OpenTofu and Azure IaC for State Management

[iacwithazure]

I'm looking to understand whether there is some opensource solution or Azure Native solution for managing the backend "Bootstrap" environment that hosts the storage account and containers that manage my Application's root module state. My goal is to have the ability to deploy both the Bootstrap and Application IaC while maintaining impotence. Right now I have two solutions which ultimately face the same issue in the end which is at the tail end of the backend state environments.

1. Deployment of bootstrap with local state.
2. Deployment of bootstrap with an external storage account that will be used as a backup.

With both of these, it will require local state to be used to some extent.

One benefit of working with Azure is that it enables the terraform import command which allows an existing resource ID to be managed by state. With this knowledge, I will have a script handy to import the config to a state management, although still unsure if I can import to local state.

One utility that popped up on my radar is terrakube (https://docs.terrakube.io/), but I don't have any Kubernetes, I'm strictly deploying IaaS and PaaS at this time.

Any advice is helpful!

[rswrz]

The Storage Account is a classic chicken-egg problem when it comes to provisioning and managing it via Terraform.

Here’s a possible solution:

1. Create the Storage Account for the remote state initially with a local state.
2. Migrate the local state to the remote state:
   1. Create the Terraform backend configuration.
   2. Run terraform init -migrate-state.
   3. After the state migration is successful, the local state file can be deleted.
3. From now on, the Storage Account holding the Terraform state would also be managed via Terraform in a remote state. It's crucial to prevent accidental deletion of this Storage Account – e.g., by using lifecycle { prevent_destroy = true } or an Azure Resource Block (azurerm_management_lock).

[iacwithazure]

Thank you for the reply and the notes about risk-mitigation. This is the best solution that I've considered at this time.

[rswrz]

You’re welcome! Please don't hesitate to let me know if you come across a better solution in the future.