GMI · TECHNOLOGY OBSERVATORY // ALL SYSTEMS NOMINAL
ENGINEERED BY LEOPARD DATA

Infrastructure as Code

Using Pulumi with C# to define, deploy, and manage Azure infrastructure through code.

Pulumi for Azure Infrastructure

Grade My Investments' infrastructure is entirely defined as code using Pulumi with C#, maintaining our commitment to the Microsoft ecosystem even in our infrastructure management. This approach enables version-controlled, repeatable, and reviewable infrastructure deployments across all environments.

By using Pulumi with C# instead of traditional JSON or YAML templates, our developers can leverage their existing C# expertise to manage infrastructure, use familiar tools like Visual Studio and VS Code, and benefit from compile-time type safety and IntelliSense support.

AZURE TOPOLOGY
rendering diagram…
flowchart TB
    subgraph IaC[Pulumi C# - Infrastructure as Code]
        PD[Gmi.Pulumi.Infrastructure.Dev]:::svc
        PP[Gmi.Pulumi.Infrastructure.Prod]:::svc
    end
    subgraph NET[Virtual Network - VNet]
        SN1[App Service Subnet]:::svc
        SN2[MySQL Subnet]:::svc
        NSG[Network Security Group]:::sec
    end
    subgraph COMPUTE[Compute]
        ASP[App Service Plan]:::svc
        WA[Web Apps - Client - Admin - TechWeb]:::app
        FN[Azure Functions]:::svc
        VM[Linux VM B2ms<br/>Background Services]:::svc
    end
    subgraph DATA[Data - Storage]
        DB[(MySQL Flexible Server<br/>VNet integrated)]:::data
        BLOB[(Blob Storage Account<br/>Hot tier)]:::data
        KV[(Key Vault<br/>Secrets - Managed Identity)]:::sec
    end
    subgraph OBS[Observability]
        AI([Application Insights]):::ext
    end
    PD -->|pulumi up| NET
    PP -->|pulumi up| NET
    NET --> COMPUTE
    NET --> DATA
    COMPUTE --> DATA
    COMPUTE --> OBS
    COMPUTE --> KV
classDef app fill:#1f2630,stroke:#C0894E,color:#F3EFE8;
classDef svc fill:#241c14,stroke:#E2B583,color:#F3EFE8;
classDef data fill:#22201a,stroke:#C0894E,color:#EBD3AE;
classDef ext fill:#1b1f27,stroke:#5A616B,color:#C4C0B8;
classDef sec fill:#1d2733,stroke:#5cc8e0,color:#eafaff;
Pulumi C# defines every Azure resource across dev and prod environments.

Infrastructure Projects

Project Environment Key Resources Purpose
Gmi.Pulumi.Infrastructure.Dev Development VNet, Subnets, App Service Plan (S1), 3 Web Apps, Functions, MySQL (B1ms), VM (B2ms), Key Vault, Storage Developer testing and experimentation
Gmi.Pulumi.Infrastructure.Prod Production VNet, Subnets, App Service Plan (B1) + Function Plan (S1), 3 Web Apps, Functions, MySQL (B2ms), VM (B2ms), Key Vault, Storage Live customer environment
Both projects are standalone C# top-level programs that define the complete infrastructure for their environment. Shared class libraries (Gmi.ClassLibrary, Gmi.DataAccess, etc.) are used at the application level, not the infrastructure level.

Azure Resources Managed

Compute Resources
  • • App Service Plans (Web + Functions)
  • • Web Apps (Client, Admin, Technology)
  • • Azure Functions (dotnet-isolated)
  • • Virtual Machines (B2ms - Background Services)
Data & Storage
  • • MySQL Flexible Server (VNet integrated)
  • • Function Storage Account (StorageV2)
  • • Blob Storage Account (Hot tier)
Networking
  • • Virtual Networks (10.0.0.0/16 dev, 10.1.0.0/16 prod)
  • • Subnets with Delegation (App Service, MySQL)
  • • Network Security Groups (SSH, HTTP, HTTPS)
  • • Public IP Addresses (Static, VM SSH)
  • • VNet Integration for all services
Security & Identity
  • • Azure AD App Registrations
  • • Service Principals
  • • Azure Key Vault (secrets for DB, Blob Storage, Stripe, SendGrid, Twilio, FMP, Google OAuth)
  • • System-Assigned Managed Identities
  • • Key Vault Access Policies per service

Code Example

Sample Pulumi C# Infrastructure Definition (from actual Dev stack)
// Configuration
var config = new Pulumi.Config();
var location = config.Get("location") ?? "Central US";
var resourceBaseName = config.Get("resourceBaseName") ?? "gmiapp";

// Resource Group
var devResourceGroup = new ResourceGroup("dev-rg", new ResourceGroupArgs
{
    ResourceGroupName = $"{resourceBaseName}-dev-rg",
    Location = location,
    Tags = new Dictionary<string, string>
    {
        {"Environment", "Development"},
        {"Project", resourceBaseName}
    }
});

// App Service Plan (S1 Standard for VNet integration)
var devAppServicePlan = new AppServicePlan("dev-asp", new AppServicePlanArgs
{
    Name = $"{resourceBaseName}-dev-asp",
    ResourceGroupName = devResourceGroup.Name,
    Location = location,
    Sku = new SkuDescriptionArgs { Name = "S1", Tier = "Standard" },
    Kind = "app"
});

// MySQL Flexible Server with VNet Integration
var devMySqlServer = new Server("dev-mysql", new ServerArgs
{
    ServerName = $"{resourceBaseName}-dev-mysql",
    ResourceGroupName = devResourceGroup.Name,
    Location = location,
    AdministratorLogin = mysqlAdminUsername,
    AdministratorLoginPassword = mysqlAdminPassword,
    Version = "8.0.21",
    Sku = new MySQLServerSkuArgs
    {
        Name = "Standard_B1ms", Tier = "Burstable"
    },
    Storage = new StorageArgs { StorageSizeGB = 20 },
    Network = new NetworkArgs
    {
        PublicNetworkAccess = "Disabled",
        DelegatedSubnetResourceId = devMySqlSubnet.Id
    }
});

IaC Benefits with Pulumi

Development Benefits
  • Type Safety: Compile-time checking prevents errors
  • IntelliSense: Full IDE support with autocompletion
  • Refactoring: Safe infrastructure changes
  • Testing: Unit test infrastructure code
  • Debugging: Step through infrastructure deployments
Operational Benefits
  • Version Control: Git history of all changes
  • Code Reviews: PR process for infrastructure
  • Rollback: Easy revert to previous versions
  • Drift Detection: Identify manual changes
  • Cost Preview: See cost impact before deploy

Deployment Workflow

1
Code Development

Write infrastructure changes in C# using Visual Studio or VS Code

2
Preview Changes

Run pulumi preview to see what will be created, updated, or deleted

3
Code Review

Submit PR with infrastructure changes for team review

4
Automated Testing

CI pipeline validates infrastructure code and runs policy checks

5
Deployment

Execute pulumi up through Azure DevOps pipeline

6
Validation

Automated smoke tests verify infrastructure is functioning

Pulumi Stack
  • Pulumi CLI
  • C# SDK
  • Azure Native Provider
  • State Management
  • Secrets Encryption
  • Policy as Code
Infrastructure Metrics
  • 2 Environment Stacks (Dev + Prod)
  • 30+ Azure Resources per environment
  • 100% Infrastructure as Code
  • Key Vault Centralized Secret Management
  • VNet Integrated Private Networking
  • Managed Identity Service-to-Service Auth
Why Pulumi?
  • Real Programming Languages
    Use C# instead of DSLs or YAML
  • Multi-Cloud Ready
    Support for Azure, AWS, GCP
  • Built-in Secrets
    Encrypted secrets management
  • State Management
    Reliable state tracking
Common Commands
pulumi new azure-csharp Create new project
pulumi stack select dev Switch to dev stack
pulumi preview Preview changes
pulumi up Deploy infrastructure
pulumi destroy Tear down resources