Azure DevOps + Terraform — Lesson 2: Azure Remote State, Service Connections, and Secure Pipeline Identity

Technical Scope

• Azure Storage backend design
• Service connections and workload identity concepts
• Pipeline variables, variable groups, and secrets
• Subscription, tenant, environment, and permission boundaries

Instructor Demonstration

Configure a pipeline identity and remote backend without storing a client secret in code.

Applied Workshop

Create separate test and production service connections with least privilege.

1. Translate the scenario into configuration, access, state, pipeline, or module decisions.
2. Implement the change in a controlled workspace or repository.
3. Capture the plan, logs, outputs, policy results, and post-change checks.
4. Explain one safer or more maintainable alternative and its trade-off.

Validation Standard

Pipeline identity, backend access, and target subscription are explicit and controlled.

• The intended target, identity, environment, and state boundary are confirmed.
• The plan or execution evidence contains no unexplained destructive action.
• Security, reliability, maintainability, and operational ownership are reviewed.
• The final result can be reproduced from version-controlled inputs.

Failure Analysis

Fix service-connection authorization, RBAC propagation, backend access, and subscription mismatch.

Learners isolate the smallest verified cause, correct it, rerun the relevant validation step, and record the preventive action in the course improvement log.