Introduction

Over the past few weeks I have been helping a couple of my customers take their first steps into the world of DevOps and Infrastructure-as-Code with Terraform.

It’s safe to say there is an array of fantastic content out there already in the community and from the vendors themselves, which have certainly been useful to use with my customers. Some of the content I have been using with my customers is listed below:

• Azure Docs – Terraform on Azure
• Hashicorp Terraform Docs – Get Started Terraform on Azure
• Thomas Thornton – Terraform With Azure DevOps and Build Artifacts

So What Is This Blog Post About?

Good question. In this blog post I want to share with you how I configure Azure DevOps (Project, Repos, Pipelines, Artifacts, Branch Policies, Variable Groups, Service Connections etc.) to deploy Terraform into Azure. I’ll also show you how I configure Azure resources like Storage Accounts, Key Vaults & Service Principals to handle the remote state for Terraform with Azure DevOps and handling access secrets securely.

This not only applies to Azure and could also re-purposed very easily for any Terraform style deployment using Azure DevOps to orchestrate the process.

Now I won’t be doing this as a long blog post, as many of my other posts are, instead I have recorded this all as a video and put on YouTube for you all to enjoy instead!

I’ve also created an overview diagram to explain the logical flow from someone creating Terraform code to deployment. Which will hopefully help everyone understand all the pieces involved in this process!

So with that, checkout the below diagram, video walk through and beneath all that code snippets and example Terraform files; enjoy!

Process Flow Diagram

Click on the diagram above to open it in full in another tab

The diagram is also available below in Visio & PDF formats:

• Visio
• PDF

Video Walk Through

Code Snippets

Terraform Plan Build Pipeline

Terraform Init

terraform init -backend-config="access_key=$(NAME OF KEY VAULT SECRET FOR STORAGE ACCOUNT KEY)"

Terraform Validate

terraform validate

Terraform Plan

terraform plan -input=false -out=tfplan -var="spn-client-id=$(CHANGEME-spn-client-id)" -var="spn-client-secret=$(CHANGEME-spn-secret)" -var="spn-tenant-id=$(CHANGEME-spn-tenant-id)"

Create Archive Step

$(Build.ArtifactStagingDirectory)/$(Build.BuildId)-tfplan.tgz

# File/Directory To Publish
$(Build.ArtifactStagingDirectory)/$(Build.BuildId)-tfplan.tgz

# Artifact Name
$(Build.BuildId)-tfplan

Terraform Apply Release Pipeline

Extract Archive

$(System.ArtifactsDirectory)/_Terraform Plan/$(Build.BuildId)-tfplan/$(Build.BuildId)-tfplan.tgz

Terraform Init

terraform init -backend-config="access_key=$(NAME OF KEY VAULT SECRET FOR STORAGE ACCOUNT KEY)"

Terraform Apply

terraform apply -auto-approve -input=false tfplan 

Terraform File Examples

backend.tf

1terraform {
2  backend "azurerm" {
3    storage_account_name = "tfazdodemostg001"
4    container_name       = "terraform-state"
5    key                  = "tf-azdo-demo.tfstate"
6  }
7}

providers.tf

 1terraform {
 2  required_providers {
 3    azurerm = {
 4      source  = "hashicorp/azurerm"
 5      version = "2.56.0"
 6    }
 7  }
 8}
 9
10provider "azurerm" {
11  features {}
12  subscription_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
13  client_id       = var.spn-client-id
14  client_secret   = var.spn-client-secret
15  tenant_id       = var.spn-tenant-id
16}

variables.tf

1variable "spn-client-id" {}
2variable "spn-client-secret" {}
3variable "spn-tenant-id" {}

This blog is part of Azure Week. Check it out for more great content!

About the Author:

Jack is a Cloud Solutions Architect @ Microsoft & a former Microsoft Azure MVP based near Brighton in the UK.

Reference:

Tracey, J. (2020). Terraform With Azure DevOps. Available at: https://jacktracey.co.uk/terraform-with-azure-devops/ [Accessed: 6th July 2021].