Security Operations

Security Operations

This page turns the Security Model into operational procedures. It is intended for day-to-day lab use, pull request review, and incident response.

Security Control Map

Pull Request Security Review

Review every Terraform pull request with this sequence:

1. Check whether a public IP, public network access, RDP rule, Load Balancer NAT rule, Application Gateway, VPN Gateway, Firewall, or AKS cluster is being added.
2. Confirm the selected profile is intentional.
3. Confirm allowed_jumpbox_source_ips does not include 0.0.0.0/0.
4. Confirm enable_lb_rdp_nat_rules = false unless there is a documented temporary exception.
5. Confirm Key Vault, SQL, and Storage remain private-first.
6. Confirm diagnostics are attached to new durable resources.
7. Confirm cost impact is acceptable.
8. Confirm no secret-like values are included in tfvars, examples, docs, or workflow logs.

Break-Glass Public RDP Procedure

Public RDP should be avoided. If it is temporarily required:

Requirement	Rule
Scope	Use a single trusted CIDR, not 0.0.0.0/0
Duration	Keep the window short and remove after the test
Approval	Document reason, owner, and expected end time
Controls	Enable logging and verify NSG rule scope
Cleanup	Revert the variable change and run a new plan

Do not keep allow_public_rdp_from_internet = true in a reusable profile.

Secret Exposure Procedure

If a secret is found in the repo, workflow logs, issue, or wiki:

1. Revoke or rotate the exposed secret immediately.
2. Remove the value from the current branch.
3. Check GitHub secret scanning and Gitleaks output.
4. Review Azure sign-in logs and resource activity.
5. Replace automation credentials with OIDC where possible.
6. Update docs so the same mistake is harder to repeat.

Do not treat deleting a file or force-pushing history as sufficient; rotation is the important step.

Public Data Plane Review

For each shared service:

Service	Review question	Expected answer
Key Vault	Is public access still needed?	No, prefer Private Endpoint
SQL	Is public network access enabled?	No
SQL	Is Allow Azure Services enabled?	No
Storage	Are blobs publicly readable?	No
Storage	Is HTTPS required?	Yes
Private DNS	Are zones linked to the right VNets?	Yes

Monitoring Review

After apply, confirm:

• Log Analytics workspace exists.
• Diagnostic settings exist for Key Vault, SQL, Storage, NSGs, AKS, Firewall, App Gateway, and VPN where deployed.
• Alerts target real deployed resource IDs.
• Flow logs are intentional because they can add cost.
• Action groups have correct receivers.

Security Evidence To Keep

For a meaningful lab record, keep:

• GitHub Actions run URL.
• Terraform plan summary.
• Cost estimate.
• Security scan output.
• OPA policy output.
• Resource inventory artifact.
• Manual validation notes for private DNS and public exposure.

When To Stop And Redesign

Stop and redesign instead of applying if:

• A plan adds broad public management access.
• The plan destroys shared state, identity, or networking unexpectedly.
• A profile enables multiple expensive edge services without a cost reason.
• Policy gates are bypassed to make a risky plan pass.
• A data-plane service becomes public while Private Endpoints are enabled.