Infrastructure as Code
Using Pulumi with C# to define, deploy, and manage Azure infrastructure through code.
Pulumi for Azure Infrastructure
Grade My Investments' infrastructure is entirely defined as code using Pulumi with C#, maintaining our commitment to the Microsoft ecosystem even in our infrastructure management. This approach enables version-controlled, repeatable, and reviewable infrastructure deployments across all environments.
By using Pulumi with C# instead of traditional JSON or YAML templates, our developers can leverage their existing C# expertise to manage infrastructure, use familiar tools like Visual Studio and VS Code, and benefit from compile-time type safety and IntelliSense support.
flowchart TB
subgraph IaC[Pulumi C# - Infrastructure as Code]
PD[Gmi.Pulumi.Infrastructure.Dev]:::svc
PP[Gmi.Pulumi.Infrastructure.Prod]:::svc
end
subgraph NET[Virtual Network - VNet]
SN1[App Service Subnet]:::svc
SN2[MySQL Subnet]:::svc
NSG[Network Security Group]:::sec
end
subgraph COMPUTE[Compute]
ASP[App Service Plan]:::svc
WA[Web Apps - Client - Admin - TechWeb]:::app
FN[Azure Functions]:::svc
VM[Linux VM B2ms<br/>Background Services]:::svc
end
subgraph DATA[Data - Storage]
DB[(MySQL Flexible Server<br/>VNet integrated)]:::data
BLOB[(Blob Storage Account<br/>Hot tier)]:::data
KV[(Key Vault<br/>Secrets - Managed Identity)]:::sec
end
subgraph OBS[Observability]
AI([Application Insights]):::ext
end
PD -->|pulumi up| NET
PP -->|pulumi up| NET
NET --> COMPUTE
NET --> DATA
COMPUTE --> DATA
COMPUTE --> OBS
COMPUTE --> KV
classDef app fill:#1f2630,stroke:#C0894E,color:#F3EFE8;
classDef svc fill:#241c14,stroke:#E2B583,color:#F3EFE8;
classDef data fill:#22201a,stroke:#C0894E,color:#EBD3AE;
classDef ext fill:#1b1f27,stroke:#5A616B,color:#C4C0B8;
classDef sec fill:#1d2733,stroke:#5cc8e0,color:#eafaff;
Infrastructure Projects
| Project | Environment | Key Resources | Purpose |
|---|---|---|---|
Gmi.Pulumi.Infrastructure.Dev |
Development | VNet, Subnets, App Service Plan (S1), 3 Web Apps, Functions, MySQL (B1ms), VM (B2ms), Key Vault, Storage | Developer testing and experimentation |
Gmi.Pulumi.Infrastructure.Prod |
Production | VNet, Subnets, App Service Plan (B1) + Function Plan (S1), 3 Web Apps, Functions, MySQL (B2ms), VM (B2ms), Key Vault, Storage | Live customer environment |
Gmi.ClassLibrary, Gmi.DataAccess, etc.) are used at the application level, not the infrastructure level.
Azure Resources Managed
Compute Resources
- • App Service Plans (Web + Functions)
- • Web Apps (Client, Admin, Technology)
- • Azure Functions (dotnet-isolated)
- • Virtual Machines (B2ms - Background Services)
Data & Storage
- • MySQL Flexible Server (VNet integrated)
- • Function Storage Account (StorageV2)
- • Blob Storage Account (Hot tier)
Networking
- • Virtual Networks (10.0.0.0/16 dev, 10.1.0.0/16 prod)
- • Subnets with Delegation (App Service, MySQL)
- • Network Security Groups (SSH, HTTP, HTTPS)
- • Public IP Addresses (Static, VM SSH)
- • VNet Integration for all services
Security & Identity
- • Azure AD App Registrations
- • Service Principals
- • Azure Key Vault (secrets for DB, Blob Storage, Stripe, SendGrid, Twilio, FMP, Google OAuth)
- • System-Assigned Managed Identities
- • Key Vault Access Policies per service
Code Example
Sample Pulumi C# Infrastructure Definition (from actual Dev stack)
// Configuration
var config = new Pulumi.Config();
var location = config.Get("location") ?? "Central US";
var resourceBaseName = config.Get("resourceBaseName") ?? "gmiapp";
// Resource Group
var devResourceGroup = new ResourceGroup("dev-rg", new ResourceGroupArgs
{
ResourceGroupName = $"{resourceBaseName}-dev-rg",
Location = location,
Tags = new Dictionary<string, string>
{
{"Environment", "Development"},
{"Project", resourceBaseName}
}
});
// App Service Plan (S1 Standard for VNet integration)
var devAppServicePlan = new AppServicePlan("dev-asp", new AppServicePlanArgs
{
Name = $"{resourceBaseName}-dev-asp",
ResourceGroupName = devResourceGroup.Name,
Location = location,
Sku = new SkuDescriptionArgs { Name = "S1", Tier = "Standard" },
Kind = "app"
});
// MySQL Flexible Server with VNet Integration
var devMySqlServer = new Server("dev-mysql", new ServerArgs
{
ServerName = $"{resourceBaseName}-dev-mysql",
ResourceGroupName = devResourceGroup.Name,
Location = location,
AdministratorLogin = mysqlAdminUsername,
AdministratorLoginPassword = mysqlAdminPassword,
Version = "8.0.21",
Sku = new MySQLServerSkuArgs
{
Name = "Standard_B1ms", Tier = "Burstable"
},
Storage = new StorageArgs { StorageSizeGB = 20 },
Network = new NetworkArgs
{
PublicNetworkAccess = "Disabled",
DelegatedSubnetResourceId = devMySqlSubnet.Id
}
});IaC Benefits with Pulumi
Development Benefits
- Type Safety: Compile-time checking prevents errors
- IntelliSense: Full IDE support with autocompletion
- Refactoring: Safe infrastructure changes
- Testing: Unit test infrastructure code
- Debugging: Step through infrastructure deployments
Operational Benefits
- Version Control: Git history of all changes
- Code Reviews: PR process for infrastructure
- Rollback: Easy revert to previous versions
- Drift Detection: Identify manual changes
- Cost Preview: See cost impact before deploy
Deployment Workflow
Code Development
Write infrastructure changes in C# using Visual Studio or VS Code
Preview Changes
Run pulumi preview to see what will be created, updated, or deleted
Code Review
Submit PR with infrastructure changes for team review
Automated Testing
CI pipeline validates infrastructure code and runs policy checks
Deployment
Execute pulumi up through Azure DevOps pipeline
Validation
Automated smoke tests verify infrastructure is functioning
Pulumi Stack
- Pulumi CLI
- C# SDK
- Azure Native Provider
- State Management
- Secrets Encryption
- Policy as Code
Infrastructure Metrics
- 2 Environment Stacks (Dev + Prod)
- 30+ Azure Resources per environment
- 100% Infrastructure as Code
- Key Vault Centralized Secret Management
- VNet Integrated Private Networking
- Managed Identity Service-to-Service Auth
Why Pulumi?
-
Real Programming Languages
Use C# instead of DSLs or YAML -
Multi-Cloud Ready
Support for Azure, AWS, GCP -
Built-in Secrets
Encrypted secrets management -
State Management
Reliable state tracking
Common Commands
pulumi new azure-csharp
Create new projectpulumi stack select dev
Switch to dev stackpulumi preview
Preview changespulumi up
Deploy infrastructurepulumi destroy
Tear down resources