Azure Terraform templates
Hub and spoke foundations for new Azure environments
Microsoft CAF
Framework
Hub and spoke, or vWAN
Topology
NSG rules and Bastion
Baseline
Overview
The network and governance layer I lay down before anything else goes into a new Azure subscription, kept as modules so the next build starts from the same place.
The problem
Building Azure environments one at a time produces overlapping address space, NSG rules that differ per spoke, storage accounts nobody is watching, and no way to tell what changed since handover.
How it works
Layered Terraform modules deploy the virtual network hub and its spokes, route traffic through a central firewall, stand up Bastion and Private DNS zones, and assign subscription level policy.
Design decisions
- CAF naming is enforced by variable validation, so a wrong name fails the plan rather than surviving into production.
- Subnets are segmented by purpose: gateway, firewall, Bastion, shared services, and workloads.
- Key Vault and managed identities are wired in from the start, which is much harder to retrofit.