Terraform via Azure DevOps pipeline¶

Remote state¶

Bootstrap (una vez): storage/container de state + infra/environments/dev/backend.hcl.
El pipeline hace terraform init -backend-config=backend.hcl.

Service connection¶

Name: sc-azure-eai-dev
Pipeline: eai-terraform-dev (id 22)
Variable group: eai-terraform-dev
TF_VAR_SQL_ADMIN_PASSWORD (secret)
TF_VAR_front_door_id = GUID AFD (7b77b579-…) — no dejar vacío en apply

Flujo con aprobación manual¶

sequenceDiagram
  participant Dev as Developer
  participant ADO as eai-terraform-dev
  participant Plan as Stage Plan
  participant MV as ManualValidation
  participant App as Stage Apply

  Dev->>ADO: push infra/** a deployment
  ADO->>Plan: init + plan -out=tfplan
  Plan->>ADO: artifact tfplan-dev (tfplan + plan.txt)
  ADO->>MV: Waiting for review
  Note over MV: Revisar plan.txt — APIM, envs Entra, drifts
  alt Resume
    MV->>App: download tfplan
    App->>App: terraform apply tfplan
  else Reject / timeout
    MV-->>Dev: sin cambios en Azure
  end

Origen	Validate	Plan	Apply
Push `deployment`	Sí	Sí	Sí, tras ManualValidation
PR → main/develop/deployment	Sí	Sí	No

Apply job timeout: 120 min (APIM Developer puede tardar 30–60 min).

También puede existir gate de Environment dev-terraform-apply en ADO.

Flags relevantes (DEV)¶

Variable	Uso
`enable_apim`	`true` en pipeline → crea APIM + policy JWT
`entra_finance_spa_client_id`	SPA client id
`entra_finance_api_audience`	Audience `api://{api-app-id}`
`enable_entra_app_registrations`	Default `false` — preferir script Entra

Detalle Entra/APIM: entra-apim-finance.md.

Checklist antes de Resume¶

[ ] Plan: resume add/change/destroy esperado
[ ] Si enable_apim=true: aparece azurerm_api_management (coste Developer)
[ ] Envs de finance_web (APIM URL, Entra) correctos
[ ] Sin destroys accidentales de SQL/KV/ACR

Branches¶

CI de Terraform solo en push a deployment (path infra/**). Validación adicional en PRs.