Store Remote State
Now you have built, changed, and destroyed infrastructure from your local machine. This is great for testing and development, but in production environments you should keep your state secure and encrypted, where your teammates can access it to collaborate on infrastructure. The best way to do this is by running Terraform in a remote environment with shared access to state.
Terraform Cloud allows teams to easily version, audit, and collaborate on infrastructure changes. It can also store access credentials off of developer machines, and provides a safe, stable environment for long-running Terraform processes.
In this tutorial, you will migrate your state to Terraform Cloud.
Prerequisites
This tutorials assumes you have completed the previous tutorials. If not, create a directory named learn-terraform-azure-instance
and paste this code into
a file named main.tf
.
Note
Because the cloud
block is not supported by older versions of Terraform, you must use 1.1.0 or higher in order to follow this tutorial. Previous versions can use the remote
backend block to configure the CLI workflow and migrate state.
Set up Terraform Cloud
If you have a HashiCorp Cloud Platform or Terraform Cloud account, log in using your existing credentials. For more detailed instructions on how to sign up for a new account and create an organization, review the Sign up for Terraform Cloud tutorial.
Next, configure the cloud
block in your configuration with the organization name,
and a new workspace name of your choice:
Authenticate with Terraform Cloud
Now that you have defined your Terraform Cloud configuration, you must
authenticate with Terraform Cloud in order to proceed with initialization. In
order to authenticate with Terraform Cloud, run the terraform login
subcommand, and follow the prompts to log in.
Note
If you are using a version of Terraform prior to 0.12.21, the terraform login
command is not available. Instead, set up a CLI configuration file to authenticate.
For more detailed instructions on logging in, see the login tutorial.
Migrate the state file
Now you are ready to migrate your local state file to Terraform Cloud. Reinitialize your configuration to begin the migration. This causes Terraform to recognize your cloud
block configuration.
During reinitialization, Terraform presents a prompt saying that it will copy the state file to your Terraform Cloud workspace. Enter yes
so Terraform will migrate the state from your local machine to Terraform Cloud.
When using Terraform Cloud with the CLI-driven workflow, you can choose to have Terraform run remotely, or on your local machine. The default option is remote execution — Terraform Cloud will perform Terraform operations remotely. When using local execution, Terraform Cloud will execute Terraform on your local machine and remotely store your state file in Terraform Cloud. For this tutorial, you will use the default remote execution option for the workspace.
Now that Terraform has migrated the state file to Terraform Cloud, delete the local state file.
Configure a Service Principal
If you are not already logged in to Azure, use the Azure CLI to log in to your account.
Your browser window will open and you will be prompted to enter your Azure login credentials. After successful authentication, your terminal will display your subscription information. You do not need to save this output as it is saved in your system for Terraform to use.
A Service Principal is an application within Azure Active Directory whose authentication tokens can be used as environment variables in Terraform Cloud. For more information, visit the Azure documentation.
First, list the Subscriptions associated with your Azure account.
Select a subscription and copy its id
field value. This is the Subscription ID related to your account. Paste this value into the command below with your own Subscription ID and save the value. You will use it later to give Terraform Cloud access to your Azure account.
Create the Service Principal with the same Subscription ID.
Copy this output somewhere safe.
Update the Terraform Cloud environment variables
Now that you have the authentication information for your account, navigate to the learn-terraform-azure
workspace in the Terraform Cloud UI.
Find the Variables tab and create the below environment variables using the values you put into and got back from the last command. Set the ARM_CLIENT_SECRET
as a sensitive value.
Environment Variable | AZ CLI |
---|---|
ARM_SUBSCRIPTION_ID | SUBSCRIPTION_ID from the last command's input. |
ARM_CLIENT_ID | appID from the last command's output. |
ARM_CLIENT_SECRET | password from the last command's output. (Sensitive) |
ARM_TENANT_ID | tenant from the last command's output. |
Update and save these four environment variables. Set the ARM_CLIENT_SECRET
as a sensitive value. Review your environment variables to ensure they match the example below.
Apply the configuration
Now, apply your configuration including the required variables. Terraform will tell you that there are no changes.
Terraform is now storing your state remotely in Terraform Cloud. Remote state storage makes collaboration easier and keeps state and secret information off your local disk. Remote state is loaded only in memory when it is used.
Destroy the infrastructure
Destroy your infrastructure, and remember to confirm with a yes
.
Next Steps
This concludes the getting started tutorials for Terraform. Now you can use Terraform to create and manage your infrastructure.
For more hands-on experience with the Terraform configuration language, resource provisioning, or importing existing infrastructure, review the tutorials below.
Configuration Language - Get more familiar with variables, outputs, dependencies, meta-arguments, and other language features to write more sophisticated Terraform configurations.
Modules - Organize and re-use Terraform configuration with modules.
Import - Import existing infrastructure into Terraform.
To read more about available configuration options, explore the Terraform documentation.
Learn more about Terraform Cloud
Terraform Cloud supports two main workflows for performing Terraform runs:
- A VCS-driven workflow, in which it automatically queues plans whenever changes are committed to your configuration's VCS repo.
- An API-driven workflow, in which a CI pipeline or other automated tool can upload configurations directly.
For a hands-on introduction to the Terraform Cloud VCS-driven workflow, follow the Terraform Cloud getting started tutorials. Terraform Cloud also offers commercial solutions which include team permission management, policy enforcement, agents, and more.