Enterprise Azure Terraform Lab Phase 1 Part 1: Foundation and Remote State

📁 GitHub Repository: lwc-wk/enterprise-azure-lab1

Enterprise Azure Terraform Lab Phase 1 Part 1: Foundation and Remote State

🧩 Background

This lab is not about building a fancy frontend application.

The real goal is to prove that I can design, deploy, explain, validate, and clean up Azure infrastructure using Terraform.

The core idea is simple:

Fake UI is acceptable. Fake architecture is not.

The React dashboard can stay simple. The infrastructure behind it must be real, explainable, repeatable, and cost-aware.

This Phase 1 lab simulates a small enterprise-style Azure environment for an internal business application. It focuses on:

• Resource organization
• Terraform Infrastructure as Code
• Remote state
• Virtual networking
• Subnet segmentation
• Storage Account security
• Monitoring foundation
• App Service hosting
• Budget alerts
• Basic Azure RBAC
• Destroy-after-validation discipline

🧠 Design Philosophy

Before writing Terraform, I defined the engineering principles first.

Least Privilege

Nobody should receive more access than required.

In Phase 1, this means avoiding broad Owner or Contributor access unless absolutely necessary.

Segmentation

Different functions should be separated.

Even though this is a low-cost lab, the network is designed with separate subnets:

• Application subnet
• Management subnet

This keeps the design simple while still showing enterprise-style thinking.

Auditability

I should be able to explain:

• What exists
• Why it exists
• Who can access it
• How it is monitored
• How it would change in production

Repeatability

The lab must be deployable, testable, and destroyable with Terraform.

terraform init
terraform fmt
terraform validate
terraform plan
terraform apply
terraform destroy

Low Cost

This lab intentionally avoids unnecessary expensive services.

Phase 1 does not use:

• Virtual Machines
• Bastion
• Load Balancer
• Azure Firewall
• Always-on paid tiers unless temporarily needed

Paid tiers are only used briefly for validation screenshots, then scaled down or destroyed.

🏗️ Architecture Model

The lab is split into two layers.

Permanent Layer

This layer stores Terraform state and should normally stay alive.

It is created manually first with Azure CLI.

rg-tfstate-enterprise-lab
└── Storage Account
    └── Blob container: tfstate

Why this exists:

• Terraform needs a safe place to store state.
• Local terraform.tfstate is fragile.
• The backend should survive lab destroy operations.
• It separates long-lived state infrastructure from short-lived lab infrastructure.

Ephemeral Lab Layer

This is the actual portfolio lab.

It can be deployed when needed and destroyed afterward.

rg-infra-dev-azlab2
├── Virtual Network
│   ├── subnet-app
│   └── subnet-management
├── Network Security Group
├── Storage Account
├── Log Analytics Workspace
├── App Service Plan
├── Azure Linux Web App
├── Diagnostic Settings
├── Resource Group Budget
└── Optional RBAC Assignments

This layer is designed to be disposable.

📁 Repository Structure

The repository is organized to separate app code, Terraform code, environment variables, screenshots, and helper scripts.

enterprise-azure-terraform-lab/
├── README.md
├── architecture.md
├── SOUL.md
├── app/
│   └── React + Vite + TypeScript dashboard
├── docs/
│   ├── screenshots/
│   └── diagrams/
├── env/
│   ├── dev.tfvars
│   ├── demo.tfvars
│   ├── local.secrets.tfvars      # not committed
│   └── local.rbac.tfvars         # not committed
├── infra/
│   ├── backend.tf
│   ├── versions.tf
│   ├── providers.tf
│   ├── locals.tf
│   ├── generic-input-variables.tf
│   ├── random-resources.tf
│   ├── resource-group.tf
│   ├── network.tf
│   ├── security.tf
│   ├── storage.tf
│   ├── monitoring.tf
│   ├── diagnostics.tf
│   ├── app-service.tf
│   ├── budget.tf
│   ├── rbac.tf
│   ├── outputs.tf
│   ├── autoscale.tf.disabled
│   └── app-service-slot.tf.disabled
└── scripts/
    ├── init-backend.sh
    ├── deploy-infra.sh
    ├── deploy-app.sh
    └── destroy.sh

🧾 Why Split Terraform Files?

The Terraform code is split by responsibility.

This makes the code easier to understand, maintain, and explain in an interview.

🧱 Terraform Backend

Terraform backend is created manually first.

The backend uses:

• Resource Group
• Storage Account
• Blob container

Example backend configuration:

terraform {
  backend "azurerm" {
    resource_group_name  = "rg-tfstate-enterprise-lab"
    storage_account_name = "sttfstatexxxxx"
    container_name       = "tfstate"
    key                  = "enterprise-azure-lab-dev.tfstate"
  }
}

Important lesson:

The backend is not part of the destroyable lab layer.

The backend Resource Group should stay:

rg-tfstate-enterprise-lab

The lab Resource Group can be destroyed:

rg-infra-dev-azlab2

🏷️ Variables, Locals, and Naming

Environment-specific values are placed in env/dev.tfvars.

business_division       = "infra"
environment             = "dev"
project_name            = "azlab2"
resource_group_location = "centralus"
owner                   = "lw"

monthly_budget_amount = 10
budget_start_date     = "2026-05-01T00:00:00Z"

During testing, the first Resource Group had partial deployment and App Service capacity issues. Changing the project name to azlab2 forced Terraform to create a clean resource naming set.

Example naming pattern:

infra-dev-azlab2

Resources become:

rg-infra-dev-azlab2
vnet-infra-dev-azlab2
nsg-infra-dev-azlab2
law-infra-dev-azlab2
asp-infra-dev-azlab2
app-infra-dev-azlab2-xxxxxx

Common tags are used for governance and cost awareness.

common_tags = {
  Project     = "enterprise-azure-lab"
  Environment = var.environment
  Owner       = var.owner
  ManagedBy   = "terraform"
  CostControl = "destroy-after-validation"
}

🧹 Resource Group as Lifecycle Boundary

The Resource Group is the lifecycle boundary of the lab.

It groups all ephemeral lab resources together.

This makes cleanup simple:

terraform destroy -var-file="../env/dev.tfvars"

🧾 Summary

In this first part, I built the foundation of the lab:

• Defined the architecture principles
• Separated permanent backend resources from disposable lab resources
• Created a Terraform remote state backend
• Organized Terraform files by responsibility
• Standardized naming and tags
• Used the Resource Group as the lifecycle and cost boundary

This is the base layer. Without this, the rest of the lab would just be random Azure clicking with better lighting.