Managing dev, staging, and production in Azure is easier when every environment shares the same Terraform modules—but with isolated state and clear promotion paths.
One module, many workspaces
Keep environment-specific values in .tfvars files or Terraform Cloud workspaces instead of duplicating entire stacks. DRY modules, explicit variables.
Remote state per environment
Store state in separate Azure Storage accounts or containers with locking enabled. Never share state files across environments.
Pipeline-gated applies
Run terraform plan on every PR; restrict apply to protected branches with manual approval for production.
Policy as code
Combine Terraform with Azure Policy or OPA to catch drift and non-compliant resources before they reach prod.