Terraform / Infrastructure as Code (IaC)

Terraform:- Terraform / Infrastructure as Code 1. Write and maintain Terraform configuration files to provision and manage a wide range of Azure infrastructure resources including virtual machines, Private AKS clusters, PostgreSQL Flexible Server, Cosmos DB, Azure Container Registry, Application Gateway with WAF, Key Vault, Storage Accounts, Databricks, Azure AD Groups, and App Registrations. 2. Design and implement hub-spoke network topologies with multi-subscription VNet peering, conditional environment-specific peering, NSG rules, route tables, and user-defined routing to force egress traffic through Azure Firewall. 3. Build and maintain reusable Terraform modules — both project-local modules and shared platform modules — ensuring consistent naming conventions, variable contracts, and output structures across all environments and teams. 4. Manage environment-isolated remote state files in Azure Blob Storage using CI/CD-injected backend configurations, with separate state keys per environment (dev, qa, uat, production) to prevent state collision and enable targeted applies. 5. Implement infrastructure security controls including private endpoints for all PaaS resources, network ACL deny-by-default policies, User-Assigned Managed Identities, OIDC Workload Identity Federation, WAF policies with custom IP allowlist rules, and least-privilege RBAC role assignments across resource and subscription scopes. 6. Automate multi-environment deployments via Azure DevOps pipelines with parameterized environment targets, Key Vault-backed variable groups, conditional plan-only execution, and environment-specific variable files and agent pools per tier. 7. Apply advanced HCL patterns including dynamic blocks for conditional resource configuration, for_each for secret rotation, count-based conditional resource creation for environment-specific resources, and lifecycle rules to prevent drift on externally managed attributes. 8. Debug and troubleshoot complex Terraform issues including cross-subscription provider permission failures, Azure API race conditions between dependent resources, provider schema gaps, private DNS zone link conflicts, and dependency ordering for resources with implicit or circular relationships. 9. Collaborate with security and operations teams to enforce compliance standards including Azure Policy, Key Vault purge protection, database audit logging, and Entra ID-integrated authentication across platform services. 10. Stay current with evolving Azure provider capabilities, evaluating and adopting new provider resources and features to replace workarounds, improve security posture, and reduce operational overhead. Azure Cloud:- 1. Design, provision, and manage a broad range of Azure infrastructure resources including Virtual Machines, Virtual Machine Scale Sets (Windows and Linux), Private AKS clusters, Azure Container Registry, Application Gateway with WAF, Azure Firewall, Recovery Services Vaults, Storage Accounts, Key Vaults, and Azure Active Directory Domain Services. 2. Implement and manage hub-spoke network architectures including VNets, NSGs, route tables with Palo Alto and Azure Firewall UDR patterns, internal and external Load Balancers, Azure Bastion, Remote Desktop Services infrastructure, and private endpoints for all PaaS resources. 3. Manage and secure access to Azure resources using Role-Based Access Control, User-Assigned Managed Identities, Entra ID-integrated authentication, and Key Vault access policies across multiple vaults for different workload boundaries. 4. Deploy and manage Azure Automation Accounts with Desired State Configuration for VM configuration management — including DSC node compilation, configuration assignment, and drift remediation — and PowerShell runbooks for operational automation such as Key Vault rotation, resource tagging remediation, hybrid benefit management, and stale identity cleanup. 5. Build, maintain, and version VM images using Azure Shared Image Gallery — including baseline OS images, build agent images, hybrid worker images, and DSC-configured workload images across multiple build pipelines. 6. Monitor and operate the platform using multiple Log Analytics workspaces, Event Hub namespaces for log streaming, Container Insights, VM Insights, Change Tracking, Update Management, Service Map, NSG Analytics, and Key Vault Analytics solutions, with alert action groups for automated VM lifecycle responses. 7. Manage Azure Backup and disaster recovery using Recovery Services Vaults, restore point collections across virtual machines, and KDR-specific automation accounts for backup runbook orchestration. 8. Support Virtual Machine Scale Sets for CI/CD build agent pools (Windows and Linux) with autoscale policies, custom script extensions, DSC configuration, and IaaS antimalware enforcement — integrated with Azure DevOps pipeline agent registration. 9. Troubleshoot and resolve issues across Azure infrastructure including VM extension failures, DSC node compliance, firewall policy rule conflicts, private endpoint DNS resolution, AKS AGIC connectivity, and cross-subscription networking. 10. Collaborate with security and operations teams to enforce compliance standards including Microsoft Defender for Endpoint deployment on all VMs, Azure Policy enforcement, IaaSAntimalware extensions, domain-join configurations, and network-level controls across all workload subnets. Azure Kubernetes: 1. Set up and configure Private AKS clusters with private API server endpoints, private DNS zone integration, and Azure CNI networking with Azure Network Policy enforcement. 2. Deploy and scale applications in private AKS clusters using auto-scaling (Cluster Autoscaler) across availability zones, with UserDefined Routing (UDR) egress traffic routed through Azure Firewall. 3. Manage and monitor cluster resources and performance using Container Insights with Data Collection Rules (DCR), OMS Agent with MSI-based authentication, and Log Analytics diagnostic settings covering kube-apiserver, kube-audit, kube-scheduler, cluster-autoscaler, and CSI controller logs. 4. Ensure security and stability of AKS clusters by implementing Azure AD-integrated RBAC, Workload Identity with federated OIDC credentials, User-Assigned Managed Identity (UMI), Azure Policy add-on, and Key Vault Secrets Provider (CSI driver) for secret injection into pods. 5. Troubleshoot and resolve issues related to AKS cluster networking (Azure CNI, private endpoints, DNS zone links), AGIC (Application Gateway Ingress Controller) integration, storage (Azure Disk/File CSI drivers), and role assignment permission chains (AcrPull, Network Contributor, Managed Identity Operator). 6. Maintain and update cluster software and configurations using automated patch upgrade channels, maintenance windows for control plane and node OS upgrades, and node image upgrade policies with zero-downtime rolling surge settings. 7. Implement containerized deployments and orchestration using Docker and Azure Kubernetes Services, integrating Azure Container Registry (ACR) with kubelet identity pull authentication and federated service account workload identity for pod-level Azure resource access. Azure DevOps: 1. Manage and configure Azure DevOps projects, repositories, and pipelines. 2. Automate build, test, and deployment of code. 3. Maintain source control repositories. 4. Collaborate with development teams to implement CI/CD practices. 5. Manage and troubleshoot Azure DevOps build and release pipelines. 6. Manage and troubleshoot Azure DevOps test plans and test cases. Overall 1. Deep understanding of cloud service architecture with an emphasis on security. 2. Experience with Azure cloud and Terraform. 3. Proficiency in Azure Kubernetes, Helm charts, Ingress controllers, Services, Deployments, Config Maps, and Connectivity troubleshooting. 4. Knowledge of various PaaS offerings in Azure (App Service, Function App, Storage Accounts, Key Vault, Azure SQL Server, etc.). 5. Strong scripting and task automation skills utilizing AZ CLI, Azure PowerShell, and Windows PowerShell. 6. Practical experience in monitoring and tuning to provide high availability services.