# Size XS - Sonatype IQ - Azure Cloud-Native Reference Architecture

This Sonatype IQ Server extra-small reference architecture describes the minimum supported infrastructure specifications for deploying a single IQ Server instance in Microsoft Azure using cloud-native services. It supports environments with **fewer than 500 applications** and an expected throughput of **approximately 80–120 evaluations per hour**, or approximately **1,920–2,880 evaluations per day**.

This reference architecture represents the smallest supported infrastructure footprint for running IQ Server in Azure. It is appropriate for evaluation environments, proof-of-concept deployments, and small teams with light evaluation volume. It is not designed for high availability and is not recommended for production environments that require automatic failover or continuous availability.

## Infrastructure Specifications

This architecture includes the following layers:

- Compute Layer – IQ Server application runtime
- Database Layer – PostgreSQL metadata database
- Storage Layer – Shared file storage for IQ Server data
- Network Layer – Connectivity, access control, and optional load balancing

### Compute Layer (IQ Server)

The compute layer hosts the IQ Server application and processes application evaluations, policy evaluations, reports, and related user activity.

This layer meets the following specifications:

Single IQ Server node:

- 2 vCPU
- 16 GB RAM

JVM configuration:

- `-Xms12g`
- `-Xmx12g`

Example Azure instance types:

- `Standard_E2ps_v6` for ARM-based deployments
- `Standard_E2_v5` for x86-based deployments

This architecture uses a single IQ Server node. Because it does not include multiple application nodes, it does not provide application-level high availability.

### Database Layer (Azure Database for PostgreSQL)

This layer meets the following specifications:

- Service: Azure Database for PostgreSQL - Flexible Server
- SKU: `B_Standard_B2ms`
- Database resources:

- 2 vCores
  - 8 GB RAM
  - Burstable compute profile

- Storage:

- 32 GB
  - Auto-scaling enabled

- Zone redundancy optional

The burstable database SKU is appropriate for lightweight or intermittent workloads where evaluation activity is relatively low.

### Storage Layer (Azure Files)

Azure Files provides persistent shared storage for IQ Server operational data, reports, logs, and scan-related content.

This layer meets the following specifications:

- Service: Azure Files - Standard HDD
- Protocol: SMB 3.0
- Redundancy:

- Locally Redundant Storage (LRS) for non-critical environments
  - Zone-Redundant Storage (ZRS) recommended for production deployments

- Initial capacity: 50 GB

Azure Files provides a cost-effective shared storage solution for smaller IQ Server environments.

### Network and Security

Typical deployment patterns include the following:

- Direct access to the IQ Server node
- Optional Azure Application Gateway or Load Balancer in front of the IQ Server node
- Private connectivity between IQ Server, PostgreSQL, and Azure Files

Apply standard network security practices, including the following:

- Network Security Groups following least-privilege principle
- Azure NAT Gateway for outbound internet access
- Azure Key Vault for credential and secret management
- Azure Monitor and Log Analytics for centralized logging and monitoring

## Limitations

This architecture has the following limitations:

- This architecture supports a single IQ Server instance only. It does not support a multi-instance high-availability deployment.
- Increasing scan volume or concurrent evaluations beyond the recommended profile may lead to degraded performance.
- While Azure Database for PostgreSQL can use zone redundancy for database resilience, the application layer itself is not redundant.
- This architecture is not intended for disaster recovery and does not provide cross-region failover.
- Burstable database compute may not be appropriate for sustained high-throughput workloads.

## Deploying this Architecture

You can quickly deploy this reference architecture using [Sonatype's IQ Terraform configuration for Azure deployments](https://github.com/sonatype/sca-reference-architectures/tree/main). This automates the creation and configuration of all required Azure resources, including networking, compute, storage, and security components.

For full deployment details, see the README that accompanies the provided Terraform.