☁️ Azure Kubernetes Cluster Deployment Safeguard Terraform Module

Configures Deployment Safeguards on an AKS cluster — best-practice admission control via Azure Policy and Gatekeeper — targeting hashicorp/azurerm ~> 4.0.

• ⚙️ Creates one azurerm_kubernetes_cluster_deployment_safeguard, named this. A singleton per cluster.
• 🎚️ Sets the enforcement level — Warn or Enforce — as a closed, validated set.
• 🔐 Defaults pod_security_standards_level to Baseline, not the provider's Privileged. The provider's default is Kubernetes' unrestricted tier; this module makes you type it.
• 🚪 Validates excluded_namespaces against RFC 1123 and rejects the two documented mistakes — a comma-separated string and an embedded space.
• 🧾 Emits the posture as booleans and an ordinal, so a check block can assert on it instead of on a string.
• ⚠️ States the three things about this control that its name does not: Enforce mutates, Enforce fails open, and one exclusion bypasses two controls.

💡 Why it matters: Deployment Safeguards are the cheapest real improvement available to an AKS cluster — one resource, four arguments, and every workload is held to a published set of best practices. But it is a control whose behaviour diverges from its name in three documented ways, and none of them is visible in a plan. This module makes every computable rule a type error, flips the one permissive default it can, and emits the rest as facts you can read in a review rather than discover in an incident.

If this module saves you time:

• ⭐ Star the repository — it genuinely helps others find it.
• 💼 Connect on LinkedIn — linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee — buymeacoffee.com/microsoftexpert

flowchart TB
  RG["terraform-azurerm-resource-group"]
  AKS["terraform-azurerm-kubernetes-cluster"]
  SG["terraform-azurerm-kubernetes-cluster-deployment-safeguard"]
  EXT["terraform-azurerm-kubernetes-cluster-extension"]
  TARB["terraform-azurerm-kubernetes-cluster-trusted-access-role-binding"]
  POL["terraform-azurerm-policy-assignment -- the mechanism underneath, managed separately"]

  RG -->|"resource_group_name"| AKS
  AKS -->|"azure_policy_enabled must be true"| SG
  AKS -->|"id as kubernetes_cluster_id"| SG
  AKS -->|"id as cluster_id -- NOTE THE DIFFERENT ARGUMENT NAME"| EXT
  AKS -->|"id as kubernetes_cluster_id"| TARB
  EXT -->|"installs_into_namespace becomes an exclusion"| SG
  SG -.->|"implemented with Azure Policy, but NOT managed through it"| POL

  style SG fill:#0078D4,stroke:#004578,color:#ffffff
  style AKS fill:#004578,stroke:#00335c,color:#ffffff
  style RG fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style EXT fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style TARB fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style POL fill:#f2f4f7,stroke:#98a2b3,color:#1d2939

Two edges matter more than the rest. The cluster must have azure_policy_enabled = true or safeguards are configured and never take effect — Microsoft's first troubleshooting step. And the cluster-extension module feeds installs_into_namespace in as an exclusion, because a platform component's namespace usually cannot meet workload rules. The dashed edge is a warning: this is implemented with Azure Policy but must not be managed through it.

flowchart TB
  CID["kubernetes_cluster_id -- REQUIRED, force-new"]
  LVL["level -- REQUIRED, closed at Warn or Enforce. No default, so there is no empty call to make safe."]
  PSS["pod_security_standards_level -- provider default is Privileged, the LEAST restrictive. THIS MODULE DEFAULTS TO Baseline."]
  EXC["excluded_namespaces -- defaults to empty. Every entry bypasses BOTH controls."]
  THIS["azurerm_kubernetes_cluster_deployment_safeguard.this"]
  IDNOTE["its id IS the cluster id -- there is no separate safeguard id, and two declarations for one cluster collide silently"]
  GK["Gatekeeper admission, via Azure Policy"]
  DENY["denies noncompliant workloads"]
  MUT["MUTATES admitted workloads -- sets CPU and memory requests, adds anti-affinity, strips a node-pool taint"]
  OPEN["FAILS OPEN -- if Gatekeeper does not answer, the check is skipped and the deployment proceeds"]
  DERIVED["derived: enforcement_is_blocking, pod_security_standards_rank, excluded_system_namespaces, posture_summary"]

  CID --> THIS
  LVL --> THIS
  PSS --> THIS
  EXC --> THIS
  THIS --> IDNOTE
  THIS -->|"configures"| GK
  GK --> DENY
  GK --> MUT
  GK -.->|"by design, not a bug"| OPEN
  THIS --> DERIVED

  style THIS fill:#0078D4,stroke:#004578,color:#ffffff
  style OPEN fill:#004578,stroke:#00335c,color:#ffffff
  style CID fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style LVL fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style PSS fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style EXC fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style IDNOTE fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style GK fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style DENY fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style MUT fill:#f2f4f7,stroke:#98a2b3,color:#1d2939
  style DERIVED fill:#f2f4f7,stroke:#98a2b3,color:#1d2939

• 🔴 The resource's id IS the cluster's id. The provider states it plainly — id is "The ID of the Kubernetes Cluster (same as kubernetes_cluster_id)" — and the import command confirms it, importing by cluster ID with no /deploymentSafeguards/default suffix.
• 🔴 So two declarations for one cluster hold the SAME Terraform ID and collide silently. Both plan, both apply, each overwrites the other, and the next plan shows an alternating diff that never settles. Terraform detects nothing. Declare this once per cluster.
• 🔴 Enforce MUTATES as well as denying. It sets default CPU and memory requests, adds pod anti-affinity rules and topology spread constraints, and removes a CriticalAddonsOnly taint from a user node pool that does not set one. A workload can deploy successfully and not be the workload you wrote.
• 🔴 Enforce is not a guarantee — Gatekeeper fails open by design. "There are no guarantees that Gatekeeper will respond to our networking call. Therefore, we make sure that the validation doesn't run in such cases so that the denial doesn't block your deployments." When the check cannot run, the deployment is allowed.
• 🔴 One excluded_namespaces entry bypasses BOTH the safeguards AND the Pod Security Standard. There is no way to exempt a namespace from one and keep the other.
• ⚠️ pod_security_standards_level defaults to Privileged in the provider — the least restrictive of three. This module defaults to Baseline.
• ⚠️ All safeguard policies are bundled and cannot be individually toggled. "Deployment Safeguards is all or nothing."
• ⚠️ On AKS Automatic clusters, level cannot move from Enforce to Warn. The provider cannot see the cluster's mode, so no validation can catch this — it is an apply-time rejection.
• ⚠️ Only kubernetes_cluster_id is force-new. Everything else updates in place, which is what makes Warn → Enforce a cheap change.
• ⚠️ The parent reference is kubernetes_cluster_id here and cluster_id on the cluster-extension module for the same cluster. Do not infer it from a sibling.
• ℹ️ A namespace name is a string this module cannot resolve. Excluding a namespace that does not exist is accepted and does nothing, with no error, ever.

Force-new facts come from the provider's documentation markdown. The binary schema carries no force-new marker at all. Shapes and types come from the schema; the operational rules come from Microsoft's platform documentation.

🔒 Enabling this needs NO Azure Policy permissions, and the interesting direction is the reverse. Microsoft: "you don't have to have the correct permissions to assign or delete Azure Policies. All that is required are permissions to the AKS Contributor role." So anyone with AKS Contributor on the cluster can move Enforce to Warn or add an exclusion, holding no policy right at all — a policy-based review of who can weaken admission control here will not find them. Put it in the cluster's access review.

ℹ️ No credential is involved anywhere in this module. It accepts no secret, emits no secret, and reading it discloses nothing sensitive — so plan access and credential access do not come apart at all here. That is a positive property worth stating, because it does not hold across this library.

• The Azure Policy add-on enabled on the cluster — azure_policy_enabled = true. Without it, safeguards are configured and never take effect.
• Kubernetes 1.25 or later.
• Microsoft.PolicyInsights registered on the subscription, for the compliance assessment. Note this is not the resource's own provider.
• No lock on the cluster's resource group that blocks modification — a documented configuration-error cause, in direct tension with using a lock to protect this resource from destruction.
• The subscription not suspended, and the cluster not deleting.
• To read compliance in the portal: the Azure Policy initiative must be scoped to the cluster's resource group. cluster_resource_group is emitted for this.

terraform-azurerm-kubernetes-cluster-deployment-safeguard/
├── providers.tf   # required_version + the pinned azurerm; no provider block
├── variables.tf   # 5 inputs, 19 validations
├── main.tf        # locals deriving the posture + the single keystone resource
├── outputs.tf     # 24 outputs: id first, the derived posture, then ten constants
├── README.md      # this file
├── SCOPE.md       # the cross-module contract
├── LICENSE        # MIT
└── .gitignore     # the canonical library ignore file

provider "azurerm" {
  features {}
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Warn"
}

Two arguments. pod_security_standards_level defaults to Baseline — not the provider's Privileged.

⚠️ Start at Warn on an existing cluster. Read what it would have blocked and mutated, then move to Enforce. The change updates in place; only the cluster ID is force-new.

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Warn"
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Warn"

  # Baseline is already the default; naming it makes the intent visible in review.
  pod_security_standards_level = "Baseline"
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Enforce"
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id        = module.aks.id
  level                        = "Enforce"
  pod_security_standards_level = "Restricted"
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Enforce"

  # The PROVIDER'S default. You have to type it here.
  pod_security_standards_level = "Privileged"
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Enforce"

  excluded_namespaces = ["flux-system"]
}

module "flux_extension" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-extension.git?ref=v1.0.0"

  name           = "flux"
  cluster_id     = module.aks.id
  extension_type = "microsoft.flux"

  namespaces = {
    release_namespace = "flux-system"
  }
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Enforce"

  excluded_namespaces = [module.flux_extension.installs_into_namespace]
}

# THIS FAILS AT PARSE TIME.
excluded_namespaces = ["ns1,ns2"]

# So does this -- the CLI takes a space-separated list, and the habit carries over.
excluded_namespaces = ["ns1 ns2"]

# THIS is correct.
excluded_namespaces = ["ns1", "ns2"]

# All of these FAIL AT PARSE TIME.
excluded_namespaces = ["Flux-System"]     # upper case
excluded_namespaces = ["flux_system"]     # underscore
excluded_namespaces = ["-flux"]           # must start alphanumeric
excluded_namespaces = ["/subscriptions/00000000-0000-0000-0000-000000000000/..."]
excluded_namespaces = ["ns1", "ns1"]      # duplicate

# Correct.
excluded_namespaces = ["flux-system"]

level = "Audit"      # FAILS -- an Azure Policy EFFECT, not an enforcement level
level = "Deny"       # FAILS -- same
level = "enforce"    # FAILS -- recognised level, wrong case
level = "Enforce"    # correct

pod_security_standards_level = "baseline"   # FAILS -- Kubernetes writes these lower case
pod_security_standards_level = "enforce"    # FAILS -- that is a MODE, not a LEVEL
pod_security_standards_level = "Baseline"   # correct

# All FAIL AT PARSE TIME, each naming what you actually passed.

kubernetes_cluster_id = "/subscriptions/.../providers/Microsoft.Kubernetes/connectedClusters/arc-cluster"
# -> an Arc cluster. Deployment Safeguards are AKS-only; there is no Arc equivalent.

kubernetes_cluster_id = "/subscriptions/.../providers/Microsoft.ContainerService/fleets/fleet-prod"
# -> a fleet. SHARES the Microsoft.ContainerService prefix, which is why it transposes so easily.

kubernetes_cluster_id = "/subscriptions/.../managedClusters/aks-east/agentPools/system"
# -> a node pool. Safeguards are cluster-wide and cannot be scoped to one pool.

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id
  level                 = "Enforce"
}

check "production_admission_control" {
  assert {
    condition     = module.safeguards.enforcement_is_blocking
    error_message = "Production clusters must run Deployment Safeguards in Enforce, not Warn."
  }
  assert {
    condition     = module.safeguards.pod_security_standards_rank >= 1
    error_message = "Pod Security Standards must be Baseline or Restricted, never Privileged."
  }
  assert {
    condition     = !module.safeguards.excludes_a_system_namespace
    error_message = "A system namespace is exempt from admission control. Review why."
  }
}

module "cluster_safeguards" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"
  for_each = module.regional_clusters

  kubernetes_cluster_id = each.value.id
  level                 = "Enforce"

  pod_security_standards_level = "Baseline"
}

output "posture_by_cluster" {
  value = { for k, m in module.cluster_safeguards : k => m.posture_summary }
}

provider "azurerm" {
  features {}
}

locals {
  platform_tags = {
    environment = "production"
    owner       = "platform-engineering"
  }
}

module "platform_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-platform-eastus"
  location = "eastus"

  tags = local.platform_tags
}

module "aks" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster.git?ref=v1.0.0"

  name                = "aks-platform-eastus"
  resource_group_name = module.platform_rg.name
  location            = module.platform_rg.location
  dns_prefix          = "aks-platform"

  # MANDATORY for Deployment Safeguards. Without it they configure and never take effect.
  azure_policy_enabled = true

  # Deployment Safeguards require Kubernetes 1.25 or later.
  kubernetes_version = "1.30"

  default_node_pool = {
    name       = "system"
    node_count = 3
    vm_size    = "Standard_D4s_v5"
  }

  identity = {
    type = "SystemAssigned"
  }

  tags = local.platform_tags
}

# A platform extension whose namespace cannot meet workload rules.
module "flux_extension" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-extension.git?ref=v1.0.0"

  name           = "flux"
  cluster_id     = module.aks.id
  extension_type = "microsoft.flux"

  namespaces = {
    release_namespace = "flux-system"
  }
}

module "safeguards" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-kubernetes-cluster-deployment-safeguard.git?ref=v1.0.0"

  kubernetes_cluster_id = module.aks.id

  # Start at Warn, read the warnings, then change this one string to Enforce.
  # It updates in place -- only the cluster ID is force-new.
  level = "Enforce"

  # Baseline is this module's default; named here so the posture is explicit in review.
  pod_security_standards_level = "Baseline"

  # Read from the module that OWNS the namespace, not hard-coded in two places.
  excluded_namespaces = [
    module.flux_extension.installs_into_namespace,
  ]
}

check "admission_control_is_real" {
  assert {
    condition     = module.safeguards.enforcement_is_blocking
    error_message = "Deployment Safeguards must be in Enforce on this cluster."
  }
  assert {
    condition     = !module.safeguards.pod_security_standards_are_unrestricted
    error_message = "Pod Security Standards must not be Privileged."
  }
  assert {
    condition     = module.safeguards.excluded_namespace_count <= 1
    error_message = "At most one namespace may be exempt: the GitOps controller's own."
  }
}

output "cluster_admission_posture" {
  value = {
    cluster   = module.safeguards.cluster_name
    summary   = module.safeguards.posture_summary
    blocking  = module.safeguards.enforcement_is_blocking
    mutating  = module.safeguards.mutates_admitted_workloads
    pss_rank  = module.safeguards.pod_security_standards_rank
    exempt    = module.safeguards.excluded_namespaces
    guaranteed = false # see enforce_is_not_a_guarantee_because_gatekeeper_fails_open
  }
}

Required (2): kubernetes_cluster_id (force-new), level.

Optional (3): pod_security_standards_level (defaults to Baseline, not the provider's Privileged), excluded_namespaces, timeouts.

There is deliberately no name, tags, location or resource_group_name — the resource has no such arguments. The name is absent because the ARM object is a singleton called default.

variable "kubernetes_cluster_id" {
  type = string
  # REQUIRED, force-new. Anchored at both ends to
  # .../Microsoft.ContainerService/managedClusters/<name>.
  # Rejects by name: connectedClusters (Arc), fleets, /agentPools/ children.
  # NOTE: this argument is `cluster_id` on the cluster-extension module.
}

variable "level" {
  type = string
  # REQUIRED. CLOSED set: "Warn" | "Enforce".
  # Also rejects an Azure Policy effect (Audit, Deny, Modify, ...) by name,
  # and a recognised level in the wrong case.
}

variable "pod_security_standards_level" {
  type    = string
  default = "Baseline"
  # CLOSED set: "Baseline" | "Privileged" | "Restricted".
  # THE PROVIDER DEFAULTS THIS TO "Privileged", THE LEAST RESTRICTIVE.
  # This module defaults to "Baseline" instead; "Privileged" is an explicit opt-out.
  # Also rejects a Pod Security Admission MODE (enforce/warn/audit) where a LEVEL belongs.
}

variable "excluded_namespaces" {
  type    = list(string)
  default = []
  # EVERY ENTRY BYPASSES BOTH THE SAFEGUARDS AND THE POD SECURITY STANDARD.
  # Each must be an RFC 1123 label: lower-case alphanumerics and "-", <= 63 chars,
  # starting and ending alphanumeric. Rejects a comma, a space, a Resource ID,
  # an empty entry, and duplicates.
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
  # Provider defaults: create 30m, read 5m, update 30m, delete 30m.
}

No secret is accepted or emitted anywhere in this module.

The identity of this resource is the thing to understand first. Its Terraform id is the cluster's Resource ID — the provider says so, and the import command proves it. That is not a cosmetic detail. It means a downstream module handed id receives the cluster (and if it wanted the cluster, the mistake is masked); it means importing is done with a cluster ID; and it means two declarations targeting one cluster hold the same Terraform ID. Terraform has no uniqueness constraint to violate here, so both plan, both apply, each overwrites the other, and the next plan shows an alternating diff that never converges. The ARM object is a singleton named default, which is also why there is no name argument. Declare this once per cluster and let anything else consume its outputs.

Enforce is two behaviours, and the module emits them separately on purpose. Denial is what everyone pictures. Mutation is the other half: Enforce sets default CPU and memory requests, adds pod anti-affinity rules and topology spread constraints, and strips a CriticalAddonsOnly taint from a user node pool that does not declare one. So a manifest can be applied, reported successful, and be running with a spec nobody wrote. denies_noncompliant_workloads and mutates_admitted_workloads derive from the same input and are still separate outputs, because they are coupled only by the current behaviour of one enum value — and because one combined flag invites a reader to assume denial and stop there.

Enforce is also not a guarantee, and no configuration can make it one. Gatekeeper performs the admission check and operates fail-open by design: when it cannot be reached, the validation is skipped so that a denial does not block deployments. Availability is preferred over enforcement. That is a defensible choice for a best-practices control and the opposite of what the word "Enforce" implies, so it is emitted as a constant with a failure-timing table whose decisive rows read Never — because a skipped check produces no error, no warning, and no record. This resource raises the floor; it does not establish a boundary. A compliance claim resting on it alone is overstated.

The one permissive default that could be flipped, was. pod_security_standards_level defaults to Privileged in the provider — Kubernetes' unrestricted tier, applying essentially no pod-level constraint. This suite's rule is that an enum containing a permissive member defaults to the locked-down member, so this module defaults to Baseline: restrictive enough to block known privilege escalations, permissive enough not to break ordinary workloads, and the same choice Microsoft makes for its own AKS Automatic clusters. Restricted was not chosen as the default because it genuinely breaks workloads not written for it. The divergence from the provider is emitted rather than hidden, so a reader comparing plans is not left with an unexplained difference.

level is required, so secure-by-default has nothing to act on — and that is stated rather than glossed. There is no empty call to make safe. The three compensations this suite prescribes are all present: the value set is enforced as closed (the provider enumerates it exhaustively, so this is not an invented constraint); the restrictive value is named inside the error message, alongside a check that catches Azure Policy's own Audit/Deny/Modify vocabulary — a wrong value arriving from a different mechanism rather than a typo, which is exactly the case where naming the other mechanism in the message is worth the effort; and the choice is emitted as four derived flags.

Nothing is grouped into a structured variable here, and the absence is deliberate. The technique this suite uses for a rule spanning two fields needs both fields in one variable, because a validation {} may only reference its own. The only cross-field rule Microsoft publishes for this resource involves the cluster's mode — an AKS Automatic cluster cannot move from Enforce to Warn — and the cluster's mode is neither an input nor derivable from the Resource ID. No validation can reach it, so it is emitted as a constant and rejected by Azure at apply. Folding a field in to manufacture the check would misrepresent the schema.

Exclusions are the only dial, and they are blunt. All safeguard policies are bundled: "Deployment Safeguards is all or nothing." When one policy breaks a workload, the sole remedy is to exempt its namespace — which switches off every safeguard and the Pod Security Standard for that namespace. That asymmetry between the size of the problem and the size of the available fix is why the exclusion list is emitted in full rather than summarised.

Report-versus-reject was decided per check. A comma or an embedded space in a namespace entry is rejected, because Microsoft documents both as errors and both are computable. A system namespace in the exclusion list is reported, because a caller could plausibly have meant it — a platform component's namespace sometimes must be exempt. A duplicate is rejected, because the list carries no ordering or precedence semantics, so a repeat cannot express anything a single entry does not.

What this module cannot see, and says so. Whether the Azure Policy add-on is on. Whether the cluster runs 1.25 or later. Whether the cluster is Automatic or Standard. Whether a named namespace exists — excluding a nonexistent namespace is accepted and does nothing, silently. Each of those is an apply-time or never-time failure, and each is named in the outputs or the troubleshooting table rather than approximated by a validation that could reject legal input.

🔒 Where secure-by-default applies and where it cannot. pod_security_standards_level is the case where it applies, and the default is flipped from the provider's permissive Privileged to Baseline. level is the case where it cannot: the provider makes it required, so there is no empty call, and the compensations are a closed value set, the restrictive value named in the error message, and the posture emitted as derived flags. See secure_by_default_cannot_apply_to_a_required_enum.

⚠️ And the honest limit no default could fix: Enforce fails open. See enforce_is_not_a_guarantee_because_gatekeeper_fails_open.

terraform init -backend=false
terraform validate
terraform fmt -check

Pin by tag — ?ref=v1.0.0 — never a branch. This library is plan-only: a human applies from CI.

The operational sequence that matters here:

# 1. Configure at Warn. Nothing is blocked.
# 2. Deploy as usual and collect what would have been denied or mutated.
# 3. Fix the manifests.
# 4. Change level to "Enforce". It updates IN PLACE -- no replacement.
terraform plan -out=tfplan
terraform show -json tfplan | jq '.resource_changes[].change.actions'   # expect ["update"]

⚠️ Destroying this resource silently disables admission control on a live cluster. It reads as one destroyed resource. lifecycle is not valid inside a module block, so prevent_destroy is not available to a caller; a CanNotDelete management lock on the cluster is — bearing in mind that a lock on the resource group can itself block configuring safeguards.

The offline gate is init -backend=false → validate → fmt -check.

What only a root-module terraform console proves: that each validation {} block fires. terraform validate on a calling configuration does not run root-variable validations. Feed it deliberately bad .tfvars and read the line numbers, not the message text — Terraform hard-wraps messages, so grepping for a phrase silently matches nothing.

echo 'var.level' | terraform console -var-file=bad.tfvars

⚠️ Terraform skips a validation whose referenced variable has already failed, and suppression is per-variable, so a short error list is not proof a check is missing. Note in particular that alltrue([for ...]) over an empty collection is true — every excluded_namespaces check needs a fixture with a non-empty list, or it reports success while testing nothing.

What only a real plan/apply against Azure exercises: whether the Azure Policy add-on is enabled, whether the cluster runs Kubernetes 1.25 or later, whether the cluster is Automatic (and therefore cannot accept Warn), whether Microsoft.PolicyInsights is registered, and whether a named namespace exists. None of that is visible offline, and none of it is approximated by a validation here.

id                                                  = "/subscriptions/.../resourceGroups/rg-platform-eastus/providers/Microsoft.ContainerService/managedClusters/aks-platform-eastus"
kubernetes_cluster_id                               = "/subscriptions/.../resourceGroups/rg-platform-eastus/providers/Microsoft.ContainerService/managedClusters/aks-platform-eastus"
cluster_name                                        = "aks-platform-eastus"
cluster_resource_group                              = "rg-platform-eastus"
level                                               = "Enforce"
enforcement_is_blocking                             = true
denies_noncompliant_workloads                       = true
mutates_admitted_workloads                          = true
warns_without_blocking_anything                     = false
pod_security_standards_level                        = "Baseline"
pod_security_standards_rank                         = 1
pod_security_standards_are_unrestricted             = false
pod_security_standards_diverge_from_provider_default = true
excluded_namespaces                                 = ["flux-system"]
excluded_namespace_count                            = 1
excluded_system_namespaces                          = []
excludes_the_default_namespace                      = false
posture_summary                                     = "Enforce / PSS Baseline / 1 namespace(s) exempt"
is_the_most_restrictive_configuration               = false

ℹ️ Note id and kubernetes_cluster_id are the same string. That is correct and is the provider's design, not a module defect.

ℹ️ is_the_most_restrictive_configuration = false here despite Enforce — because the Pod Security Standard is Baseline rather than Restricted and one namespace is exempt. Both are reasonable choices; the output exists so a "maximum posture" claim can be checked rather than asserted.

• azurerm_kubernetes_cluster_deployment_safeguard — the provider resource.
• Use Deployment Safeguards in AKS — the policy list, the mutations, the AKS Automatic restriction, and the fail-open note.
• Troubleshooting Deployment Safeguards — the documented error cases, including the ns1,ns2 rejection.
• Kubernetes Pod Security Standards — what Baseline and Restricted actually require.
• SCOPE.md — this module's cross-module contract.
• Siblings: terraform-azurerm-kubernetes-cluster (the parent), terraform-azurerm-kubernetes-cluster-extension, terraform-azurerm-kubernetes-cluster-trusted-access-role-binding, terraform-azurerm-policy-assignment.

💙 "Infrastructure as Code should be standardized, consistent, and secure."