Size XS - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server extra-small reference architecture describes the minimum supported infrastructure specifications for deploying a single IQ Server instance in Microsoft Azure using cloud-native services. It supports environments with fewer than 500 applications and an expected throughput of approximately 80–120 evaluations per hour, or approximately 1,920–2,880 evaluations per day.

This reference architecture represents the smallest supported infrastructure footprint for running IQ Server in Azure. It is appropriate for evaluation environments, proof-of-concept deployments, and small teams with light evaluation volume. It is not designed for high availability and is not recommended for production environments that require automatic failover or continuous availability.

Infrastructure Specifications

This architecture includes the following layers:

• Compute Layer – IQ Server application runtime
• Database Layer – PostgreSQL metadata database
• Storage Layer – Shared file storage for IQ Server data
• Network Layer – Connectivity, access control, and optional load balancing

Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

• 2 vCPU
• 16 GB RAM

JVM configuration:

• -Xms12g
• -Xmx12g

Example Azure instance types:

• Standard_E2ps_v6 for ARM-based deployments
• Standard_E2_v5 for x86-based deployments

This architecture uses a single IQ Server node. Because it does not include multiple application nodes, it does not provide application-level high availability.

Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

• Service: Azure Database for PostgreSQL - Flexible Server

• SKU: B_Standard_B2ms

• Database resources:

• 2 vCores

  • 8 GB RAM
  • Burstable compute profile

• Storage:

• 32 GB

  • Auto-scaling enabled

• Zone redundancy optional

The burstable database SKU is appropriate for lightweight or intermittent workloads where evaluation activity is relatively low.

Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

• Service: Azure Files - Standard HDD

• Protocol: SMB 3.0

• Redundancy:

• Locally Redundant Storage (LRS) for non-critical environments

  • Zone-Redundant Storage (ZRS) recommended for production deployments

• Initial capacity: 50 GB

Azure Files provides a cost-effective shared storage solution for smaller IQ Server environments.

Network and Security

Typical deployment patterns include the following:

• Direct access to the IQ Server node
• Optional Azure Application Gateway or Load Balancer in front of the IQ Server node
• Private connectivity between IQ Server, PostgreSQL, and Azure Files

Apply standard network security practices, including the following:

• Network Security Groups following least-privilege principle
• Azure NAT Gateway for outbound internet access
• Azure Key Vault for credential and secret management
• Azure Monitor and Log Analytics for centralized logging and monitoring

Limitations

This architecture has the following limitations:

• This architecture supports a single IQ Server instance only. It does not support a multi-instance high-availability deployment.
• Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
• While Azure Database for PostgreSQL can use zone redundancy for database resilience, the application layer itself is not redundant.
• This architecture is not intended for disaster recovery and does not provide cross-region failover.
• Burstable database compute may not be appropriate for sustained high-throughput workloads.

Deploying this Architecture

You can quickly deploy this reference architecture using Sonatype's IQ Terraform configuration for Azure deployments. This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.