Terraform en Azure: state management, módulos y workspaces

Terraform (HashiCorp) es la herramienta de IaC más adoptada en entornos multi-cloud. En Azure compite directamente con Bicep — la elección depende del contexto: Terraform para multi-cloud o equipos ya experimentados, Bicep para Azure-only con la máxima integración.

Provider Azure y autenticación

terraform {
  required_providers {
    azurerm = { source = "hashicorp/azurerm", version = "~> 3.85" }
  }
  backend "azurerm" {
    resource_group_name  = "rg-terraform-state"
    storage_account_name = "staterraformstate"
    container_name       = "tfstate"
    key                  = "analytics-prod.tfstate"
  }
}

provider "azurerm" {
  features {}
  # Usa ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID, ARM_SUBSCRIPTION_ID
  # vía env vars (nunca hardcoded)
}

Recursos básicos

variable "environment" { type = string }
variable "location"    { type = string, default = "westeurope" }

locals {
  prefix = "bconcepts-${var.environment}"
}

resource "azurerm_resource_group" "main" {
  name     = "rg-analytics-${var.environment}"
  location = var.location
}

resource "azurerm_storage_account" "datalake" {
  name                     = "sta${replace(local.prefix, "-", "")}"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  is_hns_enabled           = true    # ADLS Gen2
}

Módulos reutilizables

# modules/keyvault/main.tf
variable "name"     {}
variable "rg_name"  {}
variable "location" {}

resource "azurerm_key_vault" "this" {
  name                = var.name
  resource_group_name = var.rg_name
  location            = var.location
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "standard"
  enable_rbac_authorization = true
  soft_delete_retention_days = 90
}

# Usar el módulo:
module "keyvault" {
  source   = "./modules/keyvault"
  name     = "kv-${local.prefix}"
  rg_name  = azurerm_resource_group.main.name
  location = var.location
}

Workspaces para multi-entorno

terraform workspace new dev
terraform workspace new prod

terraform workspace select dev
terraform apply -var="environment=dev"

terraform workspace select prod
terraform apply -var="environment=prod"

Conclusión

Terraform con remote state en Azure Blob Storage es el estándar para equipos que gestionan infraestructura multi-cloud o que prefieren HCL a Bicep. El state remoto con locking evita conflictos en deploys paralelos y mantiene auditable el histórico de cambios de infraestructura.