Forem: Deepak Sharma

🚀 Terraform Azure Infrastructure (Modular Architecture + DevSecOps)

Deepak Sharma — Thu, 27 Nov 2025 06:17:02 +0000

Code Structure

.
├── azure-pipelines.yml                 # Azure DevOps CI/CD pipeline 
├── main
│   ├── main.tf                         # Module orchestration
│   ├── provider.tf                     # Azure provider configuration
│   ├── terraform.tfvars                # Input variable values
│   └── variable.tf                     # Module variables
├── modules
│   ├── 01_resource_group               # Resource Group creation
│   ├── 02_storage_account              # Storage Accounts
│   ├── 03_storage_container            # Storage Containers
│   ├── 04-Public_IP                    # Public IP
│   ├── 05_Virtual_Net                  # VNet & Subnets
│   ├── 06_sql_server                   # Azure SQL Server
│   ├── 07_sql_database                 # Azure SQL Database
│   ├── 08_net_interface                # Network Interfaces
│   └── 09_Virtual_Machine              # Azure VM
└── README.md

3-Tier Terraform Infra + Azure Pipeline Architecture Diagram

Git Repository URL:

https://github.com/deepak83s143/3-Tier-Application-Infra-with-SAST-Scanning-Azure-Pipeline.git

Features

Modular Terraform structure
Incremental resource creation
Environment-based scalability
Azure backend remote state configuration
DevSecOps validation:
Terraform Validation (terraform validate)
- tfsec security scan
- tflint linting
Manual approval stage before provisioning

Technologies

Terraform — IaC provisioning
AzureRM Provider
Azure DevOps Pipeline
tfsec — Static security scan
tflint — Terraform linting and provider validation

Terraform Workflow (Modules)

The root main/main.tf orchestrates creation in dependency order:

Resource Group
Storage Account
Storage Container
Public IP
Virtual Network & Subnets
SQL Server
SQL Database
Network Interface
Virtual Machine

Each module accepts input variables and returns useful outputs such as IDs, names, and connection objects.

Remote State Backend

Azure backend ensures centralized state storage.

backendAzureRmResourceGroupName: "ResourceGroupName"
backendAzureRmStorageAccountName: "StorageAccountName
backendAzureRmContainerName: "StorageContainerName"
backendAzureRmKey: "KeyName"

Azure DevOps Pipeline Overview

Pipeline stages:
- Integration
- Terraform init
- Terraform validate
SanityCheck
- tfsec security scan
- tflint recursive lint
CodePlanning
- terraform plan
ManualValidation
- Manual approval by reviewer
InfraCreation
- terraform apply (auto approve)

SAST Tools

tfsec

Performs static vulnerability scanning
Detects insecure Terraform configurations
Ensures cloud compliance

Used with:

task: tfsec@1
dir: $(System.DefaultWorkingDirectory)/main
version: v1.26.0

tflint

Validates wrong resource types, regions, and deprecated resources
Provider-specific rule sets

Run manually:

tflint --recursive

Variables & tfvars

User inputs are stored in:

main/variable.tf
main/terraform.tfvars

Examples include:

Resource Group configuration
Storage details
VNet CIDR blocks and subnet ranges
SQL server credentials
VM sizing and OS details

Note! :- Never commit sensitive credentials to Git.

Best Practices

Follow module boundaries strictly
No direct resource creation in main.tf
Use tfsec & tflint before merge
Always review plan outputs
Store secrets in:
- Azure KeyVault
- DevOps Library secure variables

Notes

Designed for IaC repeatability
Suitable for multi-environment deployments (dev/stg/prod)
Scalable due to isolated Terraform modules

👉 Follow me on

🚀 Azure Pipeline for Terraform Deployment (Dev & Prod Environments)

Deepak Sharma — Mon, 01 Sep 2025 08:20:33 +0000

Managing infrastructure with Terraform is one of the most common practices in modern DevOps workflows. But when it comes to automation and governance, Azure DevOps pipelines make the process much smoother.

In this blog, I’ll walk you through a real-world Azure DevOps pipeline that deploys Terraform infrastructure to Dev and Prod environments with manual approvals in between.

🔑 Prerequisites

Before setting up this pipeline, make sure you have the following in place:

Active Azure Subscription You need a valid Azure subscription where your Terraform resources will be deployed.
Azure DevOps Account An Azure DevOps project should be created to host your pipeline and repository.
Self-Hosted Agent Pool A self-hosted agent is required to run Terraform tasks. This gives more control and avoids limitations of Microsoft-hosted agents.
App Registration with Federated Credentials Create an App Registration in Azure AD and configure it with federated credentials. This will be used as the Service Connection (SPN) in Azure DevOps to authenticate Terraform with Azure.
Terraform Code A working Terraform configuration (with .tf files and .tfvars for Dev and Prod) must be present in your repository.

📌 Pipeline Overview

This pipeline is designed with two major stages:

Dev Stage → Runs Terraform init, plan, requires manual approval, and then applies changes on the Dev environment.
Prod Stage → After Dev is successful, it requires another manual approval and then applies changes to the Prod environment.

By using manual validations, we ensure that no changes are applied accidentally in production without human approval.

🔧 Key Features of the Pipeline

Multi-stage deployment → Dev first, then Prod.
Terraform AzureRM backend → Stores the Terraform state in an Azure Storage Account.
Manual validations → Adds an approval step before applying changes.
Reusable variables → Service connection, resource group, storage account, and container details are stored as variables to avoid repetition.

📝 Pipeline YAML

Here’s the YAML code for the pipeline:

trigger:
- master

pool:
  name: mademitech

variables:
  serviceConnection: 'mademi-spn'
  rgName: 'mademi-rg'
  storageAccount: 'mademisg'
  containerName: 'mademistatefiles'

stages:
  - stage: Dev
    jobs:
      - job: Validate_Dev
        displayName: Validate on Dev
        steps:
          - task: TerraformTask@5
            displayName: Init Dev
            inputs:
              provider: 'azurerm'
              command: 'init'
              backendServiceArm: $(serviceConnection)
              backendAzureRmResourceGroupName: $(rgName)
              backendAzureRmStorageAccountName: $(storageAccount)
              backendAzureRmContainerName: $(containerName)
              backendAzureRmKey: 'dev.tfstate'

          - task: TerraformTask@5
            displayName: Plan Dev
            inputs:
              provider: 'azurerm'
              command: 'plan'
              commandOptions: '-var-file=dev.tfvars --lock=false'
              environmentServiceNameAzureRM: $(serviceConnection)

      - job: ManualValidation
        displayName: Manual Approval for Dev Deployment
        dependsOn: Validate_Dev
        pool: server
        steps:
          - task: ManualValidation@1
            inputs:
              notifyUsers: 'deepak83s143@gmail.com'
              onTimeout: 'resume'

      - job: Deploy_Dev
        displayName: Deploy on Dev
        dependsOn: ManualValidation
        steps:
          - task: TerraformTask@5
            displayName: Apply Dev
            inputs:
              provider: 'azurerm'
              command: 'apply'
              commandOptions: '-var-file=dev.tfvars --auto-approve --lock=false'
              environmentServiceNameAzureRM: $(serviceConnection)

  - stage: Prod
    dependsOn: Dev
    jobs:
      - job: ManualValidation_Prod
        displayName: Manual Approval for Prod
        pool: server
        steps:
          - task: ManualValidation@1
            inputs:
              notifyUsers: 'deepak83s143@gmail.com'
              onTimeout: 'resume'

      - job: Deploy_Prod
        displayName: Deploy on Prod
        dependsOn: ManualValidation_Prod
        steps:
          - task: TerraformTask@5
            displayName: Init Prod
            inputs:
              provider: 'azurerm'
              command: 'init'
              backendServiceArm: $(serviceConnection)
              backendAzureRmResourceGroupName: $(rgName)
              backendAzureRmStorageAccountName: $(storageAccount)
              backendAzureRmContainerName: $(containerName)
              backendAzureRmKey: 'prod.tfstate'

          - task: TerraformTask@5
            displayName: Apply Prod
            inputs:
              provider: 'azurerm'
              command: 'apply'
              commandOptions: '-var-file=prod.tfvars --auto-approve'
              environmentServiceNameAzureRM: $(serviceConnection)

🔍 Step-by-Step Explanation

1. Trigger & Pool

trigger:
- master

This pipeline runs automatically whenever code is pushed to the master branch.
The pool is set to mademitech, which means it will run on a self-hosted agent.

2. Variables

variables:
  serviceConnection: 'mademi-spn'
  rgName: 'mademi-rg'
  storageAccount: 'mademisg'
  containerName: 'mademistatefiles'

These variables store reusable values for the backend configuration.
If tomorrow you change your storage account or service connection, you only need to update it once here.

3. Dev Stage

Init: Initializes Terraform with AzureRM backend and points to the Dev state file.
Plan: Runs terraform plan using dev.tfvars.
Manual Validation: Waits for approval before applying changes.
Apply: Applies the infrastructure changes on Dev.

4. Prod Stage

Depends on Dev → Ensures that only after successful Dev deployment, Prod stage runs.
Manual Validation: Extra safety check before deploying to Prod.
Init + Apply: Runs Terraform init and applies changes using prod.tfvars.

✅ Why This Approach?

Governance → Manual approvals ensure no accidental changes hit production.
Reusability → Variables make the pipeline maintainable.
Safety → Dev is always tested first before Prod.
Automation + Control → Combines Terraform automation with human oversight.

🎯 Final Thoughts

This pipeline strikes a balance between automation and manual governance. It’s a solid starting point for teams looking to deploy infrastructure with Terraform while keeping production safe.

From here, you can also enhance it by:

Adding linting & validation steps before plan.
Integrating policy checks with tools like Terraform Cloud or OPA.
Using templates for even more reusability.

👉 Follow me on

🚀 Terraform Module Example – Resource Group Creation on Azure

Deepak Sharma — Tue, 19 Aug 2025 11:05:25 +0000

This project demonstrates how to create an Azure Resource Group using Terraform modules.

By using modules, we can organize our code better, promote reusability, and simplify management of infrastructure.

📂 Project Structure

parent_module/
│── main.tf
│
└── modules/
└──── resource_group/
├────── resource_group.tf
├────── variables.tf

🔹 1. `main.tf` (in parent_module directory)

This is the root configuration file where we call our module.

module "rg_create" {
  source      = "../modules/resource_group"
  rg_name     = "mademi-rg1"
  rg_location = "centralus"
}

Explanation:

module "rg_create" → Declares a module block named rg_create.
source = "../modules/resource_group" → Points to the directory where our module is located.
rg_name → Resource Group name passed to the module (mademi-rg1).
rg_location → Azure region where the Resource Group will be created (centralus).

🔹 2. resource_group.tf (inside modules/resource_group)

This file defines the actual resource that Terraform will create.

resource "azurerm_resource_group" "mademi-rg" {
  name     = var.rg_name
  location = var.rg_location 
}

Explanation:

azurerm_resource_group → Azure Resource Group resource type.
name → Uses the value of the variable rg_name.
location → Uses the value of the variable rg_location.

🔹 3. variables.tf (inside modules/resource_group)

This file declares the input variables that the module will accept.

variable "rg_name" {
  type = string
}

variable "rg_location" {
  type = string
}

Explanation:

rg_name → The name of the Resource Group (string type).
rg_location → The Azure region (string type).

These variables are provided from the parent module (main.tf).

⚙️ How to Run

Initialize Terraform (downloads Azure provider and module dependencies):
```
terraform init
```
Validate configuration:
```
terraform validate
```
Preview changes:
```
terraform plan
```
Apply changes (create resource group):
```
terraform apply --auto-approve
```

✅ Final Output

Terraform will create an Azure Resource Group named:

mademi-rg1

in the region:

centralus

📘 Key Learning

Modules in Terraform make code reusable and clean.
Instead of writing resources directly in the root main.tf, you can package them into modules and pass values as variables.
This is especially useful when you manage large infrastructure with multiple environments.

👉 This setup can be extended further by adding:

Virtual Networks
Storage Accounts
Virtual Machines
and other Azure resources inside modules.

👉 Follow me on

Forem: Deepak Sharma

🚀 Terraform Azure Infrastructure (Modular Architecture + DevSecOps)

Code Structure

3-Tier Terraform Infra + Azure Pipeline Architecture Diagram

Git Repository URL:

Features

Technologies

Terraform Workflow (Modules)

Remote State Backend

Azure DevOps Pipeline Overview

SAST Tools

Variables & tfvars

Best Practices

Notes

🚀 Azure Pipeline for Terraform Deployment (Dev & Prod Environments)

🔑 Prerequisites

📌 Pipeline Overview

🔧 Key Features of the Pipeline

📝 Pipeline YAML

🔍 Step-by-Step Explanation

✅ Why This Approach?

🎯 Final Thoughts

🚀 Terraform Module Example – Resource Group Creation on Azure

📂 Project Structure

🔹 1. main.tf (in parent_module directory)

Explanation:

🔹 2. resource_group.tf (inside modules/resource_group)

Explanation:

🔹 3. variables.tf (inside modules/resource_group)

Explanation:

⚙️ How to Run

✅ Final Output

📘 Key Learning

🔹 1. `main.tf` (in parent_module directory)