Terraform Azure IaC Automation

I am streamlining our Azure estate and want clean, reusable Infrastructure-as-Code that can be dropped into any environment with minimal tweaks. The immediate scope is clear:

• Terraform modules that fully provision and configure Azure Virtual Machines along with their supporting networking (VNets, subnets, NSGs, public / private IPs, route tables, the works).
• Separate modules for our storage layer—Azure Blob Storage and Azure Files—covering account creation, lifecycle and replication settings, access tiers, private endpoints and RBAC.

Each module should expose sensible variables, enforce tagging, and include module-level tests (Terratest or similar). Once the code is ready, I want it wired into a DevOps pipeline so that every commit can validate, plan and apply against multiple workspaces (dev, test, prod) with manual approvals. Azure DevOps YAML is preferred, but a GitHub Actions workflow that achieves the same gates is also fine.

Acceptance criteria
1. Running ‘terraform init/plan/apply’ from the root spins up VMs, networking and storage in the subscription I point to, with no post-manual fixes.
2. State is stored remotely and locked (Azure Storage backend or Terraform Cloud).
3. CI pipeline lints, validates, plans, then awaits manual approval before apply; failed runs must be traceable in the logs.
4. Modules are documented in a concise README and sample variables file.

If you have prior experience automating Azure resources at scale and can demonstrate solid, idiomatic Terraform, I would love to review your approach and timelines.