1# Terraform Validation
2 
3Validation steps for Terraform deployments.
4 
5## Prerequisites
6 
7- `./infra/main.tf` exists
8- State backend accessible
9 
10## Validation Steps
11 
12- [ ] 1. Terraform Installation
13- [ ] 2. Azure CLI Installation
14- [ ] 3. Authentication
15- [ ] 4. Initialize
16- [ ] 5. Format Check
17- [ ] 6. Validate Syntax
18- [ ] 7. Plan Preview
19- [ ] 8. State Backend
20- [ ] 9. Azure Policy Validation
21- [ ] 10. Template Variable Resolution Check (AZD+Terraform)
22 
23## Validation Details
24 
25### 1. Terraform Installation
26 
27Verify Terraform is installed:
28 
29```bash
30terraform version
31```
32 
33**If not installed:** See https://developer.hashicorp.com/terraform/install
34 
35### 2. Azure CLI Installation
36 
37Verify Azure CLI is installed:
38 
39```bash
40az version
41```
42 
43**If not installed:**
44```
45mcp_azure_mcp_extension_cli_install(cli-type: "az")
46```
47 
48### 3. Authentication
49 
50```bash
51az account show
52```
53 
54**If not logged in:**
55```bash
56az login
57az account set --subscription <subscription-id>
58```
59 
60### 4. Initialize
61 
62```bash
63cd infra
64terraform init
65```
66 
67### 5. Format Check
68 
69```bash
70terraform fmt -check -recursive
71```
72 
73**Fix if needed:**
74```bash
75terraform fmt -recursive
76```
77 
78### 6. Validate Syntax
79 
80```bash
81terraform validate
82```
83 
84### 7. Plan Preview
85 
86```bash
87terraform plan -out=tfplan
88```
89 
90### 8. State Backend
91 
92Verify state is accessible:
93 
94```bash
95terraform state list
96```
97 
98### 9. Azure Policy Validation
99 
100See [Policy Validation Guide](../../policy-validation.md) for instructions on retrieving and validating Azure policies for your subscription.
101 
102### 10. Template Variable Resolution Check (AZD+Terraform)
103 
104> ⚠️ **CRITICAL for azd+Terraform projects.** azd substitutes `${VAR}` references in
105> `main.tfvars.json` via envsubst, but does NOT interpolate Go-style template variables
106> (`{{ .Env.* }}`). Unresolved Go-style template strings passed to Terraform cause
107> cascading deployment failures, state conflicts, and timeouts.
108 
109**Check for Go-style template variables:**
110 
111```bash
112# Check for Go-style template variables in Terraform files
113grep -rn '{{ *\.Env\.' infra/ --include='*.tf' --include='*.tfvars.json' || echo "OK: No Go-style template variables found"
114 
115# Check main.tfvars.json uses correct ${VAR} syntax
116if test -f infra/main.tfvars.json; then
117  grep -n '{{ *\.Env\.' infra/main.tfvars.json && echo "WARNING: Use \${VAR} syntax instead of {{ .Env.* }}" || echo "OK: main.tfvars.json syntax is correct"
118fi
119```
120 
121**If Go-style template variables are found:**
1221. **Fix the syntax** in `main.tfvars.json` — replace `{{ .Env.VAR }}` with `${VAR}`:
123   ```json
124   {
125       "environment_name": "${AZURE_ENV_NAME}",
126       "location": "${AZURE_LOCATION}"
127   }
128   ```
1292. For additional variables, use **`TF_VAR_*` environment variables**:
130   ```bash
131   azd env set TF_VAR_environment_name "$(azd env get-value AZURE_ENV_NAME)"
132   ```
1333. **Verify** that `variables.tf` declares all required variables
1344. **Re-run** `terraform validate` and `terraform plan` to confirm
135 
136**If `.tfvars.json` uses wrong syntax:**
137- Replace Go-style `{{ .Env.* }}` with `${VAR}` (azd's envsubst format)
138- Prefer putting static defaults in `variables.tf` `default` values. Using `terraform.tfvars` (HCL) for static defaults is acceptable if your team prefers it; this restriction is specifically about avoiding Go-style template expressions in `.tfvars.json` files.
139 
140## References
141 
142- [Error handling](./errors.md)
143 
144## Next
145 
146All checks pass → **azure-deploy**
147