Environment Configuration

Environment Configuration

This repository is controlled mainly through Terraform variables and environment-specific tfvars files.

Core files:

• variables.tf
• terraform.tfvars.example
• environments/cheap-lab.tfvars
• environments/lab.tfvars
• environments/dev.tfvars
• environments/prod.tfvars

Variable Categories

Category	Examples	Source
General metadata	environment, project, location, owner, tags	variables.tf
Network addressing	Hub, identity, management, shared, prod, dev, on-prem CIDRs and subnet prefixes	variables.tf
Edge services	deploy_firewall, deploy_vpn_gateway, deploy_application_gateway, deploy_nat_gateway	variables.tf
Remote access	enable_jumpbox_public_ip, allowed_jumpbox_source_ips, allow_public_rdp_from_internet	variables.tf
Workloads	deploy_workload_prod, deploy_workload_dev, deploy_load_balancer, enable_lb_rdp_nat_rules, deploy_aks	variables.tf
Shared services	deploy_keyvault, deploy_storage, deploy_sql, deploy_private_dns_zones, deploy_private_endpoints	variables.tf
PaaS workload services	Functions, Static Web App, Logic Apps, Event Grid, Service Bus, App Service, Cosmos DB	variables.tf
Monitoring	Log Analytics, workbooks, connection monitor, flow logs, Traffic Analytics, retention, quota	variables.tf
Governance	Policy, allowed locations, management groups, RBAC, cost management, regulatory compliance	variables.tf

Public RDP Controls

Remote management is intentionally controlled by several variables:

Variable	Recommended value	Meaning
enable_jumpbox_public_ip	false	Avoids assigning a public IP to the jumpbox
allowed_jumpbox_source_ips	Trusted CIDRs only	Defines who may reach jumpbox RDP if a public IP is enabled
allow_public_rdp_from_internet	false	Validation override for 0.0.0.0/0; do not enable by default
enable_lb_rdp_nat_rules	false	Prevents direct RDP NAT to web servers through public Load Balancer

The validation rule rejects allowed_jumpbox_source_ips = ["0.0.0.0/0"] unless the explicit override is set. This is documented in Security Model.

Cost Management Controls

If deploy_cost_management = true, configure real recipients:

cost_alert_emails = ["platform-team@example.com"]

The profile examples include placeholders so users know where to set the value. Do not apply with placeholder recipients.

Implementation source:

• variables.tf
• modules/cost-management
• landing-zones/governance

Feature Toggle Matrix

Feature	Variable	Primary module
Azure Firewall	deploy_firewall	modules/firewall
VPN Gateway	deploy_vpn_gateway	modules/networking/vpn-gateway
Application Gateway	deploy_application_gateway	modules/application-gateway
NAT Gateway	deploy_nat_gateway	modules/networking/nat-gateway
Public Load Balancer	deploy_load_balancer	modules/networking/load-balancer
AKS	deploy_aks	modules/aks
Key Vault	deploy_keyvault	modules/keyvault
Storage	deploy_storage	modules/storage
SQL	deploy_sql	modules/sql
Private Endpoint	deploy_private_endpoints	modules/private-endpoint
Azure Policy	deploy_azure_policy	modules/policy
Management groups	deploy_management_groups	modules/management-groups
RBAC roles	deploy_rbac_custom_roles	modules/rbac

Local Overrides

terraform.tfvars is usually ignored by Git and should be treated as local-only. Do not put secrets in it.

Recommended local plan pattern:

terraform init -backend=false
terraform plan -var-file=environments/cheap-lab.tfvars

Recommended CI pattern:

• Use the workflow input environment.
• The workflow passes environments/${{ env.ENVIRONMENT }}.tfvars.
• Backend values come from GitHub secrets, not from committed files.