Infrastructure as Code Skill

Use separate directories per environment (dev, staging, prod) with their own backend and tfvars files, plus a shared modules directory for reusable components. Each environment gets its own remote state key to isolate changes and enable independent deployments.

Bicep offers day-zero Azure support, Azure-managed state, and a simpler syntax, making it ideal for Azure-only workloads. Terraform is better for multi-cloud scenarios and has a larger module ecosystem, but requires self-managed state.

Reference secrets from Azure Key Vault using data sources instead of hard-coding values or storing them in tfvars files. Combine this with CI/CD pipeline secrets and managed identities so credentials never appear in version control.

Yes, Terraform supports validation through terraform validate, tflint, tfsec, and checkov for static analysis, plus native test files using the .tftest.hcl format for plan-based assertions. Integration tests can deploy to ephemeral environments and destroy them afterward.

State corruption typically happens when multiple people apply changes concurrently without state locking, or when state files are stored locally. Use remote backends with locking enabled, such as Azure Storage or S3 with DynamoDB, and never edit state manually.

Pulumi fits teams that prefer TypeScript, Python, or Go over HCL and need complex logic like loops, conditionals, or API calls in their infrastructure code. For simpler needs or teams already experienced with Terraform, HCL-based tools are usually a better fit.