Terraform Infrastructure

Overview

This Terraform configuration deploys a complete, production-ready infrastructure on Microsoft Azure. Our Infrastructure as Code (IaC) approach enables automated, repeatable, and consistent deployments across multiple environments (Dev, QA, UAT, Production).

Infrastructure Architecture

Our infrastructure follows a hub-and-spoke architecture with complete isolation between environments. Each environment contains its own Resource Group, Virtual Network, Storage Account, and Virtual Machines.

Multi-Environment Azure Infrastructure - Complete Isolation

Architecture Highlights

• Resource Group: Logical container for all environment resources
• Virtual Network (VNet): Isolated network per environment (10.x.0.0/16)
• Subnet: Network segment for VMs (10.x.1.0/24)
• Network Security Group (NSG): Firewall rules (SSH, HTTP, HTTPS)
• Public IP: Static IP with custom DNS label
• Virtual Machine: Ubuntu 22.04 LTS with NGINX
• Storage Account: Blob storage for application data

Infrastructure Components

1. Resource Group

Example Names: rg-swarup-dev, rg-swarup-prod

2. Storage Account

• DEV: LRS replication (Locally Redundant Storage)
• PROD: GRS replication (Geo-Redundant Storage)
• HTTPS-only, private access, automatic backups

3. Virtual Network (VNet)

4. Network Security Group (NSG)

5. Virtual Machine

Terraform Project Structure

Our Terraform project follows best practices with a modular architecture that promotes reusability, maintainability, and scalability.

Modular Terraform Project Structure

Project Organization

Terraform Project Organization - File Structure & Module Layout

Module Architecture

Each module is self-contained with three key files:

• main.tf - Resource definitions
• variables.tf - Input variables
• outputs.tf - Output values for other modules

State Management

Remote State Backend

Terraform state files are stored in Azure Blob Storage instead of local disk. This enables team collaboration, state locking, and disaster recovery.

State File Organization

Azure Blob Storage - Environment State File Organization

Environment-Specific Variables

Environment-specific configuration is managed through .tfvars files. Same code, different values = different environments!

Variable Hierarchy

Terraform loads variables in this order (later overrides earlier):

1. Default values in variables.tf
2. Environment variables (TF_VAR_*)
3. terraform.tfvars (common values)
4. secrets.auto.tfvars (gitignored secrets)
5. environments/*.tfvars (environment-specific)

Variable Comparison

🚀 Deployment Commands - Multiple Options

# Deploy to DEV environment
terraform apply -var-file="environments/dev.tfvars"
                        
# Deploy to QA environment
terraform apply -var-file="environments/qa.tfvars"
                        
# Deploy to UAT environment
terraform apply -var-file="environments/uat.tfvars"
                        
# Deploy to PRODUCTION environment
terraform apply -var-file="environments/prod.tfvars"
                        

# Deploy Infrastructure
.\terraform\powershell\deploy.ps1 -Environment dev -Action apply

# Destroy Infrastructure
.\terraform\powershell\deploy.ps1 -Environment dev -Action destroy

# Plan Only (Review Changes)
.\terraform\powershell\deploy.ps1 -Environment prod -Action plan

# Initialize Terraform with Backend
terraform init -backend-config="key=terraform-dev.tfstate"

# Validate Configuration
terraform validate

# Format Code
terraform fmt -recursive

# Plan Changes
terraform plan -var-file="environments/dev.tfvars" -out=tfplan

# Apply with Plan File
terraform apply tfplan

# Apply with Auto-Approve (Careful!)
terraform apply -var-file="environments/dev.tfvars" -auto-approve

# Show Current State
terraform show

# List All Resources
terraform state list

# Destroy Everything
terraform destroy -var-file="environments/dev.tfvars"

# Trigger via GitHub UI:
# 1. Go to Actions tab
# 2. Select "Deploy Infrastructure" workflow
# 3. Click "Run workflow"
# 4. Select environment (dev/qa/uat/prod)
# 5. Choose action (apply/destroy)
# 6. Click "Run workflow"

# Automatic trigger on push to main:
git add .
git commit -m "Update infrastructure"
git push origin main

# Access Web Dashboard:
# 1. Open: https://your-website.azurewebsites.net/Terraform.html
# 2. Click "Deploy Infrastructure" button
# 3. Select Environment (DEV/QA/UAT/PROD)
# 4. Enter Security PIN
# 5. Click "Deploy Now"
# 6. Monitor progress in real-time

GitHub Secrets Authentication

Sensitive credentials (VM passwords, Azure credentials) are never stored in code. Instead, they're securely managed through GitHub Secrets and injected at deployment time.

Authentication Flow

1. GitHub Secrets: Credentials stored encrypted in GitHub repository settings
2. Workflow Environment Variables: GitHub Actions reads secrets and sets TF_VAR_* variables
3. Terraform Variables: Terraform reads environment variables automatically
4. Azure Resources: Credentials used to create VMs, never exposed in logs

Required GitHub Secrets

OIDC Authentication (Modern & Secure)