From 36863f03604f46ce933e058d936b370b31db4166 Mon Sep 17 00:00:00 2001
From: Simon Schneider <simon.schneider@volocopter.com>
Date: Mon, 1 Jul 2024 09:49:43 +0000
Subject: [PATCH 1/6] feat(azuread_application): random id for
 oauth2_permission_scope

---
 .../configuration.tfvars                                 | 7 +++++++
 modules/azuread/applications_v1/azuread_application.tf   | 9 ++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars b/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars
index 60ddaeb879..be32857be7 100644
--- a/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars
+++ b/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars
@@ -51,6 +51,13 @@ azuread_applications = {
           id    = "d4c3605a-b327-35c5-f04d-77f7fcdd4995"
           type  = "Admin"
           value = "app"
+        },
+        {
+          admin_consent_description  = "Allow to administer app2."
+          admin_consent_display_name = "Administer app2"
+          enabled                    = true
+          type  = "Admin"
+          value = "app2"
         }
       ]
     }
diff --git a/modules/azuread/applications_v1/azuread_application.tf b/modules/azuread/applications_v1/azuread_application.tf
index 900ea16d26..db440f8153 100644
--- a/modules/azuread/applications_v1/azuread_application.tf
+++ b/modules/azuread/applications_v1/azuread_application.tf
@@ -36,7 +36,7 @@ resource "azuread_application" "app" {
         content {
           admin_consent_description  = oauth2_permission_scope.value.admin_consent_description
           admin_consent_display_name = oauth2_permission_scope.value.admin_consent_display_name
-          id                         = oauth2_permission_scope.value.id
+          id                         = try(oauth2_permission_scope.value.id, random_uuid.oauth2_permission_scopes[oauth2_permission_scope.key].id)
           enabled                    = try(oauth2_permission_scope.value.enabled, null)
           type                       = try(oauth2_permission_scope.value.type, null)
           user_consent_description   = try(oauth2_permission_scope.value.user_consent_description, null)
@@ -131,3 +131,10 @@ resource "random_uuid" "app_role_id" {
     if try(value.id, null) == null
   }
 }
+
+resource "random_uuid" "oauth2_permission_scopes" {
+  for_each = {
+    for key, value in try(var.settings.api.oauth2_permission_scopes, {}) : key => value
+    if try(value.id, null) == null
+  }
+}

From 47cd1cd0174c2264ed14146b45fb45bebec2527f Mon Sep 17 00:00:00 2001
From: chian <91816369+chianw@users.noreply.github.com>
Date: Fri, 6 Sep 2024 08:25:09 +0800
Subject: [PATCH 2/6] Add private endpoint support for mysql flexible server
 (#2052)

* Apply terraform fmt

* add private endpoint for mysql flexible server try 1

* removed base_tags from mysqlflexibleserver variables

* update mysql_flexible_servers.tf

* change base_tag variable to boolean

* changed base_tags to bool

* add inherit_base_tags bool

* change location and resourcegroupname for private endpoint

* test change location and resource_group_name for private_endpoint

* add location and resource_group_name to main.tf for mysql flexible server

* revert changes to location and resource_group_name for private endpoiint and main.tf

* add example for mysql-flexible-server-private-endpoint

---------

Co-authored-by: GitHub Action <action@github.com>
---
 .../configuration.tfvars                      |   8 +-
 .../configuration.tfvars                      | 110 ++++++++++++++++++
 .../databases/mysql_flexible_server/main.tf   |   1 -
 .../private_endpoints.tf                      |  20 ++++
 .../mysql_flexible_server/variables.tf        |  17 +++
 mysql_flexible_servers.tf                     |   6 +-
 6 files changed, 156 insertions(+), 6 deletions(-)
 create mode 100644 examples/mysql_flexible_server/103-mysql-flexible-private-endpoint/configuration.tfvars
 create mode 100644 modules/databases/mysql_flexible_server/private_endpoints.tf

diff --git a/examples/cognitive_services/101-cognitive-services-account-managed-identity/configuration.tfvars b/examples/cognitive_services/101-cognitive-services-account-managed-identity/configuration.tfvars
index 79f8ab921a..62c98ec3e1 100644
--- a/examples/cognitive_services/101-cognitive-services-account-managed-identity/configuration.tfvars
+++ b/examples/cognitive_services/101-cognitive-services-account-managed-identity/configuration.tfvars
@@ -27,14 +27,14 @@ cognitive_services_account = {
       # lz_key = "examples"
       key = "test-rg"
     }
-    name     = "cs-test-1"
-    kind     = "OpenAI"
-    sku_name = "S0"
+    name                          = "cs-test-1"
+    kind                          = "OpenAI"
+    sku_name                      = "S0"
     public_network_access_enabled = true
 
     identity = {
       type = "SystemAssigned, UserAssigned" // Can be "SystemAssigned, UserAssigned" or "SystemAssigned" or "UserAssigned"
-      key  = "cognitive_msi" // A must with "SystemAssigned, UserAssigned" and "UserAssigned"
+      key  = "cognitive_msi"                // A must with "SystemAssigned, UserAssigned" and "UserAssigned"
     }
 
     tags = {
diff --git a/examples/mysql_flexible_server/103-mysql-flexible-private-endpoint/configuration.tfvars b/examples/mysql_flexible_server/103-mysql-flexible-private-endpoint/configuration.tfvars
new file mode 100644
index 0000000000..f65925a736
--- /dev/null
+++ b/examples/mysql_flexible_server/103-mysql-flexible-private-endpoint/configuration.tfvars
@@ -0,0 +1,110 @@
+global_settings = {
+  default_region = "region1"
+  regions = {
+    region1 = "australiaeast"
+  }
+}
+
+resource_groups = {
+  mysql_region1 = {
+    name   = "mysql-region1"
+    region = "region1"
+  }
+  security_region1 = {
+    name = "security-region1"
+  }
+}
+
+mysql_flexible_server = {
+  primary_region1 = {
+    name     = "vks-flexible-testservers"
+    version  = "8.0.21" #Possible values are 5.7, and 8.0.21
+    sku_name = "GP_Standard_D2ds_v4"
+    zone     = 1
+    resource_group = {
+      key = "mysql_region1"
+      # lz_key = ""                           # Set the lz_key if the resource group is remote.
+    }
+
+    private_dns_zone_id = "dns_zone1"
+
+    # Auto-generated administrator credentials stored in azure keyvault when not set (recommended).
+    #administrator_username  = "psqladmin"
+    #administrator_password  = "ComplxP@ssw0rd!"
+    keyvault = {
+      key = "mysql_region1" # (Required) when auto-generated administrator credentials needed.
+      # lz_key      = ""                      # Set the lz_key if the keyvault is remote.
+    }
+
+    # [Optional] Server Configurations
+    mysql_configurations = {
+      mysql_configurations = {
+        name  = "interactive_timeout"
+        value = "600"
+      }
+
+    }
+    # [Optional] Database Configurations
+    mysql_databases = {
+      flex_mysql_database = {
+        name      = "exampledb"
+        collation = "utf8mb3_unicode_ci"
+        charset   = "utf8mb3"
+      }
+    }
+
+    tags = {
+      server = "MysqlFlexible"
+    }
+
+    private_endpoints = {
+      private-link-level4 = {
+        name               = "sales-sql-rg1"
+        vnet_key           = "vnet_region1"
+        subnet_key         = "private_dns"
+        resource_group_key = "sql_region1"
+
+        private_service_connection = {
+          name                 = "sales-sql-rg1"
+          is_manual_connection = false
+          subresource_names    = ["mysqlServer"]
+        }
+      }
+    }
+
+  }
+
+}
+
+keyvaults = {
+  mysql_region1 = {
+    name                = "mysql-region123"
+    resource_group_key  = "security_region1"
+    sku_name            = "standard"
+    soft_delete_enabled = true
+    creation_policies = {
+      logged_in_user = {
+        secret_permissions = ["Set", "Get", "List", "Delete", "Purge"]
+      }
+    }
+  }
+}
+
+vnets = {
+  vnet_region1 = {
+    resource_group_key = "mysql_region1"
+    region             = "region1"
+    vnet = {
+      name          = "mysql"
+      address_space = ["10.10.0.0/24"]
+    }
+    subnets = {
+      private_dns = {
+        name                                           = "private-dns"
+        cidr                                           = ["10.10.0.0/25"]
+        enforce_private_link_endpoint_network_policies = true
+        enforce_private_link_service_network_policies  = false
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/modules/databases/mysql_flexible_server/main.tf b/modules/databases/mysql_flexible_server/main.tf
index 2e1918847f..e8019f6ebf 100644
--- a/modules/databases/mysql_flexible_server/main.tf
+++ b/modules/databases/mysql_flexible_server/main.tf
@@ -12,4 +12,3 @@ locals {
   }
   tags = merge(var.base_tags, local.module_tag, try(var.settings.tags, null))
 }
-
diff --git a/modules/databases/mysql_flexible_server/private_endpoints.tf b/modules/databases/mysql_flexible_server/private_endpoints.tf
new file mode 100644
index 0000000000..c77476562c
--- /dev/null
+++ b/modules/databases/mysql_flexible_server/private_endpoints.tf
@@ -0,0 +1,20 @@
+module "private_endpoint" {
+  source   = "../../networking/private_endpoint"
+  for_each = var.private_endpoints
+
+  resource_id = azurerm_mysql_flexible_server.mysql.id
+  name        = each.value.name
+  # location            = var.resource_groups[try(each.value.resource_group.lz_key, var.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].location
+  # resource_group_name = var.resource_groups[try(each.value.resource_group.lz_key, var.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].name
+  location            = var.location
+  resource_group_name = var.resource_group_name
+
+  subnet_id = can(each.value.subnet_id) ? each.value.subnet_id : var.vnets[try(each.value.lz_key, var.client_config.landingzone_key)][each.value.vnet_key].subnets[each.value.subnet_key].id
+
+  settings        = each.value
+  global_settings = var.global_settings
+  base_tags       = var.inherit_base_tags
+  tags            = local.tags
+  private_dns     = var.private_dns
+  client_config   = var.client_config
+}
diff --git a/modules/databases/mysql_flexible_server/variables.tf b/modules/databases/mysql_flexible_server/variables.tf
index 790831d1d0..c5717d2735 100644
--- a/modules/databases/mysql_flexible_server/variables.tf
+++ b/modules/databases/mysql_flexible_server/variables.tf
@@ -31,4 +31,21 @@ variable "settings" {
 variable "location" {
   description = "(Required) Specifies the supported Azure location where to create the resource. Changing this forces a new resource to be created."
   type        = string
+}
+
+variable "private_dns" {
+  default = {}
+}
+
+variable "private_endpoints" {}
+
+variable "resource_groups" {}
+
+variable "resource_group" {}
+
+variable "vnets" {}
+
+variable "inherit_base_tags" {
+  description = "Base tags for the resource to be inherited from the resource group."
+  type        = bool
 }
\ No newline at end of file
diff --git a/mysql_flexible_servers.tf b/mysql_flexible_servers.tf
index 3e396f8e63..afdcc69bee 100644
--- a/mysql_flexible_servers.tf
+++ b/mysql_flexible_servers.tf
@@ -15,7 +15,11 @@ module "mysql_flexible_server" {
   resource_group_name = can(each.value.resource_group.name) || can(each.value.resource_group_name) ? try(each.value.resource_group.name, each.value.resource_group_name) : local.combined_objects_resource_groups[try(each.value.resource_group.lz_key, local.client_config.landingzone_key)][try(each.value.resource_group_key, each.value.resource_group.key)].name
   location            = can(local.global_settings.regions[each.value.region]) || can(each.value.region) ? try(local.global_settings.regions[each.value.region], each.value.region) : local.combined_objects_resource_groups[try(each.value.resource_group.lz_key, local.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].location
 
-
+  private_endpoints = try(each.value.private_endpoints, {})
+  resource_groups   = try(each.value.private_endpoints, {}) == {} ? null : local.resource_groups
+  resource_group    = local.combined_objects_resource_groups[try(each.value.resource_group.lz_key, local.client_config.landingzone_key)][try(each.value.resource_group_key, each.value.resource_group.key)]
+  vnets             = local.combined_objects_networking
+  inherit_base_tags = local.global_settings.inherit_tags
   remote_objects = {
     subnet_id           = can(each.value.vnet.subnet_key) ? local.combined_objects_networking[try(each.value.vnet.lz_key, local.client_config.landingzone_key)][each.value.vnet.key].subnets[each.value.vnet.subnet_key].id : null
     private_dns_zone_id = can(each.value.private_dns_zone.key) ? local.combined_objects_private_dns[try(each.value.private_dns_zone.lz_key, local.client_config.landingzone_key)][each.value.private_dns_zone.key].id : null

From aae1ce2a5fe880b4f3bdfa4ba17bd8619183a533 Mon Sep 17 00:00:00 2001
From: caiovbraga <caiov.braga@gmail.com>
Date: Fri, 6 Sep 2024 02:08:39 +0100
Subject: [PATCH 3/6] Add io_scaling_enabled option to MySQL Flexible (#2039)

* Add io_scaling_enabled option to MySQL Flexible

* do not set iops, size when io_scaling_enable is true

---------

Co-authored-by: Caio Venturini Braga <caio.braga@cpoms.co.uk>
---
 modules/databases/mysql_flexible_server/server.tf | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/modules/databases/mysql_flexible_server/server.tf b/modules/databases/mysql_flexible_server/server.tf
index d2b82d4ef9..50b1dc36fc 100644
--- a/modules/databases/mysql_flexible_server/server.tf
+++ b/modules/databases/mysql_flexible_server/server.tf
@@ -52,9 +52,10 @@ resource "azurerm_mysql_flexible_server" "mysql" {
     for_each = try(var.settings.storage, null) == null ? [] : [var.settings.storage]
 
     content {
-      auto_grow_enabled = try(var.settings.storage.auto_grow_enabled, "True")
-      iops              = try(var.settings.storage.iops, "360")
-      size_gb           = try(var.settings.storage.size_gb, "20")
+      auto_grow_enabled  = try(var.settings.storage.auto_grow_enabled, "True")
+      io_scaling_enabled = try(var.settings.storage.io_scaling_enabled, "False")
+      iops               = var.settings.storage.io_scaling_enabled ? null : try(var.settings.storage.iops, "360")
+      size_gb            = var.settings.storage.io_scaling_enabled ? null : try(var.settings.storage.size_gb, "20")
     }
   }
 
@@ -116,4 +117,4 @@ resource "azurerm_key_vault_secret" "mysql_fqdn" {
   name         = format("%s-mysql-fqdn", azurecaf_name.mysql_flexible_server.result)
   value        = azurerm_mysql_flexible_server.mysql.fqdn
   key_vault_id = var.remote_objects.keyvault_id
-}
\ No newline at end of file
+}

From bc03cb66ca89eb4e63633fc65a2028648f594203 Mon Sep 17 00:00:00 2001
From: shanoor <17402800+shanoor@users.noreply.github.com>
Date: Fri, 6 Sep 2024 03:15:07 +0200
Subject: [PATCH 4/6]  Enhanced cognitive services: private endpoint support,
 diagnostic settings, more outputs (#2047)

* Apply terraform fmt

* Enhanced cognitive services: private endpoint support, diagnostic settings, more outputs

---------

Co-authored-by: GitHub Action <action@github.com>
---
 cognitive_service.tf                          |  6 ++++++
 .../cognitive_services_account/diagnostics.tf |  9 +++++++++
 .../cognitive_services_account/main.tf        |  3 ++-
 .../cognitive_services_account/output.tf      | 12 ++++++++++-
 .../private_endpoints.tf                      | 20 +++++++++++++++++++
 .../cognitive_services_account/variables.tf   | 19 +++++++++++++++++-
 6 files changed, 66 insertions(+), 3 deletions(-)
 create mode 100644 modules/cognitive_services/cognitive_services_account/diagnostics.tf
 create mode 100644 modules/cognitive_services/cognitive_services_account/private_endpoints.tf

diff --git a/cognitive_service.tf b/cognitive_service.tf
index 1eebac5c8c..b920b21464 100644
--- a/cognitive_service.tf
+++ b/cognitive_service.tf
@@ -9,6 +9,12 @@ module "cognitive_services_account" {
   resource_group_name = local.combined_objects_resource_groups[try(each.value.resource_group.lz_key, local.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].name
   location            = lookup(each.value, "region", null) == null ? local.combined_objects_resource_groups[try(each.value.resource_group.lz_key, local.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].location : local.global_settings.regions[each.value.region]
   settings            = each.value
+  resource_groups     = local.combined_objects_resource_groups
+  vnets               = local.combined_objects_networking
+  private_endpoints   = try(each.value.private_endpoints, {})
+  private_dns         = local.combined_objects_private_dns
+  diagnostics         = local.combined_diagnostics
+  diagnostic_profiles = try(each.value.diagnostic_profiles, {})
 
   managed_identities = local.combined_objects_managed_identities
 }
diff --git a/modules/cognitive_services/cognitive_services_account/diagnostics.tf b/modules/cognitive_services/cognitive_services_account/diagnostics.tf
new file mode 100644
index 0000000000..3d7118951f
--- /dev/null
+++ b/modules/cognitive_services/cognitive_services_account/diagnostics.tf
@@ -0,0 +1,9 @@
+module "diagnostics" {
+  source = "../../diagnostics"
+  count  = var.diagnostic_profiles == null ? 0 : 1
+
+  resource_id       = azurerm_cognitive_account.service.id
+  resource_location = local.location
+  diagnostics       = var.diagnostics
+  profiles          = var.diagnostic_profiles
+}
diff --git a/modules/cognitive_services/cognitive_services_account/main.tf b/modules/cognitive_services/cognitive_services_account/main.tf
index b58d11de39..e2fd2ccc7f 100644
--- a/modules/cognitive_services/cognitive_services_account/main.tf
+++ b/modules/cognitive_services/cognitive_services_account/main.tf
@@ -7,9 +7,10 @@ terraform {
 }
 
 locals {
+  location = coalesce(var.location, var.resource_group.location)
   tags = var.base_tags ? merge(
     var.global_settings.tags,
     try(var.resource_group.tags, null),
     try(var.settings.tags, null)
   ) : try(var.settings.tags, null)
-}
\ No newline at end of file
+}
diff --git a/modules/cognitive_services/cognitive_services_account/output.tf b/modules/cognitive_services/cognitive_services_account/output.tf
index 4e37bd9072..c548874b0b 100644
--- a/modules/cognitive_services/cognitive_services_account/output.tf
+++ b/modules/cognitive_services/cognitive_services_account/output.tf
@@ -8,6 +8,16 @@ output "endpoint" {
   value       = azurerm_cognitive_account.service.endpoint
 }
 
+output "primary_access_key" {
+  description = "The primary_access_key used to connect to the Cognitive Service Account."
+  value       = azurerm_cognitive_account.service.primary_access_key
+}
+
+output "secondary_access_key" {
+  description = "The secondary_access_key used to connect to the Cognitive Service Account."
+  value       = azurerm_cognitive_account.service.secondary_access_key
+}
+
 output "rbac_id" {
   description = "The Principal ID of the Cognetive Services for Role Mapping"
   value       = try(azurerm_cognitive_account.service.identity[0].principal_id, null)
@@ -15,4 +25,4 @@ output "rbac_id" {
 
 output "identity" {
   value = try(azurerm_cognitive_account.service.identity, null)
-}
\ No newline at end of file
+}
diff --git a/modules/cognitive_services/cognitive_services_account/private_endpoints.tf b/modules/cognitive_services/cognitive_services_account/private_endpoints.tf
new file mode 100644
index 0000000000..9c34adb305
--- /dev/null
+++ b/modules/cognitive_services/cognitive_services_account/private_endpoints.tf
@@ -0,0 +1,20 @@
+#
+# Private endpoint
+#
+
+module "private_endpoint" {
+  source   = "../../networking/private_endpoint"
+  for_each = var.private_endpoints
+
+  resource_id         = azurerm_cognitive_account.service.id
+  name                = each.value.name
+  location            = var.resource_groups[try(each.value.resource_group.lz_key, var.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].location
+  resource_group_name = var.resource_groups[try(each.value.resource_group.lz_key, var.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].name
+  subnet_id           = can(each.value.subnet_id) ? each.value.subnet_id : var.vnets[try(each.value.lz_key, var.client_config.landingzone_key)][each.value.vnet_key].subnets[each.value.subnet_key].id
+  settings            = each.value
+  global_settings     = var.global_settings
+  base_tags           = var.base_tags
+  tags                = local.tags
+  private_dns         = var.private_dns
+  client_config       = var.client_config
+}
diff --git a/modules/cognitive_services/cognitive_services_account/variables.tf b/modules/cognitive_services/cognitive_services_account/variables.tf
index 5c70771326..87b5679e0d 100644
--- a/modules/cognitive_services/cognitive_services_account/variables.tf
+++ b/modules/cognitive_services/cognitive_services_account/variables.tf
@@ -18,13 +18,30 @@ variable "resource_group_name" {
   type        = string
 }
 
+variable "diagnostic_profiles" {
+  default = {}
+}
+variable "diagnostics" {
+  default = {}
+}
+
 variable "settings" {}
 
 variable "managed_identities" {
   default = {}
 }
 
+variable "vnets" {}
+
+variable "resource_groups" {}
+
+variable "private_endpoints" {}
+
+variable "private_dns" {
+  default = {}
+}
+
 variable "base_tags" {
   description = "Base tags for the resource to be inherited from the resource group."
   type        = bool
-}
\ No newline at end of file
+}

From 5c9c51fc17ecd7fe75393ef57d4dc83c67d29511 Mon Sep 17 00:00:00 2001
From: shanoor <17402800+shanoor@users.noreply.github.com>
Date: Fri, 6 Sep 2024 03:25:33 +0200
Subject: [PATCH 5/6] Add eventgrid system topics support (#2053)

* Apply terraform fmt

* Feat/add eventgrid system topic (#28)

---------

Co-authored-by: GitHub Action <action@github.com>
---
 .github/workflows/standalone-scenarios.json   |   1 +
 eventgrid.tf                                  |  39 +++
 .../configuration.tfvars                      |  64 +++++
 locals.combined_objects.tf                    |   1 +
 locals.tf                                     |  22 +-
 .../main.tf                                   |   7 +
 .../module.tf                                 | 235 ++++++++++++++++++
 .../output.tf                                 |   4 +
 .../variables.tf                              |  18 ++
 .../eventgrid/eventgrid_system_topic/main.tf  |  14 ++
 .../eventgrid_system_topic/module.tf          |  52 ++++
 .../eventgrid_system_topic/output.tf          |  12 +
 .../eventgrid_system_topic/variables.tf       |  22 ++
 13 files changed, 481 insertions(+), 10 deletions(-)
 create mode 100644 examples/messaging/eventgrid/300-simple-eventgrid-system-topic/configuration.tfvars
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_event_subscription/main.tf
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_event_subscription/module.tf
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_event_subscription/output.tf
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_event_subscription/variables.tf
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_topic/main.tf
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_topic/module.tf
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_topic/output.tf
 create mode 100644 modules/messaging/eventgrid/eventgrid_system_topic/variables.tf

diff --git a/.github/workflows/standalone-scenarios.json b/.github/workflows/standalone-scenarios.json
index f8812951b1..2bd6a3da02 100644
--- a/.github/workflows/standalone-scenarios.json
+++ b/.github/workflows/standalone-scenarios.json
@@ -73,6 +73,7 @@
     "messaging/eventgrid/101-simple-eventgrid-topic-private-endpoint",
     "messaging/eventgrid/102-eventgrid_subscription",
     "messaging/eventgrid/200-simple-eventgrid-domain-topic",
+    "messaging/eventgrid/300-simple-eventgrid-system-topic",
     "messaging/servicebus/100-servicebus-services",
     "messaging/servicebus/200-servicebus-privatelink",
     "messaging/web_pubsub/100-simple-web-pubsub",
diff --git a/eventgrid.tf b/eventgrid.tf
index c26e4a05d2..82e50f1178 100755
--- a/eventgrid.tf
+++ b/eventgrid.tf
@@ -77,3 +77,42 @@ module "eventgrid_domain_topic" {
 output "eventgrid_domain_topic" {
   value = module.eventgrid_domain_topic
 }
+
+module "eventgrid_system_topic" {
+  source   = "./modules/messaging/eventgrid/eventgrid_system_topic"
+  for_each = local.messaging.eventgrid_system_topic
+
+  global_settings = local.global_settings
+  client_config   = local.client_config
+  settings        = each.value
+  base_tags       = try(local.global_settings.inherit_tags, false) ? try(local.combined_objects_resource_groups[try(each.value.resource_group.lz_key, local.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].tags, {}) : {}
+
+  location = can(local.global_settings.regions[each.value.region]) ? local.global_settings.regions[each.value.region] : local.combined_objects_resource_groups[try(each.value.resource_group.lz_key, local.client_config.landingzone_key)][try(each.value.resource_group.key, each.value.resource_group_key)].location
+
+  remote_objects = local.remote_objects
+}
+output "eventgrid_system_topic" {
+  value = module.eventgrid_system_topic
+}
+module "eventgrid_system_event_subscription" {
+  source   = "./modules/messaging/eventgrid/eventgrid_system_event_subscription"
+  for_each = local.messaging.eventgrid_system_event_subscription
+
+  global_settings = local.global_settings
+  client_config   = local.client_config
+  settings        = each.value
+
+  remote_objects = merge(
+    local.remote_objects,
+    {
+      functions               = local.combined_objects_function_apps,
+      eventhubs               = local.combined_objects_event_hubs,
+      eventgrid_system_topics = local.combined_objects_eventgrid_system_topics,
+      hybrid_connections      = local.combined_objects_relay_hybrid_connection,
+      storage_account_queues  = local.combined_objects_storage_account_queues
+    }
+  )
+}
+output "eventgrid_system_event_subscription" {
+  value = module.eventgrid_system_event_subscription
+}
diff --git a/examples/messaging/eventgrid/300-simple-eventgrid-system-topic/configuration.tfvars b/examples/messaging/eventgrid/300-simple-eventgrid-system-topic/configuration.tfvars
new file mode 100644
index 0000000000..02a3923f16
--- /dev/null
+++ b/examples/messaging/eventgrid/300-simple-eventgrid-system-topic/configuration.tfvars
@@ -0,0 +1,64 @@
+global_settings = {
+  default_region = "region1"
+  regions = {
+    region1 = "southeastasia"
+  }
+}
+
+resource_groups = {
+  evg_examples = {
+    name   = "eventgrid"
+    region = "region1"
+  }
+}
+
+storage_accounts = {
+  sa1 = {
+    name               = "0665ba08d3ae"
+    resource_group_key = "evg_examples"
+    account_kind       = "BlobStorage"
+    account_tier       = "Standard"
+    # account_replication_type = "LRS"
+    containers = {
+      dev = {
+        name = "random"
+      }
+    }
+  }
+}
+
+eventgrid_system_topic = {
+  egt1 = {
+    name = "egt1"
+    resource_group = {
+      key = "evg_examples"
+    }
+    region = "region1"
+
+    # topic_type can be one of these, more resource types can be supported
+    # Microsoft.AppConfiguration.ConfigurationStores
+    # Microsoft.Communication.CommunicationServices
+    # Microsoft.ContainerRegistry.Registries
+    # Microsoft.Devices.IoTHubs
+    # Microsoft.EventGrid.Domains
+    # Microsoft.EventGrid.Topics
+    # Microsoft.Eventhub.Namespaces
+    # Microsoft.KeyVault.vaults
+    # Microsoft.MachineLearningServices.Workspaces
+    # Microsoft.Maps.Accounts
+    # Microsoft.Media.MediaServices
+    # Microsoft.Resources.ResourceGroups
+    # Microsoft.Resources.Subscriptions
+    # Microsoft.ServiceBus.Namespaces
+    # Microsoft.SignalRService.SignalR
+    # Microsoft.Storage.StorageAccounts
+    # Microsoft.Web.ServerFarms
+    # Microsoft.Web.Sites
+    topic_type = "Microsoft.Storage.StorageAccounts"
+
+    source_resource = {
+      type = "storage_accounts"
+      key  = "sa1"
+    }
+  }
+}
diff --git a/locals.combined_objects.tf b/locals.combined_objects.tf
index 49e3609a5b..8c2f27186a 100644
--- a/locals.combined_objects.tf
+++ b/locals.combined_objects.tf
@@ -78,6 +78,7 @@ locals {
   combined_objects_event_hubs                                     = merge(tomap({ (local.client_config.landingzone_key) = module.event_hubs }), lookup(var.remote_objects, "event_hubs", {}))
   combined_objects_eventgrid_domains                              = merge(tomap({ (local.client_config.landingzone_key) = module.eventgrid_domain }), lookup(var.remote_objects, "eventgrid_domain", {}))
   combined_objects_eventgrid_topics                               = merge(tomap({ (local.client_config.landingzone_key) = module.eventgrid_topic }), lookup(var.remote_objects, "eventgrid_topic", {}))
+  combined_objects_eventgrid_system_topics                        = merge(tomap({ (local.client_config.landingzone_key) = module.eventgrid_system_topic }), lookup(var.remote_objects, "eventgrid_system_topic", {}))
   combined_objects_express_route_circuit_authorizations           = merge(tomap({ (local.client_config.landingzone_key) = module.express_route_circuit_authorizations }), lookup(var.remote_objects, "express_route_circuit_authorizations", {}))
   combined_objects_express_route_circuit_peerings                 = merge(tomap({ (local.client_config.landingzone_key) = module.express_route_circuit_peerings }), lookup(var.remote_objects, "express_route_circuit_peerings", {}))
   combined_objects_express_route_circuits                         = merge(tomap({ (local.client_config.landingzone_key) = module.express_route_circuits }), lookup(var.remote_objects, "express_route_circuits", {}), lookup(var.data_sources, "express_route_circuits", {}))
diff --git a/locals.tf b/locals.tf
index 13df3d21a2..e81350b46f 100644
--- a/locals.tf
+++ b/locals.tf
@@ -257,16 +257,18 @@ locals {
     maps_accounts = try(var.maps.maps_accounts, {})
   }
   messaging = {
-    signalr_services             = try(var.messaging.signalr_services, {})
-    servicebus_namespaces        = try(var.messaging.servicebus_namespaces, {})
-    servicebus_queues            = try(var.messaging.servicebus_queues, {})
-    servicebus_topics            = try(var.messaging.servicebus_topics, {})
-    eventgrid_domain             = try(var.messaging.eventgrid_domain, {})
-    eventgrid_topic              = try(var.messaging.eventgrid_topic, {})
-    eventgrid_event_subscription = try(var.messaging.eventgrid_event_subscription, {})
-    eventgrid_domain_topic       = try(var.messaging.eventgrid_domain_topic, {})
-    web_pubsubs                  = try(var.messaging.web_pubsubs, {})
-    web_pubsub_hubs              = try(var.messaging.web_pubsub_hubs, {})
+    signalr_services                    = try(var.messaging.signalr_services, {})
+    servicebus_namespaces               = try(var.messaging.servicebus_namespaces, {})
+    servicebus_queues                   = try(var.messaging.servicebus_queues, {})
+    servicebus_topics                   = try(var.messaging.servicebus_topics, {})
+    eventgrid_domain                    = try(var.messaging.eventgrid_domain, {})
+    eventgrid_topic                     = try(var.messaging.eventgrid_topic, {})
+    eventgrid_event_subscription        = try(var.messaging.eventgrid_event_subscription, {})
+    eventgrid_domain_topic              = try(var.messaging.eventgrid_domain_topic, {})
+    eventgrid_system_topic              = try(var.messaging.eventgrid_system_topic, {})
+    eventgrid_system_event_subscription = try(var.messaging.eventgrid_system_event_subscription, {})
+    web_pubsubs                         = try(var.messaging.web_pubsubs, {})
+    web_pubsub_hubs                     = try(var.messaging.web_pubsub_hubs, {})
   }
 
   networking = {
diff --git a/modules/messaging/eventgrid/eventgrid_system_event_subscription/main.tf b/modules/messaging/eventgrid/eventgrid_system_event_subscription/main.tf
new file mode 100644
index 0000000000..1fbfa06797
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_event_subscription/main.tf
@@ -0,0 +1,7 @@
+terraform {
+  required_providers {
+    azurecaf = {
+      source = "aztfmod/azurecaf"
+    }
+  }
+}
diff --git a/modules/messaging/eventgrid/eventgrid_system_event_subscription/module.tf b/modules/messaging/eventgrid/eventgrid_system_event_subscription/module.tf
new file mode 100644
index 0000000000..7e41458075
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_event_subscription/module.tf
@@ -0,0 +1,235 @@
+
+resource "azurecaf_name" "eges" {
+  name          = var.settings.name
+  resource_type = "azurerm_eventgrid_event_subscription"
+  prefixes      = var.global_settings.prefixes
+  random_length = var.global_settings.random_length
+  clean_input   = true
+  passthrough   = var.global_settings.passthrough
+  use_slug      = var.global_settings.use_slug
+}
+resource "azurerm_eventgrid_system_topic_event_subscription" "eges" {
+  name                          = azurecaf_name.eges.result
+  resource_group_name           = can(var.settings.resource_group.name) ? var.settings.resource_group.name : var.remote_objects.resource_groups[try(var.settings.resource_group.lz_key, var.client_config.landingzone_key)][var.settings.resource_group.key].name
+  system_topic                  = var.remote_objects.eventgrid_system_topics[try(var.settings.eventgrid_system_topic.lz_key, var.client_config.landingzone_key)][var.settings.eventgrid_system_topic.key].name
+  eventhub_endpoint_id          = can(var.settings.eventhub.id) ? var.settings.eventhub.id : can(var.remote_objects.eventhubs[try(var.settings.eventhub.lz_key, var.client_config.landingzone_key)][var.settings.eventhub.key].id) ? var.remote_objects.eventhubs[try(var.settings.eventhub.lz_key, var.client_config.landingzone_key)][var.settings.eventhub.key].id : null
+  hybrid_connection_endpoint_id = can(var.settings.hybrid_connection.id) ? var.settings.hybrid_connection.id : can(var.remote_objects.hybrid_connections[try(var.settings.hybrid_connection.lz_key, var.client_config.landingzone_key)][var.settings.hybrid_connection.key].id) ? var.remote_objects.hybrid_connections[try(var.settings.hybrid_connection.lz_key, var.client_config.landingzone_key)][var.settings.hybrid_connection.key].id : null
+  service_bus_queue_endpoint_id = can(var.settings.servicebus_queues.id) ? var.settings.servicebus_queues.id : can(var.remote_objects.servicebus_queues[try(var.settings.servicebus_queues.lz_key, var.client_config.landingzone_key)][var.settings.servicebus_queues.key].id) ? var.remote_objects.servicebus_queues[try(var.settings.servicebus_queues.lz_key, var.client_config.landingzone_key)][var.settings.servicebus_queues.key].id : null
+  service_bus_topic_endpoint_id = can(var.settings.servicebus_topic.id) ? var.settings.servicebus_topic.id : can(var.remote_objects.servicebus_topic[try(var.settings.servicebus_topic.lz_key, var.client_config.landingzone_key)][var.settings.servicebus_topic.key].id) ? var.remote_objects.servicebus_topic[try(var.settings.servicebus_topic.lz_key, var.client_config.landingzone_key)][var.settings.servicebus_topic.key].id : null
+  expiration_time_utc           = try(var.settings.expiration_time_utc, null)
+  event_delivery_schema         = try(var.settings.event_delivery_schema, null)
+
+  dynamic "azure_function_endpoint" {
+    for_each = try(var.settings.azure_function_endpoint, null) != null ? [var.settings.azure_function_endpoint] : []
+    content {
+      function_id                       = can(azure_function_endpoint.value.function_app.id) ? azure_function_endpoint.value.function_app.id : can(var.remote_objects.functions[try(azure_function_endpoint.value.function_app.lz_key, var.client_config.landingzone_key)][azure_function_endpoint.value.function_app.key].id) ? "${var.remote_objects.functions[try(azure_function_endpoint.value.function_app.lz_key, var.client_config.landingzone_key)][azure_function_endpoint.value.function_app.key].id}/functions/${azure_function_endpoint.value.function_name}" : null
+      max_events_per_batch              = try(azure_function_endpoint.value.max_events_per_batch, null)
+      preferred_batch_size_in_kilobytes = try(azure_function_endpoint.value.preferred_batch_size_in_kilobytes, null)
+    }
+  }
+  dynamic "storage_queue_endpoint" {
+    for_each = try(var.settings.storage_queue_endpoint, null) != null ? [var.settings.storage_queue_endpoint] : []
+    content {
+      storage_account_id                    = can(storage_queue_endpoint.value.queue_endpoint.storage_account.id) ? storage_queue_endpoint.value.queue_endpoint.storage_account.id : var.remote_objects.storage_accounts[try(storage_queue_endpoint.value.storage_account.lz_key, var.client_config.landingzone_key)][storage_queue_endpoint.value.storage_account.key].id
+      queue_name                            = can(storage_queue_endpoint.value.queue.name) ? storage_queue_endpoint.value.queue.name : var.remote_objects.storage_account_queues[try(storage_queue_endpoint.value.queue.lz_key, var.client_config.landingzone_key)][storage_queue_endpoint.value.queue.key].name
+      queue_message_time_to_live_in_seconds = try(storage_queue_endpoint.value.queue_message_time_to_live_in_seconds, null)
+    }
+  }
+  dynamic "webhook_endpoint" {
+    for_each = try(var.settings.webhook_endpoint, null) != null ? [var.settings.webhook_endpoint] : []
+    content {
+      url                               = try(webhook_endpoint.value.url, null)
+      base_url                          = try(webhook_endpoint.value.base_url, null)
+      max_events_per_batch              = try(webhook_endpoint.value.max_events_per_batch, null)
+      preferred_batch_size_in_kilobytes = try(webhook_endpoint.value.preferred_batch_size_in_kilobytes, null)
+      active_directory_tenant_id        = try(webhook_endpoint.value.active_directory_tenant_id, null)
+      active_directory_app_id_or_uri    = try(webhook_endpoint.value.active_directory_app_id_or_uri, null)
+    }
+  }
+  included_event_types = try(var.settings.included_event_types, null)
+
+  dynamic "advanced_filter" {
+    for_each = try(var.settings.advanced_filter, null) != null ? [var.settings.advanced_filter] : []
+    content {
+      dynamic "bool_equals" {
+        for_each = try(var.settings.bool_equals, null) != null ? [var.settings.bool_equals] : []
+        content {
+          key   = try(bool_equals.value.subject_begins_with, null)
+          value = try(bool_equals.value.subject_ends_with, null)
+        }
+      }
+      dynamic "number_greater_than" {
+        for_each = try(var.settings.number_greater_than, null) != null ? [var.settings.number_greater_than] : []
+        content {
+          key   = try(number_greater_than.value.subject_begins_with, null)
+          value = try(number_greater_than.value.subject_ends_with, null)
+
+        }
+      }
+      dynamic "number_greater_than_or_equals" {
+        for_each = try(var.settings.number_greater_than_or_equals, null) != null ? [var.settings.number_greater_than_or_equals] : []
+        content {
+          key   = try(number_greater_than_or_equals.value.subject_begins_with, null)
+          value = try(number_greater_than_or_equals.value.subject_ends_with, null)
+        }
+      }
+      dynamic "number_less_than" {
+        for_each = try(var.settings.number_less_than, null) != null ? [var.settings.number_less_than] : []
+        content {
+          key   = try(number_less_than.value.subject_begins_with, null)
+          value = try(number_less_than.value.subject_ends_with, null)
+        }
+      }
+      dynamic "number_less_than_or_equals" {
+        for_each = try(var.settings.number_less_than_or_equals, null) != null ? [var.settings.number_less_than_or_equals] : []
+        content {
+          key   = try(number_less_than.value.number_less_than_or_equals, null)
+          value = try(number_less_than.value.number_less_than_or_equals, null)
+        }
+      }
+      dynamic "number_in" {
+        for_each = try(var.settings.number_in, null) != null ? [var.settings.number_in] : []
+        content {
+          key    = try(number_less_than.value.number_in, null)
+          values = try(number_less_than.value.number_in, null)
+        }
+      }
+      dynamic "number_not_in" {
+        for_each = try(var.settings.number_not_in, null) != null ? [var.settings.number_not_in] : []
+        content {
+          key    = try(number_less_than.value.number_not_in, null)
+          values = try(number_less_than.value.number_not_in, null)
+        }
+      }
+      dynamic "number_in_range" {
+        for_each = try(var.settings.number_in_range, null) != null ? [var.settings.number_in_range] : []
+        content {
+          key    = try(number_less_than.value.number_in_range, null)
+          values = try(number_less_than.value.number_in_range, null)
+        }
+      }
+      dynamic "number_not_in_range" {
+        for_each = try(var.settings.number_not_in_range, null) != null ? [var.settings.number_not_in_range] : []
+        content {
+          key    = try(number_less_than.value.number_not_in_range, null)
+          values = try(number_less_than.value.number_not_in_range, null)
+        }
+      }
+      dynamic "string_begins_with" {
+        for_each = try(var.settings.string_begins_with, null) != null ? [var.settings.string_begins_with] : []
+        content {
+          key    = try(number_less_than.value.string_begins_with, null)
+          values = try(number_less_than.value.string_begins_with, null)
+        }
+      }
+      dynamic "string_not_begins_with" {
+        for_each = try(var.settings.string_not_begins_with, null) != null ? [var.settings.string_not_begins_with] : []
+        content {
+          key    = try(number_less_than.value.string_not_begins_with, null)
+          values = try(number_less_than.value.string_not_begins_with, null)
+        }
+      }
+      dynamic "string_ends_with" {
+        for_each = try(var.settings.string_ends_with, null) != null ? [var.settings.string_ends_with] : []
+        content {
+          key    = try(number_less_than.value.string_ends_with, null)
+          values = try(number_less_than.value.string_ends_with, null)
+        }
+      }
+      dynamic "string_not_ends_with" {
+        for_each = try(var.settings.string_not_ends_with, null) != null ? [var.settings.string_not_ends_with] : []
+        content {
+          key    = try(number_less_than.value.string_not_ends_with, null)
+          values = try(number_less_than.value.string_not_ends_with, null)
+        }
+      }
+      dynamic "string_contains" {
+        for_each = try(var.settings.string_contains, null) != null ? [var.settings.string_contains] : []
+        content {
+          key    = try(number_less_than.value.string_contains, null)
+          values = try(number_less_than.value.string_contains, null)
+        }
+      }
+      dynamic "string_not_contains" {
+        for_each = try(var.settings.string_not_contains, null) != null ? [var.settings.string_not_contains] : []
+        content {
+          key    = try(number_less_than.value.string_not_contains, null)
+          values = try(number_less_than.value.string_not_contains, null)
+        }
+      }
+      dynamic "string_in" {
+        for_each = try(var.settings.string_in, null) != null ? [var.settings.string_in] : []
+        content {
+          key    = try(number_less_than.value.string_in, null)
+          values = try(number_less_than.value.string_in, null)
+        }
+      }
+      dynamic "string_not_in" {
+        for_each = try(var.settings.string_not_in, null) != null ? [var.settings.string_not_in] : []
+        content {
+          key    = try(number_less_than.value.string_not_in, null)
+          values = try(number_less_than.value.string_not_in, null)
+        }
+      }
+      dynamic "is_not_null" {
+        for_each = try(var.settings.is_not_null, null) != null ? [var.settings.is_not_null] : []
+        content {
+          key = try(number_less_than.value.is_not_null, null)
+        }
+      }
+      dynamic "is_null_or_undefined" {
+        for_each = try(var.settings.is_null_or_undefined, null) != null ? [var.settings.is_null_or_undefined] : []
+        content {
+          key = try(number_less_than.value.is_null_or_undefined, null)
+        }
+      }
+    }
+  }
+  dynamic "delivery_identity" {
+    for_each = try(var.settings.delivery_identity, null) != null ? [var.settings.delivery_identity] : []
+    content {
+      type                   = try(delivery_identity.value.type, null)
+      user_assigned_identity = try(delivery_identity.value.user_assigned_identity, null)
+    }
+  }
+  dynamic "delivery_property" {
+    for_each = try(var.settings.delivery_property, null) != null ? [var.settings.delivery_property] : []
+    content {
+      header_name  = try(delivery_property.value.header_name, null)
+      type         = try(delivery_property.value.type, null)
+      value        = try(delivery_property.value.value, null)
+      source_field = try(delivery_property.value.source_field, null)
+      secret       = try(delivery_property.value.secret, null)
+    }
+  }
+  dynamic "dead_letter_identity" {
+    for_each = try(var.settings.dead_letter_identity, null) != null ? [var.settings.dead_letter_identity] : []
+    content {
+      type                   = try(dead_letter_identity.value.type, null)
+      user_assigned_identity = try(dead_letter_identity.value.user_assigned_identity, null)
+    }
+  }
+  dynamic "storage_blob_dead_letter_destination" {
+    for_each = try(var.settings.storage_blob_dead_letter_destination, null) != null ? [var.settings.storage_blob_dead_letter_destination] : []
+    content {
+      storage_account_id          = try(storage_blob_dead_letter_destination.value.storage_account_id, null)
+      storage_blob_container_name = try(storage_blob_dead_letter_destination.value.storage_blob_container_name, null)
+    }
+  }
+  dynamic "storage_blob_dead_letter_destination" {
+    for_each = try(var.settings.storage_blob_dead_letter_destination, null) != null ? [var.settings.storage_blob_dead_letter_destination] : []
+    content {
+      storage_account_id          = try(storage_blob_dead_letter_destination.value.storage_account_id, null)
+      storage_blob_container_name = try(storage_blob_dead_letter_destination.value.storage_blob_container_name, null)
+    }
+  }
+  dynamic "retry_policy" {
+    for_each = try(var.settings.retry_policy, null) != null ? [var.settings.retry_policy] : []
+    content {
+      max_delivery_attempts = try(retry_policy.value.max_delivery_attempts, null)
+      event_time_to_live    = try(retry_policy.value.event_time_to_live, null)
+    }
+  }
+  labels                               = try(var.settings.labels, null)
+  advanced_filtering_on_arrays_enabled = try(var.settings.advanced_filtering_on_arrays_enabled, null)
+}
diff --git a/modules/messaging/eventgrid/eventgrid_system_event_subscription/output.tf b/modules/messaging/eventgrid/eventgrid_system_event_subscription/output.tf
new file mode 100644
index 0000000000..979f441b76
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_event_subscription/output.tf
@@ -0,0 +1,4 @@
+output "id" {
+  value       = azurerm_eventgrid_system_topic_event_subscription.eges.id
+  description = "The ID of the EventGrid System Event Subscription."
+}
diff --git a/modules/messaging/eventgrid/eventgrid_system_event_subscription/variables.tf b/modules/messaging/eventgrid/eventgrid_system_event_subscription/variables.tf
new file mode 100644
index 0000000000..b9514b9172
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_event_subscription/variables.tf
@@ -0,0 +1,18 @@
+variable "global_settings" {
+  description = "Global settings object"
+}
+variable "client_config" {
+  description = "Client configuration object."
+}
+variable "settings" {
+  description = "(Required) Used to handle passthrough paramenters."
+}
+variable "remote_objects" {
+  description = "(Required) Specifies the supported Azure location where to create the resource. Changing this forces a new resource to be created."
+  default     = {}
+}
+variable "base_tags" {
+  description = "Base tags for the resource to be inherited from the resource group."
+  type        = map(any)
+  default     = {}
+}
diff --git a/modules/messaging/eventgrid/eventgrid_system_topic/main.tf b/modules/messaging/eventgrid/eventgrid_system_topic/main.tf
new file mode 100644
index 0000000000..836b88d404
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_topic/main.tf
@@ -0,0 +1,14 @@
+terraform {
+  required_providers {
+    azurecaf = {
+      source = "aztfmod/azurecaf"
+    }
+  }
+
+}
+locals {
+  module_tag = {
+    "module" = basename(abspath(path.module))
+  }
+  tags = merge(var.base_tags, local.module_tag, try(var.settings.tags, null))
+}
diff --git a/modules/messaging/eventgrid/eventgrid_system_topic/module.tf b/modules/messaging/eventgrid/eventgrid_system_topic/module.tf
new file mode 100644
index 0000000000..eb281653dd
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_topic/module.tf
@@ -0,0 +1,52 @@
+resource "azurecaf_name" "egt" {
+  name          = var.settings.name
+  resource_type = "azurerm_eventgrid_topic"
+  prefixes      = var.global_settings.prefixes
+  random_length = var.global_settings.random_length
+  clean_input   = true
+  passthrough   = var.global_settings.passthrough
+  use_slug      = var.global_settings.use_slug
+}
+
+resource "azurerm_eventgrid_system_topic" "egt" {
+  name                = azurecaf_name.egt.result
+  resource_group_name = can(var.settings.resource_group.name) ? var.settings.resource_group.name : var.remote_objects.resource_groups[try(var.settings.resource_group.lz_key, var.client_config.landingzone_key)][var.settings.resource_group.key].name
+  location            = var.location
+
+  source_arm_resource_id = try(
+    var.settings.source_resource_id,
+    var.remote_objects[var.settings.source_resource.type][try(var.settings.source_resource.lz_key, var.client_config.landingzone_key)][var.settings.source_resource.key].id,
+    null
+  )
+
+  # topic_type can be one of these, more resource types can be supported
+  # Microsoft.AppConfiguration.ConfigurationStores
+  # Microsoft.Communication.CommunicationServices
+  # Microsoft.ContainerRegistry.Registries
+  # Microsoft.Devices.IoTHubs
+  # Microsoft.EventGrid.Domains
+  # Microsoft.EventGrid.Topics
+  # Microsoft.Eventhub.Namespaces
+  # Microsoft.KeyVault.vaults
+  # Microsoft.MachineLearningServices.Workspaces
+  # Microsoft.Maps.Accounts
+  # Microsoft.Media.MediaServices
+  # Microsoft.Resources.ResourceGroups
+  # Microsoft.Resources.Subscriptions
+  # Microsoft.ServiceBus.Namespaces
+  # Microsoft.SignalRService.SignalR
+  # Microsoft.Storage.StorageAccounts
+  # Microsoft.Web.ServerFarms
+  # Microsoft.Web.Sites
+  topic_type = var.settings.topic_type
+
+  dynamic "identity" {
+    for_each = try(var.settings.identity, null) != null ? [var.settings.identity] : []
+    content {
+      type         = try(identity.value.type, null)
+      identity_ids = try(identity.value.identity_ids, null)
+    }
+  }
+
+  tags = local.tags
+}
diff --git a/modules/messaging/eventgrid/eventgrid_system_topic/output.tf b/modules/messaging/eventgrid/eventgrid_system_topic/output.tf
new file mode 100644
index 0000000000..8306f0555f
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_topic/output.tf
@@ -0,0 +1,12 @@
+output "id" {
+  value       = azurerm_eventgrid_system_topic.egt.id
+  description = "The EventGrid System Topic ID."
+}
+output "name" {
+  value       = azurerm_eventgrid_system_topic.egt.name
+  description = "The EventGrid System Topic Name."
+}
+output "identity" {
+  value       = azurerm_eventgrid_system_topic.egt.identity
+  description = "An `identity` block as defined below, which contains the Managed Service Identity information for this Event Grid System Topic."
+}
diff --git a/modules/messaging/eventgrid/eventgrid_system_topic/variables.tf b/modules/messaging/eventgrid/eventgrid_system_topic/variables.tf
new file mode 100644
index 0000000000..62afdf0290
--- /dev/null
+++ b/modules/messaging/eventgrid/eventgrid_system_topic/variables.tf
@@ -0,0 +1,22 @@
+variable "global_settings" {
+  description = "Global settings object"
+}
+variable "client_config" {
+  description = "Client configuration object."
+}
+variable "settings" {
+  description = "(Required) Used to handle passthrough paramenters."
+}
+variable "remote_objects" {
+  description = "(Required) Specifies the supported Azure location where to create the resource. Changing this forces a new resource to be created."
+  default     = {}
+}
+variable "base_tags" {
+  description = "Base tags for the resource to be inherited from the resource group."
+  type        = map(any)
+  default     = {}
+}
+variable "location" {
+  description = "Specifies the supported Azure location where to create the resource. Changing this forces a new resource to be created."
+  default     = null
+}

From d1c6e0970166ba26792ba54315c86c5bb0b94df8 Mon Sep 17 00:00:00 2001
From: GitHub Action <action@github.com>
Date: Wed, 11 Sep 2024 12:06:22 +0000
Subject: [PATCH 6/6] Apply terraform fmt

---
 .../configuration.tfvars                                      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars b/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars
index be32857be7..a8a7b91a7e 100644
--- a/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars
+++ b/examples/azuread/107-azuread-application-with-single-page-application/configuration.tfvars
@@ -56,8 +56,8 @@ azuread_applications = {
           admin_consent_description  = "Allow to administer app2."
           admin_consent_display_name = "Administer app2"
           enabled                    = true
-          type  = "Admin"
-          value = "app2"
+          type                       = "Admin"
+          value                      = "app2"
         }
       ]
     }