azure-waf-security-review

name	azure-waf-security-review
description	Review Azure workload security posture against the Well-Architected Framework Security pillar: identity and access, network boundaries, data protection, threat detection, DevSecOps maturity, and policy compliance.
allowed-tools	Read Grep Glob
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-05-09","category":"security"}

Azure WAF Security Review

The Azure Well-Architected Framework Security pillar provides guidance for protecting workload data, systems, and assets while maintaining confidentiality and integrity.

8 Security Design Principles

1. Plan your security readiness — understand security requirements, threats, and compliance obligations before building
2. Design to protect confidentiality — prevent exposure of sensitive data through encryption, access controls, and data classification
3. Design to protect integrity — detect and prevent unauthorized access to systems and data; use identity-based access
4. Design to protect availability — defend against attacks that deny access to workloads; use DDoS protection and redundancy
5. Sustain and evolve your security posture — continuously monitor, learn from incidents, and improve defenses
6. Defense in depth — layer multiple security controls so no single failure exposes the workload
7. Zero trust — verify explicitly, use least privilege access, assume breach
8. Minimize the blast radius — limit the scope of impact from security incidents

Azure Security Service Areas

Identity

• Azure Active Directory (Entra ID), Conditional Access, MFA, Privileged Identity Management (PIM), Managed Identity

Network Security

• Azure Firewall Premium, Azure Front Door + WAF, DDoS Protection Standard, Network Security Groups (NSG), Azure Private Link, Virtual Network Service Endpoints

Data Protection

• Azure Key Vault (keys, secrets, certificates), Azure Disk Encryption, Storage Service Encryption, Always Encrypted (SQL), Microsoft Purview (data governance, sensitivity labels)

Threat Detection

• Microsoft Defender for Cloud, Microsoft Sentinel (SIEM/SOAR), Azure Monitor, Defender for Servers/Containers/SQL/Storage/App Service

Governance

• Azure Policy, Management Groups, Blueprints (deprecated → use Deployment Stacks), Microsoft Cloud Security Benchmark (MCSB)

DevSecOps

• GitHub Advanced Security (CodeQL SAST, secret scanning), Microsoft Defender for DevOps, Container image scanning in ACR, Infrastructure scanning (PSRule for Azure, Checkov)

Assessment Questions

• How do you manage identity and access to your workload resources?
• How do you protect your network boundaries?
• How do you classify and protect your data?
• How do you detect and respond to security threats?
• How do you ensure your workload and supply chain are free of vulnerabilities?
• How do you enforce and validate compliance with security policies?
• How do you segment access and contain blast radius?

Validation Checklist

• All human access uses Entra ID — no local accounts or shared credentials on Azure resources
• Managed Identity used for all Azure service-to-service access — no client secrets or certificates in code
• MFA enforced via Conditional Access for all users with Azure RBAC assignments
• PIM used for privileged roles (Owner, Contributor, User Access Administrator) with approval workflow and just-in-time access
• Azure Policy assignments block public storage accounts, unapproved VM SKUs, non-compliant regions
• Microsoft Defender for Cloud Standard tier enabled across all subscriptions; security score tracked
• All storage accounts and Key Vaults use Private Endpoints — no public network access
• Key Vault soft-delete and purge protection enabled for all key vaults
• Azure Monitor diagnostic settings enabled for all critical resources; logs sent to Log Analytics
• Microsoft Sentinel connected to Log Analytics workspace with MCSB analytics rules enabled
• NSG Flow Logs enabled for all production VNets
• Container images scanned in ACR; Defender for Containers enabled for AKS

Response Shape

Identity and access posture → network security assessment → data protection → threat detection coverage → DevSecOps maturity → policy compliance → prioritized recommendations → open risks

Official Documentation

• https://learn.microsoft.com/azure/well-architected/security/
• https://learn.microsoft.com/security/benchmark/azure/

Security Notes

Read-only advisory. Do not modify Entra ID policies, Conditional Access rules, Azure Policy, or Defender configurations without explicit approval.