Terraform on Azure - Platform Governance in Practice: 30 Incident-Driven Lessons

Someone changed the database's private endpoint at midnight. The Activity Log named exactly one operator: shared-deploy@example.com.

If you run real infrastructure, you know this feeling. The hard part was never writing the resource block — it's figuring out who should own what, where the boundary goes, and how to prove the fix actually held.

Terraform on Azure: Platform Governance in Practice is 30 production lessons told from inside a fictional-but-familiar company. You'll follow Dee, the platform engineer everyone @-mentions, through three acts: retiring a shared deployment account without breaking anyone's pipeline, pulling apps into private networking without cutting off delivery, and building the monitoring, cost, and commit-time guardrails that keep a platform governable six months later.

Inside the book

Act 1 · Permission Autonomy — A shared deployment account can't tell you who did what. Split people, pipelines, and vault access into per-team boundaries: team RGs, Entra groups, per-team service connections, phased deny rollouts, SSO gates, workload identity, and a shared APIM that teams can safely edit themselves.

Act 2 · Security Hardening — A public scan reaches a database, and the subnet boundaries turn out to be nobody's job. Pull apps into private networking without breaking delivery: subnet edges, pipeline migration, ACA rebuilds, internal AKS ingress, certificate rotation, DNS lifecycle, shared NAT egress, WAF policy isolation, and CDN cache behavior.

Act 3 · Operations, Monitoring, and Cost — "It runs" isn't "it's maintainable." Size containers without stomping pipeline releases, adopt scattered secrets safely, route alerts to the team that owns the app, enforce central logging, catch budget drift mid-month, automate the monthly cost report, and right-size node requests from real usage.

Toolbox · Efficiency and Quality — Turn the scars into daily checks: Checkov, TFLint, terraform-docs, Infracost, terraform test, and pre-commit — so problems show up before the code leaves your machine.

Every lesson runs the same loop:

scene → wrong turn → Terraform fix → proof

• The HCL in the text is real azurerm_* / azuread_* — what you'd actually write in production
• Every lesson ships a runnable example: terraform init, terraform plan, no Azure subscription required
• Every takeaway is one judgment you can reuse: who owns it, where the line goes, how plan verifies it

Written for: developers entering shared environments, ops / SRE / platform engineers turning field scars into enforceable rules, and tech leads who review changes and ask "but who does this affect?"

The stories happen in Azure. The method — converge the problem, assign ownership, draw the boundary, verify before applying — outlives any provider.

Published in progress: buy once at the early price, and every remaining act arrives free.