A short monthly round-up of what moved in Terraform, the Azure provider, and the wider Infrastructure-as-Code world, in plain English, with a note on why each one matters. This is the first, so it also sweeps up a few things from the past few weeks.
Azure Verified Modules: Bicep landing zones go GA, classic ALZ-Bicep retires
The big one if you build Azure landing zones. Microsoft's Bicep implementation of the Platform Landing Zone, built entirely on Azure Verified Modules (AVM), is now generally available. AVM is the official, Microsoft-maintained module library for both Bicep and Terraform, with a defined lifecycle and clear ownership, and it's now the recommended way to stand up an enterprise landing zone.
The flip side: the classic ALZ-Bicep starter is on the way out. Microsoft deprecated the legacy module in February 2026 with a 12-month support window, and the ALZ-Bicep repository is set to be archived in February 2027.
What it means for you: if you're starting a landing zone today, start on the AVM-based platform landing zone, not the old starter. If you're already on ALZ-Bicep, there's a migration on the horizon, so plan it rather than wait for the archive date. The same AVM shift applies on the Terraform side, where AVM modules are the standard building blocks.
Source: Azure Verified Modules.
azurerm provider: 4.81.0, and moving fast
The Azure provider shipped 4.81.0 on 14 July, the latest in a near-weekly cadence (4.79 on 25 June, 4.80 on 2 July). Worth noting from the recent releases:
- Logic App Standard can now reference a Key Vault secret for its storage key (
storage_key_vault_secret_id): one more connection string that leaves your config. - New resources, including storage account table properties, Log Analytics workspace tables, and CDN Front Door batch rules.
- More "list" resources (backup policies, federated identity credentials, and others), part of Terraform's newer list-resource capability.
- Go bumped to 1.26.5, plus a run of API version upgrades across CDN, compute, and Key Vault.
What it means for you: pin the provider (~> 4.0, or tighter) and skim the changelog before you bump. A provider this active is great for coverage, and it's exactly why an unpinned version can change behaviour under you.
Source: azurerm changelog.
OpenTofu 1.12: state management gets nicer
OpenTofu, the open-source Terraform fork, released 1.12.0 on 14 May, and it keeps adding quality-of-life features:
destroy = false: remove a resource from state without destroying the real thing. The clean way to hand an object off or stop managing it.- Dynamic
prevent_destroy: the lifecycle flag can now read a variable, so you can protect production and leave dev deletable from the same code. tofu initnow records checksums for every platform automatically, so the "works on my machine, fails in CI" lock-file dance largely goes away.
What it means for you: if you've been curious about OpenTofu, the state-handling features are a real reason to look. Even if you stay on Terraform, destroy = false is the kind of thing worth knowing exists.
Source: OpenTofu 1.12.0.
Terraform core: 1.15.8 is current, older lines aging out
Terraform core's current stable line is 1.15, with 1.15.8 released on 8 July. HashiCorp supports a GA line for roughly two years, so the older versions are quietly dropping off. If you're still on 1.12 or earlier, you're at or past end of support.
What it means for you: check what you're pinned to. Being a version or two behind is normal and fine. Being past end of support means no more security fixes, which is the signal to plan an upgrade.
Source: Terraform releases.
That's the month. If one of these deserves a proper walk-through, say so and it'll become its own post.
A monthly round-up. Big releases get their own note when they land.