Terraform Automation Improves Azure Reliability

A mid-sized regional bank relied on a public-facing website built on Kentico and hosted in Microsoft Azure.

The bank’s existing infrastructure was managed largely through manual configuration, with development, QA, and production environments maintained separately across Azure and Cloudflare. Without an Infrastructure as Code (IaC) framework, changes were difficult to reproduce consistently, infrastructure configurations could vary between environments, and production updates required hands-on coordination across multiple platforms.

The production website was also hosted in a single Azure region, creating a potential availability risk for a critical customer-facing application. The bank wanted to strengthen its Azure high availability architecture by introducing a resilient, multi-region deployment while improving how infrastructure changes were managed and governed.

At the same time, the organization was preparing to retire a legacy Azure Front Door configuration and expand its use of Cloudflare for traffic management and security.

The bank partnered with Emergent Software to implement Terraform infrastructure as code across its Azure environment. The goal was to establish a more reliable cloud platform with automated traffic management, multi-region failover capabilities, and a repeatable, version-controlled infrastructure deployment process across development, QA, and production.

Emergent designed and implemented a Terraform-based high-availability architecture spanning Microsoft Azure, Cloudflare, and HCP Terraform Cloud.

The team began by documenting the existing environment and translating manually managed infrastructure into Terraform resources. Existing Azure and Cloudflare configurations were incorporated into the new Infrastructure as Code model, enabling the bank to manage critical infrastructure through version-controlled code rather than separate manual changes across administrative portals.

To support high availability, Emergent redesigned the production environment around an active-active Azure App Service deployment across two Azure regions. This multi-region architecture reduced dependence on a single location and established a resilient application layer capable of continuing to serve traffic if availability in one region was disrupted.

Cloudflare load balancing and health monitoring were configured across the Azure environments to continuously evaluate application health and direct traffic to available instances. Session affinity was also implemented at the Cloudflare layer to help maintain a consistent application experience while supporting regional failover.

The high-availability design extended beyond the application layer. Emergent configured Azure SQL with a multi-region failover group, helping ensure the data tier could support the same resiliency objectives as the web application. Azure Key Vault, virtual networks, subnets, network security groups, and private endpoints were also incorporated into the Terraform configuration.

Private endpoints for Azure SQL and Key Vault reduced public exposure of critical services, while App Service IP restrictions limited inbound application traffic to approved Cloudflare addresses. These controls strengthened the cloud environment's security posture while keeping infrastructure configuration centralized and repeatable.

Emergent also expanded Cloudflare's role beyond DNS management to include load balancing, web application firewall capabilities, DDoS protection, health monitoring, redirect rules, and origin certificate management. This allowed the bank to retire its legacy Azure Front Door configuration while consolidating traffic management around the new high-availability design.

To make infrastructure easier to manage across the application lifecycle, Emergent created separate Terraform workspaces for development, QA, production, and shared infrastructure. Each environment could maintain its required settings while following the same underlying infrastructure pattern.

HCP Terraform Cloud provided remote state management and a controlled deployment workflow. Infrastructure changes now move through a defined plan, review, approval, and apply process, giving the bank greater visibility into proposed changes before they reach production and creating a clearer audit trail for infrastructure updates.

Together, Terraform, Azure App Service, Azure SQL, Azure Key Vault, and Cloudflare provided the foundation for a more resilient and secure cloud environment. HCP Terraform Cloud supported infrastructure governance, while Azure networking and private endpoints helped protect critical services. Cloudflare provided traffic management and health monitoring across the two Azure regions.

Emergent implemented and validated the configuration environment by environment, beginning with development and QA before moving to production. This phased approach allowed the team to verify the Terraform configuration, multi-region architecture, and deployment processes before applying them to the live website.

For the production launch, Emergent also developed a structured DNS cutover process. Required validation records were pre-staged ahead of go-live, reducing dependence on DNS propagation during the final transition and allowing traffic to be shifted to the new architecture within a tightly controlled window.

The bank now operates its public-facing website on a highly available, multi-region Azure architecture managed through Terraform.

The production application is no longer dependent on a single Azure region. Its active-active App Service configuration spans two regions, with Cloudflare health monitoring and load balancing supporting automated traffic management between available environments. Azure SQL also includes multi-region failover capabilities, extending resiliency across the application and data layers.

The infrastructure supporting that high-availability architecture is now defined and managed through Terraform. Development, QA, and production environments follow a consistent infrastructure pattern, giving the organization a more reliable way to reproduce configurations and reducing inconsistencies associated with manually managed environments.

HCP Terraform Cloud also provides a more controlled process for production changes. Infrastructure updates can be planned, reviewed, and approved before deployment, improving visibility into changes and reducing the risks associated with direct manual configuration.

The project culminated in a successful production DNS cutover with zero downtime, allowing customers to continue accessing the bank's website throughout the transition.

By combining Terraform infrastructure automation with multi-region Azure hosting, database failover capabilities, and Cloudflare traffic management, Emergent helped the bank strengthen the resiliency of a critical digital platform while improving how its cloud infrastructure is deployed, governed, and maintained.