Docs

Appearance

ops-automation Repository Overview ​

Purpose ​

This document describes the ops-automation repository — the consolidated home for all scheduled automation jobs across the Cirius Group infrastructure. All scheduled workflows live here, with shared OIDC secrets and a shared SES email pipeline.

Repository Consolidation Rationale ​

Previously, automation was spread across multiple repos (e.g., hipaa-audit). This created maintenance overhead: duplicate OIDC secrets in each repo, shared scripts copied across repos, and no single view of all scheduled jobs. All scheduled automation is now consolidated here.

Repo structure (6 repos total):

RepoPurpose
azure-infraTerraform for Azure production
aws-infraTerraform for AWS DR (7 accounts)
azure-dde-infraTerraform for DDE tenant
bedrock-docsArchitecture, runbooks, compliance documentation
ops-automationAll scheduled jobs (this repo)
palo-alto-configsAutomated firewall config backup history (read-only archive)

Scheduled Workflows ​

Weekly HIPAA Compliance Audit (Operational) ​

Schedule: Monday 08:00 UTC Authentication: OIDC — Azure prod tenant, Azure DDE tenant, AWS management account

Audits HIPAA compliance across all environments and delivers a consolidated HTML email via SES.

Azure compliance audit:

  • Azure Policy HIPAA/HITRUST initiative compliance state via az policy state summarize
  • Pass/fail/non-compliant counts per control family
  • Week-over-week compliance score trending

AWS compliance audit:

  • AWS Security Hub findings filtered to NIST 800-53 (covers HIPAA control families)
  • Findings summarized by severity and control family
  • New failures flagged since last weekly run

GitHub security audit:

  • Repo settings audit (branch protection, secret scanning, Dependabot)
  • Checkov HIPAA scans across all three infra repos
  • Org-level security configuration

Additional audits included in HIPAA email:

  • Azure backup job status (Recovery Services Vault job health)
  • AWS backup reporting
  • svcs1 CA policy status

Email delivery: Dashboard-style summary delivered via SES from Logging account (038901680748, us-west-2).

Monthly Cloud Cost Report (Operational) ​

Schedule: 1st of each month, 12:00 UTC Authentication: OIDC — Azure prod tenant, Azure DDE tenant, AWS management account

Queries cost APIs across all three environments and delivers a consolidated HTML email.

Azure cost queries (both tenants):

  • Azure Cost Management REST API per subscription
  • Current month + previous month for trend comparison
  • Azure Advisor cost recommendations
  • Waste detection: unattached disks, unattached public IPs, deallocated VMs

AWS cost queries (7-account org):

  • AWS Cost Explorer API — org-wide costs grouped by service and linked account
  • Per-account breakdown across all 7 accounts
  • Waste detection: idle EC2, unattached EBS, old snapshots, unused Elastic IPs
  • AWS Cost Anomaly Detection findings

Display name overrides:

  • CiriusCustomers → Dashboard
  • Billings → AVD
  • Empty Azure service names → Prepaid/Reserved Compute

Report storage: Previous month results stored as GitHub Actions artifacts (13-month retention for year-over-year comparison).

Cortex XDR Weekly Security Email (Operational) ​

Schedule: Weekly Secrets required: CORTEX_API_KEY, CORTEX_API_KEY_ID, CORTEX_FQDN

Weekly security report pulling incident and alert data from Cortex XDR via API. Delivered via SES.

PIM and Privileged Access Audit (Operational) ​

Schedule: Weekly, Mondays Authentication: OIDC — both tenants

Workflow: pim-audit.yml / pim-audit.ps1 / build-pim-email.py

Audits privileged access across both Azure tenants and delivers a weekly email report.

Coverage:

  • CISA privileged role list
  • Permanent PIM assignments (should be time-bound)
  • Stale accounts inactive >90 days
  • Accounts without MFA
  • Service principals with privileged roles

Both production (ciriusgroup.com) and DDE (ciriusdde.com) tenants are audited.

Monthly Penetration Testing (Operational) ​

Schedule: Monthly Tools: Nuclei (ProjectDiscovery) + Nmap

Scheduled scanning of all public-facing endpoints.

Scope:

  • 9 endpoints including customer-facing AVD and CloudPC
  • AWS endpoint discovery operational
  • No IP whitelisting — mirrors real attacker perspective
  • Pre-scan notification email sent at scan start

Operational notes:

  • CloudPC is in scope
  • Findings feed into the weekly compliance email on scan weeks

Maester M365 Security Audit (Operational) ​

Schedule: Weekly, alongside HIPAA audit Authentication: Workload Identity Federation (OIDC — no secrets) Tool: maester365/maester-action@v1.0.1

Runs 280+ tests against Microsoft 365 tenants in both production and DDE.

Coverage:

  • Entra ID: Conditional Access validation, EIDSCA tests, privileged role assignments, PIM configuration
  • Intune: Diagnostic settings, Windows Feature Update policies, device compliance
  • Exchange Online: CISA baseline transport rule checks

Authentication note: The maester-action handles Azure auth independently — do NOT call Connect-AzAccount in the workflow, as this causes an Exchange auth regression.

Current scores:

  • Production: ~46.4% effective pass rate (Review bucket reduced to 1 unmatched test)
  • DDE: Running — baseline being established

Cloud Vulnerability Report (Operational) ​

Full vulnerability dashboard delivering a consolidated HTML email covering:

  • MDE blocks (all Azure servers)
  • Cortex XDR blocks
  • Arctic Wolf vulnerability data (all devices)
  • Device counts accurate (total_device_count denominator)

All devices including DashboardVM20 appearing correctly.

Palo Alto Config Backup & Security Audit (Operational) ​

Schedule: Daily (config backup) + Weekly (security audit) Compute: Azure Function (azure-infra) + Lambda (aws-infra) in management subnets

Config backup must run from within management subnets — GitHub Actions runners cannot reach private management IPs.

Config backup:

  • Daily PAN-OS XML API export from all four firewalls
  • Configs committed to palo-alto-configs repo via GitHub API (path: firewall-configs/)
  • paths-ignore applied to prevent config commits from triggering deployment pipelines
  • Change detection — SES email alert if diff detected
  • Backup and audit jobs decoupled via S3 intermediate (same pattern as AD audit)

Security audit:

  • Custom XML-parsing checks (replacing pan_analyzer — no reliable pip package)
  • Weekly automated run against latest config exports
  • BPA quarterly review process established
  • Custom HIPAA policy audits operational

See Palo Alto Config Backup & Audit for full architecture.

Backup Verification (Operational — via HIPAA Audit Email) ​

Backup job status is included in the weekly HIPAA compliance audit email:

  • Azure Recovery Services Vault job health per subscription
  • Veeam replication status
  • Any failed or missed jobs surface as compliance findings

Shared Infrastructure ​

SES Email Delivery ​

All email delivery routes through Amazon SES in the Logging account (038901680748, us-west-2).

Known constraint: send-raw-email hits OS argument length limits with large MIME payloads. Use --cli-input-json file:// with base64 streamed to file rather than shell variable interpolation for large emails.

OIDC Authentication ​

The ops-automation repo authenticates to all three environments via OIDC:

  • Azure prod tenant app registration: repo:Cirius-Group-Inc/ops-automation:ref:refs/heads/main
  • Azure DDE tenant app registration: repo:Cirius-Group-Inc/ops-automation:ref:refs/heads/main
  • AWS IAM role trust policy: repo:Cirius-Group-Inc/ops-automation:ref:refs/heads/main

The Maester/audit app registration has additional Graph permissions (19 Microsoft Graph permissions, Exchange.ManageAsApp, View-Only Configuration role) beyond the standard OIDC credential.

See OIDC Authentication for trust policy details.

GitHub Actions Minutes Budget ​

GitHub Enterprise provides 50,000 Actions minutes/month. Penetration testing runs monthly to stay within budget.

Operational Notes ​

Multiline commands: Fail in Cloud Shell (PowerShell Core on Linux) and local Windows. Always use single-line versions for any scripts that run in these environments.

Azure vs AWS date handling: Azure Cost Explorer uses inclusive end dates; AWS uses exclusive end dates (first of next month). Account for this in any date range queries.

string.Template conflict with HTML: HTML templates use $ signs that conflict with Python's string.Template. Use with .replace() instead.

Bash subshell variable bug: Piping into while loops loses variable modifications. Use process substitution instead.

Document History ​

DateChangeAuthor
March 2026Updated all workflow statuses to Operational; added Cortex XDR weekly email; added Cloud Vulnerability Report; marked Palo Alto config backup as Operational; updated Maester to cover both tenants with Connect-AzAccount regression note; updated penetration testing to Operational with CloudPC scope and pre-scan notification; updated backup verification to Operational via HIPAA audit email; added operational notes sectionRory
March 2026Initial draft — repo consolidation rationale, all scheduled workflow descriptions, shared infrastructureRory

Internal use only — Cirius Group