Tag
Azure
Azure cloud architecture, networking, and compliance — Hub & Spoke, Firewall, Private Link, and zero-trust patterns.
8 articles
- Acmebot härten für ISO 27001 & NIS2: Zero-Trust-Zertifikate in Azure22 Sept 2026Der Standard-Acmebot-Deploy hat drei öffentliche Angriffsflächen. Für ISO 27001, KRITIS oder NIS2 reicht das nie. So baust du Let's-Encrypt-Automatisierung mit Private Link, VNet Integration und Private DNS - komplett mit Terraform.
- Private AKS on Azure: No Public API Server, No Public Node IPs, No Default Outbound07 Sept 2026A production AKS cluster with private_cluster_enabled, forced-tunneled node egress via a Route Table, and private-endpoint-only ACR/Key Vault — the workload cluster that sits behind a Hub & Spoke and an Azure Firewall.
- Azure Logic App Standard: Private Storage Needs Four Private Endpoints11 Aug 2026A Logic App Standard booted into an HTTP 403 at every restart, and the portal designer only showed a generic error. Root cause: a private Storage Account needs four Private Endpoints - blob, file, queue, and table - not just the two that look obvious. Here's the postmortem and the Terraform that prevents it.
- NIS2 Article 21 in Azure: Implementing Network Security Controls with Terraform17 May 2026A technical deep-dive into the network security requirements of NIS2 Article 21 and how to implement them in Azure using Terraform - with concrete code, not legal theory.
- Zero-Trust RAG: Defeating the Shared Private Link Deadlock in Azure Terraform16 May 2026How to programmatically approve Azure AI Search Shared Private Links using AzAPI, and why your AI architecture will fail an audit without proper Identity Chaining.
- Breaking the Loop: Solving Circular Dependencies in Azure Firewall Routing07 May 2026How to implement Azure Firewall Forced Tunneling in Terraform without triggering cycle errors, and why a simple 0.0.0.0/0 route will instantly break your Windows VMs.
- Surviving Azure Policies: Zero-Trust Hub & Spoke with Terraform03 May 2026How to build an enterprise-grade Azure network architecture that blocks internet traffic by default and survives aggressive DeployIfNotExists (DINE) policies - without breaking your CI/CD pipeline.
- Hardening Azure Acmebot for ISO 27001 & NIS2 Compliance01 May 2026A deep dive into architecting a Zero-Trust Let's Encrypt automation using Terraform, Azure Private Link, and VNet Integration.