Exercise 8 ยท 50 minutes

Treat state as critical data

Inspect what local state records, migrate it to the organization-provided Azure Storage backend, and verify that the same resource remains under management.

ModuleState safelyAzure costShared serviceChangesState location

Before you start

Goal and prerequisites

Your goal

Move the current sandbox state into the assigned backend key without recreating, importing, or changing the managed identity.

You need

  • The applied configuration from Exercise 6
  • Exercise 7 completed
  • Backend values supplied by the organization
  • Blob data-plane access for your assigned state
  • Network and DNS access to the Blob endpoint

Participant task

Migrate without changing Azure

  1. 01

    Inspect local state safely

    Use Terraform commands to list managed addresses and inspect the current identity. Do not open or commit the raw state file.

    terraform state list
    terraform state show <identity-resource-address>
  2. 02

    Describe the backend boundary

    Record who owns the storage account, which state key belongs to your team, how authentication works, and what network path reaches Blob storage.

  3. 03

    Configure AzureRM state

    Add an empty backend "azurerm" {} block. Supply the organization-provided values to terraform init -migrate-state through the approved local mechanism and use Entra authentication.

    terraform init -migrate-state
  4. 04

    Verify continuity

    List state again and create a saved plan. The resource address and Azure resource ID must be unchanged, and the plan should report no infrastructure changes.

    terraform state list
    terraform plan -out main.tfplan
  5. 05

    Explain failure boundaries

    Describe what happens when authentication succeeds but Blob data-plane RBAC, private routing, DNS, or the state lease does not.

Expected outcome

Prove state moved, not infrastructure

Validation

  • Initialization confirms migration to the AzureRM backend.
  • The identity keeps the same Azure resource ID.
  • The plan reports no changes.
  • No state or plan file is staged by Git.

Optional extension

With an instructor, observe a state lock and identify the lease rather than using force-unlock. Discuss when force-unlock is justified.

Finish

Keep the backend and resource

Commit only the empty backend declaration and related documentation. Retain the sandbox for Exercise 10.