Terraform Modules

This page explains the reusable Terraform modules that make up the platform. Think of each module as a building block with a clear purpose, such as networking, monitoring, gateway access, or shared service deployment.

Module Overview

Deployment Script: deploy-terraform.sh

A wrapper script that simplifies Terraform operations with proper Azure authentication. Features auto-import of conflicting resources and intelligent retry logic.

Usage

./initial-setup/infra/deploy-terraform.sh  [options]

Commands:
  init     Initialize Terraform with backend configuration
  plan     Preview infrastructure changes
  apply    Apply infrastructure changes (with auto-import & retry)
  destroy  Destroy all infrastructure
  output   Display Terraform outputs

Examples

./initial-setup/infra/deploy-terraform.sh init
./initial-setup/infra/deploy-terraform.sh plan
./initial-setup/infra/deploy-terraform.sh apply

# Deploy only bastion
./initial-setup/infra/deploy-terraform.sh apply \
  -target=module.bastion

# Deploy only jumpbox
./initial-setup/infra/deploy-terraform.sh apply \
  -target=module.jumpbox

Monitoring Module

Provides centralized observability across all deployed resources using Azure Monitor services.

Network Module

Configures subnets within an existing VNet and creates Network Security Groups (NSGs) for traffic control.

Bastion Module

Deploys Azure Bastion for secure, browser-based SSH/RDP access to VMs without exposing public IPs.

Jumpbox Module

Creates a Linux VM for development and administration tasks, pre-configured with essential CLI tools.

Azure Proxy Module (Chisel Tunnel)

This module deploys a Chisel tunnel server so platform maintainers can reach private Azure resources from a local machine. It solves the problem of trying to access private endpoints while you are outside the virtual network.

# Get credentials from Terraform output
terraform output azure_proxy_chisel_auth
terraform output azure_proxy_url

# Connect to private PostgreSQL database
docker run --rm -it -p 5432:5432 jpillora/chisel:latest client \
  --auth "tunnel:XXXXXXXX" \
  https://your-app.azurewebsites.net \
  0.0.0.0:5432:private-postgres.postgres.database.azure.com:5432

# Now connect locally
psql -h localhost -p 5432 -U admin -d mydb

Choosing Your Access Method

The infrastructure provides four optional access methods for reaching Azure resources. You do not need all of them. Enable only the methods your team actually uses, because each one exists to solve a different access problem.

# terraform.tfvars
enable_bastion              = false
enable_jumpbox              = false
enable_azure_proxy          = false
github_runners_aca_enabled  = false

# Uses public GitHub runners
# Good for: Resource-only Terraform

# terraform.tfvars
enable_bastion              = true
enable_jumpbox              = true
enable_azure_proxy          = true
github_runners_aca_enabled  = true

# All access methods available
# Good for: Platform maintainers

See Access Methods Architecture Diagram for a visual overview.

Backend Configuration

Terraform state is stored in Azure Blob Storage with Azure AD authentication.

# infra/backend.tf
terraform {
  backend "azurerm" {
    resource_group_name  = "your-resource-group"
    storage_account_name = "tfstateaccount"
    container_name       = "tfstate"
    key                  = "terraform.tfstate"
    use_azuread_auth     = true  # Required for OIDC
  }
}

Variables Reference

Key variables used across modules: