Terraform on Azure: state management, modules and workspaces

Terraform (HashiCorp) is the most adopted IaC tool in multi-cloud environments. On Azure it competes directly with Bicep — the choice depends on context: Terraform for multi-cloud or already-experienced teams, Bicep for Azure-only with maximum integration.

Azure provider and authentication

terraform {
  required_providers {
    azurerm = { source = "hashicorp/azurerm", version = "~> 3.85" }
  }
  backend "azurerm" {
    resource_group_name  = "rg-terraform-state"
    storage_account_name = "staterraformstate"
    container_name       = "tfstate"
    key                  = "analytics-prod.tfstate"
  }
}

provider "azurerm" {
  features {}
  # Uses ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID, ARM_SUBSCRIPTION_ID
  # via env vars (never hardcoded)
}

Basic resources

variable "environment" { type = string }
variable "location"    { type = string, default = "westeurope" }

locals {
  prefix = "bconcepts-${var.environment}"
}

resource "azurerm_resource_group" "main" {
  name     = "rg-analytics-${var.environment}"
  location = var.location
}

resource "azurerm_storage_account" "datalake" {
  name                     = "sta${replace(local.prefix, "-", "")}"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  is_hns_enabled           = true    # ADLS Gen2
}

Reusable modules

# modules/keyvault/main.tf
variable "name"     {}
variable "rg_name"  {}
variable "location" {}

resource "azurerm_key_vault" "this" {
  name                = var.name
  resource_group_name = var.rg_name
  location            = var.location
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "standard"
  enable_rbac_authorization = true
  soft_delete_retention_days = 90
}

# Use the module:
module "keyvault" {
  source   = "./modules/keyvault"
  name     = "kv-${local.prefix}"
  rg_name  = azurerm_resource_group.main.name
  location = var.location
}

Workspaces for multi-environment

terraform workspace new dev
terraform workspace new prod

terraform workspace select dev
terraform apply -var="environment=dev"

terraform workspace select prod
terraform apply -var="environment=prod"

Conclusion

Terraform with remote state in Azure Blob Storage is the standard for teams managing multi-cloud infrastructure or who prefer HCL over Bicep. Remote state with locking prevents conflicts in parallel deploys and keeps the infrastructure change history auditable.