# Size L - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server large reference architecture describes the recommended infrastructure specifications for deploying a high-availability IQ Server environment in Microsoft Azure using cloud-native services. It supports environments with **10,000–19,999 applications** and an expected throughput of approximately **310 evaluations per hour per node**, or approximately **14,880–22,320 evaluations per day total**.

This reference architecture is designed for production environments that require high availability, increased evaluation capacity, and resilient managed infrastructure.

## Infrastructure Specifications

This reference architecture defines a high-availability IQ Server deployment supported by Azure-managed infrastructure services.

This architecture includes the following layers:

- **Compute Layer** – High-availability IQ Server application cluster
- **Database Layer** – PostgreSQL metadata database
- **Storage Layer** – Shared file storage for IQ Server data
- **Network Layer** – Load balancing, connectivity, and security controls

### Compute Layer (IQ Server)

The compute layer hosts the IQ Server application cluster and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Three IQ Server nodes:

- 8 vCPU per node
- 64 GB RAM per node

JVM configuration per node:

- `-Xms48g`
- `-Xmx48g`

Example Azure instance types:

- `Standard_E8ps_v6` for ARM-based deployments
- `Standard_E8_v5` for x86-based deployments

This architecture requires a high-availability IQ Server deployment. IQ Server nodes should be deployed behind a load balancer and distributed across availability zones where possible.

### Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

- Service: Azure Database for PostgreSQL - Flexible Server
- SKU: `GP_Standard_D8s_v3`
- Database resources:
  - 8 vCores
  - 32 GB RAM
- Storage:
  - 200 GB – 1 TB
  - Auto-scaling enabled
- Zone redundancy required

Zone redundancy is required at this tier to support production availability and reduce the risk of database downtime caused by zone-level failures.

### Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content across all IQ Server nodes.

This layer meets the following specifications:

- Service: Azure Files - Standard HDD
- Protocol: SMB 3.0
- Zone-redundant storage (ZRS)
- Estimated capacity: 500 GB – 1.5 TB

ZRS is required for this architecture because it replicates storage data across multiple Azure availability zones within a region.

### Network and Security

This architecture uses load-balanced high-availability connectivity across multiple IQ Server nodes.

Typical deployment patterns include the following:

- Azure Application Gateway or Load Balancer in front of IQ Server nodes
- Private connectivity between IQ Server, PostgreSQL, and Azure Files
- IQ Server nodes distributed across availability zones
- Private subnets for database and storage infrastructure

Apply standard network security practices, including the following:

- Network Security Groups following least-privilege principle
- Azure NAT Gateway for outbound internet access
- Azure Key Vault for credential and secret management
- Azure Monitor and Log Analytics for centralized logging and monitoring
- Private networking for database and storage services where possible
- TLS encryption for inbound and internal service communication

## Limitations

This architecture has the following limitations:

- This architecture requires high availability and introduces additional operational complexity compared to smaller single-instance profiles.
- This architecture does not provide cross-region disaster recovery.
- Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
- Shared storage throughput and database performance may become bottlenecks if infrastructure sizing is not adjusted alongside workload growth.
- Azure Files Standard HDD is appropriate for the stated profile, but storage performance should be monitored as evaluation volume and reporting activity increase.

## Deploying this Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for Azure deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.