Size S - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server small reference architecture describes the recommended infrastructure specifications for deploying a single IQ Server instance in Microsoft Azure using cloud-native services. It supports environments with 500–1,999 applications and an expected throughput of approximately 150–220 evaluations per hour, or approximately 3,600–5,280 evaluations per day.

This reference architecture is appropriate for small-to-medium production environments that require increased evaluation throughput, larger onboarding capacity, and improved infrastructure resilience compared to the XS profile. While this architecture still uses a single IQ Server node, it introduces stronger production recommendations around storage redundancy and database resilience.

Infrastructure Specifications

The architecture includes the following layers:

• Compute Layer – IQ Server application runtime
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Connectivity, access control, and optional load balancing

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

• 4 vCPU
• 32 GB RAM

JVM configuration:

• -Xms24g
• -Xmx24g

Example Azure instance types:

• Standard_E4ps_v6 for ARM-based deployments
• Standard_E4_v5 for x86-based deployments

Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

• Service: Azure Database for PostgreSQL - Flexible Server
• SKU options:
  • GP_Standard_D2s_v3 or
  • B_Standard_B4ms
• Database resources:
  • GP_Standard_D2s_v3
    • 2 vCores
    • 8GB RAM
  • B_Standard_B4ms
    • 4 vCores
    • 8 GB RAM
    • Burstable compute profile
• Storage:
  • 64 GB
  • Auto-scaling enabled
• Zone redundancy recommended for production deployments

Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

• Service: Azure Files - Standard HDD
• Protocol: SMB 3.0
• Zone-Redundant Storage (ZRS) recommended for production deployments
• Initial capacity of 100 GB with auto-scaling enabled

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node
• Optional Azure Application Gateway or Load Balancer in front of the IQ Server node
• Private connectivity between IQ Server, PostgreSQL, and Azure Files

Apply standard network security practices, including the following:

• Network Security Groups following least-privilege principle
• Azure NAT Gateway for outbound internet access
• Azure Key Vault for credential and secret management
• Azure Monitor and Log Analytics for centralized logging and monitoring
• Private networking for database and storage services where possible

Limitations

This architecture has the following limitations:

• This architecture supports a single IQ Server instance only. It does not support a multi-instance high-availability deployment.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
• While zone redundancy is recommended for the database and storage layers, the application layer itself is not redundant.
• This architecture is not intended for cross-region disaster recovery and does not provide automatic regional failover.

Deploying This Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for Azure deployments. This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.