Overview
Terraform and Bicep are both declarative infrastructure-as-code languages, and on Azure they can deploy the same resources, which is exactly why teams agonize over the choice. The fundamental split: Terraform is a cloud-agnostic tool that tracks what it deployed in its own state file and talks to Azure through a provider; Bicep is an Azure-only language that compiles to ARM templates and hands deployment to Azure Resource Manager itself, with no state file to manage at all.
Feature comparison
| Terraform | Bicep | |
|---|---|---|
| Cloud scope | Multi-cloud (AWS, Azure, GCP, Kubernetes, SaaS providers, …) | Azure only |
| Language | HCL | Bicep DSL, transpiles to ARM template JSON |
| State | State file you must store and protect (remote backend, locking) | None; Azure Resource Manager is the source of truth |
| New Azure features | Waits on the azurerm provider (or the AzAPI escape hatch) | Day-one support; any new ARM API version works immediately |
| Preview changes | terraform plan | what-if deployments |
| Deleting removed resources | Automatic; anything gone from config is destroyed on apply | Deployment stacks; classic incremental deployments don't delete |
| Modularity | Modules, public registry | Modules, Azure Container Registry or template specs |
| Ecosystem | Huge; thousands of providers, mature CI/CD patterns | Focused; first-class VS Code extension and Azure Pipelines/GitHub Actions tasks |
| License | Business Source License 1.1 (open-source fork: OpenTofu, MPL 2.0) | MIT, open source |
| Beyond infrastructure | Providers manage DNS, GitHub, Datadog, identity providers, … | ARM resources only |
Where Terraform tends to win
Anything that isn't exclusively Azure. If your platform spans AWS and Azure, or "infrastructure"
includes GitHub repos, Cloudflare DNS, and a monitoring SaaS, Terraform manages all of it with one
language, one workflow, and one dependency graph. Its plan/apply model with explicit state also
makes drift visible: terraform plan tells you when reality no longer matches config, and
destroying what you removed from code is the default behavior rather than an extra feature. The
talent pool and module ecosystem are the largest in infrastructure-as-code by a wide margin.
Where Bicep tends to win
All-in-on-Azure teams. No state file means no state storage account, no state locking, no
corrupted-state incidents, and no secrets sitting in a state blob, Azure itself already knows what
exists. New Azure services and API versions work the day they ship instead of waiting on a
provider release. The tooling is genuinely excellent: the VS Code extension gives full
autocomplete and type checking against real ARM schemas, and what-if previews come straight from
Resource Manager. If your team lives in the Azure portal and Azure DevOps, Bicep has the shortest
learning curve and zero extra infrastructure to operate.
Note
Terraform's 2023 move from open source to the Business Source License matters to some organizations and not at all to others, the license only restricts building competing products, not normal use. If it matters to yours, OpenTofu is the community fork that stayed open source under MPL 2.0 and remains broadly compatible.
Verdict
This one genuinely comes down to scope. If Azure is one cloud among several, or your definition of infrastructure extends past it, Terraform is the clear choice and Bicep isn't really a candidate. If you are committed to Azure and want the lowest-friction, lowest-maintenance path, native tooling, day-one API support, no state to babysit, Bicep is the better fit, and "we might go multi-cloud someday" is rarely a strong enough reason to pass on it today.