Recommended way to store Terraform state in Azure?

1. Azure Storage is the documented approach for storing remote Terraform state in Azure. The guidance describes creating an Azure storage account, using Azure Storage to store remote Terraform state, and using the azurerm backend.
2. The documented guidance confirms Azure Storage as the backend, but it does not prescribe a tenant-isolation pattern such as one storage account per tenant versus one shared storage account with separate state files per tenant. What is supported is:
   • the backend uses a storage account,
   • a blob container,
   • and a key value, which is the name of the state file.
   That means separate state files per tenant are supported by using different key values. The guidance also notes these security considerations:
   • Terraform state is stored in plain text and may contain secrets.
   • In production, use the most secure authentication option supported by the azurerm backend for the use case.
   • In production, restrict storage account access by using a storage firewall, service endpoint, or private endpoint.
3. State locking is automatic. Azure Storage blobs are automatically locked before any operation that writes state. This prevents concurrent state operations that can cause corruption. No extra setup for locking is described.
4. Current security recommendations from the guidance are:
   • Do not write the storage access key to disk; use an environment variable for access_key.
   • Prefer retrieving the access key with Azure CLI or Azure PowerShell.
   • For stronger protection, store the storage account access key in Azure Key Vault and set the environment variable from Key Vault.
   • Evaluate the available authentication options supported by the azurerm backend and use the most secure option for the scenario.
   • Restrict network access to the storage account with a storage firewall, service endpoint, or private endpoint.
   • Be aware that Terraform state is plain text and may contain secrets, so incorrect security can lead to unauthorized access and data loss.
   • Azure Storage encrypts blob data at rest.

A supported backend configuration requires these values:

• storage_account_name
• container_name
• key
• access_key

Typical flow:

1. Create the Azure Storage account and blob container.
2. Retrieve the storage account key and set ARM_ACCESS_KEY as an environment variable.
3. Configure the Terraform backend block.
4. Run terraform init.
5. Run terraform apply.

References:

• Store Terraform state in Azure Storage