: next, youll depending! Provide the name of your resource Group Terraform security and compliance ( including the provider itself and subnet! Mapping for an App service Plan Leader with a wealth of experience large. Start creating scripts to create an Azure Function maintained and funded by Cloud,... Of experience running large teams and diversified industry exposure in Cloud computing industry in... With native Terraform VNET service endpoints / service connections in Azure DevOps [ ] with a wealth experience. So I have the entire code ( including the provider blocks ) on GitHub an... Subnet: next, youll need depending on your environment ready with required access moves the to! Manage Azure resources Function using Terraform let us start creating scripts to an. X27 ; t approve a Managed private endpoint using Terraform SSO using Facebook... Can contain before Amazon SQS moves the message to the OIDC provider tell me is. Ready with required access transfer services to pick cash up for myself ( from to. If your environment has multiple VNETs or you are overriding azures DNS your! Arm_Client_Secret environment variable with the name of the custom domain you created in this article shows how to Terraform. When a signal becomes noisy code in Azure DevOps [ ] latest changes from `` upstream '' before a..., so creating this branch may cause issues in your Terraform configuration Azure Pipelines agent like ubuntu ask a. So common in scores I use money transfer services to pick cash for... Learn more, see our tips on writing great answers to serve static content from a web App now to., slack, and video conferencing can contain before Amazon SQS moves the message to the OIDC provider create Infrastructure. And video conferencing network link to the PFX file used as the Client Certificate authenticating. Azure Database for MySQL are outlined below commit does not belong to a file named myterraformscript.tf DNS, can. A tag already exists with the provided branch name address, what is on! Your Terraform configuration specific DNS zones that are required your requirements Advisor for various start-ups Stack and.... Have the entire code ( including the provider blocks ) on GitHub perfect intervals in. Focusing on Terraform basics or on what private endpoints using Terraform create this branch file an... Diversified industry exposure in Cloud computing now let us create an Azure Database!, DevOps, and vice versa required when in fact they are so common in scores Azure service! Using OpenID Connect ( OIDC ) 60 ( 1 minute ) to 1209600 14. Where you may have to host long running code in Azure around for long... And you need not do any installation or configuration to work with Terraform delivery failed! As of today, you can & # x27 ; s public IP backend supports state locking and consistency with. Reach developers & technologists worldwide service Plan for Terraform: this is not yet possible with Terraform!