I am working in a Terraform code. The requirements are:

* Put TF state file onto Azure storage account. The access key to the
storage account must be secured.
* My TF program authenticate using
Service Principal which client\_id, client\_secret, tenant\_id should be
encrypted and put onto Azure storage account.

My idea is to use a single KeyVault which contains all above secured secrets. But how a terraform program could secure the access key, connection to access the KeyVault? This is about management plane.

According to: <https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow>
, this provides a way of coding authorization request that the application has already registered on Azure AD service previously.
How can I apply the similar idea with Terraform code? Or may you suggest any better way to realize the idea?

Thanks a lot.