Mx Infrastructure - Terraform Project¶

A comprehensive Terraform infrastructure-as-code project for deploying and managing the Marketing (Mx) platform on Microsoft Azure. This project provides multi-environment support with standardized configurations for Dev, QA, UAT, and Production environments.

Overview¶

The Mx Infrastructure project manages Azure resources for multiple marketing applications including: - AIO - All-in-One Marketing Platform - HFH - Homes for Heroes Platform
- Hub - Central Hub Application - MIP - Marketing Integration Platform - Portal - Marketing Portal Application

Key Features¶

Multi-Environment Support: Dev, QA, UAT, and Production environments
Modular Design: Reusable Terraform modules for consistent deployments
Azure Integration: Full Azure cloud infrastructure with networking, security, and monitoring
Container Support: Azure Container Registry integration for containerized applications
Database Management: Elastic SQL pools and databases with configurable performance tiers
Security: Key Vault integration, private endpoints, and network security rules
Monitoring: Application Insights integration for telemetry and monitoring

Project Structure¶

mx-infrastructure/
├── 📁 environments/                    # Environment-specific configurations
│   ├── 📁 dev/                        # Development environment
│   │   ├── backend.tf                 # Remote state configuration
│   │   ├── dev.tf                     # Dev-specific resources
│   │   └── providers.tf               # Provider configurations
│   ├── 📁 qa/                         # QA environment
│   │   ├── backend.tf
│   │   ├── qa.tf
│   │   └── providers.tf
│   └── 📁 uat/                        # UAT environment
│       ├── backend.tf
│       ├── uat.tf
│       └── providers.tf
│
├── 📁 mx-resources/                    # Core infrastructure module
│   ├── app-insights.tf               # Application monitoring
│   ├── app-service-plan.tf           # Hosting platform
│   ├── virtual-network.tf            # Network infrastructure
│   ├── key-vault.tf                  # Secrets management
│   ├── elastic-sqlserver.tf          # Database infrastructure
│   └── variables.tf                  # Input variables
│
├── 📁 mx-projects/                     # Application-specific modules
│   ├── 📁 aio/                        # All-in-One platform
│   │   ├── linux-app-service.tf      # Containerized app
│   │   ├── elastic-sqldb.tf          # Dedicated database
│   │   └── frontdoor.tf              # Global load balancer
│   ├── 📁 hfh/                        # Homes for Heroes
│   ├── 📁 hub/                        # Central Hub (includes Functions)
│   ├── 📁 mip/                        # Marketing Integration Platform
│   └── 📁 portal/                     # Marketing Portal
│
└── 📁 Documentation
    ├── README.md                      # This project guide
    └── ARCHITECTURE.md                # Technical architecture

Module Dependencies¶

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   environments/ │───▶│   mx-resources/ │───▶│   mx-projects/  │
│                 │    │                 │    │                 │
│ • dev.tf        │    │ • Core infra    │    │ • Applications  │
│ • qa.tf         │    │ • Networking    │    │ • Databases     │
│ • uat.tf        │    │ • Security      │    │ • Front Doors   │
└─────────────────┘    └─────────────────┘    └─────────────────┘

Prerequisites¶

Required Tools¶

Terraform: ~> 1.9 (1.x.x)
Azure CLI: Latest version for authentication
Azure DevOps Service Connection: For automated deployments

Required Permissions¶

Contributor access to target Azure subscriptions
Access to Azure Container Registry for image pulls
Key Vault access for secrets management

Getting Started¶

1. Authentication¶

# Login to Azure
az login

# Set the subscription (replace with your subscription ID)
az account set --subscription "your-subscription-id"

2. Initialize Terraform¶

Navigate to the desired environment directory:

cd environments/dev
terraform init

3. Plan Deployment¶

terraform plan

4. Apply Configuration¶

terraform apply

Environment Configuration¶

Development Environment¶

Network: 10.221.112.0/23
Debug Mode: Enabled
DNS Servers: ["10.221.7.20", "10.220.8.20"]
Hub VNet: Connected to CmgHubDevVnet01

QA Environment¶

Network: Custom address space
Debug Mode: Disabled
Production-like configuration with reduced capacity

UAT Environment¶

Network: Custom address space
Production mirror for user acceptance testing
Full security and monitoring enabled

Key Variables¶

Required Variables¶

Variable	Description	Type
`environment_name`	Environment name (Dev/Qa/Uat/Prod)	`string`
`webAppEnableDebugMode`	Enable debug mode for web apps	`bool`
`azure_devops_service_connection_id`	ADO service connection Object ID	`string`
`vnet_address_space`	Virtual network address space	`string`
`remote_hub_vnet_id`	Hub VNet resource ID for peering	`string`
`container_registry_id`	Container registry resource ID	`string`

Optional Variables¶

Variable	Default	Description
`project_name`	"Mx"	Project/application name
`location`	"westus2"	Azure region
`appservice_plan_capacity`	1	App Service Plan instances
`sql_sku_name`	"StandardPool"	SQL database SKU
`sql_min_compute_capacity`	10	SQL pool min compute
`sql_max_compute_capacity`	100	SQL pool max compute

Infrastructure Components¶

Core Resources (`mx-resources/`)¶

Core Infrastructure Components:

Component	Purpose	Configuration
🏗️ Resource Groups	Logical organization	Environment-specific grouping
🌐 Virtual Network	Network isolation	`10.221.112.0/23` address space
🖥️ App Service Plan	Compute platform	Linux containers, auto-scaling
🔐 Key Vault	Secrets management	Private endpoint, RBAC policies
📊 Application Insights	Monitoring	Telemetry and performance tracking
🗄️ SQL Server	Database platform	Private endpoint, audit policies
📈 Elastic Pool	Shared DB resources	Standard tier, DTU-based scaling

Security & Networking Layer:

    ┌─────────────────────────────────────────────────────────────┐
    │                     Virtual Network                         │
    │                   (10.221.112.0/23)                       │
    │                                                            │
    │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐    │
    │  │ App Service  │  │   Database   │  │  Management  │    │
    │  │    Subnet    │  │    Subnet    │  │    Subnet    │    │
    │  └──────────────┘  └──────────────┘  └──────────────┘    │
    │                                                            │
    │  ┌─────────────────────────────────────────────────────┐  │
    │  │            Network Security Groups                  │  │
    │  │            Private Endpoints                        │  │
    │  │            DNS Integration                          │  │
    │  └─────────────────────────────────────────────────────┘  │
    └─────────────────────────────────────────────────────────────┘
                                    │
                              Hub VNet Peering
                                    │
    ┌─────────────────────────────────────────────────────────────┐
    │                       Hub Network                           │
    │                 DNS: 10.221.7.20, 10.220.8.20            │
    └─────────────────────────────────────────────────────────────┘

Application Modules (`mx-projects/`)¶

Application Architecture:

┌─────────────────────────────────────────────────────────────────────┐
│                        APPLICATION LAYER                            │
├─────────────┬─────────────┬─────────────┬─────────────┬─────────────┤
│     AIO     │     HFH     │     Hub     │     MIP     │   Portal    │
│  Platform   │   Homes     │   Central   │ Integration │  Marketing  │
│             │ for Heroes  │     Hub     │  Platform   │   Portal    │
└─────────────┴─────────────┴─────────────┴─────────────┴─────────────┘
       │             │             │             │             │
       └─────────────┼─────────────┼─────────────┼─────────────┘
                     │             │             │
                     ▼             ▼             ▼
┌─────────────────────────────────────────────────────────────────────┐
│                       SHARED SERVICES                               │
│                                                                     │
│  🌍 Azure Front Door    🐳 Container Registry    🔐 Key Vault      │
│  🗄️ SQL Server         📊 Application Insights  🔒 Private Endpoints│
└─────────────────────────────────────────────────────────────────────┘

Per-Application Components:

Application	App Service	Functions	Database	Front Door	Secrets
AIO	✅ Linux Container	❌	✅ Dedicated DB	✅ Global LB	✅ App-specific
HFH	✅ Linux Container	❌	✅ Dedicated DB	✅ Global LB	✅ App-specific
Hub	✅ Linux Container	✅ Event Processing	✅ Dedicated DB	✅ Global LB	✅ App-specific
MIP	✅ Linux Container	❌	✅ Dedicated DB	✅ Global LB	✅ App-specific
Portal	✅ Linux Container	❌	✅ Dedicated DB	✅ Global LB	✅ App-specific

Security Features¶

Network Security¶

Private endpoints for PaaS services
Network security groups with restrictive rules
VNet peering with centralized hub
DNS resolution through private zones

Identity and Access¶

Service connection-based authentication
Key Vault access policies
Role-based access control (RBAC)
Managed identities for applications

Data Protection¶

SQL audit policies with retention
Encrypted storage and transmission
Backup and disaster recovery
Compliance with security standards

Monitoring and Observability¶

Application Insights¶

Performance monitoring
Error tracking and diagnostics
Custom telemetry and metrics
Alerting and notifications

SQL Monitoring¶

Database performance insights
Query performance tracking
Audit log retention (30-730 days)
Automated backup management

Deployment Pipeline¶

Azure DevOps Integration¶

CI/CD Pipeline Workflow:

┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│ 📝 Source   │───▶│ 🔧 Build    │───▶│ ✅ Test     │───▶│ 🚀 Deploy   │
│ Control     │    │ Pipeline    │    │ Validation  │    │ Pipeline    │
└─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘
       │                   │                   │                   │
   Feature Branch    Terraform Init    Terraform Plan    Terraform Apply
   Pull Request      Terraform Validate    Security Scan     Environment Deploy
   Code Review       Lint & Format     Integration Tests    State Management

Environment Promotion Flow:

    Development               QA               UAT              Production
        │                     │                │                    │
        ▼                     ▼                ▼                    ▼
┌──────────────┐    ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│  🔧 DEV      │───▶│  🧪 QA       │───▶│  👥 UAT      │───▶│  🏭 PROD     │
│              │    │              │    │              │    │              │
│ • Auto       │    │ • Auto       │    │ • Manual     │    │ • Manual     │
│ • Fast Fail  │    │ • Testing    │    │ • Approval   │    │ • Approval   │
│ • Debug      │    │ • Validation │    │ • Full Scale │    │ • Monitoring │
└──────────────┘    └──────────────┘    └──────────────┘    └──────────────┘

State Management:

Component	Configuration	Purpose
🗄️ Remote Backend	Azure Storage Account	Centralized state storage
🔒 State Locking	Azure Blob Lease	Prevent concurrent modifications
💾 State Backup	Versioned blobs	Recovery and rollback capability
🔐 Encryption	Azure encryption at rest	State file security

Best Practices¶

State file security and locking
Plan review before apply
Environment promotion workflow
Rollback capabilities

Troubleshooting¶

Common Issues¶

Authentication Errors
Verify Azure CLI login
Check service connection permissions
Validate subscription access
Network Connectivity
Verify VNet peering configuration
Check DNS server settings
Validate network security rules
Resource Conflicts
Check for naming conflicts
Verify resource availability in region
Review quota limits

Useful Commands¶

# Check Terraform state
terraform state list

# Import existing resources
terraform import azurerm_resource_group.example /subscriptions/.../resourceGroups/example

# Refresh state
terraform refresh

# Target specific resources
terraform apply -target=module.example

Contributing¶

Development Workflow¶

Create feature branch from master
Make changes in appropriate environment
Test in development environment
Submit pull request with detailed description
Deploy to QA/UAT for validation
Promote to production

Code Standards¶

Use consistent naming conventions
Document all variables and outputs
Include validation rules where applicable
Follow Terraform best practices
Maintain backward compatibility

Support¶

For questions or issues: - Technical Issues: Create issue in repository - Access Requests: Contact Azure administrators - Feature Requests: Submit through standard change process

License¶

This project is proprietary to CMG Financial Services and is not licensed for external use.