📄 Azure Sandbox Infrastructure Deployment

Terraform + Azure DevOps Integration

Author: William Lacy
Date: July 2025
Environment: Sandbox (Dev/Test)

🧭 Executive Summary

This document outlines the design, implementation, and deployment of a secure and scalable sandbox infrastructure in Microsoft Azure using Terraform and Azure DevOps

📦 Project Overview

Tooling: Terraform, Azure DevOps, Azure Key Vault, Azure Storage
Authentication: Service Principal with secrets stored in Key Vault
State Management: Remote backend in Azure Blob Storage
Infrastructure Scope:
- Resource Group
- Virtual Network and Subnet
- Windows VM Scale Set
- Secure admin credentials
- Pipeline integration for automated deployment

📦 Pipeline Overview

Trigger: On commits to main branch
Agent Pool: Hosted Ubuntu agent (ubuntu-latest)
Secrets: Pulled from Azure Key Vault (TFScalingKV)
Terraform Version: Latest available
Authentication: Service Principal via environment variables
Execution Flow: init → plan → apply

🧱 Infrastructure Components

🔹 Resource Group

resource "azurerm_resource_group" "sandbox" {
  name     = "sandbox-rg"
  location = "East US"
}

🔹 Virtual Network and Subnet

resource "azurerm_virtual_network" "sandbox" {
  name                = "sandbox-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.sandbox.location
  resource_group_name = azurerm_resource_group.sandbox.name
}

resource "azurerm_subnet" "sandbox" {
  name                 = "sandbox-subnet"
  resource_group_name  = azurerm_resource_group.sandbox.name
  virtual_network_name = azurerm_virtual_network.sandbox.name
  address_prefixes     = ["10.0.1.0/24"]
}

🔹 Windows Virtual Machine Scale Set

resource "azurerm_windows_virtual_machine_scale_set" "sandbox_scale_set" {
  name                = "sandbox-vmss"
  location            = azurerm_resource_group.sandbox.location
  resource_group_name = azurerm_resource_group.sandbox.name
  sku                 = "Standard_F2"
  instances           = 2
  admin_username      = var.admin_username
  admin_password      = var.admin_password
  computer_name_prefix = "sandbox"

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2019-Datacenter"
    version   = "latest"
  }

  os_disk {
    storage_account_type = "Standard_LRS"
    caching              = "ReadWrite"
  }

  network_interface {
    name    = "sandbox-nic"
    primary = true

    ip_configuration {
      name      = "internal"
      primary   = true
      subnet_id = azurerm_subnet.sandbox.id
    }
  }

  upgrade_mode = "Manual"
}

🔐 Security and Secrets Management

🔹 Azure Key Vault (TFScalingKV)

Secret Name	Purpose
sandboxAdminUser	VMSS admin username
sandboxAdminPassword	VMSS admin password
servicePrincipalClientId	Terraform service principal ID
servicePrincipalClientSecret	SP password
subscriptionId	Azure subscription ID
tenantId	Azure AD tenant ID

🔐 Secret Management

🔹 Azure Key Vault Task


- task: AzureKeyVault@2
  inputs:
    azureSubscription: 'AzureSP-TFScaling'
    KeyVaultName: 'TFScalingKV'
    SecretsFilter: 'sandboxAdminUser,sandboxAdminPassword,servicePrincipalClientId,servicePrincipalClientSecret,subscriptionId,tenantId'
    RunAsPreJob: true

Retrieves secrets securely and makes them available as pipeline variables.

📂 Terraform Backend Configuration

terraform {
  backend "azurerm" {
    resource_group_name   = "tfstate-rg"
    storage_account_name  = "tfstatestorageaccount1"
    container_name        = "tfstate"
    key                   = "terraform.tfstate"
  }
}

Enables remote state storage with locking and consistency.

🔄 Azure DevOps Pipeline Integration

🔹 Key Vault Task

- task: AzureKeyVault@2
  inputs:
    azureSubscription: 'AzureSP-TFScaling'
    KeyVaultName: 'TFScalingKV'
    SecretsFilter: 'sandboxAdminUser,sandboxAdminPassword,servicePrincipalClientId,servicePrincipalClientSecret,subscriptionId,tenantId'
    RunAsPreJob: true

🔹 Terraform Execution

- script: |
    terraform init
    terraform plan -out=tfplan
    terraform apply tfplan
  displayName: 'Run Terraform'
  env:
    TF_VAR_admin_username: $(sandboxAdminUser)
    TF_VAR_admin_password: $(sandboxAdminPassword)
    ARM_CLIENT_ID: $(servicePrincipalClientId)
    ARM_CLIENT_SECRET: $(servicePrincipalClientSecret)
    ARM_SUBSCRIPTION_ID: $(subscriptionId)
    ARM_TENANT_ID: $(tenantId)

🧱 Pipeline Structure

🔹 Trigger


trigger:
  branches:
    include:
      - main

Automatically runs the pipeline on changes to the main branch.

🔹 Agent Pool


pool:
  vmImage: 'ubuntu-latest'

Uses Microsoft-hosted Ubuntu agents for Terraform execution.

🔹 Variables


variables:
  TF_VAR_admin_username: $(sandboxAdminUser)
  TF_VAR_admin_password: $(sandboxAdminPassword)
  ARM_CLIENT_ID: $(servicePrincipalClientId)
  ARM_CLIENT_SECRET: $(servicePrincipalClientSecret)
  ARM_SUBSCRIPTION_ID: $(subscriptionId)
  ARM_TENANT_ID: $(tenantId)

Injects secrets into Terraform via environment variables.

🔹 Terraform Installer


- task: TerraformInstaller@1
  inputs:
    terraformVersion: 'latest'

Ensures the latest version of Terraform is available on the agent.

🔹 Terraform Execution


- script: |
    terraform init
    terraform plan -out=tfplan
    terraform apply tfplan
  displayName: 'Run Terraform'
  env:
    TF_VAR_admin_username: $(sandboxAdminUser)
    TF_VAR_admin_password: $(sandboxAdminPassword)
    ARM_CLIENT_ID: $(servicePrincipalClientId)
    ARM_CLIENT_SECRET: $(servicePrincipalClientSecret)
    ARM_SUBSCRIPTION_ID: $(subscriptionId)
    ARM_TENANT_ID: $(tenantId)

Executes the full Terraform workflow using service principal authentication.

🧠 Implementation Notes

✅ Switched from Azure CLI to Service Principal authentication for CI/CD compatibility
✅ Resolved missing arguments in VMSS resource block
✅ Added supporting resources to fix undeclared references
✅ Used TF_VAR_ environment variables for secure credential injection
✅ Resolved Terraform state lock issue with terraform force-unlock
✅ Verified parallel resource creation and dependency handling

🧠 Implementation Notes

✅ Switched from Azure CLI to Service Principal authentication for pipeline compatibility
✅ Injected secrets using TF_VAR_ and ARM_ environment variables
✅ Ensured secrets are securely retrieved via Azure Key Vault
✅ Used hosted agents for consistent and scalable execution
✅ Resolved Terraform state lock issues and ensured remote backend stability