🔷 Azure DevOps Feed Terraform Module

Provisions an Azure Artifacts feed together with its role assignments and retention policy behind one composite contract — organization- or project-scoped, secure-by-default reader grants, typed for_each permission collections, and a single managed retention policy. Built for azuredevops v1.x.

This composite module creates and wires together everything a packaging feed needs:

• 📦 An Azure Artifacts feed (azuredevops_feed) — host NuGet, npm, Maven, Python, Cargo, and Universal Packages.
• 🌐 Organization- or project-scoped placement via an optional project_id (omit for an org-level feed).
• 👥 Feed role assignments (azuredevops_feed_permission) — a typed for_each map granting reader / collaborator / contributor / administrator to identity descriptors.
• 🧹 A retention policy (azuredevops_feed_retention_policy) — automatically prunes old package versions while protecting recently downloaded ones.
• 🔧 Optional feed features (permanent_delete, restore) and per-resource timeouts.

💡 Why it matters: a feed is useless until the right pipelines and people can read and publish to it, and unbounded without retention. This module turns "create a feed, then click through Feed Settings" into one reviewable, version-pinned declaration.

If these Terraform modules have been helpful to you or your organization, I'd appreciate your support in any of the following ways:

• ⭐ Star this repository to help others discover this Terraform module.
• 🤝 Connect with me on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

Whether it's a star, a professional connection, or a coffee, every gesture helps keep these modules actively maintained and continually improving. Thank you for being part of the community!

flowchart LR
 project["terraform-azuredevops-project<br/>(emits project_id)"]
 feed["terraform-azuredevops-feed<br/>(this module)"]
 artifacts["terraform-azuredevops-<br/>serviceendpoint_artifacts"]
 group["terraform-azuredevops-group<br/>(emits descriptor)"]
 pipelines["build / release<br/>pipelines"]

 project -. "project_id (optional)".-> feed
 group -. "identity_descriptor".-> feed
 feed -- "feed_id" --> artifacts
 feed -- "feed_id" --> pipelines

 style feed fill:#8957E5,color:#fff
 style project fill:#0078D4,color:#fff

• project_id is optional here — unlike most of the suite, the feed keystone can live at the organization level with no project at all.
• identity_descriptor values typically come from terraform-azuredevops-group (descriptor) or built-in/Entra identities.
• Downstream, the emitted feed_id wires into artifact service connections and pipelines that publish/consume packages.

flowchart TD
 feed["azuredevops_feed.this<br/>(keystone — org or project scoped)"]
 perm["azuredevops_feed_permission.this<br/>for_each = var.permissions<br/>(map, 0..N role grants)"]
 ret["azuredevops_feed_retention_policy.this<br/>for_each = retention_policy != null ? {policy=…}: {}<br/>(0..1 per feed)"]

 feed -- "feed_id" --> perm
 feed -- "feed_id" --> ret

 style feed fill:#8957E5,color:#fff
 style perm fill:#161B22,color:#fff
 style ret fill:#161B22,color:#fff

Resource inventory (3 resources):

• azuredevops_feed.this — the keystone feed. Renders optional features and timeouts dynamic blocks.
• azuredevops_feed_permission.this — for_each over var.permissions (map(object)), one role assignment per entry. No count.
• azuredevops_feed_retention_policy.this — for_each over a { policy = … } toggle map so the policy is created 0-or-1 times without count.

Children inherit the keystone's project_id by default and may override it per entry.

The module declares the provider requirement only — it configures no provider {} block. The root module supplies the org URL and auth (PAT or Azure AD service principal).

The Terraform identity must be able to create feeds and administer feed permissions and settings. In Azure Artifacts terms that means the running identity is a Feed Owner on the target feed (granted automatically to Project Collection Administrators and Azure Artifacts Administrators).

⚠️ Organization-scoped feeds and "who can create feeds" are collection-level controls. Creating an org-level feed (or any feed where the identity is not already a Feed Owner) requires Project Collection Administrator rights, or an explicit Azure Artifacts "Who can create feeds / Who can administer feeds" delegation. Confirm the running identity is granted the collection-level role before apply — a missing grant surfaces as a 403 Forbidden, not a validation error.

terraform-azuredevops-feed/
├── providers.tf # terraform >= 1.12, azuredevops >= 1.0 < 2.0 — no provider{} block
├── variables.tf # name, project_id, features, permissions, retention_policy, timeouts
├── main.tf # azuredevops_feed.this + feed_permission.this + feed_retention_policy.this
├── outputs.tf # id, feed_id, name, project_id, permission_ids, permission_identity_ids, retention_policy_id
├── SCOPE.md # cross-module contract + required scopes/auth + provider gotchas
└── README.md # this file

Smallest working call — an organization-scoped feed:

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name = "casey-shared-packages"
}

A project-scoped feed, wiring project_id from terraform-azuredevops-project:

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "lending-platform-packages"
  project_id = module.project.project_id
}

ℹ️ This module is organization-scoped by default — project_id is optional, not required. There are no other cross-module inputs; the org URL and auth come from the provider configuration in the root.

ℹ️ No sensitive outputs. This resource family emits only IDs, names, and identity descriptors — never secrets.

• Org-vs-project scope is chosen once and is effectively permanent. Per Microsoft Learn, organization-scoped feeds cannot be converted to project-scoped feeds. The provider treats a project_id change as a destroy/recreate, and recreation can collide with the name-reservation window (below). Decide scope deliberately.
• Feed name reservation. Because of an ADO limitation, a feed name can be reserved for up to 15 minutes after a permanent delete. A rename or scope change (both recreate the feed) may fail with a transient name conflict during that window — re-run the apply after it clears.
• Role names map to the Artifacts UI as follows:

The default consumer grant should be reader; reserve administrator for the few identities that must manage the feed.

• Retention deletes only when BOTH conditions are met. A package version is removed only when the maximum versions per package (count_limit) is reached and that version hasn't been downloaded within days_to_keep_recently_downloaded_packages. Packages promoted to a view (@release, @prerelease) are exempt from retention.
• Single retention policy per feed. The retention policy is modeled as an optional(object) rendered through a { policy = … } toggle map — at most one exists. feed_id and project_id on the policy are immutable.
• Eventual consistency. Feed and permission writes propagate asynchronously across the Artifacts service. A freshly applied permission may take a short time to take effect for a pipeline's build identity.
• Pipeline access is the common gotcha, not a module input. Pipelines authenticate as a Build Service identity ([Project] Build Service ([Org]) or Project Collection Build Service ([Org])). To let a pipeline publish, add that identity to permissions with contributor. New org-scoped feeds grant the Project Collection Build Service the collaborator role by default.
• No secrets, no sensitive. Identity descriptors are references, not credentials, so the module declares no sensitive variables or outputs and needs no nonsensitive unwrapping.

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name = "casey-shared-packages"
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "lending-platform-packages"
  project_id = module.project.project_id
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "lending-platform-packages"
  project_id = module.project.project_id

  retention_policy = {
    count_limit                               = 30 # keep up to 30 versions per package
    days_to_keep_recently_downloaded_packages = 30 # but never prune anything downloaded in the last 30 days
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "lending-platform-packages"
  project_id = module.project.project_id

  permissions = {
    developers = {
      identity_descriptor = module.dev_group.descriptor
      role                = "reader"
      display_name        = "Lending Platform Developers"
    }
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "lending-platform-packages"
  project_id = module.project.project_id

  permissions = {
    # The pipeline's project Build Service identity must be a Contributor to publish.
    build_service = {
      identity_descriptor = data.azuredevops_group.build_service.descriptor
      role                = "contributor"
      display_name        = "Project Build Service (publish)"
    }
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "platform-packages"
  project_id = module.project.project_id

  permissions = {
    consumers = {
      identity_descriptor = module.consumers_group.descriptor
      role                = "reader"
    }
    publishers = {
      identity_descriptor = module.publishers_group.descriptor
      role                = "contributor"
    }
    owners = {
      identity_descriptor = module.platform_admins.descriptor
      role                = "administrator"
      display_name        = "Platform Admins (feed owners)"
    }
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name = "casey-upstream-cache"

  permissions = {
    # Collaborators can pull packages from upstream sources into the feed.
    engineers = {
      identity_descriptor = module.engineers_group.descriptor
      role                = "collaborator"
    }
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name = "ephemeral-ci-feed"

  features = {
    permanent_delete = true # purge immediately on destroy (skips soft-delete recycle)
    restore          = false
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name = "recovered-packages"

  features = {
    restore          = true # attempt to restore a soft-deleted feed of this name
    permanent_delete = false
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  # Organization-scoped feed (no module-level project_id) …
  name = "org-shared-feed"

  permissions = {
    # … but this grant is evaluated in the context of a specific project.
    proj_team = {
      identity_descriptor = module.team_group.descriptor
      role                = "reader"
      project_id          = module.lending_project.project_id
    }
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name = "slow-region-feed"

  timeouts = {
    create = "15m"
    delete = "15m"
  }

  retention_policy = {
    count_limit                               = 50
    days_to_keep_recently_downloaded_packages = 14
    timeouts = {
      create = "15m"
    }
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "lending-platform-packages"
  project_id = module.project.project_id

  retention_policy = {
    count_limit                               = 25
    days_to_keep_recently_downloaded_packages = 30
  }

  permissions = {
    developers = {
      identity_descriptor = module.dev_group.descriptor
      role                = "reader"
    }
    ci = {
      identity_descriptor = data.azuredevops_group.build_service.descriptor
      role                = "contributor"
    }
  }
}

module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "platform-packages"
  project_id = module.project.project_id
}

# A downstream artifacts endpoint / pipeline references the emitted feed_id.
output "feed_for_pipeline" {
  value = module.feed.feed_id
}

# 1) Foundation project
module "project" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-project?ref=v1.0.0"

  name = "Lending Platform"
}

# 2) An identity group to grant feed access to
module "dev_group" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-group?ref=v1.0.0"

  project_id   = module.project.project_id
  display_name = "Lending Platform Developers"
}

# 3) Build service identity (existing)
data "azuredevops_group" "build_service" {
  project_id = module.project.project_id
  name       = "Project Collection Build Service Accounts"
}

# 4) The feed, wiring project_id + descriptors, with retention and tiered roles
module "feed" {
  source = "git::https://github.com/microsoftexpert/terraform-azuredevops-feed?ref=v1.0.0"

  name       = "lending-platform-packages"
  project_id = module.project.project_id

  features = {
    permanent_delete = false
    restore          = false
  }

  retention_policy = {
    count_limit                               = 30
    days_to_keep_recently_downloaded_packages = 30
  }

  permissions = {
    developers = {
      identity_descriptor = module.dev_group.descriptor
      role                = "reader"
      display_name        = "Developers (read)"
    }
    ci_publish = {
      identity_descriptor = data.azuredevops_group.build_service.descriptor
      role                = "contributor"
      display_name        = "CI publish"
    }
  }
}

output "feed_id" {
  value = module.feed.feed_id
}

"<handle>" = {
 identity_descriptor = string # required — identity descriptor (e.g. group.descriptor)
 role = string # required — reader | contributor | collaborator | administrator
 display_name = optional(string) # assignment display name
 project_id = optional(string) # overrides module project_id for this entry
 timeouts = optional(object({ create, read, update, delete })) # all optional(string)
}

{
 count_limit = number # required — max versions per package (> 0)
 days_to_keep_recently_downloaded_packages = number # required — grace days (>= 0)
 project_id = optional(string) # overrides module project_id; immutable
 timeouts = optional(object({ create, read, update, delete }))
}

ℹ️ No sensitive outputs — the module surfaces IDs and descriptors only.

• One keystone, typed children. azuredevops_feed.this is the single primary resource; permissions and retention are children rendered with for_each over map(object(...)) — never count.
• Make the type the contract. Deeply-typed object schemas, optional with safe defaults, validation {} for every closed value set, heredoc descriptions carrying the schema inline.
• Secure by default. reader is the recommended consumer grant; the empty call creates a feed with no extra grants and no destructive feature flags.
• Total renderer. main.tf is a pure projection — dynamic blocks for every optional/repeating block, try(x, null) on every optional nested field.
• Scope-flexible. project_id is optional everywhere, and children inherit it with a per-entry override.

cd C:\GitHubCode\newazuredevopsmodules\terraform-azuredevops-feed
terraform init -backend=false
terraform validate
terraform fmt -check

⚠️ terraform plan / apply require live organization credentials (org URL + PAT, or an Azure AD service principal). The offline gate above verifies structural correctness. For live testing use a non-production organization with a dedicated identity holding the Packaging scope — never the production org.

• ✅ terraform init -backend=false — provider resolves (microsoft/azuredevops >= 1.0, < 2.0).
• ✅ terraform validate — Success! The configuration is valid.
• ✅ terraform fmt -check — no formatting differences.
• 🔁 Type-level negative tests: an invalid role, an empty identity_descriptor, or count_limit = 0 each fail at plan time with an actionable error_message.
• 🌐 Live (non-prod org) smoke test: apply minimal org-scoped feed → confirm in Artifacts; add a reader permission → confirm in Feed Settings › Permissions.

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

Outputs:

feed_id = "11111111-2222-3333-4444-555555555555"
id = "11111111-2222-3333-4444-555555555555"
name = "lending-platform-packages"
permission_ids = { "developers" = "…" }
project_id = "00000000-0000-0000-0000-000000000000"
retention_policy_id = "…"

• Azure Artifacts feeds — key concepts
• Feed scopes: project vs organization
• Manage feed permissions & roles
• Retention policies — delete & recover packages
• Package sizes and count limits
• Terraform: azuredevops_feed · azuredevops_feed_permission · azuredevops_feed_retention_policy
• SCOPE.md — cross-module contract & required scopes/auth

💙 "Infrastructure as Code should be standardized, consistent, and secure."