State Management — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— Terraform State Management
📥Init
🔒Lock
⚙️Operate
🔧Recover
🛡️Protect
🎯 Next: Test →
Step 1 / 5
Speed
Backend Init
Configure azurerm backend with OIDC authentication💡 Analogy
OIDC backend auth is like using your company badge to enter the building — no password to remember or rotate, identity is proven by the badge issuer.
The backend block configures Azure Blob Storage as the remote state backend. use_oidc=true uses Workload Identity Federation — no client secrets to manage.
Console Output
$ terraform init

Initializing the backend...

Acquiring state lock. This may take a few moments...
Backend configuration changed!

Successfully configured the backend "azurerm" with OIDC!
State will be stored at:
  https://tfstateaccount.blob.core.windows.net/tfstate/prod.terraform.tfstate
●backend.tf
Backend InitL1–10
1# ── Remote Backend Configuration ──
2terraform {
3  backend "azurerm" {
4    resource_group_name  = "tfstate-rg"
5    storage_account_name = "tfstateaccount"
6    container_name       = "tfstate"
7    key                  = "prod.terraform.tfstate"
8    use_oidc             = true   # Use Workload Identity Federation
9  }
10}
11 
12# ── Example: state move after module refactor ──
13# OLD address: azurerm_virtual_network.main
14# NEW address: module.network.azurerm_virtual_network.vnet
15# Run: terraform state mv #        azurerm_virtual_network.main #        module.network.azurerm_virtual_network.vnet
16 
17# ── Import a manually created resource ──
18# resource "azurerm_resource_group" "main" {
19#   name     = "existing-rg"
20#   location = "eastus"
21# }
22# Run: terraform import azurerm_resource_group.main \
23#        /subscriptions/<sub>/resourceGroups/existing-rg
24 
25# ── Lifecycle: prevent_destroy ──
26resource "azurerm_storage_account" "data" {
27  name                = "proddata2024"
28  resource_group_name = "data-rg"
29  location            = "eastus"
30  account_tier        = "Standard"
31  account_replication_type = "GRS"
32 
33  lifecycle {
34    prevent_destroy = true    # Terraform refuses to destroy this resource
35    ignore_changes  = [tags]  # Ignore tag drift
36  }
37}
37 lines
Timeline — 5 Steps
Backend Init
Configure azurerm backend with OIDC authentication💡 Analogy
OIDC backend auth is like using your company badge to enter the building — no password to remember or rotate, identity is proven by the badge issuer.
The backend block configures Azure Blob Storage as the remote state backend. use_oidc=true uses Workload Identity Federation — no client secrets to manage.
Console Output
$ terraform init

Initializing the backend...

Acquiring state lock. This may take a few moments...
Backend configuration changed!

Successfully configured the backend "azurerm" with OIDC!
State will be stored at:
  https://tfstateaccount.blob.core.windows.net/tfstate/prod.terraform.tfstate

Was this page helpful?

Discussion

Configure azurerm backend with OIDC authentication

💡 Analogy

OIDC backend auth is like using your company badge to enter the building — no password to remember or rotate, identity is proven by the badge issuer.

The backend block configures Azure Blob Storage as the remote state backend. use_oidc=true uses Workload Identity Federation — no client secrets to manage.

Console Output

$ terraform init

Initializing the backend...

Acquiring state lock. This may take a few moments...
Backend configuration changed!

Successfully configured the backend "azurerm" with OIDC!
State will be stored at:
  https://tfstateaccount.blob.core.windows.net/tfstate/prod.terraform.tfstate

Configure azurerm backend with OIDC authentication

💡 Analogy

OIDC backend auth is like using your company badge to enter the building — no password to remember or rotate, identity is proven by the badge issuer.

The backend block configures Azure Blob Storage as the remote state backend. use_oidc=true uses Workload Identity Federation — no client secrets to manage.

Console Output

$ terraform init

Initializing the backend...

Acquiring state lock. This may take a few moments...
Backend configuration changed!

Successfully configured the backend "azurerm" with OIDC!
State will be stored at:
  https://tfstateaccount.blob.core.windows.net/tfstate/prod.terraform.tfstate