Skip to content

Commit

Permalink
Copy update
Browse files Browse the repository at this point in the history
  • Loading branch information
neilpeterson committed Sep 18, 2018
1 parent c5472bb commit e8d50bb
Showing 1 changed file with 11 additions and 9 deletions.
20 changes: 11 additions & 9 deletions articles/terraform/terraform-backend.md
Expand Up @@ -27,9 +27,9 @@ Before using Azure Storage as a backend, a storage account must be created. The
```azurecli-interactive
#!/bin/bash
RESOURCE_GROUP_NAME=tfstatestorage
STORAGE_ACCOUNT_NAME=tfstatestorage$RANDOM
CONTAINER_NAME=terraform.tfstate
RESOURCE_GROUP_NAME=tstate
STORAGE_ACCOUNT_NAME=tstate$RANDOM
CONTAINER_NAME=tstate
# Create resource group
az group create --name $RESOURCE_GROUP_NAME --location eastus
Expand Down Expand Up @@ -75,13 +75,13 @@ export ARM_ACCESS_KEY=$(az keyvault secret show --name terraform-backend-key --v

To configure Terraform to use the backend, include a *backend* configuration with a type of *azurerm* inside of the Terraform configuration. Add the *storage_account_name*, *container_name*, and *key* values to the configuration block.

The following example configures a Terraform backend and creates and Azure resource group.
The following example configures a Terraform backend and creates and Azure resource group. Replace the values with values from your environment.

```json
terraform {
backend "azurerm" {
storage_account_name = "tstate"
container_name = "tfstate"
storage_account_name = "tstate09762"
container_name = "tstate"
key = "terraform.tfstate"
}
}
Expand All @@ -104,17 +104,19 @@ The lock can be seen when examining the blob though the Azure portal or other Az

## Encryption at rest

By default, date stored in an Azure Blob is encrypted before being persisted to the storage infrastructure. When Terraform needs state data, it is retrieved from the backend and stored in memory. The combination of these two configurations keeps resource secrets secure.
By default, data stored in an Azure Blob is encrypted before being persisted to the storage infrastructure. When Terraform needs state, it is retrieved from the backend and stored in memory on your development system. In this configuration, state is secured in Azure Storage and not written to your local disk.

For more information on Azure Storage encryption, see [Azure Storage Service Encryption for data at rest][azure-storage-encryption].

## Next steps

Learn more about Terraform backed configuration at the [Terraform backend documentation][terraform-backend].

<!-- LINKS - external -->
<!-- LINKS - internal -->
[azure-key-vault]: ../key-vault/quick-create-cli.md
[azure-storage-encryption][../storage/common/storage-service-encryption.md]
[azure-storage-encryption]: ../storage/common/storage-service-encryption.md

<!-- LINKS - external -->
[terraform-azurerm]: https://www.terraform.io/docs/backends/types/azurerm.html
[terraform-backend]: https://www.terraform.io/docs/backends/
[terraform-state-lock]: https://www.terraform.io/docs/state/locking.html

0 comments on commit e8d50bb

Please sign in to comment.