π Step 6: Deployment Summary - terraform-e2e
- β Preflight Validation
- π Deployment Details
- ποΈ Deployed Resources
- π€ Outputs
- π©Ί Resource Health Verification
- π Post-Deployment Tasks
Generated by 07t-Terraform Deploy agent | 2026-02-26 Last applied: 2026-02-26 β Re-apply run (tag drift + RBAC least-privilege upgrade) Status: DEPLOYED AND VERIFIED
| β¬ οΈ Previous | π Index | Next β‘οΈ |
|---|---|---|
| 05-implementation-reference.md | README | 07-ab-cost-estimate.md |
β Preflight Validation
| Property | Value |
|---|---|
| IaC Tool | Terraform |
| Terraform Version | >= 1.9 |
| Provider | azurerm ~> 4.0 |
| Region | swedencentral |
| Backend | AzureRM remote state (AAD auth) |
terraform validate |
β Pass |
terraform fmt -check |
β Pass |
terraform plan |
β Pass (re-apply: 1 add, 6 change, 1 destroy) |
Change Summary (Initial 3-Phase Deployment)
| Phase | Scope | Result |
|---|---|---|
| 1 | Foundation & Monitoring | β 9 added, 0 changed, 0 destroyed |
| 2 | Security & Data | β 7 added, 2 changed, 0 destroyed |
| 3 | Compute & Frontend | β 13 added, 5 changed, 0 destroyed |
Change Summary (Re-apply Run β 2026-02-26)
| # | Resource | Change | Reason |
|---|---|---|---|
| + | azurerm_role_assignment.app_sql_db_contributor |
Create | Least-privilege upgrade: SQL DB Contributor on sqldb-terraform-e2e-dev |
| ~ | module.app_insights (App Insights) |
Update | Tag drift reconciliation (remove extra tags added outside Terraform) |
| ~ | module.app_service_plan (ASP) |
Update | Tag drift reconciliation |
| ~ | module.key_vault (Key Vault) |
Update | Tag drift reconciliation |
| ~ | module.log_analytics (Log Analytics) |
Update | Tag drift reconciliation |
| ~ | module.sql_server (SQL Server) |
Update | Tag drift reconciliation |
| ~ | module.sql_server.database["ecommerce"] (SQL DB) |
Update | Tag drift reconciliation |
| - | azurerm_role_assignment.app_sql_contributor |
Destroy | Removed over-privileged Contributor role (replaced by SQL DB Contributor) |
Apply result: Apply complete! Resources: 1 added, 6 changed, 1 destroyed.
Deployment Notes
- App Service Plan was upgraded from
B1toP1v3inswedencentralto satisfy regional capacity constraints. - Availability zones remain enabled for the App Service Plan (supported by
P1v3). - Key Vault AVM module emits a non-blocking deprecation warning (
enable_rbac_authorizationβrbac_authorization_enabled, scheduled for removal in provider v5.0). - Re-apply (2026-02-26): Tag drift was detected on 5 resources (extra tags added outside Terraform:
application,backup-policy,costcenter,maint-window,sla,tech-contact,workload). Reconciled to match Terraform configuration. - Security improvement: Contributor role on SQL Server scope replaced with SQL DB Contributor on the specific database scope (least-privilege).
π Deployment Details
| Field | Value |
|---|---|
| Project | terraform-e2e |
| Environment | dev |
| Subscription | 00858ffc-dded-4f0f-8bbf-e17fff0d47d9 |
| Resource Group | rg-terraform-e2e-dev |
| Location | swedencentral |
| Deployment Model | 3-phase Terraform apply |
| Final Status | β Succeeded |
ποΈ Deployed Resources
| Resource | Name | Type | State/Status |
|---|---|---|---|
| Smart Detector Rule | Failure Anomalies - appi-terraform-e2e-dev-3hpu |
microsoft.alertsmanagement/smartdetectoralertrules |
β Enabled |
| Application Insights | appi-terraform-e2e-dev-3hpu |
microsoft.insights/components |
β Succeeded |
| Key Vault | kv-tfe2dev-3hpu |
microsoft.keyvault/vaults |
β Succeeded |
| Log Analytics Workspace | log-terraform-e2e-dev-3hpu |
microsoft.operationalinsights/workspaces |
β Succeeded |
| SQL Server | sql-terraform-e2e-dev-3hpu |
microsoft.sql/servers |
β Ready |
| SQL DB (system) | master |
microsoft.sql/servers/databases |
β Online |
| SQL DB (app) | sqldb-terraform-e2e-dev |
microsoft.sql/servers/databases |
β Online |
| App Service Plan | asp-terraform-e2e-dev |
microsoft.web/serverfarms |
β Succeeded |
| Backend App Service | app-terraform-e2e-dev-3hpu |
microsoft.web/sites |
β Running |
| Frontend App Service | app-terraform-e2e-fe-dev-3hpu |
microsoft.web/sites |
β Running |
π€ Outputs (Expected)
app_insights_connection_string = <sensitive>
app_insights_instrumentation_key = <sensitive>
app_service_default_hostname = "app-terraform-e2e-dev-3hpu.azurewebsites.net"
app_service_fe_default_hostname = "app-terraform-e2e-fe-dev-3hpu.azurewebsites.net"
app_service_plan_id = "/subscriptions/00858ffc-dded-4f0f-8bbf-e17fff0d47d9/resourceGroups/rg-terraform-e2e-dev/providers/Microsoft.Web/serverfarms/asp-terraform-e2e-dev"
key_vault_id = "/subscriptions/00858ffc-dded-4f0f-8bbf-e17fff0d47d9/resourceGroups/rg-terraform-e2e-dev/providers/Microsoft.KeyVault/vaults/kv-tfe2dev-3hpu"
key_vault_uri = "https://kv-tfe2dev-3hpu.vault.azure.net/"
log_analytics_workspace_id = "/subscriptions/00858ffc-dded-4f0f-8bbf-e17fff0d47d9/resourceGroups/rg-terraform-e2e-dev/providers/Microsoft.OperationalInsights/workspaces/log-terraform-e2e-dev-3hpu"
resource_group_id = "/subscriptions/00858ffc-dded-4f0f-8bbf-e17fff0d47d9/resourceGroups/rg-terraform-e2e-dev"
resource_group_name = "rg-terraform-e2e-dev"
sql_server_fqdn = <sensitive>
sql_server_id = "/subscriptions/00858ffc-dded-4f0f-8bbf-e17fff0d47d9/resourceGroups/rg-terraform-e2e-dev/providers/Microsoft.Sql/servers/sql-terraform-e2e-dev-3hpu"
π To Actually Deploy
cd infra/terraform/terraform-e2e
terraform init
terraform validate
terraform plan -out=tfplan
terraform apply "tfplan"
π©Ί Resource Health Verification
Last verified: 2026-02-26 β post re-apply run
Commands run post-apply:
# Azure Resource Graph β 10 resources in rg-terraform-e2e-dev
az graph query -q "Resources | where resourceGroup =~ 'rg-terraform-e2e-dev' ..."
# Direct state checks
az webapp show --name app-terraform-e2e-dev-3hpu β state: Running, httpsOnly: true
az webapp show --name app-terraform-e2e-fe-dev-3hpu β state: Running, httpsOnly: true
az sql server show --name sql-terraform-e2e-dev-3hpu β state: Ready
# Role assignment verification
az role assignment list --scope .../sqldb-terraform-e2e-dev β SQL DB Contributor β
| Resource | Name | Status |
|---|---|---|
| Application Insights | appi-terraform-e2e-dev-3hpu |
β Succeeded |
| Key Vault | kv-tfe2dev-3hpu |
β Succeeded |
| Log Analytics Workspace | log-terraform-e2e-dev-3hpu |
β Succeeded |
| App Service Plan | asp-terraform-e2e-dev |
β Succeeded |
| SQL Server | sql-terraform-e2e-dev-3hpu |
β Ready |
| SQL Database (app) | sqldb-terraform-e2e-dev |
β Online |
| Backend App Service | app-terraform-e2e-dev-3hpu |
β Running |
| Frontend App Service | app-terraform-e2e-fe-dev-3hpu |
β Running |
| Smart Detector Alert Rule | Failure Anomalies - appi-* |
β Enabled |
| SQL DB Contributor (RBAC) | App Service MI β sqldb-terraform-e2e-dev |
β Assigned |
Result: β All 10 resources present and operational. RBAC least-privilege upgrade confirmed.
π Post-Deployment Tasks
- Terraform state backend configured with AAD auth
- 3-phase deployment completed successfully
- App Service endpoints provisioned
- SQL + Key Vault + monitoring stack deployed
- Tag drift reconciled (re-apply 2026-02-26)
- RBAC upgraded: Contributor β SQL DB Contributor (least-privilege)
- Step 7 As-Built documentation generated
-
06-deployment-summary.mdupdated with live apply evidence
Generated by Azure Agentic InfraOps | GitHub