Making Azure Policy and Terraform work together

Azure Policy and Terraform have complementary roles. Policy evaluates resources against organisational rules; Terraform declares and manages infrastructure configuration.

Problems can arise when both are configured to change the same property without an agreed approach.

Understand the policy effect

Audit, deny, modify and deployment effects behave differently. Review the Azure Policy effect documentation before deciding how a policy should interact with infrastructure as code.

For example, a policy that modifies tags may affect the configuration Terraform expects to manage. Resources deployed through policy also need a clear ownership and support model.

Document the boundary

Agree which settings Terraform will manage and which controls policy will enforce. Test the interaction and review the resulting plans.

Any exclusions or ignored changes should have a documented reason and owner. A cloud and infrastructure review can help identify where configuration ownership needs to be clarified.