Skip to content

Manual Test Runbook — N4: DDoS Network Protection

Owner: Sagar  |  Time: ~5 min (Parts A + B offline) · +15 min (optional Part C integration)  |  Sandbox: snowops-sandbox-01

Promotes N4 (modules/azure/ddos-protection/) from 🟦 Code Complete → 🟩 Shipped.

COST WARNING: Part C applies a DDoS Network Protection plan (~$2,944/month). Confirm budget approval before running Part C and destroy immediately after. Parts A and B are free — they run offline against the fixture.

Prerequisites

  • Sandbox subscription access active (PIM activated if required)
  • Budget approval confirmed for the DDoS plan charge (Part C only)
  • az login done; az account show confirms the sandbox subscription is selected
  • SNOWOPS_SANDBOX_SUBSCRIPTION_ID + SNOWOPS_SANDBOX_TENANT_ID exported
  • Local tooling: terraform >= 1.6, go >= 1.22, az CLI >= 2.50
  • Working directory: repo root

Steps

Part A — terraform fmt + validate (offline, ~3 min)

  1. Module + example:
terraform -chdir=modules/azure/ddos-protection fmt -recursive -check
terraform -chdir=modules/azure/ddos-protection init -backend=false -input=false
terraform -chdir=modules/azure/ddos-protection validate

terraform -chdir=modules/azure/ddos-protection/examples/basic init -backend=false -input=false
terraform -chdir=modules/azure/ddos-protection/examples/basic validate

Expected: Success! The configuration is valid. for both.

  1. Offline Terratest case:
cd tests/terratest
go test -v -timeout 5m ./modules/azure/... -run TestDDoSProtectionValidate

Expected: PASS.

Part B — full Terratest suite (offline, ~3 min)

  1. bash cd tests/terratest go test -count=1 -timeout 15m ./...

Expected: full offline suite green.

Part C — integration test: DDoS plan apply + VNet association (sandbox, ~15 min, ~$2,944/month prorated — DESTROY IMMEDIATELY)

Budget approval required. The plan incurs the monthly charge from the moment it is applied. Run this test, verify, and destroy within the same session to minimize cost.

  1. Apply the example:
cd modules/azure/ddos-protection/examples/basic
terraform init -input=false
terraform apply -auto-approve \
  -var "subscription_id=$SNOWOPS_SANDBOX_SUBSCRIPTION_ID" \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID" \
  -var "plan_name=snowops-n4-test-ddos"

Expected: clean apply; plan_id output is a valid ARM ID.

  1. Verify the plan exists:
az network ddos-protection show \
  -g snowops-ddos-example-rg \
  -n snowops-n4-test-ddos \
  --query "{name:name, provisioningState:provisioningState, vnets:virtualNetworks}" \
  -o json

Expected: provisioningState = "Succeeded".

  1. Associate a sandbox VNet with the plan (using a test VNet or the F2 hub vNet):
PLAN_ID=$(terraform -chdir=modules/azure/ddos-protection/examples/basic output -raw plan_id)

az network vnet update \
  -g <VNET_RG> -n <VNET_NAME> \
  --ddos-protection true \
  --ddos-protection-plan $PLAN_ID
  1. Confirm the association:
az network vnet show \
  -g <VNET_RG> -n <VNET_NAME> \
  --query "ddosProtectionPlan" -o json

Expected: id matches $PLAN_ID.

  1. Also verify via the plan's virtual_network_ids output:
terraform -chdir=modules/azure/ddos-protection/examples/basic output -json virtual_network_ids

Expected: list includes the associated VNet ARM ID.

Pass criteria

  • Part A — module + example validate; TestDDoSProtectionValidate passes
  • Part B — full offline Terratest suite passes
  • (Part C) DDoS plan applies cleanly; provisioningState = Succeeded
  • (Part C) VNet association reflected in az network vnet show + virtual_network_ids output
  • All test resources removed (plan + disassociated VNet)

Teardown

# Remove VNet association first
az network vnet update -g <VNET_RG> -n <VNET_NAME> \
  --ddos-protection false --ddos-protection-plan ""

# Destroy the plan
cd modules/azure/ddos-protection/examples/basic
terraform destroy -auto-approve \
  -var "subscription_id=$SNOWOPS_SANDBOX_SUBSCRIPTION_ID" \
  -var "tenant_id=$SNOWOPS_SANDBOX_TENANT_ID"

Sign-off

  • Tester: _  |  Date: _  |  Result: PASS / FAIL / N/A
  • Notes: