Step 4: Implementation Plan - terraform-e2e

📀 Step 4: Implementation Plan - terraform-e2e

• 📋 Overview
• 📦 Resource Inventory
• 🗂️ Module Structure
• 🔨 Implementation Tasks
• 🚀 Deployment Phases
• 🔗 Dependency Graph
• 🔄 Runtime Flow Diagram
• 🏷️ Naming Conventions
• 🔐 Security Configuration
• ⏱️ Estimated Implementation Time
• 🔒 Approval Gate
• References

Generated by terraform-plan agent | 2026-02-26

📋 Overview

Terraform implementation plan for the terraform-e2e project — a small ecommerce storefront on Azure using a Cost-Optimized N-Tier architecture pattern: App Service (frontend) → App Service B1 (backend API) → Azure SQL Basic (data store), with Key Vault for secrets, Application Insights + Log Analytics for monitoring, and an Azure Storage Account for Terraform remote state.

[!NOTE] SWA (Static Web App) was originally planned but is not available in swedencentral. Replaced with a second App Service sharing the B1 plan.

Key Parameters:

[!NOTE] SWA (Static Web App) is not available in swedencentral. The frontend is now served by a second App Service sharing the B1 Linux plan. AVM coverage remains complete (6/6).

📦 Resource Inventory

[!TIP] SQL Database is provisioned as part of the SQL Server AVM module via the databases parameter, not as a separate module call.

AVM Module Verification Summary

🗂️ Module Structure

infra/terraform/terraform-e2e/
├── main.tf                  # Root module — orchestrates all AVM modules
├── variables.tf             # Input variables (project, environment, location, owner)
├── outputs.tf               # Module outputs (resource IDs, endpoints, connection strings)
├── locals.tf                # Local values (naming, tags, unique suffix)
├── providers.tf             # Provider configuration (azurerm ~> 4.0, random)
├── backend.tf               # Azure Storage backend configuration
├── terraform.tfvars         # Default variable values for dev environment
└── bootstrap/
    └── bootstrap.sh         # Pre-init script to create state storage account

[!NOTE] All modules are called from main.tf in a flat structure (no modules/ subdirectory). AVM modules encapsulate resource complexity — custom wrapper modules are unnecessary.

🔨 Implementation Tasks

Task 1: providers.tf (Provider Configuration)

Purpose: Configure Terraform providers and version constraints.

- resource: "Provider Configuration"
  providers:
    - name: "azurerm"
      source: "hashicorp/azurerm"
      version: "~> 4.0"
      features: {}
    - name: "random"
      source: "hashicorp/random"
      version: "~> 3.0"
  required_terraform_version: ">= 1.9"

Task 2: backend.tf (State Backend)

Purpose: Configure Azure Blob Storage remote state with native locking.

- resource: "State Backend"
  backend: "azurerm"
  config:
    resource_group_name: "rg-tfstate-dev"
    storage_account_name: "sttfstatedev{suffix}"
    container_name: "tfstate"
    key: "terraform-e2e.terraform.tfstate"
  note: "Azure Blob Storage provides native state locking via blob leases"

Task 3: variables.tf + locals.tf (Variables & Naming)

Purpose: Define input variables and derive naming conventions.

Variables:

Locals (naming + tags):

- local: "suffix"
  source: "random_string.suffix.result" # 4-char unique suffix
- local: "tags"
  value:
    Environment: var.environment
    Project: var.project
    ManagedBy: "Terraform"
    Owner: var.owner
- local: "rg_tags"
  value:
    environment: var.environment
    owner: var.owner
    costcenter: var.project
    application: var.project
    workload: "ecommerce-storefront"
    sla: "99.5"
    backup-policy: "default"
    maint-window: "weekends"
    technical-contact: var.owner

Task 4: Resource Group

- resource: "Resource Group"
  type: "azurerm_resource_group"
  name: "rg-terraform-e2e-dev"
  location: "swedencentral"
  tags: "local.rg_tags"
  phase: 1
  dependencies: []

Task 5: Log Analytics Workspace

- resource: "Log Analytics Workspace"
  module: "Azure/avm-res-operationalinsights-workspace/azurerm"
  version: "~> 0.5"
  name: "log-terraform-e2e-dev-{suffix}"
  config:
    sku_name: "PerGB2018"
    retention_in_days: 30
  azurePropertyPath: "operationalInsights.workspace.properties.retentionInDays"
  tags: "local.tags"
  naming: "log-{project}-{env}-{suffix}"
  phase: 1
  dependencies: ["resource_group"]

Task 6: Application Insights

- resource: "Application Insights"
  module: "Azure/avm-res-insights-component/azurerm"
  version: "~> 0.3"
  name: "appi-terraform-e2e-dev-{suffix}"
  config:
    application_type: "web"
    workspace_resource_id: "module.log_analytics.resource_id"
    daily_data_cap_in_gb: 0.5
  azurePropertyPath: "insights.component.properties.WorkspaceResourceId"
  tags: "local.tags"
  naming: "appi-{project}-{env}-{suffix}"
  phase: 1
  dependencies: ["log_analytics"]

Task 7: Key Vault

- resource: "Key Vault"
  module: "Azure/avm-res-keyvault-vault/azurerm"
  version: "~> 0.10"
  name: "kv-tfe2e-dev-{suffix}"
  config:
    sku_name: "standard"
    enable_rbac_authorization: true
    purge_protection_enabled: true
    soft_delete_retention_days: 90
    tenant_id: "data.azurerm_client_config.current.tenant_id"
  azurePropertyPath: "keyVault.properties.enableRbacAuthorization"
  tags: "local.tags"
  naming: "kv-{short}-{env}-{suffix}"
  phase: 2
  dependencies: ["resource_group"]

Task 8: SQL Server + Database

- resource: "SQL Server"
  module: "Azure/avm-res-sql-server/azurerm"
  version: "~> 0.1"
  name: "sql-terraform-e2e-dev-{suffix}"
  config:
    azuread_authentication_only: true
    minimum_tls_version: "1.2"
    databases:
      ecommerce:
        name: "sqldb-terraform-e2e-dev"
        sku_name: "Basic"
        max_size_gb: 2
  azurePropertyPath: "sqlServers.properties.administrators.azureADOnlyAuthentication"
  tags: "local.tags"
  naming: "sql-{project}-{env}-{suffix}"
  phase: 2
  dependencies: ["resource_group", "key_vault"]

Task 9: App Service Plan

- resource: "App Service Plan"
  module: "Azure/avm-res-web-serverfarm/azurerm"
  version: "~> 2.0"
  name: "asp-terraform-e2e-dev"
  config:
    os_type: "Linux"
    sku_name: "B1"
  azurePropertyPath: "serverFarms.properties.reserved"
  tags: "local.tags"
  naming: "asp-{project}-{env}"
  phase: 3
  dependencies: ["resource_group"]

Task 10: App Service (Linux Web App)

- resource: "App Service"
  module: "Azure/avm-res-web-site/azurerm"
  version: "~> 0.21"
  name: "app-terraform-e2e-dev-{suffix}"
  config:
    kind: "linux"
    https_only: true
    minimum_tls_version: "1.2"
    service_plan_resource_id: "module.app_service_plan.resource_id"
    system_assigned_identity: true
    app_settings:
      APPLICATIONINSIGHTS_CONNECTION_STRING: "module.app_insights.connection_string"
      KEY_VAULT_URI: "module.key_vault.uri"
  azurePropertyPath: "sites.properties.httpsOnly"
  tags: "local.tags"
  naming: "app-{project}-{env}-{suffix}"
  phase: 3
  dependencies: ["app_service_plan", "key_vault", "app_insights", "sql_server"]

Task 11: App Service (Frontend)

- resource: "App Service (Frontend)"
  module: "Azure/avm-res-web-site/azurerm"
  version: "~> 0.21"
  name: "app-terraform-e2e-fe-dev-{suffix}"
  config:
    kind: "linux"
    https_only: true
    minimum_tls_version: "1.2"
    service_plan_resource_id: "module.app_service_plan.resource_id"
    system_assigned_identity: true
    app_settings:
      APPLICATIONINSIGHTS_CONNECTION_STRING: "module.app_insights.connection_string"
  azurePropertyPath: "sites.properties.httpsOnly"
  tags: "local.tags"
  naming: "app-{project}-fe-{env}-{suffix}"
  phase: 3
  dependencies: ["app_service_plan", "app_insights"]
  note: "Replaces SWA — Static Web App not available in swedencentral. Shares B1 plan with backend."

Task 12: Role Assignments

- resource: "RBAC Role Assignments"
  type: "azurerm_role_assignment"
  assignments:
    - scope: "module.key_vault.resource_id"
      role: "Key Vault Secrets User"
      principal: "module.app_service.identity.principal_id"
    - scope: "module.sql_server.resource_id"
      role: "Contributor"
      principal: "module.app_service.identity.principal_id"
  phase: 3
  dependencies: ["app_service", "key_vault", "sql_server"]

Task 13: bootstrap/bootstrap.sh (State Backend Bootstrap)

Purpose: Create the Azure Storage Account for Terraform state before terraform init.

Features:

• Creates resource group for state storage
• Creates storage account with security policies (no public blob, HTTPS, TLS 1.2)
• Creates blob container for state files
• Applies required tags (9 RG tags + 4 resource tags)

🚀 Deployment Phases

Deployment strategy: Phased (3 phases with var.deployment_phase conditional)

Phase 1: Foundation & Monitoring

Conditional: var.deployment_phase >= 1

Approval Gate: ✅ Verify foundation resources exist and monitoring pipeline operational before proceeding.

Phase 2: Security & Data

Conditional: var.deployment_phase >= 2

Approval Gate: ✅ Verify security controls (Key Vault RBAC, SQL AD-only auth) before deploying compute tier.

Phase 3: Compute & Frontend

Conditional: var.deployment_phase >= 3

Approval Gate: ✅ Verify end-to-end connectivity: Frontend App Service → Backend App Service → SQL, telemetry flowing to App Insights.

Phase Summary

Phased Deployment Commands

# Phase 1: Foundation & Monitoring
terraform apply -var="deployment_phase=1" -auto-approve

# Phase 2: Security & Data (after Phase 1 validation)
terraform apply -var="deployment_phase=2" -auto-approve

# Phase 3: Compute & Frontend (after Phase 2 validation)
terraform apply -var="deployment_phase=3" -auto-approve

🔗 Dependency Graph

Source: 04-dependency-diagram.py

Nodes map to Implementation Tasks above. Edges represent depends_on or output-to-input wiring.

🔄 Runtime Flow Diagram

Source: 04-runtime-diagram.py

Shows request/auth/secret/telemetry paths at runtime — not deployment dependencies.

🏷️ Naming Conventions

[!IMPORTANT] Key Vault and Storage Account names have a 24-character limit and must be globally unique. Use take() equivalent logic with substr() in Terraform to truncate names within limits.

🔐 Security Configuration

Azure Storage Backend Configuration

terraform {
  backend "azurerm" {
    resource_group_name  = "rg-tfstate-dev"
    storage_account_name = "sttfstatedev{suffix}"
    container_name       = "tfstate"
    key                  = "terraform-e2e.terraform.tfstate"
  }
}

Azure Blob Storage provides native state locking via blob leases — no additional DynamoDB-style locking configuration required.

⏱️ Estimated Implementation Time

🔒 Approval Gate

[!IMPORTANT] 📋 Implementation Plan Ready

Metric	Value
Azure resources planned	12 (incl. RBAC assignments)
AVM-TF modules used	7
Raw azurerm resources	3 (RG, random_string, role_assignments)
Governance constraints addressed	✅ 10 Deny policies compliant
CAF naming conventions applied	✅ All resources follow CAF
Deployment strategy	Phased (3 phases)
State backend	Azure Blob Storage
Estimated monthly cost	~$25–$60
Estimated implementation time	~4.5 hours

Challenger Review Summary (1 governance + 3 plan passes):

Category	must_fix	should_fix	suggestions
Governance	0	1	1
Security-Governance	0	2	1
Architecture-Reliability	0	1	2
Cost-Feasibility	0	0	2
Total	0	4	6

Key findings:

• should_fix: Verify SWA region support in swedencentral → Resolved: Replaced SWA with frontend App Service
• should_fix: Add lifecycle { prevent_destroy = true } on Key Vault and SQL Database → Dismissed: Not required per user
• should_fix: Configure diagnostic settings for all resources via Log Analytics
• should_fix: Add App Service health check endpoint configuration

Findings saved to:

• agent-output/terraform-e2e/challenge-findings-governance-constraints.json
• agent-output/terraform-e2e/challenge-findings-implementation-plan-pass1.json
• agent-output/terraform-e2e/challenge-findings-implementation-plan-pass2.json
• agent-output/terraform-e2e/challenge-findings-implementation-plan-pass3.json
• Approved — proceed to terraform-code
• Approver: User
• Date: 2026-02-26

Reply "approve" to proceed to terraform-code, or provide feedback.

References

[!NOTE] 📚 The following Microsoft Learn resources inform this implementation.

Plan generated by terraform-plan agent following Azure Well-Architected Framework guidelines.