Q:

How can one use Azure Service Connection in Azure DevOps Server 2019 (on-prem) to run terraform from a script running in a release stage?

So I am aware of a couple Azure DevOps terraform tasks. But we wrap our terraform calls with powershell scripts, so these tasks are of no use to us.
So, given that we call terraform from scripts the only way we could find to make terraform authenticate is by following this procedure:

Create Service Connection using the Service Principal dedicated to the pod
Create a variable group and link it to the Key Vault containing the SP credentials.
Every task running the powershell code wrapping terraform would have environment variables ARM_CLIENT_ID and ARM_CLIENT_SECRET mapped to the variables in the variable group from (2). ARM_TENANT_ID and ARM_SUBSCRIPTION_ID are set accordingly.

But this is incredibly cumbersome. Is it possible to do it with just the Service Connection?

A:

Is it possible to do it with just the Service Connection?

I am afraid it is impossible to do it with just the Service Connection for the powershell scripts.
According to the Microsoft replied:

This is as per service connection design and security considerations. Scripts in the build or release are not allowed to
  access secrets stored in service connections.

You can check the ticket here.
Hope this helps.

