svg
svg svg

Enterprise Azure Terraform Module Library

Production-grade, reusable Terraform module library for Azure, aligned to Microsoft's Cloud Adoption Framework and Azure Landing Zones.

Technologies Used:

Terraform AzureRM Provider Azure CAF Azure Landing Zones AKS Cilium Workload Identity OIDC
πŸ–ΌοΈ Image not available
Enterprise Azure Terraform Module Library
πŸ”
star

Multi-Environment

Environment Type

Advanced

Complexity Level

Reusable Across Projects

Performance Impact

Project Overview

Designed and built a set of independently usable Terraform modules covering management groups, naming conventions, networking, and AKS β€” targeting Terraform β‰₯1.9 and the AzureRM β‰₯4.x provider. The networking module (v2) moved to an object-based configuration style split across dedicated files for subnets, NAT gateways, DNS, and diagnostics, making large environments easier to reason about. The AKS module (v2) was simplified down to around 12 required variables while still supporting CNI Overlay, Cilium, Workload Identity, OIDC issuer, CSI Key Vault integration, autoscaling, and Azure Policy. Every module follows the same conventions: for_each over count, optional() attributes with sensible defaults, and outputs designed specifically for downstream module consumption β€” so teams can compose their own landing zones without fighting the module internals.

Key Features:

  • Management-groups module for Azure CAF-aligned org hierarchy
  • Naming module for consistent resource naming across teams
  • Networking module v2 β€” object-based config, dedicated subnets/NAT/DNS/diagnostics files
  • AKS module v2 β€” CNI Overlay, Cilium, Workload Identity, OIDC, CSI Key Vault
  • for_each + optional() conventions throughout for safe, flexible usage
  • Outputs structured for direct consumption by downstream modules

Challenges & Solutions:

Upgrading to AzureRM ~4.x surfaced several breaking changes across modules.

Tested each module against AzureRM 4.79 individually, fixing schema changes iteratively until every module was confirmed independently usable.

Early networking module became hard to maintain as a single large file.

Refactored into an object-based v2 design split across main.tf, subnets.tf, nat_gateway.tf, dns.tf, diagnostics.tf, and locals.tf.

AKS module had grown too many required variables, making it hard to adopt.

Redesigned the interface down to ~12 required variables with sensible optional() defaults for everything else.

svg svg

Let's Build Something Amazing Together

Ready to transform your infrastructure? Let's create scalable solutions that drive real results.

⚑
Fast Delivery
Quick turnaround
🎯
Proven Results
99.9% uptime achieved
πŸ’¬
Clear Communication
Regular updates
svg