docs(terraform): document S3 and Azure Blob state backends

[lakshmimsft]

Summary

Add a user-facing guide for configuring Terraform recipe state in existing S3 or Azure Blob storage.

The guide covers:

• Storage prerequisites, registered credentials, and required permissions.
• Bicep examples creating TerraformSettings and a new Environment.
• Required state prefixes, backend immutability, and the lack of state migration.
• Installation-wide credential scope and its implications for state isolation.
• Post-destroy state cleanup and troubleshooting.

Add links from Environment management and the cloud-credentials overview.

Reason for change

Radius PRs radius-project/radius#13078 and radius-project/radius#13110 added cloud Terraform backends and E2E coverage. Contributor documentation describes the implementation, but users also need practical configuration instructions and clear lifecycle limitations.

How to test

Documentation checks

• Build the site with cd docs && npm ci && npm run build.
• Open the new guide under Management → Configure Terraform state.
• Verify links from the Environment management and cloud-credentials pages.
• Run Markdown and spelling checks on the changed pages.

Example validation

Use a dedicated Radius installation containing the backend feature and a compatible Bicep extension.

1. Create the namespace for the chosen example.
2. Prepare a Recipe Pack in the target Radius Resource Group.
3. Deploy the S3 or Azure settings/Environment example.
4. Read TerraformSettings back and confirm that properties.backend contains the expected storage location and prefix.
5. Confirm that the Environment references those settings.

To verify actual backend access, provision storage, register credentials with the documented permissions, and deploy an application using Terraform recipes. Settings creation alone does not validate cloud storage or authentication.

File change summary

File	Summary of change
docs/content/management/terraform-state/_index.md	New cloud-state configuration guide with S3/Azure examples, prerequisites, safety constraints, verification, and troubleshooting.
docs/content/management/environments/_index.md	Adds cloud state storage as a TerraformSettings use case, warns against redirecting existing deployments, and links to the guide.
docs/content/installation/cloud-providers/_index.md	Explains that backend access uses the registered default cloud credential and links to storage-permission guidance.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Static Web App Preview

Environment	Deployment
pr2035	View workflow run

Deployed from commit 05c9dfc4f591ac26226b95cca387908249cbcff6 via the publisher workflow.

[Copilot]

🟡 Changes recommended

Several Bicep examples omit the required location property, and documentation accuracy issues remain.

2 open findings

• Describe backend cleanup logging as outcome logging, not warnings · New
• TerraformSettings reference omits the backend property · New

What changed in this PR

Documents configuring Terraform state backends in existing S3 or Azure Blob storage.

Changes:

• Adds setup guidance, permissions, lifecycle constraints, troubleshooting, and Bicep examples.
• Links backend guidance from Environment and cloud-credential documentation.
• Documents credential scope and state isolation limitations.

File	Summary
docs/​content/​management/​terraform-state/​_index.md	New S3/Azure Terraform state backend guide.
docs/​content/​management/​environments/​_index.md	Adds cloud-backed Terraform state guidance.
docs/​content/​installation/​cloud-providers/​_index.md	Links backend access to registered cloud credentials.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[willtsai]

Please give this another pass to ensure flow and clarity for the reader.