organize terraform state in blob storage account

2
votes

I am new to using terraform for azure resource management.

I am using azure blob storage as a backend for terraform state file

My project consists of multiple repositories that map to a resource group in azure subscription

repository-a ---> azure-rg-a
repository-b ---> azure-rg-b

General structure of my repository consists of

repo-a
- src
- infra
   - env
      - dev.tfvars
      - xxx.tfvars (one per env)
   - main.tf
- tests
-------------------------------------------
repo-b
- src
- infra
   - env
      - dev.tfvars
      - xxx.tfvars (one per env)
   - main.tf
- tests

A single team is responsible for both the repositories and the resource groups. What is the better place to set up blob storage

What I tried / have thought of doing

  • Option A : keep a blob storage per resource group.
    • Cons : I don't like the idea of having those many storage accounts just for state management
azure-rg-repo-a
 - repo-a-storageaccount
   - tfstate (container)
     - tfstate.tfstate (state file)

azure-rg-repo-b
 - repo-b-storageaccount
   - tfstate (container)
     - tfstate.tfstate (state file)
  • Option B : keep a blob storage in a separate resource group for infrastructure
azure-rg-infrastructure
 - repo-infra-storageaccount
   - tfstate (container)
     - repo-a.tfstate (state file for repo-a)
     - repo-b.tfstate (state file for repo-b)
1
azureterraform

1 Answers

1
votes

IMHO I would use single storage for all state files, in AWS we enable versioning and prevent delete unless MFA root is used, tightly restrict access to that storage. Also when you have a shared Account that contains CICD for infra, it's a good pattern to use a single source of truth for state files.