Terraform on Azure
Configure the AzureRM Terraform provider, write a basic infrastructure plan, and understand when to prefer Terraform over native ARM/Bicep tooling.
Terraform on Azure is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is Terraform and Why Azure?
Terraform is an open-source Infrastructure as Code tool developed by HashiCorp. Unlike Bicep, Terraform is cloud-agnostic — a single Terraform codebase can manage resources across Azure, AWS, GCP, and many other providers simultaneously. On Azure, Terraform uses the AzureRM provider to interact with the ARM API, making it a popular choice for multi-cloud organisations.
The AzureRM Terraform Provider
The AzureRM provider is a plugin that Terraform downloads and uses to translate Terraform configuration into ARM API calls. It is maintained by HashiCorp and Microsoft and is the official way to manage Azure resources with Terraform. Configure the provider with your subscription ID and authentication method, then run terraform init to download it.
# main.tf — configure the AzureRM provider
terraform {
required_providers {
azurerm = {
source = 'hashicorp/azurerm'
version = '~> 3.0'
}
}
}
provider 'azurerm' {
features {}
subscription_id = var.subscription_id
}Terraform File Structure
A typical Azure Terraform project is split across several .tf files: main.tf holds resource declarations, variables.tf defines input variables, outputs.tf defines output values, and terraform.tfvars provides variable values for a specific environment. Terraform automatically loads all .tf files in the current directory, so splitting into multiple files is purely for readability.
# variables.tf
variable 'resource_group_name' {
description = 'Name of the resource group'
type = string
default = 'my-rg'
}
variable 'location' {
description = 'Azure region'
type = string
default = 'eastus'
}Declaring Azure Resources
In Terraform, you declare Azure resources using resource blocks. The block type is resource, followed by the AzureRM resource type (e.g., 'azurerm_resource_group') and a local name used to reference it within the configuration. Property names in Terraform use snake_case rather than camelCase or PascalCase used in ARM JSON.
# main.tf — create a resource group and storage account
resource 'azurerm_resource_group' 'main' {
name = var.resource_group_name
location = var.location
}
resource 'azurerm_storage_account' 'storage' {
name = 'mystorageaccount'
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
account_tier = 'Standard'
account_replication_type = 'LRS'
tags = {
environment = 'dev'
}
}The Terraform Workflow: Init, Plan, Apply
The core Terraform workflow has three steps. terraform init downloads the AzureRM provider and sets up the backend. terraform plan compares your configuration with the current state and shows a diff of what will be created, changed, or destroyed — similar to ARM's what-if. terraform apply executes the plan and updates Azure to match your configuration.
# Step 1: Initialise the project and download providers
terraform init
# Step 2: Preview changes (shows + create, ~ update, - destroy)
terraform plan -out=tfplan
# Step 3: Apply the plan
terraform apply tfplan
# Destroy all managed resources
terraform destroyTerraform State
Terraform maintains a state file (terraform.tfstate) that records the current state of all managed resources and maps them to your configuration. This file enables Terraform to detect drift between what is configured and what exists in Azure. In team environments, store state remotely in an Azure Storage Account (a Terraform backend) so all team members share the same state file.
# Configure remote state in Azure Blob Storage
terraform {
backend 'azurerm' {
resource_group_name = 'tfstate-rg'
storage_account_name = 'tfstateaccount'
container_name = 'tfstate'
key = 'prod.terraform.tfstate'
}
}Authentication to Azure in Terraform
Terraform supports several authentication methods for Azure. During local development, use az login (Azure CLI auth) — Terraform picks up the credentials automatically. In CI/CD pipelines, use a Service Principal with a client secret or certificate, passed via environment variables. For Azure-hosted agents or VMs, use a Managed Identity for the most secure, secret-free authentication.
# Option 1: Azure CLI (local dev)
az login
terraform plan
# Option 2: Service principal via environment variables
export ARM_CLIENT_ID='00000000-0000-0000-0000-000000000000'
export ARM_CLIENT_SECRET='your-client-secret'
export ARM_SUBSCRIPTION_ID='00000000-0000-0000-0000-000000000000'
export ARM_TENANT_ID='00000000-0000-0000-0000-000000000000'
terraform planTerraform Modules for Reuse
Like Bicep modules, Terraform modules let you package and reuse infrastructure patterns. A module is a directory containing .tf files. You reference it with a module block, pass inputs via variables, and consume outputs. The Terraform Registry hosts hundreds of community and verified Azure modules you can use directly, such as the AzureRM network module.
# Use a module from the Terraform Registry
module 'vnet' {
source = 'Azure/vnet/azurerm'
version = '4.0.0'
resource_group_name = azurerm_resource_group.main.name
vnet_location = azurerm_resource_group.main.location
use_for_each = true
address_space = ['10.0.0.0/16']
subnet_prefixes = ['10.0.1.0/24', '10.0.2.0/24']
subnet_names = ['web', 'app']
}When to Choose Terraform vs Bicep
Choose Bicep when your organisation is Azure-only and wants the tightest integration with new Azure features (Bicep gets new resource type support on day one). Choose Terraform when you manage resources across multiple cloud providers, need the large ecosystem of community modules, or prefer HCL syntax and the HashiCorp toolchain. Both are valid for pure Azure deployments — organisational preference often decides.
Importing Existing Resources
If resources already exist in Azure before you started using Terraform, you can bring them under Terraform management using terraform import. This command fetches the resource's current state and adds it to the Terraform state file. After importing, you must manually write the corresponding configuration block to match the imported resource, then run terraform plan to confirm there are no differences.
# Import an existing resource group into Terraform state
terraform import \
azurerm_resource_group.main \
'/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/existing-rg'
# Terraform 1.5+ supports import blocks in configuration
import {
to = azurerm_resource_group.main
id = '/subscriptions/00000000.../resourceGroups/existing-rg'
}Terraform Best Practices on Azure
Follow these best practices for Terraform on Azure: store state remotely in Azure Blob Storage with state locking enabled, use workspaces or separate state files for different environments, never commit secrets to source control — use Azure Key Vault data sources instead, pin provider versions to avoid breaking changes, and run Terraform in a CI/CD pipeline (Azure Pipelines or GitHub Actions) with plan approval gates.
Quick Check
Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.
Lesson Recap
In this lesson you learned: Terraform is a cloud-agnostic IaC tool that uses the AzureRM provider to manage Azure resources, the init, plan, apply workflow enables safe, predictable deployments, and remote state in Azure Blob Storage is essential for team collaboration. Next up we explore creating App Service plans and Web Apps.
Frequently asked questions
Is the “Terraform on Azure” lesson free?
Yes — the full text of “Terraform on Azure” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.
What will I learn in “Terraform on Azure”?
Configure the AzureRM Terraform provider, write a basic infrastructure plan, and understand when to prefer Terraform over native ARM/Bicep tooling. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cloud & IT Cert Prep?
No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Terraform on Azure” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cloud & IT Cert Prep lesson?
Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.