Cloud

Shared Azure Terraform modules proven in real workloads

Built and hardened shared Azure Terraform modules, then applied them in workload repositories so fixes landed where reuse happened.

The problem

A platform team supported a large Azure estate with dozens of Terraform repositories in Azure DevOps: shared module source, landing-zone and network foundations, governance and Privileged Identity Management, and workload repositories for business applications and data platforms. Shared modules had to change fast enough for workload teams while staying compatible with real business-unit deployments. A one-off repository patch or portal repair unblocked a team for a day, but it left the platform harder to operate the next time the same pattern appeared.

This brownfield starting point also guides our Azure cloud engineering work.

How we worked

  1. Assess. We worked across both sides of the estate: the shared module source and the workload repositories that consumed it. Each pattern had to work in the deployments that used it, not only in the module repository.

  2. Codify. We authored or extended shared modules for Azure RBAC, Storage accounts, Key Vault, Cosmos DB, NAT Gateway, hub-and-spoke networking, Data Factory, Azure Monitor alerting, Application Gateway with Web Application Firewall, Functions, App Service for Linux and Windows, virtual machines, and naming. Access stayed in code through Microsoft Entra ID group lookups, subscription-scoped RBAC, and Key Vault and Storage account roles.

  3. Operationalize. Azure DevOps validation ran module changes through apply and destroy checks before they became shared platform code. We updated backend configuration, provider pinning, module sourcing by branch or tag, and pipeline parameters, so module consumers tested changes through the same path they used to deploy them.

  4. Enable. We applied each pattern in the workload repositories that needed it, including Application Gateway listeners, firewall policies, private endpoints, private DNS links, App Service web apps, and Azure Monitor action groups. Corrected versions moved back into the shared source, so the next team started from the fix instead of a local fork.

The outcome

The module platform became more usable because fixes landed in the shared modules and in the workload repositories that consumed them. Application, networking, Azure Monitor, and Azure RBAC changes moved through reviewable Terraform instead of portal repair work, and business-unit teams could start new work from modules, validation pipelines, and environment patterns already in Git.