Azure Deployment Step 2 - Customer Config (Redacted Examples)

Repo: raas-azure-terraform-v2
Path: /configs/
Goal: Show only redacted file examples and explain key usage (including nested values).

1) Redacted Example Files

1.1 `tenant.json`

{
  "modules": [
    {
      "directory": "base-account",
      "branch": "main",
      "commit": "416ed5c4-****-************",
      "repo_name": "raas-azure-terraform-base-account"
    }
  ]
}

1.2 `dev.tfvars`

customer_az_subscription = "2ff7467a-****-************"

RaaSS3 = {
  IAM_USER_CREDS_KV = "S3Creds"      # Key Vault reference only
  AWS_REGION        = "us-east-2"
}

location        = "uaenorth"
CI_PROJECT_NAME = "ansible-raas-v2.x"

ssh_public_key  = "ssh-rsa AAAAB3...generated-by-azure"

admin_username = "adminuser"
raas_user      = "rhapsody"

raas_config = {
  number_of_instances = 1
  rules = {
    "allow_8444_any_prod" = {
      environment                = "prod"
      priority                   = 203
      direction                  = "Inbound"
      access                     = "Allow"
      protocol                   = "Tcp"
      source_port_range          = "*"
      destination_port_range     = "8444"
      source_address_prefix      = "*"
      destination_address_prefix = "*"
    }
    # ...additional rules redacted
  }
  asgs = {
    dev = {
      sku_name = "Standard_D4s_v3"
      rhapsody_primary_static_ip   = "10.145.x.x"
      rhapsody_secondary_static_ip = "10.145.x.x"
      block_device_mappings = [{
        no_device = 0
        disk = { volume_size = 512, volume_type = "Premium_ZRS", lun = 0, caching = "ReadOnly" }
      }]
    }
  }
}

vpns = {
  "customer_x" = {
    name           = "customer_x"
    remote_address = "13.41.x.x"
    address_space  = ["172.16.x.x/23"]
    ike_policy = {
      ike_encryption_algorithm = "AES256"
      ike_integrity_algorithm  = "SHA256"
      dh_group                 = "DHGroup14"
      pfs_group                = "PFS24"
      sa_lifetime_sec          = 3600
      ipsec_encryption         = "AES256"
      ipsec_integrity          = "SHA256"
    }
  }
}

runbook_name            = "Nightly-DataDiskSnapshots"
schedule_name           = "NightlyAt2AM"
schedule_start_time     = "2025-04-26T02:00:00Z"
schedule_timezone       = "America/Phoenix"
snapshot_retention_days = 7

1.3 `dev.json`

{
  "modules": [
    { "directory": "base-counter",  "branch": "main",         "commit": "b0755039-****-********", "repo_name": "raas-azure-terraform-counter" },
    { "directory": "base-core",     "branch": "m42/mubadala", "commit": "ebabd9ea-****-********", "repo_name": "raas-azure-terraform-core" },
    { "directory": "env-raas",      "branch": "m42/mubadala", "commit": "1bd77c18-****-********", "repo_name": "raas-azure-terraform-env-raas" },
    { "directory": "base-cifs",     "branch": "main",         "commit": "0abb7eb1-****-********", "repo_name": "raas-azure-terraform-cifs" },
    { "directory": "env-snapshots", "branch": "main",         "commit": "68d4f2be-****-********", "repo_name": "raas-azure-terraform-env-snapshots" }
  ]
}

2) Appendix — Key Explanations (with Nested Values)

`tenant.json`

modules[] → List of Terraform module repos this customer/env depends on.
- directory → The folder name inside the repo.
- branch → Git branch.
- commit → Specific commit hash.
- repo_name → Repository name.

`dev.tfvars`

customer_az_subscription → Azure subscription ID.
RaaSS3 → AWS integration (S3).
- IAM_USER_CREDS_KV → Key Vault secret name storing AWS creds.
- AWS_REGION → Region for S3.
location → Azure region.
CI_PROJECT_NAME → CI/CD pipeline identifier.
ssh_public_key → Public SSH key.
admin_username → Default VM admin user.
raas_user → Platform service user.
raas_config → RaaS environment settings.
- number_of_instances → Count of instances to deploy.
- rules{} → NSG rule definitions.
- environment → Env (dev, test, prod).
- priority → NSG rule priority.
- direction → Inbound/Outbound.
- access → Allow/Deny.
- protocol → e.g., Tcp/UDP.
- source_port_range / destination_port_range → Ports.
- source_address_prefix / destination_address_prefix → IP ranges or *.
- asgs{} → VM scaling definitions per environment.
- sku_name → VM size.
- rhapsody_primary_static_ip / secondary_static_ip → IP assignments.
- block_device_mappings[] → Attached disks.
  - no_device → Boolean/int flag.
  - disk → Disk details.
  - volume_size → Disk size GB.
  - volume_type → Disk SKU.
  - lun → Logical unit number.
  - caching → Cache mode.
vpns{} → VPN definitions for customers.
- name → VPN connection name.
- remote_address → Peer IP.
- address_space[] → Subnet ranges.
- ike_policy{} → IKE/IPsec negotiation.
- ike_encryption_algorithm → e.g., AES256.
- ike_integrity_algorithm → e.g., SHA256.
- dh_group → Diffie-Hellman group.
- pfs_group → Perfect Forward Secrecy group.
- sa_lifetime_sec → Lifetime in seconds.
- ipsec_encryption → e.g., AES256.
- ipsec_integrity → e.g., SHA256.
runbook_name / schedule_name / schedule_start_time / schedule_timezone / snapshot_retention_days → Azure automation job parameters.

`dev.json`

modules[] → Environment-specific modules.
- directory → Module folder.
- branch → Branch used.
- commit → Pinned commit.
- repo_name → Repo source.

3) Reviewer Checklist

Folder paths and file names match Cosmos DB id.
No secrets present—only references.
Keys correctly nested with valid values.
No duplicated rule keys in raas_config.rules.
Terraform validate passes and CI plan runs correctly.

2A) Appendix — Expanded Nested Key Reference

This appendix lists every nested key in the redacted examples and what each controls. Use it as a map when reviewing or authoring configs.

A. `tenant.json`

modules[] (array of module descriptors)
- directory (string) — Module folder path in the repo (e.g., base-account).
- branch (string) — Git branch/tag; pairs with commit for pinning.
- commit (string) — Short/long SHA for deterministic builds.
- repo_name (string) — Source repository holding the module.

B. `dev.tfvars`

customer_az_subscription (string) — Subscription GUID where this env deploys.
RaaSS3 (object) — Example external service mapping.
- IAM_USER_CREDS_KV (string) — Key Vault/secret name; CI fetches credentials by this key.
- AWS_REGION (string) — Target AWS region for the S3 dependency (if used).
location (string) — Azure region short name (e.g., uaenorth).
CI_PROJECT_NAME (string) — Pipeline identifier used for namespacing/logging.
ssh_public_key (string) — Public key installed on provisioned VMs.
admin_username (string) — Default admin user on VMs.
raas_user (string) — Rhapsody app/service user.
raas_config (object) — Platform scaling, security rules, and VM shapes.
- number_of_instances (number) — Desired instance count (ASG/VMSS or count var).
- rules (map ) — Network Security Group rules keyed by a unique name.
- environment (string) — prod or nonprod; controls which NSG receives the rule.
- priority (number) — NSG rule priority (lower = earlier evaluation).
- direction (string) — Inbound or Outbound.
- access (string) — Allow or Deny.
- protocol (string) — Tcp, Udp, or *.
- source_port_range (string) — Source port or *.
- destination_port_range (string) — Destination port (e.g., 8444).
- source_address_prefix (string) — CIDR, AzureLoadBalancer, or *.
- destination_address_prefix (string) — CIDR or *.
- asgs (map ) — Per‑environment compute layout.
- sku_name (string) — VM size (e.g., Standard_D8s_v3).
- rhapsody_primary_static_ip (string) — Primary NIC private IP.
- rhapsody_secondary_static_ip (string) — Secondary NIC private IP.
- block_device_mappings[] (array of disks)
  - no_device (number/bool) — Whether to skip default device.
  - disk (object) — Managed disk spec
  - volume_size (number, GB) — Disk size.
  - volume_type (string) — Disk SKU (e.g., Premium_ZRS).
  - lun (number) — Logical Unit Number.
  - caching (string) — None, ReadOnly, or ReadWrite.
vpns (map ) — One or more IPSec tunnel definitions keyed by peer name.
- name (string) — Logical peer name.
- remote_address (string) — Peer public IP.
- address_space[] (array) — Remote CIDRs permitted over tunnel.
- ike_policy (object) — IPSec/IKE parameters.
- ike_encryption_algorithm (string) — e.g., AES256.
- ike_integrity_algorithm (string) — e.g., SHA256.
- dh_group (string) — e.g., DHGroup14.
- pfs_group (string) — e.g., PFS24.
- sa_lifetime_sec (number) — IKE SA lifetime.
- ipsec_encryption (string) — e.g., AES256.
- ipsec_integrity (string) — e.g., SHA256.
runbook_name (string) — Azure Automation runbook to execute snapshots.
schedule_name (string) — Automation schedule resource name.
schedule_start_time (ISO‑8601 string) — First execution time (UTC).
schedule_timezone (string) — IANA/Windows TZ for schedule.
snapshot_retention_days (number) — Retention window for snapshots.

C. `dev.json`

modules[] (array) — Environment‑specific module pinning/overrides.
- directory (string) — Module folder path.
- branch (string) — Git branch/tag for this env (allows per‑env variations).
- commit (string) — Commit SHA for reproducibility.
- repo_name (string) — Source repo of the module.

3A) Cross‑file Mapping Rules

Folder name ⇆ Cosmosid — Must match exactly (lowercase/hyphenated).
Subscription IDs — From intake/Cosmos → customer_az_subscription (tfvars) and/or subscriptions objects if used by modules.
Network — Cosmos cidrs/dns_servers map to module inputs in either tenant.json or per‑env JSON.
Security Rules — Define once in raas_config.rules; ensure keys are unique per env.
Compute Shapes — Per env under asgs with disk arrays pinned.
Secrets — Always referenced by name (Key Vault/Actions) rather than in cleartext.

Azure Deployment Step 2 - Customer Config (Redacted Examples)

1) Redacted Example Files

1.1 tenant.json

1.2 dev.tfvars

1.3 dev.json

2) Appendix — Key Explanations (with Nested Values)

tenant.json

dev.tfvars

dev.json

3) Reviewer Checklist

2A) Appendix — Expanded Nested Key Reference

A. tenant.json

B. dev.tfvars

C. dev.json

3A) Cross‑file Mapping Rules

1.1 `tenant.json`

1.2 `dev.tfvars`

1.3 `dev.json`

`tenant.json`

`dev.tfvars`

`dev.json`

A. `tenant.json`

B. `dev.tfvars`

C. `dev.json`