Enterprise Cloud Modernization
Auditing & Migrating 40+ Workloads across 400+ Resource Groups
Architected and executed an infrastructure & DevOps modernization for a leading private aviation company. Migrated 40+ workloads into a Cloud Adoption Framework (CAF) compliant hub-and-spoke architecture.
The Challenge & Context
The client operated an unmanaged, sprawling Azure footprint spanning over 40 subscriptions and 400+ resource groups with no unified networking model, unsegmented production/non-production environments, manual click-ops provisioning, and severe network latency between on-premises aviation dispatch systems and cloud services.
Engineering Approach
Engineered a greenfield, Cloud Adoption Framework (CAF) aligned hub-and-spoke landing zone. Codified the entire network and security foundation in modular Terraform, established dedicated ExpressRoute and VPN Gateway connectivity to on-prem datacenters, enforced zero-trust Private Endpoints across all PaaS data services, and automated CI/CD deployment pipelines.
Components & Data Flow
A central connectivity hub subscription hosts redundant Azure Firewall instances, Application Gateway with WAF, and ExpressRoute gateways. Spokes host isolated workload tiers (Production, Staging, Shared Services) connected via VNet Peering with forced tunneling through the hub firewall. All data stores (Azure SQL, Storage, Key Vault) communicate strictly over Private Endpoints with public access disabled.
Key Trade-offs & Decisions
Modular Terraform over Monolithic State
Divided the 400+ resource groups into isolated Terraform workspaces with remote state data sources to prevent state locking bottlenecks and contain blast radius.
Private Endpoints over Service Endpoints
Private Endpoints provide dedicated private IP addresses within VNets, eliminating public IP exposure and enabling granular NSG controls.
Managed Identities (UAMI) over Service Principals
Eliminated hardcoded credentials and secret rotation overhead across all containerized workloads and CI/CD runners.
Obstacles & How They Were Overcome
RESOLUTION:Implemented parallel routing with DNS-based cutovers and automated health check validation, ensuring critical flight tracking services experienced zero interrupted transactions.
RESOLUTION:Built custom automated discovery scripts to inventory and tag unmanaged resources prior to importing into version-controlled Terraform state.