[AVM Module Issue]: Private endpoint lock doesn't work, even though it's documented

[alefteris]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

(Optional) Module Version

0.10.0

(Optional) Correlation Id

No response

Description

Even though the README mentions that you should be able to create a management lock on the private endpoints and the AVM interface for Private Endpoints requires it, there is no code in this module that implements it.

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the TF Issue Triage documentation.

[github-actions]

🤖 GitHub Agentic Workflow Automated Triage 🤖

⚠️ This triage was generated automatically by an AI agent and may be incomplete or inaccurate.

• Duplicate check: No exact duplicates found. Related issue: [AVM Module Issue]: management lock incorrect behavior #230 ("[AVM Module Issue]: management lock incorrect behavior") — that issue concerns incorrect destroy-order when a lock is applied to the Key Vault itself. This issue ([AVM Module Issue]: Private endpoint lock doesn't work, even though it's documented #235) is about the lock property accepted by the private_endpoints variable being fully unimplemented (no azurerm_management_lock resource is ever created for private endpoints). Different root causes; left open.

• Labels applied:

  • Needs: Triage :mag: — valid confirmed bug requiring maintainer attention.

• Root cause / suggested fix: The issue is confirmed by inspecting the source code. In variables.tf (around line 302), the private_endpoints variable defines a lock sub-object:

  lock = optional(object({
    kind = string
    name = optional(string, null)
  }), null)

  However, main.private_endpoint.tf contains no azurerm_management_lock resource — the input is accepted but silently ignored. A fix would add a new azurerm_management_lock resource in main.private_endpoint.tf similar to the following:

  resource "azurerm_management_lock" "private_endpoint" {
    for_each = {
      for k, v in var.private_endpoints : k => v
      if v.lock != null
    }
  
    lock_level = each.value.lock.kind
    name       = coalesce(each.value.lock.name, "lock-pe-${var.name}-${each.key}")
    scope      = var.private_endpoints_manage_dns_zone_group ?
      azurerm_private_endpoint.this[each.key].id :
      azurerm_private_endpoint.this_unmanaged_dns_zone_groups[each.key].id
  }

  This is required by the [AVM Private Endpoints interface specification]((azure.github.io/redacted)

• No existing fix found: None of the recent releases (v0.10.0 → v0.10.2) address this. The open PR fix: correct management lock dependency direction to ensure proper destroy order #247 fixes the destroy-order problem for the Key Vault lock (issue [AVM Module Issue]: management lock incorrect behavior #230) but does not add the missing private-endpoint lock resource.

🔎 What this triage looked at

• Read full issue body for [AVM Module Issue]: Private endpoint lock doesn't work, even though it's documented #235
• Searched issues for: private endpoint lock, lock private endpoint management in this repository
• Opened and compared candidate issue [AVM Module Issue]: management lock incorrect behavior #230 — same symptom area (management locks) but different root cause (destroy-order vs missing implementation)
• Searched code for private_endpoint lock and azurerm_management_lock private_endpoint in this repository
• Read main.private_endpoint.tf — confirmed no azurerm_management_lock resource for private endpoints
• Grepped variables.tf to confirm lock is defined in the private_endpoints variable (line ~302)
• Grepped main.tf to confirm only a Key Vault-level azurerm_management_lock.this exists
• Searched for merged PRs with terms private endpoint lock missing implement
• Reviewed releases v0.10.0, v0.10.1, v0.10.2 changelogs — no mention of private endpoint lock fix
• Reviewed open PR fix: correct management lock dependency direction to ensure proper destroy order #247 — addresses issue [AVM Module Issue]: management lock incorrect behavior #230 (destroy-order), not this issue

Generated by Azure Verified Modules Terraform Module Issue Triage · 44.1 AIC · ⌖ 9.95 AIC · ⊞ 10K · ◷