Size M - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server medium reference architecture describes the recommended infrastructure specifications for deploying either a single-instance or high-availability IQ Server environment in Microsoft Azure using cloud-native services. It supports environments with 2,000–9,999 applications and an expected throughput of approximately 310 evaluations per hour per node, or approximately 7,440 evaluations per day per node.

This reference architecture is appropriate for production environments that require higher evaluation throughput, larger onboarding capacity, and a deployment model that can support either single-instance operation or high availability.

Infrastructure Specifications

This reference architecture defines an IQ Server deployment supported by Azure-managed infrastructure services.

The architecture includes the following layers:

• Compute Layer – IQ Server application runtime or high-availability application cluster
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Connectivity, load balancing, and security controls

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Two IQ Server nodes:

• 8 vCPU per node
• 64 GB RAM per node

JVM configuration per node:

• -Xms48g
• -Xmx48g

Example Azure instance types:

• Standard_E8ps_v6 for ARM-based deployments
• Standard_E8_v5 for x86-based deployments

Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

• Service: Azure Database for PostgreSQL - Flexible Server
• SKU: GP_Standard_D8s_v3
• Database resources:
  • 8 vCores
  • 32 GB RAM
• Storage:
  • 100 GB
  • Auto-scaling enabled
• Zone redundancy recommended

Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

• Service: Azure Files - Standard HDD
• Protocol: SMB 3.0
• Zone-redundant storage (ZRS) for high-availability deployments
• 100 GB initial capacity with auto-scaling enabled

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node for single-instance deployments
• Azure Application Gateway or Load Balancer in front of IQ Server nodes for high-availability deployments
• Private connectivity between IQ Server, PostgreSQL, and Azure Files
• IQ Server nodes distributed across availability zones for high-availability deployments

Apply standard network security practices, including the following:

• Network Security Groups following least-privilege principle
• Azure NAT Gateway for outbound internet access
• Azure Key Vault for credential and secret management
• Azure Monitor and Log Analytics for centralized logging and monitoring
• Private networking for database and storage services where possible
• TLS encryption for inbound and internal service communication

Limitations

This architecture has the following limitations:

• Single-instance deployments do not provide application-level high availability.
• High-availability deployments require additional infrastructure coordination, including load balancing, shared storage, and zone-aware deployment.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
• While zone redundancy is recommended for the database layer and storage layer, this architecture does not provide cross-region disaster recovery.
• Storage throughput and database performance may become bottlenecks if infrastructure sizing is not adjusted alongside workload growth.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for Azure deployments. This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.