☁️ Azure Integration Account Agreement Terraform Module

Declares one B2B trading agreement — AS2, X12, or Edifact — inside an existing integration account (azurerm_logic_app_integration_account_agreement). Targets hashicorp/azurerm ~> 4.0.

• 🤝 Declares one trading agreement — the record binding two partners, two business identities, and a B2B protocol — as a keystone resource named this.
• ✅ agreement_type (AS2 / X12 / Edifact) is required and validated; there is no safe default, because the three describe genuinely different relationships.
• ⚠️ States the quiet failure plainly: the service does not cross-check the business identities against the partners, so a mismatch produces an agreement that applies cleanly and never matches a document.
• 🔒 Treats content as a security artifact, not configuration — for AS2 it decides whether messages are signed, whether they are encrypted, and with which algorithms.
• 🗝️ Accepts no key material. Certificates are referenced by name and owned by the certificate module, which keeps the private key in Key Vault.
• 📤 Emits agreement_type so a review can see which protocol governs a relationship without opening the document; content is deliberately not emitted.

💡 Why it matters: Two facts about this resource cause most of the trouble. Terraform checks only that content parses as JSON — and through a module boundary that check is the module's own, at variable evaluation, because a provider schema check reaches only a literal written in a resource block — and nothing about its meaning is validated anywhere, and the service validates nothing about the identity pairs — so an agreement can be entirely wrong and still apply green. This module cannot check either, so it does the next best thing: it wires the identities from the partner module rather than letting you retype them, and it says exactly which claims are unverified.

If this module saves you time, please consider supporting its continued development:

• ⭐ Star the repository on GitHub.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart LR
  acct["terraform-azurerm-logic-app-integration-account"]
  hostp["partner module: YOUR side, emits business_identities"]
  guestp["partner module: the COUNTERPARTY"]
  cert["integration-account-certificate: private key stays in Key Vault"]
  schema["integration-account-schema: what EDI documents validate against"]
  this["terraform-azurerm-logic-app-integration-account-agreement"]
  ag["azurerm_logic_app_integration_account_agreement"]
  wf["terraform-azurerm-logic-app-workflow: the AS2 or EDI actions"]
  batch["integration-account-batch-configuration"]

  acct -->|"integration_account_name, NOT its id"| this
  hostp -->|"host_partner_name plus host_identity"| this
  guestp -->|"guest_partner_name plus guest_identity"| this
  cert -->|"referenced BY NAME inside content, for AS2"| this
  schema -->|"referenced by the EDI settings in content"| this
  this -->|"creates"| ag
  ag -->|"what the decode and encode actions match on"| wf
  batch -->|"sibling artifact, independent lifecycle"| acct

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class this me;
  class ag keystone;
  class acct,hostp,guestp,cert,schema,wf,batch sib;

flowchart TB
  addr["name, resource_group_name, integration_account_name: ALL force-new"]
  at["agreement_type AS2 or X12 or Edifact: validated, drives the content shape"]
  hp["host_partner_name plus guest_partner_name: must already exist in the account"]
  hi["host_identity and guest_identity: qualifier plus value"]
  nocheck["the service does NOT cross-check identities against the partners"]
  content["content: the JSON agreement body, UNVALIDATED by Terraform"]
  sec["for AS2 the content decides signing, encryption, and algorithms"]
  md["metadata: a map of strings here, a plain string on certificate, partner, schema"]
  this["terraform-azurerm-logic-app-integration-account-agreement"]
  ag["azurerm_logic_app_integration_account_agreement.this"]
  out["outputs: id, name, agreement_type, both partner names"]
  withheld["content deliberately NOT emitted"]

  addr -->|"identity"| this
  at -->|"protocol"| this
  hp -->|"the two parties"| this
  hi -->|"how documents are matched"| this
  nocheck -->|"a mismatch matches nothing, silently"| hi
  content -->|"the settings"| this
  sec -->|"review as a security artifact"| content
  md -->|"onboarding provenance"| this
  this -->|"creates"| ag
  ag -->|"emits"| out
  ag -->|"withheld"| withheld

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class this me;
  class ag keystone;
  class addr,at,hp,hi,nocheck,content,sec,md,out,withheld sib;

Resource inventory

Schema notes that bite (verified against the live provider schema):

• name, resource_group_name, and integration_account_name are all force-new. For a live trading relationship a rename means a window in which inbound documents have no agreement to match.
• The content document's required shape depends entirely on agreement_type — an X12 body under agreement_type = "AS2" is rejected at apply, not at plan.
• Terraform checks only that content parses as JSON — and through a module boundary that check is the module's own, at variable evaluation, because a provider schema check reaches only a literal written in a resource block — and nothing about its meaning is validated anywhere. Envelope settings, acknowledgement behaviour, and — for AS2 — the signing and encryption settings are opaque to every offline check.
• The service does not cross-check host_identity / guest_identity against the partners. A pair no partner declares produces an agreement that exists, applies cleanly, and never matches a document.
• Both partners must already exist in the same integration account; a name that does not resolve is rejected at apply.
• metadata is a map(string) here — the same field is a plain string on the certificate, partner, and schema artifacts in this family. An easy inconsistency to trip over when copying between them.
• The parent is addressed by name, not by Resource ID — the pattern shared by every artifact in this family.
• Agreement capacity belongs to the account's SKU, and Basic is the smallest tier of the three. Microsoft's published artifact limits allow 10 EDI trading agreements on Free, 1 on Basic and 1,000 on Standard. Nothing in this module can see the parent account's SKU, so the ceiling never appears in a plan.
• The create-time collision check is a caller-side conditional, not a property of the resource. The create path GETs this exact agreement and refuses to continue if one exists — unless the caller sets features { skip_import_check_on_create_and_allow_overwriting_existing_resources = true }, in which case an apply silently overwrites an existing agreement of the same name, content document and AS2 security settings included.
• This resource type has no tags surface.

• Logic App Contributor or Contributor on the integration account's resource group, covering Microsoft.Logic/integrationAccounts/agreements/write. Logic App Contributor grants Microsoft.Logic/*, which covers it.
• Microsoft.Logic/integrationAccounts/agreements/read — the create path's collision check GETs this agreement, not the account. There is no integrationAccounts/read call anywhere in this resource.
• Three built-in roles look sufficient and are not. Logic App Operator holds only Microsoft.Logic/*/read (plus workflow enable/disable/validate), so it can refresh and plan this resource but not create, update or delete it. Logic Apps Standard Contributor and Logic Apps Standard Developer are Microsoft.Web/* roles with no Microsoft.Logic action at all, so a team on single-tenant Logic Apps holding only those cannot manage integration-account artifacts despite the names.
• ⚠️ Plan rights are review rights here. The read path returns the whole content document, so anyone who can refresh this resource can read the exchange's AS2 signing and encryption settings. That is not credential access — no key or certificate private half is returned — but it is more than a name.
• No data-plane or Key Vault permission is needed here — certificates are referenced by name and owned by the certificate module.

• An existing integration account. Its SKU sets the agreement ceiling: Free permits 10, Basic only 1, Standard 1,000 — so a real trading estate needs Standard, and moving a Free account to Basic reduces agreement capacity from ten to one.
• Both partners already created in that same account, each declaring the business identity this agreement names.
• For AS2: the signing and encryption certificates already uploaded as certificate artifacts, referenced by name in content.
• For X12 or Edifact: any schema the agreement's settings reference already uploaded as schema artifacts.
• The caller configures the provider "azurerm" { features {} } block, auth, and subscription.

terraform-azurerm-logic-app-integration-account-agreement/
├── providers.tf   # required_version >= 1.12.0; azurerm ~> 4.0; no provider block
├── variables.tf   # validated agreement_type, required identity objects, content, timeouts tail
├── main.tf        # keystone azurerm_logic_app_integration_account_agreement.this
├── outputs.tf     # id, name, parent addressing, agreement_type, both partner names
├── README.md      # this document
├── SCOPE.md       # cross-module contract
├── LICENSE        # MIT
└── .gitignore     # canonical library ignore set

provider "azurerm" {
  features {}
}

module "contoso_x12" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-agreement.git?ref=v1.0.0"

  name                     = "contoso-x12-850"
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name # the NAME, not the id

  agreement_type = "X12"

  host_partner_name  = module.our_partner.name
  guest_partner_name = module.contoso_partner.name

  # Wired from the partner modules so the two records cannot drift apart.
  host_identity  = module.our_partner.business_identities["primary"]
  guest_identity = module.contoso_partner.business_identities["primary"]

  content = file("${path.module}/agreements/contoso-x12-850.json")
}

ℹ️ The caller owns the provider, its authentication, and the mandatory features {} block. This module never declares them.

Consumes

Emits

The examples below reference existing resources by ID or name rather than creating them; this module owns only its own resource. Those references are declared inputs:

variable "b2b_vault_id" {
  description = "id of an existing b2b vault that these examples reference but do not create."
  type        = string
}

variable "eurofoods_partner_business_identities" {
  description = "business identities of an existing eurofoods partner that these examples reference but do not create."
  type        = map(string)
}

module "contoso_x12" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-agreement.git?ref=v1.0.0"

  name                     = "contoso-x12-850"
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name

  agreement_type     = "X12"
  host_partner_name  = module.our_partner.name
  guest_partner_name = module.contoso_partner.name

  host_identity  = module.our_partner.business_identities["primary"]
  guest_identity = module.contoso_partner.business_identities["primary"]

  content = file("${path.module}/agreements/contoso-x12-850.json")
}

# ❌ Retyped by hand — and the guest partner actually declares "ZZ" / "CONTOSO-PROD".
guest_identity = {
  qualifier = "ZZ"
  value     = "CONTOSO"
}

agreement_type = "AS2"

host_identity  = module.our_partner.business_identities["as2"]
guest_identity = module.contoso_partner.business_identities["as2"]

content = file("${path.module}/agreements/contoso-as2.json")

module "contoso_signing_cert" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-certificate.git?ref=v1.0.0"

  name                     = "contoso-signing"
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name

  # The private key stays in Key Vault; only a reference is stored.
  key_vault_key = {
    key_name      = "contoso-as2-signing"
    key_vault_id  = var.b2b_vault_id
  }
}

// Inside the AS2 content document — a NAME, not key material:
{ "receiveAgreement": { "protocolSettings": { "securitySettings": { "signingCertificateName": "contoso-signing" } } } }

# ✅ A real file, in the repository, that a reviewer can diff.
content = file("${path.module}/agreements/contoso-x12-850.json")

# ✅ Also fine — malformed JSON fails at plan.
content = jsonencode({
  receiveAgreement = { protocolSettings = { /* ... */ } }
  sendAgreement    = { protocolSettings = { /* ... */ } }
})

agreement_type = "AS2"
content        = file("${path.module}/agreements/contoso-x12-850.json") # ❌ an X12 body

Error: creating Agreement: the agreement content does not match the specified agreementType

agreement_type = "EDIFACT" # ❌

Error: Invalid value for variable

  agreement_type must be exactly one of: AS2, X12, Edifact. The check is
  case-sensitive — note that Edifact is mixed-case, so EDIFACT and edifact are both
  rejected.

name           = "eurofoods-edifact-orders"
agreement_type = "Edifact"

host_identity  = module.our_partner.business_identities["edifact"]
guest_identity = var.eurofoods_partner_business_identities["edifact"]

content = file("${path.module}/agreements/eurofoods-edifact.json")

metadata = {
  onboarding_ticket = "B2B-4471"
  business_owner    = "supply-chain-ops"
  effective_date    = "2026-08-01"
  protocol_contact  = "edi-team@example.com"
}

name = "contoso-x12-850-v2" # forces replacement

locals {
  agreements = {
    "contoso-x12-850"   = { type = "X12", guest = module.contoso_partner, identity = "primary" }
    "contoso-as2"       = { type = "AS2", guest = module.contoso_partner, identity = "as2" }
    "eurofoods-edifact" = { type = "Edifact", guest = module.eurofoods_partner, identity = "edifact" }
  }
}

module "agreements" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-agreement.git?ref=v1.0.0"
  for_each = local.agreements

  name                     = each.key
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name

  agreement_type     = each.value.type
  host_partner_name  = module.our_partner.name
  guest_partner_name = each.value.guest.name

  host_identity  = module.our_partner.business_identities[each.value.identity]
  guest_identity = each.value.guest.business_identities[each.value.identity]

  content = file("${path.module}/agreements/${each.key}.json")
}

output "trading_estate" {
  description = "One row per relationship. agreement_type tells you what class of security settings the content carries."
  value = {
    for k, m in module.agreements : k => {
      protocol   = m.agreement_type
      host       = m.host_partner_name
      guest      = m.guest_partner_name
    }
  }
}

module "decode_action" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-action-custom.git?ref=v1.0.0"

  name         = "Decode_X12_message"
  logic_app_id = module.b2b_workflow.id

  body = jsonencode({
    type   = "Xml"
    inputs = { agreementName = module.contoso_x12.name }
  })
}

# Removing the module destroys the agreement. Inbound documents from that
# partner are then rejected as unmatched, immediately.

provider "azurerm" {
  features {}
}

# 1 · The resource group.
module "b2b_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-b2b-eastus2"
  location = "eastus2"
}

# 2 · The integration account. Standard, because the agreement ceiling is 10 on Free
#     and only 1 on Basic — Basic is the smallest of the three tiers here, not the middle.
module "b2b_account" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account.git?ref=v1.0.0"

  name                = "ia-b2b-eastus2"
  resource_group_name = module.b2b_rg.name
  location            = module.b2b_rg.location
  sku_name            = "Standard"
}

# 3 · Our side of every relationship, declaring the identities agreements name.
module "our_partner" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-partner.git?ref=v1.0.0"

  name                     = "our-company"
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name

  business_identity = {
    primary = { qualifier = "ZZ", value = "OURCO" }
    as2     = { qualifier = "AS2Identity", value = "OURCO-AS2" }
  }
}

# 4 · The counterparty.
module "contoso_partner" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-partner.git?ref=v1.0.0"

  name                     = "contoso"
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name

  business_identity = {
    primary = { qualifier = "ZZ", value = "CONTOSO-PROD" }
    as2     = { qualifier = "AS2Identity", value = "CONTOSO-AS2" }
  }
}

# 5 · The AS2 certificates. The private key never leaves Key Vault.
module "contoso_signing_cert" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-certificate.git?ref=v1.0.0"

  name                     = "contoso-signing"
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name

  key_vault_key = {
    key_name     = "contoso-as2-signing"
    key_vault_id = var.b2b_vault_id
  }
}

# 6 · The agreement — this module. Identities WIRED from steps 3 and 4, and the
#     certificate from step 5 referenced BY NAME inside the content document.
module "contoso_as2" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-integration-account-agreement.git?ref=v1.0.0"

  name                     = "contoso-as2"
  resource_group_name      = module.b2b_rg.name
  integration_account_name = module.b2b_account.name

  agreement_type     = "AS2"
  host_partner_name  = module.our_partner.name
  guest_partner_name = module.contoso_partner.name

  host_identity  = module.our_partner.business_identities["as2"]
  guest_identity = module.contoso_partner.business_identities["as2"]

  content = file("${path.module}/agreements/contoso-as2.json")

  metadata = {
    onboarding_ticket = "B2B-4471"
    business_owner    = "supply-chain-ops"
  }

  depends_on = [module.contoso_signing_cert]
}

# 7 · The workflow whose decode/encode actions match documents against it.
module "b2b_workflow" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-logic-app-workflow.git?ref=v1.0.0"

  name                       = "logic-b2b-inbound"
  resource_group_name        = module.b2b_rg.name
  location                   = module.b2b_rg.location
  logic_app_integration_account_id = module.b2b_account.id
}

Required addressing (all force-new): name, resource_group_name, integration_account_name.

The relationship: agreement_type, host_partner_name, guest_partner_name, host_identity, guest_identity, content.

Optional: metadata.

Universal tail: timeouts. This resource type does not support tags.

variable "name"                     { type = string } # force-new; a rename is a matching gap on a live relationship
variable "resource_group_name"      { type = string } # force-new
variable "integration_account_name" { type = string } # force-new; the NAME, not the Resource ID

variable "agreement_type" {
  # AS2 | X12 | Edifact (validated). REQUIRED, not defaulted: the content's required
  # shape depends entirely on this, and a mismatch is rejected at APPLY, not at plan.
  type = string
}

variable "host_partner_name"  { type = string } # must already exist in the same account
variable "guest_partner_name" { type = string } # must already exist in the same account

variable "host_identity" {
  # ⚠️ Must match a business identity actually DECLARED on the host partner. The service
  #    does NOT cross-check, so a mismatch produces an agreement that never matches a
  #    document. Wire from the partner module's business_identities output.
  type = object({
    qualifier = string # e.g. "ZZ" (mutually defined), "01" (DUNS), "AS2Identity"
    value     = string
  })
}

variable "guest_identity" {
  # ⚠️ Same caveat as host_identity.
  type = object({ qualifier = string, value = string })
}

variable "content" {
  # The agreement definition as JSON. Terraform validates NOTHING inside it.
  # 🔒 For AS2 this decides signing, encryption, and algorithms — review it as a
  #    SECURITY ARTIFACT. Certificates are referenced BY NAME; never embed key material.
  # Prefer jsonencode({...}) or file("$${path.module}/agreements/<name>.json").
  type = string
}

variable "metadata" {
  # A map(string) HERE — but a plain string on the certificate, partner, and schema
  # artifacts in this same family.
  type    = map(string)
  default = {}
}

variable "timeouts" {
  type    = object({ create = optional(string), read = optional(string), update = optional(string), delete = optional(string) })
  default = null
}

content is deliberately not emitted. It carries the exchange's security settings, is already readable from state, and re-emitting it would spread a security-relevant artifact across every consumer.

• Two claims in this resource are unverified by anything, and that shapes the whole module. The service does not cross-check host_identity / guest_identity against the partners, and Terraform checks only that content parses as JSON — and through a module boundary that check is the module's own, at variable evaluation, because a provider schema check reaches only a literal written in a resource block — and nothing about its meaning is validated anywhere. Neither is checkable here — the partner is a separate resource whose identities are not inputs, and the content's correctness depends on the protocol, the partners, and the certificate and schema artifacts in the account. So the module wires the identities from the partner module rather than letting them be retyped, and states plainly which claims nothing validates.
• content is a security artifact, not configuration. For AS2 it carries whether messages are signed, whether they are encrypted, and which algorithms are used. An agreement that disables signing is a valid agreement and a weakened channel — which is why the guidance is to keep it in a real file that a reviewer will diff, and why agreement_type is emitted so a review knows which documents deserve that scrutiny.
• No key material enters this module. Certificates are referenced by name inside content and owned by the certificate module, which keeps the private key in Key Vault. That also means a name reference creates no Terraform dependency, so ordering against the certificate needs explicit depends_on.
• agreement_type is required rather than defaulted. There is no safe default: AS2, X12, and Edifact describe genuinely different relationships, and a guessed value produces a content mismatch that fails only at apply.
• A rename is an outage on a live relationship. All three addressing fields are force-new, and replacement means a window in which inbound documents have no agreement to match — they are rejected, not queued.
• The parent is addressed by name, not by Resource ID. This is the pattern across every artifact in this family, and it means the dependency on the account is a string, not a reference — worth remembering when reasoning about apply order.
• metadata is a map(string) here and a plain string on three of its siblings. A genuine inconsistency in the provider's schema for this family, and the most likely thing to trip over when copying a block between artifacts.
• content is not emitted, following this suite's rule that a module does not re-publish a security-relevant artifact a consumer can already reach.
• features {} dependence. The module carries no provider {} block. If it appears not to initialize in isolation, the cause is a missing caller-side provider "azurerm" { features {} }.

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the module with ?ref=v1.0.0 — never a branch.
• This library is plan-only during authoring; a human runs terraform plan / apply from CI against real credentials.
• Before applying: confirm both partners exist and declare the exact business identities this agreement names, and that any certificate or schema the content references is already in the account.
• After apply, send a test document in both directions. A green apply proves the agreement exists, not that it matches anything.

• terraform validate proves the configuration is internally consistent and type-correct against the pinned provider schema. It does not exercise this module's validation {} blocks — there are seventeen of them, and run from inside the module's own directory validate evaluates no variables and therefore fires none. Run it against a calling configuration to fire them, or drive them offline with terraform console (an immediate end-of-input on stdin), which evaluates all of them. jsonencode() in content additionally makes malformed JSON fail while the variables are evaluated.
• terraform fmt -check enforces canonical formatting.
• Neither command calls Azure. Only terraform plan (run by a human, from CI) exercises the ARM API — the module ships without any cloud apply.
• What only apply exercises: whether content matches agreement_type, whether both partner names resolve in the account, and the account SKU's agreement ceiling (10 Free / 1 Basic / 1,000 Standard), which no module in this family can see.
• What nothing exercises: whether the business identities match the partners' declared identities, and whether the content's referenced certificates and schemas exist. The first is not validated by Terraform or the service; both surface as unmatched documents at run time. This is why the composition example wires identities rather than retyping them.

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

id                       = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/rg-b2b-eastus2/providers/Microsoft.Logic/integrationAccounts/ia-b2b-eastus2/agreements/contoso-as2"
name                     = "contoso-as2"
integration_account_name = "ia-b2b-eastus2"
resource_group_name      = "rg-b2b-eastus2"
agreement_type           = "AS2"
host_partner_name        = "our-company"
guest_partner_name       = "contoso"
host_identity            = { "qualifier" = "AS2Identity", "value" = "OURCO-AS2" }
guest_identity           = { "qualifier" = "AS2Identity", "value" = "CONTOSO-AS2" }
content_declares_section_for_agreement_type            = true
basic_tier_permits_fewer_agreements_than_free          = true
delete_fails_if_the_account_is_already_gone            = true
create_collision_check_is_disabled_by_a_caller_feature = true

ℹ️ content_declares_section_for_agreement_type printing false is the one line worth stopping on: it means the declared protocol and the document disagree, which applies cleanly and matches nothing.

• azurerm provider — azurerm_logic_app_integration_account_agreement
• Integration accounts and B2B agreements
• AS2 message settings
• X12 message settings · EDIFACT message settings
• Sibling modules: terraform-azurerm-logic-app-integration-account, -partner, -certificate, -schema, -map, -batch-configuration, -assembly, -session, and terraform-azurerm-logic-app-workflow.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."