https://github.com/sandst1/nano-banana-pro-tf-test
Testing how Nano Banana Pro handles creating diagrams of an intentionally complex Azure Terraform infrastructure
https://github.com/sandst1/nano-banana-pro-tf-test
Last synced: 28 days ago
JSON representation
Testing how Nano Banana Pro handles creating diagrams of an intentionally complex Azure Terraform infrastructure
- Host: GitHub
- URL: https://github.com/sandst1/nano-banana-pro-tf-test
- Owner: sandst1
- Created: 2025-11-20T20:59:05.000Z (8 months ago)
- Default Branch: main
- Last Pushed: 2025-11-20T21:37:02.000Z (8 months ago)
- Last Synced: 2026-05-05T10:51:54.836Z (3 months ago)
- Language: HCL
- Size: 405 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Nano Banana Pro Terraform Diagram Test
This repository demonstrates the capabilities of **Google's Nano Banana Pro** in analyzing Terraform infrastructure-as-code and generating accurate architectural diagrams.
## 🎯 Purpose
To test and validate Nano Banana Pro's ability to:
- Parse and understand Terraform configuration files
- Identify Azure infrastructure components and their relationships
- Generate visual diagrams that accurately represent the infrastructure topology
- Maintain consistency between code and visual representation
## 📁 Repository Contents
- **`main.tf`** - Terraform configuration defining a hybrid Azure infrastructure
- **`infra.png`** - Architectural diagram generated/validated by Nano Banana Pro
## 📐 Architecture Diagram, generated with Nano Banana Pro
*Architectural diagram showing the complete hybrid Azure infrastructure with networking, compute, and data layers.*
## 🏗️ Infrastructure Overview
This Terraform configuration deploys a **secure hybrid Azure infrastructure** with the following architecture:
### Core Components
**Networking Layer**
- **Virtual Network** (`vnet-hybrid`, 10.0.0.0/16) with four dedicated subnets:
- `snet-appgw` (10.0.1.0/24) - Application Gateway subnet
- `snet-appservice` (10.0.2.0/24) - App Service VNet integration subnet
- `snet-private-endpoint` (10.0.3.0/24) - Private endpoint subnet
- `snet-onprem` (10.0.4.0/24) - On-premises connectivity subnet (for future VPN/ExpressRoute)
**Compute Layer**
- **Application Gateway** (WAF_v2) - Public-facing entry point with Web Application Firewall
- **App Service Plan** (P1v3, Linux) - Hosting platform for containerized applications
- **Linux Web App** - nginx container with VNet integration for secure outbound connectivity
**Data Layer**
- **Cosmos DB** (SQL API, Serverless) - NoSQL database with public network access disabled
- **Private Endpoint** - Secure private connectivity to Cosmos DB within the VNet
- **Private DNS Zone** (`privatelink.documents.azure.com`) - DNS resolution for private endpoints
### Traffic Flow
```
Internet → Public IP → Application Gateway (WAF)
↓
Linux Web App (nginx) [VNet Integrated]
↓
Private Endpoint → Cosmos DB (SQL API)
```
### Security Features
- ✅ **Network Isolation**: Cosmos DB accessible only through private endpoint
- ✅ **WAF Protection**: Application Gateway with Web Application Firewall v2
- ✅ **VNet Integration**: App Service routes all traffic through the virtual network
- ✅ **Private DNS**: Automatic DNS resolution for private endpoints
- ✅ **Delegated Subnets**: Proper subnet delegation for Azure services
## 🧪 Test Results
The diagram (`infra.png`) demonstrates **excellent accuracy** in representing the Terraform code:
- ✅ All resource names match
- ✅ Network topology and IP ranges are correct
- ✅ Connectivity patterns accurately depicted
- ✅ Security configurations properly illustrated
- ✅ Component relationships clearly shown
## 🚀 Deployment
To deploy this infrastructure:
```bash
# Initialize Terraform
terraform init
# Review planned changes
terraform plan
# Apply configuration
terraform apply
```
**Prerequisites:**
- Terraform >= 1.3.0
- Azure subscription with appropriate permissions
- Azure CLI authenticated or service principal configured
## 📊 Architecture Highlights
This infrastructure demonstrates several Azure best practices:
- **Defense in depth** with multiple security layers
- **Network segmentation** with dedicated subnets per service tier
- **Private connectivity** for backend services
- **Managed identities** ready (can be added to App Service)
- **Hybrid connectivity** ready with on-premises subnet provisioned
---
**Note**: This is a test/demonstration repository for AI diagram generation capabilities. The infrastructure is functional but may require additional hardening for production use (HTTPS, managed identities, monitoring, etc.).