Tag: Cloud Security

Azure Health Check – A Free Script to Audit and Visualise Cloud Hygiene

Are you running Azure subscriptions and want a quick, human-friendly overview of your governance, compute, storage, network and Key Vault hygiene?
The Azure Health Check PowerShell script gives you exactly that — scanning multiple subscriptions, flagging weak spots, and producing a clean interactive HTML report (with charts!).

Why this matters

Large and growing Azure estates can easily drift into insecure or unsupported configurations: unprotected VMs, public storage blobs, missing resource locks, orphaned disks, exposed network ports — all of which can lead to security, availability or compliance issues.

Yet manually auditing each subscription is time-consuming. That’s where automation helps. With this script, you get a multi-subscription health summary, scored, visualised and exportable — ideal for periodic reviews, customer readiness checks, or even compliance audits.

Continue reading “Azure Health Check – A Free Script to Audit and Visualise Cloud Hygiene”

Introducing Azure Private Subnets: Enhancing Security by Disabling Default Outbound Access

Azure Networking Tips & Techniques - Part 1

Azure recently announced the general availability of Private Subnet, a new feature that allows you to disable the implicit outbound Internet connectivity for virtual machines in a subnet. In this blog post, we’ll cover:

  1. What Azure Private Subnets are and why they matter

  2. Key benefits of disabling default outbound access

  3. Step-by-step instructions to configure a private subnet via the Azure Portal

  4. Verifying that default outbound has been disabled

What Is an Azure Private Subnet?

Traditionally, when you create a subnet in an Azure Virtual Network (VNet) without any explicit outbound connectivity (such as a NAT gateway, Public IP, or Load Balancer), Azure automatically provides a default outbound access IP for those VMs. While this is convenient, it introduces an implicit egress path—VMs can communicate with public endpoints without you having explicitly configured any egress resources.

A Private Subnet in Azure is simply a subnet where this default outbound access is turned off. Consequently:

  • Any VM deployed within that subnet cannot reach the Internet by default.

  • You must explicitly configure an alternative egress mechanism if VMs need outbound connectivity (e.g., NAT Gateway, Standard Load Balancer, Firewall, or a Public IP assigned directly to the NIC).

By removing the implicit outbound IP, Azure Private Subnets enforce a “zero trust” approach: no VM can communicate externally until you grant it an explicit, auditable path.

Why Disable Default Outbound Access?

  1. Secure by Default
    Default outbound IPs are not customer-owned and can change unpredictably. By disabling implicit egress, you ensure VMs only send traffic externally when you explicitly allow it, reducing your attack surface.

  2. Prevent Data Exfiltration
    In regulated or highly sensitive environments (for example, PCI-DSS or HIPAA workloads), any unsolicited outbound route can pose compliance or security risks. Private Subnets eliminate unexpected data exfiltration channels.

  3. Encourage Explicit Egress Configuration
    When default outbound is disabled, you must provision a known, managed egress mechanism (like a NAT Gateway), which can be tightly monitored for logging, analytics, and cost control. This “explicit-over-implicit” model aligns with best practices for cloud network security.

Continue reading “Introducing Azure Private Subnets: Enhancing Security by Disabling Default Outbound Access”

How to Use Azure Policy for Better Cloud Management

When you work in the cloud, keeping things organised is very important. Azure Policy is a simple tool that helps enforce rules on your resources. In this post, I’ll explain what Azure Policy is and show you a basic example of using it to require a tag on all your resources.

What is Azure Policy?

Azure Policy lets you set rules for your cloud resources. For example, you might want every resource to have a tag called Cost Centre so you know which department it belongs to. If someone tries to create a resource without that tag, the policy can stop it from being created.

This tool is very useful because it helps everyone on your team follow the same guidelines and keeps your cloud resources well organised.

A Simple Example: Requiring a "Cost Centre" Tag

In this example, we’ll create a custom policy that requires every resource to have a Cost Centre tag. If the tag is missing, the resource won’t be allowed.

Overview of the Steps

  1. Create the policy rule file.

  2. Create the policy parameters file.

  3. Create the policy definition in Azure using the Azure CLI.

  4. Assign the policy to a scope.

  5. Check if your policy is working.

Continue reading “How to Use Azure Policy for Better Cloud Management”

How to Implement Azure Bastion to Securely Access Azure Virtual Machines

Bastion

When managing cloud-based virtual machines, ensuring secure access is critical. Exposing RDP/SSH ports over the internet introduces potential security vulnerabilities. Azure Bastion provides a secure, fully managed solution to connect to Azure VMs without needing to expose these ports to the public internet.

What is Azure Bastion?

Azure Bastion is a PaaS service that allows you to securely connect to your Azure Virtual Machines (VMs) using RDP or SSH, directly from the Azure Portal without the need to expose these ports via a public IP.

Minimum Required RBAC Roles for Azure Bastion Access

To connect to a VM using Azure Bastion, the user must have the appropriate permissions. At a minimum, they will need the following role assignments:

  1. Reader role on the target VM: This grants read access to the VM, allowing the user to see the VM’s configuration but not modify it.
  2. Reader role on the network interface (NIC) associated with the VM’s private IP address: This ensures the user can read network information for the VM.
  3. Reader role on the Azure Bastion resource: This grants access to the Bastion host itself, allowing the user to initiate connections through Bastion.

If the VM is in a peered virtual network (cross-VNet connections), the following additional role assignment is required:

  1. Reader Role on the virtual network (VNet) of the target VM: This is necessary if you are connecting to a VM across VNet peering.

Continue reading “How to Implement Azure Bastion to Securely Access Azure Virtual Machines”

Integrate Other Clouds with Azure Using the Multicloud Connector

multi-cloud

Introduction

As businesses adopt multi-cloud strategies to leverage the unique strengths of various cloud providers, managing these environments can become complex. Microsoft’s Azure Arc Multicloud Connector provides a streamlined solution to integrate and manage resources across different cloud platforms, specifically focusing on AWS. This blog post will explore the capabilities of the Azure Arc Multicloud Connector and guide you through a step-by-step lab to connect AWS resources to Azure.

Key Features of the Multicloud Connector

1. Unified Inventory: The Multicloud Connector automatically collects metadata from external cloud resources, providing a comprehensive view within the Azure portal. This helps in maintaining a consistent inventory across cloud environments.
2. Arc Onboarding: It facilitates the onboarding of AWS EC2 instances to Azure Arc, allowing advanced management features like policy enforcement, monitoring, and configuration management.
3. Consistent Governance: Apply Azure policies and role-based access controls (RBAC) to resources in external clouds, ensuring uniform security and compliance standards across all environments.
4. Enhanced Management: Utilize Azure Arc capabilities for onboarded resources, including vulnerability scanning and deployment automation.

Implementation Steps

Prerequisites

– An Azure subscription with Contributor access.
– An AWS account with AmazonEC2FullAccess permissions.
– Azure Arc and required resource providers registered (Microsoft.HybridCompute, Microsoft.HybridConnectivity, Microsoft.AwsConnector).

image

Continue reading “Integrate Other Clouds with Azure Using the Multicloud Connector”