# Size M - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server medium reference architecture describes the recommended infrastructure specifications for deploying either a single-instance or high-availability IQ Server environment in Microsoft Azure using cloud-native services. It supports environments with **2,000–9,999 applications** and an expected throughput of approximately **310 evaluations per hour per node**, or approximately **7,440 evaluations per day per node**.

This reference architecture is appropriate for production environments that require higher evaluation throughput, larger onboarding capacity, and a deployment model that can support either single-instance operation or high availability.

## Infrastructure Specifications

This reference architecture defines an IQ Server deployment supported by Azure-managed infrastructure services.

The architecture includes the following layers:

- **Compute Layer** – IQ Server application runtime or high-availability application cluster
- **Database Layer** – PostgreSQL metadata database
- **Storage Layer** – Shared file storage for IQ Server data
- **Network Layer** – Connectivity, load balancing, and security controls

### Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Two IQ Server nodes:

- 8 vCPU per node
- 64 GB RAM per node

JVM configuration per node:

- `-Xms48g`
- `-Xmx48g`

Example Azure instance types:

- `Standard_E8ps_v6` for ARM-based deployments
- `Standard_E8_v5` for x86-based deployments

### Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

- Service: Azure Database for PostgreSQL - Flexible Server
- SKU: `GP_Standard_D8s_v3`
- Database resources:
  - 8 vCores
  - 32 GB RAM
- Storage:
  - 100 GB
  - Auto-scaling enabled
- Zone redundancy recommended

### Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

- Service: Azure Files - Standard HDD
- Protocol: SMB 3.0
- Zone-redundant storage (ZRS) for high-availability deployments
- 100 GB initial capacity with auto-scaling enabled

### Network and Security

Typical deployment patterns include the following:

- Direct access to the IQ Server node for single-instance deployments
- Azure Application Gateway or Load Balancer in front of IQ Server nodes for high-availability deployments
- Private connectivity between IQ Server, PostgreSQL, and Azure Files
- IQ Server nodes distributed across availability zones for high-availability deployments

Apply standard network security practices, including the following:

- Network Security Groups following least-privilege principle
- Azure NAT Gateway for outbound internet access
- Azure Key Vault for credential and secret management
- Azure Monitor and Log Analytics for centralized logging and monitoring
- Private networking for database and storage services where possible
- TLS encryption for inbound and internal service communication

## Limitations

This architecture has the following limitations:

- Single-instance deployments do not provide application-level high availability.
- High-availability deployments require additional infrastructure coordination, including load balancing, shared storage, and zone-aware deployment.
- Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
- While zone redundancy is recommended for the database layer and storage layer, this architecture does not provide cross-region disaster recovery.
- Storage throughput and database performance may become bottlenecks if infrastructure sizing is not adjusted alongside workload growth.

## Deploying this Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for Azure deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.