Azure Hub-Spoke Deployment with Terraform

What will you learn from this code?

In the Terraform code, you will find a basic setup for an Azure Hub-Spoke model. It consists of Resource Groups, VNets, Subnets, Azure Firewall, Firewall rules, NGS’s, Azure Keyvault, Peerings, and Route tables.

To create this Hub-Spoke environment, I have used the following components within Terraform:

• Working with the ‘count Meta_argument‘
• Working with ‘cidrsubnet Function‘
  • Calculates a subnet address within given IP network address prefix. Which are applied for calculating address_prefixes for the spoke subnets;
• Working with separate environments
• Creating a module
• Working with outputs (creating and using)
  • Outputs from modules are used as input for other modules;
• Working with separate providers
  • Sometimes you have specific needs (features within providers) for certain modules;
• Generate random integers and id’s
  • For testing purposes it can be useful to create random integers;
• Working with ‘depends_on Meta-Argument‘
• Working with create_before_destroy ‘lifecycle Meta_argument‘
  • Why? During destroy of the Azure Firewall public ip, an error occurred because the public ip was still in use by the Azure firewall. By applying the lifecycle Meta-Argument within the pip resource block with the argument ‘create_before_destroy = true’, first the Azure Firewall will be deleted;

Directory Structure

Directory	File	Used for	Creates
root	main.tf	Creates a random integer for testing Modules are specified with given variables from production.tfvars and output from other modules.	Further defined in modules
	providers.tf	They are responsible for understanding API interactions and exposing resources.
	backend.tf	Specifies which Terraform backend is used.
	variables.tf	Variables are specified which are needed for root module as well as other modules.
./environments	production.tfvars	Defines the input values for the root module.
./modules/azfirewall	azfirewall.tf	Defines the resources for the child module.	Firewall subnet, Public IP, Azure Firewall, Application Rule, Network Collection rule and Route tables
	outputs.tf	Output values are reusable information about your infrastructure, which can be used on the command line, this information can be reused in other Terraform modules or configurations.
	variables.tf	Variables are specified which are needed for azfirewall module.
./modules/keyvault	keyvault.tf	Defines the resources for the child module.	Resource group, Keyvault and permissions
	outputs.tf	Output values are reusable information about your infrastructure, which can be used on the command line, this information can be reused in other Terraform modules or configurations.
	providers.tf	Separate features are applied specific for Keyvault.
	variables.tf	Variables are specified which are needed for keyvault module.
./modules/network_hub	outputs.tf	Output values are reusable information about your infrastructure, which can be used on the command line, this information can be reused in other Terraform modules or configurations.
	variables.tf	Variables are specified which are needed for network_hub module.
	vnet_hub.tf	Defines the resources for the child module.	Resource group, VNets and peerings
./modules/network_spoke	outputs.tf	Output values are reusable information about your infrastructure, which can be used on the command line, this information can be reused in other Terraform modules or configurations.
	variables.tf	Variables are specified which are needed for network_spoke module.
	vnet_spoke.tf	Defines the resources for the child module.	Resource group, VNets, subnets, NSGs and association

Getting started

In previous posts about Infrastructure as Code, I have created step-by-step guides for Terraform and Azure DevOps. Check out the posts about TERRAFORM AND AZURE DEVOPS | PART 1, TERRAFORM AND AZURE DEVOPS | PART 2 and TERRAFORM AND AZURE DEVOPS | PART 3.