diff --git a/.gitignore b/.gitignore
index bc4f97a..c088c36 100644
--- a/.gitignore
+++ b/.gitignore
@@ -27,3 +27,7 @@ yarn-error.log*
 **/**/*.tfstate
 **/**/target/
 
+*.terraform/
+*.tfvars
+*.tfstate
+*.tfstate.*.git_backup/
diff --git a/azure-3tier-reference/terraform/.git_backup/FETCH_HEAD b/azure-3tier-reference/terraform/.git_backup/FETCH_HEAD
new file mode 100644
index 0000000..e69de29
diff --git a/azure-3tier-reference/terraform/.git_backup/HEAD b/azure-3tier-reference/terraform/.git_backup/HEAD
new file mode 100644
index 0000000..cb089cd
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/HEAD
@@ -0,0 +1 @@
+ref: refs/heads/master
diff --git a/azure-3tier-reference/terraform/.git_backup/config b/azure-3tier-reference/terraform/.git_backup/config
new file mode 100644
index 0000000..8ad0b1b
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/config
@@ -0,0 +1,6 @@
+[core]
+	repositoryformatversion = 0
+	filemode = false
+	bare = false
+	logallrefupdates = true
+	ignorecase = true
diff --git a/azure-3tier-reference/terraform/.git_backup/description b/azure-3tier-reference/terraform/.git_backup/description
new file mode 100644
index 0000000..498b267
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/description
@@ -0,0 +1 @@
+Unnamed repository; edit this file 'description' to name the repository.
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/applypatch-msg.sample b/azure-3tier-reference/terraform/.git_backup/hooks/applypatch-msg.sample
new file mode 100644
index 0000000..a5d7b84
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/applypatch-msg.sample
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message taken by
+# applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.  The hook is
+# allowed to edit the commit message file.
+#
+# To enable this hook, rename this file to "applypatch-msg".
+
+. git-sh-setup
+commitmsg="$(git rev-parse --git-path hooks/commit-msg)"
+test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"}
+:
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/commit-msg.sample b/azure-3tier-reference/terraform/.git_backup/hooks/commit-msg.sample
new file mode 100644
index 0000000..b58d118
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/commit-msg.sample
@@ -0,0 +1,24 @@
+#!/bin/sh
+#
+# An example hook script to check the commit log message.
+# Called by "git commit" with one argument, the name of the file
+# that has the commit message.  The hook should exit with non-zero
+# status after issuing an appropriate message if it wants to stop the
+# commit.  The hook is allowed to edit the commit message file.
+#
+# To enable this hook, rename this file to "commit-msg".
+
+# Uncomment the below to add a Signed-off-by line to the message.
+# Doing this in a hook is a bad idea in general, but the prepare-commit-msg
+# hook is more suited to it.
+#
+# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
+# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1"
+
+# This example catches duplicate Signed-off-by lines.
+
+test "" = "$(grep '^Signed-off-by: ' "$1" |
+	 sort | uniq -c | sed -e '/^[ 	]*1[ 	]/d')" || {
+	echo >&2 Duplicate Signed-off-by lines.
+	exit 1
+}
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/fsmonitor-watchman.sample b/azure-3tier-reference/terraform/.git_backup/hooks/fsmonitor-watchman.sample
new file mode 100644
index 0000000..23e856f
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/fsmonitor-watchman.sample
@@ -0,0 +1,174 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+use IPC::Open2;
+
+# An example hook script to integrate Watchman
+# (https://facebook.github.io/watchman/) with git to speed up detecting
+# new and modified files.
+#
+# The hook is passed a version (currently 2) and last update token
+# formatted as a string and outputs to stdout a new update token and
+# all files that have been modified since the update token. Paths must
+# be relative to the root of the working tree and separated by a single NUL.
+#
+# To enable this hook, rename this file to "query-watchman" and set
+# 'git config core.fsmonitor .git/hooks/query-watchman'
+#
+my ($version, $last_update_token) = @ARGV;
+
+# Uncomment for debugging
+# print STDERR "$0 $version $last_update_token\n";
+
+# Check the hook interface version
+if ($version ne 2) {
+	die "Unsupported query-fsmonitor hook version '$version'.\n" .
+	    "Falling back to scanning...\n";
+}
+
+my $git_work_tree = get_working_dir();
+
+my $retry = 1;
+
+my $json_pkg;
+eval {
+	require JSON::XS;
+	$json_pkg = "JSON::XS";
+	1;
+} or do {
+	require JSON::PP;
+	$json_pkg = "JSON::PP";
+};
+
+launch_watchman();
+
+sub launch_watchman {
+	my $o = watchman_query();
+	if (is_work_tree_watched($o)) {
+		output_result($o->{clock}, @{$o->{files}});
+	}
+}
+
+sub output_result {
+	my ($clockid, @files) = @_;
+
+	# Uncomment for debugging watchman output
+	# open (my $fh, ">", ".git/watchman-output.out");
+	# binmode $fh, ":utf8";
+	# print $fh "$clockid\n@files\n";
+	# close $fh;
+
+	binmode STDOUT, ":utf8";
+	print $clockid;
+	print "\0";
+	local $, = "\0";
+	print @files;
+}
+
+sub watchman_clock {
+	my $response = qx/watchman clock "$git_work_tree"/;
+	die "Failed to get clock id on '$git_work_tree'.\n" .
+		"Falling back to scanning...\n" if $? != 0;
+
+	return $json_pkg->new->utf8->decode($response);
+}
+
+sub watchman_query {
+	my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty')
+	or die "open2() failed: $!\n" .
+	"Falling back to scanning...\n";
+
+	# In the query expression below we're asking for names of files that
+	# changed since $last_update_token but not from the .git folder.
+	#
+	# To accomplish this, we're using the "since" generator to use the
+	# recency index to select candidate nodes and "fields" to limit the
+	# output to file names only. Then we're using the "expression" term to
+	# further constrain the results.
+	my $last_update_line = "";
+	if (substr($last_update_token, 0, 1) eq "c") {
+		$last_update_token = "\"$last_update_token\"";
+		$last_update_line = qq[\n"since": $last_update_token,];
+	}
+	my $query = <<"	END";
+		["query", "$git_work_tree", {$last_update_line
+			"fields": ["name"],
+			"expression": ["not", ["dirname", ".git"]]
+		}]
+	END
+
+	# Uncomment for debugging the watchman query
+	# open (my $fh, ">", ".git/watchman-query.json");
+	# print $fh $query;
+	# close $fh;
+
+	print CHLD_IN $query;
+	close CHLD_IN;
+	my $response = do {local $/; <CHLD_OUT>};
+
+	# Uncomment for debugging the watch response
+	# open ($fh, ">", ".git/watchman-response.json");
+	# print $fh $response;
+	# close $fh;
+
+	die "Watchman: command returned no output.\n" .
+	"Falling back to scanning...\n" if $response eq "";
+	die "Watchman: command returned invalid output: $response\n" .
+	"Falling back to scanning...\n" unless $response =~ /^\{/;
+
+	return $json_pkg->new->utf8->decode($response);
+}
+
+sub is_work_tree_watched {
+	my ($output) = @_;
+	my $error = $output->{error};
+	if ($retry > 0 and $error and $error =~ m/unable to resolve root .* directory (.*) is not watched/) {
+		$retry--;
+		my $response = qx/watchman watch "$git_work_tree"/;
+		die "Failed to make watchman watch '$git_work_tree'.\n" .
+		    "Falling back to scanning...\n" if $? != 0;
+		$output = $json_pkg->new->utf8->decode($response);
+		$error = $output->{error};
+		die "Watchman: $error.\n" .
+		"Falling back to scanning...\n" if $error;
+
+		# Uncomment for debugging watchman output
+		# open (my $fh, ">", ".git/watchman-output.out");
+		# close $fh;
+
+		# Watchman will always return all files on the first query so
+		# return the fast "everything is dirty" flag to git and do the
+		# Watchman query just to get it over with now so we won't pay
+		# the cost in git to look up each individual file.
+		my $o = watchman_clock();
+		$error = $output->{error};
+
+		die "Watchman: $error.\n" .
+		"Falling back to scanning...\n" if $error;
+
+		output_result($o->{clock}, ("/"));
+		$last_update_token = $o->{clock};
+
+		eval { launch_watchman() };
+		return 0;
+	}
+
+	die "Watchman: $error.\n" .
+	"Falling back to scanning...\n" if $error;
+
+	return 1;
+}
+
+sub get_working_dir {
+	my $working_dir;
+	if ($^O =~ 'msys' || $^O =~ 'cygwin') {
+		$working_dir = Win32::GetCwd();
+		$working_dir =~ tr/\\/\//;
+	} else {
+		require Cwd;
+		$working_dir = Cwd::cwd();
+	}
+
+	return $working_dir;
+}
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/post-update.sample b/azure-3tier-reference/terraform/.git_backup/hooks/post-update.sample
new file mode 100644
index 0000000..ec17ec1
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/post-update.sample
@@ -0,0 +1,8 @@
+#!/bin/sh
+#
+# An example hook script to prepare a packed repository for use over
+# dumb transports.
+#
+# To enable this hook, rename this file to "post-update".
+
+exec git update-server-info
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/pre-applypatch.sample b/azure-3tier-reference/terraform/.git_backup/hooks/pre-applypatch.sample
new file mode 100644
index 0000000..4142082
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/pre-applypatch.sample
@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed
+# by applypatch from an e-mail message.
+#
+# The hook should exit with non-zero status after issuing an
+# appropriate message if it wants to stop the commit.
+#
+# To enable this hook, rename this file to "pre-applypatch".
+
+. git-sh-setup
+precommit="$(git rev-parse --git-path hooks/pre-commit)"
+test -x "$precommit" && exec "$precommit" ${1+"$@"}
+:
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/pre-commit.sample b/azure-3tier-reference/terraform/.git_backup/hooks/pre-commit.sample
new file mode 100644
index 0000000..e144712
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/pre-commit.sample
@@ -0,0 +1,49 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed.
+# Called by "git commit" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message if
+# it wants to stop the commit.
+#
+# To enable this hook, rename this file to "pre-commit".
+
+if git rev-parse --verify HEAD >/dev/null 2>&1
+then
+	against=HEAD
+else
+	# Initial commit: diff against an empty tree object
+	against=$(git hash-object -t tree /dev/null)
+fi
+
+# If you want to allow non-ASCII filenames set this variable to true.
+allownonascii=$(git config --type=bool hooks.allownonascii)
+
+# Redirect output to stderr.
+exec 1>&2
+
+# Cross platform projects tend to avoid non-ASCII filenames; prevent
+# them from being added to the repository. We exploit the fact that the
+# printable range starts at the space character and ends with tilde.
+if [ "$allownonascii" != "true" ] &&
+	# Note that the use of brackets around a tr range is ok here, (it's
+	# even required, for portability to Solaris 10's /usr/bin/tr), since
+	# the square bracket bytes happen to fall in the designated range.
+	test $(git diff --cached --name-only --diff-filter=A -z $against |
+	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
+then
+	cat <<\EOF
+Error: Attempt to add a non-ASCII file name.
+
+This can cause problems if you want to work with people on other platforms.
+
+To be portable it is advisable to rename the file.
+
+If you know what you are doing you can disable this check using:
+
+  git config hooks.allownonascii true
+EOF
+	exit 1
+fi
+
+# If there are whitespace errors, print the offending file names and fail.
+exec git diff-index --check --cached $against --
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/pre-merge-commit.sample b/azure-3tier-reference/terraform/.git_backup/hooks/pre-merge-commit.sample
new file mode 100644
index 0000000..399eab1
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/pre-merge-commit.sample
@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# An example hook script to verify what is about to be committed.
+# Called by "git merge" with no arguments.  The hook should
+# exit with non-zero status after issuing an appropriate message to
+# stderr if it wants to stop the merge commit.
+#
+# To enable this hook, rename this file to "pre-merge-commit".
+
+. git-sh-setup
+test -x "$GIT_DIR/hooks/pre-commit" &&
+        exec "$GIT_DIR/hooks/pre-commit"
+:
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/pre-push.sample b/azure-3tier-reference/terraform/.git_backup/hooks/pre-push.sample
new file mode 100644
index 0000000..4ce688d
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/pre-push.sample
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# An example hook script to verify what is about to be pushed.  Called by "git
+# push" after it has checked the remote status, but before anything has been
+# pushed.  If this script exits with a non-zero status nothing will be pushed.
+#
+# This hook is called with the following parameters:
+#
+# $1 -- Name of the remote to which the push is being done
+# $2 -- URL to which the push is being done
+#
+# If pushing without using a named remote those arguments will be equal.
+#
+# Information about the commits which are being pushed is supplied as lines to
+# the standard input in the form:
+#
+#   <local ref> <local oid> <remote ref> <remote oid>
+#
+# This sample shows how to prevent push of commits where the log message starts
+# with "WIP" (work in progress).
+
+remote="$1"
+url="$2"
+
+zero=$(git hash-object --stdin </dev/null | tr '[0-9a-f]' '0')
+
+while read local_ref local_oid remote_ref remote_oid
+do
+	if test "$local_oid" = "$zero"
+	then
+		# Handle delete
+		:
+	else
+		if test "$remote_oid" = "$zero"
+		then
+			# New branch, examine all commits
+			range="$local_oid"
+		else
+			# Update to existing branch, examine new commits
+			range="$remote_oid..$local_oid"
+		fi
+
+		# Check for WIP commit
+		commit=$(git rev-list -n 1 --grep '^WIP' "$range")
+		if test -n "$commit"
+		then
+			echo >&2 "Found WIP commit in $local_ref, not pushing"
+			exit 1
+		fi
+	fi
+done
+
+exit 0
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/pre-rebase.sample b/azure-3tier-reference/terraform/.git_backup/hooks/pre-rebase.sample
new file mode 100644
index 0000000..6cbef5c
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/pre-rebase.sample
@@ -0,0 +1,169 @@
+#!/bin/sh
+#
+# Copyright (c) 2006, 2008 Junio C Hamano
+#
+# The "pre-rebase" hook is run just before "git rebase" starts doing
+# its job, and can prevent the command from running by exiting with
+# non-zero status.
+#
+# The hook is called with the following parameters:
+#
+# $1 -- the upstream the series was forked from.
+# $2 -- the branch being rebased (or empty when rebasing the current branch).
+#
+# This sample shows how to prevent topic branches that are already
+# merged to 'next' branch from getting rebased, because allowing it
+# would result in rebasing already published history.
+
+publish=next
+basebranch="$1"
+if test "$#" = 2
+then
+	topic="refs/heads/$2"
+else
+	topic=`git symbolic-ref HEAD` ||
+	exit 0 ;# we do not interrupt rebasing detached HEAD
+fi
+
+case "$topic" in
+refs/heads/??/*)
+	;;
+*)
+	exit 0 ;# we do not interrupt others.
+	;;
+esac
+
+# Now we are dealing with a topic branch being rebased
+# on top of master.  Is it OK to rebase it?
+
+# Does the topic really exist?
+git show-ref -q "$topic" || {
+	echo >&2 "No such branch $topic"
+	exit 1
+}
+
+# Is topic fully merged to master?
+not_in_master=`git rev-list --pretty=oneline ^master "$topic"`
+if test -z "$not_in_master"
+then
+	echo >&2 "$topic is fully merged to master; better remove it."
+	exit 1 ;# we could allow it, but there is no point.
+fi
+
+# Is topic ever merged to next?  If so you should not be rebasing it.
+only_next_1=`git rev-list ^master "^$topic" ${publish} | sort`
+only_next_2=`git rev-list ^master           ${publish} | sort`
+if test "$only_next_1" = "$only_next_2"
+then
+	not_in_topic=`git rev-list "^$topic" master`
+	if test -z "$not_in_topic"
+	then
+		echo >&2 "$topic is already up to date with master"
+		exit 1 ;# we could allow it, but there is no point.
+	else
+		exit 0
+	fi
+else
+	not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"`
+	/usr/bin/perl -e '
+		my $topic = $ARGV[0];
+		my $msg = "* $topic has commits already merged to public branch:\n";
+		my (%not_in_next) = map {
+			/^([0-9a-f]+) /;
+			($1 => 1);
+		} split(/\n/, $ARGV[1]);
+		for my $elem (map {
+				/^([0-9a-f]+) (.*)$/;
+				[$1 => $2];
+			} split(/\n/, $ARGV[2])) {
+			if (!exists $not_in_next{$elem->[0]}) {
+				if ($msg) {
+					print STDERR $msg;
+					undef $msg;
+				}
+				print STDERR " $elem->[1]\n";
+			}
+		}
+	' "$topic" "$not_in_next" "$not_in_master"
+	exit 1
+fi
+
+<<\DOC_END
+
+This sample hook safeguards topic branches that have been
+published from being rewound.
+
+The workflow assumed here is:
+
+ * Once a topic branch forks from "master", "master" is never
+   merged into it again (either directly or indirectly).
+
+ * Once a topic branch is fully cooked and merged into "master",
+   it is deleted.  If you need to build on top of it to correct
+   earlier mistakes, a new topic branch is created by forking at
+   the tip of the "master".  This is not strictly necessary, but
+   it makes it easier to keep your history simple.
+
+ * Whenever you need to test or publish your changes to topic
+   branches, merge them into "next" branch.
+
+The script, being an example, hardcodes the publish branch name
+to be "next", but it is trivial to make it configurable via
+$GIT_DIR/config mechanism.
+
+With this workflow, you would want to know:
+
+(1) ... if a topic branch has ever been merged to "next".  Young
+    topic branches can have stupid mistakes you would rather
+    clean up before publishing, and things that have not been
+    merged into other branches can be easily rebased without
+    affecting other people.  But once it is published, you would
+    not want to rewind it.
+
+(2) ... if a topic branch has been fully merged to "master".
+    Then you can delete it.  More importantly, you should not
+    build on top of it -- other people may already want to
+    change things related to the topic as patches against your
+    "master", so if you need further changes, it is better to
+    fork the topic (perhaps with the same name) afresh from the
+    tip of "master".
+
+Let's look at this example:
+
+		   o---o---o---o---o---o---o---o---o---o "next"
+		  /       /           /           /
+		 /   a---a---b A     /           /
+		/   /               /           /
+	       /   /   c---c---c---c B         /
+	      /   /   /             \         /
+	     /   /   /   b---b C     \       /
+	    /   /   /   /             \     /
+    ---o---o---o---o---o---o---o---o---o---o---o "master"
+
+
+A, B and C are topic branches.
+
+ * A has one fix since it was merged up to "next".
+
+ * B has finished.  It has been fully merged up to "master" and "next",
+   and is ready to be deleted.
+
+ * C has not merged to "next" at all.
+
+We would want to allow C to be rebased, refuse A, and encourage
+B to be deleted.
+
+To compute (1):
+
+	git rev-list ^master ^topic next
+	git rev-list ^master        next
+
+	if these match, topic has not merged in next at all.
+
+To compute (2):
+
+	git rev-list master..topic
+
+	if this is empty, it is fully merged to "master".
+
+DOC_END
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/pre-receive.sample b/azure-3tier-reference/terraform/.git_backup/hooks/pre-receive.sample
new file mode 100644
index 0000000..a1fd29e
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/pre-receive.sample
@@ -0,0 +1,24 @@
+#!/bin/sh
+#
+# An example hook script to make use of push options.
+# The example simply echoes all push options that start with 'echoback='
+# and rejects all pushes when the "reject" push option is used.
+#
+# To enable this hook, rename this file to "pre-receive".
+
+if test -n "$GIT_PUSH_OPTION_COUNT"
+then
+	i=0
+	while test "$i" -lt "$GIT_PUSH_OPTION_COUNT"
+	do
+		eval "value=\$GIT_PUSH_OPTION_$i"
+		case "$value" in
+		echoback=*)
+			echo "echo from the pre-receive-hook: ${value#*=}" >&2
+			;;
+		reject)
+			exit 1
+		esac
+		i=$((i + 1))
+	done
+fi
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/prepare-commit-msg.sample b/azure-3tier-reference/terraform/.git_backup/hooks/prepare-commit-msg.sample
new file mode 100644
index 0000000..10fa14c
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/prepare-commit-msg.sample
@@ -0,0 +1,42 @@
+#!/bin/sh
+#
+# An example hook script to prepare the commit log message.
+# Called by "git commit" with the name of the file that has the
+# commit message, followed by the description of the commit
+# message's source.  The hook's purpose is to edit the commit
+# message file.  If the hook fails with a non-zero status,
+# the commit is aborted.
+#
+# To enable this hook, rename this file to "prepare-commit-msg".
+
+# This hook includes three examples. The first one removes the
+# "# Please enter the commit message..." help message.
+#
+# The second includes the output of "git diff --name-status -r"
+# into the message, just before the "git status" output.  It is
+# commented because it doesn't cope with --amend or with squashed
+# commits.
+#
+# The third example adds a Signed-off-by line to the message, that can
+# still be edited.  This is rarely a good idea.
+
+COMMIT_MSG_FILE=$1
+COMMIT_SOURCE=$2
+SHA1=$3
+
+/usr/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE"
+
+# case "$COMMIT_SOURCE,$SHA1" in
+#  ,|template,)
+#    /usr/bin/perl -i.bak -pe '
+#       print "\n" . `git diff --cached --name-status -r`
+# 	 if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;;
+#  *) ;;
+# esac
+
+# SOB=$(git var GIT_COMMITTER_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p')
+# git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE"
+# if test -z "$COMMIT_SOURCE"
+# then
+#   /usr/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE"
+# fi
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/push-to-checkout.sample b/azure-3tier-reference/terraform/.git_backup/hooks/push-to-checkout.sample
new file mode 100644
index 0000000..af5a0c0
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/push-to-checkout.sample
@@ -0,0 +1,78 @@
+#!/bin/sh
+
+# An example hook script to update a checked-out tree on a git push.
+#
+# This hook is invoked by git-receive-pack(1) when it reacts to git
+# push and updates reference(s) in its repository, and when the push
+# tries to update the branch that is currently checked out and the
+# receive.denyCurrentBranch configuration variable is set to
+# updateInstead.
+#
+# By default, such a push is refused if the working tree and the index
+# of the remote repository has any difference from the currently
+# checked out commit; when both the working tree and the index match
+# the current commit, they are updated to match the newly pushed tip
+# of the branch. This hook is to be used to override the default
+# behaviour; however the code below reimplements the default behaviour
+# as a starting point for convenient modification.
+#
+# The hook receives the commit with which the tip of the current
+# branch is going to be updated:
+commit=$1
+
+# It can exit with a non-zero status to refuse the push (when it does
+# so, it must not modify the index or the working tree).
+die () {
+	echo >&2 "$*"
+	exit 1
+}
+
+# Or it can make any necessary changes to the working tree and to the
+# index to bring them to the desired state when the tip of the current
+# branch is updated to the new commit, and exit with a zero status.
+#
+# For example, the hook can simply run git read-tree -u -m HEAD "$1"
+# in order to emulate git fetch that is run in the reverse direction
+# with git push, as the two-tree form of git read-tree -u -m is
+# essentially the same as git switch or git checkout that switches
+# branches while keeping the local changes in the working tree that do
+# not interfere with the difference between the branches.
+
+# The below is a more-or-less exact translation to shell of the C code
+# for the default behaviour for git's push-to-checkout hook defined in
+# the push_to_deploy() function in builtin/receive-pack.c.
+#
+# Note that the hook will be executed from the repository directory,
+# not from the working tree, so if you want to perform operations on
+# the working tree, you will have to adapt your code accordingly, e.g.
+# by adding "cd .." or using relative paths.
+
+if ! git update-index -q --ignore-submodules --refresh
+then
+	die "Up-to-date check failed"
+fi
+
+if ! git diff-files --quiet --ignore-submodules --
+then
+	die "Working directory has unstaged changes"
+fi
+
+# This is a rough translation of:
+#
+#   head_has_history() ? "HEAD" : EMPTY_TREE_SHA1_HEX
+if git cat-file -e HEAD 2>/dev/null
+then
+	head=HEAD
+else
+	head=$(git hash-object -t tree --stdin </dev/null)
+fi
+
+if ! git diff-index --quiet --cached --ignore-submodules $head --
+then
+	die "Working directory has staged changes"
+fi
+
+if ! git read-tree -u -m "$commit"
+then
+	die "Could not update working tree to new HEAD"
+fi
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/sendemail-validate.sample b/azure-3tier-reference/terraform/.git_backup/hooks/sendemail-validate.sample
new file mode 100644
index 0000000..640bcf8
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/sendemail-validate.sample
@@ -0,0 +1,77 @@
+#!/bin/sh
+
+# An example hook script to validate a patch (and/or patch series) before
+# sending it via email.
+#
+# The hook should exit with non-zero status after issuing an appropriate
+# message if it wants to prevent the email(s) from being sent.
+#
+# To enable this hook, rename this file to "sendemail-validate".
+#
+# By default, it will only check that the patch(es) can be applied on top of
+# the default upstream branch without conflicts in a secondary worktree. After
+# validation (successful or not) of the last patch of a series, the worktree
+# will be deleted.
+#
+# The following config variables can be set to change the default remote and
+# remote ref that are used to apply the patches against:
+#
+#   sendemail.validateRemote (default: origin)
+#   sendemail.validateRemoteRef (default: HEAD)
+#
+# Replace the TODO placeholders with appropriate checks according to your
+# needs.
+
+validate_cover_letter () {
+	file="$1"
+	# TODO: Replace with appropriate checks (e.g. spell checking).
+	true
+}
+
+validate_patch () {
+	file="$1"
+	# Ensure that the patch applies without conflicts.
+	git am -3 "$file" || return
+	# TODO: Replace with appropriate checks for this patch
+	# (e.g. checkpatch.pl).
+	true
+}
+
+validate_series () {
+	# TODO: Replace with appropriate checks for the whole series
+	# (e.g. quick build, coding style checks, etc.).
+	true
+}
+
+# main -------------------------------------------------------------------------
+
+if test "$GIT_SENDEMAIL_FILE_COUNTER" = 1
+then
+	remote=$(git config --default origin --get sendemail.validateRemote) &&
+	ref=$(git config --default HEAD --get sendemail.validateRemoteRef) &&
+	worktree=$(mktemp --tmpdir -d sendemail-validate.XXXXXXX) &&
+	git worktree add -fd --checkout "$worktree" "refs/remotes/$remote/$ref" &&
+	git config --replace-all sendemail.validateWorktree "$worktree"
+else
+	worktree=$(git config --get sendemail.validateWorktree)
+fi || {
+	echo "sendemail-validate: error: failed to prepare worktree" >&2
+	exit 1
+}
+
+unset GIT_DIR GIT_WORK_TREE
+cd "$worktree" &&
+
+if grep -q "^diff --git " "$1"
+then
+	validate_patch "$1"
+else
+	validate_cover_letter "$1"
+fi &&
+
+if test "$GIT_SENDEMAIL_FILE_COUNTER" = "$GIT_SENDEMAIL_FILE_TOTAL"
+then
+	git config --unset-all sendemail.validateWorktree &&
+	trap 'git worktree remove -ff "$worktree"' EXIT &&
+	validate_series
+fi
diff --git a/azure-3tier-reference/terraform/.git_backup/hooks/update.sample b/azure-3tier-reference/terraform/.git_backup/hooks/update.sample
new file mode 100644
index 0000000..c4d426b
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/hooks/update.sample
@@ -0,0 +1,128 @@
+#!/bin/sh
+#
+# An example hook script to block unannotated tags from entering.
+# Called by "git receive-pack" with arguments: refname sha1-old sha1-new
+#
+# To enable this hook, rename this file to "update".
+#
+# Config
+# ------
+# hooks.allowunannotated
+#   This boolean sets whether unannotated tags will be allowed into the
+#   repository.  By default they won't be.
+# hooks.allowdeletetag
+#   This boolean sets whether deleting tags will be allowed in the
+#   repository.  By default they won't be.
+# hooks.allowmodifytag
+#   This boolean sets whether a tag may be modified after creation. By default
+#   it won't be.
+# hooks.allowdeletebranch
+#   This boolean sets whether deleting branches will be allowed in the
+#   repository.  By default they won't be.
+# hooks.denycreatebranch
+#   This boolean sets whether remotely creating branches will be denied
+#   in the repository.  By default this is allowed.
+#
+
+# --- Command line
+refname="$1"
+oldrev="$2"
+newrev="$3"
+
+# --- Safety check
+if [ -z "$GIT_DIR" ]; then
+	echo "Don't run this script from the command line." >&2
+	echo " (if you want, you could supply GIT_DIR then run" >&2
+	echo "  $0 <ref> <oldrev> <newrev>)" >&2
+	exit 1
+fi
+
+if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then
+	echo "usage: $0 <ref> <oldrev> <newrev>" >&2
+	exit 1
+fi
+
+# --- Config
+allowunannotated=$(git config --type=bool hooks.allowunannotated)
+allowdeletebranch=$(git config --type=bool hooks.allowdeletebranch)
+denycreatebranch=$(git config --type=bool hooks.denycreatebranch)
+allowdeletetag=$(git config --type=bool hooks.allowdeletetag)
+allowmodifytag=$(git config --type=bool hooks.allowmodifytag)
+
+# check for no description
+projectdesc=$(sed -e '1q' "$GIT_DIR/description")
+case "$projectdesc" in
+"Unnamed repository"* | "")
+	echo "*** Project description file hasn't been set" >&2
+	exit 1
+	;;
+esac
+
+# --- Check types
+# if $newrev is 0000...0000, it's a commit to delete a ref.
+zero=$(git hash-object --stdin </dev/null | tr '[0-9a-f]' '0')
+if [ "$newrev" = "$zero" ]; then
+	newrev_type=delete
+else
+	newrev_type=$(git cat-file -t $newrev)
+fi
+
+case "$refname","$newrev_type" in
+	refs/tags/*,commit)
+		# un-annotated tag
+		short_refname=${refname##refs/tags/}
+		if [ "$allowunannotated" != "true" ]; then
+			echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2
+			echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2
+			exit 1
+		fi
+		;;
+	refs/tags/*,delete)
+		# delete tag
+		if [ "$allowdeletetag" != "true" ]; then
+			echo "*** Deleting a tag is not allowed in this repository" >&2
+			exit 1
+		fi
+		;;
+	refs/tags/*,tag)
+		# annotated tag
+		if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1
+		then
+			echo "*** Tag '$refname' already exists." >&2
+			echo "*** Modifying a tag is not allowed in this repository." >&2
+			exit 1
+		fi
+		;;
+	refs/heads/*,commit)
+		# branch
+		if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then
+			echo "*** Creating a branch is not allowed in this repository" >&2
+			exit 1
+		fi
+		;;
+	refs/heads/*,delete)
+		# delete branch
+		if [ "$allowdeletebranch" != "true" ]; then
+			echo "*** Deleting a branch is not allowed in this repository" >&2
+			exit 1
+		fi
+		;;
+	refs/remotes/*,commit)
+		# tracking branch
+		;;
+	refs/remotes/*,delete)
+		# delete tracking branch
+		if [ "$allowdeletebranch" != "true" ]; then
+			echo "*** Deleting a tracking branch is not allowed in this repository" >&2
+			exit 1
+		fi
+		;;
+	*)
+		# Anything else (is there anything else?)
+		echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2
+		exit 1
+		;;
+esac
+
+# --- Finished
+exit 0
diff --git a/azure-3tier-reference/terraform/.git_backup/info/exclude b/azure-3tier-reference/terraform/.git_backup/info/exclude
new file mode 100644
index 0000000..a5196d1
--- /dev/null
+++ b/azure-3tier-reference/terraform/.git_backup/info/exclude
@@ -0,0 +1,6 @@
+# git ls-files --others --exclude-from=.git/info/exclude
+# Lines that start with '#' are comments.
+# For a project mostly in C, the following would be a good set of
+# exclude patterns (uncomment them if you want to use them):
+# *.[oa]
+# *~
diff --git a/azure-3tier-reference/terraform/containers-secrets-patch.json b/azure-3tier-reference/terraform/containers-secrets-patch.json
new file mode 100644
index 0000000..9cd5997
--- /dev/null
+++ b/azure-3tier-reference/terraform/containers-secrets-patch.json
@@ -0,0 +1,3 @@
+[
+  {
+    
diff --git a/azure-3tier-reference/terraform/containers.json b/azure-3tier-reference/terraform/containers.json
new file mode 100644
index 0000000..cce18b6
--- /dev/null
+++ b/azure-3tier-reference/terraform/containers.json
@@ -0,0 +1,14 @@
+[
+  {
+    "name": "backend",
+    "image": "yousefaloufi6/backend-app:latest",
+    "env": [
+      { "name": "DB_HOST", "value": "3tier-sqlserver.database.windows.net" },
+      { "name": "DB_NAME", "value": "3tier-db" },
+      { "name": "DB_USER", "value": "yousefaloufi1" },
+      { "name": "DB_PASS", "value": "P@ssward1234!" }
+    ],
+    "probes": [],
+    "resources": { "cpu": 0.5, "ephemeralStorage": "2Gi", "memory": "1Gi" }
+  }
+]
diff --git a/azure-3tier-reference/terraform/main.tf b/azure-3tier-reference/terraform/main.tf
new file mode 100644
index 0000000..bdedc4d
--- /dev/null
+++ b/azure-3tier-reference/terraform/main.tf
@@ -0,0 +1,83 @@
+// Root module for Azure 3-tier reference
+terraform {
+  required_version = ">= 1.5.0"
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 3.50"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+}
+
+# Remote state is left for you to configure. Use backend "azurerm" with storage account.
+
+module "network" {
+  source              = "./modules/network"
+  prefix              = var.prefix
+  location            = var.location
+  resource_group_name = var.resource_group_name
+}
+
+module "monitoring" {
+  source              = "./modules/monitoring"
+  resource_group_name = module.network.resource_group_name
+  location            = var.location
+  prefix              = var.prefix
+}
+
+module "sql" {
+  source              = "./modules/sql"
+  resource_group_name = module.network.resource_group_name
+  location            = var.location
+  db_admin            = var.db_admin
+  db_password         = var.db_password
+  db_subnet_id        = module.network.db_pe_subnet_id
+  vnet_id             = module.network.vnet_id
+  prefix              = var.prefix
+}
+
+module "containerapps" {
+  source                = "./modules/containerapps"
+  resource_group_name   = module.network.resource_group_name
+  location              = var.location
+  prefix                = var.prefix
+  environment_subnet_id = module.network.aca_env_subnet_id
+  frontend_image        = var.frontend_image
+  backend_image         = var.backend_image
+  environment_id        = var.existing_environment_id
+  # User-specified DB settings
+  # Use the SQL server FQDN from the sql module (was a hard-coded placeholder 'aloufi')
+  db_host = module.sql.db_fqdn
+  # The database name comes from the sql module
+  db_name = module.sql.db_name
+  # Use the fully-qualified SQL login (user@servername)
+  db_user = "yousefaloufi1@3tier-sqlserver"
+  # Reuse the existing db_password variable instead of duplicating a literal here
+  db_pass = var.db_password
+}
+
+module "appgw" {
+  source              = "./modules/appgw"
+  resource_group_name = module.network.resource_group_name
+  location            = var.location
+  prefix              = var.prefix
+  frontend_fqdn       = module.containerapps.frontend_fqdn
+  backend_fqdn        = module.containerapps.backend_fqdn
+  appgw_subnet_id     = module.network.appgw_subnet_id
+}
+
+output "appgw_public_ip" {
+  value = module.appgw.appgw_public_ip
+}
+
+output "frontend_fqdn" {
+  value = module.containerapps.frontend_fqdn
+}
+
+output "backend_fqdn" {
+  value = module.containerapps.backend_fqdn
+}
diff --git a/azure-3tier-reference/terraform/modules/appgw/main.tf b/azure-3tier-reference/terraform/modules/appgw/main.tf
new file mode 100644
index 0000000..91abc08
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/appgw/main.tf
@@ -0,0 +1,119 @@
+resource "azurerm_public_ip" "pip" {
+  name                = "appgw-pip"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  allocation_method   = "Static"
+  sku                 = "Standard"
+}
+
+resource "azurerm_application_gateway" "appgw" {
+  name                = "appgw-${var.prefix}"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  sku {
+    name     = "WAF_v2"
+    tier     = "WAF_v2"
+    capacity = 2
+  }
+  gateway_ip_configuration {
+    name      = "appgw-ip"
+    subnet_id = var.appgw_subnet_id
+  }
+  frontend_ip_configuration {
+    name                 = "appgw-frontend-ip"
+    public_ip_address_id = azurerm_public_ip.pip.id
+  }
+  frontend_port {
+    name = "http"
+    port = 80
+  }
+
+  # HTTPS frontend port and listener intentionally omitted to avoid requiring an SSL certificate here.
+
+  backend_address_pool {
+    name  = "frontend-pool"
+    fqdns = [var.frontend_fqdn]
+  }
+
+  backend_address_pool {
+    name  = "backend-pool"
+    fqdns = [var.backend_fqdn]
+  }
+
+  backend_http_settings {
+    name                                = "http-settings"
+    port                                = 80
+    protocol                            = "Http"
+    cookie_based_affinity               = "Disabled"
+    # Ensure the Host header sent to backend matches the Container Apps FQDN
+    host_name = var.backend_fqdn
+  }
+
+  probe {
+    name                = "health-probe"
+    protocol            = "Http"
+    path                = "/actuator/health"
+    port                = 80
+    host                = var.backend_fqdn
+    interval            = 30
+    timeout             = 30
+    unhealthy_threshold = 3
+    match {
+      status_code = ["200-399"]
+    }
+  }
+
+  http_listener {
+    name                           = "listener-http"
+    frontend_ip_configuration_name = "appgw-frontend-ip"
+    frontend_port_name             = "http"
+    protocol                       = "Http"
+  }
+
+  # HTTPS listener intentionally omitted in this module to avoid SSL cert management in the module.
+  url_path_map {
+    name                               = "urlmap"
+    default_backend_address_pool_name  = "frontend-pool"
+    default_backend_http_settings_name = "http-settings"
+    path_rule {
+      name                       = "api-rule"
+      paths                      = ["/api/*"]
+      backend_address_pool_name  = "backend-pool"
+      backend_http_settings_name = "http-settings"
+    }
+  }
+  request_routing_rule {
+    name               = "rule"
+    rule_type          = "PathBasedRouting"
+    http_listener_name = "listener-http"
+    url_path_map_name  = "urlmap"
+    priority           = 100
+  }
+
+  waf_configuration {
+    enabled          = true
+    firewall_mode    = "Prevention"
+    rule_set_type    = "OWASP"
+    rule_set_version = "3.2"
+  }
+
+  # Use a predefined SSL policy to ensure TLS 1.2+ and avoid deprecated protocol versions
+  ssl_policy {
+    policy_type = "Predefined"
+    policy_name = "AppGwSslPolicy20170401S"
+  }
+  lifecycle {
+    # Workaround for provider returning computed backend_address_pool values that
+    # don't correlate with planned set elements during apply (inconsistent final plan).
+    # Ignoring changes to backend_address_pool lets terraform finish the apply.
+    # Follow-up: refactor backend pools into standalone resources or upgrade the
+    # azurerm provider to a version where this bug is fixed, then remove this.
+    ignore_changes = [backend_address_pool]
+  }
+
+  depends_on = []
+}
+
+output "appgw_public_ip" { value = azurerm_public_ip.pip.ip_address }
+
+output "appgw_id" { value = azurerm_application_gateway.appgw.id }
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/appgw/variables.tf b/azure-3tier-reference/terraform/modules/appgw/variables.tf
new file mode 100644
index 0000000..21b6fa8
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/appgw/variables.tf
@@ -0,0 +1,16 @@
+variable "resource_group_name" { type = string }
+variable "location" { type = string }
+variable "frontend_fqdn" { type = string }
+variable "backend_fqdn" { type = string }
+variable "appgw_subnet_id" { type = string }
+variable "prefix" {
+  type        = string
+  description = "Name prefix used when creating the Application Gateway"
+  default     = "app"
+}
+
+variable "ssl_certificate_name" {
+  type        = string
+  description = "Optional name of an existing SSL certificate resource to reference for HTTPS listeners"
+  default     = null
+}
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/containerapps/main.tf b/azure-3tier-reference/terraform/modules/containerapps/main.tf
new file mode 100644
index 0000000..a169c7c
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/containerapps/main.tf
@@ -0,0 +1,109 @@
+locals {
+  use_existing_env = length(trimspace(var.environment_id)) > 0
+
+  # Create a short deterministic, safe prefix from the md5 of the user-provided prefix.
+  # This guarantees: lower-case hex characters, starts with a letter ('a'), and stays short.
+  # Format: a + first 7 chars of md5(prefix) => total length 8
+  safe_hash   = substr(md5(var.prefix), 0, 7)
+  name_prefix = "a${local.safe_hash}"
+
+  # If an existing environment id is provided, use it. Otherwise, if we created an env, use its first instance id.
+  env_id = local.use_existing_env ? var.environment_id : (length(azurerm_container_app_environment.env) > 0 ? azurerm_container_app_environment.env[0].id : "")
+}
+
+resource "azurerm_container_app_environment" "env" {
+  count                          = local.use_existing_env ? 0 : 1
+  name                           = "aca-${local.name_prefix}-env"
+  location                       = var.location
+  resource_group_name            = var.resource_group_name
+  internal_load_balancer_enabled = true
+  infrastructure_subnet_id       = var.environment_subnet_id
+}
+
+resource "azurerm_container_app" "frontend" {
+  name                         = "${local.name_prefix}-frontend-app"
+  resource_group_name          = var.resource_group_name
+  container_app_environment_id = local.env_id
+  revision_mode                = "Single"
+  template {
+    container {
+      name   = "frontend"
+      image  = var.frontend_image
+      cpu    = 0.5
+      memory = "1Gi"
+    }
+  }
+  ingress {
+    external_enabled = false
+    target_port      = 80
+    transport        = "http"
+    traffic_weight {
+      latest_revision = true
+      percentage      = 100
+    }
+  }
+}
+
+resource "azurerm_container_app" "backend" {
+  name                         = "${local.name_prefix}-backend-app"
+  resource_group_name          = var.resource_group_name
+  container_app_environment_id = local.env_id
+  revision_mode                = "Single"
+  template {
+    container {
+      name   = "backend"
+      image  = var.backend_image
+      cpu    = 0.5
+      memory = "1Gi"
+      env {
+        name  = "DB_HOST"
+        value = var.db_host
+      }
+      env {
+        name  = "SPRING_DATASOURCE_URL"
+        value = "jdbc:sqlserver://${var.db_host}:1433;database=${var.db_name};encrypt=true;trustServerCertificate=false;loginTimeout=30;"
+      }
+      env {
+        name  = "SPRING_DATASOURCE_USERNAME"
+        value = var.db_user
+      }
+      env {
+        name  = "SPRING_DATASOURCE_PASSWORD"
+        value = var.db_pass
+      }
+      env {
+        name  = "DB_NAME"
+        value = var.db_name
+      }
+      env {
+        name  = "DB_USERNAME"
+        value = var.db_user
+      }
+      env {
+        name  = "DB_PASSWORD"
+        value = var.db_pass
+      }
+    }
+  }
+  ingress {
+    external_enabled = false
+    target_port      = 8080
+    transport        = "http"
+    traffic_weight {
+      latest_revision = true
+      percentage      = 100
+    }
+  }
+}
+
+output "frontend_fqdn" {
+  value = azurerm_container_app.frontend.ingress[0].fqdn
+}
+
+output "backend_fqdn" {
+  value = azurerm_container_app.backend.ingress[0].fqdn
+}
+
+output "environment_id" {
+  value = local.env_id
+}
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/containerapps/variables.tf b/azure-3tier-reference/terraform/modules/containerapps/variables.tf
new file mode 100644
index 0000000..0fcedfb
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/containerapps/variables.tf
@@ -0,0 +1,23 @@
+variable "resource_group_name" { type = string }
+variable "location" { type = string }
+variable "environment_subnet_id" { type = string }
+variable "frontend_image" { type = string }
+variable "backend_image" { type = string }
+variable "db_host" {
+  type    = string
+  default = "3tier-sqlserver.database.windows.net"
+}
+variable "db_name" { type = string }
+variable "db_user" { type = string }
+variable "db_pass" { type = string }
+variable "environment_id" {
+  description = "(Optional) Existing Container Apps Environment resource id. If provided, Terraform will not create a new environment."
+  type        = string
+  default     = ""
+}
+
+variable "prefix" {
+  type        = string
+  description = "Name prefix used for container apps and environment"
+  default     = "3tier"
+}
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/monitoring/main.tf b/azure-3tier-reference/terraform/modules/monitoring/main.tf
new file mode 100644
index 0000000..88629c3
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/monitoring/main.tf
@@ -0,0 +1,27 @@
+resource "azurerm_log_analytics_workspace" "law" {
+  name                = "${var.prefix}-law"
+  location            = var.location
+  resource_group_name = var.resource_group_name
+  sku                 = "PerGB2018"
+  retention_in_days   = 30
+}
+
+resource "azurerm_application_insights" "ai_frontend" {
+  name                = "${var.prefix}-ai-frontend"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  application_type    = "web"
+  workspace_id        = azurerm_log_analytics_workspace.law.id
+}
+
+resource "azurerm_application_insights" "ai_backend" {
+  name                = "${var.prefix}-ai-backend"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  application_type    = "web"
+  workspace_id        = azurerm_log_analytics_workspace.law.id
+}
+
+output "log_analytics_workspace_id" { value = azurerm_log_analytics_workspace.law.id }
+output "ai_frontend_instrumentation_key" { value = azurerm_application_insights.ai_frontend.instrumentation_key }
+output "ai_backend_instrumentation_key" { value = azurerm_application_insights.ai_backend.instrumentation_key }
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/monitoring/variables.tf b/azure-3tier-reference/terraform/modules/monitoring/variables.tf
new file mode 100644
index 0000000..af865a4
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/monitoring/variables.tf
@@ -0,0 +1,3 @@
+variable "resource_group_name" { type = string }
+variable "location" { type = string }
+variable "prefix" { type = string }
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/network/main.tf b/azure-3tier-reference/terraform/modules/network/main.tf
new file mode 100644
index 0000000..6e683c1
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/network/main.tf
@@ -0,0 +1,60 @@
+resource "azurerm_resource_group" "rg" {
+  name     = var.resource_group_name
+  location = var.location
+}
+
+resource "azurerm_virtual_network" "vnet" {
+  name                = "${var.prefix}-vnet"
+  resource_group_name = azurerm_resource_group.rg.name
+  location            = azurerm_resource_group.rg.location
+  address_space       = ["10.10.0.0/16"]
+}
+
+resource "azurerm_subnet" "appgw_subnet" {
+  name                 = "snet-appgw"
+  resource_group_name  = azurerm_resource_group.rg.name
+  virtual_network_name = azurerm_virtual_network.vnet.name
+  address_prefixes     = ["10.10.1.0/24"]
+}
+
+resource "azurerm_subnet" "aca_env_subnet" {
+  name                 = "snet-aca-env"
+  resource_group_name  = azurerm_resource_group.rg.name
+  virtual_network_name = azurerm_virtual_network.vnet.name
+  address_prefixes     = ["10.10.2.0/23"]
+}
+
+resource "azurerm_subnet" "db_pe_subnet" {
+  name                              = "snet-db-pe"
+  resource_group_name               = azurerm_resource_group.rg.name
+  virtual_network_name              = azurerm_virtual_network.vnet.name
+  address_prefixes                  = ["10.10.4.0/24"]
+  private_endpoint_network_policies = "Disabled"
+}
+
+resource "azurerm_subnet" "ops_subnet" {
+  name                 = "snet-ops"
+  resource_group_name  = azurerm_resource_group.rg.name
+  virtual_network_name = azurerm_virtual_network.vnet.name
+  address_prefixes     = ["10.10.5.0/24"]
+}
+
+output "vnet_id" {
+  value = azurerm_virtual_network.vnet.id
+}
+
+output "aca_env_subnet_id" {
+  value = azurerm_subnet.aca_env_subnet.id
+}
+
+output "db_pe_subnet_id" {
+  value = azurerm_subnet.db_pe_subnet.id
+}
+
+output "appgw_subnet_id" {
+  value = azurerm_subnet.appgw_subnet.id
+}
+
+output "resource_group_name" {
+  value = azurerm_resource_group.rg.name
+}
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/network/variables.tf b/azure-3tier-reference/terraform/modules/network/variables.tf
new file mode 100644
index 0000000..00227ea
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/network/variables.tf
@@ -0,0 +1,3 @@
+variable "prefix" { type = string }
+variable "location" { type = string }
+variable "resource_group_name" { type = string }
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/sql/main.tf b/azure-3tier-reference/terraform/modules/sql/main.tf
new file mode 100644
index 0000000..34ad743
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/sql/main.tf
@@ -0,0 +1,47 @@
+resource "azurerm_mssql_server" "sql" {
+  name                         = "${var.prefix}-sqlserver"
+  resource_group_name          = var.resource_group_name
+  location                     = var.location
+  version                      = "12.0"
+  administrator_login          = var.db_admin
+  administrator_login_password = var.db_password
+}
+
+resource "azurerm_mssql_database" "db" {
+  name      = "${var.prefix}-db"
+  server_id = azurerm_mssql_server.sql.id
+  sku_name  = "S0"
+}
+
+resource "azurerm_private_endpoint" "sql_pe" {
+  name                = "sql-pe"
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  subnet_id           = var.db_subnet_id
+  private_service_connection {
+    name                           = "sql-pe-conn"
+    private_connection_resource_id = azurerm_mssql_server.sql.id
+    subresource_names              = ["sqlServer"]
+    is_manual_connection           = false
+  }
+}
+
+resource "azurerm_private_dns_zone" "sql" {
+  name                = "privatelink.database.windows.net"
+  resource_group_name = var.resource_group_name
+}
+
+resource "azurerm_private_dns_zone_virtual_network_link" "link" {
+  name                  = "sql-link"
+  resource_group_name   = var.resource_group_name
+  private_dns_zone_name = azurerm_private_dns_zone.sql.name
+  virtual_network_id    = var.vnet_id
+}
+
+output "db_fqdn" {
+  value = azurerm_mssql_server.sql.fully_qualified_domain_name
+}
+
+output "db_name" {
+  value = azurerm_mssql_database.db.name
+}
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/modules/sql/variables.tf b/azure-3tier-reference/terraform/modules/sql/variables.tf
new file mode 100644
index 0000000..4a73f93
--- /dev/null
+++ b/azure-3tier-reference/terraform/modules/sql/variables.tf
@@ -0,0 +1,7 @@
+variable "resource_group_name" { type = string }
+variable "location" { type = string }
+variable "db_admin" { type = string }
+variable "db_password" { type = string }
+variable "db_subnet_id" { type = string }
+variable "vnet_id" { type = string }
+variable "prefix" { type = string }
\ No newline at end of file
diff --git a/azure-3tier-reference/terraform/plan.tfplan b/azure-3tier-reference/terraform/plan.tfplan
new file mode 100644
index 0000000..5c37ed6
Binary files /dev/null and b/azure-3tier-reference/terraform/plan.tfplan differ
diff --git a/azure-3tier-reference/terraform/terraform.tfstate.backup b/azure-3tier-reference/terraform/terraform.tfstate.backup
new file mode 100644
index 0000000..f4b509f
--- /dev/null
+++ b/azure-3tier-reference/terraform/terraform.tfstate.backup
@@ -0,0 +1,1266 @@
+{
+  "version": 4,
+  "terraform_version": "1.13.3",
+  "serial": 53,
+  "lineage": "052cb15c-2edf-19fe-c4e3-b2c8c3067826",
+  "outputs": {
+    "appgw_public_ip": {
+      "value": "68.218.101.131",
+      "type": "string"
+    },
+    "backend_fqdn": {
+      "value": "a40c7601-backend-app.internal.redbush-51cb9b9d.australiaeast.azurecontainerapps.io",
+      "type": "string"
+    },
+    "frontend_fqdn": {
+      "value": "a40c7601-frontend-app.internal.redbush-51cb9b9d.australiaeast.azurecontainerapps.io",
+      "type": "string"
+    }
+  },
+  "resources": [
+    {
+      "module": "module.appgw",
+      "mode": "managed",
+      "type": "azurerm_application_gateway",
+      "name": "appgw",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "authentication_certificate": [],
+            "autoscale_configuration": [],
+            "backend_address_pool": [
+              {
+                "fqdns": [
+                  "a40c7601-frontend-app.internal.redbush-51cb9b9d.australiaeast.azurecontainerapps.io"
+                ],
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/backendAddressPools/frontend-pool",
+                "ip_addresses": [],
+                "name": "frontend-pool"
+              },
+              {
+                "fqdns": [],
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/backendAddressPools/backend-pool",
+                "ip_addresses": [
+                  "10.10.2.94"
+                ],
+                "name": "backend-pool"
+              }
+            ],
+            "backend_http_settings": [
+              {
+                "affinity_cookie_name": "",
+                "authentication_certificate": [],
+                "connection_draining": [],
+                "cookie_based_affinity": "Disabled",
+                "host_name": "",
+                "id": "",
+                "name": "http-settings",
+                "path": "",
+                "pick_host_name_from_backend_address": true,
+                "port": 80,
+                "probe_id": "",
+                "probe_name": "",
+                "protocol": "Http",
+                "request_timeout": 30,
+                "trusted_root_certificate_names": []
+              }
+            ],
+            "custom_error_configuration": [],
+            "enable_http2": false,
+            "fips_enabled": false,
+            "firewall_policy_id": "",
+            "force_firewall_policy_association": false,
+            "frontend_ip_configuration": [
+              {
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/frontendIPConfigurations/appgw-frontend-ip",
+                "name": "appgw-frontend-ip",
+                "private_ip_address": "",
+                "private_ip_address_allocation": "Dynamic",
+                "private_link_configuration_id": "",
+                "private_link_configuration_name": "",
+                "public_ip_address_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/publicIPAddresses/appgw-pip",
+                "subnet_id": ""
+              }
+            ],
+            "frontend_port": [
+              {
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/frontendPorts/http",
+                "name": "http",
+                "port": 80
+              }
+            ],
+            "gateway_ip_configuration": [
+              {
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/gatewayIPConfigurations/appgw-ip",
+                "name": "appgw-ip",
+                "subnet_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-appgw"
+              }
+            ],
+            "global": [],
+            "http_listener": [
+              {
+                "custom_error_configuration": [],
+                "firewall_policy_id": "",
+                "frontend_ip_configuration_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/frontendIPConfigurations/appgw-frontend-ip",
+                "frontend_ip_configuration_name": "appgw-frontend-ip",
+                "frontend_port_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/frontendPorts/http",
+                "frontend_port_name": "http",
+                "host_name": "",
+                "host_names": [],
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/httpListeners/listener-http",
+                "name": "listener-http",
+                "protocol": "Http",
+                "require_sni": false,
+                "ssl_certificate_id": "",
+                "ssl_certificate_name": "",
+                "ssl_profile_id": "",
+                "ssl_profile_name": ""
+              }
+            ],
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier",
+            "identity": [],
+            "location": "australiaeast",
+            "name": "appgw-3tier",
+            "private_endpoint_connection": [],
+            "private_link_configuration": [],
+            "probe": [
+              {
+                "host": "",
+                "id": "",
+                "interval": 30,
+                "match": [
+                  {
+                    "body": "",
+                    "status_code": [
+                      "200-399"
+                    ]
+                  }
+                ],
+                "minimum_servers": 0,
+                "name": "health-probe",
+                "path": "/actuator/health",
+                "pick_host_name_from_backend_http_settings": false,
+                "port": 80,
+                "protocol": "Http",
+                "timeout": 30,
+                "unhealthy_threshold": 3
+              }
+            ],
+            "redirect_configuration": [],
+            "request_routing_rule": [
+              {
+                "backend_address_pool_id": "",
+                "backend_address_pool_name": "",
+                "backend_http_settings_id": "",
+                "backend_http_settings_name": "",
+                "http_listener_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/httpListeners/listener-http",
+                "http_listener_name": "listener-http",
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/requestRoutingRules/rule",
+                "name": "rule",
+                "priority": 100,
+                "redirect_configuration_id": "",
+                "redirect_configuration_name": "",
+                "rewrite_rule_set_id": "",
+                "rewrite_rule_set_name": "",
+                "rule_type": "PathBasedRouting",
+                "url_path_map_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/urlPathMaps/urlmap",
+                "url_path_map_name": "urlmap"
+              }
+            ],
+            "resource_group_name": "rg-3tier",
+            "rewrite_rule_set": [],
+            "sku": [
+              {
+                "capacity": 2,
+                "name": "WAF_v2",
+                "tier": "WAF_v2"
+              }
+            ],
+            "ssl_certificate": [],
+            "ssl_policy": [
+              {
+                "cipher_suites": [],
+                "disabled_protocols": [],
+                "min_protocol_version": "",
+                "policy_name": "AppGwSslPolicy20170401S",
+                "policy_type": "Predefined"
+              }
+            ],
+            "ssl_profile": [],
+            "tags": {},
+            "timeouts": null,
+            "trusted_client_certificate": [],
+            "trusted_root_certificate": [],
+            "url_path_map": [
+              {
+                "default_backend_address_pool_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/backendAddressPools/frontend-pool",
+                "default_backend_address_pool_name": "frontend-pool",
+                "default_backend_http_settings_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/backendHttpSettingsCollection/http-settings-frontend",
+                "default_backend_http_settings_name": "http-settings",
+                "default_redirect_configuration_id": "",
+                "default_redirect_configuration_name": "",
+                "default_rewrite_rule_set_id": "",
+                "default_rewrite_rule_set_name": "",
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/urlPathMaps/urlmap",
+                "name": "urlmap",
+                "path_rule": [
+                  {
+                    "backend_address_pool_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/backendAddressPools/backend-pool",
+                    "backend_address_pool_name": "backend-pool",
+                    "backend_http_settings_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/backendHttpSettingsCollection/http-settings",
+                    "backend_http_settings_name": "http-settings",
+                    "firewall_policy_id": "",
+                    "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/applicationGateways/appgw-3tier/urlPathMaps/urlmap/pathRules/api-rule",
+                    "name": "api-rule",
+                    "paths": [
+                      "/api/*"
+                    ],
+                    "redirect_configuration_id": "",
+                    "redirect_configuration_name": "",
+                    "rewrite_rule_set_id": "",
+                    "rewrite_rule_set_name": ""
+                  }
+                ]
+              }
+            ],
+            "waf_configuration": [
+              {
+                "disabled_rule_group": [],
+                "enabled": true,
+                "exclusion": [],
+                "file_upload_limit_mb": 100,
+                "firewall_mode": "Prevention",
+                "max_request_body_size_kb": 128,
+                "request_body_check": true,
+                "rule_set_type": "OWASP",
+                "rule_set_version": "3.2"
+              }
+            ],
+            "zones": []
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo1NDAwMDAwMDAwMDAwLCJkZWxldGUiOjU0MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjo1NDAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.appgw.azurerm_public_ip.pip",
+            "module.containerapps.azurerm_container_app.backend",
+            "module.containerapps.azurerm_container_app.frontend",
+            "module.containerapps.azurerm_container_app_environment.env",
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_subnet.aca_env_subnet",
+            "module.network.azurerm_subnet.appgw_subnet",
+            "module.network.azurerm_virtual_network.vnet",
+            "module.sql.azurerm_mssql_database.db",
+            "module.sql.azurerm_mssql_server.sql"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.appgw",
+      "mode": "managed",
+      "type": "azurerm_public_ip",
+      "name": "pip",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "allocation_method": "Static",
+            "ddos_protection_mode": "VirtualNetworkInherited",
+            "ddos_protection_plan_id": null,
+            "domain_name_label": null,
+            "edge_zone": "",
+            "fqdn": null,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/publicIPAddresses/appgw-pip",
+            "idle_timeout_in_minutes": 4,
+            "ip_address": "68.218.101.131",
+            "ip_tags": {},
+            "ip_version": "IPv4",
+            "location": "australiaeast",
+            "name": "appgw-pip",
+            "public_ip_prefix_id": null,
+            "resource_group_name": "rg-3tier",
+            "reverse_fqdn": null,
+            "sku": "Standard",
+            "sku_tier": "Regional",
+            "tags": {},
+            "timeouts": null,
+            "zones": []
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.containerapps",
+      "mode": "managed",
+      "type": "azurerm_container_app",
+      "name": "backend",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "container_app_environment_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.App/managedEnvironments/aca-a40c7601-env",
+            "custom_domain_verification_id": "C5629A918A3FA55FF147545881A75721689136F00C9C862C48493941404CBD3C",
+            "dapr": [],
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.App/containerApps/a40c7601-backend-app",
+            "identity": [],
+            "ingress": [
+              {
+                "allow_insecure_connections": false,
+                "custom_domain": [],
+                "exposed_port": 0,
+                "external_enabled": false,
+                "fqdn": "a40c7601-backend-app.internal.redbush-51cb9b9d.australiaeast.azurecontainerapps.io",
+                "ip_security_restriction": [],
+                "target_port": 8080,
+                "traffic_weight": [
+                  {
+                    "label": "",
+                    "latest_revision": true,
+                    "percentage": 100,
+                    "revision_suffix": ""
+                  }
+                ],
+                "transport": "http"
+              }
+            ],
+            "latest_revision_fqdn": "a40c7601-backend-app--0000059.internal.redbush-51cb9b9d.australiaeast.azurecontainerapps.io",
+            "latest_revision_name": "a40c7601-backend-app--0000059",
+            "location": "australiaeast",
+            "name": "a40c7601-backend-app",
+            "outbound_ip_addresses": [
+              "4.237.144.250"
+            ],
+            "registry": [],
+            "resource_group_name": "rg-3tier",
+            "revision_mode": "Single",
+            "secret": [],
+            "tags": {},
+            "template": [
+              {
+                "azure_queue_scale_rule": [],
+                "container": [
+                  {
+                    "args": [],
+                    "command": [],
+                    "cpu": 0.5,
+                    "env": [
+                      {
+                        "name": "DB_HOST",
+                        "secret_name": "",
+                        "value": "3tier-sqlserver.database.windows.net"
+                      },
+                      {
+                        "name": "SPRING_DATASOURCE_URL",
+                        "secret_name": "",
+                        "value": "jdbc:sqlserver://3tier-sqlserver.database.windows.net:1433;database=3tier-db;encrypt=true;trustServerCertificate=false;loginTimeout=30;"
+                      },
+                      {
+                        "name": "SPRING_DATASOURCE_USERNAME",
+                        "secret_name": "",
+                        "value": "yousefaloufi1@3tier-sqlserver"
+                      },
+                      {
+                        "name": "SPRING_DATASOURCE_PASSWORD",
+                        "secret_name": "",
+                        "value": "P@ssword1234!"
+                      },
+                      {
+                        "name": "DB_NAME",
+                        "secret_name": "",
+                        "value": "3tier-db"
+                      },
+                      {
+                        "name": "DB_USERNAME",
+                        "secret_name": "",
+                        "value": "yousefaloufi1@3tier-sqlserver"
+                      },
+                      {
+                        "name": "DB_PASSWORD",
+                        "secret_name": "",
+                        "value": "P@ssword1234!"
+                      }
+                    ],
+                    "ephemeral_storage": "2Gi",
+                    "image": "yousefaloufi6/backend-app:latest",
+                    "liveness_probe": [],
+                    "memory": "1Gi",
+                    "name": "backend",
+                    "readiness_probe": [],
+                    "startup_probe": [],
+                    "volume_mounts": []
+                  }
+                ],
+                "custom_scale_rule": [],
+                "http_scale_rule": [],
+                "init_container": [],
+                "max_replicas": 10,
+                "min_replicas": 0,
+                "revision_suffix": "",
+                "tcp_scale_rule": [],
+                "volume": []
+              }
+            ],
+            "timeouts": null,
+            "workload_profile_name": ""
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "custom_domain_verification_id"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.containerapps.azurerm_container_app_environment.env",
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_subnet.aca_env_subnet",
+            "module.network.azurerm_virtual_network.vnet",
+            "module.sql.azurerm_mssql_database.db",
+            "module.sql.azurerm_mssql_server.sql"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.containerapps",
+      "mode": "managed",
+      "type": "azurerm_container_app",
+      "name": "frontend",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "container_app_environment_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.App/managedEnvironments/aca-a40c7601-env",
+            "custom_domain_verification_id": "C5629A918A3FA55FF147545881A75721689136F00C9C862C48493941404CBD3C",
+            "dapr": [],
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.App/containerApps/a40c7601-frontend-app",
+            "identity": [],
+            "ingress": [
+              {
+                "allow_insecure_connections": false,
+                "custom_domain": [],
+                "exposed_port": 0,
+                "external_enabled": false,
+                "fqdn": "a40c7601-frontend-app.internal.redbush-51cb9b9d.australiaeast.azurecontainerapps.io",
+                "ip_security_restriction": [],
+                "target_port": 80,
+                "traffic_weight": [
+                  {
+                    "label": "",
+                    "latest_revision": true,
+                    "percentage": 100,
+                    "revision_suffix": ""
+                  }
+                ],
+                "transport": "http"
+              }
+            ],
+            "latest_revision_fqdn": "a40c7601-frontend-app--0000009.internal.redbush-51cb9b9d.australiaeast.azurecontainerapps.io",
+            "latest_revision_name": "a40c7601-frontend-app--0000009",
+            "location": "australiaeast",
+            "name": "a40c7601-frontend-app",
+            "outbound_ip_addresses": [
+              "4.237.144.250"
+            ],
+            "registry": [],
+            "resource_group_name": "rg-3tier",
+            "revision_mode": "Single",
+            "secret": [],
+            "tags": {},
+            "template": [
+              {
+                "azure_queue_scale_rule": [],
+                "container": [
+                  {
+                    "args": [],
+                    "command": [],
+                    "cpu": 0.5,
+                    "env": [],
+                    "ephemeral_storage": "2Gi",
+                    "image": "yousefaloufi6/frontend-app:latest",
+                    "liveness_probe": [],
+                    "memory": "1Gi",
+                    "name": "frontend",
+                    "readiness_probe": [],
+                    "startup_probe": [],
+                    "volume_mounts": []
+                  }
+                ],
+                "custom_scale_rule": [],
+                "http_scale_rule": [],
+                "init_container": [],
+                "max_replicas": 10,
+                "min_replicas": 0,
+                "revision_suffix": "",
+                "tcp_scale_rule": [],
+                "volume": []
+              }
+            ],
+            "timeouts": null,
+            "workload_profile_name": ""
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "custom_domain_verification_id"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.containerapps.azurerm_container_app_environment.env",
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_subnet.aca_env_subnet",
+            "module.network.azurerm_virtual_network.vnet"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.containerapps",
+      "mode": "managed",
+      "type": "azurerm_container_app_environment",
+      "name": "env",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "index_key": 0,
+          "schema_version": 0,
+          "attributes": {
+            "custom_domain_verification_id": "C5629A918A3FA55FF147545881A75721689136F00C9C862C48493941404CBD3C",
+            "dapr_application_insights_connection_string": "",
+            "default_domain": "redbush-51cb9b9d.australiaeast.azurecontainerapps.io",
+            "docker_bridge_cidr": "",
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.App/managedEnvironments/aca-a40c7601-env",
+            "infrastructure_resource_group_name": "",
+            "infrastructure_subnet_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-aca-env",
+            "internal_load_balancer_enabled": true,
+            "location": "australiaeast",
+            "log_analytics_workspace_id": "",
+            "mutual_tls_enabled": false,
+            "name": "aca-a40c7601-env",
+            "platform_reserved_cidr": "10.0.0.0/16",
+            "platform_reserved_dns_ip_address": "10.0.0.2",
+            "resource_group_name": "rg-3tier",
+            "static_ip_address": "10.10.2.62",
+            "tags": {},
+            "timeouts": null,
+            "workload_profile": [],
+            "zone_redundancy_enabled": false
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "dapr_application_insights_connection_string"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_subnet.aca_env_subnet",
+            "module.network.azurerm_virtual_network.vnet"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.monitoring",
+      "mode": "managed",
+      "type": "azurerm_application_insights",
+      "name": "ai_backend",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "app_id": "b348da4c-7037-4af9-8325-03d87a6ee089",
+            "application_type": "web",
+            "connection_string": "InstrumentationKey=435facd8-b245-470c-9e7d-124ecfb822ff;IngestionEndpoint=https://australiaeast-1.in.applicationinsights.azure.com/;LiveEndpoint=https://australiaeast.livediagnostics.monitor.azure.com/;ApplicationId=b348da4c-7037-4af9-8325-03d87a6ee089",
+            "daily_data_cap_in_gb": 100,
+            "daily_data_cap_notifications_disabled": false,
+            "disable_ip_masking": false,
+            "force_customer_storage_for_profiler": false,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Insights/components/3tier-ai-backend",
+            "instrumentation_key": "435facd8-b245-470c-9e7d-124ecfb822ff",
+            "internet_ingestion_enabled": true,
+            "internet_query_enabled": true,
+            "local_authentication_disabled": false,
+            "location": "australiaeast",
+            "name": "3tier-ai-backend",
+            "resource_group_name": "rg-3tier",
+            "retention_in_days": 90,
+            "sampling_percentage": 100,
+            "tags": {},
+            "timeouts": null,
+            "workspace_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.OperationalInsights/workspaces/3tier-law"
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "connection_string"
+              }
+            ],
+            [
+              {
+                "type": "get_attr",
+                "value": "instrumentation_key"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjozNjAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfSwic2NoZW1hX3ZlcnNpb24iOiIyIn0=",
+          "dependencies": [
+            "module.monitoring.azurerm_log_analytics_workspace.law",
+            "module.network.azurerm_resource_group.rg"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.monitoring",
+      "mode": "managed",
+      "type": "azurerm_application_insights",
+      "name": "ai_frontend",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 2,
+          "attributes": {
+            "app_id": "15e81722-d5da-4712-a707-b0fd348ebd46",
+            "application_type": "web",
+            "connection_string": "InstrumentationKey=c2545d78-c524-4f39-a19d-49910b419a91;IngestionEndpoint=https://australiaeast-1.in.applicationinsights.azure.com/;LiveEndpoint=https://australiaeast.livediagnostics.monitor.azure.com/;ApplicationId=15e81722-d5da-4712-a707-b0fd348ebd46",
+            "daily_data_cap_in_gb": 100,
+            "daily_data_cap_notifications_disabled": false,
+            "disable_ip_masking": false,
+            "force_customer_storage_for_profiler": false,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Insights/components/3tier-ai-frontend",
+            "instrumentation_key": "c2545d78-c524-4f39-a19d-49910b419a91",
+            "internet_ingestion_enabled": true,
+            "internet_query_enabled": true,
+            "local_authentication_disabled": false,
+            "location": "australiaeast",
+            "name": "3tier-ai-frontend",
+            "resource_group_name": "rg-3tier",
+            "retention_in_days": 90,
+            "sampling_percentage": 100,
+            "tags": {},
+            "timeouts": null,
+            "workspace_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.OperationalInsights/workspaces/3tier-law"
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "connection_string"
+              }
+            ],
+            [
+              {
+                "type": "get_attr",
+                "value": "instrumentation_key"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjozNjAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfSwic2NoZW1hX3ZlcnNpb24iOiIyIn0=",
+          "dependencies": [
+            "module.monitoring.azurerm_log_analytics_workspace.law",
+            "module.network.azurerm_resource_group.rg"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.monitoring",
+      "mode": "managed",
+      "type": "azurerm_log_analytics_workspace",
+      "name": "law",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 3,
+          "attributes": {
+            "allow_resource_only_permissions": true,
+            "cmk_for_query_forced": false,
+            "daily_quota_gb": -1,
+            "data_collection_rule_id": "",
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.OperationalInsights/workspaces/3tier-law",
+            "identity": [],
+            "immediate_data_purge_on_30_days_enabled": false,
+            "internet_ingestion_enabled": true,
+            "internet_query_enabled": true,
+            "local_authentication_disabled": false,
+            "location": "australiaeast",
+            "name": "3tier-law",
+            "primary_shared_key": "9RlFuCcouHRz/JAWox6DXkJxxpRET9uFGmEMA06o1MDcVBx1TsA8932UNYSFDWtWayT7mdzEk8I+tAu6V+O1QQ==",
+            "reservation_capacity_in_gb_per_day": null,
+            "resource_group_name": "rg-3tier",
+            "retention_in_days": 30,
+            "secondary_shared_key": "2tS3RJSsqu7DFzRczSRLlcjqhXzOfbDca/4FudqEjbgWK/nstvkcJH8Y45agkvkkj+nvev99MJt3/XvJ8H0oag==",
+            "sku": "PerGB2018",
+            "tags": {},
+            "timeouts": null,
+            "workspace_id": "706f8c86-e280-445f-b34c-f0b67a18e2f3"
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "primary_shared_key"
+              }
+            ],
+            [
+              {
+                "type": "get_attr",
+                "value": "secondary_shared_key"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfSwic2NoZW1hX3ZlcnNpb24iOiIzIn0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.network",
+      "mode": "managed",
+      "type": "azurerm_resource_group",
+      "name": "rg",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier",
+            "location": "australiaeast",
+            "managed_by": "",
+            "name": "rg-3tier",
+            "tags": {},
+            "timeouts": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo1NDAwMDAwMDAwMDAwLCJkZWxldGUiOjU0MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjo1NDAwMDAwMDAwMDAwfX0="
+        }
+      ]
+    },
+    {
+      "module": "module.network",
+      "mode": "managed",
+      "type": "azurerm_subnet",
+      "name": "aca_env_subnet",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "address_prefixes": [
+              "10.10.2.0/23"
+            ],
+            "default_outbound_access_enabled": true,
+            "delegation": [],
+            "enforce_private_link_endpoint_network_policies": false,
+            "enforce_private_link_service_network_policies": false,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-aca-env",
+            "name": "snet-aca-env",
+            "private_endpoint_network_policies": "Enabled",
+            "private_endpoint_network_policies_enabled": true,
+            "private_link_service_network_policies_enabled": true,
+            "resource_group_name": "rg-3tier",
+            "service_endpoint_policy_ids": [],
+            "service_endpoints": [],
+            "timeouts": null,
+            "virtual_network_name": "3tier-vnet"
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_virtual_network.vnet"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.network",
+      "mode": "managed",
+      "type": "azurerm_subnet",
+      "name": "appgw_subnet",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "address_prefixes": [
+              "10.10.1.0/24"
+            ],
+            "default_outbound_access_enabled": true,
+            "delegation": [],
+            "enforce_private_link_endpoint_network_policies": false,
+            "enforce_private_link_service_network_policies": false,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-appgw",
+            "name": "snet-appgw",
+            "private_endpoint_network_policies": "Enabled",
+            "private_endpoint_network_policies_enabled": true,
+            "private_link_service_network_policies_enabled": true,
+            "resource_group_name": "rg-3tier",
+            "service_endpoint_policy_ids": [],
+            "service_endpoints": [],
+            "timeouts": null,
+            "virtual_network_name": "3tier-vnet"
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_virtual_network.vnet"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.network",
+      "mode": "managed",
+      "type": "azurerm_subnet",
+      "name": "db_pe_subnet",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "address_prefixes": [
+              "10.10.4.0/24"
+            ],
+            "default_outbound_access_enabled": true,
+            "delegation": [],
+            "enforce_private_link_endpoint_network_policies": true,
+            "enforce_private_link_service_network_policies": false,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-db-pe",
+            "name": "snet-db-pe",
+            "private_endpoint_network_policies": "Disabled",
+            "private_endpoint_network_policies_enabled": false,
+            "private_link_service_network_policies_enabled": true,
+            "resource_group_name": "rg-3tier",
+            "service_endpoint_policy_ids": [],
+            "service_endpoints": [],
+            "timeouts": null,
+            "virtual_network_name": "3tier-vnet"
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_virtual_network.vnet"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.network",
+      "mode": "managed",
+      "type": "azurerm_subnet",
+      "name": "ops_subnet",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "address_prefixes": [
+              "10.10.5.0/24"
+            ],
+            "default_outbound_access_enabled": true,
+            "delegation": [],
+            "enforce_private_link_endpoint_network_policies": false,
+            "enforce_private_link_service_network_policies": false,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-ops",
+            "name": "snet-ops",
+            "private_endpoint_network_policies": "Enabled",
+            "private_endpoint_network_policies_enabled": true,
+            "private_link_service_network_policies_enabled": true,
+            "resource_group_name": "rg-3tier",
+            "service_endpoint_policy_ids": [],
+            "service_endpoints": [],
+            "timeouts": null,
+            "virtual_network_name": "3tier-vnet"
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_virtual_network.vnet"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.network",
+      "mode": "managed",
+      "type": "azurerm_virtual_network",
+      "name": "vnet",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "address_space": [
+              "10.10.0.0/16"
+            ],
+            "bgp_community": "",
+            "ddos_protection_plan": [],
+            "dns_servers": [],
+            "edge_zone": "",
+            "encryption": [],
+            "flow_timeout_in_minutes": 0,
+            "guid": "3d7c7dc7-ae88-46c0-a4e1-8c3f15acdd32",
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet",
+            "location": "australiaeast",
+            "name": "3tier-vnet",
+            "resource_group_name": "rg-3tier",
+            "subnet": [
+              {
+                "address_prefix": "10.10.1.0/24",
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-appgw",
+                "name": "snet-appgw",
+                "security_group": ""
+              },
+              {
+                "address_prefix": "10.10.2.0/23",
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-aca-env",
+                "name": "snet-aca-env",
+                "security_group": ""
+              },
+              {
+                "address_prefix": "10.10.4.0/24",
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-db-pe",
+                "name": "snet-db-pe",
+                "security_group": ""
+              },
+              {
+                "address_prefix": "10.10.5.0/24",
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-ops",
+                "name": "snet-ops",
+                "security_group": ""
+              }
+            ],
+            "tags": {},
+            "timeouts": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.sql",
+      "mode": "managed",
+      "type": "azurerm_mssql_database",
+      "name": "db",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "auto_pause_delay_in_minutes": 0,
+            "collation": "SQL_Latin1_General_CP1_CI_AS",
+            "create_mode": "Default",
+            "creation_source_database_id": null,
+            "elastic_pool_id": "",
+            "enclave_type": "",
+            "geo_backup_enabled": true,
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Sql/servers/3tier-sqlserver/databases/3tier-db",
+            "identity": [],
+            "import": [],
+            "ledger_enabled": false,
+            "license_type": "",
+            "long_term_retention_policy": [
+              {
+                "immutable_backups_enabled": false,
+                "monthly_retention": "PT0S",
+                "week_of_year": 1,
+                "weekly_retention": "PT0S",
+                "yearly_retention": "PT0S"
+              }
+            ],
+            "maintenance_configuration_name": "SQL_Default",
+            "max_size_gb": 250,
+            "min_capacity": 0,
+            "name": "3tier-db",
+            "read_replica_count": 0,
+            "read_scale": false,
+            "recover_database_id": null,
+            "recovery_point_id": null,
+            "restore_dropped_database_id": null,
+            "restore_long_term_retention_backup_id": null,
+            "restore_point_in_time": null,
+            "sample_name": null,
+            "secondary_type": "",
+            "server_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Sql/servers/3tier-sqlserver",
+            "short_term_retention_policy": [
+              {
+                "backup_interval_in_hours": 24,
+                "retention_days": 7
+              }
+            ],
+            "sku_name": "S0",
+            "storage_account_type": "Geo",
+            "tags": {},
+            "threat_detection_policy": [
+              {
+                "disabled_alerts": [],
+                "email_account_admins": "Disabled",
+                "email_addresses": [],
+                "retention_days": 0,
+                "state": "Disabled",
+                "storage_account_access_key": "",
+                "storage_endpoint": ""
+              }
+            ],
+            "timeouts": null,
+            "transparent_data_encryption_enabled": true,
+            "transparent_data_encryption_key_automatic_rotation_enabled": false,
+            "transparent_data_encryption_key_vault_key_id": "",
+            "zone_redundant": false
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "threat_detection_policy"
+              },
+              {
+                "type": "index",
+                "value": {
+                  "value": 0,
+                  "type": "number"
+                }
+              },
+              {
+                "type": "get_attr",
+                "value": "storage_account_access_key"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjozNjAwMDAwMDAwMDAwLCJkZWxldGUiOjM2MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjozNjAwMDAwMDAwMDAwfSwic2NoZW1hX3ZlcnNpb24iOiIxIn0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.sql.azurerm_mssql_server.sql"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.sql",
+      "mode": "managed",
+      "type": "azurerm_mssql_server",
+      "name": "sql",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "administrator_login": "sqladmin",
+            "administrator_login_password": "P@ssword1234!",
+            "azuread_administrator": [],
+            "connection_policy": "Default",
+            "fully_qualified_domain_name": "3tier-sqlserver.database.windows.net",
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Sql/servers/3tier-sqlserver",
+            "identity": [],
+            "location": "australiaeast",
+            "minimum_tls_version": "1.2",
+            "name": "3tier-sqlserver",
+            "outbound_network_restriction_enabled": false,
+            "primary_user_assigned_identity_id": "",
+            "public_network_access_enabled": true,
+            "resource_group_name": "rg-3tier",
+            "restorable_dropped_database_ids": [],
+            "tags": {},
+            "timeouts": null,
+            "transparent_data_encryption_key_vault_key_id": "",
+            "version": "12.0"
+          },
+          "sensitive_attributes": [
+            [
+              {
+                "type": "get_attr",
+                "value": "administrator_login_password"
+              }
+            ]
+          ],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjozNjAwMDAwMDAwMDAwLCJkZWxldGUiOjM2MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjozNjAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.sql",
+      "mode": "managed",
+      "type": "azurerm_private_dns_zone",
+      "name": "sql",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/privateDnsZones/privatelink.database.windows.net",
+            "max_number_of_record_sets": 25000,
+            "max_number_of_virtual_network_links": 1000,
+            "max_number_of_virtual_network_links_with_registration": 100,
+            "name": "privatelink.database.windows.net",
+            "number_of_record_sets": 3,
+            "resource_group_name": "rg-3tier",
+            "soa_record": [
+              {
+                "email": "azureprivatedns-host.microsoft.com",
+                "expire_time": 2419200,
+                "fqdn": "privatelink.database.windows.net.",
+                "host_name": "azureprivatedns.net",
+                "minimum_ttl": 10,
+                "refresh_time": 3600,
+                "retry_time": 300,
+                "serial_number": 1,
+                "tags": {},
+                "ttl": 3600
+              }
+            ],
+            "tags": {},
+            "timeouts": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.sql",
+      "mode": "managed",
+      "type": "azurerm_private_dns_zone_virtual_network_link",
+      "name": "link",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/privateDnsZones/privatelink.database.windows.net/virtualNetworkLinks/sql-link",
+            "name": "sql-link",
+            "private_dns_zone_name": "privatelink.database.windows.net",
+            "registration_enabled": false,
+            "resource_group_name": "rg-3tier",
+            "tags": {},
+            "timeouts": null,
+            "virtual_network_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet"
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjoxODAwMDAwMDAwMDAwLCJkZWxldGUiOjE4MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjoxODAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_virtual_network.vnet",
+            "module.sql.azurerm_private_dns_zone.sql"
+          ]
+        }
+      ]
+    },
+    {
+      "module": "module.sql",
+      "mode": "managed",
+      "type": "azurerm_private_endpoint",
+      "name": "sql_pe",
+      "provider": "provider[\"registry.terraform.io/hashicorp/azurerm\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "custom_dns_configs": [
+              {
+                "fqdn": "3tier-sqlserver.database.windows.net",
+                "ip_addresses": [
+                  "10.10.4.4"
+                ]
+              }
+            ],
+            "custom_network_interface_name": "",
+            "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/privateEndpoints/sql-pe",
+            "ip_configuration": [],
+            "location": "australiaeast",
+            "name": "sql-pe",
+            "network_interface": [
+              {
+                "id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/networkInterfaces/sql-pe.nic.8c18da78-1f1f-4cd6-b2eb-a33af09cd2ca",
+                "name": "sql-pe.nic.8c18da78-1f1f-4cd6-b2eb-a33af09cd2ca"
+              }
+            ],
+            "private_dns_zone_configs": [],
+            "private_dns_zone_group": [],
+            "private_service_connection": [
+              {
+                "is_manual_connection": false,
+                "name": "sql-pe-conn",
+                "private_connection_resource_alias": "",
+                "private_connection_resource_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Sql/servers/3tier-sqlserver",
+                "private_ip_address": "10.10.4.4",
+                "request_message": "",
+                "subresource_names": [
+                  "sqlServer"
+                ]
+              }
+            ],
+            "resource_group_name": "rg-3tier",
+            "subnet_id": "/subscriptions/4421688c-0a8d-4588-8dd0-338c5271d0af/resourceGroups/rg-3tier/providers/Microsoft.Network/virtualNetworks/3tier-vnet/subnets/snet-db-pe",
+            "tags": {},
+            "timeouts": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0,
+          "private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjozNjAwMDAwMDAwMDAwLCJkZWxldGUiOjM2MDAwMDAwMDAwMDAsInJlYWQiOjMwMDAwMDAwMDAwMCwidXBkYXRlIjozNjAwMDAwMDAwMDAwfX0=",
+          "dependencies": [
+            "module.network.azurerm_resource_group.rg",
+            "module.network.azurerm_subnet.db_pe_subnet",
+            "module.network.azurerm_virtual_network.vnet",
+            "module.sql.azurerm_mssql_server.sql"
+          ]
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}
diff --git a/azure-3tier-reference/terraform/tfplan b/azure-3tier-reference/terraform/tfplan
new file mode 100644
index 0000000..00aef2d
Binary files /dev/null and b/azure-3tier-reference/terraform/tfplan differ
diff --git a/azure-3tier-reference/terraform/variables.tf b/azure-3tier-reference/terraform/variables.tf
new file mode 100644
index 0000000..7b6cdf9
--- /dev/null
+++ b/azure-3tier-reference/terraform/variables.tf
@@ -0,0 +1,50 @@
+variable "subscription_id" {
+  description = "Azure subscription id"
+  type        = string
+  default     = "4421688c-0a8d-4588-8dd0-338c5271d0af"
+}
+
+variable "prefix" {
+  description = "Resource name prefix"
+  type        = string
+  default     = "3tier"
+}
+
+variable "location" {
+  description = "Azure region"
+  type        = string
+  default     = "australiaeast"
+}
+
+variable "resource_group_name" {
+  description = "Resource group name"
+  type        = string
+  default     = "rg-3tier"
+}
+
+variable "frontend_image" {
+  description = "Frontend container image"
+  type        = string
+  default     = "yousefaloufi6/frontend-app:latest"
+}
+
+variable "backend_image" {
+  description = "Backend container image"
+  type        = string
+  default     = "yousefaloufi6/backend-app:latest"
+}
+
+variable "db_admin" {
+  type    = string
+  default = "sqladmin"
+}
+
+variable "db_password" {
+  type    = string
+  default = "P@ssword1234!"
+}
+variable "existing_environment_id" {
+  description = "Optional existing Container Apps environment resource id to reuse instead of creating a new one"
+  type        = string
+  default     = ""
+}
\ No newline at end of file