Bicep Module Documentation
← Back to Overview
Module postgresql-server
postgresqlServer
| Property | Value | Description |
|---|---|---|
| general (required) | general | |
| identity | identity | |
| sku (required) | sku | The SKU (pricing tier) of the server. |
| adminUsername | string | Name of the local PostgreSQL administrator. |
| keyVaultId | string | Key Vault ID where to get the admin password. |
| keyVaultSecretName | string | Name of the Key Vault Secret in the Key Vault. |
| entraIDAdministrators | postgresqlAdministrator[] | Entra ID administrators |
| authConfig (required) | authConfig | Authentication configuration of the server. |
| availabilityZone | string | Availability Zone to deploy to server into. |
| backup | backup | Backup properties of the server. |
| serverParameters | object | Server parameters (i.e. PostgreSQL Configurations) to be configured on the server. |
| createMode | 'Create' 'Default' 'GeoRestore' 'PointInTimeRestore' 'Replica' 'ReviveDropped' 'Update' |
The mode to create a new PostgreSQL server. |
| databases | postgresqlDatabase[] | The databases to be created within the server. |
| dataEncryption | dataEncryption | Data encryption properties of the server. |
| firewallRules | postgresqlFirewallRule[] | Firewall rules to be configured for a public accessible server. |
| highAvailability | highAvailability | High availability properties of the server. |
| maintenanceWindow | maintenanceWindow | Maintenance window properties of the server. |
| network | network | Network properties of the server. This Network property is required to be passed only in case you want the server to be a Private Access (i.e. VNet integrated) server. |
| privateLink | privateLink | Settings for the Private Endpoint and Private Link for this resource |
| pointInTimeUTC | string | Restore point creation time (ISO8601 format), specifying the time to restore from. It's required when 'createMode' is 'PointInTimeRestore' or 'GeoRestore' or 'ReviveDropped'. |
| replicationRole | 'AsyncReplica' 'GeoAsyncReplica' 'None' 'Primary' |
Replication role of the server. |
| sourceServerResourceId | string | The source server resource ID to restore from. It's required when 'createMode' is 'PointInTimeRestore' or 'GeoRestore' or 'Replica' or 'ReviveDropped'. This property is returned only for Replica server. |
| storage (required) | storage | Storage properties of the server. |
| version (required) | '11' '12' '13' '14' '15' '16' '17' '18' |
PostgreSQL Server version. |
identity
| Property | Value | Description |
|---|---|---|
| type | 'None' 'UserAssigned' |
The types of identities associated with this resource. (default: none) |
| userAssignedIdentities | string[] | Resource IDs of User Assigned Identities to associate with this resource |
sku
| Property | Value | Description |
|---|---|---|
| name (required) | string | The name of the sku, typically, tier + family + cores, e.g. Standard_D4s_v3. |
| tier (required) | 'Burstable' 'GeneralPurpose' 'MemoryOptimized' |
The tier of the particular SKU, e.g. Burstable. |
authConfig
| Property | Value | Description |
|---|---|---|
| activeDirectoryAuth (required) | 'Disabled' 'Enabled' |
If enabled, use Entra ID for authentication. |
| passwordAuth (required) | 'Disabled' 'Enabled' |
If enabled, use password authentication. |
| tenantId | string | Entra ID tenant ID to use for authentication. Only to be used if 'activeDirectoryAuth' is 'Enabled' |
backup
| Property | Value | Description |
|---|---|---|
| backupRetentionDays (required) | int | Backup retention days for the server. |
| geoRedundantBackup (required) | 'Disabled' 'Enabled' |
A value indicating whether Geo-Redundant backup is enabled on the server. |
dataEncryption
| Property | Value | Description |
|---|---|---|
| geoBackupKeyURI | string | URI for the key in Key Vault for data encryption for geo-backup of the server. |
| geoBackupUserAssignedIdentityId | string | Resource ID for the User Assigned Identity to be used for data encryption for geo-backup of the server. |
| primaryKeyURI | string | URI for the key in Key Vault for data encryption of the primary server. |
| primaryUserAssignedIdentityId | string | Resource ID for the User Assigned Identity to be used for data encryption of the primary server. |
| type (required) | 'AzureKeyVault' 'SystemManaged' |
Data encryption type to depict if it is System Managed vs Azure Key vault. |
highAvailability
| Property | Value | Description |
|---|---|---|
| mode (required) | 'Disabled' 'SameZone' 'ZoneRedundant' |
The HA mode for the server. |
| standbyAvailabilityZone | string | Availability Zone to be used for the standby. |
maintenanceWindow
| Property | Value | Description |
|---|---|---|
| customWindow | string | Indicates whether custom window is enabled or disabled. |
| dayOfWeek | int | Day of week for maintenance window. |
| startHour | int | Start hour for maintenance window. |
| startMinute | int | Start minute for maintenance window. |
network
| Property | Value | Description |
|---|---|---|
| delegatedSubnetResourceId | string | Resource ID of the delegated subnet. The subnet needs a delegation to Microsoft.DBforPostgreSQL/flexibleServers. This is required to be passed during create, in case we want the server to be VNET injected, i.e. Private access server. During update, pass this only if we want to update the value for Private DNS zone. |
| privateDnsZoneArmResourceId | string | Resource ID of the Private DNS Zone. This is required to be passed during create, in case we want the server to be VNET injected, i.e. Private access server. During update, pass this only if we want to update the value for Private DNS zone. |
| publicNetworkAccess | 'Disabled' 'Enabled' |
Public network access is enabled or not |
storage
| Property | Value | Description |
|---|---|---|
| autoGrow (required) | 'Disabled' 'Enabled' |
Flag to enable / disable Storage Auto grow for the server. |
| storageSizeGB (required) | '1024' '128' '16384' '2048' '256' '32' '32768' '4096' '512' '64' '8192' |
Max storage allowed for the server. |
| tier (required) | 'P1' 'P10' 'P15' 'P2' 'P20' 'P3' 'P30' 'P4' 'P40' 'P50' 'P6' 'P60' 'P70' 'P80' |
Name of storage tier for IOPS. |
postgresqlAdministrator
| Property | Value | Description |
|---|---|---|
| displayName (required) | string | Display name of the Entra ID administrator. |
| objectId (required) | string | Object ID of the Entra ID administrator. |
| principalType (required) | 'Group' 'ServicePrincipal' 'Unknown' 'User' |
The principal type used to represent the type of Entra ID Administrator. |
| tenantId (required) | string | The tenant ID of the Entra ID administrator. |
postgresqlDatabase
| Property | Value | Description |
|---|---|---|
| name (required) | string | The name of the database. |
| charset | string | The charset of the database. |
| collation | string | The collation of the database. |
postgresqlFirewallRule
| Property | Value | Description |
|---|---|---|
| name (required) | string | |
| startIpAddress (required) | string | |
| endIpAddress (required) | string |
naming
| Property | Value | Description |
|---|---|---|
| forceFunctionAsFullName | bool | Use the function value as the full name of the resource |
| abbreviation | string | Override the abbreviation of this resource with this parameter |
| environment | string | The resource environment (for example: dev, tst, acc, prd) |
| location | string | The resource location (for example: weu, we, westeurope) |
| customer | string | The name of the customer |
| delimiter | string | The delimiter between resources (default: -) |
| nameFormat | Array containing any of: 'abbreviation' 'customer' 'environment' 'function' 'location' 'param1' 'param2' 'param3' 'useCaseName' |
The order of the array defines the order of elements in the naming scheme |
| param1 | string | Extra parameter self defined |
| param2 | string | Extra parameter self defined |
| param3 | string | Extra parameter self defined |
| function (required) | string | Function of the resource [can be app, db, security,...] |
| useCaseName | string | Name of the use case [can be hub, spoke,...] |
| suffix | string | Suffix for the resource, if empty non will be appended, otherwise will be added to the end [can be index, ...] |
| forceDefaultNaming | bool | Force the CAF naming instead of default company naming |
resourceLock
| Property | Value | Description |
|---|---|---|
| name | string | Character limit: 1-90. Valid characters: Alphanumerics, periods, underscores, hyphens, and parenthesis. Can't end in period. |
| level (required) | 'CanNotDelete' 'ReadOnly' |
The level of the lock. Possible values are: CanNotDelete and ReadOnly. CanNotDelete means authorized users are able to read and modify the resources, but not delete. ReadOnly means authorized users can only read from a resource, but they can't modify or delete it. Read-Only locks must be commented to be able to deploy again |
| notes | string | Notes about the lock. Maximum of 512 characters. |
| owners | resourceLockOwner[] | The owners of the lock |
resourceLockOwner
| Property | Value | Description |
|---|---|---|
| applicationId (required) | string | The application ID of the lock owner. |
roleAssignment
| Property | Value | Description |
|---|---|---|
| principalId (required) | string | The principal ID |
| roleDefinitionId (required) | string | The role definition ID, data file can be used for this |
| condition | string | Condition on the role assignment |
| conditionVersion | string | Version of the condition. Currently the only accepted value is "2.0" |
| delegatedManagedIdentityResourceId | string | Id of the delegated managed identity resource |
| description | string | Description of role assignment |
general
| Property | Value | Description |
|---|---|---|
| tags | object | Tags of the resource [hashtable] |
| location (required) | string | Location of the resource |
| naming (required) | naming | Naming module of the resource |
| resourceGroupName (required) | string | Name of the resource group where the resource should be located |
| sharedNaming (required) | naming | Reference to the default naming |
| roleAssignments | roleAssignment[] | Role assignments on the resource |
| resourceLocks | resourceLock[] | Resource Locks on the resource |
privateLink
| Property | Value | Description |
|---|---|---|
| pepNaming | naming | Name of the private endpoint |
| nicNaming | naming | Name of the network interface of the private endpoint |
| privateLinkNaming | naming | Name of the private link connection |
| subnets (required) | subnets[] | Id of the subnets and optionally the name of the resourcegroup in which the private endpoint should be created |
| dnsZoneIds (required) | string[] | List of DNS zone ids that need to be linked |
subnets
| Property | Value | Description |
|---|---|---|
| resourceGroupName | string | Resourcegroup (default: resourcegroup defined here => resourceGroup of pep resource => resourceGroup of subnet) |
| id (required) | string | Id of the subnet |
| location | string | Location if Vnet is in different location |
Changelog
3.4.0 (2025-11-14)
Features
- add server version 17 and 18, add hiddenTitle
3.3.0 (2025-10-06)
Features
- update resource api versions
3.2.1 (2025-09-24)
Bug Fixes
- remove deployment name + cleanup
3.2.0 (2025-04-29)
Features
- add endpoint output
3.1.1 (2025-04-11)
Bug Fixes
- naming connected resources when forceFunctionAsFullName or forceDefaultNaming is true
3.1.0 (2025-03-26)
Features
- add resourceName output
3.0.0 (2025-03-17)
⚠ BREAKING CHANGES
- remove role-assignment principalType parameter
Features
- remove role-assignment principalType parameter
2.0.1 (2025-02-25)
Bug Fixes
- limit deployment name length to 64 chars
2.0.0 (2025-01-03)
⚠ BREAKING CHANGES
- use new toObject function for UserAssignedIdentities. Only breaking when using managed identities
Features
- use new toObject function for UserAssignedIdentities. Only breaking when using managed identities