Welcome To My Blog

One of my goals for 2023 was to start a blog so I could keep all my notes in one place, and that would then allow me to share the content with the cloud community and hopefully benefit others who are embarking on the same journey. I plan to capture my thoughts on technologies I use in my day job, and those I evaluate and use in my own time.

Exporting Azure Management Group Activity Logs

I’ve been working with Management Groups a lot recently in my day job and have really seen the benefit of being able to enforce governance by assigning RBAC roles and policies once, and have all new subscriptions inherit them. However, I soon realised there was no way in the Azure Portal or the native Azure RM Terraform provider to export the Activity Logs to a Log Analytics Workspace for use with Sentinel, so I decided to figure out a solution to this.

Continue Reading...

Creating A Working Powershell Based Azure Function With Terraform

This is a post I’ve wanted to write for a while, but was one of those side projects I’ve picked up and put down a few times due to other priorities getting in the way. This idea came about because I wrote a PowerShell script to perform some housekeeping actions in Azure and I wanted it to run unattended on a scheduled basis.

Continue Reading...

How I Protect Secrets In Terraform Configurations

I have already touched on the importance of Terraform state in a previous post, but I wanted to expand on this from a security perspective. Let’s get this out the way now, Terraform stores secrets in its state file in plain text! There I said it. So how do I protect against secrets being revealed that could allow an attacker to compromise my systems? Well, I use a defence in depth strategy in a number of ways.Continue Reading...

How I Minimise Terraform Admin Effort & Manage The Constant Change

In a previous post I explained why I don’t advocate the use of child modules, but I wanted to quickly explain how I keep Terraform admin overhead to a minimum when creating standard resources whilst also working with the constant rate of change that cloud brings.

Continue Reading...

Use Of Terraform Child Modules

Terraform uses the construct of a module, which is defined by HashiCorp as “a set of Terraform configuration files in a single directory”. The root module consists of resources defined in the main working directory (which I like to refer to as the ’execution folder’). However, you can also call other modules to include their configuration. These are known as child modules which can be shared and reused by multiple root module configurations.Continue Reading...

How I Keep Terraform Simple

When writing a Terraform configuration, you want to keep all elements readable so whoever needs to interpret it in the future can easily understand the outcome the configuration deploys. This is how I do it.Continue Reading...

How To Generate JSON With Terraform Without Using Heredoc Strings

This is something I’ve only recently discovered but thought it was worth sharing here. I have a few configurations where I need to pass JSON to Terraform to process. The most used resource where I do this is azurerm_virtual_machine_extension. The example HashiCorp documentation still shows the use of Heredoc strings which is probably why I hadn’t picked up on it until now. I recently discovered a HashiCorp article where they tell you that by using the jsonencode and yamlencode functions “Terraform can be responsible for guaranteeing valid JSON or YAML syntax”.Continue Reading...