Pulumi Best Practices - Azure

const appGateway = new azurenative.network.ApplicationGateway("my-app-gateway", {
    probes: [{
        name: "health-probe",
        protocol: "Https",
        path: "/health",
        interval: 30,
        timeout: 30,
        unhealthyThreshold: 3,
        match: {
            statusCodes: ["200-399"],
        },
    }],
    backendHttpSettingsCollection: [{
        name: "backend-settings",
        probe: { id: healthProbe.id },  // Associate probe with backend settings
        // ... other config
    }],
    // ... other config
});

const appGateway = new azurenative.network.ApplicationGateway("my-app-gateway", {
    zones: ["1", "2", "3"],  // Deploy across at least 2 availability zones
    // ... other config
});

const appGateway = new azurenative.network.ApplicationGateway("my-app-gateway", {
    sslPolicy: {
        policyType: "Predefined",
        policyName: "AppGwSslPolicy20220101",  // Use modern policy with TLS 1.2+
    },
    // ... other config
});

// Option 1: Continuous Backup (recommended)
const cosmosDbContinuous = new azurenative.cosmosdb.DatabaseAccount("my-cosmosdb", {
    databaseAccountOfferType: "Standard",
    backupPolicy: {
        type: "Continuous",  // Enable continuous backup
        continuousModeProperties: {
            tier: "Continuous30Days",  // 30-day point-in-time restore
        },
    },
    // ... other config
});

// Option 2: Periodic Backup
const cosmosDbPeriodic = new azurenative.cosmosdb.DatabaseAccount("my-cosmosdb", {
    databaseAccountOfferType: "Standard",
    backupPolicy: {
        type: "Periodic",  // Enable periodic backup
        periodicModeProperties: {
            backupIntervalInMinutes: 240,  // 4 hours
            backupRetentionIntervalInHours: 720,  // 30 days
        },
    },
    // ... other config
});

const customDomain = new azurenative.cdn.AFDCustomDomain("my-custom-domain", {
    tlsSettings: {
        minimumTlsVersion: "TLS12",  // Enforce minimum TLS 1.2
        certificateType: "ManagedCertificate",  // Use Azure-managed certificates
    },
    // ... other config
});

const key = new azurenative.keyvault.Key("my-key", {
    properties: {
        kty: "RSA",  // or "RSA-HSM" for hardware protection
        keySize: 2048,  // Minimum 2048 bits for RSA
        keyOps: ["encrypt", "decrypt"],  // Specify exact operations needed
        attributes: {
            exportable: false,
        },
    },
    // ... other config
});

const key = new azurenative.keyvault.Key("my-key", {
    properties: {
        kty: "RSA",
        attributes: {
            exp: 1735689600,  // Set expiration date (Unix epoch timestamp)
            nbf: 1704067200,  // Set not-before date (Unix epoch timestamp)
        },
        // ... other config
    },
});

const key = new azurenative.keyvault.Key("my-key", {
    properties: {
        kty: "RSA",
        rotationPolicy: {
            attributes: {
                expiryTime: "P2Y",  // Set expiry time for key versions
            },
            lifetimeActions: [{
                action: { type: "rotate" },
                trigger: { timeAfterCreate: "P90D" },  // Rotate 90 days after creation
            }],
        },
        // ... other config
    },
});

const vault = new azurenative.keyvault.Vault("my-key-vault", {
    properties: {
        sku: { name: "standard" },
        enableSoftDelete: true,  // Enable soft delete
        softDeleteRetentionInDays: 90,  // Set retention period (minimum 90 days)
        // ... other config
    },
});

const loadBalancer = new azurenative.network.LoadBalancer("my-load-balancer", {
    sku: { name: "Standard" },
    probes: [{
        name: "http-health-probe",
        properties: {
            protocol: "Http",
            port: 80,
            requestPath: "/health",  // Configure health check endpoint
        },
    }],
    loadBalancingRules: [{
        name: "http-rule",
        properties: {
            probe: { id: probeId },  // Associate probe with rule
            // ... other config
        },
    }],
});

const loadBalancer = new azurenative.network.LoadBalancer("my-lb", {
    sku: {
        name: "Standard",  // Standard SKU required for zone redundancy
    },
    frontendIPConfigurations: [{
        zones: ["1", "2", "3"],  // Deploy across multiple zones
        // ... other config
    }],
});

const workspace = new azurenative.operationalinsights.Workspace("my-workspace", {
    sku: {
        name: "PerGB2018",
    },
    retentionInDays: 90,  // Set to meet compliance requirements (minimum 90 days)
    // ... other config
});

const nic = new azurenative.network.NetworkInterface("my-nic", {
    ipConfigurations: [{
        privateIPAllocationMethod: "Dynamic",
        // Do NOT include publicIPAddress property
        // ... other config
    }],
});

const nsg = new azurenative.network.NetworkSecurityGroup("secure-nsg", {
    securityRules: [
        {
            protocol: "Tcp",
            sourceAddressPrefix: "203.0.113.0/24",  // Use specific IP ranges, not 0.0.0.0/0
            access: "Allow",
            direction: "Inbound",
            // ... other config
        },
    ],
});

const nsg = new azurenative.network.NetworkSecurityGroup("strict-nsg", {
    securityRules: [
        {
            protocol: "Tcp",
            sourceAddressPrefix: "10.0.0.0/16",  // Use specific IP ranges, not * or 0.0.0.0/0
            destinationAddressPrefix: "10.0.1.0/24",  // Use specific destinations
            access: "Allow",
            direction: "Inbound",
            // ... other config
        },
    ],
});

const roleAssignment = new azurenative.authorization.RoleAssignment("my-assignment", {
    roleDefinitionId: "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",  // Reader role instead of Owner/Contributor
    principalId: servicePrincipalId,
    scope: "/subscriptions/{sub-id}/resourceGroups/my-rg",  // Scope to resource group instead of subscription
});

const storageAccount = new azurenative.storage.StorageAccount("app-storage", {
    sku: {
        name: "Standard_LRS",
    },
    tags: {
        "last-modified": "2025-10-07",  // ISO 8601 date format (YYYY-MM-DD)
        "modified-by": "jane.doe@company.com",
        "change-reason": "Added storage account for new application deployment",
    },
    // ... other config
});

const resource = new azurenative.storage.StorageAccount("my-storage", {
    tags: {
        environment: "prod",  // Use "dev", "test", "staging", or "prod"
    },
    // ... other config
});

const queue = new azurenative.servicebus.Queue("my-queue", {
    maxDeliveryCount: 10,  // Maximum delivery attempts before dead lettering
    deadLetteringOnMessageExpiration: true,  // Enable dead lettering when messages expire
    // ... other config
});

const database = new azurenative.sql.Database("my-database", {
    sku: {
        name: "S0",
        tier: "Standard",
    },
    requestedBackupStorageRedundancy: "Geo",  // Use geo-redundant backup storage
    // ... other config
});

const encryptionProtector = new azurenative.sql.EncryptionProtector("tde-protector", {
    serverKeyType: "AzureKeyVault",  // Use customer-managed key from Azure Key Vault
    serverKeyName: serverKey.name,
    autoRotationEnabled: true,  // Enable auto-rotation when key version changes
    // ... other config
});

const database = new azurenative.sql.Database("my-database", {
    sku: {
        name: "P1",
        tier: "Premium",
    },
    zoneRedundant: true,  // Enable zone redundancy for high availability
    // ... other config
});

const auditPolicy = new azurenative.sql.ServerBlobAuditingPolicy("audit-policy", {
    state: "Enabled",  // Enable audit logging
    storageEndpoint: storageEndpoint,
    retentionDays: 90,  // Retain audit logs for 90 days
    // ... other config
});

const sqlServer = new azurenative.sql.Server("my-sql-server", {
    publicNetworkAccess: "Disabled",  // Disable public network access
    // ... other config
});

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_GRS" },  // Use geo-replicated SKU for redundancy
    kind: "StorageV2",
    // ... other config
});

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    enableHttpsTrafficOnly: true,  // Enforce HTTPS-only traffic
    // ... other config
});

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    allowBlobPublicAccess: false,  // Disable public blob access
    // ... other config
});

const storageAccount = new azurenative.storage.StorageAccount("mystorageaccount", {
    sku: { name: "Standard_LRS" },
    kind: "StorageV2",
    encryption: {
        keySource: "Microsoft.Keyvault",  // Use customer-managed keys
        keyVaultProperties: {
            keyName: "my-encryption-key",
            keyVaultUri: "https://my-keyvault.vault.azure.net/",
        },
    },
    // ... other config
});

const vm = new azurenative.compute.VirtualMachine("my-vm", {
    hardwareProfile: { vmSize: "Standard_D2s_v3" },
    storageProfile: {
        imageReference: {
            publisher: "Canonical",              // Use approved publisher
            offer: "UbuntuServer",               // Use approved offer
            sku: "20.04-LTS",                    // Use approved SKU
            version: "latest",
        },
        // ... other config
    },
    // ... other config
});

const vm = new azurenative.compute.VirtualMachine("my-vm", {
    hardwareProfile: { vmSize: "Standard_D2s_v3" },
    storageProfile: {
        osDisk: {
            createOption: "FromImage",
            managedDisk: {  // Use managed disk, not vhd property
                storageAccountType: "Premium_LRS",
            },
        },
        dataDisks: [{
            lun: 0,
            createOption: "Empty",
            diskSizeGB: 128,
            managedDisk: {  // Use managed disk, not vhd property
                storageAccountType: "Premium_LRS",
            },
        }],
        // ... other config
    },
    // ... other config
});