☁️ Azure Event Hubs Namespace Terraform Module

A composite module that provisions an Azure Event Hubs namespace together with its owned event hubs and consumer groups, hardened by default and targeting hashicorp/azurerm ~> 4.0.

This module manages an Azure Event Hubs namespace as a single owned unit:

• 📛 A namespace (azurerm_eventhub_namespace) — the keystone, with SKU, capacity, auto-inflate, TLS floor, identity, and firewall.
• 📨 A keyed map of event hubs (azurerm_eventhub) — partitions, retention, status, and optional capture-to-storage.
• 👥 A keyed map of consumer groups (azurerm_eventhub_consumer_group) — each attached to one owned event hub by its map key.
• 🔒 A locked-down posture — public access off, SAS local auth off, TLS 1.2 floor, deny-by-default firewall when supplied.

💡 Why it matters: Event Hubs is the ingestion front door for streaming and telemetry pipelines. Getting the namespace posture right once — private, Entra-only, TLS-floored — means every producer and consumer inherits a safe baseline instead of re-deriving it. Modeling hubs and consumer groups as keyed maps keeps a busy topology reviewable and free of re-indexing churn.

If this module saves you time, please consider supporting it:

• ⭐ Star the repository to help others find it.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart LR
  rg["terraform-azurerm-resource-group"]
  ehns["terraform-azurerm-eventhub-namespace"]
  sa["terraform-azurerm-storage-account"]
  ra["terraform-azurerm-role-assignments"]
  pe["terraform-azurerm-private-endpoint"]
  prod["Producers (apps / IoT / diagnostics)"]
  cons["Consumers (Functions / Stream Analytics / Databricks)"]
  nsauth["terraform-azurerm-eventhub-namespace-authorization-rule"]
  ehauth["terraform-azurerm-eventhub-authorization-rule"]
  cmk["terraform-azurerm-eventhub-namespace-customer-managed-key"]
  dr["terraform-azurerm-eventhub-namespace-disaster-recovery-config"]
  schema["terraform-azurerm-eventhub-namespace-schema-group"]

  rg -->|"resource_group_name"| ehns
  prod -->|"send events"| ehns
  ehns -->|"deliver events"| cons
  ehns -->|"capture to blob"| sa
  ra -->|"Data Sender / Receiver at scope"| ehns
  pe -->|"private connectivity (Premium)"| ehns
  ehns -->|"namespace SAS rule"| nsauth
  ehns -->|"per-hub SAS rule"| ehauth
  ehns -->|"CMK encryption"| cmk
  ehns -->|"geo-DR pairing"| dr
  ehns -->|"schema registry"| schema

  classDef self fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef keystone fill:#004578,stroke:#001b33,color:#ffffff;
  classDef ext fill:#F2F2F2,stroke:#B0B0B0,color:#1a1a1a;

  class ehns self;
  class sa keystone;
  class rg,ra,pe,prod,cons,nsauth,ehauth,cmk,dr,schema ext;

The namespace consumes a resource group by name, optionally captures to a storage account, and is fronted by role assignments and a private endpoint — all owned by their own sibling modules and wired here by id / name. A private endpoint needs Standard or above; it is unsupported only on Basic.

flowchart TD
  subgraph module["terraform-azurerm-eventhub-namespace"]
    ns["azurerm_eventhub_namespace.this"]
    eh["azurerm_eventhub.this (for_each)"]
    cg["azurerm_eventhub_consumer_group.this (for_each)"]
  end

  ns -->|"namespace_id"| eh
  eh -->|"eventhub_name (by key)"| cg
  ns -->|"namespace_name"| cg

  classDef self fill:#0078D4,stroke:#004578,color:#ffffff;
  classDef keystone fill:#004578,stroke:#001b33,color:#ffffff;

  class eh,cg self;
  class ns keystone;

Resource inventory

Schema notes that bite (verified against the live provider schema):

• ⚠️ name, resource_group_name, and location on the namespace are immutable — changing any of them forces replacement of the namespace and every child hub and consumer group.
• ⚠️ dedicated_cluster_id is force-new — moving a namespace into or out of a dedicated cluster replaces it.
• 🔴 azurerm_eventhub.partition_count is NOT force-new, and that is worse than if it were. Changing it on a shared Basic or Standard namespace produces a clean in-place plan; the provider then performs a live read of the namespace during apply and refuses with "partition_count cannot be changed on shared namespaces unless the namespace sku is Premium". So the plan looks fine and the apply stops. On Premium or in a dedicated cluster it can be increased in place; a decrease is refused on every tier. Increasing it also changes how partition keys map to partitions, so event ordering across the stream changes with it.
• 🔴 partition_count and message_retention are validated by the provider at 1-1024 and 1-90 on every tier, while its own error messages describe narrower rules. Azure's real ceilings are 32 partitions and 1 day on Basic, 32 and 7 days on Standard, 100 and 90 days on Premium, and 1024 and 90 days in a dedicated cluster. This module enforces the tier ceiling so the mismatch fails at terraform validate rather than at apply.
• 🔴 capacity has no validation in the provider at all. Basic and Standard take 1-40 throughput units; Premium takes processing units in the fixed sizes 1, 2, 4, 6, 8, 10, 12 and 16 only. Both bounds are enforced here.
• ℹ️ auto_inflate_enabled and capture_description require Standard or above; so does network_rulesets, for which the provider raises "network_rulesets cannot be used when the SKU is basic" from its Create and Update functions. All three are apply-time errors in the provider and validate-time ones here.
• 🔴 The namespace's public_network_access_enabled and network_rulesets.public_network_access_enabled must agree, or the provider aborts the apply with "the value of public network access of namespace should be the same as of the network rulesets". The nested field defaults to true inside the provider while this module's namespace default is false, so a firewall block written the obvious way used to fail every time. The module now renders the nested value from the namespace value when it is unset, and refuses an explicit mismatch offline.
• 🔴 network_rulesets is Optional and Computed. Removing the block from a configuration does not remove the firewall — the provider adopts whatever Azure reports and shows no diff. Set default_action = "Allow" explicitly to open the namespace back up.
• 🔴 Changing sku to or from Premium forces replacement of the namespace, and with it every hub and consumer group. The rule lives in the provider's CustomizeDiff, not its schema, so nothing in the binary schema shows it. Basic to Standard and back is in place.
• ⚠️ On the pinned 4.x line minimum_tls_version accepts 1.0, 1.1 and 1.2; the 5.0 schema — which is what the registry documentation describes — accepts only 1.2. The module accepts all three and reports a below-floor choice, because refusing would leave an existing namespace unmanageable and would block terraform destroy.
• ℹ️ maximum_throughput_units is only honored when auto_inflate_enabled = true.
• ℹ️ Private endpoints need Standard or above, not Premium. Microsoft states only that Private Link "isn't supported in the basic tier", so a Standard namespace can use both a private endpoint and network_rulesets. Up to 120 private endpoints per namespace. Customer-managed keys are the Premium/Dedicated feature, and this module does not expose them.
• ⚠️ Disabling public access blocks traffic at the application layer, not the TCP layer — so nslookup and a bare TCP connection against the public endpoint still succeed on a namespace whose public access is off. Do not use either as evidence that the private endpoint is not in effect.
• 🔴 message_retention and a per-hub retention_description are not merely alternatives — the provider marks them ExactlyOneOf, so exactly one of the two is REQUIRED on every hub. A hub defined with only a name and a partition count cannot terraform validate; there is no "accept the service default" option. retention_description also carries a second ExactlyOneOf between retention_time_in_hours and tombstone_retention_time_in_hours. Neither constraint appears in the binary schema.
• ⚠️ capture_description.destination.storage_authentication_type defaults to "StorageSAS" — a value the API does not define, hardcoded by the provider to match the portal. Capture therefore authenticates to storage with a shared key unless you set "SystemAssigned" or "UserAssigned". The capture_uses_shared_key_event_hubs output names every hub in that state.
• ⚠️ azurerm_eventhub and azurerm_eventhub_consumer_group support no tags at all. The namespace tag is the only one there is; it is not inherited.

Least-privilege, at the smallest scope that works:

• Management plane (provisioning): Contributor on the target resource group, or a custom role granting Microsoft.EventHub/namespaces/*, Microsoft.EventHub/namespaces/eventhubs/*, and Microsoft.EventHub/namespaces/eventhubs/consumergroups/*, scoped to the resource group.
• Data plane (send/receive at runtime): assign to producer/consumer identities, not to the deploying principal —
  • Azure Event Hubs Data Owner — full data-plane management.
  • Azure Event Hubs Data Sender — publish events.
  • Azure Event Hubs Data Receiver — consume events.
• Capture to storage: the namespace identity (or the identity named in capture_description.destination.storage_authentication_id) needs Storage Blob Data Contributor on the target storage account. Without one of those, capture falls back to the provider's default of StorageSAS and authenticates with a shared key.

🔴 Plan access is credential access on this resource. The provider declares six computed, sensitive attributes on azurerm_eventhub_namespace — the primary and secondary keys, their connection strings, and two alias connection strings — and its Read function fetches them from the RootManageSharedAccessKey rule on every refresh. Terraform reads computed attributes whenever it refreshes, so anyone who can run terraform plan against a configuration using this module thereby retrieves keys that grant Manage over the whole namespace, and those values are written to the state file in plaintext.

Setting local_authentication_enabled = false does not change this. It stops SAS being accepted at the data plane; it does not stop the keys existing or being read. Treat plan rights on this module as equivalent to namespace-owner rights, grant the data-plane roles above to workload identities rather than distributing keys, and keep state in an encrypted, access-controlled backend — marking an output sensitive redacts plan output, it does not encrypt state.

• An existing resource group in a supported US Azure region (e.g. eastus, eastus2, westus2, centralus).
• The Microsoft.EventHub resource provider registered on the target subscription.
• For capture: an existing storage account and blob container the namespace identity can write to.
• For a private endpoint: Standard or above (Private Link is unsupported on Basic only), plus the subnet and private DNS zone — privatelink.servicebus.windows.net — that sibling modules provision.
• For retention_description (log compaction and delete policies) and customer-managed keys: a Premium namespace or a Dedicated cluster.
• The caller configures the provider "azurerm" { features {} } block, authentication, and subscription; this module declares none of these.

terraform-azurerm-eventhub-namespace/
├── providers.tf   # required_version + azurerm ~> 4.0 pin; no provider block
├── variables.tf   # deeply-typed object() schemas + tags/timeouts tail
├── main.tf        # keystone namespace + for_each hubs & consumer groups
├── outputs.tf     # id first, then name, then child id/name maps
├── README.md      # this document
├── SCOPE.md       # the cross-module contract
├── LICENSE        # MIT, Copyright (c) 2026 Casey Wood
└── .gitignore     # canonical library ignore set

provider "azurerm" {
  features {}
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-telemetry-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  event_hubs = {
    telemetry = {
      name              = "telemetry"
      partition_count   = 4
      message_retention = 7
    }
  }
}

ℹ️ The caller owns the provider, authentication, subscription selection, and the mandatory features {} block. The empty-posture call above is already private (no public access), Entra-only (SAS off), and TLS 1.2-floored.

Consumes

Emits

The remaining outputs are advisory rather than wiring — posture and quota flags a composition asserts on rather than feeds forward. They are listed in full under 🧾 Outputs.

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-minimal-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-ingest-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  event_hubs = {
    orders = {
      name              = "orders"
      partition_count   = 8
      message_retention = 7
    }
    clicks = {
      name              = "clicks"
      partition_count   = 4
      message_retention = 3
    }
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-cg-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  event_hubs = {
    orders = {
      name              = "orders"
      partition_count   = 8
      message_retention = 7
    }
  }

  consumer_groups = {
    billing = {
      name         = "billing-processor"
      eventhub_key = "orders"
    }
    analytics = {
      name          = "analytics-stream"
      eventhub_key  = "orders"
      user_metadata = "owned by data-platform team"
    }
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-capture-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"
  sku                 = "Standard"

  event_hubs = {
    audit = {
      name              = "audit"
      partition_count   = 4
      message_retention = 7
      capture_description = {
        enabled             = true
        encoding            = "Avro"
        interval_in_seconds = 300
        size_limit_in_bytes = 314572800
        skip_empty_archives = true
        destination = {
          name                = "EventHubArchive.AzureBlockBlob"
          archive_name_format = "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}"
          blob_container_name = "eh-capture"
          storage_account_id  = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-streaming-prod/providers/Microsoft.Storage/storageAccounts/stcaptureprod"
        }
      }
    }
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-capauth-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  identity = {
    type = "SystemAssigned"
  }

  event_hubs = {
    audit = {
      name              = "audit"
      partition_count   = 2
      message_retention = 7
      capture_description = {
        enabled  = true
        encoding = "AvroDeflate"
        destination = {
          name                        = "EventHubArchive.AzureBlockBlob"
          archive_name_format         = "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}"
          blob_container_name         = "eh-capture"
          storage_account_id          = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-streaming-prod/providers/Microsoft.Storage/storageAccounts/stcaptureprod"
          storage_authentication_type = "SystemAssigned"
        }
      }
    }
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                     = "ehns-inflate-prod"
  resource_group_name      = "rg-streaming-prod"
  location                 = "eastus2"
  sku                      = "Standard"
  capacity                 = 2
  auto_inflate_enabled     = true
  maximum_throughput_units = 10
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                          = "ehns-fw-prod"
  resource_group_name           = "rg-streaming-prod"
  location                      = "eastus2"
  public_network_access_enabled = true

  network_rulesets = {
    default_action                 = "Deny"
    trusted_service_access_enabled = true
    ip_rule = [
      { ip_mask = "203.0.113.0/24" },
      { ip_mask = "198.51.100.10" },
    ]
    virtual_network_rule = [
      {
        subnet_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-network-prod/providers/Microsoft.Network/virtualNetworks/vnet-prod/subnets/snet-apps"
      },
    ]
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-sysid-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  identity = {
    type = "SystemAssigned"
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-uaid-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  identity = {
    type = "UserAssigned"
    identity_ids = [
      "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-identity-prod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/uami-eventhub",
    ]
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-premium-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"
  sku                 = "Premium"
  capacity            = 1

  event_hubs = {
    changelog = {
      name            = "changelog"
      partition_count = 8
      retention_description = {
        cleanup_policy                    = "Compact"
        tombstone_retention_time_in_hours = 48
      }
    }
    events = {
      name            = "events"
      partition_count = 4
      retention_description = {
        cleanup_policy          = "Delete"
        retention_time_in_hours = 168
      }
    }
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-basic-dev"
  resource_group_name = "rg-streaming-dev"
  location            = "eastus"
  sku                 = "Basic"

  event_hubs = {
    events = {
      name              = "events"
      partition_count   = 2
      message_retention = 1
    }
  }
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                          = "ehns-locked-prod"
  resource_group_name           = "rg-streaming-prod"
  location                      = "eastus2"
  sku                           = "Standard"
  local_authentication_enabled  = false
  public_network_access_enabled = false
  minimum_tls_version           = "1.2"

  identity = { type = "SystemAssigned" }

  event_hubs = {
    secure = {
      name              = "secure"
      partition_count   = 4
      message_retention = 7
      status            = "Active"
    }
  }
}

locals {
  domains = ["orders", "payments", "shipping", "inventory"]
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-platform-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  event_hubs = {
    for d in local.domains : d => {
      name              = d
      partition_count   = 4
      message_retention = 7
    }
  }

  consumer_groups = merge([
    for d in local.domains : {
      "${d}-audit"     = { name = "${d}-audit", eventhub_key = d }
      "${d}-analytics" = { name = "${d}-analytics", eventhub_key = d }
    }
  ]...)
}

module "eventhub_namespace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"

  name                = "ehns-tagged-prod"
  resource_group_name = "rg-streaming-prod"
  location            = "eastus2"

  tags = {
    environment = "prod"
    owner       = "data-platform"
    cost_center = "CC-4021"
  }

  timeouts = {
    create = "30m"
    delete = "30m"
  }
}

provider "azurerm" {
  features {}
}

module "resource_group" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"
  name     = "rg-streaming-prod"
  location = "eastus2"
}

module "capture_storage" {
  source              = "git::https://github.com/microsoftexpert/terraform-azurerm-storage-account.git?ref=v1.0.0"
  name                = "stcaptureprod0421"
  resource_group_name = module.resource_group.name
  location            = module.resource_group.location

  containers = {
    capture = { name = "eh-capture" }
  }
}

module "eventhub_namespace" {
  source              = "git::https://github.com/microsoftexpert/terraform-azurerm-eventhub-namespace.git?ref=v1.0.0"
  name                = "ehns-platform-prod"
  resource_group_name = module.resource_group.name
  location            = module.resource_group.location
  sku                 = "Standard"

  identity = { type = "SystemAssigned" }

  event_hubs = {
    telemetry = {
      name              = "telemetry"
      partition_count   = 8
      message_retention = 7
      capture_description = {
        enabled  = true
        encoding = "Avro"
        destination = {
          name                        = "EventHubArchive.AzureBlockBlob"
          archive_name_format         = "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}"
          blob_container_name         = "eh-capture"
          storage_account_id          = module.capture_storage.id
          storage_authentication_type = "SystemAssigned"
        }
      }
    }
  }

  consumer_groups = {
    stream = { name = "stream-processor", eventhub_key = "telemetry" }
  }
}

module "producer_grant" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.eventhub_namespace.id

  role_assignments = {
    producer_sender = {
      scope                = module.eventhub_namespace.id
      role_definition_name = "Azure Event Hubs Data Sender"
      principal_id         = var.producer_principal_id
    }
  }
}

Identity & placement — name, resource_group_name, location (all required, all immutable).

Namespace configuration — sku ("Standard"), capacity (1), auto_inflate_enabled (false), maximum_throughput_units (null), dedicated_cluster_id (null).

Secure posture — local_authentication_enabled (false), public_network_access_enabled (false), minimum_tls_version ("1.2"), identity (null), network_rulesets (null).

Child collections — event_hubs ({}), consumer_groups ({}).

Universal tail — tags ({}), timeouts (null).

variable "identity" {
  type = object({
    type         = string
    identity_ids = optional(list(string))
  })
  default = null
}

variable "network_rulesets" {
  type = object({
    default_action                 = optional(string, "Deny")
    public_network_access_enabled  = optional(bool)
    trusted_service_access_enabled = optional(bool)
    ip_rule = optional(list(object({
      ip_mask = string
      action  = optional(string, "Allow")
    })), [])
    virtual_network_rule = optional(set(object({
      subnet_id                                       = string
      ignore_missing_virtual_network_service_endpoint = optional(bool)
    })), [])
  })
  default = null
}

variable "event_hubs" {
  type = map(object({
    name              = string
    partition_count   = number
    message_retention = optional(number)
    status            = optional(string)
    capture_description = optional(object({
      enabled             = bool
      encoding            = string
      interval_in_seconds = optional(number)
      size_limit_in_bytes = optional(number)
      skip_empty_archives = optional(bool)
      destination = object({
        name                        = string
        archive_name_format         = string
        blob_container_name         = string
        storage_account_id          = string
        storage_authentication_id   = optional(string)
        storage_authentication_type = optional(string)
      })
    }))
    retention_description = optional(object({
      cleanup_policy                    = string
      retention_time_in_hours           = optional(number)
      tombstone_retention_time_in_hours = optional(number)
    }))
  }))
  default = {}
}

variable "consumer_groups" {
  type = map(object({
    name          = string
    eventhub_key  = string
    user_metadata = optional(string)
  }))
  default = {}
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
}

🔒 No connection strings or access keys are emitted. Re-emitting a secret copies it into every consuming configuration's state as well, for no benefit — and a module caller cannot reach the underlying resource's attributes to emit them anyway. Prefer Entra ID (RBAC) data-plane access with the roles named above; where a SAS connection string is genuinely unavoidable, create a dedicated authorization rule with a sibling module scoped to a single event hub, rather than reusing the namespace's root key.

• One keystone, keyed children. azurerm_eventhub_namespace.this is the single owned resource; hubs and consumer groups are for_each over keyed maps, so a key rename or removal touches only that record and never re-indexes the rest.
• Consumer-to-hub binding is by map key. Each consumer group names its owning hub through eventhub_key, which is resolved to the hub's name inside main.tf. That reference makes the create/destroy ordering implicit — Terraform builds the namespace, then the hub, then the consumer group, with no depends_on.
• Force-new realities. Changing name, resource_group_name or location replaces the whole namespace and its children, and so does moving sku to or from Premium — that last one from a CustomizeDiff the schema does not show. A hub's partition_count is the opposite trap: it is not force-new, so a change plans as an in-place update that the provider then refuses at apply on any shared Basic or Standard namespace, after a live read. Treat all of these as design-time decisions.
• Every hub needs a retention setting. The provider's ExactlyOneOf between message_retention and retention_description is invisible in the binary schema and means a hub with neither cannot terraform validate at all. There is no service default to fall back on.
• The firewall does not come off when you delete the block. network_rulesets is Optional and Computed, so an absent block reads as adopt whatever exists. Removing it produces an empty plan and leaves the namespace firewalled exactly as before. Set default_action = "Allow" to open it back up.
• Two public-access switches that must agree. The namespace's own public_network_access_enabled and the nested one inside network_rulesets are compared by the provider, which aborts the apply when they differ. Their defaults disagree — false here, true inside the provider's nested block — so main.tf renders the nested value from the namespace value whenever the caller leaves it unset, and variables.tf refuses an explicit contradiction offline.
• Capture authenticates with a shared key by default. storage_authentication_type defaults to "StorageSAS", a value the API does not define. Set "SystemAssigned" or "UserAssigned" and grant that identity Storage Blob Data Contributor on the destination account; capture_uses_shared_key_event_hubs lists every hub still on the default.
• Auto-inflate scales one way. It raises throughput units under load and never lowers them, so a spike raises the bill permanently. Terraform does not see it happen — it surfaces later as drift on capacity, and the next plan proposes undoing the scale-up that production may still need.
• Tier gates. Auto-inflate and capture need Standard+, private endpoints and retention_description need Premium/Dedicated. The module renders whatever you pass and lets the provider enforce the tier rule, so match the SKU to the features you enable.
• Optional blocks render only when supplied. identity, network_rulesets, per-hub capture_description/retention_description, and timeouts are all dynamic blocks gated on a non-null value, with try(x, null) on every optional inner field — an omitted key renders as absent, not as an error.
• features {} dependence. This module carries no provider block; the caller's provider "azurerm" { features {} } is required for initialization. Its absence in a root module is the usual cause of an init failure.

The empty call produces the hardened resource; each relaxation is an explicit opt-out:

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the module with ?ref=v1.0.0 — never track a branch.
• This is a plan-only / static-analysis workflow. A human runs terraform plan and terraform apply from CI against real credentials; the module authoring process never applies.

The offline proof gate that ships with this module:

• terraform init -backend=false — resolve the pinned provider without a backend.
• terraform validate — prove the configuration is internally consistent and type-correct against the pinned provider schema; the deeply-typed object() inputs surface a malformed call here, before any Azure API call.
• terraform fmt -check — enforce canonical formatting.

What the gate does not cover: validate and fmt never contact Azure. Tier-specific rejections (e.g. capture on Basic), RBAC, quota, and name-uniqueness are only exercised by terraform plan/apply against a live subscription, which a human runs from CI.

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

id                                              = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-streaming-prod/providers/Microsoft.EventHub/namespaces/ehns-platform-prod"
name                                            = "ehns-platform-prod"
resource_group_name                             = "rg-streaming-prod"
location                                        = "eastus2"
namespace_fqdn                                  = "ehns-platform-prod.servicebus.windows.net"
sku                                             = "Standard"
capacity                                        = 4
billed_whether_used                             = true
auto_inflate_can_raise_billed_capacity_silently = false
maximum_throughput_units_is_inert               = false
public_network_access_enabled                   = false
local_authentication_enabled                    = false
minimum_tls_version                             = "1.2"
minimum_tls_version_below_current_baseline      = false
plan_access_is_credential_access                = true
network_rulesets_configured                     = false
firewall_default_action                         = null
firewall_rule_count                             = 0
eventhub_count                                  = 1
eventhub_count_exceeds_tier_limit               = false
total_partition_count                           = 8
capture_enabled_event_hubs                      = ["telemetry"]
capture_uses_shared_key_event_hubs              = []
consumer_group_count_by_event_hub               = {
  "telemetry" = 1
}
eventhub_ids                = {
  "telemetry" = "/subscriptions/.../namespaces/ehns-platform-prod/eventhubs/telemetry"
}
eventhub_names              = {
  "telemetry" = "telemetry"
}
eventhub_partition_ids      = {
  "telemetry" = ["0", "1", "2", "3", "4", "5", "6", "7"]
}
eventhub_consumer_group_ids = {
  "stream" = "/subscriptions/.../eventhubs/telemetry/consumergroups/stream-processor"
}
identity_principal_id       = "11111111-2222-3333-4444-555555555555"
identity_tenant_id          = "66666666-7777-8888-9999-000000000000"

• Provider resources: azurerm_eventhub_namespace, azurerm_eventhub, azurerm_eventhub_consumer_group.
• Microsoft Learn: Azure Event Hubs documentation, Event Hubs Capture, Authorize with Microsoft Entra ID.
• Sibling modules: terraform-azurerm-resource-group, terraform-azurerm-storage-account, terraform-azurerm-role-assignments, terraform-azurerm-private-endpoint, terraform-azurerm-virtual-network, terraform-azurerm-user-assigned-identity.
• This module's SCOPE.md — the cross-module contract.

💙 "Infrastructure as Code should be standardized, consistent, and secure."