Terraform on Azure: 5 Complete Steps to Provision Infrastructure

Managing cloud infrastructure through interactive web consoles creates configuration drift, untracked changes, and inconsistent environments across development stages. Adopting Terraform on Azure transforms infrastructure into modular, version-controlled code, allowing platform engineering teams to provision identical virtual networks, compute clusters, and storage tiers reliably across global cloud regions.

By combining HashiCorp Terraform with Azure Resource Manager (ARM) APIs via the azurerm provider, engineering organizations replace manual administrative workflows with repeatable, deterministic Infrastructure as Code (IaC) execution cycles.

1. Terraform on Azure Architecture Overview

A resilient enterprise deployment cleanly isolates declarative code configurations from runtime state persistence:

• HashiCorp Configuration Language (HCL): The human-readable declarative language used to specify exact cloud topologies, dependencies, and sizing parameters.
• Terraform State Engine (terraform.tfstate): A single source of truth mapping your declared HCL blocks to concrete Azure resource IDs, subscription endpoints, and metadata attributes.
• Remote State Backend (Azure Blob Storage): Stores the production state file centrally with blob lease locking enabled. This prevents race conditions and corrupted states when multiple engineers or CI/CD pipelines run simultaneously.
• Provider Ecosystem (azurerm): Translates declarative Terraform configuration blocks into direct, authenticated Azure REST API calls.

2. Configure Remote State in Azure Blob Storage

Never store production state files locally on a developer workstation. Local state files leak credentials, fail to synchronize across team members, and lack concurrency locks.

Execute these Azure CLI commands to initialize an isolated Resource Group and encrypted Storage Account with blob lease locking:

# Authenticate to your Azure tenant
az login

# Create a dedicated Resource Group for state storage
az group create --name tf-state-rg --location eastus

# Create a globally unique Storage Account with encryption enforced
az storage account create \
  --name devstacktfstate2026 \
  --resource-group tf-state-rg \
  --location eastus \
  --sku Standard_LRS \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false

# Create the private blob container for state files
az storage container create \
  --name tfstate \
  --account-name devstacktfstate2026 \
  --auth-mode login

3. Enterprise Multi-File Terraform Project Structure

Enterprise-grade Terraform projects avoid massive single-file architectures. Structure your working directory into modular files for maintainability:

terraform-azure-infra/
├── main.tf # Core provider and resource declarations
├── variables.tf # Input variable types and default parameters
├── outputs.tf # Exported resource IDs and endpoint values
└── terraform.tfvars # Environment-specific values (Dev/Staging/Prod)

Structuring your project cleanly ensures scalable Terraform on Azure implementations across environments.

4. Code Implementation

variables.tf (Dynamic Configurations)

Define structured input parameters with strict validation rules to keep deployments flexible:

variable "environment" {
  type        = string
  description = "Target deployment environment"
  default     = "production"
}

variable "location" {
  type        = string
  description = "Azure region for all provisioned resources"
  default     = "eastus"
}

variable "vnet_address_space" {
  type        = list(string)
  description = "CIDR block for the enterprise virtual network"
  default     = ["10.0.0.0/16"]
}

variable "subnet_prefixes" {
  type        = map(string)
  description = "CIDR allocations for tier-isolated subnets"
  default = {
    web = "10.0.1.0/24"
    app = "10.0.2.0/24"
    db  = "10.0.3.0/24"
  }
}

main.tf (Core Infrastructure Declaration)

This foundational configuration defines how Terraform on Azure manages network security rules and virtual subnets. Declare the provider requirements, remote state backend binding, resource group, virtual network, and Network Security Groups (NSGs):

terraform {
  required_version = ">= 1.7.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.100.0"
    }
  }

  backend "azurerm" {
    resource_group_name  = "tf-state-rg"
    storage_account_name = "devstacktfstate2026"
    container_name       = "tfstate"
    key                  = "production.infrastructure.tfstate"
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = true
    }
  }
}

# Core Resource Group
resource "azurerm_resource_group" "infra_rg" {
  name     = "rg-devstack-${var.environment}"
  location = var.location
  tags = {
    Environment = var.environment
    ManagedBy   = "Terraform"
    Project     = "DevStackHub"
  }
}

# Enterprise Virtual Network
resource "azurerm_virtual_network" "core_vnet" {
  name                = "vnet-devstack-${var.environment}"
  address_space       = var.vnet_address_space
  location            = azurerm_resource_group.infra_rg.location
  resource_group_name = azurerm_resource_group.infra_rg.name
}

# Web Tier Subnet
resource "azurerm_subnet" "web_subnet" {
  name                 = "snet-web-${var.environment}"
  resource_group_name  = azurerm_resource_group.infra_rg.name
  virtual_network_name = azurerm_virtual_network.core_vnet.name
  address_prefixes     = [var.subnet_prefixes["web"]]
}

# Network Security Group (NSG) Hardening
resource "azurerm_network_security_group" "web_nsg" {
  name                = "nsg-web-${var.environment}"
  location            = azurerm_resource_group.infra_rg.location
  resource_group_name = azurerm_resource_group.infra_rg.name

  security_rule {
    name                       = "AllowHTTPSInbound"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "AllowHTTPInbound"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "80"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

# Subnet-to-NSG Association
resource "azurerm_subnet_network_security_group_association" "web_nsg_assoc" {
  subnet_id                 = azurerm_subnet.web_subnet.id
  network_security_group_id = azurerm_network_security_group.web_nsg.id
}

outputs.tf (Exported Endpoints)

Expose provisioned IDs and CIDR blocks so dependent services and pipelines can consume them without querying the cloud API manually:

output "resource_group_name" {
  description = "The assigned name of the primary resource group"
  value       = azurerm_resource_group.infra_rg.name
}

output "vnet_id" {
  description = "The unique Azure ID of the virtual network"
  value       = azurerm_virtual_network.core_vnet.id
}

output "web_subnet_id" {
  description = "The resource ID of the web tier subnet"
  value       = azurerm_subnet.web_subnet.id
}

5. The 4-Stage Execution Workflow

Run these operational commands locally or through deployment runners to provision the cloud infrastructure:

┌─────────────────────────────────┐
│         terraform init          │
│   (Fetch & Lock Cloud Plugins)  │
└────────────────┬────────────────┘
                 │
                 ▼
┌─────────────────────────────────┐
│         terraform plan          │
│   (Preview Execution Diff)      │
└────────────────┬────────────────┘
                 │
                 ▼
┌─────────────────────────────────┐
│        terraform apply          │
│   (Atomic Cloud Provisioning)   │
└────────────────┬────────────────┘
                 │
                 ▼
┌─────────────────────────────────┐
│        terraform output         │
│   (Export Resource Endpoints)   │
└─────────────────────────────────┘

1. Initialization:

terraform init

Downloads the azurerm binary, validates provider syntax, and locks the state file session in the Azure Storage Account.

2. Static Validation & Linting:

terraform validate

Verifies internal consistency and attribute syntax without contacting cloud endpoints.

3. Deterministic Execution Plan:

terraform plan -out=production.tfplan

Compares the live Azure infrastructure against your HCL files and generates an execution diff showing exact additions, modifications, and deletions.

4. Atomic Deployment:

terraform apply production.tfplan

Executes the compiled plan against Azure APIs and records newly minted resource IDs into the remote state blob.

6. Integrating Terraform with Automated CI/CD Pipelines

Running Terraform commands manually from developer machines introduces human variability and security risks. You can fully automate terraform plan on every pull request and terraform apply on main-branch merges using a GitHub Actions CI/CD Pipeline.

Once your underlying subnets, security groups, and virtual networks are provisioned, you can package your services into hardened containers using our Production-Ready Docker Containers Guide and host them seamlessly on managed compute with the Azure App Service Deployment Blueprint.

7. Security Best Practices for Enterprise IaC

• Zero Hardcoded Secrets (OIDC & Managed Identity): Avoid using long-lived Azure Service Principal passwords in configuration files or runner secrets. Configure OpenID Connect (OIDC) between your version control system and Azure Active Directory (Microsoft Entra ID) for short-lived, token-based authentication.
• Automated Static Security Scanning: Add tools like tfsec or checkov to your pull request pipelines to intercept unencrypted storage buckets, wide-open security rules (0.0.0.0/0), and missing logging configurations before any infrastructure is applied.
• Tagging and Cost Allocation: Enforce structured metadata tags (Environment, CostCenter, ManagedBy) across all resource declarations to track infrastructure costs accurately across business units.
• Integrating your Terraform on Azure deployments into automated workflows removes manual execution risks…