Skip to main content

Network & Infrastructure Security

Status

Owner: Tech lead · Status: draft · Canonical source: flezi.infra.iac/docs/architecture-snapshot-14-08-2026.md

Describes network isolation, firewall perimeter rules, and infrastructure hardening across Azure cloud resources.

Virtual Network (VNet) Topology​

The environment operates within dedicated Virtual Networks with strict subnet isolation:

  1. Ingress Subnet: Terminates external TLS 443; protects application backend.
  2. Backend Application Subnet: Hosts private API services; no direct public IP.
  3. Sandbox Subnet: Isolated container runners with locked-down outbound egress rules.
  4. Data Tier Subnet: Hosts PostgreSQL and Redis via Azure Private Endpoints.

Existing Controls​

  • Network Security Groups (NSGs) enforce Default Deny Inbound rules across all subnets.
  • SSH ports closed to the public Internet; administrative access via Azure Bastion or corporate VPN.
  • Azure Container Registry (ACR) disables admin account access, authenticating strictly via Managed Identity.

Evidence (Files & Configuration)​

  • flezi.infra.iac/modules/network/
  • flezi.infra.iac/docs/architecture-snapshot-14-08-2026.md

Limitations & Roadmap​

  • Deployment of Azure Web Application Firewall (WAF) policies for automated L7 DDoS protection.