Using Azure Blob Storage as Terraform Backend

Overview

Using Azure Blob Storage as a backend for Terraform enables secure and scalable management of Terraform state files. This document outlines the steps to configure and use Azure Blob Storage for state management.

Prerequisites

Before setting up the backend, ensure you have:

An Azure account with appropriate permissions.
An Azure Resource Group.
An Azure Storage Account.
The Azure CLI and Terraform CLI installed.

Step 1: Create Azure Storage Account and Blob Container

Log in to Azure CLI
```
az login
```

Create a Resource Group

az group create --name Prod-DR --location eastus

Create a Storage Account

az storage account create \
    --name tfstatefile \
    --resource-group Prod-DR \
    --location eastus \
    --sku Standard_LRS \
    --encryption-services blob

Create a Blob Container

az storage container create \
    --name tfstate-cloudflare-prod \
    --account-name tfstatefile

Step 2: Configure Terraform Backend

In your Terraform configuration, update the backend block:

terraform {
  backend "azurerm" {
    resource_group_name   = "Prod-DR"
    storage_account_name  = "tfstatefile"
    container_name        = "tfstate-cloudflare-prod"
    key                   = "terraform.tfstate"
  }
}

Step 3: Authentication Methods

Terraform supports multiple authentication methods. Choose one based on your setup.

1. Using Storage Access Key (Simple but less secure)

Retrieve the storage access key:

az storage account keys list --resource-group Prod-DR --account-name tfstatefile --query '[0].value' --output tsv

Export the key:

export ARM_ACCESS_KEY="<your-storage-access-key>"

2. Using Azure AD Authentication (Recommended for security)

Enable Azure AD Authentication on your storage account:

az role assignment create --assignee <your-service-principal-id> \
    --role "Storage Blob Data Contributor" \
    --scope "/subscriptions/<subscription-id>/resourceGroups/Prod-DR/providers/Microsoft.Storage/storageAccounts/tfstatefile"

Set the authentication parameters in Terraform:

provider "azurerm" {
  features {}
  storage_use_azuread = true
}

Step 4: Initialize Terraform with Backend

Run the following command to initialize Terraform with the Azure Blob backend: To migrate an existing local state file:

terraform init -migrate-state

Step 5: Verify and Apply Terraform Configuration

Check Terraform state storage
```
terraform plan
```
Apply the changes
```
terraform apply
```

Verify the state file in Azure Blob Storage

az storage blob list --container-name tfstate-cloudflare-prod --account-name tfstatefile --output table

Step 6: Enabling State Locking (Recommended)

Unlike AWS S3 with DynamoDB, Azure Blob Storage does not natively support state locking. You can use:

Terraform Cloud/Enterprise for remote state locking
Azure Storage Account Locks to prevent accidental deletions

az lock create --name "state-lock" --resource-group Prod-DR --lock-type CanNotDelete --resource-name tfstatefile --resource-type Microsoft.Storage/storageAccounts

Conclusion

Using Azure Blob Storage as a Terraform backend provides a secure and scalable state management solution. Ensure you follow best practices, such as enabling state locking and using Azure AD authentication for enhanced security.

For more details, visit Terraform's official documentation (opens in a new tab).

Aws Ec2