Case Study: Azure Terraform CI/CD Infrastructure Platform

01 Executive Overview

The Azure Terraform & CI/CD Infrastructure Platform is a modular, production-ready Infrastructure as Code (IaC) deployment framework built for Microsoft Azure. The project eliminates manual cloud console resource provisioning by establishing automated, repeatable infrastructure landing zones through version-controlled Terraform modules and automated GitHub Actions pipelines.

✓ Author Contribution & Authorship Boundary

Sole author. Designed and implemented the reusable Terraform modules for Resource Groups, Virtual Networks, Subnets, and Azure Key Vault; established isolated multi-environment directory layouts (environments/dev and environments/prod); and authored the multi-stage GitHub Actions CI/CD pipeline configuring passwordless OpenID Connect (OIDC) federated Azure authentication.

02 Problem & System Objectives

The Infrastructure Anti-Pattern

Ad-hoc cloud provisioning through web portals or manual CLI commands introduces severe operational vulnerabilities:

Configuration Drift: Undocumented changes made directly in cloud consoles cause production environments to diverge from testing environments.
Secret Exposure Hazards: Storing long-lived cloud service principal credentials (client secrets or certificates) inside CI/CD repository secrets creates permanent credential theft risks if compromised.
Non-Reproducible Deployments: Lack of modularization forces engineering teams to copy-paste configurations, propagating misconfigurations across development, staging, and production tiers.

System Objectives

Zero Long-Lived Secrets: Authenticate GitHub Actions CI/CD runners to Azure exclusively using passwordless OpenID Connect (OIDC) token federation.
Strict Environment Isolation: Separate configuration variables, remote state backends, and access credentials between dev and prod tiers.
Automated Quality Gates: Enforce automated linting (terraform fmt -check, tflint), syntax validation, and dry-run plan generation on every pull request prior to merge.

03 Solution Architecture

The platform combines modular Terraform abstractions with an automated GitOps delivery pipeline:

GitOps Delivery & Azure Cloud Architecture

[Developer Commit / Pull Request to main]
                   │
                   ▼
       [GitHub Actions CI/CD Runner]
                   │
       ┌───────────┴───────────┐
       ▼                       ▼
[terraform fmt -check]    [terraform validate]
       │
       ▼
[Passwordless OIDC Azure Authentication]
(Short-Lived JWT Token ──► Azure Entra ID Federated Credential)
                   │
                   ▼
     [Remote State Acquisition]
  (Azure Blob Storage with Lease Lock)
                   │
       ┌───────────┴───────────┐
       ▼                       ▼
[terraform plan: dev]    [terraform plan: prod]
 (Plan posted to PR for peer review)
                   │
                   ▼ (Merge to main)
     [Automated terraform apply]
                   │
                   ▼
     [Azure Secure Landing Zone]
 ├── Resource Group (East US / West Europe)
 ├── Virtual Network (10.0.0.0/16)
 │    ├── App Subnet (10.0.1.0/24)
 │    └── Data Subnet (10.0.2.0/24) + Network Security Groups
 └── Azure Key Vault (RBAC Authorization + Soft Delete)

Modular Directory Layout

The repository establishes clean structural boundaries:

modules/resource_group/: Provisions standardized resource groupings with mandatory cost-center and environment tags.
modules/vnet/: Provisions software-defined Virtual Networks, custom subnets, and Network Security Group (NSG) rules.
modules/key_vault/: Provisions Azure Key Vault with Azure role-based access control (RBAC) and soft-delete protection.
environments/dev/ and environments/prod/: Self-contained root modules declaring environment-specific remote state storage containers and parameter variables.

04 Implementation Details

Implemented Security & CI/CD Features

Passwordless OIDC Federation: The workflow exchanges a GitHub-issued OIDC JSON Web Token (JWT) directly with Microsoft Entra ID (Azure AD). Azure validates the token subject claim (repo:alimulfazalnabil/azure-terraform-cicd-foundation:ref:refs/heads/main), granting short-lived scoped permissions without storing static passwords.
Automated Pull-Request Dry Runs: Pull requests automatically trigger dry-run plans for both development and production tiers, enabling reviewers to inspect intended resource changes before any infrastructure is modified.
State Locking: Remote backend configurations utilize Azure Blob Storage containers with native blob leasing to prevent race conditions during concurrent CI/CD pipeline runs.

💡 Key Engineering Decision: Passwordless OIDC over Service Principals

Traditional CI/CD configurations store client secrets with 1-2 year expiration dates. When credentials expire, deployments break; if stolen, attackers gain permanent cloud access. Transitioning to OpenID Connect token federation eliminates secrets entirely: tokens are ephemeral, cryptographically bound to specific branches, and expire within minutes.

05 Evaluation & Verification Evidence

The infrastructure platform has been verified through pipeline automation and syntax evaluation:

Automated Pipeline Execution: The GitHub Actions workflow (terraform-pipeline.yml) successfully executes formatting checks, provider initialization, and schema validation.
Modular Reusability: Tested across separate dev and prod configurations with zero module code duplication.

⚠️ Evaluation Scope Note

In accordance with portfolio credibility standards: This codebase is maintained as an infrastructure automation reference and portfolio showcase. It is not tied to a permanently active, paid production Azure landing zone to prevent recurring cloud hosting costs.

06 Challenges & Engineering Trade-offs

Engineering Decision	Trade-off Accepted	Mitigation Strategy
Strict Environment Directories	Requires maintaining separate `main.tf` files for dev and prod rather than Terraform Workspaces.	Ensures total blast-radius isolation; accidental dev state mutations cannot touch production infrastructure.
OIDC Subject Claims	Initial Azure Entra ID federated credential setup requires manual tenant configuration.	Documented exact step-by-step federated identity configuration in the repository README.

07 Future Roadmap

Terratest Integration: Author automated Go-based infrastructure tests to programmatically verify that deployed subnets and endpoints are reachable after provisioning.
Policy as Code (Conftest / OPA): Enforce corporate security policies (e.g. banning public IP assignments on storage accounts) at the pull-request stage.
Cost Estimation via Infracost: Integrate automated monthly cloud expenditure estimates directly into GitHub pull-request review comments.