Azure Terraform

Complete modular Terraform configuration for deploying Azure infrastructure using the Terraform MCP Server.

🎯 Overview

This project demonstrates best practices for deploying Azure infrastructure using Terraform with a modular, reusable design. It creates a complete web application infrastructure with:

• High Availability: Application Gateway with multiple backend VMs
• Security: Network Security Groups, private subnets, NAT Gateway
• Scalability: Modular design, easy to scale horizontally
• Management: Jumpbox for secure access, remote state storage

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────┐
│                          Internet                               │
└────────────┬────────────────┬────────────────┬─────────────────┘
             │                │                │
     ┌───────▼─────┐  ┌──────▼──────┐  ┌─────▼──────┐
     │  App Gateway│  │   Jumpbox   │  │    NAT     │
     │  Public IP  │  │  Public IP  │  │  Gateway   │
     │  (HTTP/S)   │  │    (SSH)    │  │  Public IP │
     └───────┬─────┘  └──────┬──────┘  └─────┬──────┘
             │                │                │
┌────────────┴────────────────┴────────────────┴────────────────┐
│                    Virtual Network (10.10.0.0/16)             │
├───────────────────────────────────────────────────────────────┤
│  ┌──────────────────┐  ┌──────────────┐  ┌─────────────────┐ │
│  │ AppGW Subnet     │  │ Public       │  │ Private Subnet  │ │
│  │ (10.10.3.0/24)   │  │ Subnet       │  │ (10.10.2.0/24)  │ │
│  │                  │  │(10.10.1.0/24)│  │                 │ │
│  │ • App Gateway    │  │              │  │ • Web VM 0      │ │
│  │                  │  │ • Jumpbox VM │  │ • Web VM 1      │ │
│  │                  │  │              │  │ (Nginx)         │ │
│  └──────────────────┘  └──────────────┘  └─────────────────┘ │
│                                                                │
│  Network Security Groups:                                     │
│  • AppGW NSG: HTTP/HTTPS from Internet                       │
│  • Jumpbox NSG: SSH from specified CIDR                      │
│  • Web NSG: HTTP from AppGW, SSH from VNet                   │
└────────────────────────────────────────────────────────────────┘

📋 Components

Step 1: Resource Group & Backend

• Resource Group: rg-uday-demo in Central US
• Storage Account for Terraform remote state
• Storage Container for state files

Step 2: Network Infrastructure

• Virtual Network (10.10.0.0/16)
• 3 Subnets (Public, Private, App Gateway)
• NAT Gateway with public IP
• 3 Public IPs (App Gateway, Jumpbox, NAT)
• Route tables for custom routing

Step 3: Security

• 3 Network Security Groups
• Granular security rules
• Subnet associations

Step 4: Compute - Web VMs

• 2x Ubuntu Linux VMs (Standard_B1s)
• Private subnet (no public IPs)
• Cloud-init with Nginx
• Displays VM name, region, and private IP

Step 5: Compute - Jumpbox

• 1x Ubuntu Linux VM (Standard_B1s)
• Public subnet with static IP
• SSH access point to private resources

Step 6: Application Gateway

• Standard_v2 SKU
• HTTP listener on port 80
• Backend pool with web VMs
• Health probes
• Basic routing rules

🚀 Quick Start

TL;DR: Login to Azure → Configure SSH key → Run terraform apply

See QUICK_START.md for the fastest way to get started.

📖 Detailed Documentation

• Quick Start Guide - Get running in 5 minutes
• Deployment Guide - Step-by-step instructions
• Architecture README - Detailed component information

📁 Project Structure

.
├── README.md                          # This file
├── architecture.md                    # Architecture documentation
├── infra/                             # Terraform infrastructure code
│   ├── main.tf                        # Root module
│   ├── variables.tf                   # Root variables
│   ├── outputs.tf                     # Root outputs
│   ├── backend.tf                     # Backend configuration
│   ├── terraform.tfvars.example       # Example variables
│   ├── .gitignore                     # Git ignore rules
│   ├── README.md                      # Detailed architecture docs
│   ├── QUICK_START.md                 # Quick start guide
│   ├── DEPLOYMENT_GUIDE.md            # Detailed deployment guide
│   └── modules/                       # Reusable modules
│       ├── resource_group/            # Resource group + storage
│       ├── vnet/                      # Virtual network
│       ├── nsg/                       # Network security groups
│       ├── vm/                        # Web VMs
│       ├── jumpbox/                   # Jumpbox VM
│       └── application_gateway/       # Application Gateway
└── docs/                              # Additional documentation

✨ Features

Best Practices Implemented

✅ Modular Design: Each resource type in its own reusable module
✅ Clear Dependencies: Explicit dependencies with depends_on
✅ Variable Definitions: Well-documented with sensible defaults
✅ Comprehensive Tagging: Consistent tags across all resources
✅ Meaningful Outputs: Easy verification and integration
✅ Security First: Private VMs, NSG rules, SSH authentication
✅ High Availability: NAT Gateway, Application Gateway v2
✅ Remote State: Azure Blob Storage backend support

Terraform Features

• Modules: Composable, reusable components
• Local Values: Computed values and common tags
• Output Values: Inter-module communication
• Variables: Parameterized configuration
• Remote State: Team collaboration support
• Dependencies: Proper resource ordering

🔧 Prerequisites

• Azure subscription with Contributor access
• Azure CLI installed and configured
• Terraform >= 1.0
• SSH key pair (uday-azure)

📦 Deployment

Minimal Steps

# 1. Login to Azure
az login

# 2. Generate SSH key
ssh-keygen -t rsa -b 4096 -f ~/.ssh/uday-azure

# 3. Configure
cd infra
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars: add SSH key, unique storage account name

# 4. Deploy
terraform init
terraform apply

# 5. Access
terraform output application_gateway_public_ip
# Open http://<ip> in browser

Detailed Steps

See DEPLOYMENT_GUIDE.md for comprehensive instructions.

🔍 Verification

After deployment:

# View all outputs
terraform output

# Test the web application
curl http://$(terraform output -raw application_gateway_public_ip)

# SSH to jumpbox
ssh -i ~/.ssh/uday-azure azureuser@$(terraform output -raw jumpbox_public_ip)

# View deployment summary
terraform output deployment_summary

🧪 Testing

# Load balancing test
for i in {1..10}; do
  curl http://$(terraform output -raw application_gateway_public_ip)
  echo ""
done

# Should show responses from both web-0 and web-1

🗑️ Cleanup

cd infra
terraform destroy

Warning: This deletes all resources including the storage account!

💰 Cost Estimation

Approximate monthly costs (US region, as of 2025):

Resource	Quantity	Monthly Cost
Storage Account	1	$1-2
Virtual Network	1	Free
NAT Gateway	1	$33 + data
Public IPs	3	$11
VMs (Standard_B1s)	3	$30
Application Gateway (Standard_v2)	1	$125
Total		~$200

Cost Saving Tips:

• Stop VMs when not in use
• Use smaller VM sizes for testing
• Use autoscaling for Application Gateway

🛠️ Customization

Add More Web VMs

Edit terraform.tfvars:

web_vm_count = 3  # or more

Change VM Size

vm_size = "Standard_B2s"  # Larger VM

Change Region

location = "eastus"

Then run:

terraform plan
terraform apply

🔐 Security Considerations

For Production:

1. Restrict SSH Access:

   jumpbox_allowed_cidr = "your-office-ip/32"
   

2. Use Azure Bastion instead of Jumpbox public IP

3. Enable Azure Firewall for advanced protection

4. Use Key Vault for secrets management

5. Enable Diagnostic Logs for all resources

6. Implement Azure Policy for governance

7. Use Private Endpoints for storage accounts

📚 Learning Resources

• Terraform Azure Provider Docs
• Azure Architecture Center
• Terraform Best Practices
• Azure CLI Reference

🤝 Contributing

This is a demo project. Feel free to:

• Fork and customize for your needs
• Submit issues for bugs
• Suggest improvements

📄 License

This project is provided as-is for demonstration and learning purposes.

🙏 Acknowledgments

Built using:

• Terraform by HashiCorp
• Azure by Microsoft
• Terraform MCP Server for automated infrastructure generation

📞 Support

For issues:

1. Check the DEPLOYMENT_GUIDE.md troubleshooting section
2. Review Azure Portal for resource status
3. Check Terraform state: terraform show
4. Validate configuration: terraform validate

---

Ready to deploy? Head to QUICK_START.md or DEPLOYMENT_GUIDE.md!

Built with ❤️ using Terraform and Azure