Exercise 4 ยท 45 minutes

Describe your first Azure resource

Translate an Azure requirement into Terraform configuration, inspect the proposed reconciliation, and deploy a user-assigned managed identity from the VS Code terminal.

ModuleDesired state Azure costNone expected CreatesManaged identity

Before you start

Goal and prerequisites

Your goal

Define one azurerm_user_assigned_identity in your assigned resource group and explain how configuration, state, and Azure contribute to its plan.

You need

  • Your assigned starter repository and resource group
  • An authenticated Azure CLI session
  • Permission to create resources in the sandbox
  • Exercise 3 completed

Participant task

Turn intent into configuration

  1. 01

    Create a focused branch

    Open the starter repository in VS Code and create lab/desired-state. Confirm the AzureRM provider constraint before changing configuration.

    git switch -c lab/desired-state
    az account show --output table
  2. 02

    Define the identity

    Add an azurerm_user_assigned_identity resource. Use the assigned resource group and location, the supplied naming prefix, and the required environment, purpose, and managed_by tags.

  3. 03

    Validate before planning

    Run each command separately and resolve errors before continuing.

    terraform fmt
    terraform init
    terraform validate
  4. 04

    Save and explain the plan

    Save the plan as main.tfplan. Identify the resource address, provider-generated values, tags, and every proposed action. Ask for clarification if the plan touches anything outside your sandbox.

    terraform plan -out main.tfplan
  5. 05

    Apply and verify

    Apply that exact saved plan, then verify the identity through both Terraform and Azure CLI.

    terraform apply main.tfplan
    terraform state list
    az identity show --name <identity-name> --resource-group <resource-group> --output table

Expected outcome

Prove the resource is managed

Validation

  • The saved plan proposed one managed identity.
  • The apply used the saved plan without prompting for a different change.
  • terraform state list contains its resource address.
  • Azure shows the required tags.

Explain

Be ready to identify which values came from configuration, which Azure assigned during creation, and what Terraform recorded in state.

Finish

Commit the intent, retain the sandbox

Commit the configuration but not state, plan files, credentials, or generated provider metadata. Keep the managed identity for Exercise 6.