Skip to main content

Working with Azure Provider

1. Configuring Azure Provider

Property Description Example Value Notes
subscription_id Subscription ID for the Azure account "12345678-1234-1234-1234-123456789012" Required for authentication
client_id Service Principal client ID "abcd1234-ef56-7890-abcd-ef1234567890" Required for service principal auth
client_secret Service Principal client secret "secret-key" Required for service principal auth
tenant_id Azure tenant ID "12345678-1234-1234-1234-123456789012" Required for service principal auth
environment Azure environment (e.g., public, government) "public" Defaults to "public"

Example: Basic Azure Provider Configuration

provider "azurerm" {
  subscription_id = "12345678-1234-1234-1234-123456789012"
  client_id       = "abcd1234-ef56-7890-abcd-ef1234567890"
  client_secret   = "secret-key"
  tenant_id       = "12345678-1234-1234-1234-123456789012"
  environment     = "public"
}
Note: Ensure that the service principal has appropriate permissions to manage resources in the specified subscription.

2. Using Azure Authentication

Method Description Configuration Notes
Service Principal with Client Secret Authenticates using a service principal with client secret credentials. {<br> "client_id": "<service-principal-client-id>",<br> "client_secret": "<service-principal-client-secret>",<br> "tenant_id": "<tenant-id>"<br>} Requires Azure AD application registration
Service Principal with Certificate Authenticates using a service principal with certificate credentials. {<br> "client_id": "<service-principal-client-id>",<br> "certificate_path": "/path/to/certificate.pfx",<br> "tenant_id": "<tenant-id>"<br>} Requires certificate file and private key
Managed Identity Uses Azure Managed Identity for authentication. {<br> "use_msi": true,<br> "tenant_id": "<tenant-id>"<br>} Works in Azure environments (VMs, App Services, etc.)
Azure CLI Uses Azure CLI login session for authentication. {<br> "use_azure_cli": true<br>} Requires az login to be run locally

Example: Service Principal with Client Secret

provider "azurerm" {<br>  features {}<br>  client_id       = "<service-principal-client-id>"<br>  client_secret   = "<service-principal-client-secret>"<br>  tenant_id       = "<tenant-id>"<br>}

Example: Using Azure CLI

provider "azurerm" {<br>  features {}<br>  use_azure_cli = true<br>}
Note: Ensure the authentication method matches your deployment environment and security requirements.

3. Managing Azure Resources

Resource Type Properties Description Required
azurerm_resource_group name, location Manages an Azure Resource Group Yes
azurerm_virtual_machine name, resource_group_name, location, size Manages a Virtual Machine in Azure Yes
azurerm_storage_account name, resource_group_name, location, tier Manages a Storage Account in Azure Yes

Example: Create a Resource Group

resource "azurerm_resource_group" "example" {
  name     = "production-resources"
  location = "East US"
}

Example: Create a Virtual Machine

resource "azurerm_virtual_machine" "example" {
  name                = "my-vm"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  size                = "Standard_B1s"
}

Example: Create a Storage Account

resource "azurerm_storage_account" "example" {
  name                = "examplestorageaccount"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  account_tier        = "Standard"
  account_replication_type = "LRS"
}
Note: Ensure that the Azure subscription is properly configured and the required permissions are in place to manage resources.

4. Using Azure Data Sources

Property Description Example
azurerm_client_config Retrieves the client configuration for the current Azure provider data "azurerm_client_config" "current" {}
azurerm_subscription Retrieves the subscription details for the current Azure provider data "azurerm_subscription" "current" {}
azurerm_resource_group Retrieves details of an existing resource group
data "azurerm_resource_group" "example" {
  name = "production-rg"
}
azurerm_virtual_network Retrieves details of an existing virtual network
data "azurerm_virtual_network" "example" {
  name                = "production-vnet"
  resource_group_name = azurerm_resource_group.example.name
}
azurerm_key_vault Retrieves details of an existing Key Vault
data "azurerm_key_vault" "example" {
  name                = "production-keyvault"
  resource_group_name = azurerm_resource_group.example.name
}

Example: Using Azure Client Config

data "azurerm_client_config" "current" {}

output "current_tenant_id" {
  value = data.azurerm_client_config.current.tenant_id
}

output "current_subscription_id" {
  value = data.azurerm_client_config.current.subscription_id
}

Example: Using Azure Resource Group

data "azurerm_resource_group" "example" {
  name = "production-rg"
}

output "resource_group_location" {
  value = data.azurerm_resource_group.example.location
}
Note: Data sources in Terraform are read-only and do not create or modify any Azure resources.

5. Configuring Multiple Subscriptions

Option Values Notes
subscription_id string ID of the Azure subscription to use
tenant_id string ID of the Azure AD tenant to use
client_id string Service Principal client ID
client_secret string Service Principal client secret

Example: Multiple Subscriptions Configuration

provider "azurerm" {
  features {}
  subscription_id = "12345678-1234-1234-1234-123456789012"
  tenant_id       = "12345678-1234-1234-1234-123456789012"
  client_id       = "12345678-1234-1234-1234-123456789012"
  client_secret   = "secret-value-here"
}
Note: For production use, avoid hardcoding credentials. Use Azure Key Vault or environment variables.

Subscription Management Best Practices

  • Use separate service principals for each subscription to isolate permissions
  • Store credentials securely using Azure Key Vault or Terraform Cloud variables
  • Use subscription_id to explicitly target a specific subscription

6. Managing Azure Tags

Property Description Example
tags Map of key-value pairs to assign as tags { Environment = "prod", Project = "webapp" }

Example: Assigning Tags to Azure Resource

resource "azurerm_resource_group" "example" {
  name     = "production-rg"
  location = "East US"

  tags = {
    Environment = "production"
    CostCenter  = "12345"
  }
}
Note: Azure tags are case-sensitive and support special characters in values.

Example: Using Tags in Data Sources

data "azurerm_resource_group" "example" {
  name = "production-rg"

  tags = {
    Environment = "production"
  }
}

Example: Tag Inheritance from Parent

resource "azurerm_resource_group" "example" {
  name     = "production-rg"
  location = "East US"

  tags = {
    Environment = "production"
    Owner       = "team-ops"
  }
}

resource "azurerm_storage_account" "example" {
  name                     = "examplestorage"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location

  tags = {
    # Inherits Environment and Owner from parent
    CostCenter = "12345"
  }
}

7. Using Azure-Specific Features

Feature Description Usage Notes
Azure AD Application Authentication using Azure Active Directory application client_id = "your-client-id" Requires client_secret or client_certificate
Managed Identity Use Azure Managed Identity for authentication use_msi = true Applicable in Azure environments like VMs or App Services
Service Principal Authentication via service principal with secret client_id = "your-client-id" Requires client_secret or client_certificate
Azure CLI Use Azure CLI for authentication use_cli = true Requires Azure CLI to be installed and logged in

Example: Using Azure AD Application

provider "azurerm" {
  features {}
  client_id       = "your-client-id"
  client_secret   = "your-client-secret"
  tenant_id       = "your-tenant-id"
}

Example: Using Managed Identity

provider "azurerm" {
  features {}
  use_msi = true
}
Note: Ensure that the Azure AD application or managed identity has appropriate permissions to manage resources in the target subscription.

Key Azure-Specific Features

  • Azure AD Application for secure authentication with client ID and secret.
  • Managed Identity for seamless authentication in Azure services.
  • Service Principal for automation and CI/CD pipelines.
  • Azure CLI for local development and testing.

8. Configuring Azure Blob Backend

Property Description Example Value
storage_account_name Name of the Azure Storage account myterraformstorage
container_name Name of the blob container to use for state storage tfstate
key Path to the state file within the blob container prod/terraform.tfstate
access_key Storage account access key (not recommended for production) ...
sas_token SAS token for authentication (recommended over access key) sv=2021-08-03&ss=bfqt&srt=sco&sp=rwdlacupitfx&se=2025-06-15T08:00:00Z&st=2024-06-15T07:00:00Z&spr=https&sig=...
use_azuread_authentication Use Azure AD authentication instead of keys or SAS tokens true

Example: Basic Azure Blob Backend Configuration

terraform {
  backend "azurerm" {
    storage_account_name = "myterraformstorage"
    container_name       = "tfstate"
    key                  = "prod/terraform.tfstate"
    access_key           = "<storage-account-access-key>"
  }
}

Example: Using Azure AD Authentication

terraform {
  backend "azurerm" {
    storage_account_name = "myterraformstorage"
    container_name       = "tfstate"
    key                  = "prod/terraform.tfstate"
    use_azuread_authentication = true
  }
}
Note: Ensure the storage account has the necessary permissions for Terraform to read and write state files. Using SAS tokens or Azure AD authentication is recommended over storing access keys in version control.

9. Using Azure Key Vault

Property Description Example Notes
azure_key_vault_secret Resource to manage a secret in Azure Key Vault
resource "azurerm_key_vault_secret" "my_secret" {
  name         = "my-secret"
  value        = "secret-value"
  key_vault_id = azurerm_key_vault.my_vault.id
}
Used to store sensitive data securely in Azure Key Vault
azure_key_vault_secret_version Resource to manage a version of a secret in Azure Key Vault
resource "azurerm_key_vault_secret_version" "my_secret_version" {
  name         = "my-secret-version"
  value        = "secret-value"
  key_vault_id = azurerm_key_vault.my_vault.id
}
Allows managing specific versions of secrets

Example: Accessing Azure Key Vault Secret in a VM

resource "azurerm_virtual_machine" "my_vm" {
  name                = "my-vm"
  resource_group_name = azurerm_resource_group.my_rg.name
  location            = azurerm_resource_group.my_rg.location

  # Use Azure Key Vault secret for password
  os_profile {
    admin_username = "adminuser"
    admin_password = azurerm_key_vault_secret.my_secret.value
  }
}
Note: Ensure that the service principal or managed identity has appropriate permissions to access the Key Vault.
Warning: Never hardcode secrets in Terraform files. Always use Azure Key Vault or similar secure storage solutions.

10. Handling Azure API Limits

Limit Type Description Recommended Action
Throttling Limits Azure REST API has rate limits (e.g., 1200 requests per hour for read operations) Implement exponential backoff with retry logic in your Terraform scripts
Concurrent Operations Max concurrent operations per subscription (e.g., 200) Use max_concurrent_requests in provider configuration to control concurrency

Example: Configuring Azure Provider with Retry Logic

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = true
    }
  }

  # Retry configuration to handle API limits
  retry {
    max_retries = 5
    delay       = "10s"
  }
}
Note: Azure API limits can cause 429 Too Many Requests errors. Implementing retries with exponential backoff helps avoid these.
Warning: Excessive retries without proper delay can lead to hitting Azure's rate limits more quickly.

Was this article helpful?