Infrastructure as Code | Bicep & Terraform on Azure

You will provision the same Azure resources with both Bicep and Terraform, then detect and remediate drift. By the end you will manage cloud infrastructure as version-controlled code with a clear plan-before-apply workflow.

Learning Objectives

Write a Bicep module and deploy it.
Write equivalent Terraform with remote state.
Detect configuration drift with plan/what-if.
Time: ~4 hours · Difficulty: Intermediate · Prereqs: Azure CLI, Bicep, Terraform.

Architecture Overview

graph LR Code[Bicep / Terraform code] --> Plan[plan / what-if] Plan --> Apply[apply] Apply --> Azure[Azure resources] State[(Terraform state)] --> Plan Azure -->|drift check| Plan

Environment Setup

You will need: the Azure CLI (with Bicep) and Terraform 1.7.

Before you begin: store Terraform state remotely (Azure Storage) for team-safe locking.

Step-by-Step Execution

Deploy with Bicep

// main.bicep
param name string
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: name
  location: resourceGroup().location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
}

az deployment group create -g tyf-rg --template-file main.bicep --parameters name=tyfiac01

Equivalent Terraform with plan

terraform init && terraform plan -out tf.plan && terraform apply tf.plan

Detect drift

$ terraform plan -detailed-exitcode

No changes. Your infrastructure matches the configuration.

Progress So Far

graph LR A[01 Bicep deploy] -->|done| B[02 Terraform apply] B -->|done| C[03 Drift check] style A fill:#1a4a1a,stroke:#00ff00,color:#fff style B fill:#1a4a1a,stroke:#00ff00,color:#fff style C fill:#1a4a1a,stroke:#00ff00,color:#fff

Testing & Validation

az resource list -g tyf-rg -o table && terraform plan -detailed-exitcode; echo "exit=$?"

An exit code of 0 from plan means no drift. If resources exist and plan is clean, your infrastructure matches code.

Troubleshooting

State lock errors: a previous run is holding the lock; wait or force-unlock carefully.
Drift keeps returning: stop editing in the portal; remediate only through code.
Bicep build error: run az bicep build to surface the line.

Extension Ideas

Run plan/apply in CI/CD with policy checks.
Add module reuse and environments (dev/prod) with workspaces.
Continuously audit posture with CSPM.

Key Results

Provisioned identical resources via Bicep and Terraform.
Managed Terraform state remotely with locking.
Detected zero drift after apply via plan exit codes.
Made infrastructure version-controlled and reviewable.

Infrastructure as Code on Azure with Bicep and Terraform