1# Terraform Deploy Recipe
2 
3Deploy to Azure using Terraform.
4 
5## Prerequisites
6 
7- Terraform CLI installed
8- `.azure/deployment-plan.md` exists with status `Validated`
9- Terraform initialized (`terraform init`)
10- Plan validated (`terraform plan`)
11- **Subscription and location confirmed** → See [Pre-Deploy Checklist](../../pre-deploy-checklist.md)
12 
13## Workflow
14 
15| Step | Task | Command |
16|------|------|---------|
17| 1 | **[Pre-deploy checklist](../../pre-deploy-checklist.md)** | Confirm subscription/location with user |
18| 2 | Select workspace | `terraform workspace select <env>` |
19| 3 | Apply | `terraform apply tfplan` |
20| 4 | Get outputs | `terraform output` |
21| 5 | Deploy app | Service-specific commands |
22| 6 | **Report** | Present deployed endpoint URLs to the user — see [Verification](verify.md) |
23 
24## Deployment Commands
25 
26### Apply with Plan File (Recommended)
27 
28```bash
29terraform plan -out=tfplan
30terraform apply tfplan
31```
32 
33### Auto-Approve (CI/CD)
34 
35```bash
36terraform apply -auto-approve
37```
38 
39### With Variables
40 
41```bash
42terraform apply \
43  -var="environment=prod" \
44  -var="location=westus2" \
45  -auto-approve
46```
47 
48### Target Specific Resource
49 
50```bash
51terraform apply -target=azurerm_container_app.api
52```
53 
54## Get Outputs
55 
56```bash
57terraform output
58terraform output -json
59terraform output api_url
60```
61 
62## Application Deployment
63 
64After infrastructure is deployed:
65 
66### Container Apps (Two-Phase Deployment)
67 
68Container Apps with ACR require a two-phase flow because the app image doesn't exist in ACR during initial `terraform apply`. See the **azure-prepare** skill's `references/services/container-apps/terraform.md` for the full pattern.
69 
70```bash
71ACR_NAME=$(terraform output -raw acr_name)
72ACR_SERVER=$(terraform output -raw acr_login_server)
73APP_NAME=$(terraform output -raw container_app_name)
74RG_NAME=$(terraform output -raw resource_group_name)
75 
76# 1. Build and push the application image to ACR
77az acr build --registry $ACR_NAME --image myapp:latest ./src/api
78 
79# 2. Configure the registry/identity link (managed identity, no passwords)
80az containerapp registry set \
81  --name $APP_NAME \
82  --resource-group $RG_NAME \
83  --server $ACR_SERVER \
84  --identity system
85 
86# 3. Update the Container App to use the real image
87az containerapp update \
88  --name $APP_NAME \
89  --resource-group $RG_NAME \
90  --image $ACR_SERVER/myapp:latest
91```
92 
93**PowerShell:**
94```powershell
95$AcrName = terraform output -raw acr_name
96$AcrServer = terraform output -raw acr_login_server
97$AppName = terraform output -raw container_app_name
98$RgName = terraform output -raw resource_group_name
99 
100az acr build --registry $AcrName --image myapp:latest ./src/api
101 
102az containerapp registry set `
103  --name $AppName `
104  --resource-group $RgName `
105  --server $AcrServer `
106  --identity system
107 
108az containerapp update `
109  --name $AppName `
110  --resource-group $RgName `
111  --image "$AcrServer/myapp:latest"
112```
113 
114> ⚠️ **Warning:** Step 2 requires the `AcrPull` role assignment to have propagated (1–5 minutes). If the update fails, wait and retry. See the [RBAC propagation health check](../../pre-deploy-checklist.md#container-apps--acr--pre-deploy-rbac-health-check).
115 
116## References
117 
118- [Verification steps](./verify.md)
119- [Error handling](./errors.md)
120