Azure FastAPI DevOps Project

A production-style cloud project that deploys a containerized FastAPI application to Azure using Terraform, Azure Container Apps, Managed Identity, Key Vault, Blob Storage, Run Pytest and GitHub Actions CI/CD.

OVERVIEW

This project demonstrates how to build, secure, and deploy a cloud-native application without hardcoding credentials.

It includes:

A FastAPI backend

Docker containerization

Infrastructure as Code (Terraform)

Secure secret management via Azure Key Vault

Managed Identity authentication (no secrets in code)

Azure Blob Storage integration

GitHub Actions CI/CD pipeline

ARCHITECTURE

TECH STACK

Python / FastAPI

Docker

Terraform

Azure Container Apps

Azure Container Registry (ACR)

Azure Key Vault

Azure Blob Storage

Managed Identity (RBAC)

GitHub Actions (CI/CD)

Infrastructure scope

Terraform provisions the Container App, its environment, and Log Analytics.

Key Vault, Storage, and ACR are created via the Azure CLI and referenced by the app - not yet managed by this Terraform.

RBAC role assignments are applied manually. (Next step: bring these under Terraform.)

SECURITY DESIGN

• App-to-Azure auth (Key Vault, Blob) uses Managed Identity — no secrets in app code
• Secrets retrieved dynamically from Key Vault at runtime
• Storage access controlled via RBAC role assignments
• Write endpoint protected by an API key

Note: ACR image pull uses the ACR admin credential (a Terraform variable), and the API key is supplied as an environment variable — the two spots that aren't fully passwordless.

API ENDPOINTS

AUTHENTICATION

Protected endpoints require header: x-api-key: your-key

CI/CD PIPELINE

CI (tests): runs automatically on every push and pull request to main

Deploy (build → push to ACR → update Container App): manual trigger only, via workflow_dispatch in GitHub Actions — a stale Azure credential or transient failure can't turn every commit into a failed pipeline run

Trigger: git push to main

TESTING

Basic tests included using pytest: pytest ./app Covers: root endpoint, health check, unauthorized access

Terraform State

State is stored remotely in Azure Blob Storage with state locking enabled. The backend storage account must be created before running terraform init:

az group create --name rg-hello-aca-sg --location southeastasia

az storage account create \
  --name tfstatektzmjackie \
  --resource-group rg-hello-aca-sg \
  --sku Standard_LRS \
  --encryption-services blob

az storage container create \
  --name tfstate \
  --account-name tfstatektzmjackie

STORAGE FLOW

1. App retrieves storage account name from Key Vault
2. Uses Managed Identity to authenticate
3. Writes blob to container appdata

COST OPTIMIZATION

Container Apps configured with: min_replicas = 0 (Scales to zero when idle)

CLEANUP

To avoid charges, delete: Container App, Container App Environment, Log Analytics Workspace

Keep only if needed: ACR, Key Vault, Storage Account

KEY LEARNINGS

Managed Identity vs secrets-based auth

Terraform vs manual Azure drift issues

RBAC propagation delays

ACR authentication setup

ARM vs AMD64 Docker image issues

Key Vault naming constraints

HOW TO RUN LOCALLY

cd app

pip install -r requirements.txt

uvicorn main:app --reload

BUILD & PUSH IMAGE

docker buildx build --platform linux/amd64 \

  -t <acr-name>.azurecr.io/p16-fastapi:<IMAGE> \
  
  --push .

SCREENSHOTS

Application Demo

Secure secret retrieval from Azure Key Vault without hardcoded credentials

Successful write to Azure Blob Storage using Managed Identity authentication

AUTHOR

Built as part of a hands-on DevOps/cloud engineering journey.