Cloud IaC

Cloud Landing Zone & IaC Platform

Reusable multi-cloud Terraform, Pulumi, and Ansible modules securing tenant configurations on Azure and AWS.

📖 Project Overview

This project provides a robust, production-ready Infrastructure-as-Code (IaC) library with 50+ modular structures for multi-cloud landing zones. It enables platform and infrastructure engineers to spin up fully compliant workspaces (development, staging, and production environments) in under 30 minutes.

Operating through a GitOps-based Git workflow, it incorporates security policy scanning via Checkov, terraform planning execution on pull requests via Atlantis, and continuous delivery via GitHub Actions. These security gates guarantee a robust SOC2 compliance posture and 100% infrastructure change auditability.

⚙️ Deployment Checklist & Runbook

Configure Terraform Hub Landing Zone

Define Azure landing zone structures including VNet Peering and routing tables:

hcl

module "landing_zone_hub" {
  source  = "./modules/azure-hub"
  version = "2.4.0"

  hub_name            = "prod-core-hub"
  address_space       = ["10.100.0.0/16"]
  enable_ddos_protect = true
  firewall_sku_tier   = "Premium"
  
  tags = {
    Environment = "Production"
    ManagedBy   = "Terraform"
  }
}

Setup Security Static Code Analysis

Establish automated Checkov scanning to assert compliance checks on Terraform modules:

yaml

name: Security Scanning

on: [pull_request]

jobs:
  checkov-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          framework: terraform
          output_format: cli

Configure Atlantis GitOps Pull Requests

Specify project structures inside the Atlantis repository configuration file:

yaml

version: 3
projects:
- name: production-westus
  dir: environments/prod-westus
  workspace: default
  terraform_version: v1.5.0
  autoplan:
    when_modified: ["*.tf", "../modules/**/*.tf"]
    enabled: true

🔄 Configuration & Environment Keys

Environment Variable	Description	Suggested Value
`ARM_CLIENT_ID`	Azure service principal application ID for provisioning.	`xxxx-xxxx-xxxx-xxxx`
`ARM_USE_MSI`	Toggle to use Managed Service Identity inside Azure runners.	`true`
`AWS_DEFAULT_REGION`	Default region target when bootstrapping AWS partitions.	`us-east-1`

📊 Architectural Workflow

graph TD
    PR[Developer Pull Request] -->|Triggers Webhook| Atlantis[Atlantis Pod]
    Atlantis -->|Local Plan| Plan[terraform plan]
    Atlantis -->|Check Policies| Checkov[Checkov Analysis]
    Checkov -->|Audit OK| Approve[PR Approval]
    Approve -->|Comment: atlantis apply| Atlantis
    Atlantis -->|Provision| Cloud[Azure / AWS Cloud APIs]
    Cloud -->|State Log| Backend[(Azure Blob / S3 Store)]

🛠️ Useful CLI Reference

# Install local Checkov scanner:
pip install checkov

# Audit local code before commits:
checkov -d . --framework terraform

# Run dry-run validation checks:
terraform init && terraform validate

# Trigger Atlantis workspace planning locally:
atlantis plan -d environments/prod-westus