RBAC in a modern DevOps world

As I can see in my blog’s stats, and as I can hear from feedback I get from attendees of my talks, Terraform, ARM Templates, and Infrastructure as code obviously are some of the hottest topics to talk and write about nowadays. In this context, I’ve recently often been asked how identity governance, role-based access control, the principle of least privilege, segregation of duties, and security come together in a modern DevOps world. Well, hold my beer…

Howdy folks!

Infrastructure-as-code tools like ARM templates and Terraform are more and more used to deploy infrastructure solutions. In general, these tools run within the context of a service principal so there needs to be an account with high privileges – at least high enough to deploy a given type of resource in your cloud environment. However, in terms of security, it seems to be hard to adhere to the principles security experts tend to suggest, like segregation of duties, role-based access control, the principle of least privilege, and so on. Really? Well, let’s first have a closer look at some of these principles. Continue reading “RBAC in a modern DevOps world”

Microsoft MVP 2019/2020

Hello community,

I know, it’s been a long time without new posts and I’m sorry for that but it’s been a very busy first half of 2019 and for the second six months of the year it’s not really going to change.

My two consecutive MVP diplomas in my home office.
Two consecutive MVP diplomas in my home office.

Continue reading “Microsoft MVP 2019/2020”

Terraform – use Azure KeyVault secrets during deployments

In the second part of my Terraform blog series I explain how to access Azure KeyVault secrets during deployments and how to get your external IP address to refer to in a Network Security Group rule. Happy deploying.

Howdy folks,

in my last article I explained how to configure Terraform so you can use it to securely deploy Azure resources. Today I want to go one step further and provide you some information about how to deploy an Azure VM including all depending resources using Terraform. Continue reading “Terraform – use Azure KeyVault secrets during deployments”

How to securely deploy Azure infrastructures with Terraform

Recently, I have intensely been using Terraform for infrastructure-as-code deployments. Since I’m always looking for security in automation I decided to start a blog series in which I explain how to configure and use Terraform to get the best out of it. This article describes the initial config of an Azure storage account as Terraform remote backend. Happy reading.

Howdy folks,

if you have recently attended one of my talks or workshops you know that in my opinion, DevOps, infrastructure as code, and automated deployments are essential for security in cloud environments. For example, you can only access an Azure KeyVault secret during your VM deployment if you do not use Azure portal. You can chose whatever tool you want, however, in this post I’m going to focus on PowerShell, ARM templates and Terraform. Continue reading “How to securely deploy Azure infrastructures with Terraform”

Microsoft Ignite 2018 – my sessions

Good morning, folks, from beautiful Orlando. It’s T-1 day for Microsoft Ignite Pre-Day to start and I wanted to give you a short heads-up about where you can find and see me speak during the conference week. Continue reading “Microsoft Ignite 2018 – my sessions”

Microsoft Ignite 2018 Session Scheduler is online

Since August 15, Microsoft Ignite 2018 is sold out! As of now, the Schedule Builder is live so make sure you fill your schedule with lots of awesome sessions now! For Microsoft Ignite first-timers I’ve written down some tips to make the most out of their trip to Orlando.

Hey folks,

I’m still more than happy that I have been selected to be part of Microsoft Ignite’s awesome speaker lineup for this year! The conference is sold out since mid of August and as of now more than 1.100 sessions have been published on Microsoft’s TechCommunity. If you want to make sure not to miss my theatre sessions about Azure Governance and Security you can simply filter the session scheduler by my surname or the session codes THR2102 and THR1068. You will only have access to the scheduler after you login with your registration account, though. Continue reading “Microsoft Ignite 2018 Session Scheduler is online”

Audit Windows AD security group changes with Azure Log Analytics

Azure Log Analytics can help you to audit security breaches not only in the cloud but also in onprem Windows Active Directory environments. With this article I give you an idea on how custom views in Azure Log Analytics can help you to see changes at a glance.

I’ve recently been asked to analyze admin behavior in an onprem Windows AD forest. Question was if I knew of a cloud-based solution that could do the job. Me: “Hold my beer…!” Continue reading “Audit Windows AD security group changes with Azure Log Analytics”