KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #claude-code #codex #dsh #dsh-plugin #ai-agent #ai-agents #deepseek-harness #agent-skills #macos #cli

terraform-azurerm-tfstate-backend

★ 3 Open GitHub ↗

Terraform module that provisions an Azure Storage account to store the `terraform.tfstate` file and a Key Vault to store the customer-managed encryption key

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# terraform-azurerm-tfstate-backend

Terraform module that provisions an Azure Storage account to store the `terraform.tfstate` file, and a Key Vault to store the customer-managed encryption key.

## Instructions
* First, create a file called `terraform.tfvars` with the following contents:

```hcl
namespace = "myteam"
stage = "dev"
name = "tfstate"
attributes = ["tmp"]
```

* Log in to Azure and set the default subscription

```bash
az login
az account set --subscription my-subscription
```

* Create the Terraform state storage account.

```bash
terraform init
terraform plan
terraform apply -auto-approve
```

Now we need to store this Terraform state in the bucket we just created.

* It will include the following instructions in the output. Follow the instructions by creating a file called `state.tf` with the Terraform content shown.

```
instructions = If you just ran this for the first time, you are using local Terraform state. Let's move the local Terraform state into the storage account that we just created.

Create a file called state.tf with the following contents:

terraform {
  backend "azurerm" {
    storage_account_name = "myteamdevtfstatetmp"
    container_name       = "myteam-dev-tfstate-tmp"
    key                  = "statebucket/terraform.tfstate"
    use_msi              = false
    subscription_id      = "<redacted>"
    tenant_id            = "<redacted>"
  }
}
```

* Now, run `terraform init -force-copy`. It will now ask you if you want to copy the existing state to the new backend. Type "yes":

```
> terraform init
Initializing modules...

Initializing the backend...
Do you want to copy existing state to the new backend?
  Pre-existing state was found while migrating the previous "local" backend to the
  newly configured "azurerm" backend. No existing state was found in the newly
  configured "azurerm" backend. Do you want to copy this state to the new "azurerm"
  backend? Enter "yes" to copy and "no" to start with an empty state.

Enter a value: yes
```

Terraform detects that you want to move your Terraform state to the Azure Storage backend, and it does so per `-auto-approve`. Now the state is stored in the Azure Storage account!

# Module Reference

## Requirements

No requirements.

## Providers

| Name | Version |
|------|---------|
| azurerm | n/a |

## Modules

| Name | Source | Version |
|------|--------|---------|
| key_vault_label | git::https://github.com/cloudposse/terraform-terraform-label.git?ref=0.4.0 |  |
| resource_group_label | git::https://github.com/cloudposse/terraform-terraform-label.git?ref=0.4.0 |  |
| storage_account_label | git::https://github.com/cloudposse/terraform-terraform-label.git?ref=0.4.0 |  |
| storage_container_label | git::https://github.com/cloudposse/terraform-terraform-label.git?ref=0.4.0 |  |

## Resources

| Name |
|------|
| [azurerm_client_config](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) |
| [azurerm_key_vault](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault) |
| [azurerm_key_vault_access_policy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy) |
| [azurerm_key_vault_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key) |
| [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) |
| [azurerm_storage_account](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account) |
| [azurerm_storage_account_customer_managed_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_customer_managed_key) |
| [azurerm_storage_container](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_container) |

## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| attributes | Additional attributes, e.g. `1` | `list(string)` | `[]` | no |
| default\_tags | Default billing tags to be applied across all resources | `map(string)` | `{}` | no |
| delimiter | Delimiter to be used between (1) `namespace`, (2) `name`, (3) `stage` and (4) `attributes` | `string` | `"-"` | no |
| key\_vault\_key\_expiration\_date | Expiration of the Key Vault Key, in UTC datetime (Y-m-d'T'H:M:S'Z'). | `string` | `"2022-12-30T20:00:00Z"` | no |
| key\_vault\_key\_type | Specifies the Key Type to use for this Key Vault Key. For Terraform state, supply RSA or RSA-HSM. | `string` | `"RSA"` | no |
| key\_vault\_name | Key Vault account name. If not provided, the name will be generated by the label module in the format namespace-stage-name. Must be 3-24 characters, alphanumerics and hyphens. | `string` | `""` | no |
| key\_vault\_sku\_name | The Name of the SKU used for this Key Vault. Possible values are standard and premium. | `string` | `"standard"` | no |
| location | The Azure location for these resources, such as East US. | `string` | `"East US"` | no |
| name | Name, which could be the name of your solution or app. Third item in naming sequence. | `string` | n/a | yes |
| namespace | Namespace, which could be your organization name. First item in naming sequence. | `string` | n/a | yes |
| resource\_group\_name | The resource group name. If not provided, the resource group will be generated by the label module in the format namespace-stage-name | `string` | `""` | no |
| stage | Stage, e.g. `prod`, `staging`, `dev`, or `test`. Second item in naming sequence. | `string` | n/a | yes |
| storage\_account\_name | Storage account name. If not provided, the name will be generated by the label module in the format namespace-stage-name. Must be 3-24	characters, with lowercase letters and numbers only. | `string` | `""` | no |
| storage\_account\_replication\_type | Defines the type of replication to use for this storage account. Valid options are LRS, GRS, RAGRS, ZRS, GZRS and RAGZRS. | `string` | `"GRS"` | no |
| storage\_account\_tier | Defines the Tier to use for this storage account. Valid options are Standard and Premium | `string` | `"Standard"` | no |

## Outputs

| Name | Description |
|------|-------------|
| key\_vault\_id | --------------------------------------------------------------------------------------------------------------------- Key Vault Attributes https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#attributes-reference --------------------------------------------------------------------------------------------------------------------- ## The Key Vault ### |
| key\_vault\_key\_id | The Key Vault Key ID |
| key\_vault\_key\_version | The current version of the Key Vault Key. |
| resource\_group\_id | The ID of the Resource Group. |
| resource\_group\_name | The name of the resource group |
| storage\_account\_id | The ID of the Storage Account |
| storage\_account\_primary\_access\_key | The primary access key for the storage account. This value is sensitive and masked from Terraform output. |
| storage\_account\_primary\_blob\_endpoint | The endpoint URL for blob storage in the primary location. |
| storage\_account\_primary\_location | The primary location of the storage account. |
| storage\_container\_has\_immutability\_policy | Is there an Immutability Policy configured on this Storage Container? |
| storage\_container\_has\_legal\_hold | Is there a Legal Hold configured on this Storage Container? |
| storage\_container\_id | The ID of the Storage Container. |
| storage\_container\_resource\_manager\_id | The Resource Manager ID of this Storage Container. |
| z\_instructions | n/a |

# References

* [Terraform documentation: AzureRM tfstate Backend](https://www.terraform.io/docs/language/settings/backends/azurerm.html)
* [cloudposse/terraform-aws-tfstate-backend](https://github.com/cloudposse/terraform-aws-tfstate-backend)
* [Azure Resource Name Rules for Storage](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftstorage)
* [Azure Resource Name Rules for Key Vault](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules#microsoftkeyvault)

terraform-azurerm-tfstate-backend

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README