TL;DR
Remember to associate a user defined route and enable service endpoints on your API Management (APIM) subnet when deploying in an internal network in a Virtual WAN or other forced routing scenario. This is necessary for the management traffic for your APIM.
... Continue ReadingTL;DR
Stop providing your Terraform identities with owner permissions on your subscriptions! Use delegated rbac admin instead so they can assign a subset of roles to other identities.
... Continue ReadingTL;DR
Fortify your Azure Monitoring with custom log ingestion to log analytics workspaces! You only need a workspace, data collection endpoint, and a data collection rule. Terraform example code available here
... Continue ReadingTL;DR
TL;DR
Terraform supports using Entra ID authentication to Azure Storage Accounts, and you can easily enable it.
... Continue ReadingTL;DR
List Azure role assignments and custom role definitions recursively with PowerShell and Azure CLI.
... Continue ReadingTL;DR
Lint your code with megalinter for more consistent, secure, and cleaner looking projects!
... Continue ReadingTL;DR
Use different managed identities with different levels of permissions for your workflows. Limit damage if someone gets access, and prevent unintended consequences.
... Continue ReadingTL;DR
Just recently discovered KICS, and it simplifies scanning your IaC for misconfigurations or security issues. You can find more information here.
... Continue ReadingTL;DR
Install and enable addons to VSCode for increasing your security posture already before any code is committed to any repository. Checkov and TFSec are two simple and free options you can use.
... Continue Reading