Starting with the hands on part I\u2019m creating a new dedicated directory for my new Terraform project:<\/p>\n\n\n Within this new directory I\u2019m creating the following files which will hold my configuration code:<\/p>\n\n\n\n For the authentication with Azure I\u2019m using the Azure CLI command line tool. You can Install the Azure CLI on Ubuntu with one command which curls a script, provided by Microsoft, from the internet and executes it on your system:<\/p>\n\n\n\n curl -sL https:\/\/aka.ms\/InstallAzureCLIDeb | sudo bash<\/em><\/strong><\/p>\n\n\n\n To get more information\u2019s about how to install the Azure CLI on your system, checkout this link<\/a> from Microsoft.<\/p>\n\n\n\n As far as the installation is successfully done, you can verify it with the following command:<\/p>\n\n\n\n az –version<\/em><\/strong><\/p>\n\n\n\n Then use the following command for connecting to Azure:<\/p>\n\n\n\n az login<\/em><\/strong><\/p>\n\n\n\n This command will open a browser window where you can sign in to Azure:<\/p>\n\n\n\n After you successfully authenticated yourself to Azure, you can check your available subscriptions with the following command:<\/p>\n\n\n\n az account list<\/em><\/strong><\/p>\n\n\n\n As the Azure CLI is now installed on the system and we are successfully authenticated to Azure, we can now start with the configuration of Terraform and the required provider for interacting with the Azure cloud platform.<\/p>\n\n\n\n Therefore I add the code block below into the providers.tf file which will tell terraform to install and initialize the azurerm provider with the specific version 4.10.0, which is the latest at the moment:<\/p>\n\n\n\n To configure the azurerm provider, I add the provider code block below additionally into the providers.tf file.<\/p>\n\n\n\n You can find your subscription ID in the output from the \u201caz account list\u201d command above.<\/p>\n\n\n\n After inserting those code blocks into the providers.tf file, we can install the defined azurerm provider and initialize Terraform by running the below command in our project directory:<\/p>\n\n\n\n terraform init<\/em><\/strong><\/p>\n\n\n\n As Terraform is now successfully initialized and the required provider is installed, we can start with the development of our infrastructure code.<\/p>\n\n\n\n But before doing so I would like to target the concept of workspaces in Terraform. Workspaces enables you to use the same configuration code for multiple environments through separate state files. You can imagine workspaces as a separated deployment environment and you terraform code as a independent plan or image of your infrastructure. As an example, imagine you added a new virtual machine to your terraform code and deployed it in production. If you now want to have the same virtual machine for test purposes, you just have to switch into your test workspace and run the terraform code again. You will have the exact same virtual machine within a few minutes!<\/p>\n\n\n\n To check the workspaces you have in your Terraform project, use the following command:<\/p>\n\n\n\n terraform workspace list<\/em><\/strong><\/p>\n\n\n\n As you can see we just have the default workspace in our new Terraform project. I want to deploy my infrastructure in this hands on blog post for multiple environments, therefore I will create some new workspaces. Lets assume we have a development, test and production stage for our infrastructure. I will create therefore the workspaces accordingly with the commands below:<\/p>\n\n\n\n terraform workspace new development<\/em><\/strong><\/p>\n\n\n\n terraform workspace new test<\/em><\/strong><\/p>\n\n\n\n terraform workspace new production<\/em><\/strong><\/p>\n\n\n\n After executing these commands, we can now check again our available workspaces in our terraform project:<\/p>\n\n\n\n Note that terraform will let you know your current workspace through the \u201c*\u201d symbol behind the particular workspace. We want to deploy our infrastructure for development first. So I will switch back into the development workspace with the following command:<\/p>\n\n\n\n terraform workspace select development<\/em><\/strong><\/p>\n\n\n\n As the workspaces are now successfully created, we can start with our configuration code.<\/p>\n\n\n\n First of all I go into the variables.tf file and add the variable code block below to that file:<\/p>\n\n\n\n I will use this \u201cenv\u201d variable for the suffix or prefix of resource names, which I will deploy, to simple recognize to which environment these resources belong.<\/p>\n\n\n\n Next I will create a resource group in Azure. Therefore I add the code block below to the main.tf file:<\/p>\n\n\n\n As you can see I set the name of the resource group dynamically with the prefix \u201cRG_\u201d and the value for the current workspace in the variable \u201cenv\u201d, which I\u2019ve defined before in the variables.tf file. The variable \u201cterraform.workspace\u201d is a default variable which refers to the current workspace.<\/p>\n\n\n\n To check which resource terraform would create in case we would apply the current configuration code, we can run the following command:<\/p>\n\n\n\n terraform plan<\/em><\/strong><\/p>\n\n\n\n We can see that terraform would create a new resource group with the name \u201cRG_DEV\u201d.<\/p>\n\n\n\n Next I will create a virtual network. Therefore I add the variable code block below to the variables.tf file. This variable defines for each environment stage a own address space:<\/p>\n\n\n\n I add now the code block below to the main.tf file to create a virtual network:<\/p>\n\n\n\n As you can see I\u2019m referencing here as well to the \u201cenv\u201d variable for dynamically setting the suffix of the network name and as well to the new \u201ccidr\u201d variable to set the address space of the virtual network.<\/p>\n\n\n\n Next I will create some subnets within the virtual network. I want to create 4 subnets in total:<\/p>\n\n\n\n Therefore I add the variable below to my variables.tf file, which defines for each environment stage and subnet an address space:<\/p>\n\n\n\n Next I will add for each subnet a new resource block to the main.tf file:<\/p>\n\n\n\n Note that I enabled in the backend tier subnet the option \u201cprivate_endpoint_network_policies\u201d. This is a option which enforces the network security groups to take effect on the private endpoints in the particular subnet. Checkout this link<\/a> from Microsoft for more information\u2019s about this option.<\/p>\n\n\n\n Next I will create an Azure SQL Server. Therefore I add the variable below to my variables.tf file. This variable is supposed to hold the admin password of the Azure SQL Server. I set the sensitivity option for this variable which will prevent the password to be exposed in the terminal output or in the Terraform logs:<\/p>\n\n\n\n I did also not set any value in the configuration files, instead I will set the variable value as a environment variable before applying the configuration.<\/p>\n\n\n\n Next I add the code block below to my main.tf file:<\/p>\n\n\n\n As you can see I referenced the \u201csqlserver_password\u201d variable to set the password for the \u201csqladmin\u201d user. I also disabled the public network access to prevent database access over the public endpoint of the server. I will create instead a private endpoint later on.<\/p>\n\n\n\n Next I will create the Azure SQL Database. Therefore I add the variable below to my variables.tf file:<\/p>\n\n\n\n The thought behind this variable is, that we have different requirements for the different stages. The general purpose SKU is sufficient for the non-productive databases but for the productive one we want the business critical service tier. As well as we want to have 30 days of point in time recovery for our productive data while 7 days is sufficient for non-productive and we want to store our productive database backups on geo-zone redundant storage while zone redundant storage is sufficient for the non-productive databases.<\/p>\n\n\n\n Then I add the resource block below into my main.tf file:<\/p>\n\n\n\n As you can see I\u2019m referencing to my \u201cdatabase_settings\u201d variable to set the configuration options dynamically.<\/p>\n\n\n\n For name resolution I will next create a private DNS zone. For that I add the resource block below to my main.tf file:<\/p>\n\n\n\n To associate this private DNS zone now with my virtual network, I will next create a virtual network link. Therefore I add the resource block below to my main.tf file:<\/p>\n\n\n\n To be able to securely connect to my azure sql database I will now create a private endpoint in my backend subnet. Therefore I add the resource block below to my main.tf file:<\/p>\n\n\n\n With this configuration code, I create a private endpoint with the name of the Azure SQL Server and the suffix \u201c-endpoint\u201d. Through the option \u201csubnet_id\u201d I place this endpoint in the backend subnet with a private service connection to the Azure SQL Server. I also associate the endpoint to the private DNS zone, which I\u2019ve created just before, for name resolution.<\/p>\n\n\n\n Lets now continue and create an azure bastion host for the administration of our environment. Therefore I first create a public IP address through adding the resource block below to my main.tf file:<\/p>\n\n\n\n Next I create the bastion host itself. For that I add the code block below to my main.tf file:<\/p>\n\n\n\n Now I will add a virtual machine to my middle tier subnet. Therefore I need to create first a network interface for that virtual machine. The resource block below will create the needed network interface:<\/p>\n\n\n\n As the virtual machine, which I intend to create, needs an admin password like the azure sql server, I will create an additional password variable. Therefore I add the code block below to my variables.tf file:<\/p>\n\n\n\n To create the virtual machine itself, I add the resource block below to my main.tf file:<\/p>\n\n\n\n Next I want to secure my subnets. Therefore I create for my front tier, middle tier and backend tier subnet a network security group by adding the resource blocks below to my main.tf file:<\/p>\n\n\n\n Next I create for each network security group particular rules.<\/p>\n\n\n\n Starting with the front tier subnet I want to block all Inbound traffic except traffic over https. Therefore I add the two resource blocks below to my main.tf file:<\/p>\n\n\n\n Continuing with the middle tier subnet I want to block all inbound traffic but allow http traffic only from the front tier subnet and allow rdp traffic only from the bastion subnet. Therefore I add the three resource blocks below to my main.tf file:<\/p>\n\n\n\n Last but not least I want to block all Inbound traffic to my backend tier subnet except traffic to the sql-server port from the middle tier subnet. In addition I want to block explicitly the internet access from this subnet.<\/p>\n\n\n\n You are questioning why I\u2019m explicitly block internet access from this subnet while I haven\u2019t any public IP address or NAT gateway for this subnet? That\u2019s because Microsoft provides access to the internet through a default outbound IP address in case no explicit way is defined. That\u2019s a feature which will be deprecated on the 30th<\/sup> September 2025. To get more information\u2019s about this feature check out this link<\/a> from Microsoft.<\/p>\n\n\n\n To create the rules for the backend tier subnet I add the three resource blocks below to my main.tf file:<\/p>\n\n\n\n I will stop with the creation of resources for this blog post and will show you finally how you can define outputs. For example let\u2019s assume we want to have the name of the Azure SQL Server and the IP address of the virtual machine extracted after the deployment. Therefore I add the two output variables below to the outputs.tf file:<\/p>\n\n\n\n Outputs are especially useful when you need to pass up information\u2019s from the deployment to a higher context. For example when you are working with modules in terraform and you want to pass information\u2019s from a child module to a parent module. In our case the outputs will just be printed out to the command line after the deployment.<\/p>\n\n\n\n As I am now done with the definition of the configuration code for this blog post, I will plan and apply my configuration for each stage. Before doing so, I need to first set a value for my password variables. On Ubuntu this can be done with this command:<\/p>\n\n\n\n export TF_VAR_sqlserver_password=”your password”<\/em><\/strong><\/p>\n\n\n\n export TF_VAR_vm_password=”your password”<\/em><\/strong><\/p>\n\n\n\n After I\u2019ve set the variables, I run the terraform plan command and we can see that terraform would create 29 resources:<\/p>\n\n\n\n This seems to be good for my so I run the terraform apply command to deploy my infrastructure:<\/p>\n\n\n\n terraform apply<\/em><\/strong><\/p>\n\n\n\n After some minutes of patience terraform applied the configuration code successfully:<\/p>\n\n\n\n When I\u2019m signing in to the Azure portal I can see my development resource group with all the resources inside:<\/p>\n\n\n\n I want to have my test and production resources as well so I switch the terraform workspace to test and production and run in both workspaces again the terraform apply command.<\/p>\n\n\n\n After some additional minutes of patience we can see in the Azure portal that we have now all resources for each environment stage:<\/p>\n\n\n\n Lets now compare the settings from the productive database with the development database and we can see that the SKU for the productive one is business critical while the SKU for the non-productive one is general purpose:<\/p>\n\n\n\n The Backup storage has also been set according to the \u201cdatabase_settings\u201d variable:<\/p>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-20.png\")
<\/figure>\n\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-21.png\")
<\/figure>\n\n\n\nInstalling the Azure CLI:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-22.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-23.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-24.png\")
<\/figure>\n\n\n\nInitialize Terraform:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-25.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-26.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-27.png\")
<\/figure>\n\n\n\nTerraform Workspaces:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-28.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-29.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-30.png\")
<\/figure>\n\n\n\nCreate an Azure Resource Group:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-31.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-32.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-33.png\")
<\/figure>\n\n\n\nCreate a Virtual Network and Subnets:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-34.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-35.png\")
<\/figure>\n\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-36.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-37.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-38.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-39.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-40.png\")
<\/figure>\n\n\n\nCreate an Azure SQL Database:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-41.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-42.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-43.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-44.png\")
<\/figure>\n\n\n\nCreate a DNS Zone and a Private Endpoint:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-45.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-46.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-47.png\")
<\/figure>\n\n\n\nCreate an Azure Bastion:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-48.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-49.png\")
<\/figure>\n\n\n\nCreate a Virtual Machine:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-50.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-51.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-52.png\")
<\/figure>\n\n\n\nCreate Network Security Groups and Rules:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-53.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-54.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-55.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-56.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-57.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-58.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-59.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-60.png\")
<\/figure>\n\n\n\nDefine Output Variables:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-61.png\")
<\/figure>\n\n\n\nApply the Configuration Code:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-62.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-63.png\")
<\/figure>\n\n\n\nCheck the Infrastructure in the Azure Portal:<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-64.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-65.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-66.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-67.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-68.png\")
<\/figure>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-71.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-72.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-73.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-74.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-75.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-76.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-77.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-78.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2025\/01\/image-79.png\")
<\/figure>\n\n\n\n