☁️ Azure Video Indexer Account Terraform Module

Manages an Azure AI Video Indexer account, whose most important prerequisite — a blob data role on its storage account — the provider neither creates nor checks (azurerm_video_indexer_account). Targets hashicorp/azurerm ~> 4.0.

• 🎬 An ARM-based Azure AI Video Indexer account — the resource that indexes media and produces insights from it. Classic accounts retired on 30 June 2024 and nothing here can produce one.
• 🔴 Its identity needs a blob data role on the storage account, and this module does not create it. Neither does the provider check it — and the apply succeeds without it. The account is created, and indexing fails later.
• 🔴 Which is why Azure asks for Owner, or Contributor plus User Access Administrator: a caller with only Contributor cannot write that role assignment, so they will create an account that cannot index anything.
• 🔴 Both identity and storage are required blocks, so there is no empty call to harden — the module defaults the identity to SystemAssigned, which needs nothing from the caller and involves no credential.
• 🔒 public_network_access defaults to Disabled here, diverging from the provider's Enabled, and is taken as a positively-stated boolean so there is no double negative to misread.
• ⚠️ The storage account must be Standard general-purpose v2 — Azure documents it, the provider does not, and it is not visible from a Resource ID.
• ⚠️ storage.user_assigned_identity_id should be one of identity.identity_ids, which spans two variables and so cannot be validated. The module emits storage_access_identity_is_assigned_to_account instead of pretending to check.

💡 Why it matters: Everything hard about this resource is outside it. The schema has eight fields and none of them records the role assignment that makes the account work, the storage account kind that Azure requires, or the firewall exception a locked-down storage account needs. A plan that looks perfect can produce an account that indexes nothing.

If this module saves you time, please consider supporting its continued development:

• ⭐ Star the repository on GitHub.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart TB
  rg["terraform-azurerm-resource-group"]
  sa["terraform-azurerm-storage-account. Must be Standard general-purpose v2. And if its own public access is closed, it must allow TRUSTED AZURE SERVICES through the firewall - two correct secure defaults that break each other."]
  uai["terraform-azurerm-user-assigned-identity, optional. The default is a system-assigned identity, which needs nothing from the caller."]
  vi["terraform-azurerm-video-indexer-account"]
  ra["terraform-azurerm-role-assignments: the BLOB DATA ROLE on the storage account. NOT created here, NOT checked by the provider - and its absence does not fail the apply. The account is created and INDEXING FAILS LATER."]
  pe["terraform-azurerm-private-endpoint. Needed because this module closes public network access by default."]
  diag["terraform-azurerm-monitor-diagnostic-setting"]

  rg -->|"resource_group_name and location"| vi
  sa -->|"storage.storage_account_id, force-new"| vi
  uai -->|"identity.identity_ids, when not system-assigned"| vi
  vi -->|"principal_id and storage_account_id feed the assignment"| ra
  ra -->|"grants blob data access, or indexing silently fails"| sa
  vi -->|"id"| pe
  vi -->|"id"| diag

  classDef mine fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class vi mine;
  class ra keystone;
  class rg,sa,uai,pe,diag sib;

flowchart TB
  name["name: 3-50 characters of letters, digits and hyphens. An ARM constraint the provider does not publish, so it is enforced here rather than left to fail at apply. Force-new."]
  ident["identity is a REQUIRED block, so there is no absent-identity case to harden. Defaults to SystemAssigned - no credential, no caller-managed lifecycle. Both halves of the identity_ids pairing are checked on this one variable, because a validation may only reference its own variable."]
  space["And the combined value is SystemAssigned, UserAssigned - WITH A SPACE. The ARM API spells it without one, so the error message names that near-miss explicitly."]
  stor["storage is also REQUIRED. storage_account_id is force-new, must be a Standard general-purpose v2 account, and neither its kind nor its tier is visible from a Resource ID."]
  pna["public_network_access defaults to Enabled in the provider and to DISABLED here. Taken as a positively-stated boolean so there is no double negative to misread."]
  this["azurerm_video_indexer_account.this"]
  cross["storage_access_identity_is_assigned_to_account: the check Terraform cannot make, because it spans two variables. Emitted as a derived flag instead of pretended. Assert true."]
  role["requires_blob_data_role_assignment_on_storage: always true, and the module's most important output. The identity needs a blob data role on the storage account. Nothing here creates or checks it, the apply SUCCEEDS without it, and indexing fails later."]
  outputs["id, principal_id, storage_account_id, identity_type, has_system_assigned_identity, storage_access_identity_id, public_network_access_enabled, storage_must_be_standard_general_purpose_v2"]

  name -->|"validated"| this
  ident -->|"required block"| this
  ident -->|"near-miss"| space
  space -->|"rejected by name"| this
  stor -->|"required block, force-new"| this
  pna -->|"secure divergence"| this
  this -->|"exports"| outputs
  this -->|"cannot validate, so emits"| cross
  this -->|"prerequisite you must act on"| role
  role -->|"grant it to"| outputs

  classDef mine fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class this mine;
  class pna mine;
  class role,cross keystone;
  class name,ident,space,stor,outputs sib;

Resource inventory

Schema notes that bite — confirmed against the live provider schema and its documentation:

• 🔴 The blob data role assignment is required, uncreated and unchecked — and its absence does not fail the apply.
• 🔴 identity and storage are both required blocks.
• 🔴 Force-new: name, resource_group_name, location, storage.storage_account_id.
• ⚠️ identity.type's combined value is "SystemAssigned, UserAssigned" — with a space. The ARM API spells it without one.
• ⚠️ None is a valid ARM identity type but not a provider one. This resource always carries an identity.
• ⚠️ public_network_access defaults to Enabled in the provider; this module defaults it closed.
• ⚠️ The storage account must be Standard general-purpose v2, documented by Azure and not by the provider.
• ⚠️ ARM constrains name to 3–50 characters of [A-Za-z0-9-], which the provider does not document.
• ⚠️ principal_id is empty when identity.type is UserAssigned alone — see example 5.
• ℹ️ The Azure OpenAI connection the ARM API offers is not exposed by the provider, so it cannot be managed here.
• lifecycle is not valid inside a module block, so a caller cannot add prevent_destroy (example 12).

🔴 This is why Azure's guidance asks for subscription-level Owner, or Contributor plus User Access Administrator — not because the account is privileged, but because creating a working one means writing a role assignment, and Contributor cannot (example 3).

✅ Video Indexer Restricted Viewer is the role most people actually want: view videos and their insights, with no ability to change the environment or manage users (example 10).

• 🔴 A blob data role assignment for the account's identity on the storage account — Storage Blob Data Owner (what the portal assigns) or Storage Blob Data Contributor (what Microsoft's deployment samples assign). Its absence does not fail the apply (example 3).
• 🔴 A Standard general-purpose v2 (StorageV2) storage account (example 4).
• A region where Video Indexer is available.
• ⚠️ A trusted-services firewall exception on the storage account, if that account's own public access is closed — which this suite's storage module defaults to (example 8).
• A private endpoint, if public_network_access_enabled is left at its default false (example 7).

terraform-azurerm-video-indexer-account/
├── providers.tf   # required_version + the pinned azurerm provider. No provider block.
├── variables.tf   # name, resource_group_name, location, identity, storage,
#                  # public_network_access_enabled, tags, timeouts
├── main.tf        # the keystone `this` + its two required nested blocks
├── outputs.tf     # id first, then identity and storage facts, then the prerequisite flags
├── README.md      # this document
├── SCOPE.md       # the cross-module contract
├── LICENSE        # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "video_indexer" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-video-indexer-account.git?ref=v1.0.0"

  name                = "vi-media-insights"
  resource_group_name = module.rg.name
  location            = module.rg.location

  # ⚠️ Required by the provider. Must be Standard general-purpose v2 (example 4).
  storage = {
    storage_account_id = module.vi_storage.id
  }

  # identity defaults to SystemAssigned — nothing needed here (example 5).
  # public_network_access_enabled defaults to false (example 7).

  tags = { owner = "media-platform" }
}

🔴 This is not finished. The account's identity still needs a blob data role on that storage account, and nothing above creates it. See example 3 — without it the apply succeeds and indexing fails later.

ℹ️ The caller configures the provider, its authentication, and the mandatory features {} block. This module declares none of them.

Consumes

Emits

The examples below reference existing resources by ID or name rather than creating them; this module owns only its own resource. Those references are declared inputs:

variable "other_storage_id" {
  description = "id of an existing other storage that these examples reference but do not create."
  type        = string
}

variable "vi_identity_id" {
  description = "id of an existing vi identity that these examples reference but do not create."
  type        = string
}

variable "vi_identity_principal_id" {
  description = "principal id of an existing vi identity that these examples reference but do not create."
  type        = string
}

module "video_indexer" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-video-indexer-account.git?ref=v1.0.0"

  name                = "vi-media-insights"
  resource_group_name = module.rg.name
  location            = module.rg.location

  storage = {
    storage_account_id = module.vi_storage.id
  }
}

# 🔴 Force-new:
name                = "vi-media-insights-v2"
resource_group_name = "rg-other"
location            = "westus2"
storage             = { storage_account_id = var.other_storage_id }

# ✅ Updates in place:
identity                      = { type = "SystemAssigned, UserAssigned", identity_ids = [var.vi_identity_id] }
public_network_access_enabled = true
storage                       = { storage_account_id = module.vi_storage.id, user_assigned_identity_id = var.vi_identity_id }
tags                          = { owner = "media-platform" }

# This module creates the account:
module "video_indexer" { /* … */ }

# 🔴 And this is the part everybody forgets. Without it, the account cannot read or write its
#    own storage — and NOTHING in the apply above says so.
module "vi_storage_role" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.video_indexer.storage_account_id # the storage account
  role_assignments = {
    vi_blob = {
      role_definition_name = "Storage Blob Data Contributor"
      principal_id         = module.video_indexer.principal_id # the account's identity
    }
  }
}

output "reminder" {
  value = module.video_indexer.requires_blob_data_role_assignment_on_storage # always true
}

storage = {
  storage_account_id = module.vi_storage.id # must be Standard StorageV2
}

output "check_your_storage" {
  value = module.video_indexer.storage_must_be_standard_general_purpose_v2 # always true
}

Error: Invalid value for variable

  storage.storage_account_id must be a full storage account Resource ID ending in
  /providers/Microsoft.Storage/storageAccounts/<name> — anchored, so a container or
  blob-service child ID is rejected too. ⚠️ It must also be a Standard general-purpose v2
  account, which this module cannot verify from an ID.

identity = { type = "SystemAssigned" }                                            # ✅ the default
identity = { type = "UserAssigned", identity_ids = [var.vi_identity_id] }      # ⚠️ principal_id is EMPTY
identity = { type = "SystemAssigned, UserAssigned", identity_ids = [var.vi_identity_id] } # both

principal_id = module.video_indexer.has_system_assigned_identity ? module.video_indexer.principal_id : var.vi_identity_principal_id

identity = { type = "SystemAssigned, UserAssigned", identity_ids = [var.vi_identity_id] } # ✅
identity = { type = "SystemAssigned,UserAssigned",  identity_ids = [var.vi_identity_id] } # ⚠️ rejected

Error: Invalid value for variable

  identity.type must be exactly one of: "SystemAssigned", "UserAssigned",
  "SystemAssigned, UserAssigned". ⚠️ The combined value needs a SPACE after the comma —
  "SystemAssigned,UserAssigned" is the ARM API's spelling and is rejected here. Also note
  "None" is an ARM value but not a provider one: this resource always carries an identity.

identity.identity_ids must contain at least one … when identity.type is "UserAssigned" …
identity.identity_ids must be empty when identity.type is "SystemAssigned", which is the
likelier mistake than the reverse: supplying IDs alongside "SystemAssigned" silently means
nothing. ✅ Use "SystemAssigned, UserAssigned" (with the space) if you want both.

# ✅ The default — the provider's own default is "Enabled":
# public_network_access_enabled = false

# ⚠️ Public reachability, typed deliberately:
public_network_access_enabled = true

output "exposed" {
  value = module.video_indexer.public_network_access_enabled # false is the good answer
}

This module:                public_network_access_enabled = false   ✅
The storage-account module:  public_network_access_enabled = false   ✅
Together:                    Video Indexer cannot reach its storage  ⚠️

identity = {
  type         = "UserAssigned"
  identity_ids = [var.vi_identity_id]
}

storage = {
  storage_account_id        = module.vi_storage.id
  user_assigned_identity_id = var.vi_identity_id # ✅ must be one of identity_ids above
}

output "wired_correctly" {
  value = module.video_indexer.storage_access_identity_is_assigned_to_account # assert true
}

output "vi_review" {
  value = {
    id       = module.video_indexer.id
    exposed  = module.video_indexer.public_network_access_enabled # ✅ expect false
    identity = module.video_indexer.identity_type
    sys_mi   = module.video_indexer.has_system_assigned_identity
    storage  = module.video_indexer.storage_account_id
    accessor = module.video_indexer.storage_access_identity_id
    wired    = module.video_indexer.storage_access_identity_is_assigned_to_account # ✅ expect true
    # 🔴 Prompts, not values:
    needs_role = module.video_indexer.requires_blob_data_role_assignment_on_storage
    needs_gpv2 = module.video_indexer.storage_must_be_standard_general_purpose_v2
  }
}

name = "vi-media-insights"  # ✅ letters, digits, hyphens; 3–50 characters
name = "vi_media_insights"  # ⚠️ rejected — underscores are not allowed
name = "vi"                 # ⚠️ rejected — under 3 characters

Error: Invalid value for variable

  name must be 3-50 characters of letters, digits and hyphens only — Azure Resource Manager
  rejects underscores, periods and other punctuation for this resource type. The provider
  does not publish this constraint, so an invalid name fails at apply rather than at plan.

terraform destroy on this module:
  removes the ACCOUNT      ->  and the account's indexed insights
  the storage account survives, with its blobs
  the role assignment survives, now pointing at a deleted principal
  a user-assigned identity survives

terraform import 'module.video_indexer.azurerm_video_indexer_account.this' \
  "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-media/providers/Microsoft.VideoIndexer/accounts/vi-media-insights"

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-media-platform"
  location = "eastus"
}

# ── Storage: Standard general-purpose v2 (example 4) ─────────────────────────
# ⚠️ If this account closes its own public access — which that module defaults to —
#    it must also allow TRUSTED AZURE SERVICES through its firewall, or Video
#    Indexer cannot reach it (example 8).
module "vi_storage" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-storage-account.git?ref=v1.0.0"

  name                = "stvimediainsights"
  resource_group_name = module.rg.name
  location            = module.rg.location
}

# ── The account itself ──────────────────────────────────────────────────────
module "video_indexer" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-video-indexer-account.git?ref=v1.0.0"

  # ⚠️ 3–50 chars of letters, digits and hyphens (example 11). Force-new.
  name                = "vi-media-insights"
  resource_group_name = module.rg.name
  location            = module.rg.location

  # ✅ Credential-free, and the module's default — stated here for the reader (example 5).
  identity = {
    type = "SystemAssigned"
  }

  # 🔴 Force-new, and must be Standard general-purpose v2 (example 4).
  storage = {
    storage_account_id = module.vi_storage.id
    # user_assigned_identity_id omitted -> the system-assigned identity reaches
    # storage, which is why identity.type must include SystemAssigned (example 9).
  }

  # 🔒 The default, restated so the posture is visible in the composition (example 7).
  # Reaching a closed account needs a private endpoint.
  public_network_access_enabled = false

  tags = {
    owner      = "media-platform"
    data_class = "media-with-faces-and-speech"
  }
}

# ── 🔴 The prerequisite the account cannot create for itself (example 3) ─────
# Without this the applies above all succeed and INDEXING FAILS LATER.
module "vi_storage_role" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-role-assignments.git?ref=v1.0.0"

  scope = module.video_indexer.storage_account_id
  role_assignments = {
    vi_blob = {
      role_definition_name = "Storage Blob Data Contributor"
      principal_id         = module.video_indexer.principal_id
    }
  }
}

# ── A private endpoint, because the account is closed (example 7) ────────────
#   module "vi_endpoint" {
#     source = ".../terraform-azurerm-private-endpoint..."
#     ...    = module.video_indexer.id
#   }

output "vi_posture" {
  value = {
    id      = module.video_indexer.id
    exposed = module.video_indexer.public_network_access_enabled                  # ✅ false
    wired   = module.video_indexer.storage_access_identity_is_assigned_to_account # ✅ true
    storage = module.video_indexer.storage_account_id
  }
}

variable "identity" {
  type = object({
    type         = optional(string, "SystemAssigned")
    identity_ids = optional(list(string), [])
  })
  default = {}
  # Required by the provider, so it always renders — defaulted to the credential-free option. Both halves of the
  # identity_ids pairing are checked here, because a validation may only reference its own variable. See examples 5–6.
  # ✅ type: "SystemAssigned" | "UserAssigned" | "SystemAssigned, UserAssigned"  (note the SPACE)
  # ⚠️ identity_ids: required for UserAssigned, rejected for SystemAssigned, each entry an anchored
  #    /providers/Microsoft.ManagedIdentity/userAssignedIdentities/<name> ID.
}

variable "storage" {
  type = object({
    storage_account_id        = string
    user_assigned_identity_id = optional(string)
  })
  # Required by the provider. storage_account_id is FORCE-NEW and must be a Standard general-purpose v2 account —
  # documented by Azure, not by the provider, and invisible from an ID. See example 4.
  # ℹ️ user_assigned_identity_id omitted -> access falls to the system-assigned identity; supplied -> it should be one
  #    of identity.identity_ids, which spans two variables and so is emitted as a flag. See example 9.
}

variable "public_network_access_enabled" {
  type    = bool
  default = false
  # 🔒 Diverges from the provider's "Enabled" default. Taken as a positive boolean and rendered to the provider's
  # string enum, so there is no double negative to misread. Not force-new. See example 7.
}

ℹ️ Nothing here is secret. principal_id is an object ID, which is an identifier rather than a credential — the account holds no key or connection string this module could emit.

• The module's centre of gravity is a prerequisite outside its own resource. Video Indexer reaches storage through a managed identity, that identity needs a blob data role on the storage account, and the provider neither creates the assignment nor checks it. Crucially, the apply succeeds without it — so the failure appears at the first upload, disconnected from the change that caused it. That is why the fact is a constant output rather than a comment: it is consequential, invisible in state, and inferable from nothing else in the plan.

• The RBAC consequence is stated where it will be read. Contributor cannot write role assignments, so a caller granted only Contributor produces an account that cannot index — which is the real reason Azure's guidance asks for Owner, or Contributor plus User Access Administrator. Naming the reason beats copying the requirement.

• Both nested blocks are required, so this suite's secure-by-default rule has nothing to harden in the empty call. The module says so rather than inventing safety: storage has no default because the account cannot exist without storage, and identity defaults to SystemAssigned because when the choice is which identity rather than whether, the credential-free one is the safe answer.

• public_network_access is the one field where a secure default is available, and the divergence is deliberate. The provider defaults it to Enabled; the module defaults it closed and takes it as a positively-stated boolean, rendering the provider's string enum internally. Double negatives are where security reviews go wrong.

• The storage ↔ identity pairing is emitted rather than enforced, because Terraform cannot enforce it. A validation {} condition may only reference its own variable, so cross-variable checks must be placed rather than gathered — and where they cannot be placed at all, this suite's rule is a derived flag that leaves the judgement with the reader. storage_access_identity_is_assigned_to_account handles both the supplied and the omitted case, comparing case-insensitively because Azure Resource IDs are.

• The identity_ids pairing can be placed, so it is — in both directions. The reverse direction matters more than it looks: IDs supplied alongside SystemAssigned are silently ignored by Azure, which is exactly the kind of no-signal mistake worth catching at plan time.

• The "SystemAssigned, UserAssigned" space is named in the error message. The ARM API omits it, so the near-miss is what somebody reading ARM documentation will type. Per this suite's validation philosophy, naming the probable mistake beats listing legal values and leaving the reader to spot a space.

• The ARM name constraint is enforced although the provider does not publish it. The rule here is to enforce what the platform documents — and the ARM template reference publishes the 3–50 character [A-Za-z0-9-] pattern, so this is enforcing a documented constraint rather than inventing one.

• principal_id being empty for UserAssigned alone is called out repeatedly, because a composition that grants a role to it unconditionally grants nothing — a silent failure with the same symptom as the missing assignment itself. has_system_assigned_identity exists to make that branch easy to write.

• The trusted-services interaction is documented rather than worked around. Two independently correct secure defaults — this module closing the account, the storage module closing the storage account — break the path between them, and the fix belongs on a resource this module only references by ID.

• Privacy, not secrecy, is the residual risk. Video Indexer processes faces and speech, so retention and lawful basis are the questions that matter most about this account and none of them is answerable in a module. They are flagged for whoever owns data protection.

• Before the first upload: create the blob data role assignment. Nothing else will tell you.
• Before granting plan rights: Contributor alone cannot finish this job.
• Before choosing storage: Standard general-purpose v2, dedicated, and force-new.
• Before locking down storage: allow trusted Azure services, or Video Indexer cannot reach it.
• Before indexing real media: settle retention and lawful basis with whoever owns data protection.

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the source to a tag — ?ref=v1.0.0 — never a branch.
• Plan-only from here. A human applies from CI.
• 🔴 Create the blob data role assignment, or the account will not index (example 3).
• 🔴 Force-new: name, resource_group_name, location, storage.storage_account_id.
• ✅ In place: the identity block, public_network_access_enabled, the storage access identity, tags.
• ⚠️ Assert storage_access_identity_is_assigned_to_account is true (example 9).
• ⚠️ Assert public_network_access_enabled is false unless exposure is deliberate.
• ⚠️ Importing? Restate storage_account_id and check the network default first (example 12).
• 💡 A CanNotDelete lock guards deletion, not replacement.

terraform validate and terraform fmt -check are the offline gate. They confirm:

• name is 3–50 characters of letters, digits and hyphens — an ARM constraint the provider does not publish;
• resource_group_name and location are non-empty;
• identity.type is exactly one of the three provider values, space included;
• identity.identity_ids is non-empty for UserAssigned and empty for SystemAssigned;
• every entry in identity.identity_ids is an anchored user-assigned identity Resource ID;
• storage.storage_account_id is an anchored storage account ID — a container or blob-service child ID is rejected;
• storage.user_assigned_identity_id, when supplied, is an anchored user-assigned identity ID;
• the module declares no provider block.

💡 These were proved by evaluating the conditions in terraform console inside the module — which does fire root-module variable validations, unlike terraform validate on a calling configuration. "SystemAssigned,UserAssigned" fires the space check, "UserAssigned" with no IDs fires the required-IDs check, "SystemAssigned" with IDs fires the reverse check, a container ID fires the storage anchor, and "vi_media" fires the name pattern.

⚠️ And note a property of the harness: Terraform skips a validation whose referenced variable has already failed, so a short error list is not proof that a check is missing. Fix the first fault and re-run before concluding anything.

What only plan and apply exercise:

• whether the storage account exists and is a Standard general-purpose v2 account;
• whether the region offers Video Indexer;
• whether the caller may create the account and associate that storage.

What no Terraform command checks at any stage:

• 🔴 whether the blob data role assignment exists — and the apply succeeds without it;
• ⚠️ whether the storage account allows trusted Azure services through its firewall;
• ⚠️ whether a private endpoint exists for a closed account;
• whether the media being indexed may lawfully be held, and for how long.

Outputs:

has_system_assigned_identity                   = true
id                                             = "/subscriptions/00000000-.../providers/Microsoft.VideoIndexer/accounts/vi-media-insights"
identity_ids                                   = []
identity_type                                  = "SystemAssigned"
location                                       = "eastus"
name                                           = "vi-media-insights"
principal_id                                   = "11111111-2222-3333-4444-555555555555"
public_network_access_enabled                  = false
requires_blob_data_role_assignment_on_storage   = true
resource_group_name                            = "rg-media-platform"
storage_access_identity_id                     = null
storage_access_identity_is_assigned_to_account  = true
storage_account_id                             = "/subscriptions/00000000-.../providers/Microsoft.Storage/storageAccounts/stvimediainsights"
storage_must_be_standard_general_purpose_v2     = true
tenant_id                                      = "99999999-8888-7777-6666-555555555555"

✅ public_network_access_enabled = false — the module's default, and the divergence from the provider (example 7).

✅ storage_access_identity_is_assigned_to_account = true with storage_access_identity_id = null: access falls to the system-assigned identity, and identity_type includes SystemAssigned, so the pairing holds (example 9).

🔑 principal_id is the grantee for the blob data role on storage_account_id (example 3). On a UserAssigned-only account it would be empty (example 5).

🔴 requires_blob_data_role_assignment_on_storage = true is a reminder, not a status. It does not mean the assignment exists.

• azurerm_video_indexer_account — provider documentation, including the identity type values of example 6.
• Create an Azure AI Video Indexer account — the permissions and storage requirements of examples 3 and 4.
• Set up Video Indexer with firewall-protected storage — the trusted-services exception of example 8.
• Microsoft.VideoIndexer/accounts template reference — the ARM name constraint of example 11.
• Video Indexer account types — ARM versus the classic accounts retired on 30 June 2024.
• Private endpoints with Video Indexer — reaching a closed account (example 7).
• Sibling modules: terraform-azurerm-resource-group, terraform-azurerm-storage-account, terraform-azurerm-role-assignments, terraform-azurerm-user-assigned-identity, terraform-azurerm-private-endpoint, terraform-azurerm-monitor-diagnostic-setting.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."