Archive
security
The VMs that LAPS cannot reach still have passwords
Windows LAPS handles domain-joined machines. Entra login removes the local credential entirely. This is about the machines neither one reaches, and a tool that rotates their…automationazurepowershell
169.254.169.254: The Cloud Metadata Endpoint
Managed Identity solves credential storage problems. It does not eliminate identity abuse. Managed Identity is one of those Azure features almost everyone recommends — and honestly,…azureknowledgesecurityStop letting your AI guess Azure RBAC
azure-rbac-advisor — a prompt skill that researches least-privilege RBAC for your IaC and doesn’t make up permission strings.* How this started This didn’t start with an…aiazuresecurity
The Privileged Role Exposures Defender Misses
A look at Tier Zero exposure paths that don’t show up in the obvious places — and a tool to find them. Update, September 2026. The script…automationazureentraidLeast Privilege Studio: An Azure RBAC Tool
If you’ve ever set up a service principal in Azure and thought “I’ll just use Contributor for now” — this is for you. It’s not carelessness,…azuresecurityHardening Entra ID with Terraform
A practical implementation guide covering identity baseline, privileged access, conditional access, and monitoring – fully managed as infrastructure as code. Entra ID is the identity backbone…entraidsecurityterraformPrivate Azure Monitoring at Scale — Terraform, Zero Public Traffic
Modern enterprise cloud architectures demand more than just functional monitoring — they demand secure monitoring. By default, the Azure Monitor Agent ships logs and metrics over…securityterraformUsing Azure Firewall as a NVA with Terraform
Using Azure Firewall as a Network Virtual Appliance (NVA) provides a powerful alternative to traditional VNet peering in hub-and-spoke designs. Instead of relying on implicit trust…securityterraformManaging Secrets in Terraform: From Bad to Automated
When it comes to Infrastructure as Code (IaC), Terraform is an incredibly powerful tool. It allows us to define, deploy, and maintain entire environments in a…automationazurepowershell
