🏗️ Azure Landing Zone Lab

# Deploy minimal infrastructure
deploy_firewall         = true
deploy_vpn_gateway      = false
deploy_onprem_simulation = false

# Test load balancing
curl http://<lb_frontend_ip>  # Observe round-robin between web01-prd and web02-prd

# RDP to individual servers
mstsc /v:<lb_frontend_ip>:3389  # web01
mstsc /v:<lb_frontend_ip>:3390  # web02

# Enable hybrid scenario
deploy_vpn_gateway       = true
deploy_onprem_simulation = true
enable_bgp               = true  # Optional: Enable BGP routing

# From jumpbox, test firewall rules
Test-NetConnection -ComputerName google.com -Port 443
Invoke-WebRequest -Uri https://ifconfig.me  # Check SNAT IP

# Enable AKS
deploy_aks = true

# Connect to cluster
az aks get-credentials --resource-group rg-workload-prod-lab-<location_short> --name aks-prod-lab-<location_short>
kubectl get nodes

# From jumpbox, access Key Vault
$secret = Get-AzKeyVaultSecret -VaultName "kv-azlab-xxxx" -Name "admin-password"

# Test SQL connectivity
Test-NetConnection -ComputerName "sql-xxxx.database.windows.net" -Port 1433

// Sample KQL query for VM performance
Perf
| where ObjectName == "Processor" and CounterName == "% Processor Time"
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 5m)
| render timechart

# Enable Application Gateway
deploy_application_gateway = true
appgw_waf_mode             = "Detection"  # or "Prevention"

git clone https://github.com/Jamonygr/azure-landing-zone-lab.git
cd azure-landing-zone-lab

# Copy example config
cp terraform.tfvars.example terraform.tfvars

# Edit configuration (set at minimum subscription_id and admin credentials)
code terraform.tfvars

# Login to Azure and set the target subscription
az login
az account set --subscription "<your-subscription-id>"

# Initialize Terraform
terraform init

# Plan deployment
terraform plan -out=tfplan

# Apply
terraform apply tfplan

# Get the Load Balancer IP
terraform output lb_frontend_ip

# Test with curl (should alternate between web01-prd and web02-prd)
curl http://$(terraform output -raw lb_frontend_ip)

# Clean up when done
terraform destroy

# Create an app registration and add a federated credential for this repo.
# Then grant least-privilege Azure roles required by your selected profile.
az ad app create --display-name "terraform-alz-pipeline"

# Deploy infrastructure (manual apply)
gh workflow run "Terraform Pipeline" -f action=apply -f environment=lab

# Destroy infrastructure (requires confirmation)
gh workflow run "Terraform Pipeline" \
  -f action=destroy \
  -f environment=lab \
  -f destroy_confirm=DESTROY

# Watch pipeline progress
gh run watch

# =============================================================================
# CORE SETTINGS
# =============================================================================
subscription_id = "00000000-0000-0000-0000-000000000000"  # REQUIRED
project         = "azlab"
environment     = "lab"
location        = "westus2"  # Example: current lab profile region
owner           = "Lab-User"

# =============================================================================
# SECURITY (CHANGE THESE!)
# =============================================================================
admin_username     = "azureadmin"
admin_password     = null                       # Prefer TF_VAR_admin_password or a private tfvars file
sql_admin_login    = "sqladmin"
sql_admin_password = null                       # Prefer TF_VAR_sql_admin_password or a private tfvars file
vpn_shared_key     = null                       # Required only if VPN is enabled

# =============================================================================
# INFRASTRUCTURE FLAGS
# =============================================================================
# Core Networking
deploy_firewall              = true   # Azure Firewall (~$350/mo)
firewall_sku_tier            = "Standard"
deploy_vpn_gateway           = false  # VPN Gateway (~$140/mo, 30 min deploy)
deploy_onprem_simulation     = false  # Requires VPN Gateway
deploy_application_gateway   = true   # App Gateway with WAF (~$36/mo)

# Identity & Management
deploy_secondary_dc          = false  # Second Domain Controller (~$30/mo)
enable_jumpbox_public_ip     = false  # Prefer VPN/Bastion/private management
allowed_jumpbox_source_ips   = []     # Add trusted CIDRs only when public RDP is required
allow_public_rdp_from_internet = false

# Shared Services
deploy_keyvault              = true
deploy_storage               = true
deploy_sql                   = true   # Azure SQL (~$5/mo)

# Monitoring
deploy_log_analytics         = true
log_retention_days           = 30     # Free tier
log_daily_quota_gb           = 2      # Limit ingestion

# =============================================================================
# WORKLOADS
# =============================================================================
deploy_workload_prod         = true
deploy_workload_dev          = true   # Dev environment (similar to prod)

# Load Balancer
deploy_load_balancer         = true
enable_lb_rdp_nat_rules      = false  # Keep web VM RDP NAT closed by default
lb_type                      = "public"
lb_web_server_count          = 2
lb_web_server_size           = "Standard_B1ms"

# AKS (Disabled by default - long deploy time)
deploy_aks                   = false
aks_node_count               = 1
aks_vm_size                  = "Standard_B2s"

# =============================================================================
# PAAS SERVICES (All optional)
# =============================================================================
# Tier 1: FREE
deploy_functions             = false  # Azure Functions Y1
deploy_static_web_app        = true   # Static Web Apps Free
deploy_logic_apps            = true   # Logic Apps Consumption
deploy_event_grid            = true   # Event Grid (100k free)

# Tier 2: Low Cost (~$15-20/mo total)
deploy_service_bus           = true   # Service Bus Basic (~$0.05/mo)
deploy_app_service           = true   # App Service F1 (FREE)

# Tier 3: Data
deploy_cosmos_db             = true   # Cosmos DB Serverless (~$0-5/mo)
paas_alternative_location    = "canadacentral"  # For quota issues
cosmos_location              = "northeurope"    # Example alternate region

# =============================================================================
# NETWORK ADD-ONS
# =============================================================================
deploy_nat_gateway                   = true   # Fixed outbound IP
deploy_private_dns_zones             = true   # Private DNS for PaaS
deploy_private_endpoints             = true   # Private Link
deploy_application_security_groups   = true   # ASGs for segmentation

# Observability
create_network_watcher               = false  # Use existing NW (create only for new subs)
enable_vnet_flow_logs                = false  # VNet flow logs
enable_traffic_analytics             = false  # Traffic visualization

# =============================================================================
# COST OPTIMIZATION
# =============================================================================
enable_auto_shutdown         = true   # Shutdown VMs at 7 PM
vm_size                      = "Standard_B2s"

.\scripts\invoke-live-validation.ps1

# From your local machine - run multiple times
# You should see responses from both web01-prd and web02-prd
curl http://$(terraform output -raw lb_frontend_ip)

# Or use PowerShell
1..10 | ForEach-Object { 
    (Invoke-WebRequest -Uri "http://$(terraform output -raw lb_frontend_ip)" -UseBasicParsing).Content 
}

<h1>web01-prd</h1>
<p>Azure Landing Zone - prod Workload</p>
<p>Load Balanced Web Server</p>

# RDP to jumpbox first, then test internal connectivity

# Test Domain Controller
Test-NetConnection -ComputerName 10.1.1.4 -Port 389  # LDAP

# Test Web Servers
Test-NetConnection -ComputerName 10.10.1.4 -Port 80
Test-NetConnection -ComputerName 10.10.1.5 -Port 80

# Test Key Vault
Resolve-DnsName kv-azlab-xxxx.vault.azure.net

# Test SQL via Private Endpoint
Test-NetConnection -ComputerName sql-azlab-xxxx.database.windows.net -Port 1433

# Test outbound through firewall
Invoke-WebRequest -Uri https://ifconfig.me -UseBasicParsing  # Shows firewall's public IP

# From on-prem management VM
Test-NetConnection -ComputerName 10.1.1.4 -Port 389   # DC in Azure
Test-NetConnection -ComputerName 10.2.1.4 -Port 3389  # Jumpbox in Azure

# From Azure jumpbox
Test-NetConnection -ComputerName 10.100.1.4 -Port 445  # File server on-prem

# Check backend pool health
az network lb show \
  --resource-group rg-workload-prod-lab-<location_short> \
  --name lb-prod-lab-<location_short> \
  --query "loadBalancingRules[].backendAddressPool.id" -o table

# Check probe status
az network lb probe list \
  --resource-group rg-workload-prod-lab-<location_short> \
  --lb-name lb-prod-lab-<location_short> -o table

# Check VPN tunnel status
az network vpn-connection show \
  --resource-group rg-hub-lab-<location_short> \
  --name vpn-conn-hub-to-onprem \
  --query "connectionStatus" -o tsv

# Check if VMs are in backend pool
az network nic show \
  --resource-group rg-workload-prod-lab-<location_short> \
  --name nic-web01-prd \
  --query "ipConfigurations[0].loadBalancerBackendAddressPools" -o table

# Check health probe status
az network lb probe list \
  --resource-group rg-workload-prod-lab-<location_short> \
  --lb-name lb-prod-lab-<location_short> -o table

# Verify NSG allows HTTP
az network nsg rule list \
  --resource-group rg-workload-prod-lab-<location_short> \
  --nsg-name nsg-web-prod-lab-<location_short> -o table

# RDP to the VM via NAT rule
mstsc /v:<lb_frontend_ip>:3389  # web01
mstsc /v:<lb_frontend_ip>:3390  # web02

# Check IIS status
Get-WindowsFeature -Name Web-Server

# Manually install if needed
Install-WindowsFeature -Name Web-Server -IncludeManagementTools

# Recreate the default page
$content = "<h1>$env:COMPUTERNAME</h1><p>Azure Landing Zone Web Server</p>"
Set-Content -Path "C:\inetpub\wwwroot\index.html" -Value $content

# Check VPN connection status
az network vpn-connection show \
  --resource-group rg-hub-lab-<location_short> \
  --name vpn-conn-hub-to-onprem \
  --query "{Status:connectionStatus,IngressBytes:ingressBytesTransferred,EgressBytes:egressBytesTransferred}" -o table

# Check VPN Gateway status
az network vnet-gateway show \
  --resource-group rg-hub-lab-<location_short> \
  --name vpngw-hub-lab-<location_short> \
  --query "provisioningState" -o tsv

# Reset VPN connection if stuck
az network vpn-connection update \
  --resource-group rg-hub-lab-<location_short> \
  --name vpn-conn-hub-to-onprem \
  --set connectionProtocol=IKEv2

# Check network access (from jumpbox)
Test-NetConnection -ComputerName kv-azlab-xxxx.vault.azure.net -Port 443

# Verify RBAC access
az role assignment list --scope /subscriptions/<sub-id>/resourceGroups/rg-shared-lab-<location_short>

# Check Key Vault firewall
az keyvault network-rule list --name kv-azlab-xxxx

# Verify private endpoint DNS resolution
Resolve-DnsName sql-azlab-xxxx.database.windows.net

# Should return private IP (10.3.x.x), not public IP

# Test connectivity
Test-NetConnection -ComputerName sql-azlab-xxxx.database.windows.net -Port 1433

# State lock error
terraform force-unlock <lock-id>

# Resource already exists
terraform import <resource_address> <resource_id>

# Quota exceeded
# Request quota increase in Azure Portal or change region

# Provider version mismatch
terraform init -upgrade

// Check firewall logs in Log Analytics
AzureDiagnostics
| where Category == "AzureFirewallNetworkRule" or Category == "AzureFirewallApplicationRule"
| where msg_s contains "Deny"
| project TimeGenerated, msg_s
| order by TimeGenerated desc
| take 50

# terraform.tfvars

# =============================================================================
# REQUIRED - Must be set
# =============================================================================
subscription_id    = "your-subscription-id"
admin_password     = "YourSecureP@ssw0rd!"    # Minimum 12 chars, complexity required
sql_admin_password = "SqlSecureP@ssw0rd!"
vpn_shared_key     = "YourVPNSharedKey123!"   # Required if VPN enabled

# =============================================================================
# CORE SETTINGS
# =============================================================================
project     = "azlab"                          # Resource naming prefix
environment = "lab"                            # Environment tag
location    = "westus2"                        # Azure region
owner       = "Lab-User"                       # Owner tag value

# =============================================================================
# DEPLOYMENT FLAGS - Enable/disable components
# =============================================================================
deploy_firewall          = true                # Azure Firewall (~$350/mo)
deploy_vpn_gateway       = false               # VPN Gateway (~$140/mo)
deploy_onprem_simulation = false               # Simulated on-premises
deploy_load_balancer     = true                # Public Load Balancer
deploy_aks               = false               # Kubernetes cluster
deploy_application_gateway = false             # App Gateway with WAF

# =============================================================================
# VM CONFIGURATION
# =============================================================================
vm_size              = "Standard_B2s"          # Default VM size
lb_web_server_count  = 2                       # Number of IIS servers
lb_web_server_size   = "Standard_B1ms"         # Web server size
enable_auto_shutdown = true                    # Shutdown VMs at 7 PM

# =============================================================================
# PAAS SERVICES (All optional, most are free tier)
# =============================================================================
deploy_functions      = false                  # Azure Functions (FREE)
deploy_static_web_app = false                  # Static Web Apps (FREE)
deploy_logic_apps     = false                  # Logic Apps (pay per run)
deploy_event_grid     = false                  # Event Grid (FREE 100k)
deploy_service_bus    = false                  # Service Bus (~$0.05/mo)
deploy_app_service    = false                  # App Service (~$13/mo)
deploy_container_apps = false                  # Container Apps (placeholder flag; not wired)
deploy_cosmos_db      = false                  # Cosmos DB (serverless)

# =============================================================================
# NETWORK ADD-ONS & OBSERVABILITY
# =============================================================================
deploy_private_dns_zones         = false       # Private DNS zones for PaaS
deploy_private_endpoints         = false       # Private Link endpoints
deploy_nat_gateway               = false       # Fixed outbound IP
deploy_application_security_groups = false     # ASGs for micro-segmentation
enable_vnet_flow_logs            = false       # VNet flow logs (uses AzAPI)
enable_traffic_analytics         = false       # Traffic analytics
create_network_watcher           = false       # Create NW for new subs

# =============================================================================
# GOVERNANCE & COMPLIANCE (Advanced)
# =============================================================================
deploy_azure_policy              = false       # Azure Policy assignments
deploy_regulatory_compliance     = false       # HIPAA/PCI-DSS (audit mode)
deploy_cost_management           = false       # Budget alerts
deploy_backup                    = false       # Recovery Services Vault

# Initialize
terraform init

# Plan with specific var file
terraform plan -var-file="environments/prod.tfvars" -out=tfplan

# Apply
terraform apply tfplan

# Get outputs
terraform output

# Get specific output
terraform output lb_frontend_ip
terraform output -raw keyvault_uri

# Destroy everything
terraform destroy -auto-approve

# Destroy specific resource
terraform destroy -target=module.workload_prod

# Import existing resource
terraform import azurerm_resource_group.hub /subscriptions/.../resourceGroups/rg-hub-lab-<location_short>