Configuration Reference

The module and compatibility script read the explicit YAML shape in config.yaml and schema-check required fields before any Azure write operation. The editor-facing JSON schema lives in schemas/config.schema.json.

resourceGroup

Field	Notes
resourceGroup.name	VM resource group name. Also used as the base for generated resource names.
resourceGroup.location	Azure region.
resourceGroup.tags	Tags applied to created resource groups.

network

Field	Notes
network.vnet.addressPrefix	VNet IPv4 CIDR. Invalid octets or prefix lengths are rejected.
network.subnet.addressPrefix	VM subnet IPv4 CIDR. Invalid octets or prefix lengths are rejected.
network.publicIp.enabled	Required boolean. The sample uses false; keep disabled for Bastion-first access.
network.publicIp.allocationMethod	Required. Static or Dynamic; used only when VM public IP is enabled.
network.publicIp.idleTimeoutInMinutes	Required integer from 4 to 30. Used only when VM public IP is enabled.

securityRules

Use an empty list by default:

securityRules: []

The script rejects broad inbound RDP or SQL rules from *, 0.0.0.0/0, ::/0, or Internet.

When rules are provided, each rule must include name, protocol, direction, priority, sourceAddressPrefix, sourcePortRange, destinationAddressPrefix, destinationPortRange, and access.

keyVault

Field	Notes
keyVault.name	Globally unique Key Vault name. New vaults are RBAC-enabled.
keyVault.storageKeySecretName	Secret name for the storage account key.
keyVault.vmAdminPasswordSecretName	Secret name for the VM admin password.
keyVault.passwordLength	Lab password length when -GeneratePassword is used. Must be 12 to 128.

credentials

Field	Notes
credentials.username	Local VM administrator username.

Do not put passwords in YAML.

vm

Field	Notes
vm.size	Azure VM size.
vm.image.publisherName	Marketplace image publisher.
vm.image.offer	Marketplace image offer.
vm.image.skus	Marketplace image SKU.
vm.image.version	Marketplace image version, usually latest for labs.

bastion

Field	Notes
bastion.subnetAddressPrefix	IPv4 CIDR for AzureBastionSubnet.
bastion.sku	Bastion SKU. Allowed values are Basic, Standard, and Premium. The sample uses Basic.
bastion.publicIp.*	Required public IP settings for the Bastion host, not for the SQL VM. The script expects a Standard SKU and Static allocation.

storage

Field	Notes
storage.resourceGroup	Separate resource group for storage and Key Vault.
storage.accountName	Globally unique lowercase storage account name.
storage.skuName	Storage SKU.
storage.fileShareName	Azure Files share name.
storage.driveLetter	Single uppercase drive letter inside the VM.
storage.backupPath	Path under the mounted share searched by restore-databases.ps1. Drive-qualified paths, UNC paths, traversal, and shell metacharacters are rejected.

softwareInstalls

Field	Notes
softwareInstalls.allowDynamicBootstrap	Allows deployment-time package-manager bootstrap downloads. Use false with a prepared VM image or internal source for stronger environments.
softwareInstalls.chocolatey.bootstrapUrl	Optional Chocolatey bootstrap source when dynamic bootstrap is allowed.
softwareInstalls.chocolatey.bootstrapSha256	Optional SHA-256 digest for the Chocolatey bootstrap script.
softwareInstalls.packages[].manager	Package manager. Allowed values are Chocolatey and PowerShellGallery.
softwareInstalls.packages[].name	Package name.
softwareInstalls.packages[].version	Required pinned package version.
softwareInstalls.packages[].sha256	Optional SHA-256 value for Chocolatey packages only. The generated command passes it to choco install as a SHA-256 checksum.
softwareInstalls.packages[].sourceUri	Optional package source/reference URI for review. It is not used as the install source.
softwareInstalls.installScript	Additional trusted PowerShell executed inside the VM after structured package installs.
softwareInstalls.logonScript	Optional trusted PowerShell registered for the configured user at logon.

Review this block carefully. Dynamic bootstrap and package installation run inside the VM.