Bicep or Terraform for an Azure landing zone platform

Both languages are fully supported for the platform landing zone, so the choice rests on how each behaves over years of updates, not on whether it can deploy the first release.

Learn’s comparison concludes that multicloud or hybrid automation favours Terraform, and that if your environment involves frequent out-of-band changes Bicep is more forgiving. Team skills and your existing pipelines usually decide the rest.

Terraform state is part of the platform

Terraform state is stored in plain text and can contain secrets, so Learn treats it as sensitive. Keep it remotely in an Azure Storage blob container, never locally or in the repository: local state doesn’t work for teams and is easily deleted. Blob storage locks state automatically during writes, preventing corruption from concurrent runs, and encrypts it at rest. Learn’s sample uses an access key, but its own key points tell you to evaluate the backend’s authentication options for production and to restrict network access with a storage firewall, service endpoint or private endpoint. For stateful resources it suggests prevent_destroy in a lifecycle block and a careful review of every plan for unexpected replacements. The accelerator’s bootstrap, described later, creates the state storage and grants the pipeline identities access to it, which settles most of these decisions for you.

Bicep and deployment stacks

A deployment stack manages a set of resources as one unit. When a resource is removed from the template, the stack detaches it by default, or deletes it if actionOnUnmanage is set to delete; deny settings can also block changes to managed resources outside the stack. Stacks can be created at resource group, subscription or management group scope. The AVM-based Bicep accelerator uses management group deployment stacks with DeleteAll, so policy assignments removed from a new ALZ library version are cleaned up on the next deployment. Its documentation says its CI pipelines preview changes with standard deployments because stacks didn’t support what-if when the pipelines were built, and those previews may not show deletions exactly. Learn now documents what-if for deployment stacks, which reports resources that will be deleted or detached, so check whether your pipeline version has moved to it.

Common pitfall: Keeping Terraform state on a laptop or committing it to the repository - Learn warns that state is plain text, can include secrets and is easily lost when local; use a locked, encrypted Azure Storage backend with restricted network access and identity-based access for the pipeline.

Common pitfall: Assuming an incremental Bicep deployment removes what you deleted from the template - incremental deployments leave removed resources in place; use deployment stacks (or Complete mode where supported) and check the stack’s actionOnUnmanage setting, because the default only detaches.

Get the whole book

This note is one section of Azure Landing Zones: Building an Azure Foundation with the Cloud Adoption Framework, an independent guide in the Ultra Transcenders Beyond the Exam series, with comparison tables, diagrams, the common pitfalls and tested companion code, plus a glossary linked to Microsoft Learn.

About the book · Azure Landing Zones terms in the glossary · All free notes from Azure Landing Zones