Leveraging GitHub Actions with Terraform for Multi-Subscription Azure Deployments

Leveraging GitHub Actions with Terraform for Multi-Subscription Azure Deployments

Managing infrastructure across multiple Azure subscriptions can become complex. This guide demonstrates how to effectively utilize GitHub Actions with Terraform to streamline deployments and enhance your workflow.

1. Project Setup

Begin by creating a new repository in your GitHub organization. Initialize a new directory within the repository for your Terraform configurations.

2. Terraform Configuration

Structure: Organize your Terraform configurations into separate directories for each subscription. This promotes modularity and maintainability.

Example:

• ./subscription1/
• ./subscription2/

Within each subscription directory:

• Create a main.tf file to define your infrastructure resources.
• Utilize variables to manage subscription-specific parameters (e.g., subscription ID, resource group).
• Consider using workspaces to manage different environments (e.g., dev, test, prod) within a single subscription.

3. GitHub Actions Workflow

Create a .github/workflows/terraform.yml file to define your workflow.

Key Steps:

• Checkout: Check out the repository code.
• Setup Azure CLI: Install and configure the Azure CLI.
• Authenticate to Azure: Utilize service principals or managed identities to authenticate with each Azure subscription.
• Terraform Initialization: Initialize Terraform working directories for each subscription.
• Terraform Plan: Generate an execution plan for each subscription.
• Terraform Apply: Apply the plan to provision infrastructure in each subscription.
• Output: Gather and display relevant outputs (e.g., resource IDs).

4. Workflow Example (Simplified)

name: Terraform Deploy

on:
  push:
    branches: [ "main" ]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - name: Setup Azure CLI
      uses: azure/setup-az@v1

    - name: Login to Subscription 1
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS_SUB1 }}

    - name: Terraform Init - Subscription 1
      run: |
        cd ./subscription1
        terraform init

    - name: Terraform Plan - Subscription 1
      run: |
        cd ./subscription1
        terraform plan -out=plan.out

    - name: Terraform Apply - Subscription 1
      run: |
        cd ./subscription1
        terraform apply plan.out

    # ... Repeat for Subscription 2 ... 

5. Important Considerations

• Security: Prioritize security by utilizing service principals with restricted permissions and managing secrets securely within your GitHub repository.
• Idempotency: Ensure your Terraform configurations are idempotent to avoid unexpected behavior during subsequent deployments.
• Testing: Implement thorough testing strategies, including unit tests for your Terraform modules and integration tests for your entire infrastructure.
• Version Control: Adhere to proper version control practices for your Terraform configurations and infrastructure-as-code.
• Documentation: Maintain clear and concise documentation for your infrastructure and deployment processes.

6. Benefits

• Increased Efficiency: Automate infrastructure provisioning and reduce manual effort.
• Improved Consistency: Ensure consistent deployments across multiple subscriptions.
• Enhanced Collaboration: Facilitate collaboration among team members.
• Reduced Risk: Minimize the risk of human error and improve the overall stability of your infrastructure.