The azure-native:hybridnetwork:ConfigurationGroupValue resource, part of the Pulumi Azure Native provider, stores configuration data for Azure Hybrid Network deployments by binding JSON values to validation schemas. This guide focuses on two capabilities: open configuration values and secret configuration handling.
Configuration group values reference existing configuration group schemas that define validation rules and structure. The examples are intentionally small. Combine them with your own schemas and network function definitions.
Provide configuration values for network function deployment
Hybrid network deployments require configuration values that define how network functions connect and operate, validated against a schema.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const configurationGroupValue = new azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue", {
configurationGroupValueName: "testConfigurationGroupValue",
location: "eastus",
properties: {
configurationGroupSchemaResourceReference: {
id: "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
idType: "Open",
},
configurationType: "Open",
configurationValue: "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
},
resourceGroupName: "rg1",
});
import pulumi
import pulumi_azure_native as azure_native
configuration_group_value = azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue",
configuration_group_value_name="testConfigurationGroupValue",
location="eastus",
properties={
"configuration_group_schema_resource_reference": {
"id": "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
"id_type": "Open",
},
"configuration_type": "Open",
"configuration_value": "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
},
resource_group_name="rg1")
package main
import (
hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := hybridnetwork.NewConfigurationGroupValue(ctx, "configurationGroupValue", &hybridnetwork.ConfigurationGroupValueArgs{
ConfigurationGroupValueName: pulumi.String("testConfigurationGroupValue"),
Location: pulumi.String("eastus"),
Properties: &hybridnetwork.ConfigurationValueWithoutSecretsArgs{
ConfigurationGroupSchemaResourceReference: hybridnetwork.OpenDeploymentResourceReference{
Id: "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
IdType: "Open",
},
ConfigurationType: pulumi.String("Open"),
ConfigurationValue: pulumi.String("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}"),
},
ResourceGroupName: pulumi.String("rg1"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var configurationGroupValue = new AzureNative.HybridNetwork.ConfigurationGroupValue("configurationGroupValue", new()
{
ConfigurationGroupValueName = "testConfigurationGroupValue",
Location = "eastus",
Properties = new AzureNative.HybridNetwork.Inputs.ConfigurationValueWithoutSecretsArgs
{
ConfigurationGroupSchemaResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
{
Id = "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
IdType = "Open",
},
ConfigurationType = "Open",
ConfigurationValue = "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
},
ResourceGroupName = "rg1",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValue;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValueArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var configurationGroupValue = new ConfigurationGroupValue("configurationGroupValue", ConfigurationGroupValueArgs.builder()
.configurationGroupValueName("testConfigurationGroupValue")
.location("eastus")
.properties(ConfigurationValueWithoutSecretsArgs.builder()
.configurationGroupSchemaResourceReference(OpenDeploymentResourceReferenceArgs.builder()
.id("/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName")
.idType("Open")
.build())
.configurationType("Open")
.configurationValue("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}")
.build())
.resourceGroupName("rg1")
.build());
}
}
resources:
configurationGroupValue:
type: azure-native:hybridnetwork:ConfigurationGroupValue
properties:
configurationGroupValueName: testConfigurationGroupValue
location: eastus
properties:
configurationGroupSchemaResourceReference:
id: /subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName
idType: Open
configurationType: Open
configurationValue: '{"interconnect-groups":{"stripe-one":{"name":"Stripe one","international-interconnects":["france","germany"],"domestic-interconnects":["birmingham","edinburgh"]},"stripe-two":{"name":"Stripe two","international-interconnects":["germany","italy"],"domestic-interconnects":["edinburgh","london"]}},"interconnect-group-assignments":{"ssc-one":{"ssc":"SSC 1","interconnects":"stripe-one"},"ssc-two":{"ssc":"SSC 2","interconnects":"stripe-two"}}}'
resourceGroupName: rg1
The configurationGroupSchemaResourceReference points to a schema that validates the JSON structure. The configurationType property set to “Open” means the configuration data is not encrypted and will be visible in API responses. The configurationValue contains JSON-formatted settings that match the schema’s expected structure. In this example, the JSON defines interconnect groups and their assignments for network routing.
Store sensitive configuration using secret values
When configuration includes credentials or sensitive parameters, the secret configuration type prevents exposure in logs or API responses.
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";
const configurationGroupValue = new azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue", {
configurationGroupValueName: "testConfigurationGroupValue",
location: "eastus",
properties: {
configurationGroupSchemaResourceReference: {
id: "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
idType: "Open",
},
configurationType: "Secret",
secretConfigurationValue: "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
},
resourceGroupName: "rg1",
});
import pulumi
import pulumi_azure_native as azure_native
configuration_group_value = azure_native.hybridnetwork.ConfigurationGroupValue("configurationGroupValue",
configuration_group_value_name="testConfigurationGroupValue",
location="eastus",
properties={
"configuration_group_schema_resource_reference": {
"id": "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
"id_type": "Open",
},
"configuration_type": "Secret",
"secret_configuration_value": "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
},
resource_group_name="rg1")
package main
import (
hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := hybridnetwork.NewConfigurationGroupValue(ctx, "configurationGroupValue", &hybridnetwork.ConfigurationGroupValueArgs{
ConfigurationGroupValueName: pulumi.String("testConfigurationGroupValue"),
Location: pulumi.String("eastus"),
Properties: &hybridnetwork.ConfigurationValueWithSecretsArgs{
ConfigurationGroupSchemaResourceReference: hybridnetwork.OpenDeploymentResourceReference{
Id: "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
IdType: "Open",
},
ConfigurationType: pulumi.String("Secret"),
SecretConfigurationValue: pulumi.String("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}"),
},
ResourceGroupName: pulumi.String("rg1"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var configurationGroupValue = new AzureNative.HybridNetwork.ConfigurationGroupValue("configurationGroupValue", new()
{
ConfigurationGroupValueName = "testConfigurationGroupValue",
Location = "eastus",
Properties = new AzureNative.HybridNetwork.Inputs.ConfigurationValueWithSecretsArgs
{
ConfigurationGroupSchemaResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
{
Id = "/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName",
IdType = "Open",
},
ConfigurationType = "Secret",
SecretConfigurationValue = "{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}",
},
ResourceGroupName = "rg1",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValue;
import com.pulumi.azurenative.hybridnetwork.ConfigurationGroupValueArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var configurationGroupValue = new ConfigurationGroupValue("configurationGroupValue", ConfigurationGroupValueArgs.builder()
.configurationGroupValueName("testConfigurationGroupValue")
.location("eastus")
.properties(ConfigurationValueWithSecretsArgs.builder()
.configurationGroupSchemaResourceReference(OpenDeploymentResourceReferenceArgs.builder()
.id("/subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName")
.idType("Open")
.build())
.configurationType("Secret")
.secretConfigurationValue("{\"interconnect-groups\":{\"stripe-one\":{\"name\":\"Stripe one\",\"international-interconnects\":[\"france\",\"germany\"],\"domestic-interconnects\":[\"birmingham\",\"edinburgh\"]},\"stripe-two\":{\"name\":\"Stripe two\",\"international-interconnects\":[\"germany\",\"italy\"],\"domestic-interconnects\":[\"edinburgh\",\"london\"]}},\"interconnect-group-assignments\":{\"ssc-one\":{\"ssc\":\"SSC 1\",\"interconnects\":\"stripe-one\"},\"ssc-two\":{\"ssc\":\"SSC 2\",\"interconnects\":\"stripe-two\"}}}")
.build())
.resourceGroupName("rg1")
.build());
}
}
resources:
configurationGroupValue:
type: azure-native:hybridnetwork:ConfigurationGroupValue
properties:
configurationGroupValueName: testConfigurationGroupValue
location: eastus
properties:
configurationGroupSchemaResourceReference:
id: /subscriptions/subid/resourcegroups/testRG/providers/microsoft.hybridnetwork/publishers/testPublisher/configurationGroupSchemas/testConfigurationGroupSchemaName
idType: Open
configurationType: Secret
secretConfigurationValue: '{"interconnect-groups":{"stripe-one":{"name":"Stripe one","international-interconnects":["france","germany"],"domestic-interconnects":["birmingham","edinburgh"]},"stripe-two":{"name":"Stripe two","international-interconnects":["germany","italy"],"domestic-interconnects":["edinburgh","london"]}},"interconnect-group-assignments":{"ssc-one":{"ssc":"SSC 1","interconnects":"stripe-one"},"ssc-two":{"ssc":"SSC 2","interconnects":"stripe-two"}}}'
resourceGroupName: rg1
Setting configurationType to “Secret” changes how Azure stores and returns the configuration. The secretConfigurationValue property holds the sensitive JSON data, which Azure encrypts and never returns in API responses. The configuration structure remains identical to open configurations, but the data is protected from exposure.
Beyond these examples
These snippets focus on specific configuration group value features: open and secret configuration types, and schema-validated JSON configuration. They’re intentionally minimal rather than full network function deployments.
The examples reference pre-existing infrastructure such as configuration group schemas and resource groups. They focus on storing configuration data rather than provisioning the schemas or network functions that consume the values.
To keep things focused, common configuration patterns are omitted, including:
- Resource tagging (tags property)
- Schema reference type variations (Open vs Secret idType)
- Configuration value structure and validation rules
These omissions are intentional: the goal is to illustrate how configuration group values are wired, not provide drop-in network function modules. See the ConfigurationGroupValue resource reference for all available configuration options.
Let's configure Azure Hybrid Network Configuration Groups
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Configuration Types & Values
What's the difference between Open and Secret configuration types?
The
configurationType determines which property holds your configuration data. Use configurationType: "Open" with configurationValue for non-sensitive data, or configurationType: "Secret" with secretConfigurationValue for sensitive data. Both accept JSON strings.What format should I use for configuration values?
Configuration values must be JSON strings. The examples show complex nested JSON objects with interconnect groups and assignments, all provided as escaped JSON strings.
What's the difference between idType and configurationType?
The
idType (in configurationGroupSchemaResourceReference) can be either “Open” or “Secret” and refers to the schema reference type. The configurationType determines whether you use configurationValue or secretConfigurationValue. These can differ, as shown in the third example where idType: "Secret" is used with configurationType: "Open".Resource Properties & Immutability
Which properties can't be changed after creation?
The
location, configurationGroupValueName, and resourceGroupName properties are immutable and cannot be modified after the resource is created.What's required to create a ConfigurationGroupValue?
You must provide
location, resourceGroupName, configurationGroupValueName, and the properties object containing configurationGroupSchemaResourceReference and configurationType with the appropriate configuration value property.API Versions
What API version does this resource use?
This resource uses Azure REST API version 2024-04-15. In version 2.x of the Azure Native provider, it used API version 2023-09-01. You can access other API versions like 2023-09-01 by generating a local SDK package using
pulumi package add azure-native hybridnetwork [ApiVersion].