Project A - Create Production Storage Account for Terraform Remote State

[sking-dev]

What?

Manually create a centralised, highly resilient Azure Storage Account to host Terraform remote state files for all domains (/networking, /monitoring, /identity, /governance, etc.) in the Production Azure Landing Zone.

Why?

To ensure all Terraform state files are stored securely and resiliently, with protection against accidental deletion or corruption.

How?

• Create a dedicated resource group for state storage (e.g., rg-uks-alz-tfstate-prod)
• Create a Storage Account with:
  • Globally unique name (e.g., alzprodstate)
  • SKU: Standard_RAGRS (Read-Access Geo-Redundant Storage)
  • Kind: StorageV2
  • Secure transfer required: Enabled (HTTPS only)
• Create a blob container (e.g., tfstate)
• Enable blob versioning for automatic version history
• Enable soft delete for blobs (e.g., 30 days retention)
• (Optional) Configure Storage Account firewall to restrict access to trusted networks
• Document the Storage Account name, container name, and region for use in all backend.tf files

Sample Azure CLI Commands

az group create --name rg-uks-alz-tfstate-prod --location uksouth

az storage account create \
  --name alzprodstate \
  --resource-group rg-uks-alz-tfstate-prod \
  --location uksouth \
  --sku Standard_RAGRS \
  --kind StorageV2 \
  --https-only true

az storage container create --account-name alzprodstate --name tfstate

az storage account blob-service-properties update \
  --account-name alzprodstate \
  --enable-versioning true

az storage blob service-properties delete-policy update \
  --account-name alzprodstate \
  --enable true \
  --days-retained 30