# Size S - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server small reference architecture describes the recommended infrastructure specifications for deploying a single IQ Server instance in Microsoft Azure using cloud-native services. It supports environments with **500–1,999 applications** and an expected throughput of approximately **150–220 evaluations per hour**, or approximately **3,600–5,280 evaluations per day**.

This reference architecture is appropriate for small-to-medium production environments that require increased evaluation throughput, larger onboarding capacity, and improved infrastructure resilience compared to the XS profile. While this architecture still uses a single IQ Server node, it introduces stronger production recommendations around storage redundancy and database resilience.

## Infrastructure Specifications

The architecture includes the following layers:

- **Compute Layer** – IQ Server application runtime
- **Database Layer** – PostgreSQL metadata database
- **Storage Layer** – Shared file storage for IQ Server data
- **Network Layer** – Connectivity, access control, and optional load balancing

### Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

- 4 vCPU
- 32 GB RAM

JVM configuration:

- `-Xms24g`
- `-Xmx24g`

Example Azure instance types:

- `Standard_E4ps_v6` for ARM-based deployments
- `Standard_E4_v5` for x86-based deployments

### Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

- Service: Azure Database for PostgreSQL - Flexible Server
- SKU options:
  - `GP_Standard_D2s_v3` or
  - `B_Standard_B4ms`
- Database resources:
  - `GP_Standard_D2s_v3`
    - 2 vCores
    - 8GB RAM
  - `B_Standard_B4ms`
    - 4 vCores
    - 8 GB RAM
    - Burstable compute profile
- Storage:
  - 64 GB
  - Auto-scaling enabled
- Zone redundancy recommended for production deployments

### Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

- Service: Azure Files - Standard HDD
- Protocol: SMB 3.0
- Zone-Redundant Storage (ZRS) recommended for production deployments
- Initial capacity of 100 GB with auto-scaling enabled

### Network and Security

Typical deployment patterns include the following:

- Direct access to the IQ Server node
- Optional Azure Application Gateway or Load Balancer in front of the IQ Server node
- Private connectivity between IQ Server, PostgreSQL, and Azure Files

Apply standard network security practices, including the following:

- Network Security Groups following least-privilege principle
- Azure NAT Gateway for outbound internet access
- Azure Key Vault for credential and secret management
- Azure Monitor and Log Analytics for centralized logging and monitoring
- Private networking for database and storage services where possible

## Limitations

This architecture has the following limitations:

- This architecture supports a single IQ Server instance only. It does not support a multi-instance high-availability deployment.
- Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
- While zone redundancy is recommended for the database and storage layers, the application layer itself is not redundant.
- This architecture is not intended for cross-region disaster recovery and does not provide automatic regional failover.

## Deploying This Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for Azure deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.