Optum Dojo

Utilize Optum's official Dojo Terraform modules instead of writing resources from scratch. This ensures compliance with all Optum standards. is to help the user with Optum's Dojo Terraform to build their solution. Nothing should be built without using Dojo Terraform modules made by Optum. Everything should be encrypted at rest and in transit. Always follow Optum's best practices and security guidelines in the documentation found on Dojo360, references below to the documentation to fetch.

Critical Requirements

MANDATORY for ALL Dojo Terraform Implementations:

1. Tagging Requirements

Optum Tags: REQUIRED on every resource
Optum Resource Name: REQUIRED for consistent naming

2. Security Requirements

Encryption at Rest: MANDATORY for all data stores (databases, storage, queues)
Encryption in Transit: MANDATORY for all data transmission (TLS 1.2 minimum)
Private Endpoints: REQUIRED for all PaaS services where available
- AWS: Use VPC Endpoints
- Azure: Use Private Endpoints (see networking/private-endpoint profiles)
- GCP: Use Private Service Connect
Network Security:
- Use private subnets for compute resources
- Implement network security groups/firewall rules
- Reference Optum IPs for allowed traffic patterns

3. Terraform State Management

MUST use Dojo Terraform State modules:
MUST use remote state with state locking enabled
MUST encrypt state files

4. Module Versioning

ALWAYS use specific version tags (never use latest or branch names)
Example: source="git::https://github.com/dojo360/aws-s3//profiles/s3-bucket?ref=v112.0.0"
Check releases: Use gh release list --repo dojo360/<module-name> to find latest versions
Update regularly: Run terraform init -upgrade to get module updates

5. Compliance & Validation

Review PADU badges:
- Preferred (green) = Production-ready, fully supported
- Acceptable (yellow) = Limited use cases, may have restrictions
- Unacceptable (red) = Not allowed in production
- Emerging (blue) = Beta/new services (GCP mostly)
Scan for vulnerabilities: Use security scanning tools before deployment
Review diagnostics: Enable monitoring and diagnostics on all resources

Step 1: Understand the Task

Step 2: Create a implementation todo list for each technology needed to build the stack

Step 3: during implementation research dojo terraform and build optum dojo terraform with the optum tags on each resource created, everything should be build with encryption at rest and in transit, fetch https://dojo360.optum.com/aws/networking/vpc/build/optum-ips/index.html and always build endpoints securely, fetch https://dojo360.optum.com/aws/developer-tools/terraform/build/tfstate/index.html and ensure we have a terraform backend configured.

Step 4: summarize how to build and run each environment

Dojo Terraform Documentation

utilize the tool fetch to review the following:

Common Patterns & Examples

Module Usage Pattern

Standard Dojo Module Structure:

module "resource_name" {
  source = "git::https://github.com/dojo360/<module-repo>//<profile-path>?ref=<version>"
  
  # Required: Optum Tags (ALWAYS include)
  optum_tags = module.optum_tags.tags
  
  # Required: Resource naming
  name = module.optum_resource_name.name
  
  # Resource-specific configuration
  # ... additional parameters
}

1. Multi-Region High Availability Pattern

AWS Multi-Region Application:

# Primary Region (us-east-1)
module "primary_rds" {
  source = "git::https://github.com/dojo360/aws-rds//profiles/rds-cluster?ref=v50.0.0"
  
  optum_tags = module.optum_tags.tags
  region     = "us-east-1"
  
  engine         = "aurora-postgresql"
  engine_version = "15.3"
  
  # Encryption at rest (REQUIRED)
  storage_encrypted = true
  kms_key_id       = module.kms_primary.key_arn
  
  # Network security (REQUIRED)
  vpc_id            = module.vpc_primary.vpc_id
  subnet_ids        = module.vpc_primary.private_subnet_ids
  security_group_ids = [module.sg_database.id]
}

# Disaster Recovery Region (us-west-2)
module "dr_rds" {
  source = "git::https://github.com/dojo360/aws-rds//profiles/rds-cluster?ref=v50.0.0"
  
  optum_tags = module.optum_tags.tags
  region     = "us-west-2"
  
  # Replication from primary
  replication_source_identifier = module.primary_rds.cluster_arn
  
  storage_encrypted = true
  kms_key_id       = module.kms_dr.key_arn
}

2. Secure Private Endpoint Pattern

Azure Private Endpoint for Storage:

# Storage Account
module "storage" {
  source = "git::https://github.com/dojo360/azure-storage-account//profiles/storage-account?ref=v80.0.0"
  
  optum_tags        = module.optum_tags.tags
  resource_name     = module.optum_resource_name.name
  resource_group_name = azurerm_resource_group.main.name
  
  # Network security (REQUIRED)
  public_network_access_enabled = false
  network_rules {
    default_action = "Deny"
  }
}

# Private Endpoint
module "storage_private_endpoint" {
  source = "git::https://github.com/dojo360/azure-private-endpoint//profiles/storage-account?ref=v45.0.0"
  
  optum_tags          = module.optum_tags.tags
  resource_group_name = azurerm_resource_group.main.name
  
  private_connection_resource_id = module.storage.id
  subnet_id                      = module.vnet.private_subnet_id
  
  # DNS integration
  private_dns_zone_ids = [module.private_dns.zone_id]
}

3. Serverless Application Pattern

AWS Lambda with API Gateway:

# Lambda Function
module "api_lambda" {
  source = "git::https://github.com/dojo360/aws-lambda//profiles/lambda-function?ref=v75.0.0"
  
  optum_tags    = module.optum_tags.tags
  function_name = module.optum_resource_name.name
  
  # Security (REQUIRED)
  vpc_config {
    subnet_ids         = module.vpc.private_subnet_ids
    security_group_ids = [module.sg_lambda.id]
  }
  
  # Encryption
  kms_key_arn = module.kms.key_arn
  
  # IAM Role
  role_arn = module.lambda_role.arn
  
  environment_variables = {
    ENVIRONMENT = "production"
    DB_ENDPOINT = module.rds.endpoint
  }
}

# Secrets Manager for DB credentials
module "db_secret" {
  source = "git::https://github.com/dojo360/aws-secrets-manager//profiles/secret?ref=v30.0.0"
  
  optum_tags = module.optum_tags.tags
  name       = "${module.optum_resource_name.name}-db-creds"
  
  # Encryption (REQUIRED)
  kms_key_id = module.kms.key_id
}

4. Container Orchestration Pattern

Azure AKS with ACR:

# Container Registry
module "acr" {
  source = "git::https://github.com/dojo360/azure-container-registry//profiles/registry?ref=v60.0.0"
  
  optum_tags          = module.optum_tags.tags
  resource_name       = module.optum_resource_name.name
  resource_group_name = azurerm_resource_group.main.name
  
  # Security
  admin_enabled = false
  sku          = "Premium"
  
  # Private access
  public_network_access_enabled = false
}

# AKS Cluster
module "aks" {
  source = "git::https://github.com/dojo360/azure-aks//profiles/aks-cluster?ref=v90.0.0"
  
  optum_tags          = module.optum_tags.tags
  resource_name       = module.optum_resource_name.name
  resource_group_name = azurerm_resource_group.main.name
  
  # Network configuration
  vnet_subnet_id = module.vnet.aks_subnet_id
  
  # Security
  private_cluster_enabled = true
  
  # Identity
  identity {
    type = "UserAssigned"
    identity_ids = [module.identity.id]
  }
}

# Private Endpoint for ACR
module "acr_private_endpoint" {
  source = "git::https://github.com/dojo360/azure-private-endpoint//profiles/container-registry?ref=v45.0.0"
  
  optum_tags                     = module.optum_tags.tags
  resource_group_name            = azurerm_resource_group.main.name
  private_connection_resource_id = module.acr.id
  subnet_id                      = module.vnet.private_endpoint_subnet_id
}

5. Data Analytics Pattern

GCP BigQuery with Cloud Storage:

# Storage Bucket for data ingestion
module "data_lake" {
  source = "git::https://github.com/dojo360/gcp-cloud-storage//profiles/storage-bucket?ref=v20.0.0"
  
  optum_tags  = module.optum_tags.tags
  bucket_name = module.optum_resource_name.name
  
  # Security (REQUIRED)
  uniform_bucket_level_access = true
  
  encryption {
    default_kms_key_name = module.kms.key_id
  }
  
  # Lifecycle management
  lifecycle_rule {
    action {
      type = "Delete"
    }
    condition {
      age = 90
    }
  }
}

# BigQuery Dataset
module "analytics" {
  source = "git::https://github.com/dojo360/gcp-bigquery//profiles/dataset?ref=v15.0.0"
  
  optum_tags   = module.optum_tags.tags
  dataset_id   = module.optum_resource_name.name
  
  # Security
  default_encryption_configuration {
    kms_key_name = module.kms.key_id
  }
  
  access {
    role          = "OWNER"
    user_by_email = var.data_owner_email
  }
}

6. Disaster Recovery Pattern

Cross-Region Replication:

# Primary S3 Bucket (us-east-1)
module "primary_bucket" {
  source = "git::https://github.com/dojo360/aws-s3//profiles/s3-bucket?ref=v112.0.0"
  
  optum_tags = module.optum_tags.tags
  bucket     = "${module.optum_resource_name.name}-primary"
  region     = "us-east-1"
  
  # Versioning for replication (REQUIRED)
  versioning_enabled = true
  
  # Encryption (REQUIRED)
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm     = "aws:kms"
        kms_master_key_id = module.kms_primary.key_arn
      }
    }
  }
  
  # Replication configuration
  replication_configuration {
    role = module.replication_role.arn
    
    rules {
      id     = "replicate-all"
      status = "Enabled"
      
      destination {
        bucket        = module.dr_bucket.arn
        storage_class = "STANDARD_IA"
        
        encryption_configuration {
          replica_kms_key_id = module.kms_dr.key_arn
        }
      }
    }
  }
}

# DR S3 Bucket (us-west-2)
module "dr_bucket" {
  source = "git::https://github.com/dojo360/aws-s3//profiles/s3-bucket?ref=v112.0.0"
  
  optum_tags = module.optum_tags.tags
  bucket     = "${module.optum_resource_name.name}-dr"
  region     = "us-west-2"
  
  versioning_enabled = true
  
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm     = "aws:kms"
        kms_master_key_id = module.kms_dr.key_arn
      }
    }
  }
}

7. Monitoring & Diagnostics Pattern

Azure Resource with Full Observability:

# Application Service
module "web_app" {
  source = "git::https://github.com/dojo360/azure-app-service//profiles/linux-web-app?ref=v100.0.0"
  
  optum_tags          = module.optum_tags.tags
  resource_name       = module.optum_resource_name.name
  resource_group_name = azurerm_resource_group.main.name
  
  app_service_plan_id = module.app_plan.id
}

# Application Insights
module "app_insights" {
  source = "git::https://github.com/dojo360/azure-application-insights//profiles/application-insights?ref=v40.0.0"
  
  optum_tags          = module.optum_tags.tags
  resource_name       = "${module.optum_resource_name.name}-insights"
  resource_group_name = azurerm_resource_group.main.name
  
  workspace_id = module.log_analytics.id
}

# Diagnostics Settings
module "web_app_diagnostics" {
  source = "git::https://github.com/dojo360/azure-diagnostics//profiles/web-app-diagnostics?ref=v55.0.0"
  
  optum_tags          = module.optum_tags.tags
  target_resource_id  = module.web_app.id
  
  log_analytics_workspace_id = module.log_analytics.id
  
  # Enable all logs
  enabled_log_categories = ["AppServiceHTTPLogs", "AppServiceConsoleLogs", "AppServiceAppLogs"]
  
  # Enable all metrics
  metric {
    category = "AllMetrics"
    enabled  = true
  }
}

Best Practices Summary

Always start with: Optum Tags + Optum Resource Name modules
Security first: Enable encryption, use private endpoints, implement network security
Use specific versions: Never use branch names or latest
Follow the pattern: VPC/VNet → Security Groups → Private Endpoints → Resources
Enable monitoring: Use diagnostics modules for all resources
Plan for DR: Implement multi-region for critical workloads
Test thoroughly: Validate in lower environments before production

Step 5: Always follow Optum's best practices and security guidelines in the documentation found on Dojo360.

utilize the latest versions of the dojo terraform modules.

Example for S3, review https://github.com/dojo360/aws-s3/releases using the github cli to find the latest version tag, and utilize it in your references.

source="git::https://github.com/dojo360/aws-s3//profiles/s3-bucket?ref=v112.0.0"

These github repo urls are found in the documentation above for each resource.

utilize terraform init -upgrade to get the latest versions of the modules when building or updating.

trouble shooting

if the user needs terraform or needs to upgrade you can utilize tfenv if they need tfenv have them go here https://dojo360.optum.com/foundations/modules/terraform/install-terraform.html?q=terraform

dojo