Azure DevOps IaC Pipeline

Multi-stage YAML pipeline with Terraform gates, approvals, and Slack alerts.

A multi-stage Azure DevOps pipeline for infrastructure as code. Stages progress from lint and validate through plan (with a diff posted as a PR comment) to apply, gated by an environment approval. Slack notifications fire on plan diff and apply completion.

Tech Stack

Features

• Lint stage: tflint + terraform fmt check
• Validate stage: terraform validate against real AWS credentials
• Plan stage: output posted as PR comment via Azure DevOps REST API
• Apply stage: gated by environment approval in Azure DevOps
• Slack webhook notification on plan diff and successful apply

Pipeline Stages

The pipeline has four stages: `lint`, `validate`, `plan`, and `apply`. The first three run automatically on every push. The `apply` stage waits for a manual approval via an Azure DevOps environment check — only designated reviewers can ungate it.

PR Comments

After a successful plan, a pipeline script calls the Azure DevOps REST API to post the Terraform plan output as a comment on the active pull request. This gives reviewers the infrastructure diff without leaving the PR view.

Setup

Create an Azure DevOps service connection for AWS (access key + secret, or OIDC). Set pipeline variables: `TF_VAR_*` for your inputs, `SLACK_WEBHOOK` for notifications. Import `azure-pipelines.yml` from the repository root.

File Structure