Build: Bootstrap remote state backend

0/3 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/3

◆ Before you start

Prerequisites

Terraform 1.8+Required
terraform version
Azure CLI 2.61+Required
az login
Azure SubscriptionRequired
Storage Blob Data Contributor role needed

🗄️

Step 1 of 3

Bootstrap remote state backend

Provision the Azure Blob Storage backend for Terraform state. This is often done once per organization with a bootstrap script.

Tasks

Run the bootstrap script to create: resource group, storage account, container

Enable blob versioning and soft-delete on the storage account

Note the storage account name and container name for backend config

Grant your Service Principal or MI the Storage Blob Data Contributor role

🎯 What You'll Learn

▸Create the resources needed to store Terraform state remotely
▸Understand why remote state (not local) is required for teams
▸Configure Storage Account with versioning and soft-delete for state protection

Code

Bashbootstrap.sh
1 #!/bin/bash
2 # Bootstrap Terraform remote state backend
3 set -e
4  
5 RESOURCE_GROUP="tfstate-rg"
6 LOCATION="eastus"
7 STORAGE_ACCOUNT="tfstate$(openssl rand -hex 4)"  # Unique name
8 CONTAINER_NAME="tfstate"
9  
10 echo "Creating resource group..."
11 az group create --name $RESOURCE_GROUP --location $LOCATION
12  
13 echo "Creating storage account: $STORAGE_ACCOUNT"
14 az storage account create \
15   --name $STORAGE_ACCOUNT \
16   --resource-group $RESOURCE_GROUP \
17   --location $LOCATION \
18   --sku Standard_LRS \
19   --encryption-services blob \
20   --min-tls-version TLS1_2 \
21   --allow-blob-public-access false
22  
23 echo "Enabling blob versioning..."
24 az storage account blob-service-properties update \
25   --resource-group $RESOURCE_GROUP \
26   --account-name $STORAGE_ACCOUNT \
27   --enable-versioning true \
28   --enable-delete-retention true \
29   --delete-retention-days 30
30  
31 echo "Creating container..."
32 az storage container create \
33   --name $CONTAINER_NAME \
34   --account-name $STORAGE_ACCOUNT \
35   --auth-mode login
36  
37 echo "\n=== Backend config ==="
38 echo "resource_group_name  = \"$RESOURCE_GROUP\""
39 echo "storage_account_name = \"$STORAGE_ACCOUNT\""
40 echo "container_name       = \"$CONTAINER_NAME\""
41 echo "key                  = \"<your-project>.terraform.tfstate\""

💡 Pro Tips

▸Use a dedicated resource group (e.g., "tfstate-rg") for state resources
▸Enable versioning and soft-delete to recover from accidental state deletion
▸Never store the state bootstrap config in the same state — use a separate script

Expected Output

Storage account and container created for Terraform state

Discussion

1 #!/bin/bash 2 # Bootstrap Terraform remote state backend 3 set -e 4 5 RESOURCE_GROUP="tfstate-rg" 6 LOCATION="eastus" 7 STORAGE_ACCOUNT="tfstate$(openssl rand -hex 4)" # Unique name 8 CONTAINER_NAME="tfstate" 9 10 echo "Creating resource group..." 11 az group create --name $RESOURCE_GROUP --location $LOCATION 12 13 echo "Creating storage account: $STORAGE_ACCOUNT" 14 az storage account create \ 15 --name $STORAGE_ACCOUNT \ 16 --resource-group $RESOURCE_GROUP \ 17 --location $LOCATION \ 18 --sku Standard_LRS \ 19 --encryption-services blob \ 20 --min-tls-version TLS1_2 \ 21 --allow-blob-public-access false 22 23 echo "Enabling blob versioning..." 24 az storage account blob-service-properties update \ 25 --resource-group $RESOURCE_GROUP \ 26 --account-name $STORAGE_ACCOUNT \ 27 --enable-versioning true \ 28 --enable-delete-retention true \ 29 --delete-retention-days 30 30 31 echo "Creating container..." 32 az storage container create \ 33 --name $CONTAINER_NAME \ 34 --account-name $STORAGE_ACCOUNT \ 35 --auth-mode login 36 37 echo "\n=== Backend config ===" 38 echo "resource_group_name = \"$RESOURCE_GROUP\"" 39 echo "storage_account_name = \"$STORAGE_ACCOUNT\"" 40 echo "container_name = \"$CONTAINER_NAME\"" 41 echo "key = \"<your-project>.terraform.tfstate\""

1	#!/bin/bash
2	# Bootstrap Terraform remote state backend
3	set -e
4
5	RESOURCE_GROUP="tfstate-rg"
6	LOCATION="eastus"
7	STORAGE_ACCOUNT="tfstate$(openssl rand -hex 4)" # Unique name
8	CONTAINER_NAME="tfstate"
9
10	echo "Creating resource group..."
11	az group create --name $RESOURCE_GROUP --location $LOCATION
12
13	echo "Creating storage account: $STORAGE_ACCOUNT"
14	az storage account create \
15	--name $STORAGE_ACCOUNT \
16	--resource-group $RESOURCE_GROUP \
17	--location $LOCATION \
18	--sku Standard_LRS \
19	--encryption-services blob \
20	--min-tls-version TLS1_2 \
21	--allow-blob-public-access false
22
23	echo "Enabling blob versioning..."
24	az storage account blob-service-properties update \
25	--resource-group $RESOURCE_GROUP \
26	--account-name $STORAGE_ACCOUNT \
27	--enable-versioning true \
28	--enable-delete-retention true \
29	--delete-retention-days 30
30
31	echo "Creating container..."
32	az storage container create \
33	--name $CONTAINER_NAME \
34	--account-name $STORAGE_ACCOUNT \
35	--auth-mode login
36
37	echo "\n=== Backend config ==="
38	echo "resource_group_name = \"$RESOURCE_GROUP\""
39	echo "storage_account_name = \"$STORAGE_ACCOUNT\""
40	echo "container_name = \"$CONTAINER_NAME\""
41	echo "key = \"<your-project>.terraform.tfstate\""