AZ-400 Question 183
Select 3Your company is adopting a multi-environment Infrastructure as Code (IaC) solution using Terraform in Azure DevOps. Each environment has its own subscription, and the organization wants to ensure consistent deployments while minimizing drift and securely handling secrets. You have created a root Terraform configuration for shared resources and child modules for environment-specific configurations. Which two approaches reflect best practices for implementing this scenario?
- A
Store the Terraform state files in a remote backend such as Azure Storage with appropriate role-based access controls (RBAC).
- B
Embed environment-specific secrets directly within Terraform configuration files so all teams can easily access them.
- C
Use separate workspaces to isolate state and configuration details for each environment and subscription.
- D
Manually apply changes for critical resources to avoid accidental modifications through automated scripts.
- E
Leverage Azure Key Vault to securely manage and retrieve secrets during Terraform deployments.
Show answer and explanation
Correct answers: A, C, E
Explanation
In a multi-environment IaC scenario, adopting a centralized, securely managed Terraform state and using per-environment isolation strategies (like workspaces) help maintain consistency and reduce configuration drift. Sensitive data (e.g., passwords, connection strings) should be securely managed, often through services like Azure Key Vault, rather than being stored in plain text within Terraform files. For additional guidance, consult the official Microsoft documentation on best practices for using Terraform with Azure and managing secrets in Azure Key Vault.
- A. Correct.
Storing Terraform state in a secure remote backend like Azure Storage�protected by RBAC�is a recommended practice because it prevents local state file discrepancies, reduces the risk of accidental state overwrites, and allows shared access with proper security controls.
- B. Incorrect.
Placing secrets directly in Terraform configuration files is a security risk and not a recommended practice. Instead, secrets should be stored securely (e.g., in Azure Key Vault) and injected into the pipeline at runtime.
- C. Correct.
Using separate workspaces enables you to isolate state and configuration settings for each environment and subscription. This helps prevent accidental cross-environment changes and ensures customization is properly managed.
- D. Incorrect.
Manually applying changes undermines the continuous integration/continuous delivery (CI/CD) approach and can introduce environment drift and human error. Best practice is to automate Terraform apply steps within a pipeline.
- E. Correct.
Leveraging Azure Key Vault allows sensitive values to be stored securely and delivered to Terraform at runtime without exposing them in code. This significantly reduces the risk of credential leaks.