diff --git a/internal/meta/base_meta.go b/internal/meta/base_meta.go
index 56f1c4a..3355b5a 100644
--- a/internal/meta/base_meta.go
+++ b/internal/meta/base_meta.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/Azure/aztfy/pkg/config"
 	"github.com/Azure/aztfy/pkg/log"
+	"github.com/zclconf/go-cty/cty"
 
 	"github.com/Azure/aztfy/internal/client"
 	"github.com/Azure/aztfy/internal/resmap"
@@ -75,7 +76,7 @@ type baseMeta struct {
 	devProvider       bool
 	backendType       string
 	backendConfig     []string
-	providerConfig    map[string]string
+	providerConfig    map[string]cty.Value
 	fullConfig        bool
 	parallelism       int
 	hclOnly           bool
@@ -569,14 +570,13 @@ func (meta *baseMeta) buildTerraformConfig(backendType string) string {
 }
 
 func (meta *baseMeta) buildProviderConfig() string {
-	lines := []string{"  features {}"}
+	f := hclwrite.NewEmptyFile()
+	body := f.Body().AppendNewBlock("provider", []string{"azurerm"}).Body()
+	body.AppendNewBlock("features", nil)
 	for k, v := range meta.providerConfig {
-		lines = append(lines, fmt.Sprintf("  %s = %s", k, v))
+		body.SetAttributeValue(k, v)
 	}
-	return fmt.Sprintf(`provider "azurerm" {
-%s
-}
-`, strings.Join(lines, "\n"))
+	return string(f.Bytes())
 }
 
 func (meta *baseMeta) initTF(ctx context.Context) error {
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 0a75acc..40daf6d 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -4,6 +4,7 @@ import (
 	"github.com/Azure/aztfy/pkg/telemetry"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/arm"
+	"github.com/zclconf/go-cty/cty"
 )
 
 type OutputFileNames struct {
@@ -36,10 +37,10 @@ type CommonConfig struct {
 	// BackendConfig specifies an array of Terraform backend configs.
 	BackendConfig []string
 	// ProviderConfig specifies key value pairs that will be expanded to the terraform-provider-azurerm settings (i.e. `azurerm {}` block)
-	// Currently, only the top level attribute whose type is string is supported.
+	// Currently, only the attributes (rather than blocks) are supported.
 	// This is not used directly by aztfy binary as the provider configs can be set by environment variable already.
 	// While it is useful for module users that want support multi-users scenarios in one process (in which case changing env vars affect the whole process).
-	ProviderConfig map[string]string
+	ProviderConfig map[string]cty.Value
 	// FullConfig specifies whether to export all (non computed-only) Terarform properties when generating TF configs.
 	FullConfig bool
 	// Parallelism specifies the parallelism for the process