Docs

Appearance

Azure Infrastructure Overview ​

Purpose ​

This document describes the Azure infrastructure architecture for the primary production environment. All infrastructure is managed as code using Terraform and deployed via GitHub Actions CI/CD pipelines.

Region ​

The primary Azure environment runs in US West 2, including Terraform state storage.

Subscription Structure ​

The Azure environment uses multiple subscriptions for resource isolation and RBAC boundary enforcement:

SubscriptionPurposeKey Resources
ProductionProduction workloadsVMs, storage, app resources
DevelopmentDev/test workloadsDev VMs, test databases
IdentityDirectory servicesEntra ID domain services VMs
FirewallNetwork securityPalo Alto VM-Series, hub VNet
LoggingCentralized monitoringLog Analytics, Event Hub, archive storage, Defender
MainIAM and stateOIDC federation, Key Vault, Terraform state storage
DashboardDashboard environment[VERIFY: specific workloads]

Each subscription has its own Terraform environment directory in the azure-infra repository, its own backend state, and its own CI/CD deploy workflow triggered by path-based changes.

Repository ​

RepositoryRegionPurpose
azure-infraUS West 2Primary production infrastructure

See DDE Infrastructure Overview for the DDE environment.

Core Components ​

Azure Active Directory / Entra ID ​

Entra ID provides identity and access management for the environment. Key configurations include:

  • OIDC federated identity credentials for GitHub Actions CI/CD authentication — no long-lived credentials are stored in GitHub secrets
  • Service principals scoped to specific infrastructure repositories
  • Role-based access control (RBAC) applied at the resource group level

Networking ​

The network follows a hub-spoke topology with traffic inspection enforced through Palo Alto firewalls.

VNet Structure ​

Hub VNet (US West 2)
├── Firewall Subnet        ← Palo Alto VM-Series
├── Management Subnet      ← Management zone traffic
└── Gateway Subnet         ← Connectivity

Spoke VNet(s)
└── Workload Subnets       ← Production workloads

Palo Alto Firewall Zones ​

All traffic between network segments passes through the Palo Alto VM-Series firewall. The firewall is configured with three zones:

ZonePurpose
untrustExternal / internet-facing traffic
trustInternal production workloads
mgmtFirewall and infrastructure management

Security policies control traffic flow between zones. No direct trust-to-untrust traffic is permitted without explicit policy allow rules. Management zone access is restricted to authorized admin sources only.

See Palo Alto Firewall Overview for policy structure and change request procedures.

Virtual Machines ​

Production workloads run on Windows Server VMs in Azure. VMs are:

  • Deployed via Terraform using standardized configurations
  • Joined to the domain via Entra ID where applicable
  • Placed in the appropriate subnet based on workload classification
  • Base images built in the dev environment before production deployment

Storage Accounts ​

Storage AccountPurpose
Terraform stateStores .tfstate files for azure-infra repo
Application storageProduction workload data as required

Key Vault ​

Azure Key Vault is used for secrets management. Keys, certificates, and secrets used by production workloads are stored in Key Vault rather than in application configs or Terraform code.

Azure Policy ​

Azure Policy is configured on the subscription to enforce compliance guardrails at the platform level. Policy enforcement operates as a runtime complement to Checkov, which scans at the IaC layer before deployment.

The HIPAA/HITRUST and ISO 27001 policy initiatives are assigned to all production subscriptions. Azure Policy evaluates deployed resources against these frameworks continuously, complementing Checkov's pre-deploy IaC scanning.

Security Architecture ​

Defense in depth is achieved through layered controls:

LayerControlTool
IaC (pre-deploy)Compliance scanningCheckov
NetworkTraffic inspectionPalo Alto VM-Series
NetworkSegmentationVNets, NSGs, Subnets
IdentityAccess controlEntra ID, RBAC
PlatformPolicy enforcementAzure Policy
SecretsSecrets managementKey Vault

Compliance Posture ​

The Azure environment is in scope for SOC2, HIPAA, and HITRUST compliance. Key controls implemented:

  • Encryption at rest on storage accounts and managed disks
  • Network segmentation via hub-spoke topology and firewall zones
  • Identity-based access with OIDC for automated deployments
  • Infrastructure-as-code enforcing consistent, auditable configuration
  • Checkov scanning on all PRs to prevent non-compliant resources from being deployed

Document History ​

DateChangeAuthor
March 2, 2026Added Subscription Structure section with 7-subscription model and purposesRory
March 2026Updated Azure Policy section to reflect deployed HIPAA/HITRUST and ISO 27001 initiatives, fixed DDE infrastructure linkRory
February 2026Initial draftRory

Internal use only — Cirius Group