APIM module major: contract simplification

[krusty93]

Summary

Collects APIM module breaking changes behind a major version plan instead of relying on Terraform's unsupported deprecated variable attribute for the current binary constraint.

This PR simplifies the module contract so common APIM infrastructure is owned by the module and driven by use_case.

Breaking changes

• Removes subnet_id; the module always creates the APIM subnet using dx_available_subnet_cidr with a /24 prefix.
• Removes subnet_pep_id; the private endpoint subnet ID is computed from the VNet and standard pep subnet naming.
• Removes virtual_network_type_internal; APIM virtual network type is selected by use_case.
• Removes enable_public_network_access; public network access is selected by use_case and SKU behavior.
• Removes public_ip_address_id; the module creates a Standard static public IP when required by the selected use case.
• Removes private_dns_zone_ids; private DNS zones are looked up by name in private_dns_zone_resource_group_name or the VNet resource group, in the current subscription.
• Removes notification_sender_email; publisher_email is used for notifications.
• Removes lock_enable; lock behavior is selected by use_case.
• Removes key_vault_id and certificate_names; hostname certificates are configured directly with Key Vault certificate IDs and the module strips versions internally.
• Replaces monitoring with log_analytics_workspace_id; logs and metrics are enabled by default for production use cases.
• Removes management_logger_application_insight_enabled; Application Insights logger is enabled when application_insights.id is set.
• Removes application_insights.enabled and application_insights.connection_string; the module resolves the connection string from the Application Insights resource ID.
• Simplifies hostname_configuration.proxy; users can only choose whether the resource-name proxy host is the default SSL binding via use_resource_name_as_default.

Tests

• Replaces the legacy combined tests/apim.tftest.hcl with dedicated unit.tftest.hcl, contract.tftest.hcl, and integration.tftest.hcl layers.
• Unit and contract tests use mocked azurerm and dx providers.
• Integration tests use real providers plus tests/setup shared infrastructure and random instance numbers for isolation.

Validation

• terraform fmt -recursive
• terraform validate
• pnpm nx run azure_api_management:tf-validate --skipNxCache
• TF_CLI_ARGS_test='-filter=tests/unit.tftest.hcl' pnpm nx run azure_api_management:tf-test --skipNxCache
• TF_CLI_ARGS_test='-filter=tests/contract.tftest.hcl' pnpm nx run azure_api_management:tf-test --skipNxCache
• pre-commit Terraform docs, fmt, validate, and tflint hooks

Resolves CES-1911

[github-actions]

📋 Pre-commit Output Log

[INFO] Initializing environment for https://github.com/antonbabenko/pre-commit-terraform.
Lock Terraform Registry modules..................................(no files to check)Skipped
Terraform Providers Lock (on staged .terraform.lock.hcl files).......................Passed
- hook id: terraform_providers_lock_staged
- duration: 0.16s

No .terraform.lock.hcl files to process.

Terraform fmt........................................................................Passed
terraform_docs on modules............................................................Passed
Terraform validate with tflint.......................................................Passed
Terraform validate...................................................................Passed
Terraform validate with trivy........................................................Passed

_{Generated on Fri Jul 24 16:14:00 UTC 2026
Run all checks on modified files}