Reference Architectures

# Three-tier VNet: one subnet per tier, each bound to its own NSG
resource "azurerm_subnet" "public" {        # Application Gateway only
  name                 = "public-subnet"
  address_prefixes     = ["10.0.1.0/24"]
  virtual_network_name = azurerm_virtual_network.main.name
  resource_group_name  = azurerm_resource_group.main.name
}
resource "azurerm_subnet" "app" {
  name                 = "app-subnet"
  address_prefixes     = ["10.0.10.0/24"]
  virtual_network_name = azurerm_virtual_network.main.name
  resource_group_name  = azurerm_resource_group.main.name
}
resource "azurerm_subnet" "data" {          # no outbound internet
  name                 = "data-subnet"
  address_prefixes     = ["10.0.20.0/24"]
  virtual_network_name = azurerm_virtual_network.main.name
  resource_group_name  = azurerm_resource_group.main.name
}

# NSG rule bodies omitted; the decisions are:
#   appgw-nsg : allow 443/tcp  inbound from *             (internet → App Gateway)
#   app-nsg   : allow 8080/tcp inbound from 10.0.1.0/24   (App Gateway subnet only)
#   db-nsg    : allow 1433/tcp inbound from 10.0.10.0/24  (app subnet only)
#   db-nsg    : deny  */*      outbound                   (no internet egress)

# Rules only take effect once each subnet is associated with its NSG
resource "azurerm_subnet_network_security_group_association" "public" {
  subnet_id                 = azurerm_subnet.public.id
  network_security_group_id = azurerm_network_security_group.appgw.id
}
resource "azurerm_subnet_network_security_group_association" "app" {
  subnet_id                 = azurerm_subnet.app.id
  network_security_group_id = azurerm_network_security_group.app.id
}
resource "azurerm_subnet_network_security_group_association" "data" {
  subnet_id                 = azurerm_subnet.data.id
  network_security_group_id = azurerm_network_security_group.db.id
}

# (NSG Flow Logs and the Defender for Cloud plans are elsewhere in monitoring.tf.)

# Alert on real 5xx responses (Application Gateway ResponseStatus, filtered to
# HttpStatusGroup=5xx) — UnhealthyHostCount measures backend health, not errors.
resource "azurerm_monitor_metric_alert" "high_5xx" {
  name                = "high-5xx-rate"
  resource_group_name = azurerm_resource_group.main.name
  scopes              = [azurerm_application_gateway.main.id]
  severity            = 1
  window_size         = "PT15M"
  criteria {
    metric_namespace = "Microsoft.Network/applicationGateways"
    metric_name      = "ResponseStatus"
    aggregation      = "Total"
    operator         = "GreaterThan"
    threshold        = 50
    dimension {
      name     = "HttpStatusGroup"
      operator = "Include"
      values   = ["5xx"]
    }
  }
  action {
    action_group_id = azurerm_monitor_action_group.security_alerts.id
  }
}
# Failed administrative (control-plane) operations. Activity Log does NOT
# contain sign-ins — monitor sign-in risk with Entra ID diagnostic logs.
resource "azurerm_monitor_activity_log_alert" "admin_operation_failure" {
  name                = "admin-operation-failures"
  resource_group_name = azurerm_resource_group.main.name
  scopes              = ["/subscriptions/${data.azurerm_subscription.current.subscription_id}"]
  criteria {
    category = "Administrative"
    level    = "Error"
  }
  action {
    action_group_id = azurerm_monitor_action_group.security_alerts.id
  }
}

{
  "properties": {
    "displayName": "Deny Dangerous Actions",
    "metadata": {
      "comment": "Confirm the Microsoft.Security/securityContacts/alertNotifications.state alias against your target tenant before enforcing (az policy alias list)."
    },
    "policyType": "Custom",
    "mode": "All",
    "policyRule": {
      "if": {
        "anyOf": [
          { "allOf": [
            { "field": "type", "equals": "Microsoft.Security/securityContacts" },
            { "field": "Microsoft.Security/securityContacts/alertNotifications.state", "equals": "Off" }
          ]},
          { "allOf": [
            { "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
            { "field": "Microsoft.Storage/storageAccounts/allowBlobPublicAccess", "equals": true }
          ]},
          { "allOf": [
            { "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
            { "not": { "field": "Microsoft.Storage/storageAccounts/encryption.services.blob.enabled", "equals": true } }
          ]}
        ]
      },
      "then": { "effect": "Deny" }
    }
  }
}

# Cloudflare Zero Trust Access application (ZTNA, replaces VPN)
resource "cloudflare_zero_trust_access_application" "internal_app" {
  account_id                = var.account_id
  name                      = "Internal Dashboard"
  domain                    = "dashboard.internal.example.com"
  type                      = "self_hosted"
  session_duration          = "1h"
  auto_redirect_to_identity = true
  policies = [
    { id = cloudflare_zero_trust_access_policy.corp_policy.id, precedence = 1 }
  ]
}

# Require corporate SSO identity plus device posture
resource "cloudflare_zero_trust_access_policy" "corp_policy" {
  account_id = var.account_id
  name       = "Corporate Access"
  decision   = "allow"
  include = [
    { login_method = ["oidc"] }  # SSO via Okta/Entra
  ]
  require = [
    { device_posture = { id = cloudflare_zero_trust_device_posture_rule.disk_encryption.id } }
  ]
}

# Device posture rules moved under the zero_trust namespace in provider v5.
# Add os_version / firewall rules the same way.
resource "cloudflare_zero_trust_device_posture_rule" "disk_encryption" {
  account_id = var.account_id
  name       = "Require disk encryption"
  type       = "disk_encryption"
  match { platform = "windows" }
  input { require_all = true }
}

# Enforce mTLS for all traffic in the mesh
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT   # All traffic must be mTLS

---
# Only allow order-svc to call payment-svc.
# A single ALLOW policy is already default-deny for the selected workload:
# once an ALLOW policy matches a pod, any request that no ALLOW rule matches
# is rejected. No separate DENY policy is needed — a DENY policy only carves
# explicit exceptions out of an existing allowance.
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: payment-svc-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: payment-svc
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/order-svc"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/api/v1/charges", "/api/v1/refunds"]

# Gates 1-2: source. Third-party actions are pinned by commit SHA, not a tag.
name: Secure CI/CD Pipeline
on: [push, pull_request]

permissions:
  contents: read
  # Fork PRs receive neither repository secrets nor security-events: write,
  # so secret scanning / SARIF upload are best-effort on fork contributions.
  security-events: write

jobs:
  source-gates:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      with: { fetch-depth: 0 }        # full history for Gitleaks
    - name: Gate 1 — secrets scan
      uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Gate 2 — SAST (Semgrep)
      run: |
        docker run --rm -v "$PWD:/src" -w /src semgrep/semgrep \
          semgrep scan --error --config p/security-audit --config p/owasp-top-ten
    - name: Gate 2 — SCA (Trivy)
      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
      with:
        scan-type: fs
        scan-ref: .
        severity: CRITICAL,HIGH
        exit-code: 1

# ADR-{number}: {Title}

## Status
Proposed | Accepted | Deprecated | Superseded by ADR-{n}

## Context
What is the problem or situation that requires a decision?
What are the security requirements and constraints?

## Decision Drivers
- Compliance requirement (e.g., SOC 2, PCI DSS)
- Threat model finding (reference TM-{n})
- Performance / scalability requirement
- Operational complexity budget

## Considered Options
1. **Option A** — Description, pros, cons
2. **Option B** — Description, pros, cons
3. **Option C** — Description, pros, cons

## Decision
We chose **Option B** because...

## Security Implications
- **Risk accepted**: What residual risk remains?
- **Controls required**: What must be implemented alongside?
- **Monitoring**: What should we watch for?

## Consequences
- Positive: What improves?
- Negative: What trade-offs are we making?
- Related decisions: Links to dependent ADRs