Working with Azure Provider
1. Configuring Azure Provider
| Property | Description | Example Value | Notes |
|---|---|---|---|
| subscription_id | Subscription ID for the Azure account | "12345678-1234-1234-1234-123456789012" |
Required for authentication |
| client_id | Service Principal client ID | "abcd1234-ef56-7890-abcd-ef1234567890" |
Required for service principal auth |
| client_secret | Service Principal client secret | "secret-key" |
Required for service principal auth |
| tenant_id | Azure tenant ID | "12345678-1234-1234-1234-123456789012" |
Required for service principal auth |
| environment | Azure environment (e.g., public, government) | "public" |
Defaults to "public" |
Example: Basic Azure Provider Configuration
provider "azurerm" {
subscription_id = "12345678-1234-1234-1234-123456789012"
client_id = "abcd1234-ef56-7890-abcd-ef1234567890"
client_secret = "secret-key"
tenant_id = "12345678-1234-1234-1234-123456789012"
environment = "public"
}
Note: Ensure that the service principal has appropriate permissions to manage resources in the specified subscription.
2. Using Azure Authentication
| Method | Description | Configuration | Notes |
|---|---|---|---|
| Service Principal with Client Secret | Authenticates using a service principal with client secret credentials. | {<br> "client_id": "<service-principal-client-id>",<br> "client_secret": "<service-principal-client-secret>",<br> "tenant_id": "<tenant-id>"<br>} |
Requires Azure AD application registration |
| Service Principal with Certificate | Authenticates using a service principal with certificate credentials. | {<br> "client_id": "<service-principal-client-id>",<br> "certificate_path": "/path/to/certificate.pfx",<br> "tenant_id": "<tenant-id>"<br>} |
Requires certificate file and private key |
| Managed Identity | Uses Azure Managed Identity for authentication. | {<br> "use_msi": true,<br> "tenant_id": "<tenant-id>"<br>} |
Works in Azure environments (VMs, App Services, etc.) |
| Azure CLI | Uses Azure CLI login session for authentication. | {<br> "use_azure_cli": true<br>} |
Requires az login to be run locally |
Example: Service Principal with Client Secret
provider "azurerm" {<br> features {}<br> client_id = "<service-principal-client-id>"<br> client_secret = "<service-principal-client-secret>"<br> tenant_id = "<tenant-id>"<br>}
Note: Ensure the authentication method matches your deployment environment and security requirements.
3. Managing Azure Resources
| Resource Type | Properties | Description | Required |
|---|---|---|---|
| azurerm_resource_group | name, location |
Manages an Azure Resource Group | Yes |
| azurerm_virtual_machine | name, resource_group_name, location, size |
Manages a Virtual Machine in Azure | Yes |
| azurerm_storage_account | name, resource_group_name, location, tier |
Manages a Storage Account in Azure | Yes |
Example: Create a Resource Group
resource "azurerm_resource_group" "example" {
name = "production-resources"
location = "East US"
}
Example: Create a Virtual Machine
resource "azurerm_virtual_machine" "example" {
name = "my-vm"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
size = "Standard_B1s"
}
Example: Create a Storage Account
resource "azurerm_storage_account" "example" {
name = "examplestorageaccount"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "LRS"
}
Note: Ensure that the Azure subscription is properly configured and the required permissions are in place to manage resources.
4. Using Azure Data Sources
| Property | Description | Example |
|---|---|---|
| azurerm_client_config | Retrieves the client configuration for the current Azure provider | data "azurerm_client_config" "current" {} |
| azurerm_subscription | Retrieves the subscription details for the current Azure provider | data "azurerm_subscription" "current" {} |
| azurerm_resource_group | Retrieves details of an existing resource group | |
| azurerm_virtual_network | Retrieves details of an existing virtual network | |
| azurerm_key_vault | Retrieves details of an existing Key Vault | |
Example: Using Azure Client Config
data "azurerm_client_config" "current" {}
output "current_tenant_id" {
value = data.azurerm_client_config.current.tenant_id
}
output "current_subscription_id" {
value = data.azurerm_client_config.current.subscription_id
}
Example: Using Azure Resource Group
data "azurerm_resource_group" "example" {
name = "production-rg"
}
output "resource_group_location" {
value = data.azurerm_resource_group.example.location
}
Note: Data sources in Terraform are read-only and do not create or modify any Azure resources.
5. Configuring Multiple Subscriptions
| Option | Values | Notes |
|---|---|---|
| subscription_id | string |
ID of the Azure subscription to use |
| tenant_id | string |
ID of the Azure AD tenant to use |
| client_id | string |
Service Principal client ID |
| client_secret | string |
Service Principal client secret |
Example: Multiple Subscriptions Configuration
provider "azurerm" {
features {}
subscription_id = "12345678-1234-1234-1234-123456789012"
tenant_id = "12345678-1234-1234-1234-123456789012"
client_id = "12345678-1234-1234-1234-123456789012"
client_secret = "secret-value-here"
}
Note: For production use, avoid hardcoding credentials. Use Azure Key Vault or environment variables.
Subscription Management Best Practices
- Use separate service principals for each subscription to isolate permissions
- Store credentials securely using Azure Key Vault or Terraform Cloud variables
- Use
subscription_idto explicitly target a specific subscription
6. Managing Azure Tags
| Property | Description | Example |
|---|---|---|
| tags | Map of key-value pairs to assign as tags | { Environment = "prod", Project = "webapp" } |
Example: Assigning Tags to Azure Resource
resource "azurerm_resource_group" "example" {
name = "production-rg"
location = "East US"
tags = {
Environment = "production"
CostCenter = "12345"
}
}
Note: Azure tags are case-sensitive and support special characters in values.
Example: Using Tags in Data Sources
data "azurerm_resource_group" "example" {
name = "production-rg"
tags = {
Environment = "production"
}
}
Example: Tag Inheritance from Parent
resource "azurerm_resource_group" "example" {
name = "production-rg"
location = "East US"
tags = {
Environment = "production"
Owner = "team-ops"
}
}
resource "azurerm_storage_account" "example" {
name = "examplestorage"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
tags = {
# Inherits Environment and Owner from parent
CostCenter = "12345"
}
}
7. Using Azure-Specific Features
| Feature | Description | Usage | Notes |
|---|---|---|---|
| Azure AD Application | Authentication using Azure Active Directory application | client_id = "your-client-id" |
Requires client_secret or client_certificate |
| Managed Identity | Use Azure Managed Identity for authentication | use_msi = true |
Applicable in Azure environments like VMs or App Services |
| Service Principal | Authentication via service principal with secret | client_id = "your-client-id" |
Requires client_secret or client_certificate |
| Azure CLI | Use Azure CLI for authentication | use_cli = true |
Requires Azure CLI to be installed and logged in |
Example: Using Azure AD Application
provider "azurerm" {
features {}
client_id = "your-client-id"
client_secret = "your-client-secret"
tenant_id = "your-tenant-id"
}
Note: Ensure that the Azure AD application or managed identity has appropriate permissions to manage resources in the target subscription.
Key Azure-Specific Features
- Azure AD Application for secure authentication with client ID and secret.
- Managed Identity for seamless authentication in Azure services.
- Service Principal for automation and CI/CD pipelines.
- Azure CLI for local development and testing.
8. Configuring Azure Blob Backend
| Property | Description | Example Value |
|---|---|---|
| storage_account_name | Name of the Azure Storage account | myterraformstorage |
| container_name | Name of the blob container to use for state storage | tfstate |
| key | Path to the state file within the blob container | prod/terraform.tfstate |
| access_key | Storage account access key (not recommended for production) | ... |
| sas_token | SAS token for authentication (recommended over access key) | sv=2021-08-03&ss=bfqt&srt=sco&sp=rwdlacupitfx&se=2025-06-15T08:00:00Z&st=2024-06-15T07:00:00Z&spr=https&sig=... |
| use_azuread_authentication | Use Azure AD authentication instead of keys or SAS tokens | true |
Example: Basic Azure Blob Backend Configuration
terraform {
backend "azurerm" {
storage_account_name = "myterraformstorage"
container_name = "tfstate"
key = "prod/terraform.tfstate"
access_key = "<storage-account-access-key>"
}
}
Example: Using Azure AD Authentication
terraform {
backend "azurerm" {
storage_account_name = "myterraformstorage"
container_name = "tfstate"
key = "prod/terraform.tfstate"
use_azuread_authentication = true
}
}
Note: Ensure the storage account has the necessary permissions for Terraform to read and write state files. Using SAS tokens or Azure AD authentication is recommended over storing access keys in version control.
9. Using Azure Key Vault
| Property | Description | Example | Notes |
|---|---|---|---|
| azure_key_vault_secret | Resource to manage a secret in Azure Key Vault | |
Used to store sensitive data securely in Azure Key Vault |
| azure_key_vault_secret_version | Resource to manage a version of a secret in Azure Key Vault | |
Allows managing specific versions of secrets |
Example: Accessing Azure Key Vault Secret in a VM
resource "azurerm_virtual_machine" "my_vm" {
name = "my-vm"
resource_group_name = azurerm_resource_group.my_rg.name
location = azurerm_resource_group.my_rg.location
# Use Azure Key Vault secret for password
os_profile {
admin_username = "adminuser"
admin_password = azurerm_key_vault_secret.my_secret.value
}
}
Note: Ensure that the service principal or managed identity has appropriate permissions to access the Key Vault.
Warning: Never hardcode secrets in Terraform files. Always use Azure Key Vault or similar secure storage solutions.
10. Handling Azure API Limits
| Limit Type | Description | Recommended Action |
|---|---|---|
| Throttling Limits | Azure REST API has rate limits (e.g., 1200 requests per hour for read operations) | Implement exponential backoff with retry logic in your Terraform scripts |
| Concurrent Operations | Max concurrent operations per subscription (e.g., 200) | Use max_concurrent_requests in provider configuration to control concurrency |
Example: Configuring Azure Provider with Retry Logic
provider "azurerm" {
features {
resource_group {
prevent_deletion_if_contains_resources = true
}
}
# Retry configuration to handle API limits
retry {
max_retries = 5
delay = "10s"
}
}
Note: Azure API limits can cause
429 Too Many Requests errors. Implementing retries with exponential backoff helps avoid these.
Warning: Excessive retries without proper delay can lead to hitting Azure's rate limits more quickly.