Azure DevOps Terraform Pipeline

Sat, Jun 22, 2024

I was recently working on a project that required me to create a Terraform pipeline in Azure DevOps. I had never done this before, so I had to do some research to figure out how to set it up. In this article, I will share the final pipeline that I created, as well as some of the resources that I found helpful along the way.

Preconditions

I will use ‘ubuntu-latest’ as the agent pool for this pipeline. Because I use Ubuntu in other CI/CD tool like GitHub Actions and GitLab CI/CD, I am familiar with the commands and tools available in the Ubuntu environment. If you are using a different agent pool, you may need to adjust the commands accordingly.
Terraform installation script can be found here. I will use this script to install Terraform on the agent machine.
My Azure DevOps uses Service Connection to authenticate with Azure. In my case the Service Connection uses Identity Federation as the authentication method.
Terraform pipeline steps from marketplace are not available for my use case.

Terraform Pipeline

stages:
  - stage: Terraform
    jobs:
    - job: Terraform
      pool:
        vmImage: 'ubuntu-latest'
      steps:
      - task: CmdLine@2
        displayName: 'Terraform Install'
        inputs:
          script: |
# https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli#install-terraform
            sudo apt-get update && sudo apt-get install -y gnupg software-properties-common
            wget -O- https://apt.releases.hashicorp.com/gpg | \
              gpg --dearmor | \
              sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg > /dev/null
            echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
              https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
              sudo tee /etc/apt/sources.list.d/hashicorp.list
            sudo apt update
            sudo apt-get install terraform
            terraform --version

      - task: AzureCLI@2
        displayName: 'Terraform Plan'
        inputs:
          addSpnToEnvironment: true
          azureSubscription: MyServiceConnection
          scriptType: bash
          scriptLocation: inlineScript
          workingDirectory: '$(System.DefaultWorkingDirectory)/infrastructure'
          inlineScript: |
# https://devblogs.microsoft.com/devops/public-preview-of-workload-identity-federation-for-azure-pipelines/#azure-cli-task-support-for-inline-authentication
            export ARM_CLIENT_ID=$servicePrincipalId
            export ARM_OIDC_TOKEN=$idToken
            export ARM_TENANT_ID=$tenantId
            export ARM_SUBSCRIPTION_ID=$(az account show --query id -o tsv)
            export ARM_USE_OIDC=true

            terraform init \
              -var-file="./env/dev/input.tfvars" \
              -backend-config="./env/dev/backend.tfvars"

            terraform plan \
              -var-file="./env/dev/input.tfvars" \
              -input=false

Azure DevOps Terraform Pipeline

Preconditions

Terraform Pipeline

Links

Comments