IaC Boilerplates (Terraform)

Each numbered folder is a standalone Terraform root module (its own state). Deploy them in numeric order within a platform; later stacks take IDs from earlier stacks' outputs via variables.

.
├── azure/                      provider: hashicorp/azurerm ~> 5.0
│   ├── 00-tfstate-backend      Storage account + container for remote state (RBAC, versioning, lock)
│   ├── 01-foundation           Resource group, Log Analytics, managed identity, activity log export
│   ├── 02-networking           VNet, subnets (map-driven), NSGs + rules, optional NAT gateway
│   ├── 03-storage              Hardened storage account, containers, lifecycle policy, firewall
│   ├── 04-key-vault            RBAC Key Vault, role assignments, example secret
│   ├── 05-linux-vm             Ubuntu 24.04 VM, trusted launch, Entra SSH login, auto-shutdown
│   └── 06-governance           Policy (allowed regions, required tags), Defender for Cloud, budget
├── entra/                      provider: hashicorp/azuread ~> 3.0
│   ├── 01-users-groups         Users, security groups, dynamic groups, break-glass accounts
│   ├── 02-app-registration     App + SP, Graph permissions, exposed API scope, rotating secret, GitHub OIDC
│   ├── 03-conditional-access   Named locations + 6 baseline CA policies (report-only by default)
│   └── 04-directory-roles      Built-in role assignments, administrative units
├── intune/                     provider: microsoft/msgraph ~> 0.6 (+ azuread for groups)
│   ├── 01-device-groups        Dynamic device groups per OS / Autopilot / ownership, pilot group
│   ├── 02-compliance-policies  Windows, iOS, macOS, Android Work Profile compliance + assignments
│   ├── 03-configuration-profiles  Windows OMA-URI, Endpoint Protection, iOS/macOS restrictions
│   └── 04-windows-update-rings WUfB rings (pilot / broad / critical) + assignments
└── aws/                        provider: hashicorp/aws ~> 6.0
    ├── 00-tfstate-backend      S3 state bucket (versioned, encrypted, TLS-only, native locking)
    ├── 01-vpc                  VPC, public/private/database subnets across AZs, NAT, endpoints, flow logs
    ├── 02-iam                  Password policy, MFA-enforced Admins group, EC2 SSM role, GitHub OIDC role
    ├── 03-security-baseline    CloudTrail, GuardDuty, Security Hub, Access Analyzer, alerts, budget
    ├── 04-ec2                  AL2023 instance(s), IMDSv2, encrypted gp3, SSM access, security group
    └── 05-s3-bucket            Generic hardened S3 bucket

Usage

cd aws/01-vpc
cp terraform.tfvars.example terraform.tfvars   # edit values
terraform init
terraform plan
terraform apply

Authentication

Platform	How
Azure / Entra / Intune	az login (use az login --allow-no-subscriptions for Entra/Intune-only tenants). For CI, set ARM_CLIENT_ID, ARM_TENANT_ID and OIDC or a client secret.
AWS	aws configure sso / aws sso login, or AWS_PROFILE. For CI, use the GitHub OIDC role from aws/02-iam.

Remote state

1. Apply azure/00-tfstate-backend and/or aws/00-tfstate-backend with local state.
2. Uncomment the backend block in each other stack's versions.tf, fill in the bucket/storage account name, then terraform init -migrate-state.

Required permissions & licensing

• Entra — User Administrator / Groups Administrator for users and groups; Application Administrator for app registrations; Conditional Access Administrator for CA; Privileged Role Administrator for role assignments and admin consent. Dynamic groups and Conditional Access need Entra ID P1.
• Intune — Intune Administrator (or Graph DeviceManagementConfiguration.ReadWrite.All). Intune resources use the official microsoft/msgraph provider against the Graph beta endpoint, so the request bodies map 1:1 to the Graph Intune API docs. To add a policy, copy its JSON body from the docs (or from Graph Explorer after creating it in the portal) into a body = {} map.
• Azure governance — Owner or Resource Policy Contributor + Security Admin on the subscription.

Safety notes

• Conditional Access policies ship as enabledForReportingButNotEnforced. Check the sign-in logs before changing policy_state to enabled, and always pass the break-glass group to excluded_group_ids.
• Break-glass and user passwords live in Terraform state, so use an encrypted remote backend with restricted access.
• Items that cost money: NAT gateways (Azure + AWS), Defender for Cloud plans, Security Hub, GuardDuty, VMs/EC2.