Azure Production Infrastructure
An enterprise product team needed a secure, resilient Azure platform built from scratch. We delivered a Terraform-managed environment covering Blob Storage with CDN, Application Gateway with WAF, VM Scale Sets, Azure App Service, and an Azure DevOps Pipelines CI/CD workflow — all inside a hub-spoke VNet with private endpoints and centralized monitoring.
The situation
The engineering team had outgrown ad-hoc Azure resource creation and needed a hardened, production-grade platform before their next enterprise onboarding wave. Everything was missing: no hub-spoke network design, no autoscaling strategy, assets stored on VM local disk, deployments via manual RDP/SSH, and no pipeline to speak of. Security reviews were blocked because there was nothing consistent to review.
Production-ready Azure platform live in 9 weeks with zero manual click-ops and a sub-15-minute release pipeline.
How we worked
Stabilise delivery early, then build the foundation that keeps it stable once we hand it back.
Established a hub VNet for shared services (Bastion, firewall, VPN gateway) and a spoke VNet for the application workload, peered together. Defined Network Security Groups with least-privilege rules, private endpoints for Storage and Key Vault, and Azure Private DNS zones to resolve them inside the VNet without public exposure.
Provisioned Azure Blob Storage accounts with geo-redundant replication (GRS) for media uploads and build artifacts, lifecycle policies for tiering, and versioning for rollback. Connected Azure CDN (Front Door origin group) in front of the static container for low-latency global delivery with cache invalidation wired into the pipeline.
Deployed an Azure Application Gateway v2 with Web Application Firewall (WAF) in prevention mode as the single ingress point. Configured HTTPS listeners with an App Service–managed certificate, path-based routing rules to split traffic between the VM Scale Set backend pool and the App Service backend, and custom health probes per service.
Deployed a Zone-redundant VM Scale Set (VMSS) using a hardened custom image baked via Azure Image Builder. Autoscale rules target 60% CPU with a 3-minute cooldown and a minimum of 2 instances across zones. Custom Script Extension handles bootstrap; rolling upgrade policy keeps releases zero-downtime.
Deployed stateless API and background worker services to Azure App Service (Linux, P2v3 plan) with deployment slots for blue/green promotion. VNet Integration routes all outbound App Service traffic through the spoke VNet, keeping downstream calls to databases and Key Vault private. App settings and connection strings sourced from Key Vault references.
Built a multi-stage Azure Pipeline triggered on main-branch merges: lint → unit tests → Docker build → ACR push → VMSS rolling update + App Service slot swap. YAML pipeline definitions live in the repo; environment-scoped approvals gate production promotion. Pipeline service connection uses a federated workload identity — no stored secrets.
All resources codified in Terraform with remote state in an Azure Storage backend and state locking via blob leases. Wired Azure Monitor, Log Analytics Workspace, and Application Insights for end-to-end observability. Delivered Terraform module documentation, runbooks for day-2 operations, and a recorded handoff walkthrough.
Handover
Stack
Afterwards
Measured after handover, once the client's own team was running the system without us.
Tell us what you are trying to move, migrate or automate and we will reply within one business day with an honest read on the work — including the parts we think you should not do.
More engagements
Fully automated, production-ready GCP platform delivered in under 8 weeks with 100% IaC coverage.
Read the case study AWS Full-Stack InfrastructureFully automated, production-ready infrastructure delivered in under 10 weeks.
Read the case study