Building Secure and Reusable Terraform Modules for Azure

"In production, copy-pasting Terraform code is a liability. Modularizing it is a strategy."

As your cloud infrastructure grows, managing it as clean, consistent, and secure code becomes essential. That’s where Terraform modules come in.

Let’s explore how to build reusable and secure Terraform modules for production-grade Azure environments.

🤔 Why Use Modules?

Terraform modules help you:

• Avoid duplication
• Enforce standards (naming, tagging, access policies)
• Separate concerns (network, storage, compute)
• Improve reusability across environments (dev/stage/prod)

📁 Recommended Module Structure

terraform-azure-storage-account/
│
├── main.tf
├── variables.tf
├── outputs.tf
├── locals.tf
└── README.md

✅ Best Practices for Reusability

• Prefix resource names with variables (e.g., var.env)
• Use locals for derived values
• Tag everything (cost, ownership, environment)
• Provide defaults for non-sensitive inputs
• Version your modules (via Git or registry)

🔒 Best Practices for Security

• Never hardcode secrets (use azurerm_key_vault_secret)
• Always enable diagnostic settings and logging
• Apply least-privilege roles (via role assignments)
• Use HTTPS-only, encryption, and private endpoints when applicable

📦 Sample Module: Azure Storage Account

main.tf

resource "azurerm_storage_account" "this" {
  name                     = var.name
  resource_group_name      = var.resource_group_name
  location                 = var.location
  account_tier             = var.tier
  account_replication_type = var.replication_type

  tags = merge(var.tags, {
    module = "storage-account"
  })
}

variables.tf

variable "name" {}
variable "resource_group_name" {}
variable "location" {}
variable "tier" {
  default = "Standard"
}
variable "replication_type" {
  default = "LRS"
}
variable "tags" {
  default = {}
}

📥 Consuming the Module

module "storage" {
  source              = "git::https://github.com/your-org/terraform-azure-storage-account.git?ref=v1.0.0"
  name                = "mystorageacc01"
  resource_group_name = "prod-rg"
  location            = "westeurope"
  tags = {
    env   = "prod"
    owner = "infra-team"
  }
}

🔗 GitHub Module Repo: terraform-azure-storage-account

🔄 Bonus Tips

• Use terraform-docs to auto-generate README.md
• Pin provider versions to avoid drift
• Validate with terraform validate and tflint

🧠 Final Thoughts

Reusable modules are your IaC power tools — they keep your cloud secure, clean, and maintainable at scale.

In the next post, we’ll build a complete Azure network module with diagnostics, UDR, and firewall integration.

Follow for more insights on DevOps, IaC, and production-grade infrastructure design.