Identity and Access

Identity And Access

The lab includes both Azure access controls and a Windows identity spoke for domain controller scenarios.

Identity Landing Zone

Source:

• landing-zones/identity-management
• landing-zones/identity-management/core
• modules/compute/windows-vm
• modules/networking/nsg
• modules/networking/route-table

Resources

Resource	Purpose
Identity VNet	Dedicated identity spoke
Domain controller subnet	Hosts DC VMs
DC NSG	Allows required AD DS traffic from hub/on-prem prefixes
DC01	Primary Windows Server domain controller
DC02	Optional secondary domain controller
Identity route table	Sends egress to Azure Firewall when enabled

Default Addresses

Item	Default
Identity VNet	10.1.0.0/16
Domain controller subnet	10.1.1.0/24
DC01 IP	10.1.1.4
DC02 IP	10.1.1.5

Profile examples:

• cheap-lab.tfvars identity settings
• lab.tfvars identity settings
• prod.tfvars secondary DC setting

Azure RBAC

Custom RBAC roles are created when deploy_rbac_custom_roles = true.

Source:

• landing-zones/governance/main.tf
• modules/rbac

Current custom role outputs:

• network_operator_role_id
• backup_operator_role_id
• monitoring_reader_role_id

Source: modules/rbac/outputs.tf

GitHub Actions Azure Identity

The CI pipeline should authenticate with OIDC federation.

Workflow permissions:

permissions:
  contents: write
  pull-requests: write
  security-events: write
  id-token: write

Source: .github/workflows/terraform.yml

Required GitHub secrets:

• AZURE_CLIENT_ID
• AZURE_TENANT_ID
• AZURE_SUBSCRIPTION_ID
• TF_STATE_RG
• TF_STATE_SA

Do not use a long-lived AZURE_CREDENTIALS JSON secret.

Least Privilege Recommendations

For a lab subscription:

• Grant the federated GitHub identity only the roles needed for the selected profile.
• Management groups require elevated rights and should be disabled in cheap-lab.
• Role assignments and policy assignments may require Owner or User Access Administrator.
• Restrict state storage permissions to the Terraform automation identity.
• Separate plan-only and apply identities if you later adapt this repo for production workflows.

Validation

Terratest checks:

• Hub VNet exists.
• Identity VNet exists.
• Hub VNet has peerings.

Source: tests/landing_zone_test.go

Recommended additional checks:

• Confirm no unexpected public IPs on identity VMs.
• Confirm domain controller NSG rules are scoped to required prefixes.
• Confirm custom RBAC roles are not assigned to broad principals by default.