u/GrtWhite

I'm a network engineer — ~30 years, mostly Cisco/enterprise. I passed the Azure Solutions Architect Expert a couple years ago but never got to use it in anger. I'm between jobs right now, so rather than only grinding applications I've been putting the time into actually building the cloud/IaC skills the cert says I have.

This is the result: a fictional "cloud post-production studio" on Azure, all Terraform (azurerm ~> 4.0). The cheap networking/storage/monitoring is applied live; the expensive stuff (GPU, NetApp Files, Firewall, App Gateway) is feature-flagged and validated plan-only, so the whole design proves out at ~$0. There's a gated Azure DevOps pipeline (plan → manual approval → apply), remote state, and — because I wanted to stress-test my own work — I had it red-teamed by a friend and remediated every finding with terraform test (mock_provider, so the suite runs at $0 with no Azure creds).

I'd genuinely rather get torn apart here than in an interview. Specifically, tell me where I'm wrong:

1. Structure — every subnet/NSG/VM comes from one locals map via for_each. Idiomatic at this size, or should I be breaking it into modules?
2. Plan-only guard — a terraform_data lifecycle.precondition + a confirm_expensive_resources flag so the expensive resources can't apply by accident. Sensible pattern, or is there a cleaner idiom?
3. Variable validation — the VPN pre-shared-key validation is gateway-conditional (only enforced when enable_gateway = true) so it doesn't block plan-only runs. Reasonable, or a smell?
4. CI — a credential-free "Verify" stage (the mocked tests) runs on every PR; the plan/apply stages with the service principal only run on main. Overkill for a solo repo, or the right instinct?

Repo: github.com/gsamarco/FourHorsemenStudio — ./scripts/verify.sh runs the whole suite offline at $0 if you want to poke at it.

I know a few things are still gaps (firewall FQDN allow-list, App Gateway TLS, ANF snapshots) — those were conscious plan-only deferrals, but if you think I mis-prioritized, say so.

Thanks for your brutal honesty.