diff --git a/.vscode/settings.json b/.vscode/settings.json
index e086aa277..4cf10d6eb 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -29,5 +29,8 @@
   "python.testing.unittestEnabled": false,
   "[terraform]": {
     "editor.defaultFormatter": "hashicorp.terraform"
+  },
+  "[terraform-vars]": {
+    "editor.defaultFormatter": "hashicorp.terraform"
   }
 }
diff --git a/terraform/azure-pipelines.yml b/terraform/azure-pipelines.yml
index aa47617a8..655ae74c6 100644
--- a/terraform/azure-pipelines.yml
+++ b/terraform/azure-pipelines.yml
@@ -27,6 +27,8 @@ stages:
               provider: azurerm
               command: init
               workingDirectory: "$(System.DefaultWorkingDirectory)/terraform"
+              # https://developer.hashicorp.com/terraform/tutorials/automation/automate-terraform#automated-terraform-cli-workflow
+              commandOptions: -input=false
               # service connection
               backendServiceArm: Production
               # needs to match main.tf
@@ -41,7 +43,7 @@ stages:
               command: plan
               # wait for lock to be released, in case being used by another pipeline run
               # https://discuss.hashicorp.com/t/terraform-plan-wait-for-lock-to-be-released/6870/2
-              commandOptions: -lock-timeout=2m
+              commandOptions: -input=false -lock-timeout=2m
               workingDirectory: "$(System.DefaultWorkingDirectory)/terraform"
               # service connection
               environmentServiceNameAzureRM: Production
@@ -53,7 +55,7 @@ stages:
               provider: azurerm
               command: apply
               # (ditto the lock comment above)
-              commandOptions: -lock-timeout=2m
+              commandOptions: -input=false -lock-timeout=2m
               workingDirectory: "$(System.DefaultWorkingDirectory)/terraform"
               # service connection
               environmentServiceNameAzureRM: Production