Enterprise Azure Terraform Lab Phase 1 Part 3 : Network, Storage, and Monitoring Baseline

📁 GitHub Repository: lwc-wk/enterprise-azure-lab1

Enterprise Azure Terraform Lab Phase 1 Part 3 : Network, Storage, and Monitoring Baseline

🧩 Background

After creating the Terraform foundation, the next step was to build the core Azure infrastructure baseline.

This part focuses on:

• Virtual Network design
• Subnet segmentation
• Network Security Group baseline
• Storage Account security
• Log Analytics Workspace

The goal is not to create a huge enterprise network. The goal is to show that even a small lab can follow enterprise design principles.

🌐 Virtual Network and Subnet Segmentation

The lab uses a simple VNet:

Address space: 10.10.0.0/16

Two subnets are created:

subnet-app        10.10.1.0/24
subnet-management 10.10.2.0/24

Purpose:

• Demonstrate subnet segmentation
• Separate application-facing and management-oriented resources
• Prepare for future private endpoints or more advanced network controls

🛡️ Network Security Group Baseline

A Network Security Group is created and associated with both subnets.

The custom rule denies inbound Internet traffic:

Name: Deny-Inbound-Internet
Priority: 4000
Direction: Inbound
Access: Deny
Source: Internet
Destination: *
Port: *
Protocol: *

Phase 1 does not deploy:

• VM
• Bastion
• Public SSH
• Public RDP

Why?

Because there is no reason to expose management ports when the lab does not need them.

Use Azure CLI:

az network nsg list \
    --resource-group rg-infra-dev-azlab \
    --output table

Inspect NSG rule:

az network nsg rule list \
    --resource-group rg-infra-dev-azlab \
    --nsg-name nsg-infra-dev-azlab \
    --output table

💾 Storage Account Security Baseline

The lab creates an ephemeral Storage Account separate from the Terraform backend Storage Account.

Security baseline:

• Standard tier
• LRS replication
• Minimum TLS 1.2
• HTTPS-only traffic
• Public blob access disabled
• Terraform-managed tags

Why LRS?

LRS is cost-efficient and enough for a lab.

If you forgot the Storage Account name Run:

az storage account list l
    --resource-group rg-tfstate-enterprise-lab \
    --query "[].name"
    --output table

📊 Log Analytics Workspace

The Log Analytics Workspace is the monitoring foundation.

Current settings:

SKU: PerGB2018
Retention: 30 days

Important distinction:

Log Analytics Workspace = monitoring destination
Diagnostic Settings     = pipeline that sends resource logs into it

🧾 Summary

This part of the lab created the infrastructure baseline:

• VNet with separated subnets
• NSG baseline rule to deny inbound Internet traffic
• Secure Storage Account settings
• Log Analytics Workspace as the monitoring destination

This is where the lab starts to look like real infrastructure instead of a cloud-themed screenshot collection.