A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://developer.hashicorp.com/terraform/language/backend/azurerm below:

Backend Type: azurerm | Terraform

Stores the state as a Blob with the given Key within the Blob Container within the Blob Storage Account.

This backend supports state locking and consistency checking with Azure Blob Storage native capabilities.

Warning: We recommend using environment variables to supply credentials and other sensitive data. If you use -backend-config or hardcode these values directly in your configuration, Terraform will include these values in both the .terraform subdirectory and in plan files. Refer to Credentials and Sensitive Data for details.

The azurerm backend needs to authenticate to the storage account data plane in order to manipulate the state file blob in the storage account container. In order to do that, it needs to authenticate and to know the data plane URI for the storage account.

The azurerm backend supports 5 methods to authenticate to the storage account data plane:

Azure Active Directory and Access Key Lookup Authentication Types

There are 5 types of Azure Active Directory authentication supported, which apply to the Azure Active Directory and Access Key Lookup methods.

These types can be supplied via inputs or via a pre-authenticated Azure CLI. We cover them in more depth in the following sections.

Data Plane URI

In most cases, you can infer the data plane URI from the storage_account_name and container_name. Refer to the storage account overview documentation for more information on the standard endpoints.

If you are using the 'Azure DNS zone endpoints' feature, the backend will need to lookup the data plane URI from the management plane. This requires that you set the lookup_blob_endpoint configuration option to true and the Reader role assignment on the storage account.

This method requires a valid Azure Active Directory principal and a predictable storage account data plane URI.

Required Configuration Options

The following configuration options are always required for this method:

Optional Inputs

These optional configuration options apply when looking up the data plane URI from the management plane. They are not required when the data plane URI can be inferred from the storage_account_name and container_name.

Storage Account Required Role Assignments

The recommended data plane role assignments required for this method are either one of:

The recommended management plane role assignments required for this method are:

Azure Active Directory with OpenID Connect / Workload identity federation Required Configuration Options

The following additional configuration options are always required for this sub-type:

Example Configuration for GitHub

With GitHub, the ID Token environment variables are automatically found, so no further settings are required.

terraform {
  backend "azurerm" {
    use_oidc             = true                                    # Can also be set via `ARM_USE_OIDC` environment variable.
    use_azuread_auth     = true                                    # Can also be set via `ARM_USE_AZUREAD` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    client_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Example Configuration for Azure DevOps

With Azure DevOps, the ID Token endpoint environment variables are automatically found, but you need to supply the service connection ID in oidc_azure_service_connection_id. If you are using the AzureCLI or AzurePowerShell tasks, the service connection ID is automatically set to the AZURESUBSCRIPTION_SERVICE_CONNECTION_ID environment variable.

terraform {
  backend "azurerm" {
    use_oidc                         = true                                    # Can also be set via `ARM_USE_OIDC` environment variable.
    oidc_azure_service_connection_id = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_OIDC_AZURE_SERVICE_CONNECTION_ID` environment variable.
    use_azuread_auth                 = true                                    # Can also be set via `ARM_USE_AZUREAD` environment variable.
    tenant_id                        = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    client_id                        = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    storage_account_name             = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name                   = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                              = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Azure Active Directory with Compute Attached Managed Identity Required Configuration Options

The following additional configuration options are always required for this sub-type:

Optional Configuration Options

The following additional configuration options are optional for this sub-type:

Example Configuration 
terraform {
  backend "azurerm" {
    use_msi              = true                                    # Can also be set via `ARM_USE_MSI` environment variable.
    use_azuread_auth     = true                                    # Can also be set via `ARM_USE_AZUREAD` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    client_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable. Not required for System Assigned Managed Identity.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Azure Active Directory with Azure CLI

You must have a pre-authenticated Azure CLI session using any supported method.

Required Configuration Options

The following additional configuration options are always required for this sub-type:

Example Configuration 
terraform {
  backend "azurerm" {
    use_cli              = true                                    # Can also be set via `ARM_USE_CLI` environment variable.
    use_azuread_auth     = true                                    # Can also be set via `ARM_USE_AZUREAD` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable. Azure CLI will fallback to use the connected tenant ID if not supplied.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Azure Active Directory with Client Secret

Terraform retains this method for backwards compatibility only, do not use it for any new workloads.

Warning! This method requires you to manage and rotate a secret. Use OpenID Connect / Workload identity federation as a more secure approach.

Required Inputs

The following additional configuration options are always required for this sub-type:

Example Configuration 
terraform {
  backend "azurerm" {
    use_azuread_auth     = true                                    # Can also be set via `ARM_USE_AZUREAD` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    client_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    client_secret        = "************************************"  # Can also be set via `ARM_CLIENT_SECRET` environment variable.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Azure Active Directory with Client Certificate

Terraform retains this method for backwards compatibility only, do not use it for any new workloads.

Warning! This method requires you to manage and rotate a secret. Use OpenID Connect / Workload identity federation as a more secure approach.

Required Inputs

The following additional configuration options are always required for this sub-type:

Example Configuration 
terraform {
  backend "azurerm" {
    use_azuread_auth            = true                                    # Can also be set via `ARM_USE_AZUREAD` environment variable.
    tenant_id                   = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    client_id                   = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    client_certificate_path     = "/path/to/bundle.pfx"                   # Can also be set via `ARM_CLIENT_CERTIFICATE_PATH` environment variable.
    client_certificate_password = "************************************"  # Can also be set via `ARM_CLIENT_CERTIFICATE_PASSWORD` environment variable.
    storage_account_name        = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name              = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                         = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}

This method requires you find the Access Key for the storage account and supply it to the backend configuration.

The Access Key is then used to directly authenticate to the storage account data plane.

Terraform retains this method for backwards compatibility, we do not recommend it for new workloads.

Required Configuration Options

The following configuration options are always required for this method:

Storage Account Required Role Assignments

There are no role assignments required on the storage account for this method as the Access Key is used to authenticate to the data plane.

Example Configuration

Warning! This method requires you to manage and rotate a secret. Consider using OIDC as a more secure approach.

terraform {
  backend "azurerm" {
    access_key           = "abcdefghijklmnopqrstuvwxyz0123456789..."  # Can also be set via `ARM_ACCESS_KEY` environment variable.
    storage_account_name = "abcd1234"                                 # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                                  # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                   # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}

This method requires you generate a SAS Token for the storage account container or blob and supply it to the backend configuration.

The SAS Token is then used to directly authenticate to the storage account data plane.

Terraform retains this method for backwards compatibility, we do not recommend it for new workloads.

Required Configuration Options

The following configuration options are always required for this method:

Storage Account Required Permissions

The SAS Token requires write and list permissions on the container or blob.

Example Configuration

Warning! This method requires you to manage and rotate a secret. Consider using OIDC as a more secure approach.

terraform {
  backend "azurerm" {
    sas_token            = "abcdefghijklmnopqrstuvwxyz0123456789..."  # Can also be set via `ARM_SAS_TOKEN` environment variable.
    storage_account_name = "abcd1234"                                 # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                                  # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                   # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}

This method requires a valid Azure Active Directory principal and is a fallback for when Azure Active Directory authentication cannot be used on the storage account data plane.

This method queries the management plane to get the storage account Access Key and then uses that Access Key to authenticate to the storage account data plane. It requires elevated permissions on the storage account.

Terraform retains this method for backwards compatibility, we do not recommend it for new workloads.

Required Configuration Options

The following configuration options are always required for this method:

Optional Configuration Options

These optional configuration options apply when looking up the data plane URI from the management plane. They are not required when the data plane URI can be inferred from the storage_account_name and container_name.

Storage Account Required Role Assignments

The recommended data plane role assignments required for this method are either one of:

The recommended management plane role assignments required for this method are:

Access Key Lookup with OpenID Connect / Workload identity federation

OpenID Connect / Workload identity federation is the recommended method for this scenario.

Required Configuration Options

The following additional configuration options are always required for this sub-type:

Example Configuration for GitHub

With GitHub, the ID Token environment variables are automatically found, so no further settings are required.

terraform {
  backend "azurerm" {
    use_oidc             = true                                    # Can also be set via `ARM_USE_OIDC` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    subscription_id      = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_SUBSCRIPTION_ID` environment variable.
    client_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    resource_group_name  = "StorageAccount-ResourceGroup"          # Can be passed via `-backend-config=`"resource_group_name=<resource group name>"` in the `init` command.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Example Configuration for Azure DevOps

With Azure DevOps, the ID Token endpoint environment variables are automatically found, but you need to supply the service connection ID in oidc_azure_service_connection_id. If you are using the AzureCLI or AzurePowerShell tasks, the service connection ID is automatically set to the AZURESUBSCRIPTION_SERVICE_CONNECTION_ID environment variable.

terraform {
  backend "azurerm" {
    use_oidc                         = true                                    # Can also be set via `ARM_USE_OIDC` environment variable.
    oidc_azure_service_connection_id = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_OIDC_AZURE_SERVICE_CONNECTION_ID` environment variable.
    tenant_id                        = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    subscription_id                  = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_SUBSCRIPTION_ID` environment variable.
    client_id                        = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    resource_group_name              = "StorageAccount-ResourceGroup"          # Can be passed via `-backend-config=`"resource_group_name=<resource group name>"` in the `init` command.
    storage_account_name             = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name                   = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                              = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Access Key Lookup with Compute Attached Managed Identity Required Configuration Options

The following additional configuration options are always required for this sub-type:

Optional Configuration Options

The following additional configuration options are optional for this sub-type:

Example Configuration 
terraform {
  backend "azurerm" {
    use_msi              = true                                    # Can also be set via `ARM_USE_MSI` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    subscription_id      = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_SUBSCRIPTION_ID` environment variable.
    client_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable. Not required for System Assigned Managed Identity.
    resource_group_name  = "StorageAccount-ResourceGroup"          # Can be passed via `-backend-config=`"resource_group_name=<resource group name>"` in the `init` command.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Access Key Lookup with Azure CLI

You must have a pre-authenticated Azure CLI session using any supported method.

terraform {
  backend "azurerm" {
    use_cli              = true                                    # Can also be set via `ARM_USE_CLI` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable. Azure CLI will fallback to use the connected tenant ID if not supplied.
    subscription_id      = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_SUBSCRIPTION_ID` environment variable. Azure CLI will fallback to use the connected subscription ID if not supplied.
    resource_group_name  = "StorageAccount-ResourceGroup"          # Can be passed via `-backend-config=`"resource_group_name=<resource group name>"` in the `init` command.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Access Key Lookup with Client Secret

Terraform retains this method for backwards compatibility only, do not use it for any new workloads.

Warning! This method requires you to manage and rotate a secret. Use OpenID Connect / Workload identity federation as a more secure approach.

terraform {
  backend "azurerm" {
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    subscription_id      = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_SUBSCRIPTION_ID` environment variable.
    client_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    client_secret        = "************************************"  # Can also be set via `ARM_CLIENT_SECRET` environment variable.
    resource_group_name  = "StorageAccount-ResourceGroup"          # Can be passed via `-backend-config=`"resource_group_name=<resource group name>"` in the `init` command.
    storage_account_name = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name       = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                  = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}
Access Key Lookup with Client Certificate

Terraform retains this method for backwards compatibility only, do not use it for any new workloads.

Warning! This method requires you to manage and rotate a secret. Use OpenID Connect / Workload identity federation as a more secure approach.

terraform {
  backend "azurerm" {
    tenant_id                   = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    subscription_id             = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_SUBSCRIPTION_ID` environment variable.
    client_id                   = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    client_certificate_path     = "/path/to/bundle.pfx"                   # Can also be set via `ARM_CLIENT_CERTIFICATE_PATH` environment variable.
    client_certificate_password = "************************************"  # Can also be set via `ARM_CLIENT_CERTIFICATE_PASSWORD` environment variable.
    resource_group_name  = "StorageAccount-ResourceGroup"          # Can be passed via `-backend-config=`"resource_group_name=<resource group name>"` in the `init` command.
    storage_account_name        = "abcd1234"                              # Can be passed via `-backend-config=`"storage_account_name=<storage account name>"` in the `init` command.
    container_name              = "tfstate"                               # Can be passed via `-backend-config=`"container_name=<container name>"` in the `init` command.
    key                         = "prod.terraform.tfstate"                # Can be passed via `-backend-config=`"key=<blob key name>"` in the `init` command.
  }
}

To use the terraform_remote_state data source with the azurerm backend, you must use the exact same configuration as you would for the backend block in your configuration.

For example to use Direct Azure Active Directory authentication with OpenID Connect / Workload identity federation for GitHub you would use the following configuration:

data "terraform_remote_state" "foo" {
  backend = "azurerm"
  config = {
    use_oidc             = true                                    # Can also be set via `ARM_USE_OIDC` environment variable.
    use_azuread_auth     = true                                    # Can also be set via `ARM_USE_AZUREAD` environment variable.
    tenant_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_TENANT_ID` environment variable.
    client_id            = "00000000-0000-0000-0000-000000000000"  # Can also be set via `ARM_CLIENT_ID` environment variable.
    storage_account_name = "abcd1234"                              # There is not environment variable support for this input.
    container_name       = "tfstate"                               # There is not environment variable support for this input.
    key                  = "prod.terraform.tfstate"                # There is not environment variable support for this input.
  }
}

Warning: We recommend using environment variables to supply credentials and other sensitive data. If you use -backend-config or hardcode these values directly in your configuration, Terraform will include these values in both the .terraform subdirectory and in plan files. Refer to Credentials and Sensitive Data for details.

For more information on when each of these configuration settings is required, refer to the previous sections of this page.

The following configuration options are supported:

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4