`azure-backend` Experiment: Add support for configuring minimum TLS version on bootstrapped storage accounts. Update default TLS version to `TLS1_2`.

Describe the Enhancement

As a user of Terragrunt with an azurerm backend block, I would like more control over how a bootstrapped storage account is provisioned. In particular, I want the ability to change the TLS version to something else, to adhere to say, an organization's Azure Policy restriction.

In addition, since Azure has deprecated TLS versions TLS1_0 and TLS1_1 on all Azure resources since August 2025, I'd recommend also changing the default TLS version to at least TLS1_2, from the current TLS1_0.

Additional context

Implications

• Adding more support for specific fields on the bootstrapped storage account than just the bare minimum may trend development towards recreating the azurerm_storage_account Terraform module logic. This change is simple and self-contained, but a future where the full storage account feature set is requested is not avoided by letting this issue proceed.

Alternatives

• Just setting the default TLS versions to TLS1_2 and not providing an option for users to change it will realistically fulfill 95% of bootstrap use cases that even touch TLS for the foreseeable future.

Level of Effort / Changes Required

• Just updating defaults: Low. It seems to me all that would have to change is the contents of this WithDefaults() function call before we send our data to the armstorage library: https://github.com/gruntwork-io/terragrunt/blob/main/internal/azurehelper/storage_account.go#L378. Most likely, the addition of a MinimumTLSVersion field to the StorageAccountConfig object.
• Adding an additional parameter: Low. More changes will have to be made to remotestate/backend/azurerm/remote_state_config.go to add support for a new field, which will then get interpretted, validated, and passed along to azurehelper/storage_account. Docs will have to updated to denote the new field.

PoC (Proof of Concept)

Example Usage of New Field:

remote_state {
  backend = "azurerm"
  config = {
    storage_account_name = "myterragruntstate"
    skip_storage_account_creation = false
    ...
    # NEW FIELD
    minimum_tls_version = "TLS1_2" # Available options: `TLS1_2, TLS1_3`. Defaults to `TLS1_2`
  }
}

> terragrunt backend bootstrap --experiment azure-backend Provisions an Azure storage account with minimum TLS version set to TLS1_2.

RFC Not Needed

• I have evaluated the complexity of this enhancement, and I believe it does not require an RFC.

Links:

1. Azure TLS 1.0 and 1.1 deprecation announcement: https://azure.microsoft.com/en-us/updates?id=update-retirement-tls1-0-tls1-1-versions-azure-services
2. Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage library docs for accepted MinimumTLSVersion values: https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage#MinimumTLSVersion (note: "The default interpretation is TLS 1.0 for this property.")