Terraform 8: Configuring the azurerm provider (features {})
easy⏱ 5 mincourseterraform
The provider block
A provider block configures how Terraform talks to a platform: subscription, tenant, credentials, and behavior toggles. The azurerm provider requires a features {} block — even when empty — or init/plan fails. Leave it empty to accept defaults, or set nested blocks to change how specific resources behave.
provider "azurerm" {
features {}
}
Tuning behavior inside features {}
features {} groups per-resource-type behavior toggles. A common one is resource_group.prevent_deletion_if_contains_resources — a safety net so destroy refuses to delete a non-empty resource group. Set your subscription via subscription_id (or, better, the ARM_SUBSCRIPTION_ID environment variable so no ID lands in code).
provider "azurerm" {
# subscription_id is read from ARM_SUBSCRIPTION_ID when omitted here
features {
resource_group {
prevent_deletion_if_contains_resources = true
}
key_vault {
purge_soft_delete_on_destroy = false
}
}
}
Never hardcode secrets or tenant IDs
Authenticate via environment variables (ARM_CLIENT_ID, ARM_CLIENT_SECRET, ARM_TENANT_ID, ARM_SUBSCRIPTION_ID) or a managed identity — not literals in .tf files that get committed. Keep the provider block focused on behavior (features {}), and let the environment supply identity.
Validate a provider config
Model providerConfig with a boolean hasFeaturesBlock and a preventRgDeletion boolean. Write isValidAzurermConfig(cfg) that returns true only when hasFeaturesBlock is true (azurerm's hard requirement). Log the result for a config that has the features block.